@junghanacs/entwurf 0.34.1 → 0.35.0

package/demo/README.md

@@ -1,193 +1,127 @@
-# entwurf recorded demos
-
-> **Archived pre-0.12 evidence.** These scripts still describe the retired v1 `entwurf` / `entwurf_resume` / `entwurf_send` demo flow. They are kept for historical comparison and will be replaced by a v2-native retake in a post-0.12 follow-up; do not treat them as the current 0.12 runnable recipe.
-
-> **Model ids here are archived, not recommended (2026-08-20).** The `entwurf/gpt-5.4` rows below record what these GIFs actually ran on. They are stale twice over: `entwurf/gpt-5.4` is no longer a curated `entwurf` ACP id at all — that provider serves only the `claude-*` and `cortex-*` rows in `pi-extensions/lib/acp/models.ts` — and the live-spend default has since moved to `openai-codex/gpt-5.6-luna` under a cheaper plan. Read them as a record of the recording, never as a default to copy; the current defaults live in `VERIFY.md` and `NEXT.md`.
-
-Two recorded GIF scripts live here. Both use `asciinema` for capture and
-`agg` for cast → GIF conversion. Both share the same gitignore policy
-(`*.cast` global, `demo/*.gif`, `demo/*.log` — only the `.sh` and this
-README are tracked).
-
-## `demo-baseline.sh` — single-pane baseline + entwurf surface
-
-Historical pre-0.12 demo, still linked from the top-level `README.md` as archived evidence. `package.json#pi.image` now points at the `entwurf` release hero instead. Two scenes driven into one pi pane:
-
-1. **Baseline self-awareness** — the `Q-B0` + `Q-B0-CARRIER` interview,
-   English answer enforced. The pane exposes how the running model
-   names its harness, distinguishes native tools from MCP / custom
-   tools, names the carrier surface for each cited piece of
-   information, and admits unknowns instead of fabricating.
-2. **Entwurf surface** — the same pane spawns a sibling via the
-   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-5`,
-   sibling `gpt-5.4`), prints the Session ID, and quotes the sibling's
-   one-line reply verbatim.
-
-Run from the repo root (or `demo/`):
+# Recorded demos — source checkout recipes
+
+## Whole Herdr: Pi ↔ native Claude Code (#138)
+
+This is the scene shown by the [README GIF](../README.md). The recording is the **whole
+Herdr client**, with sidebar and tabs, without captions. It observes a real Pi citizen
+opening native Claude Code, receiving its callback, sending one task, and receiving the
+sibling's native Bash result. Camera focus is a view, never an address or delivery receipt.
+
+### Original publication versus a new take
+
+[Original provenance](./herdr-pi-cc-20261011.provenance.json) records the approved GIF hash,
+original cast hash, measured runtime/models, audited source hashes and render arguments.
+The original raw cast, transcripts, native records and full manifests remain private.
+**A fresh checkout cannot replay that original capture.** The command below creates a
+**new LIVE take of the same scene**, not byte-identical GIF reproduction or renewed
+acceptance of the original. Model text, timing, ids and terminal banners vary. The original
+agg/ffprobe versions were not recorded; current tool versions cannot retroactively fill them.
+
+### Prerequisites — no automatic install or repair
+
+Run from an installed development **source checkout**, not an npm consumer. The `.ts`
+takes/helpers/tests are maintainer tooling and are deliberately excluded from the tarball.
+
+- Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
+  current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
+- Pi at the checkout's supported floor (**current floor 1.1.0**); `entwurf` on PATH must be
+  the intended source stable-bin. Source evidence is not registry-package acceptance.
+- `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
+- Herdr's existing Pi integration at
+  `${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}/extensions/herdr-agent-state.ts`.
+- The operator's existing Claude launcher/auth and vendor data at
+  `${XDG_DATA_HOME:-$HOME/.local/share}/claude`. Missing or drifted ownership is a refusal,
+  not permission to install, copy credentials or fix global hooks/settings.
+- For offline rendering only: `agg` and `ffprobe` on PATH. Rendering is optional and
+  requires the original private `take.cast` **and its same-run manifest**.
+
+Selectors for this scene are fixed: Pi `openai-codex/gpt-6.1-sol`, thinking `low`, native
+Claude Code alias `sonnet`. Overrides may only restate these. An OpenRouter base-URL
+redirect is refused before inference; no fallback model or automatic retry is used.
+A requested alias and the native model id observed in its transcript are recorded separately.
+
+### Offline verification first
 
 ```bash
-bash demo/demo-baseline.sh
+./run.sh check-demo-reproducibility
+pnpm exec tsc --noEmit -p scripts/tsconfig.json
 ```
 
-Output lands directly in the publish surface — re-running the script
-overwrites the previous take so the gallery preview always matches the
-current branch:
-
-- `docs/assets/entwurf-demo.cast` — raw asciinema recording (gitignored)
-- `docs/assets/entwurf-demo.gif` — tracked, referenced by the top-level `README.md` as archived pre-0.12 evidence
-- `demo/baseline-debug.log` — `ENTWURF_DEBUG=1` stderr (gitignored, stays next to the script)
+The named source-only floor verb discovers `demo/**/*.test.ts` and runs Node's own test
+runner, including fake-tool/child-process fixtures. It is reached by `pnpm check` and
+`pnpm run check:full`; these are not Vitest tests and are not reached by the adapter beside
+Vitest globs. HOME, writable XDG roots and identity carriers are sandboxed by the verb.
+`agg` and `ffmpeg` are faked, but the renderer/caption fixtures decode real GIF bytes, so
+this floor needs a real `ffprobe` on PATH; without it they fail (`ffprobe ENOENT`) rather
+than skip. CI installs Ubuntu's `ffmpeg` package (which carries `ffprobe`) in the check job.
+The receiving type fence is `scripts/tsconfig.json`, paired with the root `demo` exclusion.
 
-## `demo.sh` — two-pane entwurf flow (regression guard)
+### Explicit new LIVE take
 
-Three-scene entwurf flow used for regression evidence, not for the
-public README. Two pi sessions run side-by-side in one tmux window;
-a background driver types the scene prompts into the sender pane.
-
-1. **Spawn** a sonnet sibling (memory write — "tempered indigo").
-2. **Resume** that same sibling (memory recall — identity preservation,
-   the #9 regression guard).
-3. **Cross-session greeting** via `entwurf_send`. *(Historical: `entwurf_send` was retired in the
-   0.12 cutover, and the "sent box" half of that pairing was never actually reachable — the
-   sender-side renderer had zero producers and was removed in #120 P3. What the recording shows on
-   the receive side is real; the send side is a box the operator could not have seen.)*
-
-Run:
+Only run after deciding to spend real subscription turns:
 
 ```bash
-bash demo/demo.sh
+LIVE=1 node demo/take-herdr-pi-cc.ts
 ```
 
-Output mirrors the baseline demo's layout — recording artifacts land in
-`docs/assets/` so the publish surface and the demo script share one
-naming convention:
+With approved selectors/policy and without `LIVE=1`, it exits 97 **before tool preflight
+or resource creation**. Invalid selectors or an OpenRouter redirect can refuse earlier
+with exit 2, still without tools or writes. Once authorized, it creates a private Herdr
+server/fence, starts the scene, and stops only resources whose
+ownership it can prove. Failure ends observation; it cannot undo a citizen's completed work.
+No automatic retry, rerender or promotion follows a failure. Failed evidence is retained.
 
-- `docs/assets/entwurf-entwurf.cast` — raw asciinema recording (gitignored via global `*.cast`)
-- `docs/assets/entwurf-entwurf.gif` — tracked, referenced by the top-level `README.md` Entwurf section
-- `demo/peer-debug.log` — `ENTWURF_DEBUG=1` stderr from the top pane (gitignored, stays next to the script)
-- `demo/sender-debug.log` — same from the bottom pane
+The fence isolates Herdr XDG state and Entwurf record/mailbox roots, **not the whole host**:
+HOME/auth/vendor stores remain real; the existing Claude data directory is linked into the
+private fence. Pi's control socket and the addressed v2 lock use real `~/.pi/` directories.
+The native transcripts, records and fence are kept, not erased by teardown. Do not run this
+against an operator server or broaden cleanup to unrelated sessions.
 
-Watch debug live (separate terminal, before `bash demo.sh`):
+The default output is `.tmp-verify/138-demo-gifs/takes/<take-id>/` (ignored); an explicit
+`ENTWURF_DEMO_OUT` changes its parent. `manifest.json` contains assertions, camera views,
+raw receipts, measured models and the cast digest. The stage describes source **tooling**;
+`entwurfOnPath` is observed, not checked against this checkout's stable-bin. Confirm that
+binding separately before calling a take source-runtime evidence. Git HEAD and dirty state
+are observed; a dirty HEAD is **not** an immutable source fingerprint.
+Keep the exact source and manifest with any subsequent take you intend to audit.
 
-```bash
-tail -F demo/sender-debug.log demo/peer-debug.log
-```
-
-Quick post-run greps:
-
-```bash
-grep 'entwurf:debug'        demo/sender-debug.log
-grep -E '(entwurf|model-switch)' demo/sender-debug.log
-```
+### Offline rendering and publication boundary
 
-## Tunables (env vars)
-
-### `demo.sh` (entwurf two-pane)
-
-| Var | Default | Meaning |
-|---|---|---|
-| `PEER_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | top pane backend (receives greeting) |
-| `SENDER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | bottom pane backend (drives scenes) |
-| `SCENE_DELAY` | `25` | seconds to wait for each scene's agent work |
-| `WARMUP` | `3` | seconds to wait for both pi banners |
-| `FINAL_PAUSE` | `5` | extra wait after scene 3 (peer reply lag) |
-| `GIF_SPEED` | `2.8` | agg playback multiplier (cast time → GIF time) |
-| `SESSION` | `entwurf-demo` | tmux session name |
-| `OUTDIR` | `demo/` | debug log directory (cast + gif live in `docs/assets/`) |
-
-### `demo-baseline.sh` (single-pane baseline + entwurf)
-
-| Var | Default | Meaning |
-|---|---|---|
-| `DRIVER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
-| `SIBLING_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | cross-backend sibling spawned in scene 2 |
-| `SIBLING_CWD` | repo root | cwd passed to the entwurf sibling (drives `<project-context>` injection) |
-| `SCENE1_DELAY` | `60` | seconds for the long English baseline answer |
-| `SCENE2_DELAY` | `30` | seconds for the sync entwurf round-trip |
-| `WARMUP` | `3` | seconds to wait for the pi banner |
-| `FINAL_PAUSE` | `4` | extra wait after scene 2 |
-| `GIF_SPEED` | `2.0` | agg playback multiplier (slower than `demo.sh` — the answer rewards reading) |
-| `GIF_COMPRESS` | `1` | run gifsicle after agg (`0` to skip) |
-| `GIF_LOSSY` | `200` | gifsicle `--lossy` strength (drop to `80` if a future scenario shows artifacts) |
-| `GIF_COLORS` | `64` | gifsicle `--colors` palette size |
-| `SESSION` | `entwurf-baseline-demo` | tmux session name |
-| `OUTDIR` | `demo/` | debug log directory (cast + gif live in `docs/assets/`) |
-
-### Model ↔ alias map
-
-The demo launch lines correspond to your shell aliases:
-
-| Alias | Model id | Use as |
-|---|---|---|
-| `piao` | `entwurf/claude-opus-5` | `SENDER_MODEL` (precision scenes) |
-| `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
-| `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
-| `piat5` | `entwurf/gpt-5.5` | either |
-| `piag` | `entwurf/gemini-3.1-pro-preview` | either |
-
-Each pane runs with `ENTWURF_DEBUG=1` baked in — same shape as
-the aliases — so every spawn/model-switch/entwurf trace lands in the
-debug log files (see below).
-
-Examples:
+Given an existing same-run private take, no model turn is needed:
 
 ```bash
-# Swap peer to gemini
-PEER_MODEL=entwurf/gemini-3.1-pro-preview bash demo.sh
-
-# Faster pacing for short retake
-SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
-
-# All three backends in one demo would need a 3-pane variant — out of scope here.
+node demo/render-take.ts <private-take-dir> <private-output.gif>
 ```
 
-## Prerequisites
-
-- `pi` on PATH (current floor 1.1.0)
-- `entwurf` provider configured + auth ready for the selected sender/peer models
-- `asciinema` installed
-- `agg` installed (optional — only for GIF conversion)
-- `gifsicle` installed (optional — `demo-baseline.sh` post-compress step; skip with `GIF_COMPRESS=0`. On NixOS: `nix-shell -p gifsicle` covers both scripts)
-- `tmux` installed
-
-If you watch the demo live: open another terminal and run
-`tmux attach -t entwurf-demo -r` (read-only attach) **before** the script
-starts recording. Do not attach writable — keystrokes from your terminal
-would collide with the driver.
-
-## Why pre-baked prompts
-
-Each scene's prompt asks the inner agent to discover state itself
-(`entwurf_peers`, prior Session ID from this conversation). So the driver
-script types static strings only — no sessionId injection, no
-output parsing. That's what makes it reproducible.
-
-## Editing scenes
-
-Open `demo.sh`, edit the three `tmux send-keys -t "$SENDER_PANE" -l '...'`
-blocks under the `drive()` function. The `-l` flag tells tmux to send the
-argument literally (no key-name interpretation), so quotes inside the prompt
-are safe as long as you don't use single quotes inside the single-quoted
-argument.
-
-## Tracked vs. ignored
-
-Tracked (committed):
-
-- `demo/demo.sh`
-- `demo/demo-baseline.sh`
-- `demo/README.md`
-- `docs/assets/entwurf-demo.gif` — archived pre-0.12 README demo GIF (no longer `package.json#pi.image`)
-- `docs/assets/entwurf-entwurf.gif` — archived pre-0.12 Entwurf section illustration
-
-Ignored (regenerable recording artifacts — both demos):
-
-- `*.cast` (global rule — applies under `docs/assets/` too)
-- `demo/*.log`
-
-Both demos write their recording artifacts directly into `docs/assets/`
-using the names above. Re-running a demo overwrites the previous take so
-the published preview always matches `main`. The `.cast` source stays
-local (global `*.cast` ignore); only the `.gif` rides the publish surface.
-The `gifsicle` step inside `demo-baseline.sh` makes the take reproducible
-without a manual compression pass — see the Tunables table for tuning the
-lossy/colors flags.
+The renderer verifies cast digest, trims only recorder-only teardown, and promotes the
+private GIF only after agg exits successfully and ffprobe decodes it. Each render keeps a
+uniquely named `.render.cast` beside its output (also on failure), with name/digest in a
+successful sidecar; the original take's `take.render.cast` is never overwritten. Non-live-pass takes
+can render only to a private FAILED name. A mixed subject/teardown event is retained whole.
+The renderer refuses repository `docs/assets/` destinations, including parent-directory
+aliases: **publication is a separate reviewed copy**, never a rendering side effect.
+
+Its email/company-path scan is deliberately narrow, **not a privacy/public-readability
+certificate**: personal paths, hostnames, footers and native progress language can remain.
+The operator approved the original rough pixels with their disclosed limitations. A new
+render requires its own review; it must not overwrite the approved original implicitly.
+The GIF and sidecar rename separately; a crash between them leaves a mismatched pair, not
+atomic two-file publication. Optional `caption-take.ts` produces a separate derivative;
+it is not this uncaptioned publication recipe.
+
+## Other source scenes
+
+`take-pi-durable.ts`, `take-pi-acp.ts` and `take-pi-cc.ts` record **different**, private tmux
+scenes. Each requires its own explicit `LIVE=1` and, like the Herdr scene, refuses a
+non-approved selector or an OpenRouter base-URL redirect first (exit 2, no tools or writes).
+They are not the Herdr GIF's recipe.
+Their helper tests remain in the same offline discovery verb. Original FAILED takes and
+offline rejudgements are distinct evidence, never replacement LIVE acceptance.
+
+## Archived pre-0.12 scripts
+
+`demo-baseline.sh` and `demo.sh` retain their historical bodies for comparison, but now
+**refuse immediately with exit 2**, even with `LIVE=1`. They cannot launch retired v1 flows
+or overwrite today's published assets. Historical commands, selectors and old output paths
+inside those bodies are tombstones, not runnable advice. Scene 3's current deterministic
+delivery proof is `./run.sh check-bridge-delivery`; do not revive the v1 route.

package/demo/demo-baseline.sh

@@ -25,7 +25,11 @@
 
 set -euo pipefail
 
-# ---------- config ----------
+# Hard retirement: the preserved v1 body must never launch or overwrite today's approved GIF.
+printf '%s\n' 'entwurf demo: archived v1 baseline refused; see demo/README.md for the source-only Herdr recipe.' >&2
+exit 2
+
+# ---------- historical body (unreachable) ----------
 SESSION=${SESSION:-entwurf-baseline-demo}
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)

package/demo/demo.sh

@@ -5,7 +5,7 @@
 # retired v1 verbs (`entwurf` / `entwurf_resume` / `entwurf_send`), which the 0.12
 # cutover removed; a run would fail at scene 1. Kept for historical comparison only.
 # See demo/README.md. Scene 3's delivery proof was recovered as a deterministic gate
-# (scripts/check-bridge-delivery.ts); the v2-native retake is a post-0.12 follow-up.
+# (scripts/check-bridge-delivery.ts); current v2-native source recipes live in demo/README.md.
 #
 #
 # MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
@@ -28,7 +28,11 @@
 
 set -euo pipefail
 
-# ---------- config ----------
+# Hard retirement: preserve historical source, not a second runnable v1 route.
+printf '%s\n' 'entwurf demo: archived v1 peer scene refused; see demo/README.md for current source recipes.' >&2
+exit 2
+
+# ---------- historical body (unreachable) ----------
 SESSION=${SESSION:-entwurf-demo}
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)

package/demo/herdr-pi-cc-20261011.provenance.json

@@ -0,0 +1,64 @@
+{
+	"schemaVersion": 1,
+	"scene": "whole-Herdr Pi to native Claude Code",
+	"take": "take-herdr-pi-cc-2026-10-11T11-57-22-297Z",
+	"startedAt": "2026-10-11T11:57:22.299Z",
+	"stage": "SOURCE checkout, not an npm consumer",
+	"gif": {
+		"path": "docs/assets/entwurf-demo.gif",
+		"sha256": "b686739b5c68fa458dd47c844711aea0f6ab5819eb3eb5d2850449922fa084c0",
+		"bytes": 1835518,
+		"seconds": 43.5,
+		"width": 1126,
+		"height": 764,
+		"frames": 340,
+		"captions": false
+	},
+	"cast": {
+		"sha256": "bbf8a409c58f8b48e88346d232a66ee41ac0c2acf8e605a3f568fd7d40857cf2",
+		"public": false
+	},
+	"runtime": {
+		"entwurf": "0.34.2",
+		"pi": "1.1.0",
+		"herdr": "0.9.3",
+		"gitHead": "9f4c9983fed1dd0ba619bc5a50f0f5abccefeef4",
+		"gitDirty": true,
+		"measuredPiModel": "openai-codex/gpt-6.1-sol",
+		"requestedClaudeAlias": "sonnet",
+		"measuredClaudeNativeModel": "claude-sonnet-5-5"
+	},
+	"auditedOriginalSourceSha256": {
+		"demo/take-herdr-pi-cc.ts": "f9cd30f1bb5b06236559a9f1283f0e030b300f6a17858d778c40d246327a6349",
+		"demo/lib/take-recorder.ts": "d47d824b90a7265c5ab6e7c4bf313b4f81b27cef836b4ddd15f971f3de386256",
+		"demo/render-take.ts": "f6e68157d7f8fb1f0e00a359efaa04aa30eeca1112ce2571661f39aea826b55d",
+		"demo/lib/herdr-take.ts": "57089d883323b2582aadd7f54f63cfce541f3a2c584bb6940313fbcdc940d83e"
+	},
+	"render": {
+		"aggArgs": [
+			"--idle-time-limit",
+			"2",
+			"--speed",
+			"1",
+			"--last-frame-duration",
+			"8",
+			"--font-size",
+			"14",
+			"--theme",
+			"monokai"
+		],
+		"trimmedTailEvents": 2,
+		"trimmedWhat": "recorder teardown: herdr client exit (alt-screen exit + server shut down line)",
+		"renderedAt": "2026-10-11T11:58:32.828Z",
+		"aggVersion": null,
+		"ffprobeVersion": null,
+		"toolVersionEvidence": "not recorded for this original; current versions cannot fill historical fields"
+	},
+	"limits": [
+		"Original cast, manifests and native records remain private; this tree cannot replay that capture.",
+		"The tracked command is a new LIVE take recipe, not byte-identical reproduction.",
+		"Current maintainer source is amended; original source hashes are historical observations, not a complete import-closure seal.",
+		"Operator approved the rough original pixels; this is not privacy or public-readability certification.",
+		"No claim of 0.35.0 release, published-package acceptance or future Herdr plugin observation follows from this take."
+	]
+}

package/docs/setup-clean-host.md

@@ -195,8 +195,8 @@ root-bound — an install from another root rewrites it rather than refusing; no
 `PI_CODING_AGENT_DIR`, Claude config) changed between runs or a host that changes between the plugin's
 early owner check and its installed recheck, which can still refuse after the download; and the plugin's
 deactivate, finding no activation ledger, reports what is left at its addresses and neither reclaims nor
-reuses it. The no-ledger diagnostic is not in the published 0.34.0 runtime; a plugin host receives it only
-from a later published runtime the plugin pins.
+reuses it. The 0.34.0 runtime predates that no-ledger diagnostic; a plugin host runs the runtime its
+`runtime-lock.json` pins.
 
 ## 2. Optional pi adapter / ACP plugin
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.34.1",
+	"version": "0.35.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -40,6 +40,8 @@
 		"scripts/",
 		"prompts/",
 		"demo/README.md",
+		"demo/herdr-pi-cc-20261011.provenance.json",
+		"!demo/**/*.ts",
 		"demo/demo.sh",
 		"demo/demo-baseline.sh",
 		"docs/setup-clean-host.md",
@@ -186,7 +188,7 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/run.sh

@@ -134,6 +134,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
+  ./run.sh check-demo-reproducibility # source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication
   ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
@@ -1029,6 +1030,37 @@ check_capability_bundle_reach() {
   run_ts scripts/check-capability-bundle-reach.ts
 }
 
+check_demo_reproducibility() {
+  # Source-only Node strip-types/CLI and subprocess fixtures, not adapter Vitest tests.
+  # Discovery lives beside demo behavior; no filename list or npm TS crossing.
+  section "demo reproducibility (offline source fixtures, no model or recording)"
+  case "$REPO_DIR" in */node_modules/*) fail "check-demo-reproducibility is source-checkout-only"; return 1 ;; esac
+  local -a tests=()
+  local f
+  while IFS= read -r f; do [ -n "$f" ] && tests+=("$f"); done < <(cd "$REPO_DIR" && find demo -type f -name '*.test.ts' -print | LC_ALL=C sort)
+  if [ "${#tests[@]}" -eq 0 ]; then
+    fail "[QK:DEMO-TEST-DISCOVERY] demo test discovery is empty — no fixtures is not a passing floor"
+    return 1
+  fi
+  (
+    local sandbox name
+    sandbox=$(mktemp -d /tmp/entwurf-demo-unit.XXXXXX)
+    trap 'rm -rf -- "$sandbox"' EXIT
+    while IFS= read -r name; do
+      case "$name" in ENTWURF_*|HERDR_*|PI_SESSION_ID|PI_AGENT_ID|CLAUDECODE|CLAUDE_CODE_SESSION_ID|TMUX|TMUX_PANE|LIVE) unset "$name" ;; esac
+    done < <(compgen -e)
+    export HOME="$sandbox/home" PI_CODING_AGENT_DIR="$sandbox/pi"
+    export XDG_CONFIG_HOME="$sandbox/config" XDG_DATA_HOME="$sandbox/data" XDG_STATE_HOME="$sandbox/state" XDG_CACHE_HOME="$sandbox/cache" XDG_RUNTIME_DIR="$sandbox/runtime"
+    mkdir -m 700 "$HOME" "$PI_CODING_AGENT_DIR" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$XDG_RUNTIME_DIR" "$sandbox/bin"
+    # Take.finish records PATH versions; fixtures must not depend on an installed Pi or run it.
+    printf '#!/bin/sh\n[ "$1" = --version ] && { printf "offline-fixture\\n"; exit 0; }\nexit 81\n' > "$sandbox/bin/pi"
+    chmod +x "$sandbox/bin/pi"
+    export PATH="$sandbox/bin:$PATH"
+    cd "$REPO_DIR"
+    node --test "${tests[@]}"
+  )
+}
+
 check_bridge_delivery() {
   # demo/demo.sh scene 3, recovered as a deterministic gate. demo drove two real pi
   # panes so it proved DELIVERY through the installed binary (at model cost); what
@@ -3756,6 +3788,8 @@ check_pack() {
     # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
     # companion negation because `^plugins/` above already refuses that whole tree.
     '\.test\.[cm]?[jt]s$'
+    # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
+    '^demo/.*\.ts$'
   )
 
   local pass=1 f pat hit
@@ -7634,6 +7668,8 @@ case "$cmd" in
     # global plugin install, USER MCP reach, meta-record store integrity, hook log
     # no-ERROR, and actual SessionStart creation evidence. A plugin present with
     # zero claude-code meta-records is a SILENT MISS -> non-zero exit.
+    # #136: the only argument is `--plugin-runtime <root>`; shift the verb so the doctor sees it.
+    shift || true
     (cd "$REPO_DIR" && bash scripts/meta-bridge-doctor.sh "$@")
     ;;
   install-copilot-bridge)
@@ -8173,6 +8209,9 @@ case "$cmd" in
   check-pi-queue-oracle)
     check_pi_queue_oracle
     ;;
+  check-demo-reproducibility)
+    check_demo_reproducibility
+    ;;
   check-tests-beside-behavior)
     check_tests_beside_behavior
     ;;

package/scripts/check-gate-qualification.ts

@@ -3455,6 +3455,7 @@ let manifestCount: number;
 		"codex-native": 82,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
+		"demo-reproducibility": 12,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"pi-launch": 9,
@@ -3471,7 +3472,7 @@ let manifestCount: number;
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 28,
+		"herdr-activation": 34,
 		"herdr-plugin-build": 20,
 		"herdr-runtime-bootstrap": 31,
 		"herdr-fresh-call": 38,
@@ -3493,7 +3494,7 @@ let manifestCount: number;
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 22,
+		"release-gate": 24,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 6,