@junghanacs/entwurf 0.30.1 → 0.31.0

package/scripts/mutants/pi-durable.json

@@ -0,0 +1,390 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-durable",
+	"mutants": [
+		{
+			"claim": "PI-DURABLE-RUNTIME-UNTRACKED-DRIFT",
+			"title": "a non-ignored untracked file in the operator runtime no longer counts as pin drift",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" || facts.untracked !== \"\" || "],
+			"replace": [" || "],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-UNTRACKED-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-MODELDATA-DRIFT",
+			"title": "model data that is not the pinned bytes is no longer its own refusal",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\treturn \"pi-durable-runtime-modeldata-drift\";\n"],
+			"replace": ["\t\treturn null;\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-MODELDATA-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-READ-ONLY",
+			"title": "verification runs git against the operator checkout's own index instead of a private copy, so a stale stat cache is rewritten",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["const onCopy = { ...base, GIT_INDEX_FILE: copy };"],
+			"replace": ["const onCopy = { ...base };"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-READ-ONLY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-LOCATOR-FIXED",
+			"title": "a relative XDG_DATA_HOME is honoured, so the runtime's one fixed place follows the caller's cwd",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" && xdg.length > 0 && path.isAbsolute(xdg)) {"],
+			"replace": [" && xdg.length > 0) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-LOCATOR-FIXED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-STAGED-DRIFT",
+			"title": "the index == HEAD term leaves the verdict, so a staged change behind an equal worktree diff verifies as the pin",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\tif (!facts.indexMatchesHead) return \"pi-durable-runtime-pin-drift\";\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-STAGED-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE",
+			"title": "the verifier's entry guard goes back to import.meta.main, which the floor's runner can misread as the process entry",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["if (invokedDirectly) {\n"],
+			"replace": ["if (import.meta.main) {\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CONFIG-NEUTRAL",
+			"title": "the diff's blank-context spacing is left to the runtime's git configuration again, so a config can move the verdict",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [
+				"[\"-c\", \"core.abbrev=8\", \"-c\", \"diff.suppressBlankEmpty=false\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"
+			],
+			"replace": ["[\"-c\", \"core.abbrev=8\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CONFIG-NEUTRAL]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM",
+			"title": "the contact gate's tracked-overlay assertion loses the index term, so it certifies a runtime tree it never saw",
+			"subject": "scripts/check-pi-durable-contact.ts",
+			"find": ["facts.gitAnswered && facts.indexMatchesHead && facts.diffEqualsPatch && facts.untracked"],
+			"replace": ["facts.gitAnswered && facts.diffEqualsPatch && facts.untracked"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-FOUR-UNITS",
+			"title": "the receive unit stops asking whether the compiled owner join admits the durable host, so a launch proceeds to a citizen nobody can deliver to",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": [
+				"\tif (!ownerJoinAdmitsDurableHost(layout.deliverability)) return \"pi-durable-receive-unit-missing\";\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-FOUR-UNITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED",
+			"title": "a model without a provider part passes the preflight and reaches the durable launch",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": ["\tif (at <= 0 || at === model.length - 1) return null;"],
+			"replace": ["\tif (at < 0 || at === model.length - 1) return null;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY",
+			"title": "the launch argv accepts --bridge-entry, so a caller can point the contact at a bridge outside this package",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"],
+			"replace": [
+				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FRESH-CALL-EXPOSED",
+			"title": "entwurf_fresh_call drops out of the durable contact's tools, so the citizen cannot open a sibling",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\ttools: PI_DURABLE_TOOL_NAMES.map(tool),"],
+			"replace": ["\t\ttools: PI_DURABLE_TOOL_NAMES.filter((name) => name !== \"entwurf_fresh_call\").map(tool),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FRESH-CALL-EXPOSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BRIDGE-DIRECT-SCRUBBED",
+			"title": "the identity scrub is omitted, so inherited identity carriers reach the bridge child",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\tif (value !== undefined && !scrubbed.has(key)) env[key] = value;\n"],
+			"replace": ["\t\tif (value !== undefined) env[key] = value;\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BRIDGE-DIRECT-SCRUBBED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS",
+			"title": "the root binding is omitted, so the bridge child reads whatever garden roots it inherited instead of the roots the contact wrote",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\tfor (const key of Object.keys(PI_DURABLE_BRIDGE_ROOT_ENV) as (keyof PiDurableRoots)[]) {\n\t\tenv[PI_DURABLE_BRIDGE_ROOT_ENV[key]] = roots[key];\n\t}\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PDH-JOIN-FOREIGN-SENDER-REFUSED",
+			"title": "the durable host leaves the sender join, so a live durable receiver whose owner sender marker names another garden is no longer refused (ABSENT-SENDER and SCOPE also go red)",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
+			"replace": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDH-JOIN-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-deliverability.owner-join.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-SCHEMA-DRIFT-REFUSED",
