@junghanacs/entwurf 0.25.1 → 0.30.1

package/AGENTS.md

@@ -18,7 +18,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 
 - **entwurf-core (v2):** garden-id addressing, record facts, rail liveness, dispatch decisions, and delivery evidence.
 - **Record authority:** every citizen uses V3 `MetaIdentity`; `backend` selects rail capability, never identity rank.
-- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and exposes pi’s native tools.
+- **pi adapter:** attaches its native session to a record, hosts the record-keyed control socket, and registers the compiled `entwurf-bridge` with Pi’s built-in MCP under that record’s identity.
 - **Native bridges:** register existing sessions without owning transcript or auth. Claude Code and Copilot are self-fetch; Antigravity and Codex are native-push. Codex remains native rather than ACP so its vendor tools, delegation, and work context remain intact. Admission/evidence details belong in [DELIVERY.md](./DELIVERY.md) and [VERIFY.md](./VERIFY.md).
 - **ACP plugin:** one `entwurf` provider under an isolated overlay. The host pi session is already a record-backed citizen; ACP creates neither a second citizen nor a socket layer.
 - **mux:** launch-only placement and fixed-runtime launch. It never imports into delivery. Fresh identity arrives only through its callback envelope, never a lookup; same-id visible resume keeps identity/liveness/locking on the v2 side of the injected seam. Fresh call accepts only the narrow model, literal absolute cwd, and existing caller-server seat inputs; it creates no session and does not infer seat from cwd. A Codex CALLER alone has an omitted-placement rule: it opens beside its own TUI pane, matched by thread-id in that pane title; 0/2+ matches reject; explicit placement still wins. Do not turn either fresh call or resume into a generic driver, command/env carrier, or second creation API. Exact module/argv/import ownership: [docs/mux-launch-rail.md](./docs/mux-launch-rail.md).

package/BASELINE.md

@@ -246,7 +246,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes seven tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes eight tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---
 

package/CHANGELOG.md

@@ -4,6 +4,196 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.30.1 - 2026-10-04
+
+### Fixed
+
+- **Claude incomplete foreground-tool failures no longer invite a whole-prompt replay (#127).**
+  Only a non-aborted prompt rejection decoded as the root ACP SDK's `RequestError`, code
+  `-32603`, vendor `errorKind: incomplete_tool_call`, receives an authored unsafe-to-replay
+  verdict. Some tools may already have run. The original rejection and stderr/lifecycle/launch
+  evidence stay in existing diagnostics rather than tainting pi's retry/overflow classifier.
+  FIRST failure, abort precedence, exactly one error seal, and new/reuse session drop remain;
+  other failures and Cortex retain their legacy paths. This is not a global retry disable or
+  a claim about vendor-internal retries or real incomplete-tool frequency.
+- **Herdr's existing plugin/runtime consumption boundary is aligned (#126).** The follow-up to
+  0.30.0 aligned the plugin manifest with its locked runtime, re-pinned the published npm bytes,
+  and measured Herdr 0.9.3 supply against the unchanged 0.9.0 admission floor. Sandbox path
+  normalization and the Pi-native callback oracle were corrected. Operating Herdr/config stayed
+  unchanged; no permanent plugin/package equality policy was introduced.
+- **Herdr build verification covers both carriers and the real default lock reader.** Explicit
+  npm and checkout fixtures assert exact sequential acquisition counts and final artifact identity.
+  The uninjected default reader is checked against an independent committed JSON oracle, with a
+  dedicated wrong-directory mutant. This changes proof, not the production build/runtime/activation.
+- **Published support, source observations and execution evidence stay distinct (#127).** The
+  ACP rail and dependency ledger separate conditional settings, capability-gated and ambient
+  changes from runtime certification, stock auth messages from sealed legacy stderr tails,
+  upstream comments from unread SDK internals, and native/platform/loader contexts. The typed
+  rejection row points only to its deterministic gate: normal raw/reuse LIVE turns do not induce
+  that rejection.
+
+### Changed
+
+- **Claude ACP closure:** adapter `0.79.0` → `0.85.1`, shared direct/child ACP wire SDK `1.4.0` →
+  `1.6.0`, Agent SDK `0.3.274` → `0.3.286`; the existing shared-wire contract is retained.
+  New reachable upstream behaviour is classified in the ACP rail and ROADMAP ledger, not
+  silently adopted as new Entwurf policy. Pi 1.0's range and public bridge verbs are unchanged.
+- **Unpublished Herdr verification candidate:** plugin metadata is 0.30.1 and uses the closed `herdr-checkout`
+  verification carrier while 0.30.1 is unpublished. No npm integrity is fabricated. After
+  publication, re-pin only the measured registry artifact and re-prove that acquisition source;
+  switching an installed source still requires explicit deactivate/activate.
+
+### Verification
+
+- Implementation/source review, related MUST LIVE and pre-version landing receipts are in
+  [#127](https://github.com/junghan0611/entwurf/issues/127), with #126's Herdr acceptance separate.
+  Main landing `f24820c` passed required four CI jobs, full411s and qualification841/841.
+  These are pre-version receipts, not this release's exact-SHA acceptance.
+- The gate-only amendment landed separately at `61dbef7`: independent review closed with
+  zero Blockers/Defects; the frozen 0.30.0 source passed local qualification **842/842** and
+  full645s. Its [exact-SHA CI](https://github.com/junghan0611/entwurf/actions/runs/37181269379)
+  passed all four required jobs, full361s and qualification842/842. These are pre-version
+  implementation receipts, not 0.30.1 release acceptance. The original npm-only/version-pinned
+  HPB failure, old wrong-directory mutant survival, inventory RED, PARTIAL13/13 and PARTIAL14/14
+  receipts remain separate history; offline four positive/two negative controls are not registry
+  proof (`~/tmp/e0301-prepare/gate-fix/implementation-floor/`).
+- **Fresh 0.30.1 working-candidate floor:** P4 full641s, followed by
+  `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.30.1.SLE9uA --cut`:
+  **MUST PASS=24 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, exit0/cutOK;
+  its own full645s and qualification **842/842** passed. The versioned candidate on
+  `61dbef7` stayed frozen through both runs (seal
+  `541cc5a368315e6ecac4548a3492ce73024c6fe9dc5613077e14898d4fd76879`).
+  Complete log: `/tmp/entwurf-release-gate-0.30.1.SLE9uA/release-gate.log`, SHA256
+  `ea070c2ea019c05766e40e3442d1a31d68894e6cb3da7f7bbb80460c782bc020`.
+- **Native Codex caller-seat acceptance:** 65 assertions, native `gpt-5.6-luna` and
+  Pi `openai-codex/gpt-6-luna`; personally launched app-server PID2143836 in session
+  A `$309` and initial Pi/fresh Codex/outbound Pi all in S `$316`, windows
+  `@810/@811/@812`. The outbound receipt names `codex-title-anchor`; both exact
+  source-role audits completed3/3. The complete pre-cleanup evidence is retained at
+  `.probe-artifacts/codex-fresh-live-fypXrI/`; decoded decisive receipts accompany
+  `~/tmp/e0301-prepare/fresh-prepare/p5-accepted.json`.
+- **On-demand long-turn:** Sonnet5 completed the original three sequential240s
+  foreground waits in736147ms, with exactly one cold ACP bootstrap and no reported
+  retry/timeout; the same candidate seal remained MATCH. This normal-turn receipt does
+  not induce `incomplete_tool_call` or certify vendor-internal retry frequency.
+- **Immediate P9:** census113 unused roots, four owned/aged/unused roots444K and one
+  reparented GLG Emacs daemon. All four roots were archived before four-fence-checked
+  reclamation; no process was killed. Post-census reports110 unused/zero reclaimable
+  roots, with Emacs untouched. Archive SHA256
+  `3132ab92d26702a5b1e3ddf9298e7e77c6abe63c276625ac2cd93b12558ad19a`;
+  per-root fences and before/after observations are in
+  `~/tmp/e0301-prepare/fresh-prepare/p9-reclaim/receipt.json`.
+- **Claude checkout-provenance certification of the candidate tree:** the local
+  owner-managed installer was refreshed from this working0.30.1 checkout, then a NEW
+  native Claude2.1.289 session was opened without sending a prompt. Install finished
+  `2026-10-04T10:20:16.328Z`; fresh garden `20261004T192019-c50e8a` was created at
+  `10:20:19.625Z`. Exact launched PID3397500/startKey `linux:284430975` joins both
+  markers, its unique V3 record and registered bridge child3397563. Registry-authoritative
+  cached plugin0.1.0 and stable XDG assembly match the checkout's hook/writer/session-id/
+  registry bytes; plugin0.1.0 is not the root package version. Strict doctor exit0:
+  three live owner joins, source=assembled=installed writer `8558bb3a5aa8`, registry
+  `277c8dc2a183`, store v1=0/v2=0/v3=1476, PASS. The targeted leaf completed27s;
+  **full/BODY/P5 reruns=0**, leaf seal
+  `1f754eeb12ff800b2d7c1122d2b8fad030c9311e1784aab67166916ad3eb5364` MATCH.
+  Receipt `~/tmp/e0301-prepare/fresh-prepare/criterion4.json` SHA256
+  `0af3edc3d913eae2157d8229f7408c670f47b8bdd6363ff8e1f1c8a51e2b1fe6`;
+  doctor log SHA256 `6922043ddb500c34edaba5f70115d910cbdbfe7a1d01f8ff9ab28f2b3cf9a83f`.
+  This satisfies the pre-commit fresh-native criterion in dev-clone mode, not emitted-JS
+  package/bin-shim, final-artifact, registry, model-turn or fresh delivery/reply acceptance.
+- **Explicit one-cut agy exception, authorized by GLG (2026-10-04):**
+  “명시 예외 승인 npm publish 전까지 쭉 가줘” authorizes this0.30.1 cut to proceed
+  without criterion7 acceptance. **agy native-push is NOT CERTIFIED on the1.2 line**:
+  measured on oracle/agy1.2.16, the answering LS port requires a CSRF nonce the external
+  sender does not legitimately hold; authenticated current host/CID join and same-gid
+  round-trip are absent. HTTP200/grpc16 `missing CSRF token` is not successful delivery.
+  The requirement's introduction date is unknown. The checked adapter/imprint/raw-send/
+  LIVE/pin subjects are unchanged from0.30.0; last native acceptance remains1.1.0
+  (2026-07-14), `PIN_AGY_MINOR=1.1` and DELIVERY's certification row are unchanged.
+  Follow-up [#128](https://github.com/junghan0611/entwurf/issues/128) is prerequisite
+  research: own tool-shell key presence/current CID/garden first, no nonce extraction,
+  discovery/cache/manager or unapproved implementation. This exception does not label
+  agy green, modify the permanent floor, or authorize npm publication.
+- **No duplicate local floor:** GLG requested retaining the existing green evidence
+  and resolving only the two native leaves. P4/full, qualification BODY, P5 and duplicate
+  local M0/full are not restarted for the post-verdict evidence/policy prose. Exact
+  prepared-SHA CI (four required jobs plus its qualification BODY) and one preserved
+  final-artifact consumer acceptance remain separate mandatory make evidence. The
+  working-candidate receipts above do not certify those later axes or registry bytes;
+  verification prose added after each frozen verdict is not the bytes that run consumed.
+
+## 0.30.0 - 2026-10-02
+
+### Changed
+
+- **Pi 1.0 admission — the pi fence is `>=1.0.0 <1.1` (#125).** Dev pins move to Pi 1.0.0 and the
+  peer range to the next-minor ceiling `>=1.0.0 <1.1`. The range checks are major-aware; pack
+  literals, the four affected mutants, the live docs and ROADMAP's two gate-read lines follow. No
+  ACP, vendor or Herdr companion bump rides it. The 0.99.1 and 0.99.2 floors this cycle passed
+  through were branch steps and never shipped. Pi now carries MCP in its core
+  ([You Said No MCP!](https://earendil.com/posts/you-said-no-mcp/), 2026-09-29) and this admission
+  builds on it rather than duplicating native tools; `pi-durable` and Pi's codemode are not adopted
+  here, and what they mean for Entwurf is undecided.
+- **Codex first-admission verification follows the current Pi MCP dialect.** Joined native
+  call/result names must still agree before exact Pi-qualified names become semantic receipts;
+  downstream source audits and receipt-owned cleanup use the same boundary. The LIVE driver now
+  separates launch from callback-validated relay, and clarifies callback-first startup without
+  relaxing message bytes, role counts, omitted cwd/seat, or claiming guaranteed model obedience.
+  The final standalone Codex chain passed 65 assertions, including both exact source-role audits.
+- **This cut has an explicit local acceptance exception (GLG, 2026-10-02).** The original P5
+  remains MUST 23 PASS / 1 FAIL / 0 SKIP, BEHAVIOR PASS; subsequent scoped Codex acceptance is a
+  separate run on amended bytes, not a synthetic 24/24 single-run result. GLG chose not to repeat
+  local full/qualification BODY/P5/M0 after the repairs. Exact prepared-SHA CI (including fresh
+  full and qualification BODY) and preserved-candidate Docker acceptance remain required. The
+  grouped development proofs do not activate #124 P3 composite release policy.
+- **A pi citizen's Entwurf verbs ride Pi's built-in MCP (#125).** A born pi citizen registers the
+  compiled `entwurf-bridge` with `pi.registerMcpServer` under its record gardenId, so a pi model
+  reaches the same server every other host does. The five hand-written native tools are gone;
+  `entwurf_inbox_read` and `entwurf_register_native` are hidden on a pi host, leaving six declared.
+  Pi folds every character outside `[A-Za-z0-9_]` in an MCP tool name to `_`, so a pi model calls
+  `mcp__entwurf_bridge__<verb>`, and the pi fresh-call dialect (callback, delivery, peers) moved to
+  that spelling as one literal hard cut — no alias, no version router. The server key stays
+  `entwurf-bridge`; a same-namespace `mcp.json` entry overrides the registration by Pi's own
+  precedence.
+- **Qualification builds what a gate consumes (#125, development tooling).** The snapshot stays
+  source-only; a mutant may declare `build {argv, output}`, and for that gate group only the
+  runner builds the output from the snapshot's own bytes, rebuilds it after every mutation and
+  before the post-control (baseline digest required), never counts a build red as a kill, voids a
+  run whose gate writes into the output, and removes it when the group ends (`[QK:QUALIFY-BUILD-*]`).
+
+- **README is the product entry; clean-host setup owns the operating detail.** Installation,
+  prerequisites, citizen first use, terms and short history stay in README. Detailed settings,
+  harness configuration, context, skills and upgrades move to `docs/setup-clean-host.md` with
+  retained entry anchors and links. Herdr keeps its separate installation document. VERIFY
+  distinguishes Pi's built-in MCP tool ingress from record-addressed Unix-socket receive and
+  the ACP explicit tool projection; this is contract prose, not a new acceptance receipt.
+
+### Fixed
+
+- **Claude ACP turns no longer get vendor-managed background work (#125).** The Claude adapter's
+  child env sets `CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1`, which turns off the vendor's own
+  Bash/Agent `run_in_background` option and its timeout / turn-abort auto-backgrounding. Cortex is
+  unchanged. A process a command detaches on its own (`&`, `setsid`, a daemon) is outside this
+  switch, so it is not a general termination guarantee. Observed on the branch (#125, one host,
+  not a release acceptance): cancelling a reused turn's foreground work ended it and the same
+  session served the next turn, while a cancelled FIRST turn is not retained and the next turn
+  bootstraps a new session. Pinned by `[QK:ACP-CLAUDE-FOREGROUND-ONLY]` with one rollback mutant.
+- **`check-pack-install` keeps the consumer inside its own sandbox.** Its consumer subcalls name
+  every writable root (HOME, four XDG, `PI_CODING_AGENT_DIR`); an inherited agent dir had received
+  the npm consumer's user-scope settings (`[QK:PACK-INSTALL-INHERITED-AGENTDIR-UNTOUCHED]`,
+  `[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED]`).
+- **LIVE smokes match Pi 1.0 (#125).** Isolated pi citizens load `-e builtin:mcp` beside
+  `--no-extensions`, which turns the built-in MCP off too; the chain hop-2 tool name uses the
+  underscore form. `smoke-acp-session-reuse-live` judges reuse by turn 2's `[acp: reusing live
+  session]` notice rather than by recall alone, since a rebuilt turn re-sends the full transcript.
+  The native lifecycle cell drives `openai-codex/gpt-6-luna`.
+- **Docs state the current contract.** The bridge's eight verbs are counted as eight wherever a
+  current sentence counts them (dated seven-tool receipts stay as they were). The harness source
+  map's callback column names `FRESH_CALL_CALLBACK_TOOL`, with the delivery dialects moved to a
+  note. The ACP support table is this checkout's declaration rather than a shipped baseline,
+  VERIFY's surface banner no longer carries 0.21.0's acceptance numbers, the Herdr docs separate
+  the committed `herdr-checkout` carrier from npm's production authority, and VERIFY's ACP
+  troubleshooting reads turn evidence from lifecycle notices and the session's stopReason.
+
 ## 0.25.1 - 2026-09-30
 
 ### Added

package/DELIVERY.md

@@ -108,7 +108,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 
 | Harness / surface | Product status | Capability | Transport and boundary |
 |---|---|---|---|
-| **pi native Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. |
+| **pi Entwurf** | shipped | D7; D8 partial | Record-addressed Unix control socket. A record-less socket is diagnostic only and never dispatched. A pi session calls the verbs through Pi's built-in MCP running the compiled `entwurf-bridge` (#125); the receive rail is unchanged. |
 | **Claude Code interactive `>=2.1.217`** | shipped; Linux certified | D6; D7/D8 partial | Per-session mailbox + exec-form `FileChanged`/`asyncRewake`. B2 proved idle wake and same-session continuity on one NixOS host. |
 | **Antigravity / agy** | shipped | D6; D7 partial | Record-backed native-push through LS gRPC `agentapi send-message`; no mailbox or receiver marker. Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness: `entwurf_fresh_call` cannot open an agy sibling, and nothing here should be read as claiming visible lifecycle parity. |
 | **Codex CLI app-server citizen** | supported in 0.21.0; caller-seat topology ACCEPTED on Linux at 0.153.4, 2026-09-16 (56 assertions, exit 0), and the caller-DIRECTORY axis ACCEPTED the same day on the same host (#95 lane C, 65 assertions, exit 0; the 2026-09-12 explicit-home acceptance is history — #95 D1 retired that room) | D6 accepted; D7 partial; D8 unproven | Vendor-trusted user-scope `SessionStart` birth plus strict per-request metadata join; no shared-pid sender marker. `thread/loaded/list` probes the operator-owned app-server UDS and one-shot `codex queue` delivers with no retry. The operator owns the app-server and seats it wherever they like; Entwurf creates, moves and supervises none of it. Since #95 lane B a Codex CALLER with no explicit placement opens its sibling beside its OWN pane, located by the `thread-id` its `[tui].terminal_title` writes into the pane title; 0 or 2+ matching panes refuse with no fallback, and the title is a placement input only — never an address, liveness or delivery fact. #95 D1 (2026-09-16) retired the fixed `codex` home that omitted-placement Codex TARGETS used to select, so an omitted seat is the caller's own session for every backend. Exact 0.153.4 source still bounds placing a sibling beside a TUI whose thread nobody named as unsupported; the anchor resolves only the pane showing the caller's own thread. |