@junghanacs/entwurf 0.25.0 → 0.25.1

package/CHANGELOG.md

@@ -4,6 +4,115 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.25.1 - 2026-09-30
+
+### Added
+
+- **Per-group qualification receipts, a composite ledger, and an offline exact-SHA oracle (#124,
+  development tooling — not release policy).** `check-gate-qualification --group <argv> --receipt
+  <path>` runs one exact-argv group through the unchanged control → mutant → restore → control body
+  and writes a sealed `PARTIAL/local` receipt; `--groups <JSON|all> --collect <dir>` runs several in
+  one process and writes an inventory (`collection.json` + `gNNN.json`), never a verdict;
+  `--compose` builds a local ledger whose groups are MEASURED, FAIL, INHERITED-UNVERIFIED or UNRUN
+  (CARRIED is defined and never populated — no audited dependency projection exists), with verdicts
+  RED / NOT-QUALIFIED / RISK-PENDING / COMPOSITE-GREEN. A dispatch-only `ci.yml` step
+  (`workflow_dispatch -f composite_groups=…`) uploads a collection artifact, and
+  `scripts/qualification-oracle.ts` composes an exact-SHA ledger from GitHub run, job and artifact
+  evidence inside a clean clone of that SHA. **Release acceptance is unchanged:**
+  `verify-exact-ci.sh` plus the full qualification body stay the release MUST until #124 P3, and no
+  release path calls the composite oracle. **Unobserved:** no collection artifact has been uploaded
+  yet, so the real GitHub zip layout, the CI work-surface cross-check and the collector's CI
+  environment are unmeasured; the reader fails closed on anything it does not recognize. New mutant
+  lane `qualification-ledger` (42 QK claims); the committed set is 824 mutants across 63 lanes.
+  Frozen-candidate evidence before commit (host `oracle`, work surface `ccfb8bbe9cd2…`):
+  qualification body 824/824 killed in 5,053 s, `check:full` exit 0 in 617 s. Issue #124 stays open.
+
+### Changed
+
+- **Herdr plugin runtime lock returns to `herdr-checkout` for the 0.25.1 candidate window.** An npm
+  lock must name a version that is already published and coherent with the checkout's
+  `package.json` (`check-herdr-runtime-bootstrap` `[QK:HRB-LOCK-SOURCE-CLOSED]`), so the 0.25.0 npm
+  pin cannot ride a 0.25.1 cut. The npm pin returns as a follow-up once 0.25.1 is on the registry
+  (the dd84ac0 pattern).
+- **GitHub release notes are soft-wrapped at M6 extraction** (`entwurf-release`): paragraphs and
+  list items are joined, fenced code stays byte-for-byte, and the extraction refuses notes whose text
+  differs from the CHANGELOG section by anything beyond whitespace.
+
+- **Herdr plugin 0.5.1 is the follow-up for the #120-aware raw-install LIVE oracle.**
+  Plugin 0.5.0 already shipped on the `v0.25.0` tag and its npm-pinned follow-up commit
+  `113ca5327074b77eb5d81453b1a277afcdf4ddca` was publicly reachable. The first clean-host
+  test of that commit completed install, npm integrity, pi/Claude activation and record-backed
+  birth, then falsely marked the status pane red: it still required `herdr-agent-list-failed` at
+  column zero, while #120 moved that name into the owner-labelled `[4] CITIZENS` block. The
+  corrected assertion anchors both that block and its indented failure line; the same remote
+  0.5.0 commit then passed the full first-user path without production-code changes (receipt
+  below). The manifest alone advances to 0.5.1 here to distinguish this verified follow-up from
+  the already public 0.5.0. **This is not yet a LIVE acceptance claim for 0.5.1**; its remote
+  commit must be tested separately before a physical-host install is handed to GLG.
+
+- **Herdr plugin 0.5.0 pins its runtime to the published npm `@junghanacs/entwurf@0.25.0`.**
+  The `v0.25.0` tag already carries `plugins/herdr/herdr-plugin.toml` at 0.5.0; this post-publish
+  follow-up replaces its candidate-window `herdr-checkout` lock with the exact published npm
+  version and sha512. `npm view @junghanacs/entwurf@0.25.0 dist.integrity` and an independent
+  SHA-512 over the preserved accepted candidate
+  (`/tmp/entwurf-release-candidate-0.25.0.pyaGKq/junghanacs-entwurf-0.25.0.tgz`, sha256
+  `6ed3d67c8db30b71572738b9cddce38c9cf12d73c4f494b48b1475235918a968`) agree on
+  `sha512-6Cm5qFZiR8OtqSszcfv/bhxhFlLL0dmeBOnBp3wnnL5JOI6e68anEG3SUuUXKK7CuCaM4S+ft7H8vgVKw4vDhg==`;
+  npm's published `dist.shasum` matches the accepted candidate's SHA-1, and registry `latest` is
+  0.25.0 while `repair` remains 0.12.8-repair.1. The lock and its three committed-lock gate cells
+  move together (forward of the 0.25.0 candidate inverse); source switches still require explicit
+  deactivation. Focused `check-herdr-plugin-build`, `check-herdr-runtime-bootstrap`,
+  `check-herdr-plugin`, `check-herdr-plugin-profile`, `check-dep-versions`, and
+  `check-gate-manifests` passed; the last confirms 782 mutants across 62 lanes without executing
+  qualification. These are local pin/protocol receipts, **not** a public-remote first-user-path
+  receipt: that journey needs the committed pin on a reachable ref and must be measured separately.
+- **Public-remote first-user path (2026-09-23, after pin push).** In a clean `node:24` container,
+  `LIVE=1 ENTWURF_REQUIRE_DOCKER=1 ./run.sh smoke-herdr-raw-install-live --ref main`
+  resolved `main` to `113ca5327074b77eb5d81453b1a277afcdf4ddca`, read plugin manifest 0.5.0,
+  fetched `kind=npm @junghanacs/entwurf@0.25.0` at tarball SHA-256
+  `6ed3d67c8db30b71572738b9cddce38c9cf12d73c4f494b48b1475235918a968`, wired pi and
+  Claude, born a record-backed pi citizen without a model turn, read the status fan with and
+  without a Herdr server, and deactivated/reinstalled successfully. **PASS**; full log
+  `/tmp/entwurf-herdr050-raw-install-113ca53-amended.log`, sha256
+  `406ff681166e596c9b358ffbac9129fe32c9c7878c874d177ebc3f1cab661788` (decisive lines
+  above are reproduced here for cross-host readers). The first attempt on this same remote SHA
+  failed only at the fan oracle: #120 now reports `herdr-agent-list-failed` inside the `[4] CITIZENS`
+  block, not at column zero. `scripts/smoke-herdr-raw-install-live.sh` now anchors that block and
+  its indented failure line; the corrected run passed with no product-source change. The older
+  `smoke-herdr-plugin-build-live` still asserts the **checkout** carrier and is not evidence for
+  this npm pin — running it here reported the expected source mismatch, not an install failure.
+
+### Verification
+
+Prepared tree over `8b92e09` (CHANGELOG + `package.json` 0.25.1, uncommitted and frozen while the
+gates ran), host `oracle`, 2026-09-30 KST, ambient identity carriers stripped (`ENTWURF_*`,
+`CLAUDE*`, `PI_SESSION_ID`, `PI_AGENT_ID`).
+
+- **Deterministic floor (P4):** `pnpm run build-bridge` then `pnpm run check:full`,
+  `[check:full] total elapsed 624s exit 0`, `[check-pack] 550 files in tarball`.
+- **Aggregate LIVE floor (P5):** `LIVE=1 ./run.sh release-gate <scratch> --cut`, scratch
+  `/tmp/entwurf-release-gate-0.25.1.pDnZeR`, log `release-gate.log` sha256
+  `9a7e698cafa4fd476301be2e61b291c88ec40b059955c97aae8d829c3d213a7c`, 6,022 s:
+  **MUST PASS=24 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Inside it,
+  `check-gate-qualification` reported `qualified claims: 824/824 killed` and
+  `[gate-qualification] ok` (824 mutants, 63 lanes), and `smoke-codex-fresh-live` ran inside the
+  aggregate for the first time with the operator-supplied triple: app-server PID `2786140`,
+  started by this release lane with `./run.sh codex-app-server` in its own tmux session `$261`
+  (the native process owning the control socket, read from that pane's own process tree, never a
+  search), Codex `gpt-5.6-luna`, Pi `openai-codex/gpt-5.6-terra` →
+  `64 assertions ok`. The app-server was stopped after the gate.
+- **Pre-LIVE doctors:** meta-bridge, pi-package, the four Codex doctors, the three OMP doctors and
+  agy-bridge exit 0; `doctor-copilot-bridge` exits 1 with `copilot CLI missing from PATH` (Copilot is
+  not a release MUST rail on this host).
+- **Host residue (P9, at the gate's verdict):** 628 → 619 owned `/tmp` dirs; 9 roots / 1.1 G
+  reclaimed, none minted by this run (7 `check-probe-ordering` roots dated 2026-09-23..29, one
+  `entwurf-s2b-overlay`, one 1.1 G `entwurf-hpbl` from 2026-09-23). The recurring
+  `check-probe-ordering` residue names a gate that still leaks on some path. One reparented process
+  holds a `/tmp` path and was named, not killed: the operator's own
+  `emacs --init-directory=/tmp/agent-emacs-init --daemon`.
+- **Not claimed:** exact-SHA CI and the preserved-artifact acceptance belong to `make`; the #124
+  composite collection has not been dispatched, so no composite ledger exists for this release.
+
 ## 0.25.0 - 2026-09-23
 
 ### Added

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/VERIFY.md

@@ -86,7 +86,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.25.0",
+	"version": "0.25.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {

package/run.sh

@@ -199,7 +199,7 @@ Usage:
   ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
-  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO mutants and never snapshots this repo (~8s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
+  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
@@ -6938,9 +6938,10 @@ case "$cmd" in
     # floor can pay for it: the runner self-test (classifier truth table + synthetic
     # negatives) plus the REAL manifests — schema, global claim uniqueness, subjects
     # tracked and lstat-regular in the origin index, claim tokens exactly once in their
-    # gate sources — plus the declared lane inventory. It executes ZERO mutants and
-    # makes NO snapshot of this repo; the body (check-gate-qualification) owns that and
-    # is unchanged. Cheap enough for check:hermetic (~8s).
+    # gate sources — plus the declared lane inventory. It executes ZERO committed mutants
+    # (the self-test runs only synthetic fixture mutants in tmp fixture repos) and makes NO
+    # snapshot of this repo; the body (check-gate-qualification) owns the committed set and
+    # is unchanged. Cheap enough for check:hermetic (~20s measured 2026-09-29 on oracle).
     run_ts scripts/check-gate-qualification.ts --manifests-only
     ;;
   check-gate-qualification)