@junghanacs/entwurf 0.31.0 → 0.33.0

package/scripts/pi-durable-receive-host.mjs

@@ -1,7 +1,7 @@
-// G-receive host half (#129 L-receive). Runs AS the durable host, under the pinned overlay checkout's
-// source resolver, and is spawned only by scripts/check-pi-durable-receive.ts:
+// G-receive host half (#129 L-receive). Runs AS the durable host, under this checkout's pi-durable
+// carrier resolver (#130), and is spawned only by scripts/check-pi-durable-receive.ts:
 //
-//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//   node --import <checkout>/pi/pi-durable/carrier-resolver.mjs \
 //        scripts/pi-durable-receive-host.mjs <bridge entry>
 //
 // It opens the durable app through the production bootstrap composition — which arms the contact's

package/scripts/pi-durable-send-host.mjs

@@ -1,7 +1,7 @@
-// G-send host half (#129 L-send first cell). Runs AS the durable host, under the pinned overlay
-// checkout's source resolver, and is spawned only by scripts/check-pi-durable-send.ts:
+// G-send host half (#129 L-send first cell). Runs AS the durable host, under this checkout's
+// pi-durable carrier resolver (#130), and is spawned only by scripts/check-pi-durable-send.ts:
 //
-//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//   node --import <checkout>/pi/pi-durable/carrier-resolver.mjs \
 //        scripts/pi-durable-send-host.mjs <bridge entry> <prompt>
 //
 // It opens the durable app through the production bootstrap composition, then gives the app ONE
@@ -16,11 +16,16 @@
 // holds. It prints one JSON report line, holds the host alive until the gate writes `close`,
 // closes, prints `{"closed":true}` and exits. With ENTWURF_PI_DURABLE_SEND_FAULT=malformed-report
 // (the gate's control) it gives the app no input and sends a non-JSON report line instead.
+//
+// --native-module <file> (#130 P2): the whole packaged `main` runs instead — its argument parse, the
+// operator module's initialization, the TUI load and the open, in main's own order — with ONE seam:
+// the TUI runner is this driver, which gives the app the one input through the controller it is
+// handed and reports the view as above. Nothing else of main is replaced.
 import { createInterface } from "node:readline";
-import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+import { main, openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
 
 const USAGE =
-	"usage: pi-durable-send-host.mjs <bridge entry> <prompt> [--await-go] [--report-intent <callId> | --recover <callId>]";
+	"usage: pi-durable-send-host.mjs <bridge entry> <prompt> [--await-go] [--report-intent <callId> | --recover <callId> | --native-module <file>]";
 const [bridgeEntry, prompt, ...flags] = process.argv.slice(2);
 if (bridgeEntry === undefined || prompt === undefined) throw new Error(USAGE);
 // --await-go: report `born` once the citizen exists, and give the app its one input only after the
@@ -36,13 +41,18 @@ if (bridgeEntry === undefined || prompt === undefined) throw new Error(USAGE);
 let awaitGo = false;
 let reportIntent;
 let recoverCall;
+let nativeModule;
 for (let i = 0; i < flags.length; i++) {
 	if (flags[i] === "--await-go") awaitGo = true;
 	else if (flags[i] === "--report-intent" && flags[i + 1] !== undefined) reportIntent = flags[++i];
 	else if (flags[i] === "--recover" && flags[i + 1] !== undefined) recoverCall = flags[++i];
+	else if (flags[i] === "--native-module" && flags[i + 1] !== undefined) nativeModule = flags[++i];
 	else throw new Error(USAGE);
 }
 if (reportIntent !== undefined && recoverCall !== undefined) throw new Error(USAGE);
+if (nativeModule !== undefined && (awaitGo || reportIntent !== undefined || recoverCall !== undefined)) {
+	throw new Error(USAGE);
+}
 
 const stdinLines = createInterface({ input: process.stdin })[Symbol.asyncIterator]();
 /** Wait for one exact line from the gate; the gate closing stdin first is a failure. */
@@ -80,6 +90,67 @@ function summarize(entry) {
 	};
 }
 
+/** Give the app one input through `controller` and resolve once `source` shows the turn settled. */
+function submitAndSettle(source, controller) {
+	const before = source.current();
+	const noticesBefore = before.notices.length;
+	let submitted = false;
+	return new Promise((resolve) => {
+		const check = () => {
+			if (!submitted) return;
+			const view = source.current();
+			const busy = view.conversation.docs["pi.live"]?.run !== undefined;
+			const answered = view.conversation.entries.some((e) => e.kind === "pi.assistant");
+			const failed = view.notices.slice(noticesBefore).some((n) => n.level === "error");
+			if ((!busy && answered) || failed) {
+				unsubscribe();
+				resolve(before);
+			}
+		};
+		const unsubscribe = source.subscribe(check);
+		controller.submit(prompt, "followUp").then(() => {
+			submitted = true;
+			check();
+		});
+	});
+}
+
+if (nativeModule !== undefined) {
+	let code = 0;
+	try {
+		await main(
+			["--provider", "loopback", "--model", "scripted", "--width", "task-wide", "--native-module", nativeModule],
+			{
+				bridgeEntry,
+				loadTui: async () => ({
+					runDurableTui: async (source, controller) => {
+						const before = await submitAndSettle(source, controller);
+						const view = source.current();
+						process.stdout.write(
+							`${JSON.stringify({
+								native: true,
+								hostPid: process.pid,
+								session: view.session,
+								conversationIdBefore: before.conversation.conversation.id,
+								conversationIdAfter: view.conversation.conversation.id,
+								entries: view.conversation.entries.filter((e) => e.kind.startsWith("pi.")).map(summarize),
+								busy: view.conversation.docs["pi.live"]?.run !== undefined,
+								notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+							})}\n`,
+						);
+						await waitFor("close");
+					},
+				}),
+			},
+		);
+	} catch (error) {
+		code = 1;
+		process.stdout.write(`${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+	}
+	process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+	process.exit(code);
+}
+
 const citizen = await openDurableCitizen({
 	bridgeEntry,
 	cwd: process.cwd(),

package/scripts/smoke-herdr-raw-install-live.sh

@@ -108,7 +108,7 @@ if ! command -v docker >/dev/null 2>&1 || ! docker info >/dev/null 2>&1; then
   exit 0
 fi
 
-PI_SPEC="$(node -p "require('$REPO/package.json').devDependencies['@earendil-works/pi-coding-agent']")"
+PI_SPEC="$(node -p "require('$REPO/package.json').dependencies['@earendil-works/pi-coding-agent']")"
 # Pinned, not floating: a receipt that cannot say WHICH Claude Code it ran is not
 # reproducible. This is the version measured in the container on 2026-09-19. Claude Code
 # is scaffolding here (Rule 17) — the product face starts at `herdr integration install`.

package/scripts/smoke-pi-durable-fresh-live.ts

@@ -214,11 +214,11 @@ for (const bin of ["pi", "entwurf", "tmux"]) {
 }
 const layout = piDurablePackageLayout();
 ok("this package closure carries the pi-durable units", layout !== null);
-const runtime = checkPiDurableRuntime(process.env, layout);
+const runtime = checkPiDurableRuntime(layout);
 ok(
-	"the operator-provided durable runtime is present and is the pin (the 0.31.0 supply contract)",
+	"this package's pi-durable carrier and its declared SDK set verify (the 0.32.0 supply contract)",
 	runtime.ok,
-	runtime.ok ? "" : `${runtime.reason}`,
+	runtime.ok ? "" : `${runtime.reason}: ${runtime.detail}`,
 );
 receipts["0-runtime"] = runtime.ok ? JSON.stringify(runtime) : "";
 

package/scripts/smoke-setup-verdict.sh

@@ -140,8 +140,8 @@ want "S-1: claude absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\"
 want "S-1: agy absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'agy: SKIP'"
 want "S-1: copilot absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP'"
 want "S-1: omp absent is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'omp: SKIP'"
-want "S-1: an absent operator durable runtime is an explicit zero-state SKIP" "printf '%s' \"\$OUT\" | grep -q 'pi-durable: SKIP'"
-want "S-1: setup wrote no durable runtime (Entwurf never installs it)" "[ ! -e '$XDG_DATA_HOME/entwurf/pi-durable' ]"
+want "S-1: the pi-durable row is the package's own carrier verdict (PASS: carrier + pinned SDK set verify; never a SKIP)" "printf '%s' \"\$OUT\" | grep -q 'pi-durable: PASS'"
+want "S-1: setup writes nothing for pi-durable (the carrier ships in the package)" "[ ! -e '$XDG_DATA_HOME/entwurf/pi-durable' ]"
 want "S-1: core bridge boundary validated (PASS)" "printf '%s' \"\$OUT\" | grep -q 'core: PASS'"
 want "S-1: final verdict is computed, not unconditional" \
   "printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
@@ -151,20 +151,20 @@ want "S-1: zero Pi wiring written for an absent pi" "[ ! -e '$PROJ1/.pi' ]"
 want "S-1: no user-scope pi settings were created" "[ ! -e '$PI_CODING_AGENT_DIR/settings.json' ]"
 want "S-1: no agy config was created" "[ ! -e '$HOME/.gemini' ]"
 
