@junghanacs/entwurf 0.25.1 → 0.30.1

package/scripts/mutants/pi-mcp-bridge.json

@@ -0,0 +1,36 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-mcp-bridge",
+	"mutants": [
+		{
+			"claim": "PI-MCP-BRIDGE-DECLARED-SURFACE",
+			"title": "entwurf_self joins the hidden list, so a pi model is no longer declared the verb that tells it who it is",
+			"subject": "pi-extensions/lib/entwurf-mcp-server.ts",
+			"find": [
+				"export const ENTWURF_MCP_HIDDEN_TOOLS = [\"entwurf_inbox_read\", \"entwurf_register_native\"] as const;"
+			],
+			"replace": [
+				"export const ENTWURF_MCP_HIDDEN_TOOLS = [\"entwurf_inbox_read\", \"entwurf_register_native\", \"entwurf_self\"] as const;"
+			],
+			"gate": ["bash", "run.sh", "check-pi-mcp-bridge"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-MCP-BRIDGE-DECLARED-SURFACE]",
+			"signatureSource": "scripts/check-pi-mcp-bridge.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-MCP-BRIDGE-SAME-CHILD-IDENTITY",
+			"title": "the explicit carrier is built from the model label when one is known, so the spawned child claims an identity no record holds",
+			"subject": "pi-extensions/lib/entwurf-mcp-server.ts",
+			"find": ["\t\tenv: { PI_SESSION_ID: input.gardenId, ...(input.agentId ? { PI_AGENT_ID: input.agentId } : {}) },"],
+			"replace": [
+				"\t\tenv: { PI_SESSION_ID: input.agentId ?? input.gardenId, ...(input.agentId ? { PI_AGENT_ID: input.agentId } : {}) },"
+			],
+			"gate": ["bash", "run.sh", "check-pi-mcp-bridge"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-MCP-BRIDGE-SAME-CHILD-IDENTITY]",
+			"signatureSource": "scripts/check-pi-mcp-bridge.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		}
+	]
+}

package/scripts/mutants/pi-mcp-register.json

@@ -0,0 +1,51 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-mcp-register",
+	"mutants": [
+		{
+			"claim": "PI-MCP-REGISTER-AFTER-BIRTH",
+			"title": "the extension factory registers the bridge at load, before any record exists — the server is on Pi's registry with no born identity to carry",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\tpi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);"],
+			"replace": [
+				"\tpi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);",
+				"\tpi.registerMcpServer(ENTWURF_MCP_SERVER_NAME, { command: process.execPath, args: [] });"
+			],
+			"gate": ["bash", "run.sh", "check-pi-mcp-register"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PI-MCP-REGISTER-AFTER-BIRTH]",
+			"signatureSource": "pi-extensions/entwurf-control.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-MCP-IDENTITY-BEFORE-UI",
+			"title": "the status line is rendered before the registration, so a UI failure leaves a born citizen without its verbs",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": [
+				"\t\tregisterEntwurfMcpServer(pi, ctx, birth.gardenId);",
+				"\t\tupdateStatus(ctx, true, birth.gardenId);"
+			],
+			"replace": [
+				"\t\tupdateStatus(ctx, true, birth.gardenId);",
+				"\t\tregisterEntwurfMcpServer(pi, ctx, birth.gardenId);"
+			],
+			"gate": ["bash", "run.sh", "check-pi-mcp-register"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PI-MCP-IDENTITY-BEFORE-UI]",
+			"signatureSource": "pi-extensions/entwurf-control.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-MCP-EXPOSURE",
+			"title": "the verbs are registered behind codemode instead of declared directly, so the model is handed a different surface than every other host",
+			"subject": "pi-extensions/lib/entwurf-mcp-server.ts",
+			"find": ["\t\texposure: \"direct\","],
+			"replace": ["\t\texposure: \"codemode\","],
+			"gate": ["bash", "run.sh", "check-pi-mcp-register"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PI-MCP-EXPOSURE]",
+			"signatureSource": "pi-extensions/entwurf-control.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -39,20 +39,20 @@
 			"signatureSource": "scripts/check-entwurf-v2-production.ts"
 		},
 		{
-			"claim": "V2SURF-PI-MODE-SCOPE",
-			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
-			"subject": "pi-extensions/entwurf-control.ts",
+			"claim": "V2SURF-MODE-SCOPE",
+			"title": "the bridge mode param (the one every caller reads, pi included since #125) reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
+				"\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
 				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
 			],
 			"replace": [
-				"\t\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
+				"\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
 				"\t\t\t\t\t\"Both queues are volatile process memory.\","
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2SURF-PI-MODE-SCOPE]",
+			"signature": "[QK:V2SURF-MODE-SCOPE]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
 		{

package/scripts/resident-rpc-drive.ts

@@ -169,7 +169,11 @@ const result: DriveResult = {
 	timedOut: false,
 };
 
-const piArgs = ["--no-extensions", "-e", REPO_ROOT, "--entwurf-control"];
+// `--no-extensions` keeps ambient discovery out, and since Pi 0.99 it also turns the BUILT-IN
+// extensions off: a citizen born here had no MCP, so its entwurf-bridge registration threw
+// `register_mcp_server` (`[측정 2026-10-02]` pi 0.99.2 and 1.0.0 alike). `-e builtin:mcp` restores
+// that one built-in — the MCP a resident has — and nothing else.
+const piArgs = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT, "--entwurf-control"];
 // NO --session-id. That injection is what the #50 C2 cut removed: pi mints its own
 // id and the record mints the address. A resume names the FILE, never an id.
 if (sessionFile) piArgs.push("--session", sessionFile);

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -62,7 +62,9 @@ const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 
 const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;

package/scripts/smoke-acp-cortex-live.ts

@@ -68,7 +68,9 @@ const CORTEX_OVERLAYS_ROOT = path.join(os.homedir(), ".pi", "agent", "cortex-ove
 const SOCKET_SUFFIX = ".sock";
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 
 const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 // The cortex CLI self-extracts on first launch and its newSession alone is

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.79.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp, exact pin in package.json) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-acp-session-reuse-live.ts

@@ -3,13 +3,20 @@
 //   LIVE=1 ./run.sh smoke-acp-session-reuse-live
 //
 // The deterministic gate (check-acp-session-reuse) proves the prompt SCOPE
-// (delta-only) and the wiring with a fake seam. This proves the REAL thing: a
-// process-scoped pi process drives TWO real ACP turns over ONE reused
-// claude-agent-acp child, and turn 2 — which sends ONLY the latest user delta —
-// gets an answer that depends on a codeword introduced in turn 1. That is only
-// possible if (a) the child/connection were actually reused (not respawned) and
-// (b) the live ACP session kept turn 1 in its own history (so the delta was
-// enough). A respawn-per-turn backend (S2c) would forget the codeword.
+// (delta-only) and the wiring with a fake seam. This drives the REAL backend
+// (real overlay + spawn + vendor) through TWO ACP turns in one process-scoped
+// process and asserts that turn 2 took the REUSE path.
+//
+// The reuse verdict is the production lifecycle notice, NOT the recall. A
+// respawned (`new`) turn re-sends the FULL transcript (context.ts
+// buildAcpPrompt "new"), and turn 2's context below carries turn 1's codeword, so
+// a respawn-per-turn backend would recall it just as well — recall alone cannot
+// tell reuse from rebuild. Turn 2 must therefore announce `[acp: reusing live
+// session]` and must not announce `[acp: preparing …]`; check-acp-session-reuse
+// pins that the reuse branch emits exactly that and the new branch the opposite.
+// The recall is kept as a supporting check that the reused session still answers
+// from its own history. Delta-only on the wire stays the deterministic gate's
+// claim: the vendor stdio is not observed here.
 //
 // It forces process-scoped by pushing the real `--entwurf-control` resident flag
 // into argv (resolveLifecyclePolicy reads process.argv), then calls the REAL
@@ -175,18 +182,28 @@ async function main(): Promise<void> {
 	if (!r2.done) fail("turn 2 did not complete");
 	console.error(`[smoke-acp-session-reuse-live] turn 2 reply: ${JSON.stringify(r2.text.slice(-120))}`);
 
-	// The codeword only lives in turn 1. Turn 2 sent only the delta question, so a
-	// correct answer proves the reused live ACP session remembered turn 1.
+	// The reuse verdict: the backend's own lifecycle notices ride the text stream, so
+	// turn 2 names the path it took. A rebuild would announce `preparing` instead.
+	assert.ok(
+		r2.text.includes("[acp: reusing live session]"),
+		`turn 2 did not take the reuse path — no "[acp: reusing live session]" notice (reply: ${JSON.stringify(r2.text.slice(-200))})`,
+	);
+	assert.ok(
+		!r2.text.includes("[acp: preparing"),
+		`turn 2 re-bootstrapped a session ("[acp: preparing …]") instead of reusing turn 1's (reply: ${JSON.stringify(r2.text.slice(-200))})`,
+	);
+	// Supporting only: the reused session still answers from its own history. A rebuild
+	// would pass this too (it re-sends the codeword), which is why it is not the verdict.
 	assert.ok(
 		r2.text.includes(codeword),
-		`turn 2 reply did not contain the turn-1 codeword ${codeword} — reuse/memory failed (reply: ${JSON.stringify(r2.text.slice(-200))})`,
+		`turn 2 reply did not contain the turn-1 codeword ${codeword} — the reused session lost its history (reply: ${JSON.stringify(r2.text.slice(-200))})`,
 	);
 
 	console.log(
-		"[smoke-acp-session-reuse-live] PASS — 2-turn reuse over one ACP child; turn-2 delta recalled the turn-1 codeword",
+		"[smoke-acp-session-reuse-live] PASS — turn 2 took the reuse path ([acp: reusing live session], no re-bootstrap) and recalled the turn-1 codeword",
 	);
 	console.log(`  model:    entwurf/${MODEL}`);
-	console.log(`  codeword: ${codeword} recalled in turn 2 (delta-only)`);
+	console.log(`  codeword: ${codeword} recalled in turn 2 (supporting; delta-only is check-acp-session-reuse's claim)`);
 }
 
 main()

package/scripts/smoke-acp-socket-citizen-live.ts

@@ -41,7 +41,9 @@ const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 
 const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const POLL_MS = 100;

package/scripts/smoke-acp-v2-send-live.ts

@@ -95,7 +95,9 @@ const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 
 const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;

package/scripts/smoke-codex-fresh-live.ts

@@ -75,6 +75,7 @@ import {
 import {
 	buildCodexInstruction,
 	buildInitialPiPhaseOne,
+	buildInitialPiRelay,
 	runCleanupStages,
 	selectReport,
 } from "./lib/codex-fresh-live-protocol.ts";
@@ -954,6 +955,8 @@ async function run(): Promise<void> {
 		model: piModel,
 		cwd: scratch,
 		task:
+			"Session-info already supplies device and time. Do not recheck time, cwd, or identity with shell or other tools. " +
+			"Your FIRST tool call must be mcp__entwurf_bridge__entwurf_callback with no arguments, and nothing before it. " +
 			`After your required callback receipt, end the turn and wait passively for one addressed message containing ${initialPiWaitToken}. ` +
 			"That message is the only authority to open the Codex sibling. Do not call shell, sleep, terminal, or any tool to wait.",
 	});
@@ -1070,7 +1073,6 @@ async function run(): Promise<void> {
 		codexWaitToken,
 		codexModel,
 		scratch,
-		codexInstruction,
 	});
 
 	// The model is asked to operate public tools, but every launch and delivery assertion below
@@ -1190,6 +1192,23 @@ async function run(): Promise<void> {
 		`requested=${scratch}\npane=${codexPaneCwd}\nrollout-session_meta=${codexRolloutCwd}\n` +
 		`record=${codexIdentity.cwd}\napp-server=${appServerCwd}`;
 
+	// Only after the exact callback and record/cwd joins: instruct the initial Pi to relay,
+	// never deliver the Codex payload on its behalf.
+	const relayInitialPi = await bridge.call("entwurf_v2", {
+		target: initialPiGid,
+		intent: "fire-and-forget",
+		message: buildInitialPiRelay({ codexGardenId, codexInstruction }),
+	});
+	receipts["8c-fixture-to-initial-pi-relay"] = relayInitialPi.text;
+	ok(
+		"the fixture addressed the initial Pi relay phase through the control socket",
+		!relayInitialPi.isError &&
+			/entwurf_v2 control-socket → (?:sent|queued-steer|queued-follow-up|accepted-unknown-boundary)/.test(
+				relayInitialPi.text,
+			),
+		relayInitialPi.text,
+	);
+
 	const initialPiToCodex = await awaitOrRecover("the initial Pi joined native-push receipt", SOURCE_WAIT_MS, () => {
 		const piSources = piSourceToolReceipts(readInitialPiEntries());
 		assertSourceCallScopes(piSources, "entwurf_v2", "target", [callerGid, codexGardenId], "initial Pi v2 roles");

package/scripts/smoke-entwurf-chain-live.ts

@@ -67,7 +67,9 @@ import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 
@@ -329,9 +331,11 @@ async function main(): Promise<void> {
 			`Call the tool mcp__entwurf-bridge__entwurf_v2 exactly once with target=${gidD}, intent=fire-and-forget,`,
 			`and message=${nonce} terminus. Then reply with only the tool's outcome line.`,
 		].join(" ");
+		// hop2 is read by B, a NATIVE pi citizen: Pi folds the server key's hyphen, so B is declared
+		// `mcp__entwurf_bridge__entwurf_v2`. hop1 (Claude Code) and hop3 (ACP Claude) keep the hyphen.
 		const hop2 = [
 			`${nonce} hop2. You are the second hop of a delivery chain.`,
-			`Call the tool mcp__entwurf-bridge__entwurf_v2 exactly once with target=${gidC}, intent=fire-and-forget,`,
+			`Call the tool mcp__entwurf_bridge__entwurf_v2 exactly once with target=${gidC}, intent=fire-and-forget,`,
 			"and message set to exactly the text between INNER-BEGIN and INNER-END.",
 			"Then reply with only the tool's outcome line.",
 			"INNER-BEGIN",

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -76,7 +76,9 @@ const SOCKET_SUFFIX = ".sock";
 // Release-gate topology: repo-under-test, not deployment smoke. Load only this
 // checkout's extension so resident behavior is independent of global pi packages.
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
+// `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+// registration needs (scripts/resident-rpc-drive.ts has the measurement).
+const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", "builtin:mcp", "-e", REPO_ROOT] as const;
 
 // Staged timeouts (automation): short and per-stage so a stall is attributable.
 //

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -196,10 +196,9 @@ function transcriptRecords(file: string): string[] {
 }
 
 /**
- * The BARE verb names, as the two surfaces this smoke reads actually spell them — NOT the
- * model-facing dialect. `[측정 2026-09-20, this smoke's own red fixture]` the claude MCP activity
- * log carries `Calling MCP tool: entwurf_callback` / `Tool 'entwurf_callback' completed`, and pi
- * writes `"type":"toolCall","name":"entwurf_callback"`; neither records
+ * The verb names as the CLAUDE MCP activity log spells them — NOT the model-facing dialect.
+ * `[측정 2026-09-20, this smoke's own red fixture]` that log carries `Calling MCP tool:
+ * entwurf_callback` / `Tool 'entwurf_callback' completed`, never
  * `mcp__entwurf-bridge__entwurf_callback`. The per-host dialect is owned by
  * `FRESH_CALL_CALLBACK_TOOL` / `FRESH_CALL_DELIVERY_TOOL` in `fresh-call-composition.ts` and is
  * what the FRAMING says; these two are what an OBSERVER sees, and conflating them is what this
@@ -208,6 +207,17 @@ function transcriptRecords(file: string): string[] {
 const CALLBACK_VERB = "entwurf_callback";
 const DELIVERY_VERB = "entwurf_v2";
 
+/**
+ * The callback as a Pi 1.0 TRANSCRIPT spells it. Pi's built-in MCP is the tool ingress since
+ * 0.30.0, and Pi records the qualified name the model called. The bare `entwurf_callback` this
+ * smoke read on 2026-09-20 belonged to the retired native-tool registration; a pi→pi child that
+ * called back correctly would then never match, which is a red about the oracle, not the rail.
+ * Declared here as the OBSERVED literal, not imported from the compositor, so a change to the
+ * production framing cannot quietly move this expectation with it — the same rule as
+ * `PI_SOURCE_VERBS` in `lib/codex-fresh-source-receipts.ts`. No prefix strip, no legacy OR.
+ */
+const PI_CALLBACK_TOOL = "mcp__entwurf_bridge__entwurf_callback";
+
 /**
  * The id of the CALLBACK toolCall in this record, or null. Pi writes a call and its result as two
  * records; this is one half of the join that replaces a same-record read.
@@ -238,7 +248,9 @@ function entwurfCallIdFor(record: string, nonce: string, callerGid: string): str
 	if (!Array.isArray(content)) return null;
 	for (const part of content) {
 		const call = part as { type?: unknown; name?: unknown; id?: unknown; arguments?: unknown };
-		if (call.type !== "toolCall" || call.name !== CALLBACK_VERB) continue;
+		if (call.type !== "toolCall") continue;
+		if (call.name === CALLBACK_VERB) throw new Error(`${LABEL}: retired raw Pi tool name ${CALLBACK_VERB}`);
+		if (call.name !== PI_CALLBACK_TOOL) continue;
 		// Zero-argument verb: absent, null and `{}` are all the shape it is called with. A supplied
 		// target or message is a model naming an address the env already owns — not this act.
 		const args = call.arguments as { message?: unknown; target?: unknown } | undefined | null;
@@ -444,8 +456,10 @@ async function main(): Promise<void> {
 			childBackend: "pi",
 			callerKind: "pi",
 			childKind: "pi",
-			callerModel: "openai-codex/gpt-5.6-sol",
-			childModel: "openai-codex/gpt-5.6-sol",
+			// The approved roster's lighter Pi GPT tier (agent-config MODELS.md, 2026-09-30); gpt-5.6-sol
+			// is still in the catalog but no longer on the roster. A LIVE cost choice, not a product set.
+			callerModel: "openai-codex/gpt-6-luna",
+			childModel: "openai-codex/gpt-6-luna",
 		},
 		{
 			label: "claude→claude",

package/scripts/smoke-herdr-raw-install-live.sh

@@ -491,7 +491,7 @@ for (const name of ["entwurf", "entwurf-bridge", "entwurf-statusline"]) {
 
 // The REAL subcommand, from the installed bin, under node_modules — which is the branch of
 // start.sh that runs the prebuilt dist. Its own oracle is an EXACT set (`EXPECT_TOOLS` in run.sh check-bridge), so a
-// zero exit here is the artifact listing all seven garden verbs and no eighth.
+// zero exit here is the artifact listing all eight garden verbs and no ninth.
 const run = spawnSync(path.join(binDir, "entwurf"), ["check-bridge"], { encoding: "utf8" });
 const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
 // [a-z0-9_] and not [a-z_]: the first draft of this line printed `entwurf_v` for entwurf_v2

package/scripts/smoke-mux-lifecycle-live.ts

@@ -108,7 +108,7 @@ const BRIDGE_LAUNCHER = path.join(REPO, "mcp", "entwurf-bridge", "start.sh");
 
 /** The two pi shapes. They differ in exactly one thing that matters here — whether the record
  * carries `provider=entwurf`, which is what makes the resume argv re-inject the bridge (#29). */
-const PI_NATIVE_MODEL = "openai-codex/gpt-5.6-luna";
+const PI_NATIVE_MODEL = "openai-codex/gpt-6-luna";
 const PI_ACP_MODEL = "entwurf/claude-sonnet-5";
 const CLAUDE_MODEL = "claude-sonnet-5";
 

package/scripts/smoke-resident-garden-guard.sh

@@ -91,7 +91,9 @@ TIMEOUT="${SMOKE_RGG_TIMEOUT:-90}"
 # Release-gate topology: this is a repo-under-test smoke, not a deployment smoke.
 # Load ONLY this checkout's extension so results do not depend on device-local global
 # packages / current branch wiring.
-REPO_EXTENSION_ARGS=(--no-extensions -e "$REPO")
+# `builtin:mcp`: `--no-extensions` also turns off Pi's built-in MCP, which a citizen's entwurf-bridge
+# registration needs (scripts/resident-rpc-drive.ts has the measurement).
+REPO_EXTENSION_ARGS=(--no-extensions -e builtin:mcp -e "$REPO")
 
 pass=0
 fail=0