+			"title": "schema drift is never reported, so a bridge whose tool schemas differ from the exposed copies is accepted at birth",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\treturn problems.length === 0 ? undefined : problems.join(\"; \");"],
+			"replace": ["\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SCHEMA-DRIFT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY",
+			"title": "the receiver arms against any live sender marker, even one naming another garden or session",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (sender === null || sender.gardenId !== gardenId || sender.nativeSessionId !== nativeSessionId) {"
+			],
+			"replace": [
+				"\t\t\tif (sender === null || (sender.gardenId !== gardenId && sender.nativeSessionId !== nativeSessionId)) {"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-ONE-BIRTH",
+			"title": "a born contact can attach again, minting a second birth on the same contact",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (state.kind !== \"pending\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"replace": [
+				"\t\t\tif (state.kind === \"attaching\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ONE-BIRTH]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FIRST-INPUT-ONCE",
+			"title": "the launcher's first input loses its fixed request id, so a reopen can admit the same task again",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\t\trequestId: `entwurf-first-input:${attachment.gardenId}`,\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FIRST-INPUT-ONCE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START",
+			"title": "the send gate registers a bridge under a fresh start read instead of the start that qualified it, so a pid recycled after qualification is owned and signalled",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["own(child.pid, \"bridge\", child.start)"],
+			"replace": ["own(child.pid, \"bridge\")"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY",
+			"title": "the send gate looks complete observation up by pid, so a host whose pid was reused inherits its predecessor's observed children",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["childrenObserved.has(host)"],
+			"replace": ["[...childrenObserved].some((h) => h.pid === host.pid)"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-S3-START-RECHECKED",
+			"title": "the send gate's SIGKILL of the paused bridge loses its start-key re-check, so a process that replaced it after the IO and state reads is killed",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": [
+				"\tif (procStat(bridge1.pid)?.start !== bridge1.start)\n\t\tthrow new Error(`GAP: bridge1 ${bridge1.pid} is not the observed process immediately before its SIGKILL`);\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-S3-START-RECHECKED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES",
+			"title": "the receive gate's failed connect no longer closes the transport, so a bridge spawned inside connect is left neither owned nor closed",
+			"subject": "scripts/check-pi-durable-receive.ts",
+			"find": [
+				"\ttry {\n\t\tawait client.connect(transport);\n\t} catch (error) {\n\t\t// A failed connect may already have spawned the bridge, which is not owned yet: close the\n\t\t// transport (it ends the child it spawned) before rethrowing, and keep the cause first.\n\t\ttry {\n\t\t\tawait transport.close();\n\t\t} catch (closeError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, closeError],\n\t\t\t\t`the sending bridge did not connect (${(error as Error).message}); closing it also failed`,\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n"
+			],
+			"replace": ["\tawait client.connect(transport);\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY",
+			"title": "the receiver diagnostic appends every successful admission instead of keeping the latest one, so it grows with the host's lifetime (RING-COALESCES, whose two-pass expectation is latest-only, also goes red)",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\t\tadmissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });"
+			],
+			"replace": ["\t\t\t\tadmissions.push({ why, requestId, submissionId: submission.id, fresh, unread });"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/pi-floor.json

@@ -7,10 +7,10 @@
 			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
 			"subject": "pnpm-workspace.yaml",
 			"find": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2'"
 			],
 			"replace": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0'"
 			],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/pi-durable-contact-host.mjs

@@ -0,0 +1,105 @@
+// G-contact host half (#129 L-identity). Runs AS the durable host, under the pinned overlay
+// checkout's source resolver, and is spawned only by scripts/check-pi-durable-contact.ts:
+//
+//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//        scripts/pi-durable-contact-host.mjs <bridge entry> new|continue \
+//        [<sessions dir> <senders dir> <mailbox dir> <receivers dir>]
+//
+// The four optional directories are explicit garden roots handed to the contact, all or none;
+// without them the contact uses the shared roots its environment selects.
+//
+// With ENTWURF_PI_DURABLE_CONTACT_FAULT=malformed-report (set only by the gate's control) the report
+// line is deliberately not JSON.
+//
+// It opens the durable app through the production bootstrap composition (`openDurableCitizen`),
+// then executes the contact's registered tools DIRECTLY — adapter-direct, harness-bypassed: no
+// model turn and no ToolTask, so this proves the adapter's bridge contact, not the harness
+// selecting or validating the tool. The report carries the contact's own `receiver()` state, never
+// the path the attachment returned. It prints one JSON report line, holds the host and its
+// bridge child alive until the orchestrator writes `close` (so /proc can be read from outside),
+// closes, prints `{"closed":true}` and exits.
