@junghanacs/entwurf 0.35.1 → 0.36.1

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md — Maintainer Guidelines for entwurf
 
-For agents who own this repository: durable invariants and the documents that own the changing evidence. This is the **entwurf capability package**: garden-citizen dispatch substrate, native-harness bridges, ACP plugin, and pi adapter. Entwurf is the subject; pi is one adapter. ACP is a plugin, not the boundary. V2 addresses existing citizens; `entwurf_fresh_call` creates a new sibling.
+For agents who own this repository: durable invariants and the documents that own the changing evidence. This is the **entwurf capability package**: visible sibling lifecycle and garden-id delivery — the v2 dispatch core, native-harness bridges, ACP plugin, and pi adapter. Entwurf is the subject; pi is one adapter. ACP is a plugin, not the boundary. V2 addresses existing citizens; `entwurf_fresh_call` creates a new sibling.
 
 ## North Star — One Forged Screwdriver
 
@@ -42,7 +42,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
 16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
-17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf may carry that pinned, removable app/TUI with its declared overlay and deterministic emit/import relocation, against one coherent published-library version set. Native execution, auth, queues, storage, transcript and recovery remain upstream-owned (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
+17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf owns that thin, removable app/TUI composition as canonical source and ships its deterministic emission (type strip + import relocation) as a carrier, against one coherent published-library version set. The engine — native execution, auth, queues, storage, transcript, compaction, cancellation and recovery — remains the upstream SDK (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.
 

package/CHANGELOG.md

@@ -4,6 +4,409 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.36.1 - 2026-10-14
+
+### ACP
+
+- **Claude ACP closure (#128):** adapter `0.85.1` → `0.90.0`, shared direct/child ACP wire SDK
+  `1.6.0` → `1.8.0`, Agent SDK `0.3.286` → `0.3.296`; the shared-wire contract is retained and
+  Entwurf adds no new policy. Two no-prompt readbacks against the installed 0.90.0 found the
+  three curated ids answering exactly as on 0.85.1, so the set-model alias rows are unchanged.
+  The first followed only the production launch and overlay seam; the second also built every
+  session with the production session meta under the shipped defaults. Neither sent a prompt or
+  saw a model-turn update, but they do not prove zero API calls, measure the billing rail or an
+  operator's own settings, or certify a 0.90.0 prompt turn. The first run's two operating
+  observations, both with the cause unmeasured, are in the ROADMAP ledger.
+- **ACP gates no longer touch the operator's Claude overlay (#128).** Five offline gates that
+  drive the compiled turn loop now sandbox HOME, XDG and the pi agent dir before importing the
+  backend; a tripwire and a paired mutant hold that.
+
+### Codex
+
+- **The Codex fresh-call smoke reads app-server socket ownership from the kernel (#128).** It
+  used to accept the named app-server when its argv spelled `--listen` for the default control
+  socket. It now takes the physical endpoint the production socket classifier resolves, and
+  requires exactly one process in the named PID's own subtree (the named PID, bound to the start
+  time read when its identity was checked, or one of its descendants) to hold that socket's
+  kernel LISTEN inode, and a bounded second read must agree. Anything else fails closed as
+  not-owned or indeterminate. The 0.36.1 LIVE run exercised it once on an owned app-server
+  started with the explicit `--listen` wrapper (below); a vendor-managed daemon is still not
+  admitted by it.
+
+### pi-durable
+
+- **The pi-durable fresh-call smoke waits for its doorbell turn to end.** It took pd's native
+  snapshot as soon as Pi's relay reached the fixture, then required the doorbell submission to
+  be `done`. A pi-durable input stays `placed` while the run that consumed it is active and turns
+  `done` only when that run ends, so a slow final generation read as a failed admission. The
+  0.36.1 LIVE run caught exactly that (submission `placed`, the last generation task still
+  `running`, every delivery receipt green). The smoke now waits, with its existing bounded
+  `until`, for this message's submission to settle (`done` or `unanswered`) before the snapshot,
+  and still requires `done`. Smoke-only; no pi-durable runtime byte changes.
+
+### Release boundary and verification
+
+- **Scope.** A core patch over `v0.36.0`: the four #128 checkpoints `fdf8c3d`, `3da44be`,
+  `3e4f52f` and `3242922` above, the handoff `b043833`, and the smoke fix `91cc080`. The
+  pi-durable runtime, the Herdr manifest (0.36.0), its host pin (Herdr 0.9.4) and the plugin
+  implementation are unchanged; the Herdr runtime's acquisition source does change (the carrier
+  below). #142 is not in it. Still open in #128 and not claimed here: admission of a
+  vendor-managed Codex daemon, the Copilot 1.0.97 cell, agy 1.3.1 (not certified), the OMP
+  18.10.4 doctors, and the remaining native cells.
+- **Local evidence before this preparation is focused, not a whole pass.** Each affected
+  qualification wave (PARTIAL) measured its own checkpoint, each with a green control, and none
+  is carried to another. The Codex socket-ownership bytes killed 150/150 in the
+  `check-mux-fresh-call` group; 825 of the 975 committed claims were not run. The dependency move
+  killed 4/4 in `check-dep-versions`; 971 of 975 were not run. The gate isolation killed 45/45 in
+  five groups (prompt lifecycle 15, usage accounting 12, stream hooks 10, stop reason 7, session
+  reuse 1); 931 of the 976 committed claims were not run. The qualification body has not run on
+  any of them.
+- **Unpublished candidate carrier.** As in 0.36.0, `plugins/herdr/runtime-lock.json`
+  temporarily names the closed `herdr-checkout` source: an npm-source lock must agree with the
+  checkout's core version, and 0.36.1 has no published integrity yet. The Herdr manifest stays
+  0.36.0. Operating effect: a Herdr plugin installed from `--ref main` while this carrier stands
+  acquires this cut's checkout runtime, not npm 0.36.0. The `v2026.10.14-herdr.0.36.0` tag and
+  the npm 0.36.0 bytes are unchanged, and moving a host between the two sources needs an
+  explicit deactivate/activate. Re-pinning the registry bytes is a separate, verified commit
+  after the operator publishes core 0.36.1.
+- **The local FULL is RED, and its Herdr cell is CI's.** `pnpm run check:full` ran once on the
+  frozen candidate (642 s, exit 1). `check:core` passed, `check:hermetic` passed every step but
+  its last, and `check-herdr-sandbox` failed its version boundary: the pin is Herdr 0.9.4 and
+  the host binary was 0.9.3. That cell is not to run locally (it reads the operator's own
+  panes), and the aggregate reached it unnoticed; before failing it executed the host binary's
+  `--version` once and read no pane. `check:package`, which never ran, then passed alone
+  (163 s; 601 files in the dry-run pack). By the operator's decision for this cut only, the
+  sandbox cell is owed to the prepared SHA's CI, which runs it on the digest-pinned Herdr 0.9.4
+  and must pass there; the exception is not inherited by a later cut. Logs: FULL
+  `29b08c71e3d3c92fecb936f5611838088d35b8c5566f4dde99e03cc4b76b0078`, package
+  `937e69eeb551bcd0aea049550185e1f6d9f24d917f28099f768928554a16ae84`.
+- **LIVE, taken step by step, not as `release-gate --cut`.** The gate's first MUST step re-runs
+  `check:full`, so it would have reached the same local Herdr cell. By the operator's decision for
+  this cut, the gate's other 23 MUST steps ran in its own order, command, environment and
+  working directory (`run.sh` 7027-7127), stopping at the first red, with no static step. The
+  first run passed steps 1-22 and failed `smoke-pi-durable-fresh-live` on the race fixed above.
+  The fixed smoke then passed alone on the same candidate (36 assertions, 66 s); steps 1-22 are
+  reused because the fix is not an input to them. **MUST 23/23 PASS (22 + the fixed step 23),
+  SKIP 0**. The advisory BEHAVIOR step was not run. Among them: the 12 ACP smokes ran the first
+  prompt turns on the 0.90.0 driver, and `smoke-codex-fresh-live` passed 66 assertions against
+  an app-server started for this cut in its own tmux session (pid 2345801, the named PID's child
+  2345861 holding the kernel LISTEN inode) with `gpt-5.6-luna` and `openai-codex/gpt-5.6-luna`.
+  The gate session held no ambient identity carrier, and the candidate fingerprint was the same
+  before and after each run. Scratch `/tmp/entwurf-release-gate-0.36.1.1aZK83`. This is local
+  LIVE evidence, not a release-gate verdict and not the exact CI.
+- **Exact CI owes the whole floor.** The prepared SHA's exact CI (the four required jobs, the
+  qualification body, and `check-herdr-sandbox` on pinned Herdr 0.9.4) is the next checkpoint and
+  is not presumed PASS.
+- **Publication boundary.** No make artifact, core tag, GitHub Release or npm publication
+  is claimed; they wait for the exact CI, the make decision and the operator.
+
+## v2026.10.14-herdr.0.36.0 — Herdr Entwurf plugin 0.36.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.36.0 and
+its `v0.36.0` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.36.0.** `plugins/herdr/runtime-lock.json` names npm
+  `@junghanacs/entwurf@0.36.0` with the registry's measured sha512
+  (`sha512-3aPk69RmAF35x…244UwQ==`). The plugin manifest moves 0.35.1 → 0.36.0;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **The measured Herdr moves to 0.9.4.** `scripts/fixtures/herdr-supply.json` pins
+  v0.9.4 (`7e26bad9`), protocol 22, with both Linux asset digests taken from the
+  immutable release and named by its attestation. On aarch64 the pin rests on a
+  private CLI baseline: version, protocol 22, 18 `integration status` rows unchanged
+  from 0.9.3, pi (v9) and claude (v10) integrations seeded by 0.9.3 reading `current`
+  and reinstalling byte-identically, and a residue-free `server stop`. The full
+  `check-herdr-sandbox` has not run at this pin on either architecture; its first run
+  is this snapshot's CI. The x86_64 asset is recorded as not yet executed.
+- **Herdr 0.9.4 changes how plugins are installed.** It builds each install or update
+  in a new managed installation directory, keeps the previous one until no server uses
+  it, and adds `herdr plugin update`. The plugin README now says so. The Entwurf runtime
+  and harness wiring live outside the checkout, so an update should leave an activated
+  host working; that is not yet measured.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest 0.36.0, repair 0.12.8-repair.1. The downloaded
+  tarball is 11121634 bytes, SHA256
+  `7478acd01828280ccb989c4eeb230ae5238bddeeb791f6caa209a4fca2e24a0a`, byte-identical to
+  the preserved accepted core candidate; independently computed sha512 equals
+  `dist.integrity`. A sandboxed `pi install npm:@junghanacs/entwurf@0.36.0` resolved the
+  ACP bridge inside the sandbox and listed the curated `entwurf` models.
+- **Focused gates on the branch.** On aarch64, with the digest-checked Herdr 0.9.4 first
+  on `PATH`, nine focused gates passed: `check-herdr-supply` (11 assertions),
+  `check-herdr-plugin` (49), `check-herdr-plugin-profile` (14), `check-herdr-plugin-build`
+  (21), `check-herdr-runtime-bootstrap` (31), `check-herdr-activation` (33),
+  `check-herdr-placement` (25), `check-herdr-fresh-call` (45) and `check-gate-manifests`.
+  That last one validated 971 committed mutants across 72 lanes and executed none of them.
+  The scripts typecheck fence was clean.
+- **Receipt binding tightened, then re-checked.** Review found that the supply gate's
+  receipt check accepted a `herdr 0.9.40` receipt for the 0.9.4 pin, because it matched a
+  substring. It now requires the receipt to begin with the exact version token. Nine
+  in-memory stimuli against the gate's own check then returned the expected verdicts. They
+  include that prefix-version counterexample, which is refused, and a synthetic future x86_64
+  positive, which is not execution evidence. The supply gate, the fence and
+  `check-gate-manifests` were re-run green. The supply group's qualification PARTIAL killed
+  11/11 mutants with a green control. The other 960 committed mutants did not run, so this is
+  not qualification of the snapshot.
+- **The npm runtime swap against the real registry.** These cells used the production
+  runtime helper against the real registry, in sandboxed user roots.
+  - Seeding: the 0.35.1 runtime came from its own committed lock and package metadata.
+  - Swap: 0.35.1 → 0.36.0 took one acquisition. The cached 0.36.0 tarball's sha512 equals
+    the lock. Its sha256 `7478acd0…` equals the ready journal's observed digest and the
+    accepted core candidate.
+  - Journals: the `installing` journal carried the 0.35.1 identity as `previousRuntime`;
+    the `runtime-ready` journal carries `previousRuntime: null`.
+  - Last-good tree: when acquisition began, the 0.35.1 tree was still at the active address.
+    That it stays there until the candidate verifies comes from the helper's source order
+    (write `installing`, acquire and verify in staging, then swap). The run observed only
+    the start of that window.
+  - Torn swap: a manually seeded one (the active tree moved to the backup address; not a
+    killed process or power loss) was restored before acquisition and reported
+    `recovered: torn-swap`.
+  - Re-request: an exact re-request acquired nothing and left journal and tree
+    byte-identical.
+  - Removal: the owned removal reclaimed cache, runtime and journal.
+  - Not certified by these cells: Herdr's install/update relocation, harness wiring, the
+    installed CLI's deactivate path, a model turn, or recovery from a real kill.
+- Pending, and not claimed here:
+  - the pushed SHA's four-job CI, with the full `check-herdr-sandbox` and the qualification
+    body (971 mutants);
+  - the public-ref install/use/update/deactivate journey on Herdr 0.9.4, including whether
+    an activated runtime survives a plugin update.
+
+### Publication checkpoint
+
+Recorded after the snapshot, as docs only; no Herdr plugin byte, manifest or pin changes with it.
+
+- **Publication checkpoint for `v2026.10.14-herdr.0.36.0`, measured at its commit `9f33dd1`
+  before the snapshot was published.** The snapshot's push CI 38479767989 passed all four jobs
+  and the official exact-SHA oracle. Its check job verified the pinned x86_64 Herdr 0.9.4 digest
+  before execution; `check-herdr-sandbox` passed 12 assertions on private Herdr 0.9.4; the
+  qualification body killed 971/971. On Herdr 0.9.4 in a clean aarch64 container, the unchanged
+  `smoke-herdr-raw-install-live --ref main` passed at that commit. A driver-level journey then
+  went from the public `v2026.10.13-herdr.0.35.1` snapshot on Pi 1.1.0, through a pinned Pi
+  upgrade to 1.2.0, to a version-changing cross-ref reinstall of the 0.36.0 plugin (`herdr
+  plugin install … --ref main`) under a private Herdr server, and passed 10/10: wiring entries
+  unchanged; a session born before the reinstall kept its process, garden id and control socket;
+  a session was born after it; `herdr plugin update` at that same ref was only an
+  already-up-to-date no-op; and deactivate removed the owned runtime, cache, ledger and wiring
+  entries. On a fixed Pi 1.2.0 the 0.35.1 snapshot refuses by its own range: 0.35.1 and 0.36.0
+  accept disjoint Pi ranges. Not certified: a session's MCP or model continuity, `pi update
+  self`, a host upgrade, a `plugin update` that finds a new commit, a herdr-pane row, an x86_64
+  container, the tag as `--ref`, or when Herdr reclaims a retained previous installation. The
+  supply manifest's x86_64 `executed: false` remains the preparation-time declaration; flipping
+  it is a separate change.
+
+## 0.36.0 - 2026-10-13
+
+### pi-durable
+
+- **The thin app/TUI composition is Entwurf-owned source (#141).** The six carrier files
+  are emitted from `pi/pi-durable/src/experimental/durable/*.ts` (with `src/LICENSE`), which
+  folds in the retired `runtime-contacts.patch`, and run on the 1.2.0 SDK set (below). Net
+  against 0.35.1, three carrier files change: `runtime.js` `60c2965e…118403`, `tui.js`
+  `0f9ebaf8…b3abc5` and `subagent.js` `1cb2390b…a64220`. `harness-setup.js`, `prompt.js`,
+  `sessions.js` and LICENSE keep their 0.35.1 bytes. The source checkpoint `86d4b65` left the
+  package version at 0.35.1; this release sets 0.36.0. The first step (S0) moved ownership
+  alone: no carrier byte, no LICENSE and no SDK version (then 1.1.0) changed, only the pin's
+  carrier source blob ids. The upstream SDK still owns
+  execution, auth, queues, storage/transcript, compaction, cancellation and recovery (Rule 17).
+- **Pin schema 3.** `pi/pi-durable/overlay/upstream-pin.json` keeps its path and the shapes
+  installed readers use. A frozen `origin` holds the upstream commit, its recorded blobs, the
+  retired patch's digest and the 0.35.1 carrier digests. Only `carrier` is generated.
+- **Emitter.** `scripts/emit-pi-durable-carrier.ts --check` reads only in-repo source, and a
+  missing file is a named refusal. A host running a different Node gets the byte proof plus a
+  named emitter-identity SKIP, not a PASS. `--write` names every generated field it changes.
+  `--origin <clone>` checks provenance only. The CI `check` job runs the pinned emitter Node
+  exactly, with `ENTWURF_REQUIRE_EMITTER_NODE=1`; other jobs float the major.
+- **Typecheck fence.** `pi/pi-durable/tsconfig.json` is the fourth `pnpm typecheck` program:
+  strict, `erasableSyntaxOnly` / `verbatimModuleSyntax`, and `rootDirs` onto the installed
+  `pi-coding-agent/dist`, so internals are typed by their published declarations. Its explicit
+  empty `exclude` receives what the root program excludes. The exact devDependency
+  `@types/proper-lockfile@4.1.4` supplies the one missing declaration.
+- **Formatting.** The owned source uses upstream width (indentWidth 3), with no per-file
+  exception. Formatting `tui.ts` wrapped its one Entwurf-written dock line and added one trailing
+  comma, so `tui.js` was re-emitted (sha256 `63600d4b…095b`, the S1-B1 intermediate; the S1-B3
+  changes below produce the current `0f9ebaf8…b3abc5`). A parser-derived token/AST
+  comparison found nothing else changed. The `PI-DURABLE-FOOTER-BADGE-PROTECTED` mutant follows
+  the wrapped line and plants the same fault.
+- **Proof.** New claims: `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`, `-EMIT-NODE-EXACT`,
+  `PI-DURABLE-SOURCE-FENCE-RESOLVES`, `PI-DURABLE-SOURCE-NOT-SHIPPED` (the source, the fence and the
+  retired patch stay out of the JS-only tarball; proved on npm's own file list with
+  `--ignore-scripts` beside the carrier, while check-pack keeps the same tripwire on the floor), and
+  `PI-DURABLE-EMITTER-NODE-CI-BOUND` / `-CI-REQUIRED`. These two read the check job's active
+  setup-node input and its actual `check:full` step env, never comment text or another step.
+  Retired with the patch: `PI-DURABLE-CARRIER-PATCH-SECTIONS`.
+- **SDK set 1.2.0 (#141 S1-B2).** The nine published `@earendil-works/*` production dependencies
+  move from 1.1.0 to 1.2.0, with the pin's `sdk.members`, the install constellation, the pin-leak
+  matcher and the declared ranges (`>=1.2.0 <1.3`). `pi-client` and `pi-protocol` leave the set (not
+  published at 1.2.0); the only new third-party package is `@silvia-odwyer/photon@0.3.3`.
+- **1.2.0 tool output (#141 S1-B3).** On the 1.2.0 SDK set a native durable tool result's model
+  channel is `output`, which the SDK renamed from 1.1's `content`. When a result omits `output`, the
+  model gets the text the tool retained through `api.output()`. `content` is not read, so a result
+  naming only `content` that retained no output reaches the model as nothing. The subagent tool (now
+  `satisfies ToolExecutionResult`), the contact's bridge tools and the synthetic native-module
+  fixture retain none, so they answer in `output`. The ordinary Pi
+  `ToolExecutionComponent.updateResult` and `InputSubmissionDraft` keep `content`.
+- **Fatal session.** The carrier runtime takes the Session's own close listener and the report that
+  follows it: a session that failed and closed itself is on screen at once (`Session failed: <cause>.
+  It takes no more input, and a tool still running may take a while to stop. Close this session,
+  then reopen it with --continue.`) and input to it is refused by name, without waiting for
+  `closed`, which a tool ignoring its abort can hold off. A normal `close()` unsubscribes first and
+  is no failure. A failure listener subscribed after the failure is told at once, once. On that
+  signal the contact retires its receiver as `session-failed` before the next doorbell — also when
+  the session had already failed before the contact attached, so no receiver marker is left behind;
+  a normal close still retires it as `closed`, and a cleanup failure is thrown, not swallowed.
+- **Compaction failure.** The TUI draws the conversation's retained `pi.live.compactionFailure`
+  (`Compaction failed (<reason>): <error>`) for as long as the SDK keeps it. A failed background
+  compaction the SDK starts on its own (`threshold`) had no other report; the manual one keeps its
+  existing notice beside the line.
+- **Proof (S1-B3).** New claims `PI-DURABLE-SUBAGENT-OUTPUT-MODEL-VISIBLE`,
+  `-BRIDGE-TOOL-OUTPUT-MODEL-VISIBLE`, `-FATAL-SESSION-VIEW`, `-FATAL-SESSION-SHOWN`,
+  `-FATAL-SUBMIT-REFUSED`, `-RECEIVER-RETIRE-ON-FATAL`, `-SELF-CLOSE-NOT-FAILURE` and
+  `-COMPACTION-FAILURE-SHOWN` run the real bootstrap and carrier on the published 1.2.0 SDK with a
+  faux model and an injected storage failure; each mutant plants its fault in the generated carrier
+  or the bridge source.
+
+### Codex
+
+- **The 0.162.1 control endpoint is accepted as its exact alias (#141).** Codex 0.162.1 binds its
+  0600 control socket under `realpath(/tmp)/codex-daemon-<euid>/`, named by the sha256 of the
+  canonical advertised path, and makes the advertised path a symlink to it. One classifier,
+  `checkCodexSocketFile`, accepts a plain socket or exactly that alias (link owner, byte-equal
+  target, a 0700 socket directory owned by the same euid, a socket no other user can open) and
+  refuses every other symlink. The delivery probe, `codex queue --remote` and the fresh-call
+  preflight connect to the socket it verified. The managed launcher runs the same classifier's
+  compiled twin (`mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`) and keeps no copy of
+  its own: a missing twin is an incomplete installation, refused as
+  `codex-app-server-classifier-missing` (reinstall the package, or run `pnpm run build-bridge` in
+  a source checkout), and an answer it does not recognise is refused by name. This is measured
+  on the 0.162.1 layout only and promises nothing about a later Codex. The plain-socket layout is
+  kept; its native acceptance remains the dated 0.153.4 record, not a claim about every older or
+  newer version.
+- **Stated limits.** The launcher reports a dangling exact alias as the dead leftover the vendor
+  removes on start and launches over it, but its alias and dangling-alias paths have no LIVE
+  observation; they are proven on the classifier in a sandbox. The birth hook's thread naming,
+  the fresh Codex TUI's `--remote` endpoint and the fresh-call smoke's thread reads still hand the
+  advertised path to a connect without classifying it. Those connections worked in the named
+  diagnostic on this host; they remain unclassified. That is recorded as an Observation: not
+  every Codex connection goes through the classifier. A same-euid process can still replace the
+  verified socket file; that residual is named, not locked.
+
+### Docs
+
+- **Open, reopen and message lead the one-line surfaces.** The README, FAQ, CONTRIBUTING,
+  AGENTS, the Herdr plugin README and manifest description, and the package description and
+  keywords name the three verbs and where each lands, instead of describing Entwurf as
+  garden-id messaging alone. The README gains an open/reopen/message table with each verb's
+  harness scope. FAQ's tmux list includes pi-durable again, and CONTRIBUTING no longer calls
+  the shipped Codex native-push citizen an unreleased candidate.
+
+### Release boundary and verification
+
+- **Review.** The source checkpoint `86d4b65` and its amendment `d1c9103` were reviewed by
+  the #141 coordinator, Fable advisory reviews (no Blocker; their Defects were fixed before
+  the checkpoint) and a read-only Grok review of `86d4b65`. Grok's eight documentation and
+  live-authority findings were closed in `d1c9103`, and its recheck found no new Defect. The
+  Codex fix `90fa8bb` follows a coordinator-approved design with a read-only Grok design
+  review; a Fable advisory review of its pre-commit bytes found no Blocker, and its one Defect,
+  the missing Codex entry above, is closed in this section.
+- **Local evidence before this preparation is focused, not a whole pass.** Each affected
+  qualification wave (PARTIAL) measured its own candidate and none is carried to another. S0
+  killed 70/70 in two groups; 891 of its 961 committed claims were not run. The S1-B3 source
+  bytes killed 82/82 in three groups (dep-versions 4, pin-matcher 2, pi-durable beside 76), each
+  with a green control; 887 of the 969 committed claims were not run there, nor was the
+  node-floor coherence group. The Codex fix bytes, verified content-identical to `90fa8bb`,
+  killed 219/219 in six groups (app-server launch 10, native push 8, admission parity 2,
+  attribution self-test 1, gate manifests 52, mux fresh call 146), each with a green control;
+  752 of the 971 committed claims were not run. An earlier wave over that fix stopped at its
+  first group with 9 killed and one WRONG-REASON; it is kept as it was, not relabelled. The
+  vitest results cache drifting outside the dependency seal and one socket fixture temp root
+  observed during the native-push group are recorded, not waived. A fresh Entwurf-only npm
+  consumer of the `86d4b65` source bytes (packed with 0.35.1 metadata) proved graph and load
+  only: nine SDK members at 1.2.0, 24/24 carrier dist targets inside the consumer, and the
+  public launch reaching the SDK's own model refusal before any birth. A store migrated by a
+  1.2.0 run and reopened on 1.1.0 kept its version-2 tool task blocked as `task_too_old`: a
+  one-time fixture receipt, not a supported downgrade.
+- **Codex 0.162.1 diagnostic is not a cut.** On the pre-amendment candidate, one Linux
+  `smoke-codex-fresh-live` diagnostic against a live 0.162.1 app-server passed 65 assertions,
+  native push included, with `gpt-5.6-sol` on the Codex side and `openai-codex/gpt-6.1-sol` for
+  the Pi sibling only. It is not release-gate acceptance and covers no other model. The earlier
+  local FULL and LIVE `--cut` were taken on the pre-fix candidate (the cut was BLOCKED when the
+  advertised alias was refused) and are not evidence for this one. The frozen FULL and the final
+  LIVE `--cut` passed on this candidate (below); the installed-consumer proof
+  (`check-pack-install`, run by the CI `install-surface` job, not by `check:full`) and the
+  prepared SHA's CI body are pending.
+- **Final frozen floor on this candidate.** One frozen tree, HEAD `90fa8bb` plus this release's
+  metadata, with the same work-surface fingerprint before and after both runs.
+  `pnpm run check:full` passed once (817 s, exit 0; 599 files in the dry-run pack).
+  `LIVE=1 ./run.sh release-gate <scratch> --cut` passed once: **MUST PASS=24 FAIL=0 SKIP=0**,
+  **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, `cut: OK`. Its own static FULL (814 s) means this floor ran
+  FULL twice. The Codex step named the operator-owned 0.162.1 app-server by pid (851181) with
+  `gpt-5.6-sol` on the Codex side and `openai-codex/gpt-6.1-sol` for the Pi siblings, and passed
+  65 assertions, native push included; it attaches to an existing server, so the managed
+  launcher's alias and dangling-alias paths remain unobserved. Scratch
+  `/tmp/entwurf-release-gate-0.36.0.lw5Xju`, log SHA-256
+  `17a2bd54efaaeba2899bf9bbd3c13c0e68749d9d03367347c4872d6f4126ad30`; FULL log SHA-256
+  `184ea443326a72858d25b70ba25b44e804307205586d8a03d4af7c5b07ee1288`. A read-only host census
+  afterwards found one `entwurf-chain-*` and one `smoke-pi-durable-fresh-live-*` root from this
+  run, the same per-run residue earlier LIVE runs left; it is recorded and was not cleaned. This
+  is local acceptance only: not the exact CI, not a whole qualification pass.
+- **Exact CI pending.** The prepared SHA's exact CI (the four required jobs and the
+  qualification body) is the next checkpoint and is not presumed PASS.
+- **Unpublished candidate carrier.** As in 0.35.1, `plugins/herdr/runtime-lock.json`
+  temporarily names the closed `herdr-checkout` source: an npm-source lock must agree with
+  the checkout's core version, and 0.36.0 has no published integrity yet. The Herdr
+  manifest stays 0.35.1. After the operator publishes core 0.36.0, a separate Herdr snapshot
+  re-pins the measured registry bytes.
+- **Publication boundary.** No make artifact, core tag, GitHub Release or npm publication
+  is claimed; they wait for the exact CI, the make decision and the operator.
+
+## v2026.10.13-herdr.0.35.1 — Herdr Entwurf plugin 0.35.1
+
+A separate Herdr plugin snapshot, not another core release: core package 0.35.1 and
+its `v0.35.1` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.35.1 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns to production npm source
+  `@junghanacs/entwurf@0.35.1` with the registry's measured sha512
+  (`sha512-cZZaGfNP…EIchcQ==`). The plugin manifest moves 0.35.0 → 0.35.1;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **The same core capability through Herdr.** The runtime this snapshot acquires carries
+  core 0.35.1: the Claude 5.5 curation with its set-model readback and the pi-durable inbox
+  repair (#140). The core release also adds an English, source-only checkout menu. The
+  plugin changes no rail, gate or mutant.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.35.0
+  installation can rebind under the plugin README's ownership conditions. A host that
+  installed the intervening `herdr-checkout` candidate must explicitly deactivate by
+  its own absolute runtime path before reinstalling the npm-source snapshot.
+  No operator installation or active session is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest 0.35.1, repair 0.12.8-repair.1. The downloaded
+  tarball is 11101943 bytes, SHA256
+  `6edbcf9fbf31a6df1aff04f34b28ac279a071917d13916410bf466fd33a44eae`, equal to the preserved
+  core release candidate. Independently computed sha512 equals `dist.integrity`;
+  the registry-shipped runtime helper is byte-equal to this checkout's.
+- Required exact-registry-tarball Docker consumer passed without repacking. Real-npm
+  0.35.0 → 0.35.1 swap and harness-seeded torn-swap recovery passed: the product restored
+  the last-good tree before reacquisition, certified the new registry digest, then
+  performed an exact-request no-op and owned-fixture removal. Seven focused
+  Herdr/manifest gates passed with HEAD, index and work surface unchanged.
+  `check-herdr-sandbox` was not run locally for this snapshot because it reads the
+  operator's own herdr panes; it rides the pushed SHA's FULL floor in CI.
+- At preparation time, the public-ref install/use/deactivate/reinstall journey and the
+  pushed plugin SHA's ordinary four-job CI are still pending. Their actual outcomes belong
+  to the release checkpoint; this paragraph is not their acceptance. Earlier npm or
+  checkout-carrier receipts cannot certify these source-specific axes.
+- Core 0.35.1's native Codex LIVE remains an explicit per-cut unmeasured exception, not a
+  PASS or a standing waiver. Its whole qualification body ran at the core release SHA;
+  this plugin-only metadata change does not borrow that body as its own.
+
 ## 0.35.1 - 2026-10-13
 
 ### ACP

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@ This is a daily-driver bridge. Correctness beats feature breadth. Read this befo
 
 ## What this repo is
 
-`entwurf` is a **garden-citizen dispatch bridge** — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail** — that lets already-running harnesses address one another by garden id; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is an unreleased native-push candidate with record birth and delivery-probe evidence (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
+`entwurf` opens and messages visible sibling sessions across independent harnesses, and reopens dormant pi siblings in tmux ([capability table](./README.md)), with the garden id as their address — entwurf-core (v2 dispatch) + a meta-bridge + a pi adapter + an **ACP plugin on a two-backend adapter rail**; pi is one adapter, not the subject. The ACP plugin borrows the backend's identity (system prompt preset, model behavior, tool implementations) and shapes the *operating surface* — tools, MCP, skills, permissions — to match pi's own policy **wherever that backend exposes a knob for it**. Where it does not, the plugin does not fake one: a cortex session keeps its own native tool surface and receives MCP through an overlay projection, so "shaped to pi's policy" is a Claude-strength claim, not a universal one. Claude is the reference ACP backend and Snowflake Cortex Code is the second (landed 0.13.0, `cortex-` prefixed ids — [docs/acp-backend-rail.md](./docs/acp-backend-rail.md#cortex-code-audit-d1d10)); Codex is not on this rail at all — it is a shipped native-push citizen that keeps its own vendor tools and work context (see AGENTS.md, DELIVERY.md), never ACP-managed — and Gemini is not a shipped backend. That is the entire ACP-rail scope.
 
