@junghanacs/entwurf 0.34.2 → 0.35.1

package/demo/README.md

@@ -1,193 +1,127 @@
-# entwurf recorded demos
-
-> **Archived pre-0.12 evidence.** These scripts still describe the retired v1 `entwurf` / `entwurf_resume` / `entwurf_send` demo flow. They are kept for historical comparison and will be replaced by a v2-native retake in a post-0.12 follow-up; do not treat them as the current 0.12 runnable recipe.
-
-> **Model ids here are archived, not recommended (2026-08-20).** The `entwurf/gpt-5.4` rows below record what these GIFs actually ran on. They are stale twice over: `entwurf/gpt-5.4` is no longer a curated `entwurf` ACP id at all — that provider serves only the `claude-*` and `cortex-*` rows in `pi-extensions/lib/acp/models.ts` — and the live-spend default has since moved to `openai-codex/gpt-5.6-luna` under a cheaper plan. Read them as a record of the recording, never as a default to copy; the current defaults live in `VERIFY.md` and `NEXT.md`.
-
-Two recorded GIF scripts live here. Both use `asciinema` for capture and
-`agg` for cast → GIF conversion. Both share the same gitignore policy
-(`*.cast` global, `demo/*.gif`, `demo/*.log` — only the `.sh` and this
-README are tracked).
-
-## `demo-baseline.sh` — single-pane baseline + entwurf surface
-
-Historical pre-0.12 demo, still linked from the top-level `README.md` as archived evidence. `package.json#pi.image` now points at the `entwurf` release hero instead. Two scenes driven into one pi pane:
-
-1. **Baseline self-awareness** — the `Q-B0` + `Q-B0-CARRIER` interview,
-   English answer enforced. The pane exposes how the running model
-   names its harness, distinguishes native tools from MCP / custom
-   tools, names the carrier surface for each cited piece of
-   information, and admits unknowns instead of fabricating.
-2. **Entwurf surface** — the same pane spawns a sibling via the
-   `entwurf` tool (`mode=sync`, cross-model — driver `claude-sonnet-5`,
-   sibling `gpt-5.4`), prints the Session ID, and quotes the sibling's
-   one-line reply verbatim.
-
-Run from the repo root (or `demo/`):
+# Recorded demos — source checkout recipes
+
+## Whole Herdr: Pi ↔ native Claude Code (#138)
+
+This is the scene shown by the [README GIF](../README.md). The recording is the **whole
+Herdr client**, with sidebar and tabs, without captions. It observes a real Pi citizen
+opening native Claude Code, receiving its callback, sending one task, and receiving the
+sibling's native Bash result. Camera focus is a view, never an address or delivery receipt.
+
+### Original publication versus a new take
+
+[Original provenance](./herdr-pi-cc-20261011.provenance.json) records the approved GIF hash,
+original cast hash, measured runtime/models, audited source hashes and render arguments.
+The original raw cast, transcripts, native records and full manifests remain private.
+**A fresh checkout cannot replay that original capture.** The command below creates a
+**new LIVE take of the same scene**, not byte-identical GIF reproduction or renewed
+acceptance of the original. Model text, timing, ids and terminal banners vary. The original
+agg/ffprobe versions were not recorded; current tool versions cannot retroactively fill them.
+
+### Prerequisites — no automatic install or repair
+
+Run from an installed development **source checkout**, not an npm consumer. The `.ts`
+takes/helpers/tests are maintainer tooling and are deliberately excluded from the tarball.
+
+- Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
+  current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
+- Pi at the checkout's supported floor (**current floor 1.1.0**); `entwurf` on PATH must be
+  the intended source stable-bin. Source evidence is not registry-package acceptance.
+- `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
+- Herdr's existing Pi integration at
+  `${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}/extensions/herdr-agent-state.ts`.
+- The operator's existing Claude launcher/auth and vendor data at
+  `${XDG_DATA_HOME:-$HOME/.local/share}/claude`. Missing or drifted ownership is a refusal,
+  not permission to install, copy credentials or fix global hooks/settings.
+- For offline rendering only: `agg` and `ffprobe` on PATH. Rendering is optional and
+  requires the original private `take.cast` **and its same-run manifest**.
+
+Selectors for this scene are fixed: Pi `openai-codex/gpt-6.1-sol`, thinking `low`, native
+Claude Code alias `sonnet`. Overrides may only restate these. An OpenRouter base-URL
+redirect is refused before inference; no fallback model or automatic retry is used.
+A requested alias and the native model id observed in its transcript are recorded separately.
+
+### Offline verification first
 
 ```bash
-bash demo/demo-baseline.sh
+./run.sh check-demo-reproducibility
+pnpm exec tsc --noEmit -p scripts/tsconfig.json
 ```
 
-Output lands directly in the publish surface — re-running the script
-overwrites the previous take so the gallery preview always matches the
-current branch:
-
-- `docs/assets/entwurf-demo.cast` — raw asciinema recording (gitignored)
-- `docs/assets/entwurf-demo.gif` — tracked, referenced by the top-level `README.md` as archived pre-0.12 evidence
-- `demo/baseline-debug.log` — `ENTWURF_DEBUG=1` stderr (gitignored, stays next to the script)
+The named source-only floor verb discovers `demo/**/*.test.ts` and runs Node's own test
+runner, including fake-tool/child-process fixtures. It is reached by `pnpm check` and
+`pnpm run check:full`; these are not Vitest tests and are not reached by the adapter beside
+Vitest globs. HOME, writable XDG roots and identity carriers are sandboxed by the verb.
+`agg` and `ffmpeg` are faked, but the renderer/caption fixtures decode real GIF bytes, so
+this floor needs a real `ffprobe` on PATH; without it they fail (`ffprobe ENOENT`) rather
+than skip. CI installs Ubuntu's `ffmpeg` package (which carries `ffprobe`) in the check job.
+The receiving type fence is `scripts/tsconfig.json`, paired with the root `demo` exclusion.
 
-## `demo.sh` — two-pane entwurf flow (regression guard)
+### Explicit new LIVE take
 
-Three-scene entwurf flow used for regression evidence, not for the
-public README. Two pi sessions run side-by-side in one tmux window;
-a background driver types the scene prompts into the sender pane.
-
-1. **Spawn** a sonnet sibling (memory write — "tempered indigo").
-2. **Resume** that same sibling (memory recall — identity preservation,
-   the #9 regression guard).
-3. **Cross-session greeting** via `entwurf_send`. *(Historical: `entwurf_send` was retired in the
-   0.12 cutover, and the "sent box" half of that pairing was never actually reachable — the
-   sender-side renderer had zero producers and was removed in #120 P3. What the recording shows on
-   the receive side is real; the send side is a box the operator could not have seen.)*
-
-Run:
+Only run after deciding to spend real subscription turns:
 
 ```bash
-bash demo/demo.sh
+LIVE=1 node demo/take-herdr-pi-cc.ts
 ```
 
-Output mirrors the baseline demo's layout — recording artifacts land in
-`docs/assets/` so the publish surface and the demo script share one
-naming convention:
+With approved selectors/policy and without `LIVE=1`, it exits 97 **before tool preflight
+or resource creation**. Invalid selectors or an OpenRouter redirect can refuse earlier
+with exit 2, still without tools or writes. Once authorized, it creates a private Herdr
+server/fence, starts the scene, and stops only resources whose
+ownership it can prove. Failure ends observation; it cannot undo a citizen's completed work.
+No automatic retry, rerender or promotion follows a failure. Failed evidence is retained.
 
-- `docs/assets/entwurf-entwurf.cast` — raw asciinema recording (gitignored via global `*.cast`)
-- `docs/assets/entwurf-entwurf.gif` — tracked, referenced by the top-level `README.md` Entwurf section
-- `demo/peer-debug.log` — `ENTWURF_DEBUG=1` stderr from the top pane (gitignored, stays next to the script)
-- `demo/sender-debug.log` — same from the bottom pane
+The fence isolates Herdr XDG state and Entwurf record/mailbox roots, **not the whole host**:
+HOME/auth/vendor stores remain real; the existing Claude data directory is linked into the
+private fence. Pi's control socket and the addressed v2 lock use real `~/.pi/` directories.
+The native transcripts, records and fence are kept, not erased by teardown. Do not run this
+against an operator server or broaden cleanup to unrelated sessions.
 
-Watch debug live (separate terminal, before `bash demo.sh`):
+The default output is `.tmp-verify/138-demo-gifs/takes/<take-id>/` (ignored); an explicit
+`ENTWURF_DEMO_OUT` changes its parent. `manifest.json` contains assertions, camera views,
+raw receipts, measured models and the cast digest. The stage describes source **tooling**;
+`entwurfOnPath` is observed, not checked against this checkout's stable-bin. Confirm that
+binding separately before calling a take source-runtime evidence. Git HEAD and dirty state
+are observed; a dirty HEAD is **not** an immutable source fingerprint.
+Keep the exact source and manifest with any subsequent take you intend to audit.
 
-```bash
-tail -F demo/sender-debug.log demo/peer-debug.log
-```
-
-Quick post-run greps:
-
-```bash
-grep 'entwurf:debug'        demo/sender-debug.log
-grep -E '(entwurf|model-switch)' demo/sender-debug.log
-```
+### Offline rendering and publication boundary
 
-## Tunables (env vars)
-
-### `demo.sh` (entwurf two-pane)
-
-| Var | Default | Meaning |
-|---|---|---|
-| `PEER_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | top pane backend (receives greeting) |
-| `SENDER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | bottom pane backend (drives scenes) |
-| `SCENE_DELAY` | `25` | seconds to wait for each scene's agent work |
-| `WARMUP` | `3` | seconds to wait for both pi banners |
-| `FINAL_PAUSE` | `5` | extra wait after scene 3 (peer reply lag) |
-| `GIF_SPEED` | `2.8` | agg playback multiplier (cast time → GIF time) |
-| `SESSION` | `entwurf-demo` | tmux session name |
-| `OUTDIR` | `demo/` | debug log directory (cast + gif live in `docs/assets/`) |
-
-### `demo-baseline.sh` (single-pane baseline + entwurf)
-
-| Var | Default | Meaning |
-|---|---|---|
-| `DRIVER_MODEL` | `entwurf/claude-sonnet-5` (≡ `pias`) | the driven pane — answers Q-B0 and spawns the sibling |
-| `SIBLING_MODEL` | `entwurf/gpt-5.4` (≡ `piat`) | cross-backend sibling spawned in scene 2 |
-| `SIBLING_CWD` | repo root | cwd passed to the entwurf sibling (drives `<project-context>` injection) |
-| `SCENE1_DELAY` | `60` | seconds for the long English baseline answer |
-| `SCENE2_DELAY` | `30` | seconds for the sync entwurf round-trip |
-| `WARMUP` | `3` | seconds to wait for the pi banner |
-| `FINAL_PAUSE` | `4` | extra wait after scene 2 |
-| `GIF_SPEED` | `2.0` | agg playback multiplier (slower than `demo.sh` — the answer rewards reading) |
-| `GIF_COMPRESS` | `1` | run gifsicle after agg (`0` to skip) |
-| `GIF_LOSSY` | `200` | gifsicle `--lossy` strength (drop to `80` if a future scenario shows artifacts) |
-| `GIF_COLORS` | `64` | gifsicle `--colors` palette size |
-| `SESSION` | `entwurf-baseline-demo` | tmux session name |
-| `OUTDIR` | `demo/` | debug log directory (cast + gif live in `docs/assets/`) |
-
-### Model ↔ alias map
-
-The demo launch lines correspond to your shell aliases:
-
-| Alias | Model id | Use as |
-|---|---|---|
-| `piao` | `entwurf/claude-opus-5` | `SENDER_MODEL` (precision scenes) |
-| `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
-| `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
-| `piat5` | `entwurf/gpt-5.5` | either |
-| `piag` | `entwurf/gemini-3.1-pro-preview` | either |
-
-Each pane runs with `ENTWURF_DEBUG=1` baked in — same shape as
-the aliases — so every spawn/model-switch/entwurf trace lands in the
-debug log files (see below).
-
-Examples:
+Given an existing same-run private take, no model turn is needed:
 
 ```bash
-# Swap peer to gemini
-PEER_MODEL=entwurf/gemini-3.1-pro-preview bash demo.sh
-
-# Faster pacing for short retake
-SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
-
-# All three backends in one demo would need a 3-pane variant — out of scope here.
+node demo/render-take.ts <private-take-dir> <private-output.gif>
 ```
 
-## Prerequisites
-
-- `pi` on PATH (current floor 1.1.0)
-- `entwurf` provider configured + auth ready for the selected sender/peer models
-- `asciinema` installed
-- `agg` installed (optional — only for GIF conversion)
-- `gifsicle` installed (optional — `demo-baseline.sh` post-compress step; skip with `GIF_COMPRESS=0`. On NixOS: `nix-shell -p gifsicle` covers both scripts)
-- `tmux` installed
-
-If you watch the demo live: open another terminal and run
-`tmux attach -t entwurf-demo -r` (read-only attach) **before** the script
-starts recording. Do not attach writable — keystrokes from your terminal
-would collide with the driver.
-
-## Why pre-baked prompts
-
-Each scene's prompt asks the inner agent to discover state itself
-(`entwurf_peers`, prior Session ID from this conversation). So the driver
-script types static strings only — no sessionId injection, no
-output parsing. That's what makes it reproducible.
-
-## Editing scenes
-
-Open `demo.sh`, edit the three `tmux send-keys -t "$SENDER_PANE" -l '...'`
-blocks under the `drive()` function. The `-l` flag tells tmux to send the
-argument literally (no key-name interpretation), so quotes inside the prompt
-are safe as long as you don't use single quotes inside the single-quoted
-argument.
-
-## Tracked vs. ignored
-
-Tracked (committed):
-
-- `demo/demo.sh`
-- `demo/demo-baseline.sh`
-- `demo/README.md`
-- `docs/assets/entwurf-demo.gif` — archived pre-0.12 README demo GIF (no longer `package.json#pi.image`)
-- `docs/assets/entwurf-entwurf.gif` — archived pre-0.12 Entwurf section illustration
-
-Ignored (regenerable recording artifacts — both demos):
-
-- `*.cast` (global rule — applies under `docs/assets/` too)
-- `demo/*.log`
-
-Both demos write their recording artifacts directly into `docs/assets/`
-using the names above. Re-running a demo overwrites the previous take so
-the published preview always matches `main`. The `.cast` source stays
-local (global `*.cast` ignore); only the `.gif` rides the publish surface.
-The `gifsicle` step inside `demo-baseline.sh` makes the take reproducible
-without a manual compression pass — see the Tunables table for tuning the
-lossy/colors flags.
+The renderer verifies cast digest, trims only recorder-only teardown, and promotes the
+private GIF only after agg exits successfully and ffprobe decodes it. Each render keeps a
+uniquely named `.render.cast` beside its output (also on failure), with name/digest in a
+successful sidecar; the original take's `take.render.cast` is never overwritten. Non-live-pass takes
+can render only to a private FAILED name. A mixed subject/teardown event is retained whole.
+The renderer refuses repository `docs/assets/` destinations, including parent-directory
+aliases: **publication is a separate reviewed copy**, never a rendering side effect.
+
+Its email/company-path scan is deliberately narrow, **not a privacy/public-readability
+certificate**: personal paths, hostnames, footers and native progress language can remain.
+The operator approved the original rough pixels with their disclosed limitations. A new
+render requires its own review; it must not overwrite the approved original implicitly.
+The GIF and sidecar rename separately; a crash between them leaves a mismatched pair, not
+atomic two-file publication. Optional `caption-take.ts` produces a separate derivative;
+it is not this uncaptioned publication recipe.
+
+## Other source scenes
+
+`take-pi-durable.ts`, `take-pi-acp.ts` and `take-pi-cc.ts` record **different**, private tmux
+scenes. Each requires its own explicit `LIVE=1` and, like the Herdr scene, refuses a
+non-approved selector or an OpenRouter base-URL redirect first (exit 2, no tools or writes).
+They are not the Herdr GIF's recipe.
+Their helper tests remain in the same offline discovery verb. Original FAILED takes and
+offline rejudgements are distinct evidence, never replacement LIVE acceptance.
+
+## Archived pre-0.12 scripts
+
+`demo-baseline.sh` and `demo.sh` retain their historical bodies for comparison, but now
+**refuse immediately with exit 2**, even with `LIVE=1`. They cannot launch retired v1 flows
+or overwrite today's published assets. Historical commands, selectors and old output paths
+inside those bodies are tombstones, not runnable advice. Scene 3's current deterministic
+delivery proof is `./run.sh check-bridge-delivery`; do not revive the v1 route.

package/demo/demo-baseline.sh

@@ -25,7 +25,11 @@
 
 set -euo pipefail
 
-# ---------- config ----------
+# Hard retirement: the preserved v1 body must never launch or overwrite today's approved GIF.
+printf '%s\n' 'entwurf demo: archived v1 baseline refused; see demo/README.md for the source-only Herdr recipe.' >&2
+exit 2
+
+# ---------- historical body (unreachable) ----------
 SESSION=${SESSION:-entwurf-baseline-demo}
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)

package/demo/demo.sh

@@ -5,7 +5,7 @@
 # retired v1 verbs (`entwurf` / `entwurf_resume` / `entwurf_send`), which the 0.12
 # cutover removed; a run would fail at scene 1. Kept for historical comparison only.
 # See demo/README.md. Scene 3's delivery proof was recovered as a deterministic gate
-# (scripts/check-bridge-delivery.ts); the v2-native retake is a post-0.12 follow-up.
+# (scripts/check-bridge-delivery.ts); current v2-native source recipes live in demo/README.md.
 #
 #
 # MODEL NOTE (2026-08-20). The model ids below are the ARCHIVED values these
@@ -28,7 +28,11 @@
 
 set -euo pipefail
 
-# ---------- config ----------
+# Hard retirement: preserve historical source, not a second runnable v1 route.
+printf '%s\n' 'entwurf demo: archived v1 peer scene refused; see demo/README.md for current source recipes.' >&2
+exit 2
+
+# ---------- historical body (unreachable) ----------
 SESSION=${SESSION:-entwurf-demo}
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." && pwd)

package/demo/herdr-pi-cc-20261011.provenance.json

@@ -0,0 +1,64 @@
+{
+	"schemaVersion": 1,
+	"scene": "whole-Herdr Pi to native Claude Code",
+	"take": "take-herdr-pi-cc-2026-10-11T11-57-22-297Z",
+	"startedAt": "2026-10-11T11:57:22.299Z",
+	"stage": "SOURCE checkout, not an npm consumer",
+	"gif": {
+		"path": "docs/assets/entwurf-demo.gif",
+		"sha256": "b686739b5c68fa458dd47c844711aea0f6ab5819eb3eb5d2850449922fa084c0",
+		"bytes": 1835518,
+		"seconds": 43.5,
+		"width": 1126,
+		"height": 764,
+		"frames": 340,
+		"captions": false
+	},
+	"cast": {
+		"sha256": "bbf8a409c58f8b48e88346d232a66ee41ac0c2acf8e605a3f568fd7d40857cf2",
+		"public": false
+	},
+	"runtime": {
+		"entwurf": "0.34.2",
+		"pi": "1.1.0",
+		"herdr": "0.9.3",
+		"gitHead": "9f4c9983fed1dd0ba619bc5a50f0f5abccefeef4",
+		"gitDirty": true,
+		"measuredPiModel": "openai-codex/gpt-6.1-sol",
+		"requestedClaudeAlias": "sonnet",
+		"measuredClaudeNativeModel": "claude-sonnet-5-5"
+	},
+	"auditedOriginalSourceSha256": {
+		"demo/take-herdr-pi-cc.ts": "f9cd30f1bb5b06236559a9f1283f0e030b300f6a17858d778c40d246327a6349",
+		"demo/lib/take-recorder.ts": "d47d824b90a7265c5ab6e7c4bf313b4f81b27cef836b4ddd15f971f3de386256",
+		"demo/render-take.ts": "f6e68157d7f8fb1f0e00a359efaa04aa30eeca1112ce2571661f39aea826b55d",
+		"demo/lib/herdr-take.ts": "57089d883323b2582aadd7f54f63cfce541f3a2c584bb6940313fbcdc940d83e"
+	},
+	"render": {
+		"aggArgs": [
+			"--idle-time-limit",
+			"2",
+			"--speed",
+			"1",
+			"--last-frame-duration",
+			"8",
+			"--font-size",
+			"14",
+			"--theme",
+			"monokai"
+		],
+		"trimmedTailEvents": 2,
+		"trimmedWhat": "recorder teardown: herdr client exit (alt-screen exit + server shut down line)",
+		"renderedAt": "2026-10-11T11:58:32.828Z",
+		"aggVersion": null,
+		"ffprobeVersion": null,
+		"toolVersionEvidence": "not recorded for this original; current versions cannot fill historical fields"
+	},
+	"limits": [
+		"Original cast, manifests and native records remain private; this tree cannot replay that capture.",
+		"The tracked command is a new LIVE take recipe, not byte-identical reproduction.",
+		"Current maintainer source is amended; original source hashes are historical observations, not a complete import-closure seal.",
+		"Operator approved the rough original pixels; this is not privacy or public-readability certification.",
+		"No claim of 0.35.0 release, published-package acceptance or future Herdr plugin observation follows from this take."
+	]
+}

package/docs/acp-backend-rail.md

@@ -379,9 +379,9 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5-5`, `claude-opus-5-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
-| Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
+| Model authority | per-turn ACP set-model, its answer read back before the prompt | per-turn ACP set-model; an unavailable curated id fails before prompt; the answer is not read back |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
 | Overlay | `CLAUDE_CONFIG_DIR` whitelist, configured-empty hooks, native memory hidden | session-scoped isolated HOME + `SNOWFLAKE_HOME`, private `cortex/mcp.json`, measured-minimum auth passthrough |
 | MCP | explicit wire `mcpServers` | explicit declarations projected to private `mcp.json` because Cortex ignores the wire field |
@@ -390,6 +390,32 @@ operator's repair named.
 
 ### Claude
 
+The unprefixed Claude curation uses exact Opus/Sonnet 5.5 ids; the ACP adapter does
+not route the retired exact ids `claude-opus-5` or `claude-sonnet-5`, alias them to
+a newer model, or rewrite existing session records. Cortex retains its separate
+native 5 ids. Pi owns fuzzy CLI model selection before the adapter: with this
+seven-row set, its 1.1.0 resolver matches the old bare 5 patterns to the Cortex rows
+instead of refusing them (measured with the pure upstream resolver and synthetic rows,
+not a vendor turn). So the launches Entwurf builds admit only an EXACT curated id
+(`pi-extensions/lib/acp/model-ids.js`): `entwurf_fresh_call` with backend `pi` and an
+`entwurf/<id>` model, and `entwurf_resume_call` of a session whose emitted provider is
+`entwurf`, refuse anything else as `acp-model-not-curated` before a pane opens. A human
+typing `pi --model …` keeps the upstream fuzzy behaviour, so use the full 5.5 ids there.
+
+The adapter reads its set-model answer back before the prompt. The driver resolves the
+requested id onto one of the rows it offers and answers with that row's `value` as the
+model option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). Measured on
+2026-10-12 against 0.85.1 with no prompt sent: `claude-fable-5-1` answers its own row,
+while `claude-sonnet-5-5` and `claude-opus-5-5` answer the alias rows `sonnet` and
+`opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row resolves to is not on the
+ACP wire, so `CLAUDE_SET_MODEL_ALIAS_ROWS` (`backend-adapter.ts`) declares, for each
+alias-answered id, the one measured row it is accepted as, value and name together. A
+missing model option, another row, or any other value/name pair refuses the turn before
+the prompt, with text pi does not classify as transient. A curated id added later needs
+its own measured answer before it ships. `check-acp-set-model-readback` holds the
+contract offline; it does not certify the installed driver's runtime, and no 5.5 prompt
+turn is claimed by this measurement.
+
 The bundled adapter resolves before any PATH fallback. Its overlay retains only the
 auth/runtime state required by the Claude Agent SDK and hides operator memory, hooks,
 agents, history, and local settings. Rich project/operator context rides the first-user

package/docs/setup-clean-host.md

@@ -913,7 +913,7 @@ operator-installed Claude runtime. Resolution order:
 2. `require.resolve(...)` against the bundled `@agentclientprotocol/claude-agent-acp`.
 3. `PATH:claude-agent-acp` fallback if package resolution fails.
 
-The curated Claude ids are `claude-opus-5`, `claude-sonnet-5`, and
+The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`, and
 `claude-fable-5-1`. Cortex exposes `cortex-auto`, `cortex-claude-opus-5`,
 `cortex-claude-sonnet-5`, and `cortex-openai-gpt-5.4`.
 `entwurfProvider.cortexConnection` or `ENTWURF_ACP_CORTEX_CONNECTION` selects

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -110,6 +110,44 @@ function resolveClaudeLaunch() {
  * ambient value cannot turn it off. Cortex declares nothing of the kind.
  */
 export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" };
+/**
+ * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
+ * requested id onto one of the rows it offers and answers with that row's `value` as the model
+ * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
+ * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
+ * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
+ * only as the exact measured row, value AND name, declared here for the requested id. No other
+ * spelling is matched.
+ */
+export const CLAUDE_SET_MODEL_ALIAS_ROWS = Object.freeze({
+    "claude-sonnet-5-5": Object.freeze({ value: "sonnet", name: "Sonnet 5.5" }),
+    "claude-opus-5-5": Object.freeze({ value: "opus", name: "Opus 5.5" }),
+});
+/** Refuse unless the set-model answer names the requested model. A missing model option, another
+ *  row, or a row that is not the measured alias row would let a different model answer under this id. */
+export function confirmClaudeSetModelAnswer(response, nativeModelId) {
+    const configOptions = response?.configOptions;
+    const modelOption = Array.isArray(configOptions)
+        ? configOptions.find((option) => option?.id === "model")
+        : undefined;
+    const currentValue = modelOption?.currentValue;
+    if (typeof currentValue === "string" && currentValue === nativeModelId)
+        return;
+    const rows = Array.isArray(modelOption?.options)
+        ? modelOption.options.flatMap((row) => Array.isArray(row?.options) ? row.options : [row])
+        : [];
+    const selected = typeof currentValue === "string" ? rows.find((row) => row?.value === currentValue) : undefined;
+    const alias = CLAUDE_SET_MODEL_ALIAS_ROWS[nativeModelId];
+    if (alias !== undefined && currentValue === alias.value && selected?.name === alias.name)
+        return;
+    const answered = modelOption === undefined
+        ? "no model option"
+        : `model ${jsonText(currentValue)} named ${jsonText(selected?.name ?? null)}`;
+    throw new Error(`entwurf: claude-agent-acp answered set-model ${JSON.stringify(nativeModelId)} with ${answered}, which does not ` +
+        `name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
+        `the installed driver and the curated id disagree, and repeating the turn cannot change that.`);
+}
 export const claudeAdapter = {
     backend: "claude",
     // Claude owns its UNPREFIXED curated ids only (rail “Adapter contract”). The native id
@@ -161,7 +199,12 @@ export const claudeAdapter = {
         if (typeof setConfig !== "function") {
             throw new Error(`setSessionConfigOption unsupported — cannot enforce model ${modelId}`);
         }
-        await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });
+        const answer = await setConfig.call(connection, {
+            sessionId: acpSessionId,
+            configId: "model",
+            value: nativeModelId,
+        });
+        confirmClaudeSetModelAnswer(answer, nativeModelId);
     },
     configSignatureFields(_adapterSettings) {
         // Claude folds no extra backend-specific fields beyond backend + nativeModelId
@@ -302,7 +345,8 @@ export const cortexAdapter = {
     // serves fails loud BEFORE the prompt (`Unsupported model: …`). PR #40's
     // launch-time `-m` pin was retired for this: set-model is the single model
     // authority (resolveLaunch never passes `-m`), and "auto" is set explicitly
-    // rather than treated as an unspoken default.
+    // rather than treated as an unspoken default. NO answer readback, unlike claude: nobody has
+    // measured what cortex's set_config_option response carries, so a check would be a guess.
     async enforceModel({ connection, acpSessionId, nativeModelId, modelId }) {
         const setConfig = connection.setSessionConfigOption;
         if (typeof setConfig !== "function") {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/model-ids.js

@@ -0,0 +1,67 @@
+// ACP plugin — the curated model IDs, and nothing else (#128).
+//
+// This leaf imports NOTHING. `models.ts` builds the registry rows from the pi-ai
+// catalog; the launch seams (`fresh-call-dispatch.ts`, `resume-launch-identity.ts`)
+// only need to know which IDs exist, and they ride the pi-free bridge closure, so
+// they read the IDs here rather than load a vendor catalog to learn them.
+//
+// WHY `.js`: the same reason as `protocol.js`. Both the emit-capable root program
+// (allowJs) and Node --experimental-strip-types resolve an explicit `.js` import
+// literally to this file, so `models.ts` (root fence, `.js` specifiers) and the
+// strip-types gates that load `models.ts` directly reach one SSOT. A `.ts` leaf
+// would need a `.ts` specifier the root config cannot allow.
+//
+// WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
+// case-insensitive substring match among the provider's rows and prefers the
+// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
+// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
+// silently open on the Snowflake Cortex rail instead of the Claude subscription.
+// An exact match against this list is the only admission; nothing is aliased,
+// substituted or rewritten.
+/** The single ACP provider id under which every curated row is registered. */
+export const PROVIDER_ID = "entwurf";
+// The curated Claude ids. Adding one here is a commitment to verify it across
+// both axes (protocol smoke + agent interview) — do not extend casually.
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
+    "claude-sonnet-5-5",
+    "claude-opus-5-5",
+    "claude-fable-5-1",
+]);
+/** The anchor model whose absence is a hard registry regression, not a soft skip. */
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
+// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
+// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+export const CORTEX_MODEL_PREFIX = "cortex-";
+export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+    "cortex-auto",
+    "cortex-claude-opus-5",
+    "cortex-claude-sonnet-5",
+    "cortex-openai-gpt-5.4",
+]);
+/** @type {ReadonlySet<string>} */
+const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+/**
+ * Exact membership only — no trim, no case folding, no prefix.
+ * @param {string} model
+ * @returns {boolean}
+ */
+export function isCuratedAcpModelId(model) {
+    return CURATED_ACP_MODEL_IDS.has(model);
+}
+/** The named refusal both launch seams answer with. */
+export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
+export const ACP_MODEL_NOT_CURATED_HINT = `an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
+    "Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
+    "so nothing was opened, and nothing is aliased or rewritten";
+/** Carries `reason` so callers match a FIELD, never the wording. */
+export class AcpModelNotCuratedError extends Error {
+    /** @param {string} model */
+    constructor(model) {
+        super(`${ACP_MODEL_NOT_CURATED}: ${JSON.stringify(model)} is not an exact curated ${PROVIDER_ID} model id`);
+        this.name = "AcpModelNotCuratedError";
+        /** @readonly */
+        this.reason = ACP_MODEL_NOT_CURATED;
+        /** @readonly */
+        this.model = model;
+    }
+}