@junghanacs/entwurf 0.25.1 → 0.30.0

package/AGENTS.md

@@ -18,7 +18,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 
 - **entwurf-core (v2):** garden-id addressing, record facts, rail liveness, dispatch decisions, and delivery evidence.
 - **Record authority:** every citizen uses V3 `MetaIdentity`; `backend` selects rail capability, never identity rank.
-- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and exposes pi’s native tools.
+- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and registers the compiled `entwurf-bridge` with Pi’s built-in MCP under that record’s identity.
 - **Native bridges:** register existing sessions without owning transcript or auth. Claude Code and Copilot are self-fetch; Antigravity and Codex are native-push. Codex remains native rather than ACP so its vendor tools, delegation, and work context remain intact. Admission/evidence details belong in [DELIVERY.md](./DELIVERY.md) and [VERIFY.md](./VERIFY.md).
 - **ACP plugin:** one `entwurf` provider under an isolated overlay. The host pi session is already a record-backed citizen; ACP creates neither a second citizen nor a socket layer.
 - **mux:** launch-only placement and fixed-runtime launch. It never imports into delivery. Fresh identity arrives only through its callback envelope, never a lookup; same-id visible resume keeps identity/liveness/locking on the v2 side of the injected seam. Fresh call accepts only the narrow model, literal absolute cwd, and existing caller-server seat inputs; it creates no session and does not infer seat from cwd. A Codex CALLER alone has an omitted-placement rule: it opens beside its own TUI pane, matched by thread-id in that pane title; 0/2+ matches reject; explicit placement still wins. Do not turn either fresh call or resume into a generic driver, command/env carrier, or second creation API. Exact module/argv/import ownership: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md).

package/BASELINE.md

@@ -246,7 +246,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes seven tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes eight tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---
 

package/CHANGELOG.md

@@ -4,6 +4,79 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.30.0 - 2026-10-02
+
+### Changed
+
+- **Pi 1.0 admission — the pi fence is `>=1.0.0 <1.1` (#125).** Dev pins move to Pi 1.0.0 and the
+  peer range to the next-minor ceiling `>=1.0.0 <1.1`. The range checks are major-aware; pack
+  literals, the four affected mutants, the live docs and ROADMAP's two gate-read lines follow. No
+  ACP, vendor or Herdr companion bump rides it. The 0.99.1 and 0.99.2 floors this cycle passed
+  through were branch steps and never shipped. Pi now carries MCP in its core
+  ([You Said No MCP!](https://earendil.com/posts/you-said-no-mcp/), 2026-09-29) and this admission
+  builds on it rather than duplicating native tools; `pi-durable` and Pi's codemode are not adopted
+  here, and what they mean for Entwurf is undecided.
+- **Codex first-admission verification follows the current Pi MCP dialect.** Joined native
+  call/result names must still agree before exact Pi-qualified names become semantic receipts;
+  downstream source audits and receipt-owned cleanup use the same boundary. The LIVE driver now
+  separates launch from callback-validated relay, and clarifies callback-first startup without
+  relaxing message bytes, role counts, omitted cwd/seat, or claiming guaranteed model obedience.
+  The final standalone Codex chain passed 65 assertions, including both exact source-role audits.
+- **This cut has an explicit local acceptance exception (GLG, 2026-10-02).** The original P5
+  remains MUST 23 PASS / 1 FAIL / 0 SKIP, BEHAVIOR PASS; subsequent scoped Codex acceptance is a
+  separate run on amended bytes, not a synthetic 24/24 single-run result. GLG chose not to repeat
+  local full/qualification BODY/P5/M0 after the repairs. Exact prepared-SHA CI (including fresh
+  full and qualification BODY) and preserved-candidate Docker acceptance remain required. The
+  grouped development proofs do not activate #124 P3 composite release policy.
+- **A pi citizen's Entwurf verbs ride Pi's built-in MCP (#125).** A born pi citizen registers the
+  compiled `entwurf-bridge` with `pi.registerMcpServer` under its record gardenId, so a pi model
+  reaches the same server every other host does. The five hand-written native tools are gone;
+  `entwurf_inbox_read` and `entwurf_register_native` are hidden on a pi host, leaving six declared.
+  Pi folds every character outside `[A-Za-z0-9_]` in an MCP tool name to `_`, so a pi model calls
+  `mcp__entwurf_bridge__<verb>`, and the pi fresh-call dialect (callback, delivery, peers) moved to
+  that spelling as one literal hard cut — no alias, no version router. The server key stays
+  `entwurf-bridge`; a same-namespace `mcp.json` entry overrides the registration by Pi's own
+  precedence.
+- **Qualification builds what a gate consumes (#125, development tooling).** The snapshot stays
+  source-only; a mutant may declare `build {argv, output}`, and for that gate group only the
+  runner builds the output from the snapshot's own bytes, rebuilds it after every mutation and
+  before the post-control (baseline digest required), never counts a build red as a kill, voids a
+  run whose gate writes into the output, and removes it when the group ends (`[QK:QUALIFY-BUILD-*]`).
+
+- **README is the product entry; clean-host setup owns the operating detail.** Installation,
+  prerequisites, citizen first use, terms and short history stay in README. Detailed settings,
+  harness configuration, context, skills and upgrades move to `docs/setup-clean-host.md` with
+  retained entry anchors and links. Herdr keeps its separate installation document. VERIFY
+  distinguishes Pi's built-in MCP tool ingress from record-addressed Unix-socket receive and
+  the ACP explicit tool projection; this is contract prose, not a new acceptance receipt.
+
+### Fixed
+
+- **Claude ACP turns no longer get vendor-managed background work (#125).** The Claude adapter's
+  child env sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1`, which turns off the vendor's own
+  Bash/Agent `run_in_background` option and its timeout / turn-abort auto-backgrounding. Cortex is
+  unchanged. A process a command detaches on its own (`&`, `setsid`, a daemon) is outside this
+  switch, so it is not a general termination guarantee. Observed on the branch (#125, one host,
+  not a release acceptance): cancelling a reused turn's foreground work ended it and the same
+  session served the next turn, while a cancelled FIRST turn is not retained and the next turn
+  bootstraps a new session. Pinned by `[QK:ACP-CLAUDE-FOREGROUND-ONLY]` with one rollback mutant.
+- **`check-pack-install` keeps the consumer inside its own sandbox.** Its consumer subcalls name
+  every writable root (HOME, four XDG, `PI_CODING_AGENT_DIR`); an inherited agent dir had received
+  the npm consumer's user-scope settings (`[QK:PACK-INSTALL-INHERITED-AGENTDIR-UNTOUCHED]`,
+  `[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED]`).
+- **LIVE smokes match Pi 1.0 (#125).** Isolated pi citizens load `-e builtin:mcp` beside
+  `--no-extensions`, which turns the built-in MCP off too; the chain hop-2 tool name uses the
+  underscore form. `smoke-acp-session-reuse-live` judges reuse by turn 2's `[acp: reusing live
+  session]` notice rather than by recall alone, since a rebuilt turn re-sends the full transcript.
+  The native lifecycle cell drives `openai-codex/gpt-6-luna`.
+- **Docs state the current contract.** The bridge's eight verbs are counted as eight wherever a
+  current sentence counts them (dated seven-tool receipts stay as they were). The harness source
+  map's callback column names `FRESH_CALL_CALLBACK_TOOL`, with the delivery dialects moved to a
+  note. The ACP support table is this checkout's declaration rather than a shipped baseline,
+  VERIFY's surface banner no longer carries 0.21.0's acceptance numbers, the Herdr docs separate
+  the committed `herdr-checkout` carrier from npm's production authority, and VERIFY's ACP
+  troubleshooting reads turn evidence from lifecycle notices and the session's stopReason.
+
 ## 0.25.1 - 2026-09-30
 
 ### Added

package/DELIVERY.md

@@ -108,7 +108,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
-| **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
+| **pi Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. A pi session calls the verbs through Pi's built-in MCP running the compiled `entwurf-bridge` (#125); the receive rail is unchanged. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |