@junghanacs/entwurf 0.36.0 → 0.37.0

package/scripts/mutants/pi-durable.json

@@ -458,7 +458,7 @@
 			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
 			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
 			"subject": "pi/pi-durable/overlay/upstream-pin.json",
-			"find": ["\"sha256\": \"60c2965eadbdbbe78fce1b7eeb89d97eb3104a30b7d58ebca87009d2e9118403\""],
+			"find": ["\"sha256\": \"725757156580ad2a2d170c790440763371bb8035052a0c6caae6af5159d4718f\""],
 			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
@@ -701,8 +701,8 @@
 			"claim": "PI-DURABLE-MODULE-ABSENT-UNCHANGED",
 			"title": "the module phase runs without a --native-module, so a launch that names no module still tries to import one",
 			"subject": "pi/pi-durable/bootstrap.mjs",
-			"find": ["\tconst { nativeModules = [], ...args } = parseArgs(argv);"],
-			"replace": ["\tconst { nativeModules = [undefined], ...args } = parseArgs(argv);"],
+			"find": ["\tconst { nativeModules = [], resume = false, ...args } = parseArgs(argv);"],
+			"replace": ["\tconst { nativeModules = [undefined], resume = false, ...args } = parseArgs(argv);"],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-MODULE-ABSENT-UNCHANGED]",
@@ -735,12 +735,12 @@
 				"\tconst extensions = await loadNativeModules(nativeModules);",
 				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
 				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
-				"\tconst { runDurableTui } = await loadTui();"
+				"\tconst tui = await loadTui();"
 			],
 			"replace": [
 				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
 				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
-				"\tconst { runDurableTui } = await loadTui();",
+				"\tconst tui = await loadTui();",
 				"\tconst extensions = await loadNativeModules(nativeModules);"
 			],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
@@ -791,8 +791,8 @@
 			"claim": "PI-DURABLE-MODULE-CWD-PINNED",
 			"title": "the app is opened wherever the process is at open time, not in the caller's directory fixed before the module ran",
 			"subject": "pi/pi-durable/bootstrap.mjs",
-			"find": ["\tconst citizen = await openDurableCitizen({ ...args, cwd, extensions, bridgeEntry, open, contact });"],
-			"replace": ["\tconst citizen = await openDurableCitizen({ ...args, extensions, bridgeEntry, open, contact });"],
+			"find": ["\t\t...(session === undefined ? {} : { session }),\n\t\tcwd,\n\t\textensions,\n\t\tbridgeEntry,"],
+			"replace": ["\t\t...(session === undefined ? {} : { session }),\n\t\textensions,\n\t\tbridgeEntry,"],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-MODULE-CWD-PINNED]",
@@ -1142,7 +1142,7 @@
 		},
 		{
 			"claim": "PI-DURABLE-COMPACTION-FAILURE-SHOWN",
-			"title": "the TUI drops the conversation's retained compaction failure: a failed background compaction vanishes from the screen once its status is removed",
+			"title": "the TUI drops the conversation's retained compaction failure: a failed threshold compaction vanishes from the screen once its status is removed",
 			"subject": "pi/pi-durable/carrier/tui.js",
 			"find": ["\tif (compaction !== undefined) {\n\t\tlines.push"],
 			"replace": ["\tif (compaction === null) {\n\t\tlines.push"],
@@ -1151,6 +1151,78 @@
 			"signature": "[QK:PI-DURABLE-COMPACTION-FAILURE-SHOWN]",
 			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
 			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-STREAM-TRANSPORT-WIRE",
+			"title": "the Harness settings stop carrying the transport: the provider never continues a response, so every request of a long session resends the whole conversation",
+			"subject": "pi/pi-durable/carrier/harness-setup.js",
+			"find": ["\t\t\t\ttransport: settingsManager.getTransport(),"],
+			"replace": ["\t\t\t\t// transport is not forwarded"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-STREAM-TRANSPORT-WIRE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-STREAM-TRANSPORT-FORWARDED",
+			"title": "the Harness settings fix the transport instead of reading the operator's: a chosen sse or plain websocket is silently replaced by auto",
+			"subject": "pi/pi-durable/carrier/harness-setup.js",
+			"find": ["\t\t\t\ttransport: settingsManager.getTransport(),"],
+			"replace": ["\t\t\t\ttransport: \"auto\","],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-STREAM-TRANSPORT-FORWARDED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-COMPACTION-WAITS",
+			"title": "the Harness settings hand the SDK pi's compaction settings alone: its default background policy summarizes beside a running turn instead of the turn waiting",
+			"subject": "pi/pi-durable/carrier/harness-setup.js",
+			"find": ["\t\t\treturn { ...settingsManager.getCompactionSettings(), backgroundTokens: 0 };"],
+			"replace": ["\t\t\treturn settingsManager.getCompactionSettings();"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-COMPACTION-WAITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-PROMPT-SKILL-SCOPE-BASE",
+			"title": "the prompt hands the skills setting over as written: a relative project entry is read against the conversation's directory and its skills are silently not listed",
+			"subject": "pi/pi-durable/carrier/prompt.js",
+			"find": ["\t\t\t\t\tskillPaths: scopedSkillPaths(settings, agentDir, fallbackCwd),"],
+			"replace": ["\t\t\t\t\tskillPaths: settings.getSkillPaths(),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PROMPT-SKILL-SCOPE-BASE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RESUME-OPENS-CHOSEN",
+			"title": "the runtime drops the chosen session id: --resume opens a new session instead of the conversation the operator picked",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\toptions.continueSession ?? false,\n\t\toptions.session,\n\t);"],
+			"replace": ["\t\toptions.continueSession ?? false,\n\t);"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RESUME-OPENS-CHOSEN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RESUME-CANCEL-OPENS-NOTHING",
+			"title": "a cancelled --resume falls back to the newest session: the operator said no and a conversation opens anyway",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\tprocess.stderr.write(\"[pi-durable] resume-cancelled: nothing was opened\\n\");\n\t\t\treturn;"],
+			"replace": ["\t\t\targs.continueSession = true;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RESUME-CANCEL-OPENS-NOTHING]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		}
 	]
 }

