@junghanacs/entwurf 0.30.1 → 0.32.0

package/AGENTS.md

@@ -31,7 +31,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 3. **One identity contract, capability domains.** Branch on rail/liveness capability, not a privileged citizen class.
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
-6. **MCP is explicit.** Only explicit `mcpServers`; no ambient configuration scan or automatic retrieval.
+6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`; native extension modules use operator-declared paths through the owning bootstrap. Neither discovers ambient configuration, scans extension directories, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
 7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
@@ -42,7 +42,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
 16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
-17. **Entwurf installs itself; setup composes.** Installation supplies Entwurf bytes and development fixtures, never a harness binary, subscription, credential, or login. Setup detects existing harness capability; absence is explicit skip and detected incompleteness is non-green. Portability evidence and rail/runtime support remain separate.
+17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf may carry that pinned, removable app/TUI with its declared overlay and deterministic emit/import relocation, against one coherent published-library version set. Native execution, auth, queues, storage, transcript and recovery remain upstream-owned (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.
 
@@ -91,6 +91,7 @@ implement → affected focused gates → independent review → one amendment bu
           → qualification once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
 ```
 
+- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: required changed qualification, frozen FULL and native/LIVE/release floors remain mandatory before landing/shipment, never inherited from an interim commit.
 - Inner loop runs only affected gates; review and its corrections finish before the full floor.
 - A changed contract names a production subject and independent oracle; its focused assertion has a stable QK and exact-once mutant. Matrices change by their declared axes/cells, not appended anecdotes.
 - Qualification body is scheduled once when its surface changes; its manifest/head checks remain in the deterministic floor. A release requires the exact-SHA qualification evidence required by VERIFY, never a nearby green run.
@@ -100,6 +101,7 @@ implement → affected focused gates → independent review → one amendment bu
 ## Type and Working Boundaries
 
 - Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
+- Develop only on branches in this repository checkout; never use worktrees or tmp development clones. Isolated test fixtures and temporary evidence are not development checkouts.
 - Make surgical, one-contract changes. Removal repairs source and its proof together; a green gate never proves retired behavior.
 - Before commit, sweep repository-wide for retired authority vocabulary and landed-plan future tense. Historical tombstones may remain; live docs, source, gates, and usage must agree.
 - Prefer capability-domain language over identity rank. Use tabs unless the project formatter requires otherwise. GLG decides commit, push, and release gates.

package/CHANGELOG.md

@@ -4,6 +4,200 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.32.0 - 2026-10-08
+
+### Added
+
+- **One npm installation unit for native `pi-durable` (#130).** The package
+  supplies the omitted experimental app/TUI as a pinned Pi1.0.4 carrier, with the
+  declared contact overlay, deterministic emit/import relocation, MIT license
+  and rebuild contract. Nine exact published SDK dependencies supply the native
+  library set. The operator no longer clones, patches or builds a separate
+  fixed-XDG source runtime; there is no old-route fallback, downloader or repair.
+  Native runtime/TUI/models/auth/queues/SQLite/transcripts/recovery remain upstream-owned.
+- **One explicit native extension ingress.** `--native-module <absolute file>`
+  loads ordinary ESM, including top-level await, before TUI/runtime imports;
+  its default native durable Extension is installed by reference after the
+  contact. Reserved extension/contact names and identity/cwd changes refuse by
+  name. These are trusted-code mistake guards, not a sandbox or rollback. No
+  ambient discovery, classic ExtensionAPI shim, persistent module profile or
+  fresh-call propagation. Synthetic node:* development fixtures prove the
+  contact, module tool and native bash child; real dotenv policy stays downstream
+  in agent-config after release.
+
+### Changed
+
+- **Pi host floor and native SDK set are separate subjects.** Host CLI range is
+  `>=1.0.4 <1.1`; native SDK members are exact1.0.4 production dependencies,
+  with `proper-lockfile`4.1.2. The installed verifier walks reachable physical
+  member edges by name/version, allows coherent sharing and cycles, and refuses
+  incomplete, drifted or mixed-version supply even when imports work.
+- **Known ordinary-Pi manifest warning retained.** The host warns that its
+  extension packages belong in peer dependencies; the exact installed SDK copies
+  intentionally serve the separate native process. GLG accepted this manifest
+  constraint for0.32, not a universal harmlessness or peer-contract certification.
+
+### Fixed
+
+- **Qualification preserves prior-run evidence.** Retire the ambient dead-pid /
+  prefix sweep and its marker-based authority. Full/group execution share only
+  invocation-owned snapshot creation/teardown; prior names and bytes survive
+  green, red and collection fixture cases. No replacement GC or cleanup manager.
+  Repair the malformed-carrier oracle's discriminator and run the actual rebuilt
+  verifier inside its own copied package so the READ-ONLY mutant cannot contaminate
+  the checkout. The production refusal and read-only contracts remain unchanged.
+- **Installed-gate host fixtures keep their SDK generation closed.** Derive the
+  aligned host's complete exact SDK roots from the owning pin, and the same
+  member names at1.0.2 for the previous-host control. The first prepared CI's
+  coinstalled host tried pi-ai1.1.0 and received npm404 through its caret edges;
+  its RED is preserved. Product pins/overrides and native assertions are unchanged.
+- **Fresh-call tool description fits the existing host cap.** One clause was
+  shortened from2068 to2021 characters; callable schema, cap2048, named refusals
+  and the installed-carrier contract are unchanged.
+
+### Verification and evidence boundaries
+
+- **Frozen source/native candidate:** `b220b20c1b95f0ecafe8e679668bda3c5678be81`
+  accepted FULL716s/exit0, all898 committed mutant IDs exactly once KILLED,
+  178 green controls, unchanged origin, MUST25/0/0 and BEHAVIOR1/0/0/cutOK.
+  Explicit installed `check-pack-install` passed separately; FULL/aggregate do
+  not contain that gate or the container gate. Saved official Codex65/Pi-durable36
+  snapshots were independently rejudged through their shipped receipt oracles.
+  [Owning #130 receipt](https://github.com/junghan0611/entwurf/issues/130#issuecomment-6043744944).
+- **Pre-version landing:** main `78c917ae2dbec01281c41287db14ed8d008a3c82`,
+  [push CI37679372365](https://github.com/junghan0611/entwurf/actions/runs/37679372365),
+  all four required jobs plus qualification BODY success, exact898/898 KILLED,
+  controls178green/origin unchanged and Linux artifact-consumer exit0. Its
+  temporary tarball retained package version0.31.0; it is neither the published
+  0.31.0 artifact nor a preserved accepted0.32 candidate.
+- **Independent pre-prepare consistency review:** Grok Blocker0/Defect2; the
+  two stale pending underclaims were corrected as prose, not a gate restart.
+  GLG explicitly approved version metadata preparation, new prepared-SHA CI and
+  one preserved exact artifact without repeating local FULL/LIVE for documentation
+  changes. Source/native receipts retain their original fingerprints; prepared-SHA
+  qualification, versioned artifact and registry equality remain independent
+  evidence. This preparation text does not assert a tag, GitHub release or npm publish.
+- **Historical RED retained.** R3 aggregate remains RED despite FULL714s/exit0.
+  Its protected36MB snapshot was irreversibly deleted by the retired sweep;
+  wider deletion extent and the vendor `-32603` cause remain unknown. Original
+  raw/confirmation/review erratum are preserved. Prior-run preservation is a
+  private-fixture proof: r4 had no prior root in actual tmp, so no in-situ claim.
+  Original0.31 release/tag/artifact/archive are immutable. Native agy1.2 remains
+  NOT CERTIFIED and its historical1.1 pin is unchanged; no new native agy acceptance
+  or permanent exception is inferred.
+
+## 0.31.0 - 2026-10-07
+
+### Added
+
+- **Native durable contact (`pi-durable`, #129).**
+  Treat the experimental durable coding app as a separate native harness. One
+  native host attaches to one V3 garden id; the contact adds visible garden
+  identity, self/peers, canonical outbound dispatch and announce-only root-directed
+  mailbox receive with explicit inbox read. Runtime, TUI, model/auth, SQLite
+  storage, transcript and recovery remain upstream-owned. Internal subagents do
+  not mint another citizen. Native recovery is not exactly-once Entwurf delivery.
+
+### Installation
+
+- **Entwurf's npm/source installation route stays unchanged.** Optional native
+  durable use additionally requires an operator-provided pinned upstream source
+  runtime and the narrow runtime-contact overlay (Pi 1.0.2/source `cd32f77` in this
+  lane). The `@earendil-works/pi-durable` **library** is npm-installable; the
+  experimental coding app/TUI is not supplied by the ordinary Pi npm package.
+  Entwurf does not install a harness or copy credentials. Existing non-durable
+  users do not need a source checkout. [Native durable setup boundary](docs/setup-clean-host.md#2b-optional-native-durable-pi-durable).
+
+### Changed
+
+- **Pi dependency/runtime floor is 1.0.2**, with pi peer range `>=1.0.2 <1.1`.
+  Native durable pins upstream source `cd32f77` and its narrow contact overlay;
+  no upgrade to a newer experimental app or replacement runtime is included.
+- **Source workspace discovery is root-only.** Explicit `packages: ['.']` keeps
+  pnpm's workspace scan coherent with the root install, without disabling its
+  dependency verification. Prepack still runs the foreground build lifecycle,
+  with build output on stderr so pack JSON stays readable and failures propagate.
+
+### Verification
+
+- **Reviewed pre-version main:** product `165338e` and native-admission `535c2e1`
+  landed separately with normal hooks/shared safety scans. The final landing's
+  [exact-SHA CI](https://github.com/junghan0611/entwurf/actions/runs/37478003145)
+  at `535c2e1b63e6a66c45227e197de80bf261202aec` passed all four required jobs
+  and the qualification BODY **872/872 KILLED**, including the new foreign-sender
+  guard4.5s KILLED against subject `7bdea2c4c664…`. Implementation issue #129 is closed; #130 owns
+  npm-only runtime supply, Pi upgrades, ACP and UI follow-ups. This main receipt
+  is not the later prepared-commit or preserved-artifact acceptance.
+- **Native first admission:** corrected real Pi → pi-durable → Pi LIVE36
+  passed in41s on `openai-codex/gpt-6.1-sol`, task-wide native5 + contact6 offering.
+  A consistent official SQLite backup establishes first callback, own-id inbox
+  read, joined successful native dispatch and the exact root doorbell reaching done.
+  Pi transcript row19 carries the exact expected payload and authoritative durable
+  sender. Native V evidence is distinct from checkout contact95/send19/receive21
+  scripted S + native H and installed-bootstrap import-only proof.
+- **Receipt-oracle repair is portable and independently reviewed.** Exact payload,
+  terminal sender envelope, root scope, effective offering, call/result and doorbell
+  joins replace substring/union predicates. Eight inline tests and the existing mux
+  coordinate carry a foreign-sender guard mutant. The original35-GREEN predicate
+  selected fixture row15; real old-row19 delivery was independently present. Old raw,
+  wrong receipt and RED857/870 remain preserved, never relabelled new acceptance.
+  Native admission raw: `.tmp-verify/b9ffcb-pack-cause/live-pd-20261006T223708/`.
+- **Versioned working-candidate P4:** FULL666s/exit0, HEAD/index/tracked work-surface
+  and binary diff frozen MATCH; pack dry-run580files. The pre-verdict release-metadata
+  patch/bytes are preserved in `.tmp-verify/031-release/prepare/p4/`, snapshot SHA
+  `2529949384af40c6ca15f65575638b97980817cb85d7a68bb81e9ff1b34c8fa7`, full-log SHA
+  `57da80e9e32159f8bc966381a2756d6a34cca647dd5ee5791ee681ed3509b0df`.
+  This floor used the exact private Herdr0.9.3 aarch64 supply pin; operator0.9.1 stayed
+  unchanged. No qualification BODY or native LIVE was executed in this P4 run.
+- **Explicit agy criterion7 exception for this0.31.0 cut, confirmed by GLG
+  (2026-10-07):** “agy 예외. 0.30.1부터 그렇게 헀어 더 진행가자” permits continuing
+  prepare/make while agy1.2 remains **NOT CERTIFIED**. The historical1.1 pin and
+  DELIVERY certification row stay unchanged; #128 remains first-party own-context
+  prerequisite research. No nonce/credential extraction, old-CID replay, transport
+  implementation, permanent floor change or npm publication is authorized by this
+  exception. Other release axes remain mandatory.
+- **Fresh native Claude host:** owned writer/registry refresh corrected the stale
+  deployed v3 bytes before P5. Source=assembled=installed writer `c8f05d394d0e`,
+  capability registry `2f95e94f1eb9`; strict doctor exits0 with four live owner joins.
+  A new Claude2.1.291 session after install, garden `20261007T024544-c71062`,
+  ownerPID2784041/startKey `linux:304383485`, bridge child2784080, joins sender,
+  receiver and V3 record with no model turn. `prepare/claude-native-cert/accepted.json`
+  retains the exact metadata. This is checkout-provenance certification, not an
+  installed emitted-JS/bin-shim, registry, model-turn or fresh delivery/reply receipt.
+- **First P5 and scoped repair remain distinct.** The frozen candidate's first
+  `--cut` run ended RED: MUST23/2/0, BEHAVIOR1/0/0, qualification872/872 KILLED,
+  HEAD/index/tracked bytes MATCH. Log `/tmp/entwurf-release-gate-0.31.0.JdQ4q6/release-gate.log`.
+  The owned OMP receiver's stale writer was refreshed through its installer; strict
+  runtime/ownership doctor and fresh receive LIVE11 passed. Initial Pi's Codex relay
+  added one trailing newline; the exact source oracle rejected it. A fresh chain on
+  the unchanged candidate passed65 assertions, source audits Pi3/3 + Codex3/3, with
+  no oracle relaxation or old-CID replay. The owed on-demand seat×cwd fresh-call
+  matrix passed39. `prepare/p5-focused-1/accepted.json` retains those focused receipts;
+  they do not turn the original aggregate RED into GREEN. Immediate P9 was report-only,
+  five eligible roots312K after P5 and six328K after the focused bundle; protected
+  Emacs was the only reparented `/tmp` process, with no deletion or signal.
+- **Final fresh P5 cut verdict:** `LIVE=1 ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.31.0.Xzbk2b --cut` exited0 after110m15s:
+  **MUST PASS=25 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, its own
+  FULL and qualification **872/872 KILLED**, frozen HEAD/index/tracked bytes MATCH.
+  Log SHA256 `609612baff850ec06fc74321002b33a6b71d3dabc76874dc1546b8722c317bf2`;
+  snapshot SHA256 `38c49ca5123ffc9883762d637084dba9ed77adbdd5f3e86287a1ace565f763de`.
+  `prepare/p5-final/accepted.json` retains the boundary; native durable raw is
+  `/tmp/smoke-pi-durable-fresh-live-2026-10-06T23-27-34-983Z`. Immediate P9 reported
+  unused198/eligible6/328K, protected Emacs only; no deletion/signal.
+- **Fresh-eyes documentation alignment:** independent Grok review found one
+  underclaim bundle, not a false green: operator docs still called accepted native
+  admission pending and a direction note pointed to a retired branch handoff.
+  After the final P5 verdict, documentation-only commit `87de9f7` aligns those states
+  with DELIVERY/#129 and distinguishes seven citizen backends from six fresh-openable
+  ones. Bounded independent re-review closed the Defect (Blocker0/Defect0); normal
+  hooks/shared scanner passed, and main fast-forwarded locally before release-prep. Executable/gate/model/pin/manifest bytes are unchanged; no LIVE Claude ↔
+  durable or registry/runtime provision is inferred. Review artifacts live in
+  `.tmp-verify/031-release/grok-fresh-review/` and `docs-amendment/`.
+- **Release acceptance is pending:** prep commit/prepared-SHA CI and preserved
+  artifact remain outstanding. No final candidate, tag, GitHub release or npm
+  publication is asserted here.
+
 ## 0.30.1 - 2026-10-04
 
 ### Fixed

package/DELIVERY.md

@@ -116,6 +116,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
 | **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
+| **pi-durable native host** | 0.31.0 candidate; visible fresh + addressed receive + both cross-harness legs accepted on one Linux host (2026-10-06, `smoke-pi-durable-fresh-live`, 36 assertions, exit 0) | D6 (D3/D4 shown); D7 partial; D8 unproven | The operator-provided pinned source runtime (`cd32f77` + overlay) launched by the managed `entwurf pi-durable --provider … --model … --width task-wide`; the contact registers six tools and spawns the compiled bridge as a direct child; receive is announce-only self-fetch (doorbell → root submission → `entwurf_inbox_read`). Receipt (V on both sides, `openai-codex/gpt-6.1-sol`): real Pi `20261006T223710-e51e21` opened pd `20261006T223720-ba0c08` through `entwurf_fresh_call`; pd's first action called back into Pi with the exact nonce; Pi's live turn → pd mailbox ENQUEUE `2026-10-06T13-37-35-446Z-b57c69.msg`, that message's doorbell submission `done` on pd's root conversation, drained by pd's live turn (`entwurf_inbox_read` of its own id, settled); pd's live turn → Pi `entwurf_v2` settled `control-socket → sent` (native tool-result, joined by call id) and landed as exactly one Pi row with the expected payload and pd as the anchored sender. Native offering (root `pi.system`, toolsAdded/toolsRemoved applied): the six contact tools + bash/read/edit/write/subagent; pd's first root tool call is the callback. Actual model from root `pi.assistant` rows; the generation checkpoint does not retain `request.model` after completion. |
 | **Copilot CLI TUI+server** — *withdrawn lane, kept as evidence* | rejected | D7; D8 unproven | Older official-SDK probe over hidden `--ui-server`; idle enqueue worked, but loopback RPC authentication was not established. The bundled extension supersedes this candidate without reviving it. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 

package/README.md

@@ -15,7 +15,7 @@ Git branches, worktrees, file isolation and internal delegation remain their con
 [Short answers: FAQ](./FAQ.md).
 
 ```text
-pi / Claude Code / Copilot / OMP / Antigravity / Codex
+pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
   → record-backed garden id
     → entwurf_v2
       → control-socket | self-fetch mailbox | native-push
@@ -27,6 +27,20 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
+**Native durable contact (`pi-durable`) ships in the [0.31.0 release](https://github.com/junghan0611/entwurf/releases/tag/v0.31.0) (#129).**
+It is a separate native harness contact, not ordinary Pi's control-socket adapter.
+The contact attaches one durable host to a garden id, adds visible identity and
+two-way mailbox contact, while the upstream harness keeps its TUI, models/auth,
+SQLite storage and recovery. Native admission passed on one Linux host on the
+0.31.0 source-runtime route. Under the #130/0.32 contract the app ships inside the
+Entwurf package as a pinned [carrier](#native-durable-pi-durable--130--032-contract), so
+it no longer depends on installing the ordinary Pi CLI or provisioning a runtime.
+
+> **Prepared 0.32.0 candidate, not a published release.** The current source contains #130's
+> carrier and explicit native-module contract. Prepared-SHA CI and one preserved versioned
+> artifact have their own acceptance receipts; preparation alone does not assert npm publication.
+> The published 0.31.0 follows its source-runtime docs — it does not supply this carrier.
+
 ## Install
 
 **Choose by where you work. Neither route installs a harness, subscription or login.**
@@ -35,7 +49,7 @@ citizen is not a promise of every lifecycle operation.
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.0.0 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.0.4 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -63,6 +77,38 @@ Detected harness wiring on Darwin can therefore be written while setup stays
 non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
 restriction; that is not certification of every platform's harness rails.
 
+### Native durable (pi-durable) — #130 / 0.32 contract
+
+**Installing Entwurf from npm supplies pi-durable. There is no runtime checkout, patch,
+build or model-data copy for the operator.**
+
+| Component | How it is supplied | What it does not supply |
+|---|---|---|
+| Entwurf | Existing npm or source-checkout route above | A harness binary, subscription or login |
+| pi SDK set (`@earendil-works/*` 1.0.4, incl. the `pi-durable` library) | Exact production dependencies of Entwurf | The experimental app, which upstream does not publish |
+| Native experimental durable app/TUI | Entwurf's **carrier**: the pinned upstream v1.0.4 app files, type-stripped, with the narrow runtime-contact overlay (`pi/pi-durable/carrier/`, MIT) | A replacement ordinary Pi CLI or an Entwurf-owned harness |
+
+`entwurf pi-durable` verifies the carrier and the pi SDK set it resolves — every reachable
+package edge binds the declared name at exactly the pinned version — and refuses by name otherwise
+(`pi-durable-package-incomplete`, `-carrier-drift`, `-sdk-absent`, `-sdk-mismatch`);
+`entwurf setup` reports the same verdict as PASS or FAIL (never SKIP) without writing durable
+wiring. The ordinary Pi on PATH is a separate subject with its own range above. Native auth,
+models, sessions and recovery stay upstream-owned: Entwurf does not copy credentials or convert
+ordinary Pi sessions into durable SQLite sessions. One operator module of your own can ride the
+launch with `--native-module <absolute file>`: it initializes before the durable runtime and its
+default export, a native durable `Extension`, is installed after Entwurf's contact ([setup
+§2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)). Ordinary Pi may warn
+that Entwurf's `@earendil-works/*` belong in `peerDependencies`; the exact set is a production
+dependency on purpose, for the native process — a known manifest constraint accepted for 0.32.
+
+The installed carrier's runtime/TUI load, its physical SDK edges and the public launch up to the
+app's own model resolution are package-gate evidence; the checkout contact/send/receive gates run the
+same carrier with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate
+release proof. 0.31.0 shipped the earlier source-runtime
+route (Pi 1.0.2/source `cd32f77`), which this contract replaces.
+See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
+and [#130](https://github.com/junghan0611/entwurf/issues/130).
+
 ### Herdr workbench
 
 ```bash
@@ -132,9 +178,9 @@ Liveness is read at dispatch time; an id's shape does not tell you its transport
 | Reopen a dormant pi citizen under its own id | `entwurf_resume_call {target}` | Separate LAUNCH and socket OBSERVATION receipts; no turn is run |
 
 **Delivery starts no process.** A live pi receives over its record-addressed Unix
-control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP) through its
-mailbox; a probe-alive native-push citizen (Antigravity, Codex) through its native
-conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
+control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP, pi-durable)
+through its mailbox; a probe-alive native-push citizen (Antigravity, Codex) through
+its native conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
 push and record-less sockets reject honestly. Only control-socket dispatch takes
 the per-target lock; the other rails use their own deliverability/probe evidence.
 
@@ -148,9 +194,10 @@ is a live rail fact, not merely a consequence of trusted identity.
 
 **Mux launches; it never delivers.** Inside Herdr, fresh opens a new unfocused tab
 in the caller's workspace, pi/Claude Code only, with no tmux fallback. Outside,
-it opens pi/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux server.
-The model is required; optional `cwd` is a literal absolute directory, omitted or
-empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
+it opens pi/pi-durable/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux
+server. pi-durable runs the installed carrier on its exact SDK set described above and
+refuses by name before any window when that verdict is not green; Herdr does not fresh-open it. The model is required; optional `cwd` is a literal
+absolute directory, omitted or empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
 tmux session (not permitted inside Herdr), never a new session or a cwd lookup.
 Omitted tmux placement follows the caller: Codex beside its own TUI pane matched
 by thread-id, everyone else in their own session. Missing/ambiguous context refuses.
@@ -182,14 +229,17 @@ and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-l
 Instead of keeping native pi copies of the verbs, the adapter registers the same
 compiled bridge after record birth, under the citizen's identity, and Pi supervises
 that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
-control socket.** Garden identity and dispatch stay Entwurf's. What `pi-durable`
-or Pi codemode should mean here remains undecided: this cut neither adopts nor
-certifies them. The 0.30.0 follow-up separately measured Herdr supply 0.9.3 and
+control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
+did not adopt or certify `pi-durable` or codemode. Native durable support is now
+released as a separate 0.31.0 native contact, as described above; codemode remains a
+harness-internal capability, not another garden citizen. The 0.30.0 follow-up
+separately measured Herdr supply 0.9.3 and
 re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its
 public consumer and CI receipts live in the #126 thread. That dated alignment is
-not a permanent version-equality rule. Unpublished 0.30.1 uses the closed
-`herdr-checkout` verification carrier; the [plugin source contract](./plugins/herdr/README.md)
-owns the measured npm re-pin and source-specific proof owed after publication.
+not a permanent version-equality rule. 0.30.1 is published (npm, 2026-10-04); at its tag the
+plugin's runtime lock is still the closed `herdr-checkout` verification carrier. Publication did
+not re-pin it: the measured npm re-pin and its source-specific proof are separate, still-open
+work that the [plugin source contract](./plugins/herdr/README.md) owns.
 
 Entwurf is the 0.12+ successor to
 [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp):

package/VERIFY.md

@@ -200,6 +200,41 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 Do not collapse source, package, fixture, and native-host evidence into one “green.”
 
+**Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
+beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
+verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
+maintainer emitter (its source reads refuse replace refs), and the bootstrap's explicit
+`--native-module` ingress (#130 P2), driven through the packaged `main`'s own seams: initialization
+before the TUI and the open, named refusals, the identity and directory guards, the contact-first
+order by reference, and the bridge spawn *spec* (not the child's inheritance). `check-pi-runtime-version` asks the
+same verifier whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
+host is setup's subject), and `check-pi-import-surface` asserts the carrier fence. The separate
+`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive` are
+CHECKOUT-ONLY SDK/contact gates: they run the checkout's own carrier — verified first, refused by
+name — and require a private compiled bridge emitted from this candidate
+(`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). A missing bridge input reports SKIP 97, never PASS; a
+refused carrier fails. Installed packages refuse these developer gates. Contact is
+adapter-direct/harness-bypassed; send/receive exercise scripted loopback S plus actual native
+harness H, not vendor V. `check-pi-durable-send` with `ENTWURF_PI_DURABLE_SEND_CELL=native-module`
+runs the whole packaged `main` with the synthetic module (`test/fixtures/pi-durable-native-module/`):
+its initialization lands before the host's first `@earendil-works`/`entwurf-pi-dist:` resolution
+(one receipt file, observing resolve hook), and one scripted answer calls the module's tool, the
+native `bash` (whose child sees the module's value) and the contact's `entwurf_self`. Their scoped
+raw records, wire, native view and SQLite oracles do not certify every queue/crash window. `check-pack-install` proves the INSTALLED carrier on actual npm
+consumers (Entwurf-only, aligned host, isolated global): the installed verifier, a consumer oracle
+whose every resolved product file lies inside that consumer's own `node_modules` (with a
+same-sandbox neighbour as the rejected control), every reachable physical SDK edge at the pinned
+version and declared name, a mixed-version tree refused by name although it still imports, a
+constructed depth-3 mismatch refused by the verifier and seen by the oracle, the public launch reaching the
+app's own model refusal before any birth — also with one installed `--native-module` initialized
+first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.2
+binary beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
+PASSes — not native admission. The maintainer's rebuild
+equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
+a named SKIP, not acceptance. First-release visible fresh/callback and native
+caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a release-gate MUST
+(LIVE=1; vendor V on a real Pi and a real pi-durable host); SDK or package green does not waive it.
+
 | Axis | Required proof | Limit |
 |---|---|---|
 | Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
@@ -290,7 +325,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.0 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.4 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 1.0.0)
+- `pi` on PATH (current floor 1.0.4)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | devDep exact `1.0.0`, peer `>=1.0.0 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Shipped in 0.30.0 (`[측정 2026-10-04]` npm `latest` `0.30.0` declares this same peer range); its acceptance record is CHANGELOG 0.30.0, with #125 as the branch evidence |
+| pi runtime | SDK exact `1.0.4`, host `>=1.0.4 <1.1` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: the published 0.31.0 declares the earlier peer floor 1.0.2 with the same next-minor ceiling; the 1.0.4 move and its receipts are ROADMAP's 2026-10-07 bump entry |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |