@junghanacs/entwurf 0.25.0 → 0.30.0

package/AGENTS.md

@@ -18,7 +18,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 
 - **entwurf-core (v2):** garden-id addressing, record facts, rail liveness, dispatch decisions, and delivery evidence.
 - **Record authority:** every citizen uses V3 `MetaIdentity`; `backend` selects rail capability, never identity rank.
-- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and exposes pi’s native tools.
+- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and registers the compiled `entwurf-bridge` with Pi’s built-in MCP under that record’s identity.
 - **Native bridges:** register existing sessions without owning transcript or auth. Claude Code and Copilot are self-fetch; Antigravity and Codex are native-push. Codex remains native rather than ACP so its vendor tools, delegation, and work context remain intact. Admission/evidence details belong in [DELIVERY.md](./DELIVERY.md) and [VERIFY.md](./VERIFY.md).
 - **ACP plugin:** one `entwurf` provider under an isolated overlay. The host pi session is already a record-backed citizen; ACP creates neither a second citizen nor a socket layer.
 - **mux:** launch-only placement and fixed-runtime launch. It never imports into delivery. Fresh identity arrives only through its callback envelope, never a lookup; same-id visible resume keeps identity/liveness/locking on the v2 side of the injected seam. Fresh call accepts only the narrow model, literal absolute cwd, and existing caller-server seat inputs; it creates no session and does not infer seat from cwd. A Codex CALLER alone has an omitted-placement rule: it opens beside its own TUI pane, matched by thread-id in that pane title; 0/2+ matches reject; explicit placement still wins. Do not turn either fresh call or resume into a generic driver, command/env carrier, or second creation API. Exact module/argv/import ownership: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md).

package/BASELINE.md

@@ -246,7 +246,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes seven tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes eight tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---
 

package/CHANGELOG.md

@@ -4,6 +4,188 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.30.0 - 2026-10-02
+
+### Changed
+
+- **Pi 1.0 admission — the pi fence is `>=1.0.0 <1.1` (#125).** Dev pins move to Pi 1.0.0 and the
+  peer range to the next-minor ceiling `>=1.0.0 <1.1`. The range checks are major-aware; pack
+  literals, the four affected mutants, the live docs and ROADMAP's two gate-read lines follow. No
+  ACP, vendor or Herdr companion bump rides it. The 0.99.1 and 0.99.2 floors this cycle passed
+  through were branch steps and never shipped. Pi now carries MCP in its core
+  ([You Said No MCP!](https://earendil.com/posts/you-said-no-mcp/), 2026-09-29) and this admission
+  builds on it rather than duplicating native tools; `pi-durable` and Pi's codemode are not adopted
+  here, and what they mean for Entwurf is undecided.
+- **Codex first-admission verification follows the current Pi MCP dialect.** Joined native
+  call/result names must still agree before exact Pi-qualified names become semantic receipts;
+  downstream source audits and receipt-owned cleanup use the same boundary. The LIVE driver now
+  separates launch from callback-validated relay, and clarifies callback-first startup without
+  relaxing message bytes, role counts, omitted cwd/seat, or claiming guaranteed model obedience.
+  The final standalone Codex chain passed 65 assertions, including both exact source-role audits.
+- **This cut has an explicit local acceptance exception (GLG, 2026-10-02).** The original P5
+  remains MUST 23 PASS / 1 FAIL / 0 SKIP, BEHAVIOR PASS; subsequent scoped Codex acceptance is a
+  separate run on amended bytes, not a synthetic 24/24 single-run result. GLG chose not to repeat
+  local full/qualification BODY/P5/M0 after the repairs. Exact prepared-SHA CI (including fresh
+  full and qualification BODY) and preserved-candidate Docker acceptance remain required. The
+  grouped development proofs do not activate #124 P3 composite release policy.
+- **A pi citizen's Entwurf verbs ride Pi's built-in MCP (#125).** A born pi citizen registers the
+  compiled `entwurf-bridge` with `pi.registerMcpServer` under its record gardenId, so a pi model
+  reaches the same server every other host does. The five hand-written native tools are gone;
+  `entwurf_inbox_read` and `entwurf_register_native` are hidden on a pi host, leaving six declared.
+  Pi folds every character outside `[A-Za-z0-9_]` in an MCP tool name to `_`, so a pi model calls
+  `mcp__entwurf_bridge__<verb>`, and the pi fresh-call dialect (callback, delivery, peers) moved to
+  that spelling as one literal hard cut — no alias, no version router. The server key stays
+  `entwurf-bridge`; a same-namespace `mcp.json` entry overrides the registration by Pi's own
+  precedence.
+- **Qualification builds what a gate consumes (#125, development tooling).** The snapshot stays
+  source-only; a mutant may declare `build {argv, output}`, and for that gate group only the
+  runner builds the output from the snapshot's own bytes, rebuilds it after every mutation and
+  before the post-control (baseline digest required), never counts a build red as a kill, voids a
+  run whose gate writes into the output, and removes it when the group ends (`[QK:QUALIFY-BUILD-*]`).
+
+- **README is the product entry; clean-host setup owns the operating detail.** Installation,
+  prerequisites, citizen first use, terms and short history stay in README. Detailed settings,
+  harness configuration, context, skills and upgrades move to `docs/setup-clean-host.md` with
+  retained entry anchors and links. Herdr keeps its separate installation document. VERIFY
+  distinguishes Pi's built-in MCP tool ingress from record-addressed Unix-socket receive and
+  the ACP explicit tool projection; this is contract prose, not a new acceptance receipt.
+
+### Fixed
+
+- **Claude ACP turns no longer get vendor-managed background work (#125).** The Claude adapter's
+  child env sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1`, which turns off the vendor's own
+  Bash/Agent `run_in_background` option and its timeout / turn-abort auto-backgrounding. Cortex is
+  unchanged. A process a command detaches on its own (`&`, `setsid`, a daemon) is outside this
+  switch, so it is not a general termination guarantee. Observed on the branch (#125, one host,
+  not a release acceptance): cancelling a reused turn's foreground work ended it and the same
+  session served the next turn, while a cancelled FIRST turn is not retained and the next turn
+  bootstraps a new session. Pinned by `[QK:ACP-CLAUDE-FOREGROUND-ONLY]` with one rollback mutant.
+- **`check-pack-install` keeps the consumer inside its own sandbox.** Its consumer subcalls name
+  every writable root (HOME, four XDG, `PI_CODING_AGENT_DIR`); an inherited agent dir had received
+  the npm consumer's user-scope settings (`[QK:PACK-INSTALL-INHERITED-AGENTDIR-UNTOUCHED]`,
+  `[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED]`).
+- **LIVE smokes match Pi 1.0 (#125).** Isolated pi citizens load `-e builtin:mcp` beside
+  `--no-extensions`, which turns the built-in MCP off too; the chain hop-2 tool name uses the
+  underscore form. `smoke-acp-session-reuse-live` judges reuse by turn 2's `[acp: reusing live
+  session]` notice rather than by recall alone, since a rebuilt turn re-sends the full transcript.
+  The native lifecycle cell drives `openai-codex/gpt-6-luna`.
+- **Docs state the current contract.** The bridge's eight verbs are counted as eight wherever a
+  current sentence counts them (dated seven-tool receipts stay as they were). The harness source
+  map's callback column names `FRESH_CALL_CALLBACK_TOOL`, with the delivery dialects moved to a
+  note. The ACP support table is this checkout's declaration rather than a shipped baseline,
+  VERIFY's surface banner no longer carries 0.21.0's acceptance numbers, the Herdr docs separate
+  the committed `herdr-checkout` carrier from npm's production authority, and VERIFY's ACP
+  troubleshooting reads turn evidence from lifecycle notices and the session's stopReason.
+
+## 0.25.1 - 2026-09-30
+
+### Added
+
+- **Per-group qualification receipts, a composite ledger, and an offline exact-SHA oracle (#124,
+  development tooling — not release policy).** `check-gate-qualification --group <argv> --receipt
+  <path>` runs one exact-argv group through the unchanged control → mutant → restore → control body
+  and writes a sealed `PARTIAL/local` receipt; `--groups <JSON|all> --collect <dir>` runs several in
+  one process and writes an inventory (`collection.json` + `gNNN.json`), never a verdict;
+  `--compose` builds a local ledger whose groups are MEASURED, FAIL, INHERITED-UNVERIFIED or UNRUN
+  (CARRIED is defined and never populated — no audited dependency projection exists), with verdicts
+  RED / NOT-QUALIFIED / RISK-PENDING / COMPOSITE-GREEN. A dispatch-only `ci.yml` step
+  (`workflow_dispatch -f composite_groups=…`) uploads a collection artifact, and
+  `scripts/qualification-oracle.ts` composes an exact-SHA ledger from GitHub run, job and artifact
+  evidence inside a clean clone of that SHA. **Release acceptance is unchanged:**
+  `verify-exact-ci.sh` plus the full qualification body stay the release MUST until #124 P3, and no
+  release path calls the composite oracle. **Unobserved:** no collection artifact has been uploaded
+  yet, so the real GitHub zip layout, the CI work-surface cross-check and the collector's CI
+  environment are unmeasured; the reader fails closed on anything it does not recognize. New mutant
+  lane `qualification-ledger` (42 QK claims); the committed set is 824 mutants across 63 lanes.
+  Frozen-candidate evidence before commit (host `oracle`, work surface `ccfb8bbe9cd2…`):
+  qualification body 824/824 killed in 5,053 s, `check:full` exit 0 in 617 s. Issue #124 stays open.
+
+### Changed
+
+- **Herdr plugin runtime lock returns to `herdr-checkout` for the 0.25.1 candidate window.** An npm
+  lock must name a version that is already published and coherent with the checkout's
+  `package.json` (`check-herdr-runtime-bootstrap` `[QK:HRB-LOCK-SOURCE-CLOSED]`), so the 0.25.0 npm
+  pin cannot ride a 0.25.1 cut. The npm pin returns as a follow-up once 0.25.1 is on the registry
+  (the dd84ac0 pattern).
+- **GitHub release notes are soft-wrapped at M6 extraction** (`entwurf-release`): paragraphs and
+  list items are joined, fenced code stays byte-for-byte, and the extraction refuses notes whose text
+  differs from the CHANGELOG section by anything beyond whitespace.
+
+- **Herdr plugin 0.5.1 is the follow-up for the #120-aware raw-install LIVE oracle.**
+  Plugin 0.5.0 already shipped on the `v0.25.0` tag and its npm-pinned follow-up commit
+  `113ca5327074b77eb5d81453b1a277afcdf4ddca` was publicly reachable. The first clean-host
+  test of that commit completed install, npm integrity, pi/Claude activation and record-backed
+  birth, then falsely marked the status pane red: it still required `herdr-agent-list-failed` at
+  column zero, while #120 moved that name into the owner-labelled `[4] CITIZENS` block. The
+  corrected assertion anchors both that block and its indented failure line; the same remote
+  0.5.0 commit then passed the full first-user path without production-code changes (receipt
+  below). The manifest alone advances to 0.5.1 here to distinguish this verified follow-up from
+  the already public 0.5.0. **This is not yet a LIVE acceptance claim for 0.5.1**; its remote
+  commit must be tested separately before a physical-host install is handed to GLG.
+
+- **Herdr plugin 0.5.0 pins its runtime to the published npm `@junghanacs/entwurf@0.25.0`.**
+  The `v0.25.0` tag already carries `plugins/herdr/herdr-plugin.toml` at 0.5.0; this post-publish
+  follow-up replaces its candidate-window `herdr-checkout` lock with the exact published npm
+  version and sha512. `npm view @junghanacs/entwurf@0.25.0 dist.integrity` and an independent
+  SHA-512 over the preserved accepted candidate
+  (`/tmp/entwurf-release-candidate-0.25.0.pyaGKq/junghanacs-entwurf-0.25.0.tgz`, sha256
+  `6ed3d67c8db30b71572738b9cddce38c9cf12d73c4f494b48b1475235918a968`) agree on
+  `sha512-6Cm5qFZiR8OtqSszcfv/bhxhFlLL0dmeBOnBp3wnnL5JOI6e68anEG3SUuUXKK7CuCaM4S+ft7H8vgVKw4vDhg==`;
+  npm's published `dist.shasum` matches the accepted candidate's SHA-1, and registry `latest` is
+  0.25.0 while `repair` remains 0.12.8-repair.1. The lock and its three committed-lock gate cells
+  move together (forward of the 0.25.0 candidate inverse); source switches still require explicit
+  deactivation. Focused `check-herdr-plugin-build`, `check-herdr-runtime-bootstrap`,
+  `check-herdr-plugin`, `check-herdr-plugin-profile`, `check-dep-versions`, and
+  `check-gate-manifests` passed; the last confirms 782 mutants across 62 lanes without executing
+  qualification. These are local pin/protocol receipts, **not** a public-remote first-user-path
+  receipt: that journey needs the committed pin on a reachable ref and must be measured separately.
+- **Public-remote first-user path (2026-09-23, after pin push).** In a clean `node:24` container,
+  `LIVE=1 ENTWURF_REQUIRE_DOCKER=1 ./run.sh smoke-herdr-raw-install-live --ref main`
+  resolved `main` to `113ca5327074b77eb5d81453b1a277afcdf4ddca`, read plugin manifest 0.5.0,
+  fetched `kind=npm @junghanacs/entwurf@0.25.0` at tarball SHA-256
+  `6ed3d67c8db30b71572738b9cddce38c9cf12d73c4f494b48b1475235918a968`, wired pi and
+  Claude, born a record-backed pi citizen without a model turn, read the status fan with and
+  without a Herdr server, and deactivated/reinstalled successfully. **PASS**; full log
+  `/tmp/entwurf-herdr050-raw-install-113ca53-amended.log`, sha256
+  `406ff681166e596c9b358ffbac9129fe32c9c7878c874d177ebc3f1cab661788` (decisive lines
+  above are reproduced here for cross-host readers). The first attempt on this same remote SHA
+  failed only at the fan oracle: #120 now reports `herdr-agent-list-failed` inside the `[4] CITIZENS`
+  block, not at column zero. `scripts/smoke-herdr-raw-install-live.sh` now anchors that block and
+  its indented failure line; the corrected run passed with no product-source change. The older
+  `smoke-herdr-plugin-build-live` still asserts the **checkout** carrier and is not evidence for
+  this npm pin — running it here reported the expected source mismatch, not an install failure.
+
+### Verification
+
+Prepared tree over `8b92e09` (CHANGELOG + `package.json` 0.25.1, uncommitted and frozen while the
+gates ran), host `oracle`, 2026-09-30 KST, ambient identity carriers stripped (`ENTWURF_*`,
+`CLAUDE*`, `PI_SESSION_ID`, `PI_AGENT_ID`).
+
+- **Deterministic floor (P4):** `pnpm run build-bridge` then `pnpm run check:full`,
+  `[check:full] total elapsed 624s exit 0`, `[check-pack] 550 files in tarball`.
+- **Aggregate LIVE floor (P5):** `LIVE=1 ./run.sh release-gate <scratch> --cut`, scratch
+  `/tmp/entwurf-release-gate-0.25.1.pDnZeR`, log `release-gate.log` sha256
+  `9a7e698cafa4fd476301be2e61b291c88ec40b059955c97aae8d829c3d213a7c`, 6,022 s:
+  **MUST PASS=24 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Inside it,
+  `check-gate-qualification` reported `qualified claims: 824/824 killed` and
+  `[gate-qualification] ok` (824 mutants, 63 lanes), and `smoke-codex-fresh-live` ran inside the
+  aggregate for the first time with the operator-supplied triple: app-server PID `2786140`,
+  started by this release lane with `./run.sh codex-app-server` in its own tmux session `$261`
+  (the native process owning the control socket, read from that pane's own process tree, never a
+  search), Codex `gpt-5.6-luna`, Pi `openai-codex/gpt-5.6-terra` →
+  `64 assertions ok`. The app-server was stopped after the gate.
+- **Pre-LIVE doctors:** meta-bridge, pi-package, the four Codex doctors, the three OMP doctors and
+  agy-bridge exit 0; `doctor-copilot-bridge` exits 1 with `copilot CLI missing from PATH` (Copilot is
+  not a release MUST rail on this host).
+- **Host residue (P9, at the gate's verdict):** 628 → 619 owned `/tmp` dirs; 9 roots / 1.1 G
+  reclaimed, none minted by this run (7 `check-probe-ordering` roots dated 2026-09-23..29, one
+  `entwurf-s2b-overlay`, one 1.1 G `entwurf-hpbl` from 2026-09-23). The recurring
+  `check-probe-ordering` residue names a gate that still leaks on some path. One reparented process
+  holds a `/tmp` path and was named, not killed: the operator's own
+  `emacs --init-directory=/tmp/agent-emacs-init --daemon`.
+- **Not claimed:** exact-SHA CI and the preserved-artifact acceptance belong to `make`; the #124
+  composite collection has not been dispatched, so no composite ledger exists for this release.
+
 ## 0.25.0 - 2026-09-23
 
 ### Added

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/DELIVERY.md

@@ -108,7 +108,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
-| **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
+| **pi Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. A pi session calls the verbs through Pi's built-in MCP running the compiled `entwurf-bridge` (#125); the receive rail is unchanged. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |