@junghanacs/entwurf 0.35.0 → 0.36.0

package/demo/README.md

@@ -24,7 +24,7 @@ takes/helpers/tests are maintainer tooling and are deliberately excluded from th
 
 - Node at the `package.json#engines.node` floor; the checkout's pinned dependencies and
   current compiled bridge. After a source/bootstrap change, build with `pnpm run build-bridge`.
-- Pi at the checkout's supported floor (**current floor 1.1.0**); `entwurf` on PATH must be
+- Pi at the checkout's supported floor (**current floor 1.2.0**); `entwurf` on PATH must be
   the intended source stable-bin. Source evidence is not registry-package acceptance.
 - `herdr` on PATH at exactly `scripts/fixtures/herdr-supply.json#version`; `asciinema` v3.
 - Herdr's existing Pi integration at

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | SDK exact `1.1.0`, host `>=1.1.0 <1.2` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #132's 1.1.0 move (ROADMAP's 2026-10-08 bump entry) has its own acceptance still owed. Historical: the published 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
+| pi runtime | SDK exact `1.2.0`, host `>=1.2.0 <1.3` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: #141's 1.2.0 move has its own acceptance still owed. Historical: the published 0.33.0 through 0.35.1 ship SDK exact 1.1.0, 0.32.0 ships SDK exact 1.0.4 with the next-minor ceiling (ROADMAP's 2026-10-07 bump entry), and 0.31.0 declared the earlier peer floor 1.0.2 |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
@@ -379,9 +379,9 @@ operator's repair named.
 
 | Seam | Claude | Cortex Code |
 |---|---|---|
-| Model ids | unprefixed `claude-sonnet-5`, `claude-opus-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
+| Model ids | unprefixed `claude-sonnet-5-5`, `claude-opus-5-5`, `claude-fable-5-1` | `cortex-auto`, `cortex-claude-opus-5`, `cortex-claude-sonnet-5`, `cortex-openai-gpt-5.4`; prefix stripped before set-model |
 | Launch | bundled `claude-agent-acp`; `CLAUDE_AGENT_ACP_COMMAND` override | `cortex acp serve`; optional connection; `CORTEX_ACP_COMMAND` override; never a launch-time `-m` |
-| Model authority | per-turn ACP set-model | per-turn ACP set-model; an unavailable curated id fails before prompt |
+| Model authority | per-turn ACP set-model, its answer read back before the prompt | per-turn ACP set-model; an unavailable curated id fails before prompt; the answer is not read back |
 | Carrier | engraving in `_meta.systemPrompt` | no system-prompt carrier; engraving rides the first-user augment |
 | Overlay | `CLAUDE_CONFIG_DIR` whitelist, configured-empty hooks, native memory hidden | session-scoped isolated HOME + `SNOWFLAKE_HOME`, private `cortex/mcp.json`, measured-minimum auth passthrough |
 | MCP | explicit wire `mcpServers` | explicit declarations projected to private `mcp.json` because Cortex ignores the wire field |
@@ -390,6 +390,32 @@ operator's repair named.
 
 ### Claude
 
+The unprefixed Claude curation uses exact Opus/Sonnet 5.5 ids; the ACP adapter does
+not route the retired exact ids `claude-opus-5` or `claude-sonnet-5`, alias them to
+a newer model, or rewrite existing session records. Cortex retains its separate
+native 5 ids. Pi owns fuzzy CLI model selection before the adapter: with this
+seven-row set, its 1.1.0 resolver matches the old bare 5 patterns to the Cortex rows
+instead of refusing them (measured with the pure upstream resolver and synthetic rows,
+not a vendor turn). So the launches Entwurf builds admit only an EXACT curated id
+(`pi-extensions/lib/acp/model-ids.js`): `entwurf_fresh_call` with backend `pi` and an
+`entwurf/<id>` model, and `entwurf_resume_call` of a session whose emitted provider is
+`entwurf`, refuse anything else as `acp-model-not-curated` before a pane opens. A human
+typing `pi --model …` keeps the upstream fuzzy behaviour, so use the full 5.5 ids there.
+
+The adapter reads its set-model answer back before the prompt. The driver resolves the
+requested id onto one of the rows it offers and answers with that row's `value` as the
+model option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). Measured on
+2026-10-12 against 0.85.1 with no prompt sent: `claude-fable-5-1` answers its own row,
+while `claude-sonnet-5-5` and `claude-opus-5-5` answer the alias rows `sonnet` and
+`opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row resolves to is not on the
+ACP wire, so `CLAUDE_SET_MODEL_ALIAS_ROWS` (`backend-adapter.ts`) declares, for each
+alias-answered id, the one measured row it is accepted as, value and name together. A
+missing model option, another row, or any other value/name pair refuses the turn before
+the prompt, with text pi does not classify as transient. A curated id added later needs
+its own measured answer before it ships. `check-acp-set-model-readback` holds the
+contract offline; it does not certify the installed driver's runtime, and no 5.5 prompt
+turn is claimed by this measurement.
+
 The bundled adapter resolves before any PATH fallback. Its overlay retains only the
 auth/runtime state required by the Claude Agent SDK and hides operator memory, hooks,
 agents, history, and local settings. Rich project/operator context rides the first-user

package/docs/setup-clean-host.md

@@ -28,8 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.1.0 <1.2` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): a pinned upstream v1.1.0 app carrier plus the exact 1.1.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence, `>=1.2.0 <1.3` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.2.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -209,7 +209,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.1.0
+npm install -g @earendil-works/pi-coding-agent@1.2.0
 pi --version
 
 cd ~/entwurf-smoke
@@ -217,7 +217,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.1.0 <1.2`. It is a hard minimum: installing this
+The supported range is `>=1.2.0 <1.3`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -313,23 +313,22 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 What the Entwurf package supplies:
 
 1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.1.0`, plus
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.2.0`, plus
    `proper-lockfile`, as Entwurf's own production dependencies (declared once in
    `pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
    `pi-ai`; there is no catalog copy.
 2. **The native app/TUI carrier** — upstream does not publish the experimental durable
    app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
-   library). Entwurf ships the six pinned app files from upstream tag `v1.1.0`
-   (`abe508e1b89912adde45528136c3221eb69acdd7`), its narrow runtime-contact overlay
-   applied to `runtime.ts`, type-stripped and relocated, in `pi/pi-durable/carrier/`
+   library). Entwurf owns the six app files as canonical source (`pi/pi-durable/src`,
+   first taken from upstream tag `v1.1.0` `abe508e1b89912adde45528136c3221eb69acdd7`) and ships them type-stripped and relocated in `pi/pi-durable/carrier/`
    with upstream's MIT license. Each file's source blob and emitted digest are in the pin.
    The carrier reaches pi-coding-agent's internals only through its resolver
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/durable/README.md)
-and [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
-describe what the carrier is. Running the bare upstream app does not attach Entwurf's
+The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.2.0/packages/durable/README.md)
+and the [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
+(last published at v1.1.0) describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
 proxy a subscription; native execution, models, auth, queues, SQLite and recovery stay
 upstream-owned.
@@ -411,7 +410,7 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.1.0 <1.2`): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.2.0 <1.3`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
 carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
@@ -424,19 +423,28 @@ proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
 ### Maintainer: re-emitting the carrier
 
-Only a maintainer moving the pin runs `scripts/emit-pi-durable-carrier.ts`. It reads the
-pinned commit's objects (`<commit>:<path>`, `--no-replace-objects`) from a repository the
-maintainer names, applies the overlay patch with `git apply` in a private scratch tree,
-type-strips with Node's own strip-only TypeScript, relocates, and checks that the six files
-import exactly the pin's declared `distTargets`:
+Only a maintainer changing the pi-durable app runs `scripts/emit-pi-durable-carrier.ts`. Its
+input is Entwurf's own source in this repository (`pi/pi-durable/src`, #141, typechecked by
+`pi/pi-durable/tsconfig.json` against the installed SDK's declarations): it type-strips with
+Node's own strip-only TypeScript, relocates, and checks that the six files import exactly the
+pin's declared `distTargets`:
 
 ```bash
-node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --write
-node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --check  # rebuild equality
+node scripts/emit-pi-durable-carrier.ts --write   # names every generated field it changes
+node scripts/emit-pi-durable-carrier.ts --check   # rebuild equality
+node scripts/emit-pi-durable-carrier.ts --origin <clone holding origin.commit>  # provenance only
 ```
 
-`--check` without such a repository is a named SKIP, never rebuild acceptance; the emitter
-version (Node) is part of the pin.
+A missing source file is a named refusal, never a skip. The byte comparison also runs as a
+beside claim on every floor. The emitter's Node is part of the pin: under another Node,
+`--check` compares the bytes and then reports the identity as a named SKIP, never rebuild
+acceptance; the CI `check` job runs the pinned Node with `ENTWURF_REQUIRE_EMITTER_NODE=1`, where
+a mismatch is red. `--origin` checks the frozen `origin` record against the upstream objects
+it names (`<commit>:<path>`, `--no-replace-objects`) and never feeds a rebuild.
+
+The owned source is formatted at upstream width (`biome.json` override, indentWidth 3), with no
+per-file exception. A formatting change to an owned file changes its emitted bytes. So it is
+re-emitted with `--write`, and its generated digest is reviewed like any other carrier change.
 
 ## 3. Optional Claude Code native citizen
 
@@ -601,7 +609,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.1.0 <1.2`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.2.0 <1.3`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and
@@ -913,7 +921,7 @@ operator-installed Claude runtime. Resolution order:
 2. `require.resolve(...)` against the bundled `@agentclientprotocol/claude-agent-acp`.
 3. `PATH:claude-agent-acp` fallback if package resolution fails.
 
-The curated Claude ids are `claude-opus-5`, `claude-sonnet-5`, and
+The curated Claude ids are `claude-opus-5-5`, `claude-sonnet-5-5`, and
 `claude-fable-5-1`. Cortex exposes `cortex-auto`, `cortex-claude-opus-5`,
 `cortex-claude-sonnet-5`, and `cortex-openai-gpt-5.4`.
 `entwurfProvider.cortexConnection` or `ENTWURF_ACP_CORTEX_CONNECTION` selects

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -110,6 +110,44 @@ function resolveClaudeLaunch() {
  * ambient value cannot turn it off. Cortex declares nothing of the kind.
  */
 export const CLAUDE_FOREGROUND_ONLY_ENV = { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" };
+/**
+ * The set-model answer is read back before the prompt (#128). claude-agent-acp resolves the
+ * requested id onto one of the rows it offers and answers with that row's `value` as the model
+ * option's `currentValue` (0.85.1 `dist/acp-agent.js:5459-5499`). `[측정 2026-10-12]` 0.85.1, no
+ * prompt: `claude-fable-5-1` answers its own row, while `claude-sonnet-5-5` and `claude-opus-5-5`
+ * answer the alias rows `sonnet` and `opus`, named `Sonnet 5.5` and `Opus 5.5`. The id an alias row
+ * resolves to (`ModelInfo.resolvedModel`) is not on the ACP wire, so an alias answer is accepted
+ * only as the exact measured row, value AND name, declared here for the requested id. No other
+ * spelling is matched.
+ */
+export const CLAUDE_SET_MODEL_ALIAS_ROWS = Object.freeze({
+    "claude-sonnet-5-5": Object.freeze({ value: "sonnet", name: "Sonnet 5.5" }),
+    "claude-opus-5-5": Object.freeze({ value: "opus", name: "Opus 5.5" }),
+});
+/** Refuse unless the set-model answer names the requested model. A missing model option, another
+ *  row, or a row that is not the measured alias row would let a different model answer under this id. */
+export function confirmClaudeSetModelAnswer(response, nativeModelId) {
+    const configOptions = response?.configOptions;
+    const modelOption = Array.isArray(configOptions)
+        ? configOptions.find((option) => option?.id === "model")
+        : undefined;
+    const currentValue = modelOption?.currentValue;
+    if (typeof currentValue === "string" && currentValue === nativeModelId)
+        return;
+    const rows = Array.isArray(modelOption?.options)
+        ? modelOption.options.flatMap((row) => Array.isArray(row?.options) ? row.options : [row])
+        : [];
+    const selected = typeof currentValue === "string" ? rows.find((row) => row?.value === currentValue) : undefined;
+    const alias = CLAUDE_SET_MODEL_ALIAS_ROWS[nativeModelId];
+    if (alias !== undefined && currentValue === alias.value && selected?.name === alias.name)
+        return;
+    const answered = modelOption === undefined
+        ? "no model option"
+        : `model ${jsonText(currentValue)} named ${jsonText(selected?.name ?? null)}`;
+    throw new Error(`entwurf: claude-agent-acp answered set-model ${JSON.stringify(nativeModelId)} with ${answered}, which does not ` +
+        `name the requested model. Refusing before the prompt so a different model cannot answer under this id; ` +
+        `the installed driver and the curated id disagree, and repeating the turn cannot change that.`);
+}
 export const claudeAdapter = {
     backend: "claude",
     // Claude owns its UNPREFIXED curated ids only (rail “Adapter contract”). The native id
@@ -161,7 +199,12 @@ export const claudeAdapter = {
         if (typeof setConfig !== "function") {
             throw new Error(`setSessionConfigOption unsupported — cannot enforce model ${modelId}`);
         }
-        await setConfig.call(connection, { sessionId: acpSessionId, configId: "model", value: nativeModelId });
+        const answer = await setConfig.call(connection, {
+            sessionId: acpSessionId,
+            configId: "model",
+            value: nativeModelId,
+        });
+        confirmClaudeSetModelAnswer(answer, nativeModelId);
     },
     configSignatureFields(_adapterSettings) {
         // Claude folds no extra backend-specific fields beyond backend + nativeModelId
@@ -302,7 +345,8 @@ export const cortexAdapter = {
     // serves fails loud BEFORE the prompt (`Unsupported model: …`). PR #40's
     // launch-time `-m` pin was retired for this: set-model is the single model
     // authority (resolveLaunch never passes `-m`), and "auto" is set explicitly
-    // rather than treated as an unspoken default.
+    // rather than treated as an unspoken default. NO answer readback, unlike claude: nobody has
+    // measured what cortex's set_config_option response carries, so a check would be a guess.
     async enforceModel({ connection, acpSessionId, nativeModelId, modelId }) {
         const setConfig = connection.setSessionConfigOption;
         if (typeof setConfig !== "function") {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/model-ids.js

@@ -0,0 +1,67 @@
+// ACP plugin — the curated model IDs, and nothing else (#128).
+//
+// This leaf imports NOTHING. `models.ts` builds the registry rows from the pi-ai
+// catalog; the launch seams (`fresh-call-dispatch.ts`, `resume-launch-identity.ts`)
+// only need to know which IDs exist, and they ride the pi-free bridge closure, so
+// they read the IDs here rather than load a vendor catalog to learn them.
+//
+// WHY `.js`: the same reason as `protocol.js`. Both the emit-capable root program
+// (allowJs) and Node --experimental-strip-types resolve an explicit `.js` import
+// literally to this file, so `models.ts` (root fence, `.js` specifiers) and the
+// strip-types gates that load `models.ts` directly reach one SSOT. A `.ts` leaf
+// would need a `.ts` specifier the root config cannot allow.
+//
+// WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
+// case-insensitive substring match among the provider's rows and prefers the
+// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
+// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
+// silently open on the Snowflake Cortex rail instead of the Claude subscription.
+// An exact match against this list is the only admission; nothing is aliased,
+// substituted or rewritten.
+/** The single ACP provider id under which every curated row is registered. */
+export const PROVIDER_ID = "entwurf";
+// The curated Claude ids. Adding one here is a commitment to verify it across
+// both axes (protocol smoke + agent interview) — do not extend casually.
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
+    "claude-sonnet-5-5",
+    "claude-opus-5-5",
+    "claude-fable-5-1",
+]);
+/** The anchor model whose absence is a hard registry regression, not a soft skip. */
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
+// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
+// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+export const CORTEX_MODEL_PREFIX = "cortex-";
+export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+    "cortex-auto",
+    "cortex-claude-opus-5",
+    "cortex-claude-sonnet-5",
+    "cortex-openai-gpt-5.4",
+]);
+/** @type {ReadonlySet<string>} */
+const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+/**
+ * Exact membership only — no trim, no case folding, no prefix.
+ * @param {string} model
+ * @returns {boolean}
+ */
+export function isCuratedAcpModelId(model) {
+    return CURATED_ACP_MODEL_IDS.has(model);
+}
+/** The named refusal both launch seams answer with. */
+export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curated");
+export const ACP_MODEL_NOT_CURATED_HINT = `an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
+    "Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
+    "so nothing was opened, and nothing is aliased or rewritten";
+/** Carries `reason` so callers match a FIELD, never the wording. */
+export class AcpModelNotCuratedError extends Error {
+    /** @param {string} model */
+    constructor(model) {
+        super(`${ACP_MODEL_NOT_CURATED}: ${JSON.stringify(model)} is not an exact curated ${PROVIDER_ID} model id`);
+        this.name = "AcpModelNotCuratedError";
+        /** @readonly */
+        this.reason = ACP_MODEL_NOT_CURATED;
+        /** @readonly */
+        this.model = model;
+    }
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -32,8 +32,11 @@
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
 import { getModels } from "@earendil-works/pi-ai/compat";
-/** Provider id — current pre-rename surface; S1 renames this load-bearing id to `entwurf`. */
-export const PROVIDER_ID = "entwurf";
+import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-ids.js";
+// The provider id and the curated ID lists live in the dependency-free
+// `model-ids.js` leaf, shared with the launch seams (#128); this file is the only
+// one that loads the upstream catalog to turn them into registry rows.
+export { CORTEX_MODEL_PREFIX, CURATED_ANCHOR_MODEL_ID, PROVIDER_ID, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./model-ids.js";
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
 // provider defines custom models, but the ACP plugin consumes NO key: backend
 // auth belongs to the operator's own Claude CLI child process (AGENTS
@@ -45,15 +48,8 @@ export const PROVIDER_ID = "entwurf";
 // — that silences the warning but keeps the wrong auth-boundary shape. The
 // check-auth-boundary gate pins this.
 export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
-// The curated Claude ids. Adding one here is a commitment to verify it across
-// both axes (protocol smoke + agent interview) — do not extend casually.
-// Exported so the claude backend adapter (backend-adapter.ts) can answer
-// `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5", "claude-fable-5-1"];
-/** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
-// Anthropic's registry reports 1M for Sonnet 5, Opus 5 and Fable 5.1, and the
-// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for Sonnet 5.5, Opus 5.5 and Fable 5.1, and the
+// entwurf surface exposes the full 1M for all three. Sonnet 5's 1M window was the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.
@@ -82,7 +78,7 @@ function claudeContextWindow(model) {
 // carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
 // authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
 // native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5` the claude adapter owns). `routeModel` strips the prefix to
+// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
 // recover the native id, which is enforced per-turn via
 // session/set_config_option — never a launch `-m` pin (CP0-M).
 //
@@ -91,14 +87,7 @@ function claudeContextWindow(model) {
 // the running cortex no longer serves fails LOUD at set-model, before the
 // prompt (measured: `Unsupported model: …` names the live set). Adding an id
 // here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually.
-export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = [
-    "cortex-auto",
-    "cortex-claude-opus-5",
-    "cortex-claude-sonnet-5",
-    "cortex-openai-gpt-5.4",
-];
+// extend casually. The prefix and the four ids are declared in model-ids.js.
 // Hand-set conservative context window. Cortex reports the LIVE window via its
 // own ACP session config, not this curated metadata — this is a floor for the
 // registry surface, deliberately not inflated to the Claude 1M.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/codex-fresh-preflight.js

@@ -549,10 +549,11 @@ export async function codexFreshPreflight(env, deps = {}) {
         return "codex-mcp-hand-missing";
     if (visibleIdentityMissing(config))
         return "codex-visible-identity-missing";
-    const socketPath = resolveCodexDefaultSocketPath(env);
-    const socket = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+    const socket = (deps.checkSocket ?? checkCodexSocketFile)(resolveCodexDefaultSocketPath(env));
     if (!socket.ok)
         return "codex-app-server-unavailable";
-    const live = await appServerIsLive(socketPath, deps.openProtocol ?? realCodexProtocolOpener, deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS);
+    // The protocol exchange goes to the endpoint the check verified, never the advertised path
+    // again (on Codex 0.162.1 that path is an alias; see `checkCodexSocketFile`).
+    const live = await appServerIsLive(socket.connectPath, deps.openProtocol ?? realCodexProtocolOpener, deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS);
     return live ? null : "codex-app-server-unavailable";
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-visible-resume.js

@@ -46,6 +46,7 @@
  * a resume runs no turn (measured — the transcript stayed byte-identical), so there is no turn
  * outcome for this module to claim.
  */
+import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
 import { ResumeBackendUnsupportedError, resolveResumeLaunchIdentity, } from "./resume-launch-identity.js";
@@ -129,6 +130,15 @@ export async function visibleResume(targetGardenId, deps) {
             identity = deps.resolveIdentity(targetGardenId);
         }
         catch (err) {
+            // #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
+            // by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+            if (err instanceof AcpModelNotCuratedError) {
+                return {
+                    ok: false,
+                    reason: err.reason,
+                    detail: `${targetGardenId} would launch model ${JSON.stringify(err.model)} under the entwurf provider (the resolved launch pair, which may differ from the recorded provider)`,
+                };
+            }
             if (err instanceof ResumeBackendUnsupportedError) {
                 return {
                     ok: false,
@@ -210,6 +220,7 @@ export async function observeSameGidSocket(targetGardenId, socketPath, deps, tim
 const REJECT_HINT = {
     "target-invalid": "no citizen has that id; discover targets with entwurf_peers",
     "target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "target-locked": "another resume or dispatch holds this citizen's lock right now",
     "target-live": "that citizen is already running — this verb only reopens dormant ones",
     "target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-dispatch.js

@@ -24,8 +24,9 @@
  * the one address path, on both rails.
  */
 import { spawn as spawnChildProcess } from "node:child_process";
+import { ACP_MODEL_NOT_CURATED, isCuratedAcpModelId, PROVIDER_ID } from "./acp/model-ids.js";
 import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-preflight.js";
-import { mintNonce } from "./fresh-call-composition.js";
+import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.js";
 import { createHerdrRunner, herdrFreshCall, renderHerdrFreshCall, resolveHerdrContext, } from "./herdr-fresh-call.js";
 import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 /** herdr's own marker, read for its EXACT value. `[측정 2026-09-14]` herdr exports `HERDR_ENV=1`
@@ -33,6 +34,25 @@ import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
 export function selectFreshCallRail(env) {
     return env.HERDR_ENV === "1" ? "herdr" : "tmux";
 }
+/**
+ * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
+ * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
+ * would open on `cortex-claude-sonnet-5` — another vendor and billing rail — with a receipt that
+ * still names the requested id. Asked here, at the one root both rails share, so neither rail can
+ * forget it. It reads the model the way the rails will (trimmed), and only a model that already
+ * passes their grammar: a malformed one keeps its own `model-invalid` answer from the rail.
+ */
+export function isUncuratedEntwurfPiModel(backend, model) {
+    if (backend !== "pi")
+        return false;
+    const trimmed = model.trim();
+    if (!isSafeFreshCallModel(trimmed))
+        return false;
+    const slash = trimmed.indexOf("/");
+    if (slash < 0 || trimmed.slice(0, slash) !== PROVIDER_ID)
+        return false;
+    return !isCuratedAcpModelId(trimmed.slice(slash + 1));
+}
 /**
  * Open a sibling on whichever rail this process is actually standing in.
  *
@@ -49,6 +69,12 @@ export function selectFreshCallRail(env) {
  * them rather than inheriting a rule from a topology it does not share.
  */
 export async function dispatchFreshCall(request, env = process.env, spawn, nonce = mintNonce()) {
+    // Before either rail is asked anything: both would open a pane on the wrong row.
+    if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
+        return selectFreshCallRail(env) === "herdr"
+            ? { rail: "herdr", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } }
+            : { rail: "tmux", result: { ok: false, reason: ACP_MODEL_NOT_CURATED } };
+    }
     if (selectFreshCallRail(env) === "herdr") {
         const context = resolveHerdrContext(env);
         if (!context.ok) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -789,6 +789,9 @@ const HERDR_REJECT_HINT = {
     "caller-identity-unavailable": "this surface has no record-backed identity, so a sibling would have nowhere to call home",
     "model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
     "model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",
+    // #128: decided at the dispatch root (`fresh-call-dispatch.ts`), worded here because this rail's
+    // import fence admits no ACP module. The curated list itself lives in `acp/model-ids.js`.
+    "acp-model-not-curated": "an entwurf model must be one exact curated ACP id — Pi would otherwise pick another row by substring (a retired claude-sonnet-5 lands on cortex-claude-sonnet-5), so nothing was opened and nothing was aliased",
     "task-empty": "a sibling opened with nothing to do is a window nobody asked for",
     "task-too-long": `the task is over the ${TASK_MAX_CHARS}-character interface bound this verb shares with entwurf_v2`,
     "herdr-context-missing": "HERDR_ENV/HERDR_BIN_PATH are absent, so this process is not inside herdr and this rail does not exist here",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -85,6 +85,7 @@
  *     the session the window is actually in. It still reports no `pane_current_path`, and
  *     there is no "session created" field because nothing here creates one.
  */
+import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
 import { callbackEnvAssignments } from "./callback-env.js";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
@@ -490,6 +491,7 @@ const REJECT_HINT = {
     "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
+    "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "task-empty": "task is empty after trimming",
     "task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
     "runtime-unresolved": "the backend's runtime is not installed on PATH",