@junghanacs/entwurf 0.25.1 → 0.30.0

package/scripts/check-entwurf-v2-surface.ts

@@ -142,7 +142,7 @@ function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: st
 	}
 	ok(`${tag} — mode param is isolated (non-vacuous)`, modeDesc.length > 60);
 	ok(
-		`${tag} — mode param scopes itself to a CONTROL-SOCKET send and denies the other rails [QK:V2SURF-PI-MODE-SCOPE]`,
+		`${tag} — mode param scopes itself to a CONTROL-SOCKET send and denies the other rails [QK:V2SURF-MODE-SCOPE]`,
 		/CONTROL-SOCKET send/.test(modeDesc) && /no mode/.test(modeDesc),
 	);
 	ok(
@@ -692,39 +692,21 @@ async function main(): Promise<void> {
 		ok("3: surface is ctx-free — no ExtensionAPI", !code.includes("ExtensionAPI"));
 	}
 
-	// ── 4: pi-native control wiring guard ─────────────────────────────────────
+	// ── 4: pi-native control surface — the RECEIVER half, and no second caller route ──
+	// #125: the Entwurf verbs are no longer native pi tools. A pi session reaches them through Pi's
+	// built-in MCP as `mcp__entwurf_bridge__<verb>` — the SAME bridge §5 certifies — so the pi-native
+	// copies of §5's model-facing checks (rail semantics, dormant honesty, host cap, peers dead row)
+	// and the fence/senderProvider wiring they needed are retired with them, not re-proved against a
+	// file that no longer has them. What stays here is what this file still owns: the control
+	// socket's RECEIVER answer, and the absence of a second caller route.
 	{
 		const src = await fs.readFile(CONTROL_SRC, "utf8");
 		const code = src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-		ok("4: pi-native — entwurf-control registers entwurf_v2", /name:\s*"entwurf_v2"/.test(src));
+		// Hard Rule 1: one surface name, no dual route. A native registration of any Entwurf verb
+		// beside the MCP one would put the bare and the prefixed name in the same session.
 		ok(
-			"4: pi-native — reaches the fence via a NON-LITERAL dynamic import (string-const specifier)",
-			/const ENTWURF_V2_SURFACE_MODULE\s*=/.test(code) && /await import\(ENTWURF_V2_SURFACE_MODULE\)/.test(code),
-		);
-		// The whole point of the dynamic import: NO static import of the fence v2 chain into the
-		// emit-capable root program (those literal `.ts` imports would be TS5097).
-		ok(
-			"4: pi-native — NO static import of the v2 fence (runner/production/surface) — TS5097 stays closed",
-			!/import[^;]*from\s*"\.\/lib\/entwurf-v2-(runner|production|surface)\.(js|ts)"/.test(code),
-		);
-		// SE-1 2e-a: senderProvider decorates origin:'pi-session' but `replyable` is now an
-		// HONEST fact (canonical socket existsSync via computeSelfAddressability), NOT a
-		// hardcoded true. The self-address fence lib is reached through the same non-literal
-		// dynamic import pattern as the v2 surface.
-		ok(
-			"4: pi-native — senderProvider decorates origin:'pi-session' (no hardcoded replyable:true)",
-			/origin:\s*"pi-session"/.test(code) && !/replyable:\s*true/.test(code),
-		);
-		ok(
-			"4: pi-native — replyability via computeSelfAddressability + existsSync, dynamic-imported",
-			/const ENTWURF_SELF_ADDRESS_MODULE\s*=/.test(code) &&
-				/await import\(ENTWURF_SELF_ADDRESS_MODULE\)/.test(code) &&
-				/computeSelfAddressability/.test(code) &&
-				/existsSync\(/.test(code),
-		);
-		ok(
-			"4: pi-native — NO static import of the self-address fence (TS5097 stays closed)",
-			!/import[^;]*from\s*"\.\/lib\/entwurf-self-address\.(js|ts)"/.test(code),
+			"4: pi-native — entwurf-control registers NO native tool (the verbs live on the one MCP bridge, #125)",
+			!/\bregisterTool\s*\(/.test(code) && !/name:\s*"entwurf_/.test(code),
 		);
 		// #120 P2: the RECEIVER's own answer. The sender can only render a boundary the receiver
 		// actually names, so this is the far end of the same contract — and the bare `delivered`
@@ -745,82 +727,6 @@ async function main(): Promise<void> {
 				);
 			})(),
 		);
-		// Every SHIPPED rail must appear in the model-facing text. Measured 2026-07-27: both
-		// surfaces described only control-socket/mailbox and told the model that an
-		// `unsupported` citizen is reached "→ mailbox" — false for Antigravity, whose native-push
-		// rail is intercepted BEFORE the mailbox mini-table and has no mailbox at all. A model
-		// reading that would pick mailbox semantics for a citizen that has none.
-		//
-		// Scope this to the registration block, NOT the whole file: the first version of this
-		// assertion swept `src`, so deleting the sentence from the description still passed on an
-		// unrelated `native-push` string elsewhere in the module. A rail-completeness claim that
-		// any import line can satisfy is not a claim.
-		const piV2Start = src.indexOf("function registerEntwurfV2Tool");
-		const piV2End = src.indexOf("\nfunction ", piV2Start + 1);
-		// Require a REAL end marker. `piV2End === -1 ? undefined : …` would silently widen the
-		// block to end-of-file and keep passing, which is the opposite of the fail-loud this
-		// scope exists for.
-		ok(
-			"4: pi-native — registration block is isolated (non-vacuous scope for the description checks)",
-			piV2Start !== -1 && piV2End > piV2Start,
-		);
-		const piV2Block = src.slice(piV2Start, piV2End);
-		ok("4: pi-native — registration block is substantial", piV2Block.length > 500);
-		// BLOCK SCOPE IS NOT ENOUGH — the two model-facing strings mask each other. Measured
-		// 2026-07-27 (round 4): the `intent` param description was corrected to split the two
-		// reject reasons while the LONG tool description still advertised the merged, false one,
-		// and this gate stayed green at 51 checks because both live in the same block and only
-		// ONE had to carry each literal. So slice them apart and require EACH to be true.
-		// The start marker MUST be unique to the long description. Measured 2026-07-27 (round 5):
-		// a bare `description:` matched the `target` PARAM first, so this "long description"
-		// slice was 4,468 chars spanning target + intent + the long text — the very masking the
-		// split was added to remove. An over-wide slice is a silent pass, so pin the exact
-		// backtick opening instead, and assert the two slices are actually disjoint.
-		const piLongDesc = sliceDescription(piV2Block, "description: `CANONICAL", "\n\t\tparameters:");
-		const piIntentDesc = sliceDescription(piV2Block, "intent: StringEnum(", "message:");
-		ok(
-			"4: pi-native — long/intent slices are disjoint (neither can satisfy the other's claim)",
-			piLongDesc.length > 0 &&
-				piIntentDesc.length > 0 &&
-				!piLongDesc.includes(piIntentDesc) &&
-				!piIntentDesc.includes(piLongDesc),
-		);
-		for (const [what, text] of [
-			["long tool description", piLongDesc],
-			["intent param description", piIntentDesc],
-		] as const) {
-			ok(`4: pi-native — ${what} is isolated (non-vacuous)`, text.length > 120);
-			ok(`4: pi-native — ${what} names the native-push rail`, /native-push/.test(text));
-			assertDormantHonesty(`4: pi-native — ${what}`, text);
-		}
-		ok("4: pi-native — long description denies native-push a mailbox", /NO mailbox/.test(piLongDesc));
-		ok(
-			"4: pi-native — long description steers live/alive peer → fire-and-forget",
-			/liveness=alive/.test(piLongDesc) && /fire-and-forget/.test(piLongDesc),
-		);
-		assertLongDescExcludesParams("4: pi-native", piLongDesc, [
-			"target: Type.String(",
-			"intent: StringEnum(",
-			"mode: Type.Optional(",
-			"wants_reply: Type.Optional(",
-		]);
-		const piModeDesc = sliceDescription(piV2Block, "mode: Type.Optional(", "wants_reply:");
-		assertRailSemantics("4: pi-native", piLongDesc, piIntentDesc, piModeDesc);
-		assertDescriptionFitsHostCap("4: pi-native", piLongDesc);
-
-		// 4b: pi-native entwurf_peers. Asserted on THIS surface too, not only the MCP one: the two
-		// descriptions are read by different callers (a resident pi model vs a sibling reaching in
-		// over MCP), and a correction that lands on one of them is a correction half the garden
-		// never sees. Same real-boundary rule as every other slice here.
-		const piPeersStart = src.indexOf('name: "entwurf_peers"');
-		const piPeersEnd = src.indexOf("parameters:", piPeersStart + 1);
-		ok(
-			"4b: pi-native — entwurf_peers description block has a REAL end boundary",
-			piPeersStart !== -1 && piPeersEnd > piPeersStart,
-		);
-		const piPeersBlock = src.slice(piPeersStart, piPeersEnd);
-		ok("4b: pi-native — entwurf_peers description is isolated (non-vacuous)", piPeersBlock.length > 200);
-		assertPeersDeadRowHonesty("4b: pi-native", piPeersBlock);
 	}
 
