@junghanacs/entwurf 0.35.0 → 0.36.0

package/scripts/check-acp-cortex.ts

@@ -53,11 +53,11 @@ import {
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { getModels } from "@earendil-works/pi-ai/compat";
 import { buildPiContextAugment } from "../pi-extensions/lib/acp/augment.ts";
 import type { AcpMcpServer } from "../pi-extensions/lib/acp/config.ts";
 import {
 	CORTEX_MODEL_PREFIX,
-	curatedClaudeModels,
 	curatedCortexModels,
 	SUPPORTED_CORTEX_MODEL_IDS,
 } from "../pi-extensions/lib/acp/models.ts";
@@ -87,12 +87,13 @@ const cortexRowIds = cortexRows.map((m) => m.id);
 assert.deepEqual(cortexRowIds, [...SUPPORTED_CORTEX_MODEL_IDS], "curated cortex rows must match the supported id set");
 // The two Claude rows ride their OWN registry bases (a fabricated row would
 // drift from the pi-ai catalog); auto/gpt ride the sonnet base as a floor.
-const claudeRows = curatedClaudeModels();
+// Cortex retains its own native 5 ids even when Claude's curated set moves to 5.5.
+const claudeRows = getModels("anthropic");
 const sonnetBase = claudeRows.find((m) => m.id === "claude-sonnet-5");
 const opusBase = claudeRows.find((m) => m.id === "claude-opus-5");
 // Plain throw (not assert.ok): an asserts-function premise makes tsc report the
 // downstream `base` const as circularly-typed (TS7022).
-if (!sonnetBase || !opusBase) throw new Error("test premise: sonnet-5/opus-5 present in curated claude surface");
+if (!sonnetBase || !opusBase) throw new Error("test premise: sonnet-5/opus-5 present in pi-ai registry");
 for (const row of cortexRows) {
 	// Explicit annotation: node:assert's asserts-typed helpers otherwise make tsc
 	// flag this flow-dependent const as circularly typed (TS7022).
@@ -480,7 +481,7 @@ try {
 	// throwing IS the anti-collision proof; we also assert the rows are present.
 	const registered = mod.allCuratedModels().map((m) => m.id);
 	for (const want of [
-		"claude-sonnet-5",
+		"claude-sonnet-5-5",
 		"cortex-auto",
 		"cortex-claude-opus-5",
 		"cortex-claude-sonnet-5",
@@ -494,12 +495,12 @@ try {
 	assert.equal(routedSonnet.adapter.backend, "cortex", "cortex-claude-sonnet-5 must route to the cortex adapter");
 	assert.equal(routedSonnet.nativeModelId, "claude-sonnet-5", "prefix strip must recover the native model id");
 	assert.equal(
-		mod.resolveAcpBackendAdapter("claude-sonnet-5").adapter.backend,
+		mod.resolveAcpBackendAdapter("claude-sonnet-5-5").adapter.backend,
 		"claude",
 		"the unprefixed claude id must still route to claude (prefix keeps the namespaces apart)",
 	);
 	assert.equal(
-		mod.cortexAdapter.routeModel("claude-sonnet-5"),
+		mod.cortexAdapter.routeModel("claude-sonnet-5-5"),
 		undefined,
 		"cortex must NOT claim the unprefixed claude id",
 	);

package/scripts/check-acp-prompt-lifecycle.ts

@@ -40,7 +40,7 @@ import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } fr
 import { normalizeContext } from "@earendil-works/pi-ai";
 import { isRetryableAssistantError } from "@earendil-works/pi-ai/compat";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -151,7 +151,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: ({ sessionId }: any) => {
 			promptCount++;
 			notifier = (update) => handlers.sessionUpdate({ update, sessionId });

package/scripts/check-acp-provider-surface.ts

@@ -123,7 +123,7 @@ try {
 	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
 	assert.equal(cap.cfg.api, "entwurf", "entry api field drifted");
 	const capIds = (cap.cfg.models ?? []).map((m) => m.id);
-	for (const want of ["claude-sonnet-5", CURATED_ANCHOR_MODEL_ID]) {
+	for (const want of ["claude-sonnet-5-5", CURATED_ANCHOR_MODEL_ID]) {
 		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
 	}
 

package/scripts/check-acp-session-reuse.ts

@@ -51,8 +51,8 @@ function tctx(messages: Context["messages"]): TranscriptContext {
 	return normalizeContext({ tools: PI_DECLARED_TOOLS, messages });
 }
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
-const opus = { id: "claude-opus-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
+const opus = { id: "claude-opus-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -154,7 +154,7 @@ function makeHarness(recordDir: string, config: any = DEFAULT_RESOLVED_CONFIG, e
 			newSessionSeq++;
 			return { sessionId: `ACP-${newSessionSeq}` };
 		},
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async ({ sessionId, prompt }: any) => {
 			promptCalls.push({ sessionId, text: prompt.map((b: { text: string }) => b.text).join("\n") });
 			if (block) await block;
@@ -505,7 +505,7 @@ try {
 		);
 		const d1 = deltaText(t1);
 		const iPrep = d1.indexOf("[acp: preparing claude session]");
-		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-5]");
+		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-5-5]");
 		const iSent = d1.indexOf("[acp: sending prompt]");
 		assert.ok(
 			iPrep >= 0 && iReady > iPrep && iSent > iReady,
@@ -533,7 +533,7 @@ try {
 		const ctxWithNotice = tctx([
 			{ role: "user", content: "real user line", timestamp: 0 },
 			mkAssistant([
-				{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5]\n", textSignature: MARKER },
+				{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5-5]\n", textSignature: MARKER },
 				{ type: "text", text: "real assistant line" },
 			]),
 		]);

package/scripts/check-acp-stop-reason.ts

@@ -55,7 +55,7 @@ import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Model } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -124,7 +124,7 @@ function makeHarness(recordDir: string, wireReason: string | null) {
 		createConnection: (_child: any, handlers: any) => ({
 			initialize: async () => ({ agentCapabilities: {} }),
 			newSession: async () => ({ sessionId: "ACP-1" }),
-			setSessionConfigOption: async () => ({}),
+			setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 			prompt: async ({ sessionId }: any) => {
 				await handlers.sessionUpdate({
 					update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: "PARTIAL" } },

package/scripts/check-acp-stream-hooks.ts

@@ -35,7 +35,7 @@ import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -93,7 +93,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (_handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async (params: any) => {
 			// Deep-cloned: the capture must be the bytes that crossed the seam, not a
 			// live reference a later mutation could rewrite.

package/scripts/check-acp-usage-accounting.ts

@@ -61,7 +61,7 @@ import type {
 import { isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
 import { calculateContextTokens } from "@earendil-works/pi-coding-agent";
 
-const claude = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const claude = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 const cortex = { id: "cortex-auto" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
@@ -160,7 +160,7 @@ function makeHarness(recordDir: string, scripts: TurnScript[]) {
 			newSessionCalls++;
 			return { sessionId: "ACP-1" };
 		},
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async ({ sessionId }: any) => {
 			const script = scripts[turnIndex++] ?? {};
 			const update: Record<string, unknown> = { sessionUpdate: "usage_update" };

package/scripts/check-codex-app-server-launch.ts

@@ -322,25 +322,35 @@ exit "\${FAKE_CODEX_EXIT:-0}"
 		);
 	}
 	{
+		// The classifier's INDETERMINATE domain, as one claim: two unidentifiable paths, both
+		// reaching the launcher through the one `indeterminate)` arm. A path that exists and is
+		// not a socket must read indeterminate, not stale, so the launcher refuses instead of
+		// clobbering it. A symlink that is NOT Codex's exact rendezvous alias must be refused with
+		// the product classifier's own reason, which is what pins the WIRING: a launcher that grew
+		// its own symlink rule again would refuse there too, but not in those words. Both runs are
+		// made before the one assertion, so a regression on that shared arm fails HERE, at this
+		// claim, and not at an earlier unnamed cell. The exact alias's accept path is certified on
+		// `checkCodexSocketFile` (check-codex-native-push), not here: this gate has no seam to put
+		// Codex's socket directory in a sandbox.
 		const fileHome = path.join(root, "file-home");
 		const fileSock = resolveCodexDefaultSocketPath({ CODEX_HOME: fileHome });
 		mkdirSync(path.dirname(fileSock), { recursive: true });
 		writeFileSync(fileSock, "");
-		const r = launch([], { CODEX_HOME: fileHome });
-		ok(
-			"a path that exists and is not a socket is indeterminate, not stale — the launcher refuses instead of clobbering something it cannot identify",
-			r.status !== 0 && r.out.includes("codex-app-server-socket-indeterminate") && r.args.length === 0,
-		);
-	}
-	{
+		const regular = launch([], { CODEX_HOME: fileHome });
 		const linkHome = path.join(root, "link-home");
 		const linkSock = resolveCodexDefaultSocketPath({ CODEX_HOME: linkHome });
 		mkdirSync(path.dirname(linkSock), { recursive: true });
 		symlinkSync(path.join(root, "nowhere.sock"), linkSock);
-		const r = launch([], { CODEX_HOME: linkHome });
+		const link = launch([], { CODEX_HOME: linkHome });
 		ok(
-			"[QK:CODEX-APP-SERVER-REFUSES-INDETERMINATE-SOCKET] a symlinked control socket is refused by name — the same classification the delivery rail's socket check uses",
-			r.status !== 0 && r.out.includes("codex-app-server-socket-indeterminate") && r.args.length === 0,
+			"[QK:CODEX-APP-SERVER-REFUSES-INDETERMINATE-SOCKET] an unidentifiable path is refused, never launched over: a path that exists and is not a socket, and a symlink that is not Codex's rendezvous alias (refused with the classifier's own reason) — the same classification the delivery rail's socket check uses",
+			regular.status !== 0 &&
+				regular.out.includes("codex-app-server-socket-indeterminate") &&
+				regular.args.length === 0 &&
+				link.status !== 0 &&
+				link.out.includes("codex-app-server-socket-indeterminate") &&
+				link.out.includes("is not Codex's rendezvous alias") &&
+				link.args.length === 0,
 		);
 	}
 	{
@@ -358,17 +368,50 @@ exit "\${FAKE_CODEX_EXIT:-0}"
 		// Hard Rule 15: an unrecognised reading is the one case where proceeding is unsafe,
 		// because every branch above is a decision about whether this launch would clobber a
 		// running server. The stimulus is a sandbox `python3` that exits 0 while printing
-		// something nobody wrote — the exact shape a silent fall-through needs.
+		// something nobody wrote — the exact shape a silent fall-through needs. The launcher runs
+		// that connect probe only on an endpoint the classifier verified as a socket, so the cell
+		// puts a (dead) socket file there; without one the probe would never be asked.
+		const oddHome = path.join(root, "odd-home");
+		const oddSock = resolveCodexDefaultSocketPath({ CODEX_HOME: oddHome });
+		mkdirSync(path.dirname(oddSock), { recursive: true });
+		spawnSync("python3", ["-c", "import socket,sys;s=socket.socket(socket.AF_UNIX);s.bind(sys.argv[1])", oddSock]);
 		const oddBin = path.join(root, "odd-probe-bin");
 		mkdirSync(oddBin, { recursive: true });
 		const oddPython = path.join(oddBin, "python3");
 		writeFileSync(oddPython, "#!/usr/bin/env bash\ncat >/dev/null\necho 'unexpected-probe-status'\nexit 0\n");
 		chmodSync(oddPython, 0o755);
-		const r = launch([], { PATH: `${oddBin}:${bin}:${process.env.PATH ?? ""}` });
+		const r = launch([], { CODEX_HOME: oddHome, PATH: `${oddBin}:${bin}:${process.env.PATH ?? ""}` });
+		// The second stimulus is the CLASSIFIER answering a word it never gives. `stale` is the
+		// discriminating one: it is a valid verdict of the connect probe, so a launcher that passed
+		// unknown classifier words through would read it as a dead socket and LAUNCH. A sandbox
+		// `node` answers for the classifier's basename only and hands every other invocation to
+		// the real Node — a test fixture on this gate's PATH, not a seam the product reads.
+		const oddClassifierHome = path.join(root, "odd-classifier-home");
+		const oddClassifierBin = path.join(root, "odd-classifier-bin");
+		mkdirSync(oddClassifierBin, { recursive: true });
+		const oddNode = path.join(oddClassifierBin, "node");
+		writeFileSync(
+			oddNode,
+			"#!/usr/bin/env bash\n" +
+				'for a in "$@"; do case "$a" in */codex-socket-classify.js) printf \'stale\'; exit 0 ;; esac; done\n' +
+				`exec ${JSON.stringify(process.execPath)} "$@"\n`,
+		);
+		chmodSync(oddNode, 0o755);
+		const c = launch([], {
+			CODEX_HOME: oddClassifierHome,
+			PATH: `${oddClassifierBin}:${bin}:${process.env.PATH ?? ""}`,
+		});
 		ok(
 			"[QK:CODEX-APP-SERVER-REFUSES-UNRECOGNISED-PROBE] a socket classifier that exits 0 with a reading nobody wrote REFUSES instead of falling through to the exec",
 			r.status !== 0 && r.out.includes("codex-app-server-socket-probe-unrecognised") && r.args.length === 0,
 		);
+		ok(
+			`[QK:CODEX-APP-SERVER-REFUSES-UNRECOGNISED-CLASSIFIER] a classifier word the classifier never gives is refused before it can be read as one of the probe's own verdicts — 'stale' would otherwise launch (status ${c.status}, ${c.args.length} vendor args)`,
+			c.status !== 0 &&
+				c.out.includes("codex-app-server-socket-probe-unrecognised") &&
+				c.out.includes("the socket classifier answered\n  'stale'") &&
+				c.args.length === 0,
+		);
 	}
 
 	// ── 5. refusals that keep this from becoming something it is not ────────────

package/scripts/check-codex-native-push.ts

@@ -181,18 +181,219 @@ assert.equal(
 	"[QK:CODEX-NATIVE-FIXED-SOCKET] CODEX_HOME owns the vendor default socket root",
 );
 
-const temp = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-codex-native-"));
+// ── the control endpoint: a plain socket, or Codex's EXACT rendezvous alias (#141) ──────────
+// From Codex 0.162.1 the advertised path is a symlink to a 0600 socket the vendor binds under
+// `realpath(/tmp)/codex-daemon-<euid>/`, named by the sha256 hex of the canonical advertised
+// parent + "/" + basename (`[source]` rust-v0.162.1 `app-server-transport/src/transport/
+// unix_socket.rs:290-304`, `uds/src/daemon_directory.rs:13-38`). The expected target below is
+// derived HERE from that upstream rule, not read back from the product, and every cell builds
+// its own sandbox socket directory: `daemonRoot`/`euid` point the product at it, so the real
+// `/tmp/codex-daemon-<euid>` is never touched. Each refusal cell keeps every OTHER hop valid,
+// so it fails on its own rule and not on a neighbour's. A real other-uid owner needs root and
+// stays unmeasured; so does macOS, where `/tmp` canonicalizes to `/private/tmp`.
+//
+// The root and the socket directory names are SHORT on purpose: a bound socket path must fit
+// sun_path (108 bytes on Linux), and a 64-hex name under a long sandbox root does not — listen
+// fails with EINVAL. That limit is why the vendor keeps its own root at `/tmp/codex-daemon-<euid>`.
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-cnp-"));
+const euid = process.geteuid?.() ?? -1;
+const sandboxServers: net.Server[] = [];
+// A tree whose canonical path is longer than PATH_MAX can only be removed through the short
+// symlinked path that reaches it, so it is removed first, before the root.
+const overlongTrees: string[] = [];
 try {
 	const missing = checkCodexSocketFile(path.join(temp, "missing.sock"));
-	assert.deepEqual(missing.ok ? null : missing.status, "dead", "missing socket is a dead app-server");
+	assert.deepEqual(
+		missing.ok ? null : [missing.status, missing.status === "dead" ? missing.layout : null],
+		["dead", "absent"],
+		"missing socket is a dead app-server, and says it is the absent layout",
+	);
 	const regular = path.join(temp, "regular");
 	fs.writeFileSync(regular, "not a socket");
 	const wrongType = checkCodexSocketFile(regular);
 	assert.deepEqual(wrongType.ok ? null : wrongType.status, "indeterminate", "wrong path type never reads dead");
-	const link = path.join(temp, "link");
-	fs.symlinkSync(regular, link);
-	assert.match(JSON.stringify(checkCodexSocketFile(link)), /symlink/, "symlinked socket is refused by name");
+
+	const listen = async (socketPath: string, mode: number): Promise<void> => {
+		const server = net.createServer();
+		sandboxServers.push(server);
+		await new Promise<void>((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => resolve());
+		});
+		fs.chmodSync(socketPath, mode);
+	};
+	const layout = (name: string): { caseRoot: string; advertised: string; daemonRoot: string; expected: string } => {
+		const caseRoot = path.join(temp, name);
+		const parent = path.join(caseRoot, "home", "app-server-control");
+		fs.mkdirSync(parent, { recursive: true });
+		const daemonRoot = path.join(caseRoot, "d");
+		fs.mkdirSync(daemonRoot);
+		fs.chmodSync(daemonRoot, 0o700);
+		const hash = crypto
+			.createHash("sha256")
+			.update(`${fs.realpathSync(parent)}/app-server-control.sock`)
+			.digest("hex");
+		return {
+			caseRoot,
+			advertised: path.join(parent, "app-server-control.sock"),
+			daemonRoot,
+			expected: path.join(daemonRoot, hash),
+		};
+	};
+	const classify = (advertised: string, daemonRoot: string, over: { euid?: number } = {}) =>
+		checkCodexSocketFile(advertised, { daemonRoot, euid, ...over });
+	const statusOf = (check: ReturnType<typeof checkCodexSocketFile>): string => (check.ok ? "ok" : check.status);
+
+	const plainDir = path.join(temp, "plain");
+	fs.mkdirSync(plainDir);
+	const plain = path.join(plainDir, "app-server-control.sock");
+	await listen(plain, 0o600);
+	assert.deepEqual(
+		classify(plain, path.join(temp, "no-daemon-dir")),
+		{ ok: true, connectPath: plain },
+		"(A) a plain socket owned by the effective uid is the endpoint itself — the <=0.153.4 layout is unchanged",
+	);
+
+	const exact = layout("exact");
+	await listen(exact.expected, 0o600);
+	fs.symlinkSync(exact.expected, exact.advertised);
+	assert.deepEqual(
+		classify(exact.advertised, exact.daemonRoot),
+		{ ok: true, connectPath: exact.expected },
+		"(B) Codex's exact rendezvous alias is accepted, and the endpoint is the verified physical socket, not the alias",
+	);
+
+	const wrongHash = layout("wrong-hash");
+	const elsewhere = path.join(wrongHash.daemonRoot, "0".repeat(64));
+	await listen(elsewhere, 0o600);
+	fs.symlinkSync(elsewhere, wrongHash.advertised);
+	const wrongHashCheck = classify(wrongHash.advertised, wrongHash.daemonRoot);
+	assert.equal(
+		statusOf(wrongHashCheck),
+		"indeterminate",
+		"[QK:CODEX-SOCKET-ALIAS-EXACT] an alias into Codex's own socket directory whose name is not the hash of THIS advertised path is refused — a valid 0600 socket in the right 0700 directory is not enough",
+	);
