@junghanacs/entwurf 0.34.2 → 0.35.1

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -32,8 +32,11 @@
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
 import { getModels } from "@earendil-works/pi-ai/compat";
-/** Provider id — current pre-rename surface; S1 renames this load-bearing id to `entwurf`. */
-export const PROVIDER_ID = "entwurf";
+import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-ids.js";
+// The provider id and the curated ID lists live in the dependency-free
+// `model-ids.js` leaf, shared with the launch seams (#128); this file is the only
+// one that loads the upstream catalog to turn them into registry rows.
+export { CORTEX_MODEL_PREFIX, CURATED_ANCHOR_MODEL_ID, PROVIDER_ID, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./model-ids.js";
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
 // provider defines custom models, but the ACP plugin consumes NO key: backend
 // auth belongs to the operator's own Claude CLI child process (AGENTS
@@ -45,15 +48,8 @@ export const PROVIDER_ID = "entwurf";
 // — that silences the warning but keeps the wrong auth-boundary shape. The
 // check-auth-boundary gate pins this.
 export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
-// The curated Claude ids. Adding one here is a commitment to verify it across
-// both axes (protocol smoke + agent interview) — do not extend casually.
-// Exported so the claude backend adapter (backend-adapter.ts) can answer
-// `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
-/** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
-// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5.5, Opus 5.5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window was the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.
@@ -82,7 +78,7 @@ function claudeContextWindow(model) {
 // carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
 // authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
 // native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5` the claude adapter owns). `routeModel` strips the prefix to
+// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
 // recover the native id, which is enforced per-turn via
 // session/set_config_option — never a launch `-m` pin (CP0-M).
 //
@@ -91,14 +87,7 @@ function claudeContextWindow(model) {
 // the running cortex no longer serves fails LOUD at set-model, before the
 // prompt (measured: `Unsupported model: …` names the live set). Adding an id
 // here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually.
-export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = [
-    "cortex-auto",
-    "cortex-claude-opus-5",
-    "cortex-claude-sonnet-5",
-    "cortex-openai-gpt-5.4",
-];
+// extend casually. The prefix and the four ids are declared in model-ids.js.
 // Hand-set conservative context window. Cortex reports the LIVE window via its
 // own ACP session config, not this curated metadata — this is a floor for the
 // registry surface, deliberately not inflated to the Claude 1M.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-visible-resume.js

@@ -46,6 +46,7 @@
  * a resume runs no turn (measured — the transcript stayed byte-identical), so there is no turn
  * outcome for this module to claim.
  */
+import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
 import { ResumeBackendUnsupportedError, resolveResumeLaunchIdentity, } from "./resume-launch-identity.js";
@@ -129,6 +130,15 @@ export async function visibleResume(targetGardenId, deps) {
             identity = deps.resolveIdentity(targetGardenId);
         }
         catch (err) {
+            // #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
+            // by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+            if (err instanceof AcpModelNotCuratedError) {
+                return {
+                    ok: false,
+                    reason: err.reason,
+                    detail: `${targetGardenId} would launch model ${JSON.stringify(err.model)} under the entwurf provider (the resolved launch pair, which may differ from the recorded provider)`,
+                };
+            }
             if (err instanceof ResumeBackendUnsupportedError) {
                 return {
                     ok: false,
@@ -210,6 +220,7 @@ export async function observeSameGidSocket(targetGardenId, socketPath, deps, tim
 const REJECT_HINT = {
     "target-invalid": "no citizen has that id; discover targets with entwurf_peers",
     "target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "target-locked": "another resume or dispatch holds this citizen's lock right now",
     "target-live": "that citizen is already running — this verb only reopens dormant ones",
     "target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-dispatch.js

@@ -24,8 +24,9 @@
  * the one address path, on both rails.