 	// ── 5: MCP bridge wiring guard ────────────────────────────────────────────
@@ -1052,15 +958,16 @@ async function main(): Promise<void> {
 		);
 	}
 
-	// ── #120 P2 (D8): the OUTCOME list in both tool descriptions names every rail ──
-	// A caller reads one of these two blurbs and nothing else before dispatching. The control
+	// ── #120 P2 (D8): the OUTCOME list in the tool description names every rail ──
+	// A caller reads this blurb and nothing else before dispatching. (#125: the pi-native copy is
+	// retired with the native verbs; a pi session reads the bridge's own blurb.) The control
 	// rail's four boundaries are the ONLY receiver-acceptance values; a mailbox answers with an
 	// ENQUEUE receipt and native-push with an INJECTION, and folding those into the boundary union
 	// would tell a caller that `mailbox-enqueued` is something a receiver observed about its own
 	// queues. Missing either rail is red — the earlier draft listed `mailbox-enqueued` beside the
 	// four and left native-push out entirely, and nothing noticed.
 	{
-		const outcomeSites = ["mcp/entwurf-bridge/src/index.ts", "pi-extensions/entwurf-control.ts"];
+		const outcomeSites = ["mcp/entwurf-bridge/src/index.ts"];
 		const missing: string[] = [];
 		for (const rel of outcomeSites) {
 			const text = await fs.readFile(path.join(REPO, rel), "utf8");
@@ -1080,12 +987,14 @@ async function main(): Promise<void> {
 			}
 		}
 		ok(
-			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] both tool descriptions name each rail's own result — the control receiver's four acceptance boundaries (and that those four are the whole union), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
+			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] the tool description names each rail's own result — the control receiver's four acceptance boundaries (and that those four are the whole union), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
 			missing.length === 0,
 		);
 	}
 
-	// ── #120 P2: the four caller-facing prose sites, checked for what they SAY ──
+	// ── #120 P2: the caller-facing prose sites, checked for what they SAY ──
+	// (#125: three sites now — the pi-native copy left with the native verbs; a pi session reads
+	// the bridge's own `mode` text, which stays the first site below.)
 	// `[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` neither mode interrupts anything: `agent-loop.js:186`
 	// drains steering after a turn ENDS and `:191-197` drains follow-ups only once the inner loop
 	// has ended. A caller who reads "interrupt the current turn" picks `steer` for urgency and gets
@@ -1099,7 +1008,6 @@ async function main(): Promise<void> {
 	{
 		const sites = [
 			"mcp/entwurf-bridge/src/index.ts",
-			"pi-extensions/entwurf-control.ts",
 			"pi-extensions/lib/entwurf-v2-contract.ts",
 			"pi-extensions/lib/entwurf-v2-contract-schema.ts",
 		];

package/scripts/check-fresh-call-dispatch.ts

@@ -20,9 +20,9 @@
  *   FCD-HERDR-BACKEND-FIRST   a non-pilot backend refuses before any preflight and any mutation
  *   FCD-CODEX-PREFLIGHT-TMUX  the Codex preflight still gates the tmux rail, and only that rail
  *   FCD-ONE-NONCE             one nonce is minted per call and reaches the selected rail
- *   FCD-SURFACE-PARITY        both surfaces call the same dispatcher and renderer, with no
- *                             second copy of the rail choice or the preflight ordering
- *   FCD-PI-DYNAMIC-IMPORT     pi still reaches it through its lazy dynamic import
+ *   FCD-SURFACE-ROOT-ONLY     the one public surface (the bridge; pi reaches it through Pi's
+ *                             built-in MCP since #125) calls the dispatcher and renderer, with
+ *                             no copy of the rail choice or preflight, and pi keeps no second path
  *   FCD-RENDER-PER-RAIL       each rail renders its own receipt; no universal tmux prose
  *   FCD-HERDR-VIEW-NOT-ADDRESS  the herdr receipt says its coordinates are a view
  *   FCD-RECOVERY-VISIBLE      a post-split failure shows closed vs orphan-unreclaimed:reason
@@ -190,11 +190,16 @@ async function main(): Promise<void> {
 			/result: await herdrFreshCall\(/.test(dispatchCode),
 	);
 
-	// ── one composition root, two surfaces ───────────────────────────────────────────────
+	// ── one composition root, one public surface ─────────────────────────────────────────
+	// #125: the pi-native fresh-call copy is retired — a pi session reaches the bridge's through Pi's
+	// built-in MCP — so the claim is no longer parity between two copies. It is that the ONE
+	// surface reaches the root without carrying rail choice, preflight or render of its own, and
+	// that the pi extension did not keep a second path to the root beside it.
 	ok(
-		"[QK:FCD-SURFACE-PARITY] BOTH surfaces reach the dispatcher and its renderer, and NEITHER carries its own rail choice, its own Codex preflight or its own rail-specific render — a defect planted in one copy would survive on the other",
-		PI_SRC.includes("dispatchFreshCall(") &&
-			PI_SRC.includes("renderDispatchedFreshCall(") &&
+		"[QK:FCD-SURFACE-ROOT-ONLY] the bridge reaches the dispatcher and its renderer and carries no rail choice, Codex preflight or rail-specific render of its own; the pi extension carries no fresh-call path at all",
+		!PI_SRC.includes("dispatchFreshCall(") &&
+			!PI_SRC.includes("renderDispatchedFreshCall(") &&
+			!PI_SRC.includes("fresh-call-dispatch") &&
 			MCP_SRC.includes("dispatchFreshCall({") &&
 			MCP_SRC.includes("renderDispatchedFreshCall(") &&
 			// Both DESCRIBE the rule to callers ("inside herdr (HERDR_ENV=1)…") and must keep
@@ -206,12 +211,6 @@ async function main(): Promise<void> {
 			!MCP_SRC.includes("renderHerdrFreshCall") &&
 			!PI_SRC.includes("renderHerdrFreshCall"),
 	);
-	ok(
-		"[QK:FCD-PI-DYNAMIC-IMPORT] pi still reaches the composition root through its LAZY dynamic import — a static import would pull the rails into pi's startup path, which is the fence that keeps extension load cheap",
-		/const FRESH_CALL_DISPATCH_MODULE = "\.\/lib\/fresh-call-dispatch\.ts";/.test(PI_SRC) &&
-			PI_SRC.includes("await import(FRESH_CALL_DISPATCH_MODULE)") &&
-			!/^import .*fresh-call-dispatch/m.test(PI_SRC),
-	);
 
 	// ── rendering stays rail-honest ──────────────────────────────────────────────────────
 	const herdrRefusal = renderDispatchedFreshCall({

package/scripts/check-gate-qualification.ts

@@ -505,6 +505,45 @@ if (ARGS.mode === "attribution-self-test") {
 			validateManifestSet([man], { ...permissiveOrigin, regularContainedFile: (f: string) => f !== "gates/kill.sh" }),
 		"signatureSource gates/kill.sh is not a regular",
 	);
+
+	// A declared build output (#125): optional, exact keys, a normalized repo-relative
+	// directory outside node_modules/.git, and one declaration per gate group.
+	const build = { argv: ["bash", "build.sh"], output: "out" };
+	ok(
+		"manifest: a declared build validates and rides the spec",
+		JSON.stringify(validateManifest(mutate({ build }), "m").mutants[0].build) === JSON.stringify(build),
+	);
+	ok("manifest: a spec without a build carries no build key", !("build" in man.mutants[0]));
+	throws(
+		"manifest: an unknown build key is refused",
+		() => validateManifest(mutate({ build: { ...build, env: {} } }), "m"),
+		"unknown key",
+	);
+	throws(
+		"manifest: a shell-string build is refused (argv array only)",
+		() => validateManifest(mutate({ build: { ...build, argv: "bash build.sh" } }), "m"),
+		"non-empty array",
+	);
+	for (const output of ["../out", "/tmp/out", "out/../x", "./out", "out/", "node_modules/x", ".git/x"]) {
+		throws(
+			`manifest: a build output ${JSON.stringify(output)} is refused`,
+			() => validateManifest(mutate({ build: { ...build, output } }), "m"),
+			"output",
+		);
+	}
+	const withBuild = validateManifest(
+		{
+			...good,
+			lane: "built",
+			mutants: [{ ...good.mutants[0], claim: "SELFTEST-BUILT", signature: "[QK:SELFTEST-BUILT]", build }],
+		},
+		"c",
+	);
+	throws(
+		"[QK:QUALIFY-BUILD-GROUP-CONSISTENT] manifest set: one gate whose mutants declare different builds (here: one none) is refused — the same gate would be handed different inputs by run order",
+		() => validateManifestSet([man, withBuild], permissiveOrigin),
+		"mixes build declarations",
+	);
 }
 
 // ═══ Phase 1c — the pipeline over a synthetic fixture repo ══════════════════
@@ -879,6 +918,207 @@ const quiet = (): void => {};
 	}
 }
 
+// ═══ Phase 1c-b — a declared build output over a source-only fixture (#125) ═══
+//
+// The snapshot replicates the work surface only, so an IGNORED build output a gate consumes
+// (the compiled entwurf-bridge) is absent, and such a gate is CONTROL-RED in every run. A
+// mutant may declare that build instead. Each cell is a discriminating negative: a runner
+// that skipped the rebuild after a mutation, read a build red as a kill, let one group's
+// output reach another, or ignored a gate writing into the output flips exactly one of them.
+
+function buildDeclaredOutputFixture(): string {
+	const dir = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-build-")));
+	const write = (rel: string, body: string): void => {
+		const p = path.join(dir, rel);
+		fs.mkdirSync(path.dirname(p), { recursive: true });
+		fs.writeFileSync(p, body);
+	};
+	write(".gitignore", "out/\n");
+	write("src.txt", "alpha\noriginal-line\nomega\n");
+	write("tracked-out/keep.txt", "a tracked directory is source, never a build output\n");
+	// The build prints the build-red mutant's own token on its FAILURE line on purpose: a
+	// runner that read build output as gate output would call the broken build a kill.
+	write(
+		"build.sh",
+		'set -e\nrm -rf out\nmkdir -p out\nif grep -q break-build src.txt; then echo "FAIL: build broke [QK:SELFTEST-BUILD-RED]" >&2; exit 1; fi\ncp src.txt out/built.txt\n',
+	);
+	// Reads ONLY the build output: it can see the planted defect only if the runner rebuilt.
+	write(
+		"gates/built.sh",
+		'if [ ! -f out/built.txt ]; then echo "FAIL: build output missing" >&2; exit 1; fi\nif grep -q defect-line out/built.txt; then echo "FAIL: built defect [QK:SELFTEST-BUILD-KILL]" >&2; exit 1; fi\nexit 0\n',
+	);
+	write(
+		"gates/writer.sh",
+		'if [ ! -f out/built.txt ]; then exit 1; fi\nif grep -q defect-line out/built.txt; then echo stray > out/stray.txt; echo "FAIL: built defect [QK:SELFTEST-BUILD-WRITER]" >&2; exit 1; fi\nexit 0\n',
+	);
+	write(
+		"gates/no-output.sh",
+		'if [ -e out ]; then echo "FAIL: a build output leaked out of its group" >&2; exit 1; fi\nexit 0\n',
+	);
+	const git = (...args: string[]): void => {
+		const r = spawnSync("git", ["-C", dir, ...args], {
+			stdio: "ignore",
+			env: {
+				...process.env,
+				GIT_CONFIG_GLOBAL: "/dev/null",
+				GIT_CONFIG_SYSTEM: "/dev/null",
+				GIT_AUTHOR_NAME: "fx",
+				GIT_AUTHOR_EMAIL: "fx@localhost",
+				GIT_COMMITTER_NAME: "fx",
+				GIT_COMMITTER_EMAIL: "fx@localhost",
+			},
+		});
+		assert.equal(r.status, 0, `fixture git ${args.join(" ")} failed`);
+	};
+	git("init", "-q");
+	git("add", "-A");
+	git("-c", "commit.gpgsign=false", "commit", "-q", "-m", "fixture");
+	return dir;
+}
+
+{
+	const origin = buildDeclaredOutputFixture();
+	const build = { argv: ["bash", "build.sh"], output: "out" };
+	const spec = (patch: Partial<MutantSpec>): MutantSpec => ({
+		claim: "SELFTEST-BUILD-KILL",
+		title: "fixture",
+		subject: "src.txt",
+		find: ["original-line"],
+		replace: ["defect-line"],
+		gate: ["bash", "gates/built.sh"],
+		timeoutSeconds: 30,
+		signature: "[QK:SELFTEST-BUILD-KILL]",
+		signatureSource: "gates/built.sh",
+		build,
+		...patch,
+	});
+	const snap = createRepoSnapshot(origin);
+	try {
+		ok(
+			"build fixture: the snapshot is source-only — the ignored output is not replicated",
+			!fs.existsSync(path.join(snap.repoDir, "out")),
+		);
+		const report = await qualifyMutants(
+			snap,
+			[
+				// No declaration, same script: the #125 shape — the gate needs an output nobody built.
+				// It runs FIRST, so its verdict never depends on whether an earlier group cleaned up.
+				spec({
+					claim: "SELFTEST-BUILD-UNDECLARED",
+					signature: "[QK:SELFTEST-BUILD-UNDECLARED]",
+					gate: ["bash", "gates/built.sh", "undeclared"],
+					build: undefined,
+				}),
+				spec({}),
+				spec({
+					claim: "SELFTEST-BUILD-RED",
+					signature: "[QK:SELFTEST-BUILD-RED]",
+					replace: ["break-build"],
+				}),
+				spec({
+					claim: "SELFTEST-NO-LEAK",
+					signature: "[QK:SELFTEST-NO-LEAK]",
+					gate: ["bash", "gates/no-output.sh"],
+					build: undefined,
+				}),
+			],
+			quiet,
+		);
+		const byClaim = new Map(report.groups.flatMap((g) => g.mutants.map((m) => [m.claim, { g, m }] as const)));
+		ok(
+			"[QK:QUALIFY-BUILD-TRACKS-MUTATION] a gate that reads ONLY the declared build output kills a mutant planted in the build's SOURCE — the runner rebuilt from the mutated bytes, and the restored bytes rebuilt the baseline (control-post green)",
+			byClaim.get("SELFTEST-BUILD-KILL")?.m.verdict === "KILLED" &&
+				byClaim.get("SELFTEST-BUILD-KILL")?.g.control === "ok",
+		);
+		ok(
+			"[QK:QUALIFY-BUILD-RED-NOT-A-KILL] a mutation that breaks the build is never a kill, even when the build prints the claim token on its failure line — the gate did not run",
