@junghanacs/entwurf 0.23.0 → 0.24.0

package/docs/acp-backend-rail.md

@@ -92,11 +92,11 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.20.0` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| Entwurf package | `0.24.0` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.86.0`, peer `>=0.86.0 <0.87` | **exact** oracle + **closed range** | built and certified against 0.86.0; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.76.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
-| Claude Agent SDK | `0.3.257` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.79.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
+| Claude Agent SDK | `0.3.274` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
 | Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
@@ -168,6 +168,83 @@ different reasons, and collapsing them would hide a real risk**:
   `resolvedProvider` and up onto the unconditional `session/new` path. entwurf passes `settings`
   as an OBJECT (`tool-surface.ts:153`), so the branch is never taken. That makes "entwurf never
   hands `settings` as a path" a contract rather than an accident; it is stated at that call site.
+- **0.77.0's BREAKING change does not reach us, twice over.** `claudeCode.options.agent` is no
+  longer forwarded — the adapter now shallow-copies the options object and `delete`s `agent` on
+  the unconditional `session/new` path (`[측정 2026-09-18, 0.79.0 dist/acp-agent.js:5934-5941 직독]`).
+  entwurf's `buildClaudeSessionMeta` never sets that key (`tool-surface.ts:145-199` 직독: the
+  literal carries `model`/`tools`/`settingSources`/`settings` plus optional `plugins`/
+  `disallowedTools`/`extraArgs`, and nothing else), and the removed agent-picker exports
+  (`DEFAULT_AGENT_ID`, `AGENT_CONFIG_ID`, `BUILTIN_AGENT_NAMES`, `discoverCustomAgents`) are
+  imported nowhere: `[측정 2026-09-18]` `git grep -c` over `pi-extensions/`, `test/`, `scripts/`,
+  `mcp/` is **0**. We never imported the adapter as a library at all — we spawn its binary.
+- **0.77.0's `allowDangerouslySkipPermissions` opt-out is a new lever we deliberately do not
+  pull, and our effective permission mode is unchanged.** 0.76.0 sent
+  `allowDangerouslySkipPermissions: ALLOW_BYPASS` unconditionally and computed
+  `initialPermissionMode = creationOpts.permissionMode ?? resolvePermissionMode(settings…)`.
+  0.79.0 computes `allowBypass = ALLOW_BYPASS && sessionMeta?.claudeCode?.options?.allowDangerouslySkipPermissions !== false`
+  and routes the whole thing through `resolvePermissionMode(…, logger, allowBypass)`
+  (`[측정 2026-09-18, 0.79.0 dist/acp-agent.js:5932-5933 직독]`). entwurf sets that option
+  nowhere, so `undefined !== false` holds and `allowBypass === ALLOW_BYPASS`;
+  `ALLOW_BYPASS = !IS_ROOT || !!process.env.IS_SANDBOX` is **byte-identical** between the two
+  versions (`dist/permissions/modes.js` 직독). Our overlay pins
+  `permissions.defaultMode: "bypassPermissions"` (`overlay.ts:122`), which resolves the same
+  under both. The lever now EXISTS for a host that wants a non-bypass sibling; declaring it is a
+  separate axis, not a one-line flip, and nothing in this bump takes it.
+- **0.77.0's system-reminder strip never touches our first-user-message augment.**
+  `INJECTED_CONTEXT_MARKERS = ["system-reminder"]` joins the local-command markers in
+  `stripMarkerTags`, and `stripLocalCommandMetadata` has exactly two call sites
+  (`[측정 2026-09-18, 0.79.0 dist/acp-agent.js grep -n]`): `:4129`, gated on the message content
+  containing `<local-command-stdout>`, and `:5061`, in the `session/load` transcript replay. Both
+  run agent→client on text coming BACK from the transcript; our augment rides client→agent on the
+  first `session/prompt` and is never re-emitted, because entwurf calls `session/load` nowhere
+  (`[측정 2026-09-18]` `git grep loadSession` in `pi-extensions/lib/acp/` hits only the
+  `session-store.ts` capability TYPE, never a wire call). The augment also emits no
+  `<system-reminder>` tag of its own (`augment.ts` 직독), so no prose of ours is strippable.
+- **0.78.0's compaction update is a NEW `sessionUpdate` kind and is inert for us, twice over.**
+  `compaction_update` and `compaction_summary_chunk` are new in `dist/context-compaction.js`
+  (`[측정 2026-09-18]` `sessionUpdate: "…"` literal sweep across both dists: 0.76.0 has 15 distinct kinds,
+  0.79.0 has 17, and the two new ones are exactly these). Gate one: the lifecycle's
+  `presentation` is `clientSupportsCompactionUpdates(this.clientCapabilities) ? "compaction_update"
+  : "tool_call"` (`dist/acp-agent.js:1875-1879`), and that predicate reads
+  `capabilities?.session?.compaction` — entwurf sends `clientCapabilities: {}` (`backend.ts:1758`),
+  so we keep the 0.75.0 `tool_call` presentation §11-8 already measured. The replay path
+  (`:5082`) is guarded by the same predicate at `:4915`. Gate two, independent: our mapper's
+  update switch has a `default: break` — "unknown update kinds are ignored (forward-compatible)"
+  (`event-mapper.ts:311-313`, `:377-378`). The "map every terminal reason, unknown is an error" rule
+  is about ACP **stopReason**, a different axis; `stopReason` literals are unchanged across the
+  two dists (`[측정 2026-09-18]` sweep: `"cancelled"` only, both versions). No code needed.
+- **0.78.0's checkpoint file-change report and AIR diff counts are both behind the AIR gate.**
+  `supportsAgentFileChangeReport` is `clientSupportsAirCapability(capabilities, "agentFileChangeReport")`
+  (`dist/file-change-audit.js:27-29` 직독), and `air-extension.js`'s only delta is one added
+  constant `AIR_DIFF_STATS_KEY` (full-file `diff`, one line). Same `clientCapabilities: {}`
+  argument as the 0.76.0 `recommendedValue` entry — re-measured, not inherited.
+- **0.79.0's shell-command permission prompts reach our permission handler's INPUT and change no
+  decision.** The change reorders options: when the CLI hints `defaultToNo` (new in 0.79.0 —
+  `[측정 2026-09-18]` `grep -rn defaultToNo` over the 0.76.0 dist is **0 hits**), the option array
+  now sorts reject-first (`dist/permissions/options.js:5-10`). entwurf's approve-all policy
+  selects `options.find((o) => o.kind === "allow_once" || o.kind === "allow_always")` and only
+  falls back to `options[0]` when that find fails (`backend.ts:824-831`) — a find by KIND, so
+  order cannot flip it. The fallback is unreachable besides: every builder in
+  `dist/permissions/options/` routes through `withOptionalUpdate`/`withGeneratedUpdate`, both of
+  which lead with `allowOnce()`, and the hand-rolled `tools.js` sets each carry an `allow_once` or
+  `allow_always` (직독 of `shared.js` + `tools.js`). The title change (Bash/PowerShell titles now
+  bypass `humanText` compaction) lands on a field we never read.
+- **0.77.0–0.79.0's remaining fixes are unreachable under our capability posture.** The
+  AskUserQuestion multi-select/custom-text fixes (#1031, #1131) require form elicitation:
+  the adapter computes `disallowedTools = elicitationSupport.form ? [] : ["AskUserQuestion"]`
+  from `clientCapabilities.elicitation.form`, which our `{}` leaves false, so AskUserQuestion is
+  disabled on every session we open. The TaskList regex fix (#1006) is internal parsing. #1128's
+  tool names land on `presentation.toolCall._meta.claudeCode` on the permission-request path
+  (`dist/acp-agent.js:5317-5325`), which our handler ignores; our `titleForTool` already read
+  `_meta.claudeCode.toolName` as a fallback behind `update.title`, so it is additive at worst.
+- **Our model-forcing and accounting wire calls are byte-identical across 0.76.0 → 0.79.0.**
+  `[측정 2026-09-18, brace-matched extraction from both dists, md5]`: `setSessionConfigOption`
+  (4,858 B, identical), `sessionUsage` (373 B, identical), `turnQuotaMeta` and `quotaTokenCount`
+  (identical md5), and `resolveModelPreference` lives in `dist/session-model.js`, whose whole file
+  is byte-identical (`md5 cfd031d0…` both versions). The `settings`-as-STRING-PATH branch our
+  call-site contract names is still on the unconditional `session/new` path
+  (`dist/acp-agent.js:6010-6012`).
+
 - **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
   synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
   `Compact conversation`, and `_meta.contextCompaction` schema v1 — where it used to arrive as
@@ -292,23 +369,25 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.76.0 nor the Cortex landing adds a client-side
+path. Neither `claude-agent-acp` 0.79.0 nor the Cortex landing adds a client-side
 readiness fence over a session's declared MCP servers, and entwurf's common loop
 calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.75.1 → 0.76.0 bump, not inherited — the previous bump's argument is
-not reused, the way the 0.73.0 → 0.75.1 entry did not reuse 0.70.0 → 0.73.0's.
-`mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.75.1 and 2 at v0.76.0**
-`[측정 2026-09-10, upstream v0.76.0/src/acp-agent.ts read directly, grep -n]`; they first
+(Re-measured at the 0.76.0 → 0.79.0 bump, not inherited — the previous bump's argument is
+not reused, the way the 0.75.1 → 0.76.0 entry did not reuse 0.73.0 → 0.75.1's.
+`mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.76.0 and 2 at v0.79.0**
+`[측정 2026-09-18, upstream v0.79.0/src/acp-agent.ts read directly, grep -n]`; they first
 appeared in 0.71.0 via `0cbbaf3` (MCP OAuth, LLM-25012), so the ADAPTER calls it where it
-once did not. Both were re-read at `v0.76.0 src/acp-agent.ts:1762` and `:1855`
-(v0.75.1: `:1736` / `:1829`; v0.73.0: `:1618` / `:1711`): the first sits inside
-`authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every status that is not
-`needs-auth`; the second polls a SINGLE named server to `connected` under an OAuth deadline.
-Neither waits on every declared server before `newSession` returns. That is an auth
-handshake, not a readiness fence, so the boundary below is unchanged. The surrounding 200
-lines are byte-identical and the region moved +26; the whole 0.76.0 delta is one refactor
-plus one opt-in AIR extension that `clientCapabilities: {}` never enables, so the other
-reachable-surface findings stand as re-measured at the previous bump.
+once did not. Both were re-read at `v0.79.0 src/acp-agent.ts:1773` and `:1866`
+(v0.76.0: `:1762` / `:1855`; v0.75.1: `:1736` / `:1829`; v0.73.0: `:1618` / `:1711`): the
+first sits inside `authenticateMcpServers` behind `supportsMcpOAuth(query)` and skips every
+status that is not `needs-auth`; the second polls a SINGLE named server to `connected` under
+an OAuth deadline. Neither waits on every declared server before `newSession` returns. That
+is an auth handshake, not a readiness fence, so the boundary below is unchanged. The
+surrounding 200-line window is byte-identical (`diff v0.76.0:1662-1862 v0.79.0:1673-1873`,
+empty) and the region moved +11 while the file shrank 10,405 → 10,329 lines. The 0.77.0
+agent-picker removal, the 0.78.0 compaction/checkpoint/AIR work and the 0.79.0 permission
+presentation touch no part of this path, so the other reachable-surface findings stand as
+re-measured in the capability-posture section above.
 This bump changes no readiness behavior and closes no part of #72.)
 
 ### 11-7-a/b. Instrument and first measurement

package/docs/setup-clean-host.md

@@ -22,7 +22,7 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.85.1 <0.86` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.86.0 <0.87` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -156,7 +156,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.85.1
+npm install -g @earendil-works/pi-coding-agent@0.86.0
 pi --version
 
 cd ~/entwurf-smoke
@@ -164,7 +164,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.85.1 <0.86`. It is a hard minimum: installing this
+The supported range is `>=0.86.0 <0.87`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -264,9 +264,10 @@ process. Open omp yourself and it is a two-way citizen either way — it sends u
 garden id and a reply lands on it.
 
 The first turn of a fresh omp sibling is a TWO-STAGE BOOTSTRAP, not a positional prompt: the
-launcher carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`,
-and the installed birth extension waits until the callback tool is actually callable, sends a
-callback-only prompt, and delivers the operator's task only after that exact call succeeds.
+launcher carries `{v,task}` on the fixed registered flag `--entwurf-bootstrap` while the
+caller's address rides the sibling's own process env, and the installed birth extension waits
+until the zero-argument callback tool is actually callable, sends a callback-only prompt, and
+delivers the operator's task only after that exact call succeeds.
 That is a measured correction — the interactive host defers MCP discovery, so a positional
 first turn began before the tool it named existed.
 
@@ -306,7 +307,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.85.1 <0.86`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.86.0 <0.87`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -34,8 +34,13 @@
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
  *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
  *                       apart.
+ *   - entwurf_callback — ZERO-ARGUMENT fresh-sibling callback. Reads ENTWURF_CALLBACK_TARGET +
+ *                       ENTWURF_CALLBACK_NONCE from this process env (launcher-injected), validates
+ *                       grammar, and dispatches through the existing v2 runner. Refuses by name
+ *                       when env is absent/malformed or this process is a Codex-provenance bridge.
+ *                       No model-supplied target fallback.
  *
- * That list is the WHOLE public surface — seven verbs — and `check-entwurf-bridge-boot`
+ * That list is the WHOLE public surface — eight verbs — and `check-entwurf-bridge-boot`
  * (G1f) holds it as an exact set on the runtime tools/list, so a verb added or dropped
  * here without a decision is red rather than merely undocumented.
  *
@@ -64,6 +69,7 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { readCallbackEnv } from "../../../pi-extensions/lib/callback-env.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
@@ -740,6 +746,32 @@ server.tool("entwurf_resume_call", "Reopen ONE DORMANT pi citizen under its OWN
         return textErr(`entwurf_resume_call error: ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+server.tool("entwurf_callback", "ZERO-ARGUMENT callback for a fresh sibling this process was launched as. Reads " +
+    "ENTWURF_CALLBACK_TARGET and ENTWURF_CALLBACK_NONCE from this process environment " +
+    "(injected by the launcher next to the identity scrub), validates garden-id and nonce " +
+    "grammar, and dispatches through the existing v2 runner with intent fire-and-forget, " +
+    "message=nonce, wants_reply=false. The target is re-resolved by record/decider — env " +
+    "names the id, it does not skip dispatch. REFUSES BY NAME when the pair is absent, " +
+    "malformed, or this process is a Codex-provenance bridge (window env never reaches that " +
+    "MCP child). No arguments, no fallback to a model-supplied target.", {}, async (_args, extra) => {
+    const read = readCallbackEnv(process.env);
+    if (!read.ok) {
+        return textErr(`entwurf_callback: ${read.reason}`);
+    }
+    try {
+        const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
+        const rendered = await runAndRenderEntwurfV2FromSurface({
+            target: read.target,
+            intent: "fire-and-forget",
+            message: read.nonce,
+            wants_reply: false,
+        }, { senderProvider: () => sender });
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_callback error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -123,8 +123,8 @@ export const claudeAdapter = {
     },
     // MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
     // session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-    // and a context-occupancy scalar (`used`; both read at 0.76.0
-    // `dist/acp-agent.js:3471-3486`). Both are measured, so backend.ts seals them.
+    // and a context-occupancy scalar (`used`; both read at 0.79.0
+    // `dist/acp-agent.js:3504-3519`). Both are measured, so backend.ts seals them.
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/context.js

@@ -8,12 +8,16 @@
 //
 // S2c/S2d boundary (GPT S2c Q2): this is CONVERSATION TRANSCRIPT PASSTHROUGH, not
 // rich-carrier identity injection. Deliberately EXCLUDED here (all S2d):
-//   - `context.systemPrompt` — never read into the prompt or `_meta.systemPrompt`
+//   - the system prompt — never read into the prompt or `_meta.systemPrompt`
 //     (the billing carrier stays absent — NEXT §S2-scout 핀1);
 //   - `~/AGENTS.md` / cwd AGENTS / bridge identity narrative;
 //   - first-user-message augment + project-context de-dup;
-//   - `context.tools` — the ACP child tool surface is the S2b
+//   - the declared tool surface — the ACP child tool surface is the S2b
 //     `_meta.claudeCode.options` SSOT, never re-sent here.
+// Since pi 0.86 both of those ride a leading `role:"system"` message inside the
+// `TranscriptContext` (pi-ai `normalizeContext`) rather than their own `Context`
+// fields, so the exclusion is enforced by `renderMessage`'s explicit
+// `case "system"` below, not by simply not reading two fields.
 // Structured tool replay is also excluded: tool calls/results render as plain
 // transcript text, never as ACP tool invocations (the child runs its own tools).
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
@@ -69,13 +73,23 @@ function renderMessage(message) {
             const tag = message.isError ? "Tool error" : "Tool result";
             return text ? `${tag} (${message.toolName}): ${text}` : undefined;
         }
+        case "system":
+            // The never-forward-systemPrompt invariant, stated rather than inherited.
+            // Since pi 0.86 the system prompt and the declared tool surface arrive AS
+            // transcript messages (`normalizeContext`), so what used to be "we simply
+            // do not read `context.systemPrompt`" is now an active decision on every
+            // turn. `default` would already skip it; the explicit case exists so
+            // deleting it is a visible change and a new pi role cannot quietly start
+            // leaking the prompt into the ACP child's transcript.
+            return undefined;
         default:
             return undefined;
     }
 }
 /**
- * Flatten a pi Context into a single transcript string. Excludes
- * `context.systemPrompt` and `context.tools` by construction.
+ * Flatten a pi transcript into a single transcript string. Excludes the system
+ * prompt and the declared tool surface by construction — since 0.86 both ride
+ * the leading `role:"system"` message, which `renderMessage` drops explicitly.
  */
 export function contextTranscript(context) {
     const lines = [];
@@ -87,7 +101,7 @@ export function contextTranscript(context) {
     return lines.join("\n\n");
 }
 /**
- * Convert a pi Context into the ACP `prompt` array (a single text block holding
+ * Convert a pi transcript into the ACP `prompt` array (a single text block holding
  * the flattened transcript). Empty history yields an empty array — the caller
  * decides whether that is a hard error.
  */

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/tool-surface.js

@@ -124,7 +124,8 @@ export function buildClaudeSessionMeta(params, normalizedSystemPrompt) {
         // claude-agent-acp also accepts a STRING PATH, and at 0.76.0 the readFile +
         // JSON.parse for that form moved out of `resolvedProvider` up onto the
         // unconditional `session/new` path — a shape that WOULD reach us, and does not,
-        // only because we never hand it a path. Keep it inline: a path would put file
+        // only because we never hand it a path. Still on that path at 0.79.0
+        // (`dist/acp-agent.js:6010-6012`). Keep it inline: a path would put file
         // IO, and its failure modes, inside every session creation.
         settings: {
             permissions: {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/callback-env.js

@@ -0,0 +1,68 @@
+/**
+ * Callback-env — the launch-computed pair that lets a fresh sibling call home
+ * without copying a garden id or nonce out of prose.
+ *
+ * WHY THIS FILE EXISTS. Until this seam, `composeFreshCallFraming` put
+ * `target=<caller gid>` and `message=<nonce>` into the first-turn prompt, and
+ * the sibling had to retype them into `entwurf_v2`. That is the one place in
+ * the garden Hard Rule 2 (record is the sole address axis) was violated: the
+ * transcript became the address carrier, and a model that dropped a `$` or a
+ * hex nibble produced a refused dispatch that looked like a flaky backend.
+ *
+ * WHAT TRAVELS. Two process-env names, injected by the launcher next to the
+ * identity scrub (`PI_SESSION_ID=` / `PI_AGENT_ID=`), never as a general env
+ * carrier. The no-arg `entwurf_callback` verb reads BOTH from its own process
+ * and refuses by name when they are absent, malformed, or this process is a
+ * Codex-provenance bridge (window env never reaches that MCP child — measured).
+ *
+ * This module does not dispatch. It parses, validates, and formats. Launchers
+ * and the verb share it so a drifted regex cannot inject what the verb rejects.
+ */
+import { SESSION_ID_RE } from "./session-id.js";
+export const CALLBACK_TARGET_ENV = "ENTWURF_CALLBACK_TARGET";
+export const CALLBACK_NONCE_ENV = "ENTWURF_CALLBACK_NONCE";
+/** Exactly what `mintNonce` emits (`fresh-call-composition.ts`): `mux-fresh-call-` + 12 random
+ *  bytes as hex. ONE minter, ONE grammar — both rails call the same `mintNonce`, so a second
+ *  accepted prefix would be a spelling no launcher produces and this leaf exists to refuse
+ *  exactly that. A gate fixture is an oracle and never a reason to widen the subject. */
+export const CALLBACK_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
+function parseCallbackPair(target, nonce) {
+    if (typeof target !== "string" || typeof nonce !== "string") {
+        return { ok: false, reason: "callback-env-malformed" };
+    }
+    if (!SESSION_ID_RE.test(target) || !CALLBACK_NONCE_RE.test(nonce)) {
+        return { ok: false, reason: "callback-env-malformed" };
+    }
+    return { ok: true, target, nonce };
+}
+/**
+ * Format the two `KEY=value` assignments a launcher injects. Throws rather than
+ * emitting a pair the verb would refuse — a launch that cannot name its caller
+ * must not open a window whose first action is a guaranteed reject.
+ */
+export function callbackEnvAssignments(params) {
+    const parsed = parseCallbackPair(params.target, params.nonce);
+    if (!parsed.ok) {
+        throw new Error(`callback-env: refusing to inject ${parsed.reason}`);
+    }
+    return [`${CALLBACK_TARGET_ENV}=${parsed.target}`, `${CALLBACK_NONCE_ENV}=${parsed.nonce}`];
+}
+/**
+ * Read the pair from a process environment. Codex provenance is a named refuse
+ * even when the pair is well-formed: that bridge is an app-server child, and a
+ * pane-injected value would be the wrong citizen's (or last-launch-wins).
+ *
+ * Both names absent → `callback-env-absent`. One present, or either failing
+ * grammar → `callback-env-malformed`. No fallback to a model-supplied target.
+ */
+export function readCallbackEnv(env = process.env) {
+    if (env.ENTWURF_BRIDGE_NATIVE_HOST?.trim() === "codex") {
+        return { ok: false, reason: "codex-callback-env-unsupported" };
+    }
+    const target = env[CALLBACK_TARGET_ENV];
+    const nonce = env[CALLBACK_NONCE_ENV];
+    if (target === undefined && nonce === undefined) {
+        return { ok: false, reason: "callback-env-absent" };
+    }
+    return parseCallbackPair(target, nonce);
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -102,7 +102,7 @@ export const DISPATCH_LIVENESSES = ["live", "dormant", "indeterminate"];
 // unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
 // THIS set is a deliberate future decision, gated by a real compatible
 // control-socket predicate — never by silently mapping sessions to dead/indeterminate
-// (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
+// (R1 핵심). pi-extensions/lib/entwurf-facts.test.ts pins this == ["pi"] and asserts the native-push
 // domain is disjoint from it.
 export const LIVENESS_DOMAIN_BACKENDS = ["pi"];
 export function isLivenessSupported(backend) {
@@ -113,7 +113,7 @@ export function isLivenessSupported(backend) {
 // live vendor app-server target probe), NOT a control socket. This domain is DISJOINT
 // from LIVENESS_DOMAIN_BACKENDS: an Antigravity or Codex session is `unsupported` on
 // the socket FACT axis (entwurf_peers) yet independently measured on the native-push
-// axis. The two are separate rails on purpose — check-entwurf-facts pins both sets
+// axis. The two are separate rails on purpose — pi-extensions/lib/entwurf-facts.test.ts pins both sets
 // and asserts their intersection is ∅ (a backend can never be in both domains).
 export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"];
 export function nativePushSupported(backend) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-lock.js

@@ -79,7 +79,7 @@ export const ENTWURF_V2_LOCK_DIR = path.join(os.homedir(), ".pi", "entwurf-v2-lo
 export const LOCK_SUFFIX = ".lock";
 export const LOCK_OWNER = "entwurf_v2";
 /** The reject reason a lock conflict maps to. Kept as a literal here (the lock
- * primitive stays decoupled from the full contract); `check-entwurf-v2-lock`
+ * primitive stays decoupled from the full contract); `pi-extensions/lib/entwurf-v2-lock.test.ts`
  * cross-checks it against the contract's ENTWURF_V2_REJECT_REASONS so the two
  * cannot drift. */
 export const LOCK_CONFLICT_REASON = "target-locked";

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -50,6 +50,16 @@ export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "code
  * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
  */
 export const FRESH_CALL_CALLBACK_TOOL = {
+    pi: "entwurf_callback",
+    "claude-code": "mcp__entwurf-bridge__entwurf_callback",
+    copilot: "entwurf-bridge-entwurf_callback",
+    omp: "mcp__entwurf_bridge_entwurf_callback",
+    // Codex's tool process is the operator app-server, not the pane: the no-arg
+    // verb refuses there by name. First action stays the delivery verb with args.
+    codex: "mcp__entwurf_bridge__entwurf_v2",
+};
+/** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
+export const FRESH_CALL_DELIVERY_TOOL = {
     pi: "entwurf_v2",
     "claude-code": "mcp__entwurf-bridge__entwurf_v2",
     copilot: "entwurf-bridge-entwurf_v2",
@@ -95,8 +105,11 @@ export const FRESH_CALL_PEERS_TOOL = {
  * `[측정, n=3, same model]` adding the sentence below produced 3/3 callbacks. It is a FACT about the
  * runtime, in the register the rest of this framing uses since the prohibitions came out: it grants
  * nothing, forbids nothing, and names the one call that turns a listed name into a callable tool.
- * Both tools ride ONE `ToolSearch` select, so the corroboration the framing offers stays reachable
- * for a child that takes the offer.
+ * ALL THREE tools ride ONE `ToolSearch` select — the birth callback, the DELIVERY verb the last
+ * line of the framing names, and the peers listing the corroboration sentence offers. The delivery
+ * verb has to be in the same select or the deferral simply moves from the first action to the last:
+ * a sibling that finishes its task and cannot call `entwurf_v2` is the same production silence,
+ * spent instead of saved.
  *
  * Every other backend gets an EMPTY array, deliberately: pi has no deferred-tool surface, and the
  * other three were never measured to need it. A hint invented for a runtime nobody probed would be
@@ -106,7 +119,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT = {
     pi: [],
     "claude-code": [
         "If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its",
-        'tools are deferred: load them first with ToolSearch("select:${callbackTool},${peersTool}") —',
+        'tools are deferred: load them first with ToolSearch("select:${callbackTool},${deliveryTool},${peersTool}") —',
         "it waits for the server — then call ${callbackTool}.",
     ],
     copilot: [],
@@ -125,21 +138,21 @@ export const FRESH_CALL_TOOL_LOAD_HINT = {
 export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
 /** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
  * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
+export const OMP_BOOTSTRAP_VERSION = 2;
 /**
  * The whole of what a fresh omp sibling is launched with.
  *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
+ * TWO FIELDS, CLOSED. Address (target + nonce) rides process env, not this payload — a second
+ * copy here would be a second address axis. The decoder refuses an unknown key, so this object
+ * is the entire remaining contract: the task released after the no-arg callback succeeds.
+ * `callerGardenId` / `nonce` stay on the function so launcher call sites do not grow a second
+ * shape; they are not serialised.
  */
 export function buildOmpBootstrapPayload(params) {
+    void params.callerGardenId;
+    void params.nonce;
     return JSON.stringify({
         v: OMP_BOOTSTRAP_VERSION,
-        target: params.callerGardenId,
-        nonce: params.nonce,
         task: params.task,
     });
 }
@@ -271,7 +284,11 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
         case "pi":
             return [composition.prompt, "--entwurf-control", "--model", model];
         case "claude-code":
-            return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
+            return [
+                composition.prompt,
+                `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]},${FRESH_CALL_DELIVERY_TOOL["claude-code"]}`,
+                `--model=${model}`,
+            ];
         case "copilot":
             return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
         case "omp":
@@ -319,26 +336,41 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
  * corroborate the caller instead of an instruction not to look.
  */
 export function composeFreshCallFraming(params) {
-    const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+    const birthTool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+    const deliveryTool = FRESH_CALL_DELIVERY_TOOL[params.backend];
     const peersTool = FRESH_CALL_PEERS_TOOL[params.backend];
     // The hint is a per-backend TEMPLATE so the two tool dialects stay the single source of their
     // own spelling here too — a hint that hard-coded Claude's name would go stale the day a dialect
     // moves, and it would go stale silently, in the one sentence a stuck child depends on.
-    const loadHint = FRESH_CALL_TOOL_LOAD_HINT[params.backend].map((line) => line.replaceAll("${callbackTool}", tool).replaceAll("${peersTool}", peersTool));
+    const loadHint = FRESH_CALL_TOOL_LOAD_HINT[params.backend].map((line) => line
+        .replaceAll("${callbackTool}", birthTool)
+        .replaceAll("${deliveryTool}", deliveryTool)
+        .replaceAll("${peersTool}", peersTool));
     const hintBlock = loadHint.length === 0 ? [] : ["", ...loadHint];
     if (params.openingLine.length === 0) {
         throw new Error("fresh-call composition: openingLine is empty — the rail must state where it placed the sibling");
     }
+    const firstAction = params.backend === "codex"
+        ? [
+            `FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+                `target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
+                `message set to exactly ${params.nonce} — that string alone, nothing added.`,
+            `${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
+            "secret and grants no access. Sending it is how the caller learns the garden id you were born",
+            "with, which it has no other way to know. Your own record does not carry the caller's address,",
+            "so reporting your identity here does not reach it — that tool call does.",
+            "entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
+        ]
+        : [
+            `FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+            "That call is how the caller learns the garden id you were born with. There are no",
+            "parameters: a target or message you type would be a second address axis.",
+            "Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
+        ];
     return [
         params.openingLine,
         "",
-        `FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-            `target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-            `message set to exactly ${params.nonce} — that string alone, nothing added.`,
-        `${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
-        "secret and grants no access. Sending it is how the caller learns the garden id you were born",
-        "with, which it has no other way to know. Your own record does not carry the caller's address,",
-        "so reporting your identity here does not reach it — that tool call does.",
+        ...firstAction,
         "",
         `You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
         `this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
@@ -356,7 +388,7 @@ export function composeFreshCallFraming(params) {
         // its window is not the delivery. Nothing here watches for completion or sends on the
         // sibling's behalf — this rail launches and lets go (Hard Rule 16, and the reason there is no
         // supervisor anywhere in it).
-        `When the task reaches its requested final result, send that result to the same target with ${tool}.`,
+        `When the task reaches its requested final result, send that result to the same target with ${deliveryTool}.`,
         "Output in this sibling window is not delivered to the caller.",
     ];
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -43,6 +43,7 @@
 import { createHash } from "node:crypto";
 import { statSync } from "node:fs";
 import path from "node:path";
+import { callbackEnvAssignments } from "./callback-env.js";
 import { buildOmpBootstrapPayload, composeBackendArgs, composeFreshCallFraming, normalizeFreshCallInputs, TASK_MAX_CHARS, } from "./fresh-call-composition.js";
 /** The pilot set, closed. `[#116 decision]` herdr's own `--kind` enum is much larger, and that is
  * NOT evidence of support: every other backend is a pre-mutation named reject here, and there is
@@ -235,6 +236,7 @@ export function buildHerdrTabCreateArgs(params) {
         "PI_SESSION_ID=",
         "--env",
         "PI_AGENT_ID=",
+        ...callbackEnvAssignments(params.callback).flatMap((assignment) => ["--env", assignment]),
     ];
 }
 /** `agent start <name> --kind <kind> --pane <id> -- <backend argv>`. Everything after `--` is the
@@ -565,6 +567,7 @@ export async function herdrFreshCall(params, run, env, nonce, clock = HERDR_REAL
     const tabRun = await run(buildHerdrTabCreateArgs({
         workspaceId: callerPane.workspaceId,
         ...(cwd === undefined ? {} : { cwd }),
+        callback: { target: callerGardenId, nonce },
     }));
     if (tabRun.status !== 0) {
         // WHETHER ANYTHING EXISTS depends on WHO failed, and the stderr says which. herdr's own
@@ -881,9 +884,10 @@ export function renderHerdrFreshCall(result) {
             `mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
             `coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
             `dispatched to them.\n` +
-            `The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its first ` +
-            `action, and the sender envelope of THAT message is the address. Nothing is polling for it; if it never ` +
-            `comes, the pane is visible and can be read directly.`,
+            `The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+            `the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
+            `the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
+            `never comes, the pane is visible and can be read directly.`,
         isError: false,
     };
 }