+//
+// The bridge's environment is observed at the SDK connector boundary only: the contact's existing
+// `connect` injection wraps the COMPILED production `connectStdioBridge`, records the spawn spec's
+// command/args/cwd, whether each of the four poisoned identity carrier NAMES is present, and the
+// four root carrier VALUES — nothing else of the env — and forwards the spec unchanged to that real
+// connector. It is the spec the adapter hands the SDK, not the kernel child environment; no
+// /proc/<pid>/environ is read anywhere.
+import { createInterface } from "node:readline";
+import { connectStdioBridge } from "../mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js";
+import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+
+const IDENTITY_CARRIERS = ["PI_SESSION_ID", "PI_AGENT_ID", "ENTWURF_META_SENDER_MARKER", "ENTWURF_BRIDGE_NATIVE_HOST"];
+const ROOT_CARRIERS = [
+	"ENTWURF_META_SESSIONS_DIR",
+	"ENTWURF_META_SENDERS_DIR",
+	"ENTWURF_META_MAILBOX_DIR",
+	"ENTWURF_META_RECEIVERS_DIR",
+];
+const bridgeSpecs = [];
+const connect = async (spec) => {
+	bridgeSpecs.push({
+		command: spec.command,
+		args: [...spec.args],
+		cwd: spec.cwd,
+		identityCarrierPresent: Object.fromEntries(IDENTITY_CARRIERS.map((name) => [name, Object.hasOwn(spec.env, name)])),
+		rootCarriers: Object.fromEntries(ROOT_CARRIERS.map((name) => [name, spec.env[name] ?? null])),
+	});
+	return connectStdioBridge(spec);
+};
+
+const [bridgeEntry, mode, ...rootArgs] = process.argv.slice(2);
+if (bridgeEntry === undefined || (mode !== "new" && mode !== "continue") || ![0, 4].includes(rootArgs.length)) {
+	throw new Error(
+		"usage: pi-durable-contact-host.mjs <bridge entry> new|continue [<sessions dir> <senders dir> <mailbox dir> <receivers dir>]",
+	);
+}
+const [sessionsDir, sendersDir, mailboxDir, receiversDir] = rootArgs;
+
+const citizen = await openDurableCitizen({
+	bridgeEntry,
+	continueSession: mode === "continue",
+	cwd: process.cwd(),
+	contact: rootArgs.length === 0 ? { connect } : { sessionsDir, sendersDir, mailboxDir, receiversDir, connect },
+});
+let code = 0;
+try {
+	const run = async (name) => {
+		const tool = citizen.contact.extension.tools.find((t) => t.name === name);
+		if (tool === undefined) throw new Error(`the contact registers no ${name}`);
+		const result = await tool.execute({}, undefined, {});
+		return result.content.map((block) => block.text).join("\n");
+	};
+	const view = citizen.durable.view.current();
+	const report = {
+		hostPid: process.pid,
+		session: view.session,
+		attachment: citizen.attachment,
+		receiver: citizen.contact.receiver(),
+		toolNames: citizen.contact.extension.tools.map((t) => t.name),
+		bridgeSpecs,
+		self: await run("entwurf_self"),
+		peers: await run("entwurf_peers"),
+		notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+	};
+	// The gate's malformed-report control: the report line is deliberately not JSON.
+	if (process.env.ENTWURF_PI_DURABLE_CONTACT_FAULT === "malformed-report") {
+		process.stdout.write(`{"malformed report line\n`);
+	} else {
+		process.stdout.write(`${JSON.stringify(report)}\n`);
+	}
+	const lines = createInterface({ input: process.stdin });
+	for await (const line of lines) if (line.trim() === "close") break;
+} catch (error) {
+	code = 1;
+	// The failure report keeps its cause first and carries, beside it, only the host pid and the same
+	// connector-boundary record the success report has — so the gate can judge the scrub/root QKs before
+	// it throws this error. It is never a success: no attachment, self, peers or session is reported.
+	process.stdout.write(
+		`${JSON.stringify({ error: error instanceof Error ? error.message : String(error), hostPid: process.pid, bridgeSpecs })}\n`,
+	);
+} finally {
+	await citizen.close();
+}
+process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+process.exit(code);

package/scripts/pi-durable-receive-host.mjs

@@ -0,0 +1,127 @@
+// G-receive host half (#129 L-receive). Runs AS the durable host, under the pinned overlay checkout's
+// source resolver, and is spawned only by scripts/check-pi-durable-receive.ts:
+//
+//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//        scripts/pi-durable-receive-host.mjs <bridge entry>
+//
+// It opens the durable app through the production bootstrap composition — which arms the contact's
+// doorbell on the root conversation — reports `born`, and then gives the app NO input: no controller
+// call, no tool call, no bridge call, no native state of its own. Whatever runs afterwards was
+// started by the doorbell's root admission. The driver only watches the native view and the
+// contact's own `receiver()` state (never the path the attachment returned, which a later retire
+// can make stale), and reports once:
+//
+//   - the receiver has made an admission, the view holds an assistant entry after the newest user
+//     entry that calls no tool, and the conversation is no longer busy; or
+//   - the receiver is no longer armed; or
+//   - the app raised an error notice.
