@junghanacs/entwurf 0.32.0 → 0.33.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +46 -0
- package/README.md +54 -119
- package/VERIFY.md +8 -8
- package/demo/README.md +1 -1
- package/docs/acp-backend-rail.md +1 -1
- package/docs/setup-clean-host.md +12 -12
- package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js +1 -1
- package/package.json +10 -10
- package/pi/pi-durable/overlay/upstream-pin.json +12 -12
- package/pi-extensions/meta-bridge-pi-durable.ts +4 -2
- package/run.sh +44 -46
- package/scripts/check-release-gate-outcomes.ts +21 -17
- package/scripts/mutants/control-send-receipt.json +1 -1
- package/scripts/mutants/pack-install.json +3 -3
- package/scripts/mutants/pi-floor.json +6 -6
- package/scripts/mutants/release-gate.json +5 -3
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,52 @@ All notable changes to this project will be documented here. Format follows [Kee
|
|
|
4
4
|
|
|
5
5
|
## Unreleased
|
|
6
6
|
|
|
7
|
+
## 0.33.0 - 2026-10-08
|
|
8
|
+
|
|
9
|
+
### Release coordination
|
|
10
|
+
|
|
11
|
+
- **First cut coordinated by a pi-durable citizen (#132).** This cut is coordinated by the
|
|
12
|
+
pi-durable citizen `20261008T113104-801621`, implemented by Claude Code Opus, and independently
|
|
13
|
+
scrutinized by Grok. Per GLG's direct report (carried here as that report, not as a source
|
|
14
|
+
receipt), an earlier durable-coordination attempt during the 0.31.0 process broke down; 0.31.0
|
|
15
|
+
itself shipped with the accepted receipts recorded in its own section below, and neither that
|
|
16
|
+
report nor 0.32.0's snapshot-loss incident is restated here as a package-publication failure.
|
|
17
|
+
This section is written at prepare time: the prepared-SHA CI, the preserved artifact and the tag
|
|
18
|
+
that close the cut are recorded in the GitHub release and the #132 thread, not claimed here.
|
|
19
|
+
- **Verified for this cut.** The Pi SDK 1.1.0 implementation landed at `aceba59` with exact-SHA CI
|
|
20
|
+
run 37739273349 green on all four required jobs and its qualification body (898/898 killed),
|
|
21
|
+
after a local body of 898/898 and a frozen `check:full` on that candidate. The prepared tree
|
|
22
|
+
(scheduling policy, ASCII fix, version metadata) passed a frozen `check:full`. The policy's
|
|
23
|
+
affected 22-mutant partial run killed 22/22, and its later format/doc amendments re-ran their
|
|
24
|
+
focused gates. After the operator-owned Codex app-server was restarted, the Codex and
|
|
25
|
+
Antigravity native doctors were green.
|
|
26
|
+
- **Not run for this cut — GLG's direct cost/deadline decision, one cut only** ("아니야 30분 내로
|
|
27
|
+
npm publish 전까지 끝내줘. 이 부랜치 핵심은 검증했지? 그럼 됬어. … 시간 아끼자.";
|
|
28
|
+
[authority record](https://github.com/junghan0611/entwurf/issues/132#issuecomment-6057425161)). The LIVE
|
|
29
|
+
`release-gate --cut` was started and then aborted inside its `check:full`, before any LIVE step;
|
|
30
|
+
that is not a verdict, so the live MUST floor is unproven here. Also not run: the pre-commit
|
|
31
|
+
native acceptance (provider-instruction wire observation, warm/cold retention, the Codex
|
|
32
|
+
caller-seat cell), the second `check:full` before the push, and waiting for the prepared SHA's CI
|
|
33
|
+
qualification body before the candidate was packed. That CI run continues and its outcome is
|
|
34
|
+
recorded with the release; a red result is new scope. Antigravity criterion 7 stays NOT
|
|
35
|
+
CERTIFIED. VERIFY's release floor is unchanged — this is not a standing waiver.
|
|
36
|
+
|
|
37
|
+
### Changed
|
|
38
|
+
|
|
39
|
+
- **Pi SDK 1.1.0 (#132).** The nine exact production SDK members move to `1.1.0` and the
|
|
40
|
+
pi-durable carrier pin to upstream `v1.1.0` (`abe508e`); the emitter's `--check` reproduces the
|
|
41
|
+
existing carrier bytes at that commit, so only the pin's tag/commit/SDK set change. The supported
|
|
42
|
+
ordinary Pi host range follows the pin to `>=1.1.0 <1.2`. The installed-consumer previous-host
|
|
43
|
+
control moves from a real pi 1.0.2 to 1.0.4 — the immediately prior generation is now the refused
|
|
44
|
+
host — while the L3/L4 mixed and depth-3 controls keep their real 1.0.3 packages.
|
|
45
|
+
- **A cut runs its qualification body once, at the prepared SHA (#132, #133).** `release-gate` no
|
|
46
|
+
longer runs a local `check-gate-qualification` body; the release's one body is the exact-SHA CI
|
|
47
|
+
step at the prepared SHA, which the release oracle already required. The scheduling assertion now
|
|
48
|
+
keeps `release-gate` at zero invocations and its mutant plants the call back. The development rule
|
|
49
|
+
of one local run when a gate or mutant changes is unchanged; retiring it stays with #133. For this
|
|
50
|
+
cut alone GLG granted two exceptions: the policy commit rides the prepared push without its own
|
|
51
|
+
pre-version CI, and its local whole body was replaced by its affected 22-mutant partial run.
|
|
52
|
+
|
|
7
53
|
## 0.32.0 - 2026-10-08
|
|
8
54
|
|
|
9
55
|
### Added
|
package/README.md
CHANGED
|
@@ -27,29 +27,23 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
|
|
|
27
27
|
retain their own tools and work context. Capabilities differ by rail: a shipped
|
|
28
28
|
citizen is not a promise of every lifecycle operation.
|
|
29
29
|
|
|
30
|
-
**
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
0.31.0 source-runtime route. Under the #130/0.32 contract the app ships inside the
|
|
36
|
-
Entwurf package as a pinned [carrier](#native-durable-pi-durable--130--032-contract), so
|
|
37
|
-
it no longer depends on installing the ordinary Pi CLI or provisioning a runtime.
|
|
38
|
-
|
|
39
|
-
> **Prepared 0.32.0 candidate, not a published release.** The current source contains #130's
|
|
40
|
-
> carrier and explicit native-module contract. Prepared-SHA CI and one preserved versioned
|
|
41
|
-
> artifact have their own acceptance receipts; preparation alone does not assert npm publication.
|
|
42
|
-
> The published 0.31.0 follows its source-runtime docs — it does not supply this carrier.
|
|
30
|
+
> **Current release: [0.32.0](https://github.com/junghan0611/entwurf/releases/tag/v0.32.0)**
|
|
31
|
+
> ([`80d66f4`](https://github.com/junghan0611/entwurf/commit/80d66f4ca66f0be674b2d2bfbe20c49717c0340e)).
|
|
32
|
+
> Includes the pinned Pi 1.0.4 native durable app/TUI and one explicit native-module ingress.
|
|
33
|
+
> npm publication and registry byte equality are [verified](https://github.com/junghan0611/entwurf/issues/130#issuecomment-6049936030).
|
|
34
|
+
> Release history and detailed evidence belong in [CHANGELOG](./CHANGELOG.md).
|
|
43
35
|
|
|
44
36
|
## Install
|
|
45
37
|
|
|
46
|
-
**Choose by where you work.
|
|
38
|
+
**Choose by where you work. Bring your own harnesses, subscriptions and login.**
|
|
39
|
+
The native durable route below additionally supplies the upstream app/TUI missing from its npm
|
|
40
|
+
release; it does not supply credentials or take ownership of the harness.
|
|
47
41
|
|
|
48
42
|
### Direct — ordinary shell or tmux
|
|
49
43
|
|
|
50
44
|
Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
|
|
51
45
|
to use, already installed and authenticated. Pi is optional-by-presence, supported
|
|
52
|
-
range `>=1.0
|
|
46
|
+
range `>=1.1.0 <1.2`; Claude Code supported floor `>=2.1.217` is required for its
|
|
53
47
|
managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
|
|
54
48
|
|
|
55
49
|
```bash
|
|
@@ -77,37 +71,28 @@ Detected harness wiring on Darwin can therefore be written while setup stays
|
|
|
77
71
|
non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
|
|
78
72
|
restriction; that is not certification of every platform's harness rails.
|
|
79
73
|
|
|
80
|
-
### Native durable (pi-durable)
|
|
74
|
+
### Native durable (pi-durable)
|
|
81
75
|
|
|
82
|
-
**
|
|
83
|
-
build or
|
|
76
|
+
**The package supplies the pinned upstream app/TUI and nine exact Pi 1.1.0 SDK
|
|
77
|
+
members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
|
|
78
|
+
The launch verifies carrier integrity and every reachable SDK edge's name/version;
|
|
79
|
+
incomplete, drifted or mixed supply refuses by name.
|
|
84
80
|
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
§2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)). Ordinary Pi may warn
|
|
101
|
-
that Entwurf's `@earendil-works/*` belong in `peerDependencies`; the exact set is a production
|
|
102
|
-
dependency on purpose, for the native process — a known manifest constraint accepted for 0.32.
|
|
103
|
-
|
|
104
|
-
The installed carrier's runtime/TUI load, its physical SDK edges and the public launch up to the
|
|
105
|
-
app's own model resolution are package-gate evidence; the checkout contact/send/receive gates run the
|
|
106
|
-
same carrier with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate
|
|
107
|
-
release proof. 0.31.0 shipped the earlier source-runtime
|
|
108
|
-
route (Pi 1.0.2/source `cd32f77`), which this contract replaces.
|
|
109
|
-
See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
|
|
110
|
-
and [#130](https://github.com/junghan0611/entwurf/issues/130).
|
|
81
|
+
```bash
|
|
82
|
+
entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
|
|
83
|
+
entwurf pi-durable --continue
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
The contact adds garden identity and two-way mailbox communication. Runtime/TUI,
|
|
87
|
+
models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
|
|
88
|
+
[Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
|
|
89
|
+
|
|
90
|
+
Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
|
|
91
|
+
imports, then installs its default native Extension after the contact. No automatic
|
|
92
|
+
module discovery or classic Pi API shim; guards are not a sandbox or rollback.
|
|
93
|
+
Ordinary Pi's known `peerDependencies` warning reflects the separate native SDK supply.
|
|
94
|
+
[Native setup](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
|
|
95
|
+
owns flags, refusals and the extension contract.
|
|
111
96
|
|
|
112
97
|
### Herdr workbench
|
|
113
98
|
|
|
@@ -115,13 +100,11 @@ and [#130](https://github.com/junghan0611/entwurf/issues/130).
|
|
|
115
100
|
herdr plugin install junghan0611/entwurf/plugins/herdr --yes
|
|
116
101
|
```
|
|
117
102
|
|
|
118
|
-
This
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
[Herdr
|
|
122
|
-
|
|
123
|
-
The plugin does not own delivery or the Herdr launch rail; a direct-installed
|
|
124
|
-
citizen inside Herdr selects that rail from its own process context too.
|
|
103
|
+
This separate path activates Herdr-integrated **pi and Claude Code** with an
|
|
104
|
+
independently locked runtime and an observation pane; it puts no Entwurf bins on PATH.
|
|
105
|
+
An Entwurf release does not automatically re-pin that runtime.
|
|
106
|
+
[Herdr guide](./plugins/herdr/README.md) owns install, use, evidence and removal;
|
|
107
|
+
the plugin does not own delivery or the Herdr launch rail.
|
|
125
108
|
|
|
126
109
|
### Garden launcher
|
|
127
110
|
|
|
@@ -207,74 +190,26 @@ a live or non-pi target refuses, and an unobserved window stays visible without
|
|
|
207
190
|
Exact boundaries: [tmux launch](https://github.com/junghan0611/entwurf/blob/main/docs/mux-launch-rail.md)
|
|
208
191
|
and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-launch-rail.md).
|
|
209
192
|
|
|
210
|
-
##
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
(
|
|
229
|
-
|
|
230
|
-
compiled bridge after record birth, under the citizen's identity, and Pi supervises
|
|
231
|
-
that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
|
|
232
|
-
control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
|
|
233
|
-
did not adopt or certify `pi-durable` or codemode. Native durable support is now
|
|
234
|
-
released as a separate 0.31.0 native contact, as described above; codemode remains a
|
|
235
|
-
harness-internal capability, not another garden citizen. The 0.30.0 follow-up
|
|
236
|
-
separately measured Herdr supply 0.9.3 and
|
|
237
|
-
re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its
|
|
238
|
-
public consumer and CI receipts live in the #126 thread. That dated alignment is
|
|
239
|
-
not a permanent version-equality rule. 0.30.1 is published (npm, 2026-10-04); at its tag the
|
|
240
|
-
plugin's runtime lock is still the closed `herdr-checkout` verification carrier. Publication did
|
|
241
|
-
not re-pin it: the measured npm re-pin and its source-specific proof are separate, still-open
|
|
242
|
-
work that the [plugin source contract](./plugins/herdr/README.md) owns.
|
|
243
|
-
|
|
244
|
-
Entwurf is the 0.12+ successor to
|
|
245
|
-
[`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp):
|
|
246
|
-
the work was renamed around the dispatch substrate rather than the pi adapter.
|
|
247
|
-
The pre-0.12 [two-pane demo](./demo/README.md) is **archived evidence**, including
|
|
248
|
-
retired resume behaviour, not current instructions. [CHANGELOG](./CHANGELOG.md)
|
|
249
|
-
keeps the release history; dated Codex topology and qualification receipts remain
|
|
250
|
-
in [DELIVERY](./DELIVERY.md) and [BASELINE](./BASELINE.md), not rewritten as today's acceptance.
|
|
251
|
-
|
|
252
|
-
## Detailed operation
|
|
253
|
-
|
|
254
|
-
### Settings
|
|
255
|
-
|
|
256
|
-
[Setup — settings and backend-specific keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
|
|
257
|
-
owns configuration, including billing-safe carrier choices and pi-versus-backend keys.
|
|
258
|
-
|
|
259
|
-
### External MCP registration
|
|
260
|
-
|
|
261
|
-
[Setup — external hosts](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts)
|
|
262
|
-
and [manual wiring](./docs/external-mcp-host.md) own paths, env and identity prerequisites.
|
|
263
|
-
|
|
264
|
-
### Custom skills
|
|
265
|
-
|
|
266
|
-
[Setup — custom skills](./docs/setup-clean-host.md#custom-skills) owns the Claude ACP
|
|
267
|
-
plugin layout and validation; other harnesses keep their native skill mechanisms.
|
|
268
|
-
|
|
269
|
-
### Context carriers
|
|
270
|
-
|
|
271
|
-
[Setup — carriers](./docs/setup-clean-host.md#context-carriers) separates short
|
|
272
|
-
engraving from the rich first-user augment and the actual callable schema.
|
|
273
|
-
|
|
274
|
-
### Compaction policy
|
|
275
|
-
|
|
276
|
-
[Setup — reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction):
|
|
277
|
-
Entwurf does not implement backend compaction or hydrate another harness's transcript.
|
|
193
|
+
## Concepts
|
|
194
|
+
|
|
195
|
+
**Entwurf** (기투, projection-of-self) connects independent visible siblings;
|
|
196
|
+
**garden id** names a record-backed citizen, not its pane or native transcript.
|
|
197
|
+
[FAQ](./FAQ.md) explains ACP, MCP and context carriers.
|
|
198
|
+
|
|
199
|
+
## Pi integration
|
|
200
|
+
|
|
201
|
+
The pi adapter registers the compiled bridge with Pi's built-in MCP after record
|
|
202
|
+
birth; Pi supervises the MCP child. **MCP is ingress; pi receive remains the
|
|
203
|
+
record-addressed Unix control socket.** Garden identity and dispatch stay Entwurf's.
|
|
204
|
+
Codemode is harness-internal, not another garden citizen.
|
|
205
|
+
|
|
206
|
+
## Operation guides
|
|
207
|
+
|
|
208
|
+
- [Settings and backend keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
|
|
209
|
+
- [External MCP registration](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts) · [manual wiring](./docs/external-mcp-host.md)
|
|
210
|
+
- [Custom skills](./docs/setup-clean-host.md#custom-skills)
|
|
211
|
+
- [Context carriers](./docs/setup-clean-host.md#context-carriers)
|
|
212
|
+
- [Reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction) — native harness-owned; no transcript hydration
|
|
278
213
|
|
|
279
214
|
## What this repo owns, and does not
|
|
280
215
|
|
package/VERIFY.md
CHANGED
|
@@ -86,12 +86,12 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
|
|
|
86
86
|
### The canonical floor — two entry points
|
|
87
87
|
|
|
88
88
|
- **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. One core member assumes a build output: the beside test `pi-extensions/entwurf-control.test.ts` (reached through `check-tests-beside-behavior`) registers the COMPILED bridge and refuses by name when it is absent. `prepare` normally builds it at install; after an `--ignore-scripts` install or a bridge source change, run `pnpm run build-bridge` (in the sandbox candidate when verifying one) before the core. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
|
|
89
|
-
- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and
|
|
89
|
+
- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step (#132: `release-gate` no longer runs a second, local BODY; this moves only the release-mode owner — the development rule of one local run when a gate/mutant/matrix changes stays in force until #133 retires it, and the 0.33.0 cut skips it only by a one-cut exception) — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
|
|
90
90
|
- **The snapshot is source-only (#125).** It replicates the git work surface and never copies an ignored artifact from the checkout. A gate that consumes an ignored build output — the compiled `entwurf-bridge` a pi citizen registers — declares it on each of its mutants (`"build": {"argv": [...], "output": "<dir>"}`, one declaration per gate group). For that group only, the runner builds the output from the snapshot's own bytes before the control, rebuilds it after every mutation and from the restored bytes before the post-control (which must reproduce the baseline digest), never counts a build red as a kill, voids a run whose gate writes into the output, and removes the output when the group ends. The runner self-test owns this as `[QK:QUALIFY-BUILD-*]`.
|
|
91
91
|
- **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
|
|
92
|
-
- **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `
|
|
92
|
+
- **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
|
|
93
93
|
- **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
|
|
94
|
-
- **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The
|
|
94
|
+
- **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The non-skippable static step (`pnpm run check:full`) is inline: 0 = PASS, nonzero = FAIL, no SKIP arm — it has no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
|
|
95
95
|
- **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
|
|
96
96
|
|
|
97
97
|
> **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
|
|
@@ -227,8 +227,8 @@ same-sandbox neighbour as the rejected control), every reachable physical SDK ed
|
|
|
227
227
|
version and declared name, a mixed-version tree refused by name although it still imports, a
|
|
228
228
|
constructed depth-3 mismatch refused by the verifier and seen by the oracle, the public launch reaching the
|
|
229
229
|
app's own model refusal before any birth — also with one installed `--native-module` initialized
|
|
230
|
-
first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.
|
|
231
|
-
binary beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
|
|
230
|
+
first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.4
|
|
231
|
+
binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
|
|
232
232
|
PASSes — not native admission. The maintainer's rebuild
|
|
233
233
|
equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
|
|
234
234
|
a named SKIP, not acceptance. First-release visible fresh/callback and native
|
|
@@ -237,7 +237,7 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
|
|
|
237
237
|
|
|
238
238
|
| Axis | Required proof | Limit |
|
|
239
239
|
|---|---|---|
|
|
240
|
-
| Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
|
|
240
|
+
| Source | `pnpm run check:full` + the prepared SHA's CI `./run.sh check-gate-qualification` step | Does not prove an installed consumer. |
|
|
241
241
|
| Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
|
|
242
242
|
| Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
|
|
243
243
|
| Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
|
|
@@ -325,7 +325,7 @@ The goal is not merely "invoke Claude Code." We want:
|
|
|
325
325
|
**One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
|
|
326
326
|
|
|
327
327
|
1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
|
|
328
|
-
2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0
|
|
328
|
+
2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.1.0 <1.2`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
|
|
329
329
|
3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
|
|
330
330
|
4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
|
|
331
331
|
5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
|
|
@@ -482,7 +482,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
|
|
|
482
482
|
|
|
483
483
|
The minimum passing bar:
|
|
484
484
|
|
|
485
|
-
1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus
|
|
485
|
+
1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus the `./run.sh check-gate-qualification` step green in the exact-SHA CI run of the same prepared candidate (criterion 2's run).
|
|
486
486
|
2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
|
|
487
487
|
3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
|
|
488
488
|
4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
|
package/demo/README.md
CHANGED
|
@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
|
|
|
142
142
|
|
|
143
143
|
## Prerequisites
|
|
144
144
|
|
|
145
|
-
- `pi` on PATH (current floor 1.0
|
|
145
|
+
- `pi` on PATH (current floor 1.1.0)
|
|
146
146
|
- `entwurf` provider configured + auth ready for the selected sender/peer models
|
|
147
147
|
- `asciinema` installed
|
|
148
148
|
- `agg` installed (optional — only for GIF conversion)
|
package/docs/acp-backend-rail.md
CHANGED
|
@@ -134,7 +134,7 @@ ledger, 2026-10-03).
|
|
|
134
134
|
| Surface | Declaration | Class | What a green actually says |
|
|
135
135
|
|---|---|---|---|
|
|
136
136
|
| Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
|
|
137
|
-
| pi runtime | SDK exact `1.0
|
|
137
|
+
| pi runtime | SDK exact `1.1.0`, host `>=1.1.0 <1.2` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #132's 1.1.0 move (ROADMAP's 2026-10-08 bump entry) has its own acceptance still owed. Historical: the published 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
|
|
138
138
|
| ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
|
|
139
139
|
| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
|
|
140
140
|
| Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
|
package/docs/setup-clean-host.md
CHANGED
|
@@ -28,8 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
|
|
|
28
28
|
| npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
|
|
29
29
|
| Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
|
|
30
30
|
| entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
|
|
31
|
-
| pi | optional-by-presence, `>=1.0
|
|
32
|
-
| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): a pinned upstream v1.0
|
|
31
|
+
| pi | optional-by-presence, `>=1.1.0 <1.2` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
|
|
32
|
+
| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): a pinned upstream v1.1.0 app carrier plus the exact 1.1.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
|
|
33
33
|
| Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
|
|
34
34
|
| GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
|
|
35
35
|
| OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
|
|
@@ -191,7 +191,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
|
|
|
191
191
|
Install the exact release floor, then wire the project:
|
|
192
192
|
|
|
193
193
|
```bash
|
|
194
|
-
npm install -g @earendil-works/pi-coding-agent@1.0
|
|
194
|
+
npm install -g @earendil-works/pi-coding-agent@1.1.0
|
|
195
195
|
pi --version
|
|
196
196
|
|
|
197
197
|
cd ~/entwurf-smoke
|
|
@@ -199,7 +199,7 @@ entwurf install .
|
|
|
199
199
|
pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
|
|
200
200
|
```
|
|
201
201
|
|
|
202
|
-
The supported range is `>=1.0
|
|
202
|
+
The supported range is `>=1.1.0 <1.2`. It is a hard minimum: installing this
|
|
203
203
|
release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
|
|
204
204
|
minor. A host using only the external MCP bridge can skip pi until it needs a
|
|
205
205
|
control socket; no delivery rail launches a pi process.
|
|
@@ -295,22 +295,22 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
|
|
|
295
295
|
What the Entwurf package supplies:
|
|
296
296
|
|
|
297
297
|
1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
|
|
298
|
-
pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.0
|
|
298
|
+
pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.1.0`, plus
|
|
299
299
|
`proper-lockfile`, as Entwurf's own production dependencies (declared once in
|
|
300
300
|
`pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
|
|
301
301
|
`pi-ai`; there is no catalog copy.
|
|
302
302
|
2. **The native app/TUI carrier** — upstream does not publish the experimental durable
|
|
303
303
|
app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
|
|
304
|
-
library). Entwurf ships the six pinned app files from upstream tag `v1.0
|
|
305
|
-
(`
|
|
304
|
+
library). Entwurf ships the six pinned app files from upstream tag `v1.1.0`
|
|
305
|
+
(`abe508e1b89912adde45528136c3221eb69acdd7`), its narrow runtime-contact overlay
|
|
306
306
|
applied to `runtime.ts`, type-stripped and relocated, in `pi/pi-durable/carrier/`
|
|
307
307
|
with upstream's MIT license. Each file's source blob and emitted digest are in the pin.
|
|
308
308
|
The carrier reaches pi-coding-agent's internals only through its resolver
|
|
309
309
|
(`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
|
|
310
310
|
own `dist/` as installed — never through a source checkout.
|
|
311
311
|
|
|
312
|
-
The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.0
|
|
313
|
-
and [experimental app guide](https://github.com/earendil-works/pi/blob/v1.0
|
|
312
|
+
The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/durable/README.md)
|
|
313
|
+
and [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
|
|
314
314
|
describe what the carrier is. Running the bare upstream app does not attach Entwurf's
|
|
315
315
|
garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
|
|
316
316
|
proxy a subscription; native execution, models, auth, queues, SQLite and recovery stay
|
|
@@ -327,7 +327,7 @@ and from every package copy it reaches, at any depth, to its own `@earendil-work
|
|
|
327
327
|
lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members declare one another with caret
|
|
328
328
|
ranges, so semver satisfaction is not the contract; the bytes an import binds are. Sharing
|
|
329
329
|
one copy with an aligned host install of the same version is an ordinary layout. A mixed
|
|
330
|
-
tree (for example an override that binds pi-durable's `pi-ai`
|
|
330
|
+
tree (for example an override that binds pi-durable's `pi-ai` to an older published version) still
|
|
331
331
|
*imports* — which is why the edge check exists — and is refused by name.
|
|
332
332
|
|
|
333
333
|
- `entwurf setup` reports a `pi-durable` row from that check and writes no durable wiring:
|
|
@@ -372,7 +372,7 @@ tree (for example an override that binds pi-durable's `pi-ai` one patch behind)
|
|
|
372
372
|
manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
|
|
373
373
|
not a claim that every load path is harmless.
|
|
374
374
|
|
|
375
|
-
The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.0
|
|
375
|
+
The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.1.0 <1.2`): a host Pi is
|
|
376
376
|
not needed to run pi-durable, and a host inside the range need not be the same copy as the
|
|
377
377
|
carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
|
|
378
378
|
in place rather than copying credentials or migrating ordinary Pi transcripts. Native
|
|
@@ -562,7 +562,7 @@ as a note rather than a fault.
|
|
|
562
562
|
|
|
563
563
|
**entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
|
|
564
564
|
presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
|
|
565
|
-
gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0
|
|
565
|
+
gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.1.0 <1.2`) and Claude Code
|
|
566
566
|
(`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
|
|
567
567
|
decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
|
|
568
568
|
earned one because an older binary validates the exec manifest, drops `args` at runtime, and
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
* The bootstrap that composes the two lives with the overlay (`pi/pi-durable/bootstrap.mjs`), not
|
|
17
17
|
* here: this module never imports or initializes the durable app runtime and carries no path into
|
|
18
18
|
* a vendor checkout. That is this module's import boundary, not the package's dependency list: the
|
|
19
|
-
* package does declare the exact `@earendil-works/pi-durable` (
|
|
19
|
+
* package does declare the exact `@earendil-works/pi-durable` (per the pin's SDK set) for its carrier (#130).
|
|
20
20
|
*
|
|
21
21
|
* WHY BIRTH IS AFTER OPEN, BEHIND A GATE. `[read @cd32f77]` The native session id is chosen
|
|
22
22
|
* inside `openDurable` (`runtime.ts:125`, `sessions.ts:18-55`), and `openDurable` calls
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@junghanacs/entwurf",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.33.0",
|
|
4
4
|
"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": {
|
|
@@ -93,15 +93,15 @@
|
|
|
93
93
|
"@agentclientprotocol/claude-agent-acp": "0.85.1",
|
|
94
94
|
"@agentclientprotocol/sdk": "1.6.0",
|
|
95
95
|
"@anthropic-ai/sdk": "0.100.1",
|
|
96
|
-
"@earendil-works/chord": "1.0
|
|
97
|
-
"@earendil-works/pi-agent-core": "1.0
|
|
98
|
-
"@earendil-works/pi-ai": "1.0
|
|
99
|
-
"@earendil-works/pi-codemode": "1.0
|
|
100
|
-
"@earendil-works/pi-coding-agent": "1.0
|
|
101
|
-
"@earendil-works/pi-durable": "1.0
|
|
102
|
-
"@earendil-works/pi-mcp": "1.0
|
|
103
|
-
"@earendil-works/pi-telemetry": "1.0
|
|
104
|
-
"@earendil-works/pi-tui": "1.0
|
|
96
|
+
"@earendil-works/chord": "1.1.0",
|
|
97
|
+
"@earendil-works/pi-agent-core": "1.1.0",
|
|
98
|
+
"@earendil-works/pi-ai": "1.1.0",
|
|
99
|
+
"@earendil-works/pi-codemode": "1.1.0",
|
|
100
|
+
"@earendil-works/pi-coding-agent": "1.1.0",
|
|
101
|
+
"@earendil-works/pi-durable": "1.1.0",
|
|
102
|
+
"@earendil-works/pi-mcp": "1.1.0",
|
|
103
|
+
"@earendil-works/pi-telemetry": "1.1.0",
|
|
104
|
+
"@earendil-works/pi-tui": "1.1.0",
|
|
105
105
|
"@modelcontextprotocol/sdk": "^1.12.1",
|
|
106
106
|
"proper-lockfile": "4.1.2",
|
|
107
107
|
"smol-toml": "^1.8.0",
|
|
@@ -2,8 +2,8 @@
|
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"comment": "The one upstream commit the pi-durable carrier is emitted from, the patch it applies, the emitted files and the published SDK set they run against. The experimental durable app is source-only upstream (published pi-coding-agent ships no dist/experimental), so Entwurf ships it as a CARRIER: the pinned app files, type-stripped, with the relocation in pi/pi-durable/carrier-relocation.mjs. scripts/emit-pi-durable-carrier.ts is the only writer of the generated fields (blob, sha256, emitter.node) and the only reader of upstream source; an installed package never reads source. Model data rides the published @earendil-works/pi-ai.",
|
|
4
4
|
"repository": "https://github.com/earendil-works/pi",
|
|
5
|
-
"tag": "v1.0
|
|
6
|
-
"commit": "
|
|
5
|
+
"tag": "v1.1.0",
|
|
6
|
+
"commit": "abe508e1b89912adde45528136c3221eb69acdd7",
|
|
7
7
|
"patches": ["runtime-contacts.patch"],
|
|
8
8
|
"carrier": {
|
|
9
9
|
"comment": "files: the six app files bootstrap.mjs needs (main.ts is replaced by the bootstrap). distTargets: every pi-coding-agent internal the stripped files import, as paths under the published dist/; the emitter refuses a set that differs and the resolver answers no other.",
|
|
@@ -89,17 +89,17 @@
|
|
|
89
89
|
]
|
|
90
90
|
},
|
|
91
91
|
"sdk": {
|
|
92
|
-
"comment": "The published library set the carrier runs against, derived from the 1.0
|
|
92
|
+
"comment": "The published library set the carrier runs against, derived from the 1.1.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.1.0 pins). Each is an exact production dependency in package.json; the members' own edges are caret ranges, so the installed physical edges, not semver, are what must equal these versions.",
|
|
93
93
|
"members": {
|
|
94
|
-
"@earendil-works/chord": "1.0
|
|
95
|
-
"@earendil-works/pi-agent-core": "1.0
|
|
96
|
-
"@earendil-works/pi-ai": "1.0
|
|
97
|
-
"@earendil-works/pi-codemode": "1.0
|
|
98
|
-
"@earendil-works/pi-coding-agent": "1.0
|
|
99
|
-
"@earendil-works/pi-durable": "1.0
|
|
100
|
-
"@earendil-works/pi-mcp": "1.0
|
|
101
|
-
"@earendil-works/pi-telemetry": "1.0
|
|
102
|
-
"@earendil-works/pi-tui": "1.0
|
|
94
|
+
"@earendil-works/chord": "1.1.0",
|
|
95
|
+
"@earendil-works/pi-agent-core": "1.1.0",
|
|
96
|
+
"@earendil-works/pi-ai": "1.1.0",
|
|
97
|
+
"@earendil-works/pi-codemode": "1.1.0",
|
|
98
|
+
"@earendil-works/pi-coding-agent": "1.1.0",
|
|
99
|
+
"@earendil-works/pi-durable": "1.1.0",
|
|
100
|
+
"@earendil-works/pi-mcp": "1.1.0",
|
|
101
|
+
"@earendil-works/pi-telemetry": "1.1.0",
|
|
102
|
+
"@earendil-works/pi-tui": "1.1.0"
|
|
103
103
|
},
|
|
104
104
|
"direct": {
|
|
105
105
|
"proper-lockfile": "4.1.2"
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
* The bootstrap that composes the two lives with the overlay (`pi/pi-durable/bootstrap.mjs`), not
|
|
17
17
|
* here: this module never imports or initializes the durable app runtime and carries no path into
|
|
18
18
|
* a vendor checkout. That is this module's import boundary, not the package's dependency list: the
|
|
19
|
-
* package does declare the exact `@earendil-works/pi-durable` (
|
|
19
|
+
* package does declare the exact `@earendil-works/pi-durable` (per the pin's SDK set) for its carrier (#130).
|
|
20
20
|
*
|
|
21
21
|
* WHY BIRTH IS AFTER OPEN, BEHIND A GATE. `[read @cd32f77]` The native session id is chosen
|
|
22
22
|
* inside `openDurable` (`runtime.ts:125`, `sessions.ts:18-55`), and `openDurable` calls
|
|
@@ -276,7 +276,9 @@ export interface PiDurableRoots {
|
|
|
276
276
|
// ---------------------------------------------------------------------------
|
|
277
277
|
// Durable surface, typed NARROWLY and locally — read at pi-durable 1.0.2 @cd32f77 (#129,
|
|
278
278
|
// `harness/types.ts`; historical coordinates, not re-anchored here). The current supply is the
|
|
279
|
-
//
|
|
279
|
+
// carrier `pi/pi-durable/overlay/upstream-pin.json` names (1.1.0 at `abe508e`). `[read 2026-10-08]`
|
|
280
|
+
// v1.0.4 → v1.1.0 `harness/types.ts` adds `models`, `contextRetentionMs` and a `context()` options
|
|
281
|
+
// bag only; none of the shapes typed below moved.
|
|
280
282
|
// `defineExtension`/`defineTool` are identity functions (`harness/define.ts:6-17`), so a plain
|
|
281
283
|
// object is the extension.
|
|
282
284
|
// ---------------------------------------------------------------------------
|
package/run.sh
CHANGED
|
@@ -3810,7 +3810,7 @@ check_pack() {
|
|
|
3810
3810
|
# which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
|
|
3811
3811
|
# below so a future suffix change cannot pass vacuously.)
|
|
3812
3812
|
pack_install_leaked_pi() {
|
|
3813
|
-
grep '^@earendil-works+' | grep -Ev '@1\.0
|
|
3813
|
+
grep '^@earendil-works+' | grep -Ev '@1\.1\.0(_|$)' || true
|
|
3814
3814
|
}
|
|
3815
3815
|
|
|
3816
3816
|
# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
|
|
@@ -3830,15 +3830,15 @@ check_pack_pin_matcher() {
|
|
|
3830
3830
|
# None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
|
|
3831
3831
|
# the prerelease shape that an unanchored match would bless) and an off-pin version.
|
|
3832
3832
|
matcher_probe=$(printf '%s\n' \
|
|
3833
|
-
'@earendil-works+pi-ai@1.0
|
|
3834
|
-
'@earendil-works+pi-ai@1.
|
|
3835
|
-
'@earendil-works+pi-ai@1.
|
|
3836
|
-
'@earendil-works+pi-ai@1.
|
|
3837
|
-
'@earendil-works+pi-ai@1.0
|
|
3833
|
+
'@earendil-works+pi-ai@1.1.0' \
|
|
3834
|
+
'@earendil-works+pi-ai@1.1.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
|
|
3835
|
+
'@earendil-works+pi-ai@1.1.0_ws@8.21.3' \
|
|
3836
|
+
'@earendil-works+pi-ai@1.1.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
|
|
3837
|
+
'@earendil-works+pi-ai@1.1.0-beta.1' \
|
|
3838
3838
|
'@earendil-works+pi-agent-core@0.87.1' | pack_install_leaked_pi)
|
|
3839
|
-
if [ "$matcher_probe" != '@earendil-works+pi-ai@1.0
|
|
3839
|
+
if [ "$matcher_probe" != '@earendil-works+pi-ai@1.1.0-beta.1
|
|
3840
3840
|
@earendil-works+pi-agent-core@0.87.1' ]; then
|
|
3841
|
-
fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.0
|
|
3841
|
+
fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 1.1.0-beta.1 and the off-pin 0.87.1 lookalikes, and pass 1.1.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
|
|
3842
3842
|
return 1
|
|
3843
3843
|
fi
|
|
3844
3844
|
|
|
@@ -3846,9 +3846,9 @@ check_pack_pin_matcher() {
|
|
|
3846
3846
|
# (0.85.0 onward, still true at 0.99.1). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
|
|
3847
3847
|
# back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
|
|
3848
3848
|
matcher_probe=$(printf '%s\n' \
|
|
3849
|
-
'@earendil-works+chord@1.0
|
|
3849
|
+
'@earendil-works+chord@1.1.0' \
|
|
3850
3850
|
'@earendil-works+chord@0.87.1' \
|
|
3851
|
-
'@earendil-works+pi-ai@1.0
|
|
3851
|
+
'@earendil-works+pi-ai@1.1.0' | pack_install_leaked_pi)
|
|
3852
3852
|
if [ "$matcher_probe" != '@earendil-works+chord@0.87.1' ]; then
|
|
3853
3853
|
fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol — `[측정 2026-09-20]` at 0.86.0, re-measured `[측정 2026-09-22]` at 0.87.0, `[측정 2026-09-23]` at 0.87.1 and `[측정 2026-09-30]` at 0.99.1, where pi-coding-agent adds pi-codemode and pi-mcp beside them) — got: ${matcher_probe:-<nothing leaked>}"
|
|
3854
3854
|
return 1
|
|
@@ -3862,7 +3862,7 @@ check_pack_pin_matcher() {
|
|
|
3862
3862
|
# Cells: L1s (Entwurf alone, $3), L1 (project-local beside an aligned host pi-coding-agent at the
|
|
3863
3863
|
# pinned SDK version), L2 (an isolated `npm -g --prefix`), each through (a) the INSTALLED verifier
|
|
3864
3864
|
# (exit 0, prints its own carrier-resolver) and (b) an independent consumer oracle; then the L3
|
|
3865
|
-
# NEGATIVE (an override binds pi-durable's pi-ai edge
|
|
3865
|
+
# NEGATIVE (an override binds pi-durable's pi-ai edge to an older published version: the installed verifier must
|
|
3866
3866
|
# refuse it by name, while a bare import still succeeds); then (c) the public launch on L1s.
|
|
3867
3867
|
# The oracle observes RESOLUTIONS (a resolve hook), not every filesystem read; it asserts each
|
|
3868
3868
|
# resolved product file lies inside THIS consumer's node_modules — a sandbox ancestor is not the
|
|
@@ -3873,8 +3873,9 @@ pack_install_durable_cells() {
|
|
|
3873
3873
|
local tgz="$1" box="$2" l1s="$3" pin_ver oracle_dir cell root control pkg out rc
|
|
3874
3874
|
local host_specs=() host_old_specs=() spec
|
|
3875
3875
|
pin_ver=$(cd "$REPO_DIR" && node -p "require('./pi/pi-durable/overlay/upstream-pin.json').sdk.members['@earendil-works/pi-coding-agent']")
|
|
3876
|
-
# The HOST fixture needs a coherent generation too: coding-agent
|
|
3877
|
-
#
|
|
3876
|
+
# The HOST fixture needs a coherent generation too: a coding-agent root alone has
|
|
3877
|
+
# caret SDK edges, which can float to a newer generation (CI37694671506, measured at
|
|
3878
|
+
# coding-agent@1.0.4 with ^1.0.4 edges resolving 1.1.0: pi-ai tar 404).
|
|
3878
3879
|
# These are fixture roots from the owning pin, not product overrides or fallback.
|
|
3879
3880
|
out=$(cd "$REPO_DIR" && node -e 'const p = require("./pi/pi-durable/overlay/upstream-pin.json"); console.log(Object.entries(p.sdk.members).map(([n,v]) => `${n}@${v}`).join("\n"));') || return 1
|
|
3880
3881
|
mapfile -t host_specs <<<"$out"
|
|
@@ -4049,16 +4050,16 @@ ORACLE
|
|
|
4049
4050
|
|
|
4050
4051
|
# (d) Host vs native are two subjects. The installed package's native SDK set is the pin (above);
|
|
4051
4052
|
# the ordinary Pi HOST on PATH is judged by its OWN real `pi --version` against the derived range.
|
|
4052
|
-
# Real host binaries, no forged version: a sandbox install of the previous pi
|
|
4053
|
+
# Real host binaries, no forged version: a sandbox install of the previous pi generation must make the
|
|
4053
4054
|
# installed setup's pi row a named FAIL with ZERO Pi wiring while pi-durable still PASSes, and the
|
|
4054
4055
|
# aligned host binary (the pinned version, installed above for L1) must be inside the range.
|
|
4055
4056
|
# The previous host version is a variable, not a quoted `@pkg@x.y.z` spec: check-dep-versions reads
|
|
4056
4057
|
# those specs as this repo's install pins, and this one is deliberately off the floor.
|
|
4057
|
-
local host_home host_proj host_old="$box/pd-host-old" host_env=() host_old_ver="1.0.
|
|
4058
|
+
local host_home host_proj host_old="$box/pd-host-old" host_env=() host_old_ver="1.0.4"
|
|
4058
4059
|
mkdir -p "$host_old"
|
|
4059
4060
|
for spec in "${host_specs[@]}"; do host_old_specs+=("${spec%@*}@$host_old_ver"); done
|
|
4060
4061
|
out=$(cd "$host_old" && npm install "${host_old_specs[@]}" --no-audit --no-fund 2>&1) || {
|
|
4061
|
-
fail "[check-pack-install] could not install the previous-host pi fixture (
|
|
4062
|
+
fail "[check-pack-install] could not install the previous-host pi fixture ($host_old_ver):"; echo "$out" | tail -10 | sed 's/^/ /' >&2; return 1; }
|
|
4062
4063
|
for cell in old aligned; do
|
|
4063
4064
|
host_home="$box/pd-host-$cell-home"; host_proj="$box/pd-host-$cell-proj"
|
|
4064
4065
|
mkdir -p "$host_home/.pi/agent" "$host_proj"
|
|
@@ -4072,8 +4073,8 @@ ORACLE
|
|
|
4072
4073
|
fail "[check-pack-install] host $cell: the native pi-durable row must stay PASS whatever the PATH host is:"; echo "$out" | tail -20 | sed 's/^/ /' >&2; return 1
|
|
4073
4074
|
fi
|
|
4074
4075
|
if [ "$cell" = old ]; then
|
|
4075
|
-
if [ "$rc" -eq 0 ] || ! grep -q "pi: FAIL — detected pi
|
|
4076
|
-
fail "[QK:PACK-INSTALL-HOST-RANGE-SEPARATE] [check-pack-install] a real pi
|
|
4076
|
+
if [ "$rc" -eq 0 ] || ! grep -q "pi: FAIL — detected pi $host_old_ver is outside the supported range >=$pin_ver <1.2" <<<"$out" || [ -e "$host_proj/.pi" ] || [ -e "$host_home/.pi/agent/settings.json" ]; then
|
|
4077
|
+
fail "[QK:PACK-INSTALL-HOST-RANGE-SEPARATE] [check-pack-install] a real pi $host_old_ver host beside the $pin_ver native set must be a named pi FAIL with zero Pi wiring and a non-green setup (rc=$rc):"
|
|
4077
4078
|
echo "$out" | tail -20 | sed 's/^/ /' >&2
|
|
4078
4079
|
return 1
|
|
4079
4080
|
fi
|
|
@@ -4081,7 +4082,7 @@ ORACLE
|
|
|
4081
4082
|
fail "[check-pack-install] host aligned: the pinned-version host binary was judged outside the range:"; echo "$out" | tail -20 | sed 's/^/ /' >&2; return 1
|
|
4082
4083
|
fi
|
|
4083
4084
|
done
|
|
4084
|
-
echo "[check-pack-install] host vs native: a real pi
|
|
4085
|
+
echo "[check-pack-install] host vs native: a real pi $host_old_ver host is a named pi FAIL with no wiring while pi-durable PASSes; the $pin_ver host binary is inside the range"
|
|
4085
4086
|
}
|
|
4086
4087
|
|
|
4087
4088
|
# The writable roots of ONE consumer sandbox, shared by every consumer subcall of
|
|
@@ -4438,21 +4439,26 @@ _check_pack_install_impl() {
|
|
|
4438
4439
|
# library the pi-durable carrier imports, a production dependency of this package since 0.32 (its
|
|
4439
4440
|
# own deps: chord, pi-ai). All eleven are published at 1.0.4. The tarball now DECLARES the nine-member
|
|
4440
4441
|
# SDK set itself, so these pins are an aligned host install beside it, not peers it lacks.
|
|
4441
|
-
|
|
4442
|
+
# `[측정 2026-10-08]` at 1.1.0 the constellation is unchanged: the nine registry manifests
|
|
4443
|
+
# (.tmp-verify/033-prep/registry-sdk-manifests.json) give pi-coding-agent {chord, pi-agent-core,
|
|
4444
|
+
# pi-ai, pi-codemode, pi-mcp, pi-tui}, pi-ai {pi-telemetry}, pi-agent-core {pi-ai}, pi-durable
|
|
4445
|
+
# {chord, pi-ai}, and `npm view` gives pi-client {chord, pi-protocol}, pi-protocol {chord}. All
|
|
4446
|
+
# eleven are published at 1.1.0.
|
|
4447
|
+
echo "[check-pack-install] pnpm add into $tmp (with the aligned 1.1.x SDK + chord + codemode + mcp + durable + typebox)"
|
|
4442
4448
|
local install_log
|
|
4443
4449
|
install_log=$(cd "$tmp" && pnpm add \
|
|
4444
4450
|
"$tgz_path" \
|
|
4445
|
-
"@earendil-works/pi-ai@1.0
|
|
4446
|
-
"@earendil-works/pi-coding-agent@1.0
|
|
4447
|
-
"@earendil-works/pi-tui@1.0
|
|
4448
|
-
"@earendil-works/pi-agent-core@1.0
|
|
4449
|
-
"@earendil-works/pi-client@1.0
|
|
4450
|
-
"@earendil-works/pi-protocol@1.0
|
|
4451
|
-
"@earendil-works/pi-telemetry@1.0
|
|
4452
|
-
"@earendil-works/chord@1.0
|
|
4453
|
-
"@earendil-works/pi-codemode@1.0
|
|
4454
|
-
"@earendil-works/pi-mcp@1.0
|
|
4455
|
-
"@earendil-works/pi-durable@1.0
|
|
4451
|
+
"@earendil-works/pi-ai@1.1.0" \
|
|
4452
|
+
"@earendil-works/pi-coding-agent@1.1.0" \
|
|
4453
|
+
"@earendil-works/pi-tui@1.1.0" \
|
|
4454
|
+
"@earendil-works/pi-agent-core@1.1.0" \
|
|
4455
|
+
"@earendil-works/pi-client@1.1.0" \
|
|
4456
|
+
"@earendil-works/pi-protocol@1.1.0" \
|
|
4457
|
+
"@earendil-works/pi-telemetry@1.1.0" \
|
|
4458
|
+
"@earendil-works/chord@1.1.0" \
|
|
4459
|
+
"@earendil-works/pi-codemode@1.1.0" \
|
|
4460
|
+
"@earendil-works/pi-mcp@1.1.0" \
|
|
4461
|
+
"@earendil-works/pi-durable@1.1.0" \
|
|
4456
4462
|
"typebox@latest" \
|
|
4457
4463
|
--ignore-workspace --ignore-scripts 2>&1) || {
|
|
4458
4464
|
fail "[check-pack-install] pnpm add failed:"
|
|
@@ -4468,11 +4474,11 @@ _check_pack_install_impl() {
|
|
|
4468
4474
|
local leaked_pi
|
|
4469
4475
|
leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
|
|
4470
4476
|
if [ -n "$leaked_pi" ]; then
|
|
4471
|
-
fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.0
|
|
4477
|
+
fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 1.1.0):"
|
|
4472
4478
|
printf '%s\n' "$leaked_pi" | sed 's/^/ /' >&2
|
|
4473
4479
|
return 1
|
|
4474
4480
|
fi
|
|
4475
|
-
echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.0
|
|
4481
|
+
echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 1.1.0 (chord and pi-durable included)"
|
|
4476
4482
|
|
|
4477
4483
|
# Resolve the installed package.json and confirm pi.extensions
|
|
4478
4484
|
# arrived intact. If pi.extensions is empty or missing, the
|
|
@@ -6802,19 +6808,11 @@ release_gate() {
|
|
|
6802
6808
|
results+=("FAIL static (pnpm run check:full)"); failc=$((failc + 1))
|
|
6803
6809
|
fi
|
|
6804
6810
|
|
|
6805
|
-
# 1b. Discriminating power
|
|
6806
|
-
#
|
|
6807
|
-
#
|
|
6808
|
-
#
|
|
6809
|
-
#
|
|
6810
|
-
section "release-gate step: check-gate-qualification"
|
|
6811
|
-
if (cd "$REPO_DIR" && bash "$self" check-gate-qualification); then
|
|
6812
|
-
ok "check-gate-qualification: PASS"
|
|
6813
|
-
results+=("PASS check-gate-qualification"); pass=$((pass + 1))
|
|
6814
|
-
else
|
|
6815
|
-
fail "check-gate-qualification: FAIL"
|
|
6816
|
-
results+=("FAIL check-gate-qualification"); failc=$((failc + 1))
|
|
6817
|
-
fi
|
|
6811
|
+
# 1b. Discriminating power is NOT re-proven here. A cut re-proves that the gates still kill
|
|
6812
|
+
# what they claim exactly once: the qualification BODY step of the exact-SHA CI run at the
|
|
6813
|
+
# prepared SHA, which the release oracle (verify-exact-ci.sh) requires before any candidate
|
|
6814
|
+
# exists (#132 / #133 — a local BODY here repeated that ~100-minute proof on a SHA nobody ships).
|
|
6815
|
+
# Its head still rides check:full as check-gate-manifests.
|
|
6818
6816
|
|
|
6819
6817
|
# 2. (gemini-availability step removed — claude-only floor; gemini CLI is
|
|
6820
6818
|
# deprecated, so the gate no longer asserts a three-backend claim.)
|
|
@@ -358,16 +358,18 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
|
|
|
358
358
|
// check-gate-qualification left the default check chains (operator
|
|
359
359
|
// inner-loop cost, 2026-08 subtraction). That move is a gate/release
|
|
360
360
|
// contract: the step must stay REACHABLE on the axes that now own it — the
|
|
361
|
-
// CI check job (on the pushes #103's filter still sends it) and
|
|
362
|
-
//
|
|
363
|
-
// must not silently return to the default chain
|
|
364
|
-
//
|
|
365
|
-
//
|
|
366
|
-
//
|
|
361
|
+
// CI check job (on the pushes #103's filter still sends it) and, for a cut,
|
|
362
|
+
// the exact-SHA release oracle that requires that CI step at the prepared SHA
|
|
363
|
+
// (8c) — and must not silently return to the default chain or to release_gate.
|
|
364
|
+
// #132/#133 moved the cut's one BODY off release_gate: a local BODY there re-ran
|
|
365
|
+
// the same proof on a SHA nobody ships, so release_gate now invokes it ZERO
|
|
366
|
+
// times. Without this cell, deleting the CI line leaves every focused gate green
|
|
367
|
+
// while a cut quietly loses its discriminating-power step, and re-adding the
|
|
368
|
+
// release_gate block silently doubles every cut again.
|
|
367
369
|
//
|
|
368
370
|
// THREE claims, because each is an independent contract. 8a is REACHABILITY
|
|
369
|
-
// (absent from the default chain; present exactly once in
|
|
370
|
-
//
|
|
371
|
+
// (absent from the default chain and from release_gate; present exactly once in
|
|
372
|
+
// CI; named in VERIFY). 8b is what the CI step
|
|
371
373
|
// qualifies (the FULL floor, before the qualification run), added by #70. 8c is
|
|
372
374
|
// what the RELEASE path ACCEPTS as evidence for one SHA — that the body step
|
|
373
375
|
// actually ran there (#103). Each carries its own replant — one mutant must
|
|
@@ -399,25 +401,27 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
|
|
|
399
401
|
"package.json's default `check` chain contains check-gate-qualification again (doubles every closure floor)",
|
|
400
402
|
);
|
|
401
403
|
if (ciHits !== 1) holes.push(`the CI check job runs check-gate-qualification ${ciHits}x (need exactly once)`);
|
|
402
|
-
if (invocations !==
|
|
403
|
-
holes.push(
|
|
404
|
+
if (invocations !== 0)
|
|
405
|
+
holes.push(
|
|
406
|
+
`release_gate invokes check-gate-qualification ${invocations}x (need none: the cut's one BODY is the prepared SHA's CI step)`,
|
|
407
|
+
);
|
|
404
408
|
if (
|
|
405
|
-
|
|
406
|
-
|
|
409
|
+
qualGateBody.includes("PASS check-gate-qualification") ||
|
|
410
|
+
qualGateBody.includes("FAIL check-gate-qualification")
|
|
407
411
|
)
|
|
408
|
-
holes.push("
|
|
412
|
+
holes.push("release_gate still counts a check-gate-qualification MUST row");
|
|
409
413
|
if (
|
|
410
414
|
!verifyDoc.includes(
|
|
411
|
-
"in the CI `check` job on a branch push that touched the qualification surface, and
|
|
415
|
+
"in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step",
|
|
412
416
|
)
|
|
413
417
|
)
|
|
414
418
|
holes.push("VERIFY.md no longer names the owners of the moved qualification step");
|
|
415
419
|
assert.ok(
|
|
416
420
|
holes.length === 0,
|
|
417
421
|
"[QK:QUALIFICATION-SCHEDULING-REACHABLE] check-gate-qualification left the default check chains " +
|
|
418
|
-
"deliberately, so it must stay REACHABLE on the axes that own it now — absent from the default chain
|
|
419
|
-
"
|
|
420
|
-
`
|
|
422
|
+
"deliberately, so it must stay REACHABLE on the axes that own it now — absent from the default chain " +
|
|
423
|
+
"and from release_gate (the cut's one BODY is the prepared SHA's CI step), exactly once in the CI check job, " +
|
|
424
|
+
`and named in VERIFY. Broken: ${holes.join("; ")}`,
|
|
421
425
|
);
|
|
422
426
|
|
|
423
427
|
// 8b. WHAT the CI qualification step qualifies — its own claim, not a branch
|
|
@@ -181,7 +181,7 @@
|
|
|
181
181
|
"claim": "PI-CORE-PIN-TRACKS-FLOOR",
|
|
182
182
|
"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
|
|
183
183
|
"subject": "package.json",
|
|
184
|
-
"find": ["\"@earendil-works/pi-agent-core\": \"1.0
|
|
184
|
+
"find": ["\"@earendil-works/pi-agent-core\": \"1.1.0\","],
|
|
185
185
|
"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
|
|
186
186
|
"gate": ["bash", "run.sh", "check-dep-versions"],
|
|
187
187
|
"timeoutSeconds": 300,
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
|
|
7
7
|
"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
|
|
8
8
|
"subject": "run.sh",
|
|
9
|
-
"find": [" grep '^@earendil-works+' | grep -Ev '@1\\.0
|
|
9
|
+
"find": [" grep '^@earendil-works+' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
|
|
10
10
|
"replace": [" grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
|
|
11
11
|
"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
|
|
12
12
|
"timeoutSeconds": 120,
|
|
@@ -17,8 +17,8 @@
|
|
|
17
17
|
"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
|
|
18
18
|
"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
|
|
19
19
|
"subject": "run.sh",
|
|
20
|
-
"find": [" grep '^@earendil-works+' | grep -Ev '@1\\.0
|
|
21
|
-
"replace": [" grep '^@earendil-works+pi-' | grep -Ev '@1\\.0
|
|
20
|
+
"find": [" grep '^@earendil-works+' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
|
|
21
|
+
"replace": [" grep '^@earendil-works+pi-' | grep -Ev '@1\\.1\\.0(_|$)' || true"],
|
|
22
22
|
"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
|
|
23
23
|
"timeoutSeconds": 120,
|
|
24
24
|
"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",
|
|
@@ -7,10 +7,10 @@
|
|
|
7
7
|
"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
|
|
8
8
|
"subject": "pnpm-workspace.yaml",
|
|
9
9
|
"find": [
|
|
10
|
-
" - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4'"
|
|
10
|
+
" - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4 || 1.1.0'"
|
|
11
11
|
],
|
|
12
12
|
"replace": [
|
|
13
|
-
" - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2'"
|
|
13
|
+
" - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4'"
|
|
14
14
|
],
|
|
15
15
|
"gate": ["bash", "run.sh", "check-dep-versions"],
|
|
16
16
|
"timeoutSeconds": 300,
|
|
@@ -19,10 +19,10 @@
|
|
|
19
19
|
},
|
|
20
20
|
{
|
|
21
21
|
"claim": "PI-SDK-PRODUCTION-SET",
|
|
22
|
-
"title": "the durable library's production pin falls one
|
|
22
|
+
"title": "the durable library's production pin falls one release behind the SDK set the pin declares, so the carrier would bind a pi-durable nobody verified it against",
|
|
23
23
|
"subject": "package.json",
|
|
24
|
-
"find": ["\"@earendil-works/pi-durable\": \"1.0
|
|
25
|
-
"replace": ["\"@earendil-works/pi-durable\": \"1.0.
|
|
24
|
+
"find": ["\"@earendil-works/pi-durable\": \"1.1.0\","],
|
|
25
|
+
"replace": ["\"@earendil-works/pi-durable\": \"1.0.4\","],
|
|
26
26
|
"gate": ["bash", "run.sh", "check-dep-versions"],
|
|
27
27
|
"timeoutSeconds": 300,
|
|
28
28
|
"signature": "[QK:PI-SDK-PRODUCTION-SET]",
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
"title": "an @earendil-works package returns as a dev dependency beside its production pin, one name in two dependency classes",
|
|
34
34
|
"subject": "package.json",
|
|
35
35
|
"find": ["\"@biomejs/biome\": \"^2.4.13\","],
|
|
36
|
-
"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.0
|
|
36
|
+
"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.1.0\","],
|
|
37
37
|
"gate": ["bash", "run.sh", "check-dep-versions"],
|
|
38
38
|
"timeoutSeconds": 300,
|
|
39
39
|
"signature": "[QK:PI-SDK-NO-DUAL-DECLARATION]",
|
|
@@ -103,10 +103,12 @@
|
|
|
103
103
|
},
|
|
104
104
|
{
|
|
105
105
|
"claim": "QUALIFICATION-SCHEDULING-REACHABLE",
|
|
106
|
-
"title": "release_gate
|
|
106
|
+
"title": "release_gate starts invoking check-gate-qualification again — every cut silently pays a second ~100-minute BODY on a SHA nobody ships, the repetition #132/#133 moved to the prepared SHA's one CI step",
|
|
107
107
|
"subject": "run.sh",
|
|
108
|
-
"find": ["
|
|
109
|
-
"replace": [
|
|
108
|
+
"find": [" # 2. (gemini-availability step removed — claude-only floor; gemini CLI is"],
|
|
109
|
+
"replace": [
|
|
110
|
+
" (cd \"$REPO_DIR\" && bash \"$self\" check-gate-qualification) || true\n # 2. (gemini-availability step removed — claude-only floor; gemini CLI is"
|
|
111
|
+
],
|
|
110
112
|
"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
|
|
111
113
|
"timeoutSeconds": 180,
|
|
112
114
|
"signature": "[QK:QUALIFICATION-SCHEDULING-REACHABLE]",
|