+			byClaim.get("SELFTEST-BUILD-RED")?.m.verdict === "WRONG-REASON" &&
+				(byClaim.get("SELFTEST-BUILD-RED")?.m.detail ?? "").includes("declared build red"),
+		);
+		ok(
+			"[QK:QUALIFY-BUILD-SCOPED-TO-GROUP] the declared output belongs to its group alone — a later group never sees it, it is gone when the run ends, and the snapshot tree and porcelain are exactly as before",
+			byClaim.get("SELFTEST-NO-LEAK")?.g.control === "ok" &&
+				!fs.existsSync(path.join(snap.repoDir, "out")) &&
+				report.treeClean &&
+				report.porcelainClean,
+		);
+		ok(
+			"build fixture: a gate that needs an output its group did not declare is CONTROL-RED (the #125 qualification shape)",
+			byClaim.get("SELFTEST-BUILD-UNDECLARED")?.m.verdict === "CONTROL-RED",
+		);
+
+		const writer = await qualifyMutants(
+			snap,
+			[
+				spec({
+					claim: "SELFTEST-BUILD-WRITER",
+					signature: "[QK:SELFTEST-BUILD-WRITER]",
+					gate: ["bash", "gates/writer.sh"],
+					signatureSource: "gates/writer.sh",
+				}),
+			],
+			quiet,
+		);
+		ok(
+			"[QK:QUALIFY-BUILD-OUTPUT-GUARDED] a gate that writes into its declared build output voids its own run — IMPURE, never KILLED, and the group is post-red",
+			writer.groups[0].mutants[0].verdict === "IMPURE" && writer.groups[0].control === "post-red",
+		);
+		ok("build fixture: an impure-output report does not pass", reportPassed(writer) === false);
+
+		const baselineRed = await qualifyMutants(
+			snap,
+			[spec({ build: { argv: ["bash", "-c", "exit 3"], output: "out" } })],
+			quiet,
+		);
+		ok(
+			"build fixture: a build red at baseline voids the group — pre-red, every mutant CONTROL-RED",
+			baselineRed.groups[0].control === "pre-red" && baselineRed.groups[0].mutants[0].verdict === "CONTROL-RED",
+		);
+		await assert.rejects(
+			qualifyMutants(snap, [spec({ build: { argv: ["bash", "build.sh"], output: "tracked-out" } })], quiet),
+			/already exists in the snapshot/,
+			"a declared output that is on the work surface must be refused before anything runs",
+		);
+		ok(
+			"build fixture: a declared output that is on the work surface is refused before anything runs, and its source bytes are untouched",
+			fs.existsSync(path.join(snap.repoDir, "tracked-out", "keep.txt")),
+		);
+		await assert.rejects(
+			qualifyMutants(snap, [spec({ build: { argv: ["bash", "build.sh"], output: "absent-parent/out" } })], quiet),
+			/no parent directory in the snapshot/,
+			"a declared output whose parent the snapshot lacks must be refused — the build would leave that directory behind",
+		);
+		ok(
+			"build fixture: a declared output whose parent is absent is refused before anything runs, and nothing was created",
+			!fs.existsSync(path.join(snap.repoDir, "absent-parent")),
+		);
+		// A build that never cleans its output (append-only) still reproduces its baseline: the
+		// runner removes the output before every build, so the contract does not rest on the script.
+		const appending = await qualifyMutants(
+			snap,
+			[
+				spec({
+					gate: ["bash", "gates/built.sh", "appending"],
+					build: {
+						argv: ["bash", "-c", "mkdir -p out && cp src.txt out/built.txt && echo run >> out/append.log"],
+						output: "out",
+					},
+				}),
+			],
+			quiet,
+		);
+		ok(
+			"build fixture: a build that does not clean its own output still kills and reproduces its baseline (control ok, tree clean)",
+			appending.groups[0].mutants[0].verdict === "KILLED" &&
+				appending.groups[0].control === "ok" &&
+				appending.treeClean,
+		);
+	} finally {
+		fs.rmSync(snap.baseDir, { recursive: true, force: true });
+		fs.rmSync(origin, { recursive: true, force: true });
+	}
+}
+
 // ═══ Phase 1c-g — the PARTIAL group receipt over the fixture (#124 P1) ═════
 //
 // `--group` is a mixed CLI/process surface (argv, snapshot, gate children, a file
@@ -3081,6 +3321,7 @@ let manifestCount: number;
 		"acp-backend-preflight": 1,
 		"acp-augment": 10,
 		"acp-cortex": 14,
+		"acp-foreground-only": 1,
 		"acp-launch-namespace": 2,
 		"acp-overlay": 1,
 		"acp-prompt-lifecycle": 15,
@@ -3101,11 +3342,14 @@ let manifestCount: number;
 		"copilot-launch": 14,
 		"pi-launch": 9,
 		"pi-floor": 1,
+		"pi-bridge-sender": 4,
+		"pi-mcp-bridge": 2,
+		"pi-mcp-register": 3,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
-		"fresh-call-dispatch": 12,
+		"fresh-call-dispatch": 11,
 		"fresh-cut": 3,
-		"gate-qualification": 2,
+		"gate-qualification": 7,
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
@@ -3123,10 +3367,10 @@ let manifestCount: number;
 		"mux-fresh-call": 59,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
-		"pack-install": 2,
+		"pack-install": 3,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
-		"mux-resume-call": 12,
+		"mux-resume-call": 10,
 		"omp-birth": 13,
 		"omp-fresh": 24,
 		"omp-receive": 11,

package/scripts/check-install-surface.ts

@@ -260,8 +260,9 @@ const operatorCmds = [...targets].filter(([cmd, ts]) => !isDevGate(cmd) && ts.le
 			.replace(/'(?:[^'\\]|\\.)*'/g, "''");
 	const RUNSH_DRIVE = /(?:\$\{?RUN\}?|run\.sh)\s+(install|setup|remove-user-scope|remove)\b/;
 	// install/setup write the operator's REAL user-scope surfaces under "$HOME"
-	// (user settings.json registration ignores PI_CODING_AGENT_DIR), so sandboxing
-	// the agent dir is not isolation for them; only HOME is. (setup:links died with
+	// (settings.json registration follows PI_CODING_AGENT_DIR when set, but provider
+	// state and the rest stay HOME/XDG-rooted), so sandboxing the agent dir alone is not
+	// isolation for them; HOME is required. (setup:links died with
 	// the target registry — #50 C3.)
 	const HOME_ROOTED = new Set(["install", "setup"]);
 

package/scripts/check-mux-resume-call.ts

@@ -212,6 +212,7 @@ function main(): void {
 
 		const PI_SURFACE = read("pi-extensions/entwurf-control.ts");
 		const MCP_SURFACE = read("mcp/entwurf-bridge/src/index.ts");
+		const PI_CODE = PI_SURFACE.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
 		const V2_RESUME = read("pi-extensions/lib/entwurf-v2-visible-resume.ts");
 		// IMPORTS, not mentions: the module header names the mux side deliberately (that is the
 		// architecture being documented), so an assertion on prose would forbid the explanation
@@ -222,55 +223,43 @@ function main(): void {
 			v2ImportSpecifiers.length > 0 && !v2ImportSpecifiers.some((s) => /mux-/.test(s)),
 		);
 		ok(
-			"both surfaces are the composition root: each imports the mux launcher AND the v2 composition and joins them itself",
-			/mux-resume-call/.test(PI_SURFACE) &&
-				/entwurf-v2-visible-resume/.test(PI_SURFACE) &&
-				/mux-resume-call/.test(MCP_SURFACE) &&
-				/entwurf-v2-visible-resume/.test(MCP_SURFACE),
+			"the bridge is the composition root: it imports the mux launcher AND the v2 composition and joins them itself",
+			/mux-resume-call/.test(MCP_SURFACE) && /entwurf-v2-visible-resume/.test(MCP_SURFACE),
 		);
-
-		// ── the NATIVE PI registration, judged as a registration ─────────────────────
-		// The MCP half is judged on the real runtime tools/list by check-entwurf-bridge-boot.
-		// Native pi has no equivalent boot oracle here, so its registration is read from source —
-		// but narrowly, on the block itself, because "the module is imported" would stay true with
-		// the tool deleted.
-		const PI_BLOCK = (PI_SURFACE.split('name: "entwurf_resume_call",')[1] ?? "").split("\n}")[0];
+		// #125: pi reaches entwurf_resume_call through Pi's built-in MCP — the bridge above IS its
+		// surface. The native pi registration, its target-only TypeBox schema and its description are
+		// retired with it (registration and target-only are held on the runtime tools/list by
+		// BRIDGEBOOT-RESUME-CALL-REGISTERED / -TARGET-ONLY, the description by DESC-CONTRACT-MCP below).
+		// What is left to say about the pi file is that it does not come back as a second root.
 		ok(
-			"[QK:MUXRESUME-PI-SURFACE-REGISTERED] the native pi surface REGISTERS entwurf_resume_call and calls that registration during setup — an imported-but-unregistered verb is invisible to the operator while every import assertion stays green",
-			PI_SURFACE.includes('name: "entwurf_resume_call"') && /registerResumeCallTool\(pi\);/.test(PI_SURFACE),
+			"the pi extension no longer joins the resume halves itself — no second composition root beside the bridge",
+			!/mux-resume-call/.test(PI_CODE) && !/entwurf-v2-visible-resume/.test(PI_CODE),
 		);
+		// The pass-through half the native claim used to carry, now on the one surface that has it:
+		// the handler hands the validated target to the v2 composition UNCHANGED. The schema proves the
+		// input is target-only; this proves the value that reaches the record lookup is that input.
+		const MCP_RESUME_BLOCK = (MCP_SURFACE.split('"entwurf_resume_call",')[1] ?? "").split("\n);")[0];
 		ok(
-			"[QK:MUXRESUME-PI-SURFACE-TARGET-ONLY] the native schema is target-only and the handler passes params.target straight through — a model, task or prompt knob would be a second way to decide what a resumed citizen is, when the record already decided",
-			/Type\.Object\(\{\s*target: Type\.String\(/.test(PI_BLOCK) &&
-				/visibleResume\(params\.target,/.test(PI_BLOCK) &&
-				!/model|task|prompt/.test(PI_BLOCK.split("parameters:")[1]?.split("async execute")[0] ?? ""),
+			"[QK:MUXRESUME-MCP-TARGET-PASSTHROUGH] the bridge handler passes its target straight to visibleResume — a rewritten, defaulted or substituted id would reopen a DIFFERENT citizen than the one the caller named",
+			/async \(\{ target \}\) =>/.test(MCP_RESUME_BLOCK) &&
+				/await visibleResume\(target, makeVisibleResumeDeps\(visibleResumeLaunch\)\)/.test(MCP_RESUME_BLOCK),
 		);
 
-		// ── the description contract, both surfaces ──────────────────────────────────
+		// ── the description contract ────────────────────────────────────────────────
 		// Not prose parity — three claims an operator acts on, plus the host's own cap.
-		const PI_DESC = (PI_BLOCK.split("description: `")[1] ?? "").split("`,")[0];
 		const MCP_DESC = (MCP_SURFACE.split('"entwurf_resume_call",')[1] ?? "").split("{")[0];
 		const statesTheContract = (text: string): boolean =>
 			/dormant/i.test(text) && /no turn/i.test(text) && /observation/i.test(text) && /launch/i.test(text);
 
-		for (const [which, text] of [
-			["native pi", PI_DESC],
-			["MCP bridge", MCP_DESC],
-		] as const) {
-			ok(
-				`${which}: the resume description fits the host's 2048-char tool-description cap`,
-				text.length > 0 && text.length <= 2048,
-			);
-		}
-		// The two claim tokens are written OUT, not interpolated: qualification requires each
-		// `[QK:…]` to appear literally exactly once in its gate source, so a token assembled at
-		// runtime names a claim no manifest can bind to.
 		ok(
-			"[QK:MUXRESUME-DESC-CONTRACT-PI] native pi: the description states the three things a caller acts on — DORMANT targets only, no turn is run, and TWO receipts of which the observation is the one that says the citizen is back",
-			statesTheContract(PI_DESC),
+			"MCP bridge: the resume description fits the host's 2048-char tool-description cap",
+			MCP_DESC.length > 0 && MCP_DESC.length <= 2048,
 		);
+		// The claim token is written OUT, not interpolated: qualification requires each `[QK:…]` to
+		// appear literally exactly once in its gate source, so a token assembled at runtime names a
+		// claim no manifest can bind to.
 		ok(
-			"[QK:MUXRESUME-DESC-CONTRACT-MCP] MCP bridge: the description states the same three things — DORMANT targets only, no turn is run, and TWO receipts whose observation is the fact that matters",
+			"[QK:MUXRESUME-DESC-CONTRACT-MCP] MCP bridge: the description states the three things a caller acts on — DORMANT targets only, no turn is run, and TWO receipts whose observation is the fact that matters",
 			statesTheContract(MCP_DESC),
 		);
 	} finally {