+//
+// Then it holds the host alive until the gate writes `close`, closes, prints `{"closed":true}` and
+// exits.
+import { createInterface } from "node:readline";
+import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+
+const USAGE = "usage: pi-durable-receive-host.mjs <bridge entry>";
+const [bridgeEntry, ...extra] = process.argv.slice(2);
+if (bridgeEntry === undefined || extra.length > 0) throw new Error(USAGE);
+
+const stdinLines = createInterface({ input: process.stdin })[Symbol.asyncIterator]();
+/** Wait for one exact line from the gate; the gate closing stdin first is a failure. */
+async function waitFor(word) {
+	for (;;) {
+		const next = await stdinLines.next();
+		if (next.done) throw new Error(`stdin closed before "${word}"`);
+		if (next.value.trim() === word) return;
+	}
+}
+
+/** One entry of the native view, reduced to what the gate compares (the send driver's reduction). */
+function summarize(entry) {
+	const message = entry.model?.[0];
+	const blocks = Array.isArray(message?.content) ? message.content : [];
+	const text = (typeof message?.content === "string" ? [message.content] : [])
+		.concat(blocks.flatMap((b) => (b.type === "text" ? [b.text] : [])))
+		.join("\n");
+	return {
+		id: entry.id,
+		kind: entry.kind,
+		role: message?.role,
+		toolCalls: blocks
+			.filter((b) => b.type === "toolCall")
+			.map((b) => ({ id: b.id, name: b.name, arguments: b.arguments })),
+		...(message?.role === "toolResult"
+			? {
+					toolCallId: message.toolCallId,
+					toolName: message.toolName,
+					isError: message.isError === true,
+					diagnostics: Array.isArray(entry.data?.diagnostics) ? entry.data.diagnostics : [],
+				}
+			: {}),
+		text,
+	};
+}
+
+const citizen = await openDurableCitizen({ bridgeEntry, cwd: process.cwd() });
+
+function reportOf(view, why) {
+	return {
+		settled: why,
+		hostPid: process.pid,
+		session: view.session,
+		conversationId: view.conversation.conversation.id,
+		receiver: citizen.contact.receiver(),
+		entries: view.conversation.entries.filter((e) => e.kind.startsWith("pi.")).map(summarize),
+		busy: view.conversation.docs["pi.live"]?.run !== undefined,
+		notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+	};
+}
+
+let code = 0;
+try {
+	const { durable } = citizen;
+	const born = durable.view.current();
+	const noticesBefore = born.notices.length;
+	process.stdout.write(
+		`${JSON.stringify({
+			born: true,
+			hostPid: process.pid,
+			session: born.session,
+			conversationId: born.conversation.conversation.id,
+			attachment: citizen.attachment,
+			receiver: citizen.contact.receiver(),
+		})}\n`,
+	);
+	const why = await new Promise((resolve) => {
+		let done = false;
+		const check = () => {
+			if (done) return;
+			const view = durable.view.current();
+			const receiver = citizen.contact.receiver();
+			const entries = view.conversation.entries;
+			const lastUser = entries.findLastIndex((e) => e.kind === "pi.user");
+			const lastAnswer =
+				lastUser < 0 ? undefined : entries.slice(lastUser + 1).findLast((e) => e.kind === "pi.assistant");
+			const answered = lastAnswer !== undefined && summarize(lastAnswer).toolCalls.length === 0;
+			const busy = view.conversation.docs["pi.live"]?.run !== undefined;
+			let outcome;
+			if (receiver.status !== "armed") outcome = "receiver-not-armed";
+			else if (view.notices.slice(noticesBefore).some((n) => n.level === "error")) outcome = "error-notice";
+			else if (receiver.admissions.length > 0 && answered && !busy) outcome = "answered";
+			if (outcome === undefined) return;
+			done = true;
+			unsubscribe();
+			resolve(outcome);
+		};
+		const unsubscribe = durable.view.subscribe(check);
+		check();
+	});
+	process.stdout.write(`${JSON.stringify(reportOf(durable.view.current(), why))}\n`);
+	await waitFor("close");
+} catch (error) {
+	code = 1;
+	process.stdout.write(`${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+} finally {
+	await citizen.close();
+}
+process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+process.exit(code);