@junghanacs/entwurf 0.32.0 → 0.34.0

package/AGENTS.md

@@ -31,7 +31,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 3. **One identity contract, capability domains.** Branch on rail/liveness capability, not a privileged citizen class.
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
-6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`; native extension modules use operator-declared paths through the owning bootstrap. Neither discovers ambient configuration, scans extension directories, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
+6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`. Native extension modules enter only through the owning bootstrap, from an operator-named absolute file or an operator-named absolute directory read once at launch: top level only, exact suffix filter, deterministic order, every selected entry a regular file. Neither discovers ambient or default locations, takes module paths from settings or environment, recurses, watches, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
 7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
@@ -88,13 +88,13 @@ A new contract's test goes beside the behavior it certifies — `pi-extensions/*
 
 ```text
 implement → affected focused gates → independent review → one amendment bundle
-          → qualification once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
+          → affected qualification PARTIAL once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
 ```
 
-- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: required changed qualification, frozen FULL and native/LIVE/release floors remain mandatory before landing/shipment, never inherited from an interim commit.
+- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: the affected qualification PARTIAL, frozen FULL and native/LIVE/release floors remain mandatory before landing, and the prepared SHA's CI qualification body before shipment, never inherited from an interim commit.
 - Inner loop runs only affected gates; review and its corrections finish before the full floor.
 - A changed contract names a production subject and independent oracle; its focused assertion has a stable QK and exact-once mutant. Matrices change by their declared axes/cells, not appended anecdotes.
-- Qualification body is scheduled once when its surface changes; its manifest/head checks remain in the deterministic floor. A release requires the exact-SHA qualification evidence required by VERIFY, never a nearby green run.
+- Development never runs the whole qualification body. A changed gate/mutant/matrix runs its affected exact-argv groups once, after review and amendment, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`); the manifest head stays in the deterministic floor. The whole body runs once per cut, in the prepared SHA's CI: a prepared state awaits it and is never presumed PASS, and a release requires the exact-SHA evidence VERIFY names, never a nearby green run or a PARTIAL.
 - Freeze the candidate while the full floor runs; any worktree/index movement voids that receipt. Pre-commit is not the full floor.
 - LIVE/release floors are not lowered by a shorter inner loop. Failed gate or evidence downgrade blocks the relevant commit/release decision.
 

package/CHANGELOG.md

@@ -4,6 +4,109 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.34.0 - 2026-10-09
+
+### Release coordination
+
+- **One cut for #134 and #133.** Coordinated by the pi-durable citizen `20261008T113104-801621` and
+  implemented by Claude Code Opus under GLG's grant for prepare and make; npm publication is
+  coordinated with GLG separately. This section is written at prepare time: the prepared SHA's CI,
+  the preserved artifact and the tag are recorded in the GitHub release, not claimed here.
+- **Verified for this cut.** `check:full` passed on the prepare tree (719 s). The first
+  `release-gate --cut` ended RED, MUST 23/1/0: `smoke-codex-fresh-live` timed out because Codex
+  0.153.4 refused the stated Codex-side model `gpt-6-luna` for a ChatGPT account (vendor 400); that
+  run is preserved as RED. The rerun with the Codex model `gpt-5.6-terra` (Pi side unchanged) passed
+  MUST 24/0/0 and BEHAVIOR 1/0/0 in 1115 s, its own `check:full` 723 s. Before the commit,
+  `check-pack-install` (with the module-directory cell) and the `check-pi-durable-contact`/`-send`/
+  `-receive` gates against a bridge bundle emitted from the candidate passed, and an installed-package
+  fixture drove agent-config's background-bash module through a faux model: badge with the panel
+  hidden and at narrow sizes, report once, an interrupted task never re-run after `--continue`.
+  Vendor model calls there were 0 by construction; its token counts are faux accounting. Affected
+  qualification partials: 58/58 for #134 (earlier tree), 52/52 and 22/22 for #133. The whole
+  qualification body runs once, in the prepared SHA's CI.
+- **Not measured, by GLG's decision for this cut.** GLG waived the agy shipped-lane criterion: the
+  three agy doctors passed, the first native-push probe of a fresh conversation was indeterminate,
+  and agy native-push stays NOT CERTIFIED. GLG deferred the badge on GLG's own visible terminal and
+  the new post-install Claude session of the meta-bridge criterion to a later session; the host's
+  dev-linked doctor passed with five live joins, and the meta-bridge writer is unchanged since
+  0.33.0. None of these is a pass, and no 0.33.0 exception carries over.
+
+### pi-durable
+
+- **Background-task badge (#134).** The carrier runtime observes the native task graph from open to
+  close; `/tasks` now toggles only the panel. The carrier TUI draws a kind-agnostic badge of live
+  background tasks (`node.background`) as the dock's first, never-shrunk row, naming the ones not
+  running and shortening down to one ASCII cell; a one-row terminal with live background work shows
+  the badge, and with none the screen is upstream's. The overlay patch now carries one section per
+  patched carrier file (`runtime.js`, `tui.js`), and the emitter refuses any other shape.
+- **Module directory ingress (#134).** `--native-module-dir <absolute directory>` is the paired,
+  exclusive form of `--native-module`: one top-level read, `*.extension.mjs` non-dotfiles only,
+  byte-wise order, per-module guards, and named refusals for an empty directory, a non-regular
+  match, two names for one file and a cross-module extension or tool name. Hard Rule 6 now admits an
+  operator-named directory read once; ambient, default, recursive, watched and setting/environment
+  discovery stay forbidden.
+- **Deferred:** #106 no-turn retirement moved to ROADMAP as GLG's deferral, not implemented.
+  #132's unfinished Herdr plugin alignment (npm re-pin, source proof, pi-durable under Herdr) moved
+  to ROADMAP, closed not-planned, to reopen against this release's published bytes.
+
+### Verification
+
+- **Development runs no whole qualification body (#133).** `run.sh check-gate-qualification` now
+  hands its arguments to the runner's parser: `--group '<argv JSON>' --receipt <absolute path>`
+  runs one affected exact-argv group as a PARTIAL receipt, and a malformed, missing or repeated flag
+  is refused by name before any body or snapshot. Until now the wrapper dropped them, so a requested
+  PARTIAL started the whole body. Bare, it stays the whole body, which runs once per cut at the
+  prepared SHA's CI; a prepared state awaits it and is never presumed PASS. AGENTS, VERIFY and the
+  release skill retire the development rule of a local whole run when a gate, mutant or matrix
+  changes. Native/LIVE, the deterministic and package floors, the four required CI jobs and the
+  artifact acceptance are unchanged; P4 FULL and its CI repetition are not reduced here.
+
+## 0.33.0 - 2026-10-08
+
+### Release coordination
+
+- **First cut coordinated by a pi-durable citizen (#132).** This cut is coordinated by the
+  pi-durable citizen `20261008T113104-801621`, implemented by Claude Code Opus, and independently
+  scrutinized by Grok. Per GLG's direct report (carried here as that report, not as a source
+  receipt), an earlier durable-coordination attempt during the 0.31.0 process broke down; 0.31.0
+  itself shipped with the accepted receipts recorded in its own section below, and neither that
+  report nor 0.32.0's snapshot-loss incident is restated here as a package-publication failure.
+  This section is written at prepare time: the prepared-SHA CI, the preserved artifact and the tag
+  that close the cut are recorded in the GitHub release and the #132 thread, not claimed here.
+- **Verified for this cut.** The Pi SDK 1.1.0 implementation landed at `aceba59` with exact-SHA CI
+  run 37739273349 green on all four required jobs and its qualification body (898/898 killed),
+  after a local body of 898/898 and a frozen `check:full` on that candidate. The prepared tree
+  (scheduling policy, ASCII fix, version metadata) passed a frozen `check:full`. The policy's
+  affected 22-mutant partial run killed 22/22, and its later format/doc amendments re-ran their
+  focused gates. After the operator-owned Codex app-server was restarted, the Codex and
+  Antigravity native doctors were green.
+- **Not run for this cut — GLG's direct cost/deadline decision, one cut only** ("아니야 30분 내로
+  npm publish 전까지 끝내줘. 이 부랜치 핵심은 검증했지? 그럼 됬어. … 시간 아끼자.";
+  [authority record](https://github.com/junghan0611/entwurf/issues/132#issuecomment-6057425161)). The LIVE
+  `release-gate --cut` was started and then aborted inside its `check:full`, before any LIVE step;
+  that is not a verdict, so the live MUST floor is unproven here. Also not run: the pre-commit
+  native acceptance (provider-instruction wire observation, warm/cold retention, the Codex
+  caller-seat cell), the second `check:full` before the push, and waiting for the prepared SHA's CI
+  qualification body before the candidate was packed. That CI run continues and its outcome is
+  recorded with the release; a red result is new scope. Antigravity criterion 7 stays NOT
+  CERTIFIED. VERIFY's release floor is unchanged — this is not a standing waiver.
+
+### Changed
+
+- **Pi SDK 1.1.0 (#132).** The nine exact production SDK members move to `1.1.0` and the
+  pi-durable carrier pin to upstream `v1.1.0` (`abe508e`); the emitter's `--check` reproduces the
+  existing carrier bytes at that commit, so only the pin's tag/commit/SDK set change. The supported
+  ordinary Pi host range follows the pin to `>=1.1.0 <1.2`. The installed-consumer previous-host
+  control moves from a real pi 1.0.2 to 1.0.4 — the immediately prior generation is now the refused
+  host — while the L3/L4 mixed and depth-3 controls keep their real 1.0.3 packages.
+- **A cut runs its qualification body once, at the prepared SHA (#132, #133).** `release-gate` no
+  longer runs a local `check-gate-qualification` body; the release's one body is the exact-SHA CI
+  step at the prepared SHA, which the release oracle already required. The scheduling assertion now
+  keeps `release-gate` at zero invocations and its mutant plants the call back. The development rule
+  of one local run when a gate or mutant changes is unchanged; retiring it stays with #133. For this
+  cut alone GLG granted two exceptions: the policy commit rides the prepared push without its own
+  pre-version CI, and its local whole body was replaced by its affected 22-mutant partial run.
+
 ## 0.32.0 - 2026-10-08
 
 ### Added

package/README.md

@@ -27,29 +27,23 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
-**Native durable contact (`pi-durable`) ships in the [0.31.0 release](https://github.com/junghan0611/entwurf/releases/tag/v0.31.0) (#129).**
-It is a separate native harness contact, not ordinary Pi's control-socket adapter.
-The contact attaches one durable host to a garden id, adds visible identity and
-two-way mailbox contact, while the upstream harness keeps its TUI, models/auth,
-SQLite storage and recovery. Native admission passed on one Linux host on the
-0.31.0 source-runtime route. Under the #130/0.32 contract the app ships inside the
-Entwurf package as a pinned [carrier](#native-durable-pi-durable--130--032-contract), so
-it no longer depends on installing the ordinary Pi CLI or provisioning a runtime.
-
-> **Prepared 0.32.0 candidate, not a published release.** The current source contains #130's
-> carrier and explicit native-module contract. Prepared-SHA CI and one preserved versioned
-> artifact have their own acceptance receipts; preparation alone does not assert npm publication.
-> The published 0.31.0 follows its source-runtime docs — it does not supply this carrier.
+> **Current release: [0.33.0](https://github.com/junghan0611/entwurf/releases/tag/v0.33.0)**
+> ([`fea9b3d`](https://github.com/junghan0611/entwurf/commit/fea9b3dc4779ac5deb34e239abc8e0b5e3e95382)).
+> Includes the pinned Pi 1.1.0 native durable app/TUI and one explicit native-module ingress;
+> `npm` `latest` is `0.33.0`. What that cut ran and did not run is in its CHANGELOG section.
+> Release history and detailed evidence belong in [CHANGELOG](./CHANGELOG.md).
 
 ## Install
 
-**Choose by where you work. Neither route installs a harness, subscription or login.**
+**Choose by where you work. Bring your own harnesses, subscriptions and login.**
+The native durable route below additionally supplies the upstream app/TUI missing from its npm
+release; it does not supply credentials or take ownership of the harness.
 
 ### Direct — ordinary shell or tmux
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.0.4 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.1.0 <1.2`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -77,37 +71,31 @@ Detected harness wiring on Darwin can therefore be written while setup stays
 non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
 restriction; that is not certification of every platform's harness rails.
 
-### Native durable (pi-durable) — #130 / 0.32 contract
+### Native durable (pi-durable)
 
-**Installing Entwurf from npm supplies pi-durable. There is no runtime checkout, patch,
-build or model-data copy for the operator.**
+**The package supplies the pinned upstream app/TUI and nine exact Pi 1.1.0 SDK
+members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
+The launch verifies carrier integrity and every reachable SDK edge's name/version;
+incomplete, drifted or mixed supply refuses by name.
 
-| Component | How it is supplied | What it does not supply |
-|---|---|---|
-| Entwurf | Existing npm or source-checkout route above | A harness binary, subscription or login |
-| pi SDK set (`@earendil-works/*` 1.0.4, incl. the `pi-durable` library) | Exact production dependencies of Entwurf | The experimental app, which upstream does not publish |
-| Native experimental durable app/TUI | Entwurf's **carrier**: the pinned upstream v1.0.4 app files, type-stripped, with the narrow runtime-contact overlay (`pi/pi-durable/carrier/`, MIT) | A replacement ordinary Pi CLI or an Entwurf-owned harness |
-
-`entwurf pi-durable` verifies the carrier and the pi SDK set it resolves — every reachable
-package edge binds the declared name at exactly the pinned version — and refuses by name otherwise
-(`pi-durable-package-incomplete`, `-carrier-drift`, `-sdk-absent`, `-sdk-mismatch`);
-`entwurf setup` reports the same verdict as PASS or FAIL (never SKIP) without writing durable
-wiring. The ordinary Pi on PATH is a separate subject with its own range above. Native auth,
-models, sessions and recovery stay upstream-owned: Entwurf does not copy credentials or convert
-ordinary Pi sessions into durable SQLite sessions. One operator module of your own can ride the
-launch with `--native-module <absolute file>`: it initializes before the durable runtime and its
-default export, a native durable `Extension`, is installed after Entwurf's contact ([setup
-§2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)). Ordinary Pi may warn
-that Entwurf's `@earendil-works/*` belong in `peerDependencies`; the exact set is a production
-dependency on purpose, for the native process — a known manifest constraint accepted for 0.32.
-
-The installed carrier's runtime/TUI load, its physical SDK edges and the public launch up to the
-app's own model resolution are package-gate evidence; the checkout contact/send/receive gates run the
-same carrier with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate
-release proof. 0.31.0 shipped the earlier source-runtime
-route (Pi 1.0.2/source `cd32f77`), which this contract replaces.
-See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
-and [#130](https://github.com/junghan0611/entwurf/issues/130).
+```bash
+entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
+entwurf pi-durable --continue
+```
+
+The contact adds garden identity and two-way mailbox communication. Runtime/TUI,
+models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
+[Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
+
+Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
+imports, then installs its default native Extension after the contact. After 0.33.0 (#134):
+`--native-module-dir <absolute directory>` loads the top-level `*.extension.mjs` files of that
+one named directory in byte-wise order instead, and the durable TUI keeps a live
+background-task badge on screen at any terminal size. No automatic module discovery or
+classic Pi API shim; guards are not a sandbox or rollback.
+Ordinary Pi's known `peerDependencies` warning reflects the separate native SDK supply.
+[Native setup](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
+owns flags, refusals and the extension contract.
 
 ### Herdr workbench
 
@@ -115,13 +103,11 @@ and [#130](https://github.com/junghan0611/entwurf/issues/130).
 herdr plugin install junghan0611/entwurf/plugins/herdr --yes
 ```
 
-This is a separate consumer path: it activates only Herdr-integrated **pi and
-Claude Code**, acquires the locked Entwurf runtime, and adds an observation pane.
-It puts no Entwurf bins on PATH. The
-[Herdr integration guide](https://github.com/junghan0611/entwurf/blob/main/plugins/herdr/README.md)
-owns its prerequisites, first install → first use, evidence and explicit removal.
-The plugin does not own delivery or the Herdr launch rail; a direct-installed
-citizen inside Herdr selects that rail from its own process context too.
+This separate path activates Herdr-integrated **pi and Claude Code** with an
+independently locked runtime and an observation pane; it puts no Entwurf bins on PATH.
+An Entwurf release does not automatically re-pin that runtime.
+[Herdr guide](./plugins/herdr/README.md) owns install, use, evidence and removal;
+the plugin does not own delivery or the Herdr launch rail.
 
 ### Garden launcher
 
@@ -207,74 +193,26 @@ a live or non-pi target refuses, and an unobserved window stays visible without
 Exact boundaries: [tmux launch](https://github.com/junghan0611/entwurf/blob/main/docs/mux-launch-rail.md)
 and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-launch-rail.md).
 
-## Concept primer
-
-- **Entwurf** (기투, projection-of-self): opening and addressing independent visible
-  siblings, not turning them into workers of a second orchestrator.
-- **Garden / garden id:** the shared address space and stable id of one V3
-  record-backed citizen. Native harnesses keep their own identity and transcript.
-- **ACP:** a plugin that exposes backend turns as pi provider/models under the
-  operator's own auth. The host pi is already a citizen; ACP mints no second one.
-- **MCP:** tool-call ingress to the same compiled `entwurf-bridge`, not a general
-  MCP platform or the pi receive rail. ACP uses explicit `mcpServers` declarations;
-  no ambient config scan or automatic retrieval. Plain anonymous hosts have no
-  authoritative reply address and sends are refused by default.
-- **Engraving:** optional short operator text in the backend's identity carrier,
-  not rich project context or a hidden tool catalog.
-
-## Pi 1.0 and a short history
-
-**We welcome Pi's built-in MCP:** [You Said No MCP!](https://earendil.com/posts/you-said-no-mcp/)
-(Earendil, 2026-09-29). The 0.30.0 cut targets Pi 1.0 admission and ACP basics.
-Instead of keeping native pi copies of the verbs, the adapter registers the same
-compiled bridge after record birth, under the citizen's identity, and Pi supervises
-that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
-control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
-did not adopt or certify `pi-durable` or codemode. Native durable support is now
-released as a separate 0.31.0 native contact, as described above; codemode remains a
-harness-internal capability, not another garden citizen. The 0.30.0 follow-up
-separately measured Herdr supply 0.9.3 and
-re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its
-public consumer and CI receipts live in the #126 thread. That dated alignment is
-not a permanent version-equality rule. 0.30.1 is published (npm, 2026-10-04); at its tag the
-plugin's runtime lock is still the closed `herdr-checkout` verification carrier. Publication did
-not re-pin it: the measured npm re-pin and its source-specific proof are separate, still-open
-work that the [plugin source contract](./plugins/herdr/README.md) owns.
-
-Entwurf is the 0.12+ successor to
-[`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp):
-the work was renamed around the dispatch substrate rather than the pi adapter.
-The pre-0.12 [two-pane demo](./demo/README.md) is **archived evidence**, including
-retired resume behaviour, not current instructions. [CHANGELOG](./CHANGELOG.md)
-keeps the release history; dated Codex topology and qualification receipts remain
-in [DELIVERY](./DELIVERY.md) and [BASELINE](./BASELINE.md), not rewritten as today's acceptance.
-
-## Detailed operation
-
-### Settings
-
-[Setup — settings and backend-specific keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
-owns configuration, including billing-safe carrier choices and pi-versus-backend keys.
-
-### External MCP registration
-
-[Setup — external hosts](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts)
-and [manual wiring](./docs/external-mcp-host.md) own paths, env and identity prerequisites.
-
-### Custom skills
-
-[Setup — custom skills](./docs/setup-clean-host.md#custom-skills) owns the Claude ACP
-plugin layout and validation; other harnesses keep their native skill mechanisms.
-
-### Context carriers
-
-[Setup — carriers](./docs/setup-clean-host.md#context-carriers) separates short
-engraving from the rich first-user augment and the actual callable schema.
-
-### Compaction policy
-
-[Setup — reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction):
-Entwurf does not implement backend compaction or hydrate another harness's transcript.
+## Concepts
+
+**Entwurf** (기투, projection-of-self) connects independent visible siblings;
+**garden id** names a record-backed citizen, not its pane or native transcript.
+[FAQ](./FAQ.md) explains ACP, MCP and context carriers.
+
+## Pi integration
+
+The pi adapter registers the compiled bridge with Pi's built-in MCP after record
+birth; Pi supervises the MCP child. **MCP is ingress; pi receive remains the
+record-addressed Unix control socket.** Garden identity and dispatch stay Entwurf's.
+Codemode is harness-internal, not another garden citizen.
+
+## Operation guides
+
+- [Settings and backend keys](./docs/setup-clean-host.md#settings-reference-and-backend-specific-keys)
+- [External MCP registration](./docs/setup-clean-host.md#stable-bins-and-external-mcp-hosts) · [manual wiring](./docs/external-mcp-host.md)
+- [Custom skills](./docs/setup-clean-host.md#custom-skills)
+- [Context carriers](./docs/setup-clean-host.md#context-carriers)
+- [Reuse and compaction](./docs/setup-clean-host.md#session-reuse-and-compaction) — native harness-owned; no transcript hydration
 
 ## What this repo owns, and does not
 

package/VERIFY.md

@@ -86,12 +86,12 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. One core member assumes a build output: the beside test `pi-extensions/entwurf-control.test.ts` (reached through `check-tests-beside-behavior`) registers the COMPILED bridge and refuses by name when it is absent. `prepare` normally builds it at install; after an `--ignore-scripts` install or a bridge source change, run `pnpm run build-bridge` (in the sandbox candidate when verifying one) before the core. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: the whole body runs only as the bare call — in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step once and the prepared state awaits it, never presumed PASS; a cut therefore batches its commits into that one prepared push (#132 took the cut's body off the local `release-gate`). Development runs no whole body (#133): a lane that changes a gate/mutant/matrix runs its affected exact-argv groups once, after review, as PARTIAL receipts — `./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`, whose arguments reach the runner's parser unchanged and are refused there by name, before any body or snapshot, when malformed, missing or repeated. A receipt is a measurement of one group, never a qualification pass. Neither form is inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
   - **The snapshot is source-only (#125).** It replicates the git work surface and never copies an ignored artifact from the checkout. A gate that consumes an ignored build output — the compiled `entwurf-bridge` a pi citizen registers — declares it on each of its mutants (`"build": {"argv": [...], "output": "<dir>"}`, one declaration per gate group). For that group only, the runner builds the output from the snapshot's own bytes before the control, rebuilds it after every mutation and from the restored bytes before the post-control (which must reproduce the baseline digest), never counts a build red as a kill, voids a run whose gate writes into the output, and removes the output when the group ends. The runner self-test owns this as `[QK:QUALIFY-BUILD-*]`.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
-  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
+  - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
-  - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The two non-skippable static steps (`pnpm run check:full`, `check-gate-qualification`) are inline: 0 = PASS, nonzero = FAIL, no SKIP arm — they have no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
+  - **Every MUST step is invoked and reports its own outcome.** Prerequisite-bearing LIVE MUST steps ride the P1 STEP OUTCOME protocol (`scripts/lib/step-outcome.sh`): exit 0 = PASS, exit 97 = SKIP (a prerequisite the step does not have, printed as an `[entwurf:skip]` line), anything else = FAIL. The non-skippable static step (`pnpm run check:full`) is inline: 0 = PASS, nonzero = FAIL, no SKIP arm — it has no prerequisite to decline. A skip is never counted as a pass — that hole is what let a cortex-less host read as cortex acceptance. Without `--cut` this is the unattended diagnostic: SKIPs are reported and the run still exits 0. **`--cut` makes it acceptance and any MUST SKIP is red**, which is how "a real cut needs `LIVE=1` with `SKIP=0`" stopped being prose. A green MUST gate is **necessary, not sufficient** — GLG authorizes the cut.
   - **When cost-bearing MUST gates run (fixed 2026-07-23, the F6/F7 lesson):** a commit that touches a rail a MUST-tier live gate covers runs that gate **before cross-review is requested** — never parked behind "run it at approval time". Deferring a wired gate to a human decision is what let F6/F7 ship reviewed-and-approved; the wiring exists so the verdict never depends on who pressed enter. "배선이 없어 못 한 것은 OK, 배선이 있는데 안 돌린 것은 우리가 남긴 구멍이다." Model-in-loop cost is spent via the subscription-backed `entwurf` provider where the gate allows it, a free-tier native model otherwise; cost is a reason to pick the cheap target, not to skip the gate.
 