-# ── S-PD: a durable runtime PRESENT at the fixed place but not the pin → named FAIL, non-green ──
-# #129 W (L5). Presence is the locator directory under this sandbox's XDG_DATA_HOME; an empty
-# directory is not a git checkout, so the shared verifier answers pi-durable-runtime-unverifiable.
-# A drifted runtime must never read as SKIP (not installed) or PASS: it is detected and broken.
-echo "[smoke-setup-verdict] S-PD present-but-not-the-pin durable runtime"
+# ── S-PD: the retired source-runtime location decides nothing (#130 hard cut, no legacy reader) ──
+# 0.31.0 read an operator runtime at $XDG_DATA_HOME/entwurf/pi-durable/runtime. Since #130 the
+# carrier ships in the package and that location is not a fallback: debris left there (here, an
+# empty non-checkout directory, which 0.31.0 refused as unverifiable) must neither turn the row
+# into a FAIL nor be touched. The row stays the package's own carrier verdict.
+echo "[smoke-setup-verdict] S-PD debris at the retired durable runtime location"
 PROJPD="$SB/projpd"; mkdir -p "$PROJPD"
 PD_RUNTIME="$XDG_DATA_HOME/entwurf/pi-durable/runtime"; mkdir -p "$PD_RUNTIME"
 seed_auth
 set +e; OUT="$(bash "$REPO_DIR/run.sh" setup "$PROJPD" 2>&1)"; RC=$?; set -e
-want "S-PD: a present non-pin runtime is a component FAIL that owns a nonzero exit" \
-  "[ '$RC' -ne 0 ] && printf '%s' \"\$OUT\" | grep -q 'pi-durable: FAIL'"
-want "S-PD: the FAIL names the verifier's reason" "printf '%s' \"\$OUT\" | grep -q 'pi-durable-runtime-unverifiable'"
-want "S-PD: the computed summary names the durable component" "printf '%s' \"\$OUT\" | grep -q 'NON-GREEN (FAIL: pi-durable)'"
-want "S-PD: setup changed nothing in the operator's runtime directory" "[ -z \"\$(ls -A '$PD_RUNTIME')\" ]"
+want "S-PD: the retired location does not decide the row — the carrier verdict is still PASS, setup green" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'pi-durable: PASS'"
+want "S-PD: no 0.31.0 runtime refusal is named" "! printf '%s' \"\$OUT\" | grep -q 'pi-durable-runtime-'"
+want "S-PD: setup changed nothing at the retired location" "[ -z \"\$(ls -A '$PD_RUNTIME')\" ]"
 want_auth_untouched "S-PD"
 rm -rf "$XDG_DATA_HOME/entwurf/pi-durable"
 want "S-1: no Copilot config/units were created" "[ ! -e '$HOME/.copilot' ]"
@@ -212,7 +212,7 @@ want_auth_untouched "S-2b"
 # ── S-3: pi at the pinned floor → presence completes project + user wiring ──
 echo "[smoke-setup-verdict] S-3 pi present at floor"
 PROJ3="$SB/proj3"; mkdir -p "$PROJ3"
-PI_PIN="$(node -e 'console.log(require(process.argv[1]).devDependencies["@earendil-works/pi-coding-agent"])' "$REPO_DIR/package.json")"
+PI_PIN="$(node -e 'console.log(require(process.argv[1]).dependencies["@earendil-works/pi-coding-agent"])' "$REPO_DIR/package.json")"
 printf '#!/usr/bin/env bash\necho %s\n' "$PI_PIN" > "$SB/harness/pi-ok"; chmod +x "$SB/harness/pi-ok"
 seed_auth
 set +e; OUT="$(PI_BIN="$SB/harness/pi-ok" bash "$REPO_DIR/run.sh" setup "$PROJ3" 2>&1)"; RC=$?; set -e
@@ -529,8 +529,8 @@ PROJ9C="$SB/proj9c"; mkdir -p "$PROJ9C"
 seed_auth
 set +e; OUT="$(PATH="$FAKE_UNAME:$PATH" bash "$REPO_DIR/run.sh" setup "$PROJ9C" 2>&1)"; RC=$?; set -e
 want "S-9c: a harness-free uncertified host still exits 0" "[ '$RC' -eq 0 ]"
-want "S-9c: all seven harness probes are still zero-state SKIPs" \
-  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP' && printf '%s' \"\$OUT\" | grep -q 'pi-durable: SKIP'"
+want "S-9c: all six harness probes are still zero-state SKIPs, and the packaged pi-durable carrier still verifies" \
+  "printf '%s' \"\$OUT\" | grep -q 'pi: SKIP' && printf '%s' \"\$OUT\" | grep -q 'claude: SKIP' && printf '%s' \"\$OUT\" | grep -q 'agy: SKIP' && printf '%s' \"\$OUT\" | grep -q 'copilot: SKIP' && printf '%s' \"\$OUT\" | grep -q 'omp: SKIP' && printf '%s' \"\$OUT\" | grep -q 'codex: SKIP' && printf '%s' \"\$OUT\" | grep -q 'pi-durable: PASS'"
 want "S-9c: core still PASSes and the computed summary is still green" \
   "printf '%s' \"\$OUT\" | grep -q 'core: PASS' && printf '%s' \"\$OUT\" | grep -q 'result: green (computed from the component outcomes above)'"
 want "S-9c: an absent harness is never given a rail verdict it did not earn" \

package/scripts/smoke-user-scope-citizen.sh

@@ -18,7 +18,7 @@
 #
 # Cell 15 closes the third (#110), and it is the one cell here that SPAWNS pi: the
 # defect is not a byte, it is which of two checkouts wins `--entwurf-control`, and
-# only the real loader can say. It uses the pinned devDep pi, never PATH.
+# only the real loader can say. It uses the pinned dependency pi, never PATH.
 set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1 # snapshot purity: no ignored scripts/__pycache__ writes under qualification