@junghanacs/entwurf 0.36.0 → 0.37.0

package/scripts/check-acp-stop-reason.ts

@@ -54,6 +54,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Model } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
+import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
 const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
@@ -118,8 +119,6 @@ const DEFAULT_RESOLVED_CONFIG: any = {
  */
 function makeHarness(recordDir: string, wireReason: string | null) {
 	return {
-		resolveLaunch: () => ({ command: "node", args: ["fake"] }),
-		ensureOverlay: () => {},
 		spawnChild: () => makeFakeChild(),
 		createConnection: (_child: any, handlers: any) => ({
 			initialize: async () => ({ agentCapabilities: {} }),
@@ -143,6 +142,7 @@ function makeHarness(recordDir: string, wireReason: string | null) {
 const TMP_EMIT = ".tmp-verify/acp-stop-reason";
 rmSync(TMP_EMIT, { recursive: true, force: true });
 const recordDir = mkdtempSync(resolve(tmpdir(), "acp-stop-rec-"));
+const gateHome = sandboxAcpGateHome("acp-stop-reason-home-");
 
 /**
  * One driven turn, described by everything an operator could observe.
@@ -250,6 +250,7 @@ try {
 	const backendUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href;
 	const eventUrl = pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/event-mapper.js")).href;
 	const backend = (await import(backendUrl)) as any;
+	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 	const eventMod = (await import(eventUrl)) as any;
 
 	// ----------------------------------------------------------------------
@@ -354,6 +355,7 @@ try {
 		// non-empty or already gone — fine either way
 	}
 	rmSync(recordDir, { recursive: true, force: true });
+	gateHome.restore();
 }
 
 console.log(

package/scripts/check-acp-stream-hooks.ts

@@ -34,6 +34,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
+import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
 const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
@@ -108,8 +109,6 @@ function makeHarness(recordDir: string) {
 		children,
 		promptCalls,
 		deps: {
-			resolveLaunch: () => ({ command: "node", args: ["fake"] }),
-			ensureOverlay: () => {},
 			spawnChild: () => {
 				const c = makeFakeChild();
 				children.push(c);
@@ -187,6 +186,7 @@ const onResponse = () => {
 const TMP_EMIT = ".tmp-verify/acp-stream-hooks";
 rmSync(TMP_EMIT, { recursive: true, force: true });
 const recordDir = mkdtempSync(resolve(tmpdir(), "acp-stream-hooks-"));
+const gateHome = sandboxAcpGateHome("acp-stream-hooks-home-");
 
 try {
 	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
@@ -196,6 +196,7 @@ try {
 	mkdirSync(promptsOut, { recursive: true });
 	copyFileSync("pi-extensions/lib/acp/prompts/engraving.md", resolve(promptsOut, "engraving.md"));
 	const backend = (await import(pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href)) as any;
+	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 
 	// ----------------------------------------------------------------------
 	// CELL 1 — NEW turn: the hook sees the EXACT wire params; undefined keeps them.
@@ -510,6 +511,7 @@ try {
 		// non-empty or already gone — fine either way
 	}
 	rmSync(recordDir, { recursive: true, force: true });
+	gateHome.restore();
 }
 
 console.log(

package/scripts/check-acp-usage-accounting.ts

@@ -60,6 +60,7 @@ import type {
 } from "@earendil-works/pi-ai";
 import { isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
 import { calculateContextTokens } from "@earendil-works/pi-coding-agent";
+import { assertOverlayInSandbox, sandboxAcpGateHome } from "./lib/acp-gate-home.ts";
 
 const claude = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 const cortex = { id: "cortex-auto" } as unknown as Model<Api>;
@@ -193,8 +194,6 @@ function makeHarness(recordDir: string, scripts: TurnScript[]) {
 			return newSessionCalls;
 		},
 		deps: {
-			resolveLaunch: () => ({ command: "node", args: ["fake"] }),
-			ensureOverlay: () => {},
 			spawnChild: () => {
 				const c = makeFakeChild();
 				children.push(c);
@@ -297,6 +296,7 @@ function reuseCtx3(a: string, b: string, c: string): TranscriptContext {
 const TMP_EMIT = ".tmp-verify/acp-usage-accounting";
 rmSync(TMP_EMIT, { recursive: true, force: true });
 const recordDir = mkdtempSync(resolve(tmpdir(), "acp-usage-acct-"));
+const gateHome = sandboxAcpGateHome("acp-usage-accounting-home-");
 
 try {
 	execFileSync("node_modules/.bin/tsc", ["--outDir", TMP_EMIT, "--rootDir", ".", "--noEmit", "false"], {
@@ -306,6 +306,7 @@ try {
 	mkdirSync(promptsOut, { recursive: true });
 	copyFileSync("pi-extensions/lib/acp/prompts/engraving.md", resolve(promptsOut, "engraving.md"));
 	const backend = (await import(pathToFileURL(resolve(TMP_EMIT, "pi-extensions/lib/acp/backend.js")).href)) as any;
+	await assertOverlayInSandbox(TMP_EMIT, gateHome);
 
 	// ----------------------------------------------------------------------
 	// CELL 1 — the turn aggregate never reaches pi's per-request fields.
@@ -1062,6 +1063,7 @@ try {
 		// non-empty or already gone — fine either way
 	}
 	rmSync(recordDir, { recursive: true, force: true });
+	gateHome.restore();
 }
 
 /** Distinct-but-uninteresting token partition for the cost-focused cells. */

package/scripts/check-gate-qualification.ts

@@ -3442,7 +3442,7 @@ let manifestCount: number;
 		"acp-overlay": 1,
 		"acp-prompt-lifecycle": 15,
 		"acp-set-model-readback": 2,
-		"acp-stop-reason": 6,
+		"acp-stop-reason": 7,
 		"acp-stream-hooks": 10,
 		"acp-usage-accounting": 12,
 		"acp-vendor-rejection": 4,
@@ -3453,7 +3453,7 @@ let manifestCount: number;
 		"codex-app-server-launch": 10,
 		"codex-caller-seat": 28,
 		"control-send-receipt": 19,
-		"codex-native": 83,
+		"codex-native": 87,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
 		"demo-reproducibility": 12,
@@ -3464,7 +3464,7 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 78,
+		"pi-durable": 84,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 12,

package/scripts/check-herdr-supply.ts

@@ -32,7 +32,8 @@
  *   HSUP-CI-REQUIRES-HERDR    that floor runs with absence turned red
  *   HSUP-CI-LINUX-ONLY        only the Linux check job takes this; the other jobs are untouched
  *   HSUP-SETUP-NEVER-INSTALLS the product's own setup/package never installs herdr (Rule 17)
- *   HSUP-X86-UNEXECUTED       the x86_64 asset is pinned but recorded as never executed
+ *   HSUP-EXECUTION-RECEIPT-BOUND  an asset recorded as executed declares a receipt bound to this
+ *                                 pin's version and its own full digest; an unexecuted one has none
  */
 
 import assert from "node:assert/strict";
@@ -62,7 +63,34 @@ interface Supply {
 	measuredOn: string;
 	measuredArch: string;
 	releaseUrlPrefix: string;
-	assets: Record<string, { name: string; sha256: string; executed: boolean; executedNote: string }>;
+	assets: Record<
+		string,
+		{ name: string; sha256: string; executed: boolean; executedNote: string; executedReceipt?: string }
+	>;
+}
+
+/** An asset may be RECORDED as executed only with a declared receipt bound to THIS pin: the
+ * receipt BEGINS with the exact token `herdr <supply.version> ` (a substring match would let
+ * `herdr 0.9.40` stand for 0.9.4) and names the asset's FULL sha256. That checks the
+ * declaration's binding and nothing more — it is not a cryptographic receipt and cannot prove the
+ * binary ran. An unexecuted asset carries no receipt, both states keep a note, and the
+ * architecture the manifest says it was measured on must itself be recorded as executed. The
+ * architecture is never hardcoded: a future x86_64 `true` is admitted the same way, with its own. */
+function executionReceiptsBound(supply: Supply): boolean {
+	const assets = Object.values(supply.assets);
+	const noted = (note: unknown): boolean => typeof note === "string" && note.trim().length > 0;
+	return (
+		assets.length > 0 &&
+		assets.every((a) =>
+			a.executed === true
+				? typeof a.executedReceipt === "string" &&
+					a.executedReceipt.startsWith(`herdr ${supply.version} `) &&
+					a.executedReceipt.includes(a.sha256) &&
+					noted(a.executedNote)
+				: a.executed === false && a.executedReceipt === undefined && noted(a.executedNote),
+		) &&
+		supply.assets[supply.measuredArch]?.executed === true
+	);
 }
 
 function main(): void {
@@ -171,11 +199,8 @@ function main(): void {
 
 	// ── honesty about what has actually run ──────────────────────────────────────────────
 	ok(
-		"[QK:HSUP-X86-UNEXECUTED] the x86_64 asset is pinned but RECORDED AS NEVER EXECUTED — every measurement in this lane ran on aarch64, so a pinned digest must not read as evidence that the cell passes on the other architecture",
-		supply.assets.x86_64?.executed === false &&
-			supply.assets.aarch64?.executed === true &&
-			supply.measuredArch === "aarch64" &&
-			(supply.assets.x86_64?.executedNote ?? "").length > 0,
+		"[QK:HSUP-EXECUTION-RECEIPT-BOUND] an asset is recorded as executed only with a DECLARED receipt bound to this pin's version and its own full digest, and an unexecuted one carries none — a pinned digest is never evidence that its cell ran, and a receipt from another pin or another asset is not this one's. This checks the declaration's binding, not that the binary ran",
+		executionReceiptsBound(supply),
 	);
 
 	console.log(`\n[check-herdr-supply] ${passed} assertions ok`);

package/scripts/fixtures/herdr-supply.json

@@ -1,10 +1,10 @@
 {
-	"$comment": "SSOT for the herdr binary this repository has MEASURED against. Nothing else may carry a version or a digest: the CI installer, the sandbox gate's boundary check and the launch-rail document all read or cite this file. Re-measuring a new herdr means running check-herdr-sandbox against it FIRST, then editing this file, then repairing the measured sentences in docs/herdr-launch-rail.md in the same commit — miss one and the gate fails on version mismatch, which is the point.",
-	"version": "0.9.3",
-	"tag": "v0.9.3",
-	"tagCommit": "7b116c05bfda646af39d2524c54e70c751f57ee8",
+	"$comment": "SSOT for the herdr binary this repository has MEASURED against. Nothing else may carry a version or a digest: the CI installer, the sandbox gate's boundary check and the launch-rail document all read or cite this file. Re-measuring a new herdr means measuring it FIRST — fetched by digest and verified before it is made executable, then run against a private sandbox server (at least version, status-client protocol and integration rows) — then editing this file and repairing the measured sentences in docs/herdr-launch-rail.md in the same commit; miss one and the gate fails on version mismatch, which is the point. A private baseline is not the full gate: check-herdr-sandbox at a new pin is certified by its exact-SHA CI run unless it was also run locally, and an asset is recorded `executed` only with a receipt bound to this version and its full digest (check-herdr-supply HSUP-EXECUTION-RECEIPT-BOUND).",
+	"version": "0.9.5",
+	"tag": "v0.9.5",
+	"tagCommit": "2ecf19a92fc3a7fff75b6ce3655ef04f4625ec01",
 	"socketProtocol": 22,
-	"measuredOn": "2026-10-03",
+	"measuredOn": "2026-10-15",
 	"measuredArch": "aarch64",
 	"releaseUrlPrefix": "https://github.com/herdrdev/herdr/releases/download",
 	"integrity": {
@@ -15,15 +15,17 @@
 	"assets": {
 		"x86_64": {
 			"name": "herdr-linux-x86_64",
-			"sha256": "18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7",
-			"executed": false,
-			"executedNote": "pending the first CI run on an x86_64 runner — the digest is pinned (and named by GitHub's release attestation for pkg:github/herdrdev/herdr@v0.9.3), but no cell of this rail has ever run on this binary"
+			"sha256": "14d9e8bc8b4a9e0118d77c32266f76d461f09b40342eb23752960bd89f59929d",
+			"executed": true,
+			"executedReceipt": "herdr 0.9.5 linux-x86_64 sha256 14d9e8bc8b4a9e0118d77c32266f76d461f09b40342eb23752960bd89f59929d — 2026-10-15, GitHub Actions check job (x86_64), CI run 38667564413 at d8cd8f3, read from that run's check-job log: `install-herdr-ci` verified this digest before execution, and check-herdr-sandbox passed 12 assertions on private herdr 0.9.5, HS-VERSION-BOUNDARY included",
+			"executedNote": "the receipt is the full sandbox gate at the SHA that introduced this pin; it is not a claim for any later SHA. The previous pin's x86_64 asset (v0.9.4, sha256 493304fb…) ran in CI run 38479767989 at 9f33dd1, check-herdr-sandbox 12 assertions — dated history of that asset, not evidence for this one"
 		},
 		"aarch64": {
 			"name": "herdr-linux-aarch64",
-			"sha256": "4de7aa3e25678812e92960de64f7c2aaa1bca1f0f80a3c5e559837e231e1f5c0",
+			"sha256": "17d7536f2da50859523680ef279dffcac8e4a235f4e46fe8da6c2ec44141897c",
 			"executed": true,
-			"executedNote": "the #116 rail was re-measured on this exact binary on 2026-10-03 (#126), fetched by digest through scripts/install-herdr-ci.sh into a temp dir and run from an isolated snapshot whose manifest named it: `check-herdr-sandbox` green (12 assertions, private server), `herdr status client` reports protocol 22 (unchanged from 0.9.1), and `integration status` prints the same 18 rows as 0.9.1 in a sandbox HOME once that root path is normalized; pi (v9) and claude (v10) integrations installed by 0.9.1 read `current` under 0.9.3 and a 0.9.3 reinstall leaves their bytes identical. The operator host still runs the 0.9.1 asset at that date and was not touched. The 0.9.1 receipt (2026-09-17) stays dated in docs/herdr-launch-rail.md"
+			"executedReceipt": "herdr 0.9.5 linux-aarch64 sha256 17d7536f2da50859523680ef279dffcac8e4a235f4e46fe8da6c2ec44141897c — 2026-10-15, oracle aarch64, Phase A private CLI baseline (docs/herdr-launch-rail.md, 재측정 2026-10-15): `herdr --version` 0.9.5; `status client` protocol 22, endpoint_protocol_generation 1; `integration status` 18 rows, zero diff against 0.9.4 in a fresh sandbox; over integrations seeded by 0.9.4, pi reads `current (v9)` and claude reads `outdated (v10 < v11)`; a 0.9.5 reinstall leaves the pi extension and claude settings.json byte-identical, changes the claude hook only in its `HERDR_INTEGRATION_VERSION` line (10 → 11), and then reads `current (v11)`; `server stop` leaves no socket and no process",
+			"executedNote": "the receipt is a private CLI baseline only. check-herdr-sandbox has NOT run on this architecture at this pin — its operator-untouched cell reads the operator's own panes — so the full gate's first run at this pin was the CI check job on the x86_64 asset (CI run 38667564413) — not this one. The operator host was not touched. The 0.9.4 receipt (2026-10-14) stays dated in docs/herdr-launch-rail.md"
 		}
 	}
 }

package/scripts/lib/acp-gate-home.ts

@@ -0,0 +1,75 @@
+// In-process HOME sandbox for the ACP gates that drive the compiled `backend.streamAcpTurn`
+// (Rule 12: offline verification never rewires the operator).
+//
+// The turn loop resolves the REAL routed adapter from the model id and calls its
+// `ensureOverlay()`; there is no deps seam for it (`AcpTurnDeps`). Claude's overlay, the session
+// cache and the operator settings path are `homedir()` constants evaluated when the compiled
+// modules load. So the sandbox must exist BEFORE the first import of the emitted backend, and the
+// gate proves it by reading the overlay constant from that same emitted module graph. Same env
+// set as `pi-extensions/lib/acp/backend.vendor-rejection.test.ts`.
+
+import { strict as assert } from "node:assert";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const SANDBOXED_ENV = [
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_STATE_HOME",
+	"XDG_CACHE_HOME",
+	"PI_CODING_AGENT_DIR",
+	"PI_SESSION_ID",
+	"PI_AGENT_ID",
+	"CLAUDE_AGENT_ACP_COMMAND",
+	"PI_EMACS_AGENT_SOCKET",
+] as const;
+
+export interface AcpGateHome {
+	readonly home: string;
+	/** Restore every sandboxed variable and remove the sandbox root. */
+	restore(): void;
+}
+
+/** Point HOME, XDG and the pi agent dir into a fresh temp root. Call before importing backend. */
+export function sandboxAcpGateHome(prefix: string): AcpGateHome {
+	const root = mkdtempSync(join(tmpdir(), prefix));
+	const saved = new Map<string, string | undefined>(SANDBOXED_ENV.map((key) => [key, process.env[key]]));
+	const home = join(root, "home");
+	mkdirSync(home, { recursive: true });
+	process.env.HOME = home;
+	process.env.XDG_CONFIG_HOME = join(root, "xdg-config");
+	process.env.XDG_DATA_HOME = join(root, "xdg-data");
+	process.env.XDG_STATE_HOME = join(root, "xdg-state");
+	process.env.XDG_CACHE_HOME = join(root, "xdg-cache");
+	process.env.PI_CODING_AGENT_DIR = join(home, ".pi", "agent");
+	delete process.env.PI_SESSION_ID;
+	delete process.env.PI_AGENT_ID;
+	delete process.env.CLAUDE_AGENT_ACP_COMMAND;
+	delete process.env.PI_EMACS_AGENT_SOCKET;
+	return {
+		home,
+		restore() {
+			for (const [key, value] of saved) {
+				if (value === undefined) delete process.env[key];
+				else process.env[key] = value;
+			}
+			rmSync(root, { recursive: true, force: true });
+		},
+	};
+}
+
+/** Refuse to drive a turn unless the emitted overlay constant resolves inside the sandbox HOME. */
+export async function assertOverlayInSandbox(emitDir: string, sandbox: AcpGateHome): Promise<void> {
+	const overlayMod = (await import(pathToFileURL(resolve(emitDir, "pi-extensions/lib/acp/overlay.js")).href)) as {
+		CLAUDE_CONFIG_OVERLAY_DIR: string;
+	};
+	assert.equal(
+		overlayMod.CLAUDE_CONFIG_OVERLAY_DIR,
+		join(sandbox.home, ".pi", "agent", "claude-config-overlay"),
+		"the compiled backend resolved the Claude overlay outside the gate's sandbox HOME, so its real " +
+			"ensureOverlay() would refresh the operator's overlay [QK:ACP-GATE-HOME-SANDBOXED]",
+	);
+}