 **How a backend joins the rail** (the shape a PR must take): one adapter object in `pi-extensions/lib/acp/backend-adapter.ts` + its own curated rows/overlay modules + its own `check-acp-*` gate and mutant lane. Backend-specific *behavior* must stay behind the adapter, and backend-specific settings ride the opaque `adapterSettings` seam rather than growing the common config. That is not a ban on ever touching the common layer (`backend.ts`'s turn loop, `acp-client.ts`, `event-mapper.ts`, `session-store.ts`, `config.ts`) — cortex's landing did change `backend.ts` to pass the authoritative session key through the generic `ensureOverlay` seam. The rule is narrower and stricter: a common-layer change must be **backend-invariant** (it reads no backend name and branches on no backend) and **separately gated**. A common file that grows an `if (backend === …)` is the thing to reject.
 

package/DELIVERY.md

@@ -193,6 +193,21 @@ no daemon and no pid file: Ctrl-C is the operator's. A live socket, an unidentif
 second `--listen` are named refusals; a dead socket file is reported and launched over. Passing
 the raw vendor command by hand remains equivalent and is not deprecated.
 
+**The control endpoint from Codex 0.162.1 (#141).** `[source rust-v0.162.1]` The advertised path is
+now only an alias: the vendor binds a 0600 socket under `realpath(/tmp)/codex-daemon-<euid>/`, named
+by the sha256 of the canonical advertised path, and symlinks the advertised path to it
+(`app-server-transport/src/transport/unix_socket.rs:43-131, 290-304`; `uds/src/daemon_directory.rs:1-38`).
+One classifier, `checkCodexSocketFile`, accepts exactly a plain socket or that exact alias — link
+owner, byte-equal target, a 0700 socket directory, a socket no other user can open — and refuses
+every other symlink. The delivery probe, `codex queue --remote` and the fresh-call preflight connect
+to the socket it verified, never to the alias again. The launcher runs the same classifier's
+compiled twin (`mcp/entwurf-bridge/dist/scripts/codex-socket-classify.js`) directly, refuses any
+answer it does not recognise, and reports a dangling exact alias as the dead leftover the vendor
+removes on start. A same-euid process can still replace the verified socket file; that residual is
+named, not locked. The alias layout is certified on the classifier in a sandbox; the 0.162.1
+app-server protocol itself requires a named LIVE observation; a diagnostic is not release-cut
+acceptance, which separately requires the official release gate.
+
 #95 D1 (GLG, 2026-09-16) retired the requirement that this session be named `codex`, and with it the
 rule that an omitted-placement Codex TARGET selected it. The operator still owns the app-server and
 still chooses its room; Entwurf neither creates nor supervises it, and a missing app-server rejects.
@@ -489,6 +504,8 @@ ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> \
 ./run.sh smoke-codex-fresh-live
 ```
 
+The gate reads that ownership from the kernel, not from argv (#128). It takes the endpoint `checkCodexSocketFile` verified, finds its one LISTEN row in the named process's own socket table, and requires exactly one process in the named PID's own subtree to hold that inode — and still hold it on a bounded second read of that holder's fds, with every walked pid's parent and start time unchanged and the named PID still the process whose uid, argv and environment were checked (`scripts/lib/codex-socket-listener.ts`). A wrapper whose child listens (the pnpm `codex.js` shape measured at the 0.36.0 cut) and a listener started with the vendor-default `--listen unix://` are both read as what they are; a subtree that holds no fd on the inode is not-owned, and zero or several rows, several holders, an unreadable entry, or a pid, parent, fd or row that moved between reads is indeterminate. Either is a FAIL. A positive is only this ownership fact: it does not admit a vendor-managed daemon as an operator shape, and it does not satisfy the separate A ≠ S seat precondition.
+
 This is the intended gate entrypoint, not acceptance by command name. The accepted receipt above
 has a fixture only collecting evidence: a real visible record-backed Pi opens Codex from outside the
 home, and the later exact callback and bidirectional delivery receipts close the topology claim.

package/FAQ.md

@@ -8,7 +8,7 @@ No. Entwurf is closer to a workshop than a factory: it connects independently ow
 
 ## What does Entwurf do?
 
-It gives an existing session a stable **garden id** and routes a message, reply, or visible sibling launch through the rail that session actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
+It opens, reopens and messages visible sibling sessions across independent harnesses, each under a stable **garden id**. `entwurf_fresh_call` opens a new sibling in the caller's Herdr workspace or tmux session by default, `entwurf_resume_call` reopens a dormant pi sibling under the same id, and `entwurf_v2` delivers a message, reply or hand-off to an existing one through the rail it actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
 
 ## What is a garden id?
 
@@ -28,11 +28,11 @@ No. [`entwurf_v2`](./README.md#entwurf_v2--canonical-dispatch-verb) only address
 
 ## Where do visible siblings open?
 
-Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, Claude Code, Copilot, OMP, or Codex runtimes in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
+Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, pi-durable, Claude Code, Copilot, OMP, or Codex runtimes in a new window of the caller's tmux session, or of an existing session the caller names; without an explicit tmux placement, a Codex caller opens beside its own TUI pane. A dormant pi sibling reopens under the same id in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
 
 ## Does Entwurf replace Herdr or tmux?
 
-No. Herdr and tmux provide visible seats. Entwurf provides identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
+No. Herdr and tmux provide visible seats. Entwurf opens siblings into them, reopens dormant pi siblings, and carries identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
 
 ## How do I install it?
 

package/README.md

@@ -1,10 +1,12 @@
 # entwurf
 
-`entwurf` is a garden-citizen dispatch substrate: a thin bridge that lets independent
-agent harnesses address one another by **garden id**, without owning each other's
-transcript, authentication, tools, or runtime.
+`entwurf` connects independent agent harnesses as visible siblings: open a new session,
+reopen a dormant pi session in tmux, or reach an existing sibling by **garden id**. Fresh
+sessions open in the caller's Herdr workspace or tmux session by default; explicit tmux
+placement can name another existing session. Each harness keeps its own runtime,
+authentication, tools and transcript.
 
-![entwurf — a forged screwdriver for garden-citizen dispatch](docs/assets/entwurf-hero.jpg)
+![entwurf — a forged screwdriver for visible sibling sessions](docs/assets/entwurf-hero.jpg)
 
 **Pi ↔ native Claude Code inside the [Herdr workbench](#herdr-workbench).**
 A recorded source-checkout demo: callback → task → native Bash → reply.
@@ -21,12 +23,15 @@ receipts and named lifecycle verbs; the operator and native harnesses keep steer
 Git branches, worktrees, file isolation and internal delegation remain their concern.
 [Short answers: FAQ](./FAQ.md).
 
-```text
-pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
-  → record-backed garden id
-    → entwurf_v2
-      → control-socket | self-fetch mailbox | native-push
-```
+| Verb | Tool | Where it lands | Harnesses |
+|---|---|---|---|
+| **Open** a new sibling | `entwurf_fresh_call` | Herdr: a new unfocused tab in the caller's workspace. tmux: a new window in the caller's session, or an existing session named by `placement.tmuxSession`; without an explicit tmux placement, a Codex caller opens beside its own TUI pane | Herdr: pi, Claude Code. tmux: pi, pi-durable, Claude Code, Copilot, OMP, Codex |
+| **Reopen** a dormant sibling | `entwurf_resume_call` | A visible tmux window under the same garden id, with the transcript, model, provider and cwd its record names; no turn is run | pi |
+| **Message** an existing sibling | `entwurf_v2` | Its own rail: control socket, self-fetch mailbox or native push; delivery starts no process | pi, pi-durable, Claude Code, Copilot, OMP, Antigravity, Codex |
+
+Antigravity is message-only: an existing conversation registers itself, and Entwurf never
+launches one. A launch receipt is neither the new sibling's address nor proof that it
+processed its task; the sibling's own callback envelope supplies its garden id.
 
 The package holds the v2 core, native-harness bridges, a pi adapter and an ACP
 plugin. ACP is one ingress, not the boundary; pi is one adapter, not the center.
@@ -40,14 +45,15 @@ receipts; [CHANGELOG](./CHANGELOG.md) records source history.
 ## Install
 
 **Choose by where you work. Bring your own harnesses, subscriptions and login.**
-The native durable route below additionally supplies the upstream app/TUI missing from its npm
-release; it does not supply credentials or take ownership of the harness.
+The native durable route below additionally supplies an app/TUI, Entwurf's own thin composition of
+the durable app upstream omits from its npm release; it does not supply credentials or take
+ownership of the harness.
 
 ### Direct — ordinary shell or tmux
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.1.0 <1.2`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.2.0 <1.3`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -77,7 +83,7 @@ restriction; that is not certification of every platform's harness rails.
 
 ### Native durable (pi-durable)
 
-**The package supplies the pinned upstream app/TUI and nine exact Pi 1.1.0 SDK
+**The package supplies Entwurf's owned app/TUI carrier and nine exact Pi 1.2.0 SDK
 members.** No separate runtime checkout, patch, build or ordinary Pi CLI is needed.
 The launch verifies carrier integrity and every reachable SDK edge's name/version;
 incomplete, drifted or mixed supply refuses by name.
@@ -87,8 +93,9 @@ entwurf pi-durable --provider <provider> --model <model-id> --width task-wide
 entwurf pi-durable --continue
 ```
 
-The contact adds garden identity and two-way mailbox communication. Runtime/TUI,
-models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
+The contact adds garden identity and two-way mailbox communication. Entwurf owns the
+thin app/TUI composition (shipped as an emitted JS carrier); execution, models/auth, queues,
+SQLite, transcripts and recovery remain the upstream SDK's:
 [Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
 
 Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
@@ -161,6 +168,13 @@ Liveness is read at dispatch time; an id's shape does not tell you its transport
 
 ### `entwurf_v2` — canonical dispatch verb
 
+```text
+pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
+  → record-backed garden id
+    → entwurf_v2
+      → control-socket | self-fetch mailbox | native-push
+```
+
 | What you want | Tool | What its receipt means |
 |---|---|---|
 | Message, reply or hand off to an existing garden id | `entwurf_v2 {target, intent:"fire-and-forget", message}` | Receiver acceptance boundary, mailbox enqueue or native injection; not completion |