  */
 import { spawn as spawnChildProcess } from "node:child_process";
+import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.js";
-import { mintNonce } from "./fresh-call-composition.js";
+import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.js";
 import { createHerdrRunner, herdrFreshCall, renderHerdrFreshCall, resolveHerdrContext, } from "./herdr-fresh-call.js";
 import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 /** herdr's own marker, read for its EXACT value. `[측정 2026-09-14]` herdr exports `HERDR_ENV=1`
@@ -33,6 +34,25 @@ import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 export function selectFreshCallRail(env) {
     return env.HERDR_ENV === "1" ? "herdr" : "tmux";
 }
+/**
+ * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
+ * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
+ * would open on `cortex-claude-sonnet-5` — another vendor and billing rail — with a receipt that
+ * still names the requested id. Asked here, at the one root both rails share, so neither rail can
+ * forget it. It reads the model the way the rails will (trimmed), and only a model that already
+ * passes their grammar: a malformed one keeps its own `model-invalid` answer from the rail.
+ */
+export function isUncuratedEntwurfPiModel(backend, model) {
+    if (backend !== "pi")
+        return false;
+    const trimmed = model.trim();
+    if (!isSafeFreshCallModel(trimmed))
+        return false;
+    const slash = trimmed.indexOf("/");
+    if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID)
+        return false;
+    return !isCuratedAcpModelId(trimmed.slice(slash + 1));
+}
 /**
  * Open a sibling on whichever rail this process is actually standing in.
  *
@@ -49,6 +69,12 @@ export function selectFreshCallRail(env) {
  * them rather than inheriting a rule from a topology it does not share.
  */
 export async function dispatchFreshCall(request, env = process.env, spawn, nonce = mintNonce()) {
+    // Before either rail is asked anything: both would open a pane on the wrong row.
+    if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
+        return selectFreshCallRail(env) === "herdr"
+            ? { rail: "herdr", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } }
+            : { rail: "tmux", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } };
+    }
     if (selectFreshCallRail(env) === "herdr") {
         const context = resolveHerdrContext(env);
         if (!context.ok) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -789,6 +789,9 @@ const HERDR_REJECT_HINT = {
     "caller-identity-unavailable": "this surface has no record-backed identity, so a sibling would have nowhere to call home",
     "model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
     "model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",
+    // #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
+    // import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
+    "acp-model-not-curated": "an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
     "task-empty": "a sibling opened with nothing to do is a window nobody asked for",
     "task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
     "herdr-context-missing": "HERDR_ENV/HERDR_BIN_PATH are absent, so this process is not inside herdr and this rail does not exist here",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -85,6 +85,7 @@
  *     the session the window is actually in. It still reports no `pane_current_path`, and
  *     there is no "session created" field because nothing here creates one.
  */
+import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
 import { callbackEnvAssignments } from "./callback-env.js";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
@@ -490,6 +491,7 @@ const REJECT_HINT = {
     "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "task-empty": "task is empty after trimming",
     "task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
     "runtime-unresolved": "the backend's runtime is not installed on PATH",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/resume-launch-identity.js

@@ -19,11 +19,12 @@
  */
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { AcpModelNotCuratedError, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { getEntwurfExplicitExtensions, readSessionIdentity } from "./entwurf-core.js";
 import { readAddressableMetaIdentity } from "./meta-session.js";
 /**
- * The ONE expected refusal on this leaf: the target is a citizen of a backend that has no
- * same-id resume at all.
+ * One of the TWO expected refusals on this leaf: the target is a citizen of a backend that has no
+ * same-id resume at all. The other is `AcpModelNotCuratedError` (#128, `acp/model-ids.js`).
  *
  * Everything else this function throws is a defect in the record, the transcript or the
  * environment — a stale path, a foreign session file, an unrecorded model, an unresolvable
@@ -126,11 +127,19 @@ export function resolveResumeLaunchIdentity(gardenId) {
     if (!identity.cwd) {
         throw new Error(`resume-launch-identity: ${gardenId} header has no cwd (the cold-resume authority, #9).`);
     }
+    // #128: the pair checked is the one the launch will EMIT, not the recorded provider alone —
+    // `getEntwurfExplicitExtensions` also routes a bare Claude model id to `entwurf`. Under that
+    // provider Pi resolves `--model` by substring, so a retired `claude-sonnet-5` would reopen on
+    // `cortex-claude-sonnet-5`. The record and transcript stay as they are; the resume is refused.
+    const provider = explicitExtensions.provider ?? identity.provider;
+    const model = explicitExtensions.modelOverride ?? resumeModel;
+    if (provider === PROVIDER_ID && !isCuratedAcpModelId(model))
+        throw new AcpModelNotCuratedError(model);
     return {
         sessionFile,
         cwd: identity.cwd,
         explicitExtensionArgs: explicitExtensions.args,
-        provider: explicitExtensions.provider ?? identity.provider,
-        model: explicitExtensions.modelOverride ?? resumeModel,
+        provider,
+        model,
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js

@@ -58,6 +58,24 @@
  * vanished signal, a failed ring, a rejected admission or close retires the doorbell — watch
  * closed, our own marker removed, the reason kept by name — and nothing retries it.
  *
+ * WITHDRAW (#140). Each notice is a native `followUp`, placed one per run; a read drains EVERY
+ * unread body. So after a read the notices still queued for that mail would each cost a turn and an
+ * empty read. The contact keeps the native `Submission` handle of each notice it admitted, with the
+ * `.msg` names that notice announced, only while that mail is unread. After every
+ * `entwurf_inbox_read` attempt — whatever its garden id or outcome — it lists its OWN mailbox once
+ * and withdraws, through the native `Submission.abort` and the read's own invocation Context, each
+ * notice none of whose names is still `.msg.delivered`. That per-notice file predicate is the only
+ * authority: no garden-id guard, no requestId lookup, no queue of our own, no rewritten text. A placed
+ * or settled notice answers so and is let go; a withdraw that fails is let go too, named in one
+ * stderr line and on the receiver report, never retried and never retiring the doorbell; a mailbox
+ * that cannot be listed proves nothing absent, so every notice is kept and that is named the same
+ * way. The read's own result or error is returned unchanged — no diagnostic joins it. Ring passes
+ * and reads share one gate: a read waits for an admission in flight (else its drain could beat the
+ * handle it must withdraw), and an arrival during a read is rung once the read lets go. The count
+ * in a notice is its admission-time snapshot. Not covered: notices admitted before a restart (no
+ * handle), mail drained by another process (until this contact's next read), and operator abort,
+ * which natively withdraws queued notices while their mail stays unread.
+ *
  * VISIBLE IDENTITY (a static projection). `withGardenIdentity` hands the native TUI a view whose
  * every conversation label carries this citizen's garden id, so the footer the TUI keeps on screen
  * names the citizen; the bootstrap composes it only after birth succeeded. That is evidence of what
@@ -79,7 +97,8 @@
  *
  * NOT HERE: crash-safe receive. `entwurf_inbox_read` archives a body before the durable tool
  * result commits, so a crash between the two loses that body to the model; recovery settles the
- * call as interrupted and no doorbell rings again. No resume.
+ * call as interrupted and no doorbell rings again. A drain that fails part-way has archived the
+ * bodies before it (the bridge returns its error), and those too never reach the model. No resume.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -461,7 +480,8 @@ export function createPiDurableContact(options) {
                 throw new Error(`${name} arguments must be an object`);
             }
             const client = await waitReady(context?.abortSignal);
-            const result = await client.callTool(name, (args ?? {}), context?.abortSignal);
+            const call = () => client.callTool(name, (args ?? {}), context?.abortSignal);
+            const result = name === "entwurf_inbox_read" ? await readInbox(call, context) : await call();
             if (result.isError)
                 throw new Error(result.text || `${name} failed`);
             return { content: [{ type: "text", text: result.text }] };
@@ -475,8 +495,33 @@ export function createPiDurableContact(options) {
     let doorbell = null;
     let report = { status: "off" };
     const admissions = [];
-    let ringing = false;
+    /** The armed mailbox, kept past a retirement so notices admitted before it can still be judged. */
+    let inbox = null;
+    /** Every admitted notice still owed a withdraw judgement, oldest first. */
+    const notices = [];
+    let withdrawalFailure;
+    // One gate for ring passes and inbox reads; `pending` is a signal that landed while it was held.
+    let gated = false;
     let pending = false;
+    const gateWaiters = [];
+    const enterGate = () => {
+        if (!gated) {
+            gated = true;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => gateWaiters.push(resolve));
+    };
+    /** Hand the gate to the next waiting read, else open it — and ring once for a signal that landed meanwhile. */
+    const leaveGate = () => {
+        const next = gateWaiters.shift();
+        if (next !== undefined) {
+            next();
+            return;
+        }
+        gated = false;
+        if (pending)
+            void ring("signal");
+    };
     /**
      * Give the doorbell back: close the watch and remove the marker, in one step, because a
      * closed watch under a surviving marker is the false deliverability this unit refuses. Only a
@@ -520,20 +565,20 @@ export function createPiDurableContact(options) {
     /**
      * One contract with the other self-fetch doorbells: a fresh `*.msg` is the trigger, it is
      * stamped `.msg.delivered` before the announce, and the announced count is every
-     * `.msg.delivered`. Events that land while an admission is in flight coalesce into one more
-     * pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg` rings —
-     * the startup pass included — so a `.msg.delivered` left undrained by an earlier host is not
-     * announced again on its own; it shows only in the count of the next fresh arrival.
+     * `.msg.delivered`. Events that land while an admission or an inbox read holds the gate coalesce
+     * into one more pass. A failed pass retires the doorbell; it is not retried. Only a fresh `.msg`
+     * rings — the startup pass included — so a `.msg.delivered` left undrained by an earlier host is
+     * not announced again on its own; it shows only in the count of the next fresh arrival.
      */
     const ring = async (why) => {
         const armed = doorbell;
         if (armed === null)
             return;
-        if (ringing) {
+        if (gated) {
             pending = true;
             return;
         }
-        ringing = true;
+        gated = true;
         try {
             do {
                 pending = false;
@@ -568,13 +613,73 @@ export function createPiDurableContact(options) {
                 }
                 // Latest only: the diagnostic names the LAST success and never grows with the host's lifetime.
                 admissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });
+                notices.push({ requestId, fresh, submission });
             } while (pending && doorbell === armed);
         }
         catch (error) {
             retire("doorbell-failed", describeError(error));
         }
         finally {
-            ringing = false;
+            leaveGate();
+        }
+    };
+    /**
+     * One named stderr line per failed withdrawal — stderr ALWAYS, as `entwurf-control` does, since
+     * nothing in the native app reads the receiver report — and the report keeps the latest one.
+     */
+    const noteWithdrawalFailure = (failure) => {
+        withdrawalFailure = failure;
+        const subject = failure.requestId === undefined ? "" : ` ${failure.requestId}`;
+        const detail = failure.detail.replace(/\s+/g, " ");
+        process.stderr.write(`[entwurf pi-durable] notice withdrawal ${failure.reason}${subject}: ${detail}\n`);
+    };
+    /**
+     * Withdraw every held notice none of whose announced `.msg` names is still `.msg.delivered` in the
+     * armed mailbox, listed once. A mailbox that cannot be listed proves nothing absent: every notice
+     * is kept and that is named. A judged notice is let go whatever the native withdraw answers — or
+     * when it rejects, which is named and never retried — so no handle outlives its mail by more
+     * than one read. Never throws: the read's own answer is what the caller gets.
+     */
+    const withdrawDrained = async (context) => {
+        if (inbox === null || notices.length === 0)
+            return;
+        let unread;
+        try {
+            unread = new Set(fs.readdirSync(inbox).filter((name) => name.endsWith(".msg.delivered")));
+        }
+        catch (error) {
+            noteWithdrawalFailure({ reason: "inspection-failed", detail: `${inbox}: ${describeError(error)}` });
+            return;
+        }
+        for (const notice of [...notices]) {
+            if (notice.fresh.some((name) => unread.has(`${name}.delivered`)))
+                continue;
+            notices.splice(notices.indexOf(notice), 1);
+            try {
+                await notice.submission.abort(context);
+            }
+            catch (error) {
+                noteWithdrawalFailure({ reason: "abort-failed", requestId: notice.requestId, detail: describeError(error) });
+            }
+        }
+    };
+    /**
+     * An inbox read under the doorbell's gate, then the withdrawal its drain made due — after a
+     * failed read too, whose partial drain may already have archived mail. The bridge's own answer,
+     * result or rejection, is returned unchanged.
+     */
+    const readInbox = async (call, context) => {
+        await enterGate();
+        try {
+            return await call();
+        }
+        finally {
+            try {
+                await withdrawDrained(context);
+            }
+            finally {
+                leaveGate();
+            }
         }
     };
     /**
@@ -615,6 +720,7 @@ export function createPiDurableContact(options) {
                 receiversDir: roots.receiversDir,
             });
             doorbell = { gardenId, ownerPid, mailbox, signal, markerPath, watcher, submitToRoot };
+            inbox = mailbox;
             report = { status: "armed", gardenId, markerPath, admissions };
             return markerPath;
         }
@@ -731,13 +837,15 @@ export function createPiDurableContact(options) {
             settleFailed(describeError(error));
         },
         receiver() {
-            return report;
+            return withdrawalFailure === undefined || report.status === "off" ? report : { ...report, withdrawalFailure };
         },
         async close() {
             const previous = state;
             settleFailed("the contact closed before attach completed");
             state = { kind: "closed" };
             const client = previous.kind === "ready" ? previous.client : undefined;
+            // Queued notices stay native (a continued session places them); this contact judges no more.
+            notices.length = 0;
             await closeAll(disarmOnClose, async () => {
                 await client?.close();
             });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.34.2",
+	"version": "0.35.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -40,6 +40,8 @@
 		"scripts/",
 		"prompts/",
 		"demo/README.md",
+		"demo/herdr-pi-cc-20261011.provenance.json",
+		"!demo/**/*.ts",
 		"demo/demo.sh",
 		"demo/demo-baseline.sh",
 		"docs/setup-clean-host.md",
@@ -186,7 +188,7 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -339,6 +339,50 @@ function resolveClaudeLaunch(): AcpLaunchSpec {
  */
 export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" } as const;
 
+/**
+ * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
+ * requested id onto one of the rows it offers and answers with that row's `value` as the model
+ * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
+ * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
+ * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
+ * only as the exact measured row, value AND name, declared here for the requested id. No other
+ * spelling is matched.
+ */
+export const CLAUDE_SET_MODEL_ALIAS_ROWS: Readonly<Record<string, Readonly<{ value: string; name: string }>>> =
+	Object.freeze({
+		"claude-sonnet-5-5": Object.freeze({ value: "sonnet", name: "Sonnet 5.5" }),
+		"claude-opus-5-5": Object.freeze({ value: "opus", name: "Opus 5.5" }),
+	});
+
+/** Refuse unless the set-model answer names the requested model. A missing model option, another
+ *  row, or a row that is not the measured alias row would let a different model answer under this id. */
+export function confirmClaudeSetModelAnswer(response: unknown, nativeModelId: string): void {
+	const configOptions = (response as { configOptions?: unknown } | null | undefined)?.configOptions;
+	const modelOption = Array.isArray(configOptions)
+		? (configOptions as Array<Record<string, unknown> | null>).find((option) => option?.id === "model")
+		: undefined;
+	const currentValue = modelOption?.currentValue;
+	if (typeof currentValue === "string" && currentValue === nativeModelId) return;
+	const rows = Array.isArray(modelOption?.options)
+		? (modelOption.options as Array<Record<string, unknown> | null>).flatMap((row) =>
+				Array.isArray(row?.options) ? (row.options as Array<Record<string, unknown> | null>) : [row],
+			)
+		: [];
+	const selected = typeof currentValue === "string" ? rows.find((row) => row?.value === currentValue) : undefined;
+	const alias = CLAUDE_SET_MODEL_ALIAS_ROWS[nativeModelId];
+	if (alias !== undefined && currentValue === alias.value && selected?.name === alias.name) return;
+	const answered =
+		modelOption === undefined
+			? "no model option"
+			: `model ${jsonText(currentValue)} named ${jsonText(selected?.name ?? null)}`;
+	throw new Error(
+		`entwurf: claude-agent-acp answered set-model ${JSON.stringify(nativeModelId)} with ${answered}, which does not ` +
+			`name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
+			`the installed driver and the curated id disagree, and repeating the turn cannot change that.`,
+	);
+}
+
 export const claudeAdapter: AcpBackendAdapter = {
 	backend: "claude",
 
@@ -402,7 +446,12 @@ export const claudeAdapter: AcpBackendAdapter = {
 		if (typeof setConfig !== "function") {
 			throw new Error(`setSessionConfigOption unsupported — cannot enforce model ${modelId}`);
 		}
-		await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });
+		const answer = await setConfig.call(connection, {
+			sessionId: acpSessionId,
+			configId: "model",
+			value: nativeModelId,
+		});
+		confirmClaudeSetModelAnswer(answer, nativeModelId);
 	},
 
 	configSignatureFields(_adapterSettings) {
@@ -566,7 +615,8 @@ export const cortexAdapter: AcpBackendAdapter = {
 	// serves fails loud BEFORE the prompt (`Unsupported model: …`). PR #40's
 	// launch-time `-m` pin was retired for this: set-model is the single model
 	// authority (resolveLaunch never passes `-m`), and "auto" is set explicitly
-	// rather than treated as an unspoken default.
+	// rather than treated as an unspoken default. NO answer readback, unlike claude: nobody has
+	// measured what cortex's set_config_option response carries, so a check would be a guess.
 	async enforceModel({ connection, acpSessionId, nativeModelId, modelId }) {
 		const setConfig = connection.setSessionConfigOption;
 		if (typeof setConfig !== "function") {

package/pi-extensions/lib/acp/model-ids.js

@@ -0,0 +1,77 @@
+// ACP plugin — the curated model IDs, and nothing else (#128).
+//
+// This leaf imports NOTHING. `models.ts` builds the registry rows from the pi-ai
+// catalog; the launch seams (`fresh-call-dispatch.ts`, `resume-launch-identity.ts`)
+// only need to know which IDs exist, and they ride the pi-free bridge closure, so
+// they read the IDs here rather than load a vendor catalog to learn them.
+//
+// WHY `.js`: the same reason as `protocol.js`. Both the emit-capable root program
+// (allowJs) and Node --experimental-strip-types resolve an explicit `.js` import
+// literally to this file, so `models.ts` (root fence, `.js` specifiers) and the
+// strip-types gates that load `models.ts` directly reach one SSOT. A `.ts` leaf
+// would need a `.ts` specifier the root config cannot allow.
+//
+// WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
+// case-insensitive substring match among the provider's rows and prefers the
+// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
+// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
+// silently open on the Snowflake Cortex rail instead of the Claude subscription.
+// An exact match against this list is the only admission; nothing is aliased,
+// substituted or rewritten.
+
+/** The single ACP provider id under which every curated row is registered. */
+export const PROVIDER_ID = "entwurf";
+
+// The curated Claude ids. Adding one here is a commitment to verify it across
+// both axes (protocol smoke + agent interview) — do not extend casually.
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
+	"claude-sonnet-5-5",
+	"claude-opus-5-5",
+	"claude-fable-5-1",
+]);
+
+/** The anchor model whose absence is a hard registry regression, not a soft skip. */
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
+
+// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
+// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+export const CORTEX_MODEL_PREFIX = "cortex-";
+export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+	"cortex-auto",
+	"cortex-claude-opus-5",
+	"cortex-claude-sonnet-5",
+	"cortex-openai-gpt-5.4",
+]);
+
+/** @type {ReadonlySet<string>} */
+const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+
+/**
+ * Exact membership only — no trim, no case folding, no prefix.
+ * @param {string} model
+ * @returns {boolean}
+ */
+export function isCuratedAcpModelId(model) {
+	return CURATED_ACP_MODEL_IDS.has(model);
+}
+
+/** The named refusal both launch seams answer with. */
+export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
+
+export const ACP_MODEL_NOT_CURATED_HINT =
+	`an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
+	"Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
+	"so nothing was opened, and nothing is aliased or rewritten";
+
+/** Carries `reason` so callers match a FIELD, never the wording. */
+export class AcpModelNotCuratedError extends Error {
+	/** @param {string} model */
+	constructor(model) {
+		super(`${ACP_MODEL_NOT_CURATED}: ${JSON.stringify(model)} is not an exact curated ${PROVIDER_ID} model id`);
+		this.name = "AcpModelNotCuratedError";
+		/** @readonly */
+		this.reason = ACP_MODEL_NOT_CURATED;
+		/** @readonly */
+		this.model = model;
+	}
+}