+	assert.match(JSON.stringify(wrongHashCheck), /not Codex's rendezvous alias/, "that refusal says why, by name");
+
+	const relative = layout("relative");
+	await listen(relative.expected, 0o600);
+	fs.symlinkSync(path.relative(path.dirname(relative.advertised), relative.expected), relative.advertised);
+	assert.equal(
+		statusOf(classify(relative.advertised, relative.daemonRoot)),
+		"indeterminate",
+		"a relative alias target is refused even when it resolves to the expected socket",
+	);
+
+	const chain = layout("chain");
+	await listen(chain.expected, 0o600);
+	const hop = path.join(chain.caseRoot, "hop.sock");
+	fs.symlinkSync(chain.expected, hop);
+	fs.symlinkSync(hop, chain.advertised);
+	assert.equal(
+		statusOf(classify(chain.advertised, chain.daemonRoot)),
+		"indeterminate",
+		"an alias that reaches the expected socket through a second link is refused; only the vendor's one hop is accepted",
+	);
+
+	const dangling = layout("dangling");
+	fs.symlinkSync(dangling.expected, dangling.advertised);
+	const danglingCheck = classify(dangling.advertised, dangling.daemonRoot);
+	assert.deepEqual(
+		danglingCheck.ok ? null : [danglingCheck.status, danglingCheck.status === "dead" ? danglingCheck.layout : null],
+		["dead", "dangling-alias"],
+		"the exact alias with its socket gone is dead, named as the dangling alias the vendor itself removes on start",
+	);
+
+	const openDir = layout("dir-0755");
+	await listen(openDir.expected, 0o600);
+	fs.symlinkSync(openDir.expected, openDir.advertised);
+	fs.chmodSync(openDir.daemonRoot, 0o755);
+	assert.equal(
+		statusOf(classify(openDir.advertised, openDir.daemonRoot)),
+		"indeterminate",
+		"a socket directory other users can enter is refused — the vendor's own rule is mode & 0o777 == 0o700",
+	);
+
+	const stickyDir = layout("dir-1700");
+	await listen(stickyDir.expected, 0o600);
+	fs.symlinkSync(stickyDir.expected, stickyDir.advertised);
+	fs.chmodSync(stickyDir.daemonRoot, 0o1700);
+	assert.deepEqual(
+		classify(stickyDir.advertised, stickyDir.daemonRoot),
+		{ ok: true, connectPath: stickyDir.expected },
+		"a sticky 01700 socket directory is accepted: the vendor masks with 0o777, so refusing it would reject a directory Codex itself uses",
+	);
+
+	const linkedDir = layout("dir-symlink");
+	await listen(linkedDir.expected, 0o600);
+	fs.symlinkSync(linkedDir.expected, linkedDir.advertised);
+	const realDir = path.join(linkedDir.caseRoot, "real-daemon-dir");
+	fs.renameSync(linkedDir.daemonRoot, realDir);
+	fs.symlinkSync(realDir, linkedDir.daemonRoot);
+	assert.equal(
+		statusOf(classify(linkedDir.advertised, linkedDir.daemonRoot)),
+		"indeterminate",
+		"a socket directory that is itself a symlink is refused, as the vendor refuses it",
+	);
+
+	const fileTarget = layout("physical-file");
+	fs.writeFileSync(fileTarget.expected, "", { mode: 0o600 });
+	fs.symlinkSync(fileTarget.expected, fileTarget.advertised);
+	assert.equal(
+		statusOf(classify(fileTarget.advertised, fileTarget.daemonRoot)),
+		"indeterminate",
+		"an exact alias whose target is a regular file is refused, never connected to",
+	);
+
+	const readable = layout("physical-0644");
+	await listen(readable.expected, 0o644);
+	fs.symlinkSync(readable.expected, readable.advertised);
+	assert.equal(
+		statusOf(classify(readable.advertised, readable.daemonRoot)),
+		"indeterminate",
+		"an exact alias whose socket group or other users can open is refused",
+	);
+
+	assert.deepEqual(
+		[
+			statusOf(classify(plain, path.join(temp, "no-daemon-dir"), { euid: euid + 1 })),
+			statusOf(classify(exact.advertised, exact.daemonRoot, { euid: euid + 1 })),
+		],
+		["indeterminate", "indeterminate"],
+		"ownership is compared with the EFFECTIVE uid (the vendor's geteuid): under another euid both layouts are refused",
+	);
+
+	// canonicalize(parent) failure is the alias state lstat cannot see coming. The advertised
+	// path is short, but it reaches its parent through a symlink, and the parent's canonical
+	// path is longer than PATH_MAX — the vendor's own `canonicalize` fails on it the same way.
+	// It must be indeterminate: never dead, and never a throw the launcher would read as an
+	// unrecognised status.
+	const canonicalCase = path.join(temp, "canonical");
+	let far = canonicalCase;
+	while (far.length < 3600) far = path.join(far, "d".repeat(200));
+	fs.mkdirSync(far, { recursive: true });
+	const via = path.join(canonicalCase, "via");
+	fs.symlinkSync(far, via);
+	overlongTrees.push(path.join(via, "e".repeat(200)));
+	let overlongParent = via;
+	for (let i = 0; i < 4; i += 1) overlongParent = path.join(overlongParent, "e".repeat(200));
+	fs.mkdirSync(overlongParent, { recursive: true });
+	const overlongAdvertised = path.join(overlongParent, "app-server-control.sock");
+	fs.symlinkSync(exact.expected, overlongAdvertised);
+	const overlongCheck = classify(overlongAdvertised, exact.daemonRoot);
+	assert.equal(
+		statusOf(overlongCheck),
+		"indeterminate",
+		"an alias whose parent cannot be canonicalized is indeterminate",
+	);
+	assert.match(
+		JSON.stringify(overlongCheck),
+		/could not verify/,
+		"that refusal names the verification it could not do",
+	);
 } finally {
+	for (const server of sandboxServers) server.close();
+	for (const tree of overlongTrees) fs.rmSync(tree, { recursive: true, force: true });
 	fs.rmSync(temp, { recursive: true, force: true });
 }
 
@@ -201,15 +402,33 @@ const firstPage = new FakeProtocol([
 	{ data: ["other"], nextCursor: "next" },
 	{ data: ["target"], nextCursor: null },
 ]);
+// The check is asked about the advertised default path, and everything after it — the probe's
+// connect AND the route the queue send uses — goes to the endpoint the check returned. Here
+// the two are different strings, so a probe that went back to the advertised path goes red.
+let checkedPath = "";
+let openedPath = "";
 const alive = await probeCodexThread("target", {
 	env: { CODEX_HOME: "/fixed" },
-	checkSocket: () => ({ ok: true }),
-	openProtocol: opener(firstPage),
+	checkSocket: (advertised) => {
+		checkedPath = advertised;
+		return { ok: true, connectPath: "/verified/physical.sock" };
+	},
+	openProtocol: {
+		open: async (socketPath) => {
+			openedPath = socketPath;
+			return firstPage;
+		},
+	},
 });
 assert.deepEqual(
 	alive,
-	{ status: "alive", route: { backend: "codex", socketPath: "/fixed/app-server-control/app-server-control.sock" } },
-	"[QK:CODEX-NATIVE-LOADED-PROBE] full loaded-thread pagination proves the volatile route",
+	{ status: "alive", route: { backend: "codex", socketPath: "/verified/physical.sock" } },
+	"[QK:CODEX-NATIVE-LOADED-PROBE] full loaded-thread pagination proves the volatile route, on the endpoint the socket check verified",
+);
+assert.deepEqual(
+	[checkedPath, openedPath],
+	["/fixed/app-server-control/app-server-control.sock", "/verified/physical.sock"],
+	"the socket check reads the advertised default path; the probe connects to the endpoint it verified, never the alias again",
 );
 assert.equal(firstPage.closed, true, "successful probe closes its connection");
 assert.deepEqual(
@@ -221,7 +440,7 @@ assert.deepEqual(firstPage.calls[3]?.params, { cursor: "next" }, "pagination car
 const absentProtocol = new FakeProtocol([{}, { data: [], nextCursor: null }]);
 const absent = await probeCodexThread("target", {
 	env: { CODEX_HOME: "/fixed" },
-	checkSocket: () => ({ ok: true }),
+	checkSocket: (advertised) => ({ ok: true, connectPath: advertised }),
 	openProtocol: opener(absentProtocol),
 });
 assert.equal(absent.status, "dead", "a clean loaded inventory without the target is not delivery-capable");
@@ -230,7 +449,7 @@ assert.equal(absentProtocol.closed, true, "negative probe closes its connection"
 const malformedProtocol = new FakeProtocol([{}, { data: [{ id: "wrong-shape" }], nextCursor: null }]);
 const malformed = await probeCodexThread("target", {
 	env: { CODEX_HOME: "/fixed" },
-	checkSocket: () => ({ ok: true }),
+	checkSocket: (advertised) => ({ ok: true, connectPath: advertised }),
 	openProtocol: opener(malformedProtocol),
 });
 assert.equal(malformed.status, "indeterminate", "a malformed inventory is unknown, never dead");
@@ -374,7 +593,7 @@ assert.deepEqual(
 
 const adapter = createCodexNativePushAdapter({
 	env: { CODEX_HOME: "/fixed" },
-	checkSocket: () => ({ ok: true }),
+	checkSocket: (advertised) => ({ ok: true, connectPath: advertised }),
 	openProtocol: opener(new FakeProtocol([{}, { data: ["target"], nextCursor: null }])),
 	runner: queueRunner,
 });

package/scripts/check-fresh-call-dispatch.ts

@@ -26,6 +26,8 @@
  *   FCD-RENDER-PER-RAIL       each rail renders its own receipt; no universal tmux prose
  *   FCD-HERDR-VIEW-NOT-ADDRESS  the herdr receipt says its coordinates are a view
  *   FCD-RECOVERY-VISIBLE      a post-split failure shows closed vs orphan-unreclaimed:reason
+ *   FCD-ACP-MODEL-EXACT       a pi `entwurf/<id>` that is not an exact curated ACP id refuses on
+ *                             either rail before anything runs (#128)
  */
 
 import assert from "node:assert/strict";
@@ -112,10 +114,18 @@ async function main(): Promise<void> {
 	// Up to the FIRST statement of the tmux path, which is the target capability question
 	// (#95 lane B added a caller-side one beside it, so `const missing =` is no longer the
 	// boundary — it is the line that FOLDS the two).
-	const herdrBranch = dispatchCode.slice(
-		dispatchCode.indexOf('if (selectFreshCallRail(env) === "herdr")'),
-		dispatchCode.indexOf("\tconst targetMissing ="),
-	);
+	// Fail closed on the anchors: a renamed or reordered line would otherwise slice an EMPTY branch,
+	// and every negative `!herdrBranch.includes(…)` below would pass on nothing (#128 review D2).
+	// The slice ends at the herdr branch's OWN return, not at a tmux-path statement, so a mutant
+	// that edits the tmux path cannot move this boundary and fail this cell for its reason.
+	const herdrStart = dispatchCode.indexOf('if (selectFreshCallRail(env) === "herdr")');
+	const herdrReturn = 'return { rail: "herdr", result: await herdrFreshCall(';
+	const herdrReturnAt = dispatchCode.indexOf(herdrReturn);
+	const herdrBranch =
+		herdrStart >= 0 && herdrReturnAt > herdrStart
+			? dispatchCode.slice(herdrStart, herdrReturnAt + herdrReturn.length)
+			: "";
+	const herdrBranchLocated = herdrBranch.includes("herdrFreshCall(");
 
 	// ── no fallback, either direction ────────────────────────────────────────────────────
 	const incomplete = await dispatchFreshCall(REQUEST, { HERDR_ENV: "1" }, recordingSpawn().spawn);
@@ -124,6 +134,37 @@ async function main(): Promise<void> {
 		incomplete.rail === "herdr" && !incomplete.result.ok && incomplete.result.reason === "herdr-context-missing",
 	);
 
+	// ── #128: an entwurf/<id> pi launch names an EXACT curated ACP id ───────────────────────
+	{
+		const herdrSpawn = recordingSpawn();
+		const pi = (model: string) => ({ ...REQUEST, model });
+		const herdrRetired = await dispatchFreshCall(pi("entwurf/claude-sonnet-5"), HERDR_ENV, herdrSpawn.spawn);
+		const tmuxRetired = await dispatchFreshCall(pi(" entwurf/claude-opus-5 "), {}, recordingSpawn().spawn);
+		const current = recordingSpawn();
+		const herdrCurrent = await dispatchFreshCall(pi("entwurf/claude-opus-5-5"), HERDR_ENV, current.spawn);
+		const cortex = await dispatchFreshCall(pi("entwurf/cortex-claude-sonnet-5"), {}, recordingSpawn().spawn);
+		const otherBackend = await dispatchFreshCall(
+			{ ...REQUEST, backend: "claude-code", model: "entwurf/claude-sonnet-5" },
+			{},
+			recordingSpawn().spawn,
+		);
+		const reasonOf = (d: Awaited<ReturnType<typeof dispatchFreshCall>>) => (d.result.ok ? null : d.result.reason);
+		ok(
+			"[QK:FCD-ACP-MODEL-EXACT] a pi sibling under the entwurf provider must name an EXACT curated ACP id: a retired Claude 5 id refuses as acp-model-not-curated on BOTH rails (trimmed like the rails read it) before herdr is asked anything, while the 5.5 id and a Cortex id pass through and another backend is not judged — Pi would otherwise open the retired id on a Cortex row by substring",
+			herdrRetired.rail === "herdr" &&
+				reasonOf(herdrRetired) === "acp-model-not-curated" &&
+				herdrSpawn.calls.length === 0 &&
+				tmuxRetired.rail === "tmux" &&
+				reasonOf(tmuxRetired) === "acp-model-not-curated" &&
+				reasonOf(herdrCurrent) !== "acp-model-not-curated" &&
+				current.calls.length > 0 &&
+				reasonOf(cortex) !== "acp-model-not-curated" &&
+				reasonOf(otherBackend) !== "acp-model-not-curated" &&
+				renderDispatchedFreshCall(herdrRetired).text.includes("exact curated ACP id") &&
+				renderDispatchedFreshCall(tmuxRetired).text.includes("exact curated ACP id"),
+		);
+	}
+
 	const nonPilot = recordingSpawn();
 	const refused = await dispatchFreshCall({ ...REQUEST, backend: "codex" }, HERDR_ENV, nonPilot.spawn);
 	ok(
@@ -132,6 +173,7 @@ async function main(): Promise<void> {
 			!refused.result.ok &&
 			refused.result.reason === "herdr-backend-unsupported" &&
 			nonPilot.calls.length === 0 &&
+			herdrBranchLocated &&
 			// And structurally: the herdr branch names NEITHER capability preflight — not the
 			// target one, and not the caller-seat one #95 lane B put beside it.
 			!herdrBranch.includes("codexFreshPreflight") &&
@@ -153,6 +195,7 @@ async function main(): Promise<void> {
 			!durableRefused.result.ok &&
 			durableRefused.result.reason === "herdr-backend-unsupported" &&
 			durable.calls.length === 0 &&
+			herdrBranchLocated &&
 			!herdrBranch.includes("piDurable"),
 	);