 > **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
@@ -203,10 +203,21 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 **Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
 beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
 verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
-maintainer emitter (its source reads refuse replace refs), and the bootstrap's explicit
-`--native-module` ingress (#130 P2), driven through the packaged `main`'s own seams: initialization
-before the TUI and the open, named refusals, the identity and directory guards, the contact-first
-order by reference, and the bridge spawn *spec* (not the child's inheritance). `check-pi-runtime-version` asks the
+maintainer emitter (its source reads refuse replace refs; its one patch carries exactly one
+section per patched carrier file, #134), and the bootstrap's explicit `--native-module` ingress
+(#130 P2) with its paired `--native-module-dir` (#134), driven through the packaged `main`'s own
+seams: initialization before the TUI and the open, named refusals, the identity and directory
+guards, the top-level `*.extension.mjs` filter and byte-wise order, cross-module name refusals, the
+contact-first order by reference, and the bridge spawn *spec* (not the child's inheritance). The
+carrier's task footer (#134) is observed in ONE sandboxed child that loads the committed carrier
+through its own resolver: the real carrier runtime opened and closed with no model (graph observed
+for the session, `/tasks` toggling only the panel), then continued after one native background task
+was committed into that session through the SDK's public `Conversation.commit` (the carrier's graph
+holds that node and the badge counts it, `pending` while recovered), and the carrier TUI's badge and
+`durableLayout` drawn by the published pi-tui renderer on a fake terminal across rows 1–8 × cols
+1–12, count changes and resizes, against the pinned upstream screen for the zero-task case. Its
+editor is a fixed stand-in: the real `CustomEditor`, overlays, emoji width and a consumer's own task
+are the visible-terminal and consumer subjects. `check-pi-runtime-version` asks the
 same verifier whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
 host is setup's subject), and `check-pi-import-surface` asserts the carrier fence. The separate
 `check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive` are
@@ -227,8 +238,10 @@ same-sandbox neighbour as the rejected control), every reachable physical SDK ed
 version and declared name, a mixed-version tree refused by name although it still imports, a
 constructed depth-3 mismatch refused by the verifier and seen by the oracle, the public launch reaching the
 app's own model refusal before any birth — also with one installed `--native-module` initialized
-first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.2
-binary beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
+first, a reserved extension name refused before anything opens, one installed `--native-module-dir`
+initializing only its top-level `*.extension.mjs` (#134) and a directory without a module refused
+before anything opens — and the HOST kept a separate subject — a real pi 1.0.4
+binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
 PASSes — not native admission. The maintainer's rebuild
 equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
 a named SKIP, not acceptance. First-release visible fresh/callback and native
@@ -237,7 +250,7 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
 
 | Axis | Required proof | Limit |
 |---|---|---|
-| Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
+| Source | `pnpm run check:full` + the prepared SHA's CI `./run.sh check-gate-qualification` step | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
@@ -325,7 +338,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.4 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.1.0 <1.2`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable
@@ -482,7 +495,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 
 The minimum passing bar:
 
-1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus a `./run.sh check-gate-qualification` green on the same candidate.
+1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus the `./run.sh check-gate-qualification` step green in the exact-SHA CI run of the same prepared candidate (criterion 2's run).
 2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.

package/demo/README.md

@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 1.0.4)
+- `pi` on PATH (current floor 1.1.0)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | SDK exact `1.0.4`, host `>=1.0.4 <1.1` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: the published 0.31.0 declares the earlier peer floor 1.0.2 with the same next-minor ceiling; the 1.0.4 move and its receipts are ROADMAP's 2026-10-07 bump entry |
+| pi runtime | SDK exact `1.1.0`, host `>=1.1.0 <1.2` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #132's 1.1.0 move (ROADMAP's 2026-10-08 bump entry) has its own acceptance still owed. Historical: the published 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |