@junghanacs/entwurf 0.30.1 → 0.32.0

package/scripts/mutants/pi-durable.json

@@ -0,0 +1,723 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-durable",
+	"mutants": [
+		{
+			"claim": "PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE",
+			"title": "the verifier's entry guard goes back to import.meta.main, which the floor's runner can misread as the process entry",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["if (invokedDirectly) {\n"],
+			"replace": ["if (import.meta.main) {\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-FOUR-UNITS",
+			"title": "the receive unit stops asking whether the compiled owner join admits the durable host, so a launch proceeds to a citizen nobody can deliver to",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": [
+				"\tif (!ownerJoinAdmitsDurableHost(layout.deliverability)) return \"pi-durable-receive-unit-missing\";\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-FOUR-UNITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED",
+			"title": "a model without a provider part passes the preflight and reaches the durable launch",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": ["\tif (at <= 0 || at === model.length - 1) return null;"],
+			"replace": ["\tif (at < 0 || at === model.length - 1) return null;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY",
+			"title": "the launch argv accepts --bridge-entry, so a caller can point the contact at a bridge outside this package",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": [
+				"const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
+			],
+			"replace": [
+				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FRESH-CALL-EXPOSED",
+			"title": "entwurf_fresh_call drops out of the durable contact's tools, so the citizen cannot open a sibling",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\ttools: PI_DURABLE_TOOL_NAMES.map(tool),"],
+			"replace": ["\t\ttools: PI_DURABLE_TOOL_NAMES.filter((name) => name !== \"entwurf_fresh_call\").map(tool),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FRESH-CALL-EXPOSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BRIDGE-DIRECT-SCRUBBED",
+			"title": "the identity scrub is omitted, so inherited identity carriers reach the bridge child",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\tif (value !== undefined && !scrubbed.has(key)) env[key] = value;\n"],
+			"replace": ["\t\tif (value !== undefined) env[key] = value;\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BRIDGE-DIRECT-SCRUBBED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS",
+			"title": "the root binding is omitted, so the bridge child reads whatever garden roots it inherited instead of the roots the contact wrote",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\tfor (const key of Object.keys(PI_DURABLE_BRIDGE_ROOT_ENV) as (keyof PiDurableRoots)[]) {\n\t\tenv[PI_DURABLE_BRIDGE_ROOT_ENV[key]] = roots[key];\n\t}\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PDH-JOIN-FOREIGN-SENDER-REFUSED",
+			"title": "the durable host leaves the sender join, so a live durable receiver whose owner sender marker names another garden is no longer refused (ABSENT-SENDER and SCOPE also go red)",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
+			"replace": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDH-JOIN-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-deliverability.owner-join.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-SCHEMA-DRIFT-REFUSED",
+			"title": "schema drift is never reported, so a bridge whose tool schemas differ from the exposed copies is accepted at birth",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\treturn problems.length === 0 ? undefined : problems.join(\"; \");"],
+			"replace": ["\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SCHEMA-DRIFT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY",
+			"title": "the receiver arms against any live sender marker, even one naming another garden or session",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (sender === null || sender.gardenId !== gardenId || sender.nativeSessionId !== nativeSessionId) {"
+			],
+			"replace": [
+				"\t\t\tif (sender === null || (sender.gardenId !== gardenId && sender.nativeSessionId !== nativeSessionId)) {"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-ONE-BIRTH",
+			"title": "a born contact can attach again, minting a second birth on the same contact",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (state.kind !== \"pending\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"replace": [
+				"\t\t\tif (state.kind === \"attaching\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ONE-BIRTH]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FIRST-INPUT-ONCE",
+			"title": "the launcher's first input loses its fixed request id, so a reopen can admit the same task again",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\t\trequestId: `entwurf-first-input:${attachment.gardenId}`,\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FIRST-INPUT-ONCE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START",
+			"title": "the send gate registers a bridge under a fresh start read instead of the start that qualified it, so a pid recycled after qualification is owned and signalled",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["own(child.pid, \"bridge\", child.start)"],
+			"replace": ["own(child.pid, \"bridge\")"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY",
+			"title": "the send gate looks complete observation up by pid, so a host whose pid was reused inherits its predecessor's observed children",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["childrenObserved.has(host)"],
+			"replace": ["[...childrenObserved].some((h) => h.pid === host.pid)"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-S3-START-RECHECKED",
+			"title": "the send gate's SIGKILL of the paused bridge loses its start-key re-check, so a process that replaced it after the IO and state reads is killed",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": [
+				"\tif (procStat(bridge1.pid)?.start !== bridge1.start)\n\t\tthrow new Error(`GAP: bridge1 ${bridge1.pid} is not the observed process immediately before its SIGKILL`);\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-S3-START-RECHECKED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES",
+			"title": "the receive gate's failed connect no longer closes the transport, so a bridge spawned inside connect is left neither owned nor closed",
+			"subject": "scripts/check-pi-durable-receive.ts",
+			"find": [
+				"\ttry {\n\t\tawait client.connect(transport);\n\t} catch (error) {\n\t\t// A failed connect may already have spawned the bridge, which is not owned yet: close the\n\t\t// transport (it ends the child it spawned) before rethrowing, and keep the cause first.\n\t\ttry {\n\t\t\tawait transport.close();\n\t\t} catch (closeError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, closeError],\n\t\t\t\t`the sending bridge did not connect (${(error as Error).message}); closing it also failed`,\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n"
+			],
+			"replace": ["\tawait client.connect(transport);\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY",
+			"title": "the receiver diagnostic appends every successful admission instead of keeping the latest one, so it grows with the host's lifetime (RING-COALESCES, whose two-pass expectation is latest-only, also goes red)",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\t\tadmissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });"
+			],
+			"replace": ["\t\t\t\tadmissions.push({ why, requestId, submissionId: submission.id, fresh, unread });"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RELOCATION-TWO-RULES",
+			"title": "a carrier file's import of a sibling keeps its .ts specifier, so the installed carrier asks Node for a file that was never emitted",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["return `./${name}`;"],
+			"replace": ["return spec;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RELOCATION-TWO-RULES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RELOCATION-REFUSES",
+			"title": "the emitter stops counting specifier openings against recognized statements, so a dynamic or single-quoted import escapes the relocation unrewritten",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (begun !== statements) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RELOCATION-REFUSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RESOLVE-DECLARED",
+			"title": "the resolver maps a declared target one directory above the package's dist, so every carrier internal import binds a file the pin never named",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["return pathToFileURL(file).href;"],
+			"replace": ["return pathToFileURL(path.join(dist(), \"..\", target)).href;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RESOLVE-DECLARED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RESOLVE-REFUSES",
+			"title": "the resolver only asks that a parent be somewhere under the carrier directory, so an undeclared or nested file there may reach pi-coding-agent internals",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (!files.includes(parent)) {"],
+			"replace": ["if (parent === \"\") {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RESOLVE-REFUSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-HOST-ROOT",
+			"title": "the coding-agent root is taken from any package directory above the root export, so a different package named in that place becomes the dist the carrier binds",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (name !== CODING_AGENT) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-HOST-ROOT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
+			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
+			"subject": "pi/pi-durable/overlay/upstream-pin.json",
+			"find": ["\"sha256\": \"ca0ee10dc904a57d46bb33b37fcc4efe48dfa08b2f0d10e79e7bc22136871f0a\""],
+			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-PIN-MATCHES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-PIN-MALFORMED",
+			"title": "the carrier declaration no longer requires plain file names, so a pin naming ../escape.js is accepted and the resolver answers a path outside the carrier",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (!names?.every(plain) || names.length === 0"],
+			"replace": ["if (!names || names.length === 0"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-PIN-MALFORMED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-EMIT-NO-REPLACE",
+			"title": "the emitter reads source objects without --no-replace-objects, so a refs/replace entry in the maintainer's repository stands in for a pinned file",
+			"subject": "scripts/emit-pi-durable-carrier.ts",
+			"find": ["return [\"--no-replace-objects\", \"-C\", source, ...args];"],
+			"replace": ["return [\"-C\", source, ...args];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-EMIT-NO-REPLACE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-VERIFIED",
+			"title": "the verifier stops walking from each member to its own member dependencies, so only the carrier's direct edges are ever compared",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tif (name in pin.members && edge.at !== null) pending.push({ name, at: edge.at });\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-VERIFIED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-PACKAGE-INCOMPLETE",
+			"title": "a missing carrier resolver or relocation grammar is no longer an incomplete package, so the launcher prints a resolver path that does not exist",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["for (const at of [layout.resolver, layout.relocation]) {"],
+			"replace": ["for (const at of [] as string[]) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-PACKAGE-INCOMPLETE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CARRIER-DRIFT",
+			"title": "a carrier file whose bytes are not the pinned ones verifies, so an edited app runs as the emitted one",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["else if (sha256(fs.readFileSync(at)) !== file.sha256) drifted.push("],
+			"replace": ["else if (false) drifted.push("],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CARRIER-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SDK-ABSENT",
+			"title": "a declared package that resolves nothing is no longer named absent and reads as a version mismatch",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["if (absent !== undefined) return { reason: \"pi-durable-sdk-absent\", detail: edgeText(absent) };"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SDK-ABSENT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SDK-MISMATCH",
+			"title": "only the carrier's own edges are compared, so a member binding another version of a member through its nested copy verifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["const mismatch = facts.edges.find((e) => e.got !== e.want || e.name !== e.to);"],
+			"replace": [
+				"const mismatch = facts.edges.find((e) => e.from === \"carrier\" && (e.got !== e.want || e.name !== e.to));"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SDK-MISMATCH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SHARED-COPY-PASSES",
+			"title": "a same-version copy shared from above the package is treated as absent, so an ordinary hoisted install of the pinned set is refused",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tconst edge = resolveEdge(\"carrier\", name, want, base);\n"],
+			"replace": [
+				"\t\tconst edge = ((e) => (e.at !== null && !e.at.startsWith(layout.root) ? { ...e, got: null } : e))(resolveEdge(\"carrier\", name, want, base));\n"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SHARED-COPY-PASSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-READ-ONLY",
+			"title": "verifying leaves a marker in the installed carrier directory, so a read-only check mutates the package it certifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\tconst facts = inspectPiDurableRuntime(layout);\n\tconst verdict = piDurableRuntimeVerdict(facts);"],
+			"replace": [
+				"\tfs.writeFileSync(path.join(layout.carrierDir, \".verified\"), \"\");\n\tconst facts = inspectPiDurableRuntime(layout);\n\tconst verdict = piDurableRuntimeVerdict(facts);"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-READ-ONLY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CHECKOUT-CARRIER",
+			"title": "a committed carrier file is edited by hand after emission, so the checkout ships app bytes its pin does not record",
+			"subject": "pi/pi-durable/carrier/sessions.js",
+			"find": ["import lockfile from \"proper-lockfile\";"],
+			"replace": ["import lockfile from \"proper-lockfile\"; // edited"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CHECKOUT-CARRIER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CLI-EXITS",
+			"title": "a refused carrier exits 0 from resolve, so the launcher execs node under whatever the refusal printed",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\treturn PI_DURABLE_RUNTIME_EXIT.refused;\n}"],
+			"replace": ["\treturn PI_DURABLE_RUNTIME_EXIT.verified;\n}"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CLI-EXITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-REACHABLE-CLOSURE",
+			"title": "the walk stops at the members the carrier finds itself, so a same-version nested copy's own wrong-version dependency verifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\t\tif (edge.at !== null) pending.push({ name: dep, at: edge.at });\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-REACHABLE-CLOSURE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-PACKAGE-IDENTITY",
+			"title": "an edge is judged by version alone, so a different package that happens to carry the pinned version stands in for the member",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" || e.name !== e.to);"],
+			"replace": [");"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-PACKAGE-IDENTITY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SHARED-WALKED-ONCE",
+			"title": "a copy reached by two paths is walked twice, so its edges are reported twice and a member cycle never ends",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tif (walked.has(next.at)) continue;\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SHARED-WALKED-ONCE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-OPERATOR-GUARD-INVARIANT",
+			"title": "the registration snapshot keeps names but not bytes, so an edit to an existing pi-durable record under the same filename passes the guard",
+			"subject": "scripts/lib/pi-durable-operator-guard.ts",
+			"find": ["if (fs.lstatSync(file).isFile() && keep(name)) out[name] = sha256(file);"],
+			"replace": ["if (fs.lstatSync(file).isFile() && keep(name)) out[name] = \"\";"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-OPERATOR-GUARD-INVARIANT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-GATE-OPERATOR-GUARD-WIRED",
+			"title": "the contact gate compares the operator snapshot with itself, so a run that changed the operator's registrations still passes its guard",
+			"subject": "scripts/check-pi-durable-contact.ts",
+			"find": ["operatorSnapshotUnchanged(operatorBefore, operatorPiDurableSnapshot(operatorAgent)),"],
+			"replace": ["operatorSnapshotUnchanged(operatorBefore, operatorBefore),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-OPERATOR-GUARD-WIRED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-ABSENT-UNCHANGED",
+			"title": "the module phase runs without a --native-module, so a launch that names no module still tries to import one",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"],
+			"replace": ["\tconst extensions = false ? [] : [await loadNativeModule(nativeModule)];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-ABSENT-UNCHANGED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-PATH-REFUSED",
+			"title": "a relative --native-module is resolved against whatever directory the launch happens to be in",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (!isAbsolute(value))"],
+			"replace": ["\tif (false)"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-PATH-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-INIT-BEFORE-RUNTIME",
+			"title": "the module initializes after the TUI is imported, so its environment arrives after the SDK modules have evaluated",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": [
+				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];",
+				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
+				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
+				"\tconst { runDurableTui } = await loadTui();"
+			],
+			"replace": [
+				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
+				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
+				"\tconst { runDurableTui } = await loadTui();",
+				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-INIT-BEFORE-RUNTIME]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-IMPORT-FAILED",
+			"title": "a module that throws during initialization is treated as no module and the app opens anyway",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t} catch (error) {", "\t\tthrow Object.assign(", "\t\t\trefuse(\"native-module-import-failed\","],
+			"replace": [
+				"\t} catch (error) {",
+				"\t\treturn undefined;",
+				"\t\tthrow Object.assign(",
+				"\t\t\trefuse(\"native-module-import-failed\","
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-IMPORT-FAILED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-IDENTITY-GUARD",
+			"title": "the identity carriers are compared only after the module ran, so a change its initialization made is never seen",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst changed = identityChanges(before, identitySnapshot());"],
+			"replace": ["\tconst changed = identityChanges(identitySnapshot(), identitySnapshot());"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-IDENTITY-GUARD]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-CWD-PINNED",
+			"title": "the app is opened wherever the process is at open time, not in the caller's directory fixed before the module ran",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst citizen = await openDurableCitizen({ ...args, cwd, extensions, bridgeEntry, open, contact });"],
+			"replace": ["\tconst citizen = await openDurableCitizen({ ...args, extensions, bridgeEntry, open, contact });"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-CWD-PINNED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-EXPORT-NAME",
+			"title": "a module may name its extension entwurf, coding-tools, pi-prompt or subagent, and the native registry silently replaces that extension",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (RESERVED_EXTENSION_NAMES.includes(extension.name)) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-EXPORT-NAME]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-EXTENSION-ORDER",
+			"title": "the module's extension is installed before the contact",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\textensions: [contact.extension, ...extensions],"],
+			"replace": ["\t\t\textensions: [...extensions, contact.extension],"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-EXTENSION-ORDER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}