package/scripts/smoke-codex-fresh-live.ts

@@ -68,6 +68,7 @@ import {
 } from "../pi-extensions/lib/meta-session.ts";
 import { FRESH_CALL_BACKENDS } from "../pi-extensions/lib/mux-fresh-call.ts";
 import {
+	checkCodexSocketFile,
 	readCodexThread,
 	realCodexProtocolOpener,
 	resolveCodexDefaultSocketPath,
@@ -95,6 +96,12 @@ import {
 	sourceCleanupWindows,
 	validateFinalMailboxBody,
 } from "./lib/codex-fresh-source-receipts.ts";
+import {
+	describeCodexSocketOwnership,
+	judgeCodexSocketOwnership,
+	observeCodexSocketSubtree,
+	parseProcStat,
+} from "./lib/codex-socket-listener.ts";
 import { skipLive } from "./lib/live-skip.ts";
 import { parseTmuxRow, TMUX_COORDINATE_FIELDS, TMUX_COORDINATE_FORMAT } from "./lib/tmux-coordinate-row.ts";
 
@@ -697,7 +704,8 @@ async function run(): Promise<void> {
 	//                            `--cut` still refuses it as BLOCKED (MUST SKIP). Nothing is
 	//                            excused — a cut without this receipt remains impossible.
 	//   PRESENT BUT WRONG     -> FAIL, unchanged: a malformed or dead PID, a process whose
-	//                            argv is not a Codex app-server, a foreign uid, A == S. The
+	//                            argv is not a Codex app-server, a foreign uid, a subtree that
+	//                            does not hold the endpoint's LISTEN socket, A == S. The
 	//                            operator answered, and the answer is a defect.
 	// Nothing is inferred either way, and no default is invented for a value the operator
 	// did not give. The reproducible green is the invocation VERIFY and the release skill's
@@ -747,6 +755,10 @@ async function run(): Promise<void> {
 		fs.existsSync(procDir),
 		`missing ${procDir}`,
 	);
+	// Read BEFORE the uid/argv/environment checks below and handed to the socket-ownership
+	// observer, so the process those checks read and the process that owns the socket are the
+	// same one: a pid reused in between changes this start time and fails closed (#128).
+	const namedStartTime = parseProcStat(fs.readFileSync(path.join(procDir, "stat"), "utf8")).startTime;
 	const procStat = fs.statSync(procDir);
 	if (typeof process.getuid === "function") {
 		ok("the named app-server process belongs to this operator", procStat.uid === process.getuid());
@@ -774,15 +786,27 @@ async function run(): Promise<void> {
 	// cannot be borrowed into a claim about what a Codex MCP child inherits.
 	appServerEnv = { ...procEnv };
 	codexSocketPath = resolveCodexDefaultSocketPath(appServerEnv);
-	const expectedListen = `unix://${codexSocketPath}`;
-	const listensOnDefaultSocket = argv.some(
-		(arg, index) => (arg === "--listen" && argv[index + 1] === expectedListen) || arg === `--listen=${expectedListen}`,
+	// Ownership is read from the kernel, not from argv (#128). The endpoint is the one delivery
+	// itself connects to — the production classifier's verified physical socket — and the claim
+	// is that the named pid's OWN subtree holds its LISTEN inode. The argv `--listen` spelling
+	// is recorded in the receipt below and decides nothing: a wrapper whose child listens and a
+	// listener started with the vendor-default `--listen unix://` are both read as what they are.
+	const socketFile = checkCodexSocketFile(codexSocketPath);
+	ok(
+		"the default control path is a live socket or Codex's exact rendezvous alias — the endpoint delivery connects to",
+		socketFile.ok,
+		socketFile.ok ? "" : `${codexSocketPath}: ${socketFile.reason}`,
+	);
+	const socketOwnership = judgeCodexSocketOwnership(
+		observeCodexSocketSubtree(appServerPid, socketFile.connectPath, namedStartTime),
 	);
 	ok(
-		"the explicit app-server PID owns the same default UDS the fresh Codex runtime will use",
-		listensOnDefaultSocket,
-		`expected --listen ${expectedListen}; argv=${JSON.stringify(argv)}`,
+		"the explicit app-server PID's own process subtree holds the LISTEN socket at that verified endpoint",
+		socketOwnership.verdict === "owned",
+		`${describeCodexSocketOwnership(socketOwnership)}; argv=${JSON.stringify(argv)}`,
 	);
+	receipts["1a-codex-socket-ownership"] =
+		`advertised=${codexSocketPath}\nendpoint=${socketFile.connectPath}\n${describeCodexSocketOwnership(socketOwnership)}`;
 	const appServerCoordinate = inspectTmuxCoordinate("Codex app-server/MCP inherited seat", appServerEnv);
 	const fixtureCoordinate = inspectTmuxCoordinate("fixture/initial-Pi caller seat", process.env);
 	ok(

package/scripts/smoke-pi-durable-fresh-live.ts

@@ -538,9 +538,29 @@ ok(
 	fs.existsSync(liveDb),
 	liveDb,
 );
+const sqlite = await import("node:sqlite");
+// A doorbell input stays `placed` while the run that consumed it is active and turns `done` only when that run
+// ends (pi-durable's SubmissionRecord). Pi's relay can land before pd's final generation commits, so the snapshot
+// waits for THIS message's submission to settle (`done` or `unanswered`); the assertions below judge what settled.
+const msgName = /meta-mailbox → enqueued \(([^)]+)\)/.exec(piToPd.text)?.[1] ?? "";
+const doorbellRequestId = `entwurf-doorbell:${pdGid}:${msgName}`;
+if (msgName !== "") {
+	receipts["6-native-doorbell-settled"] = await until(`pd's doorbell submission to settle`, TURN_WAIT_MS, () => {
+		const live = new sqlite.DatabaseSync(liveDb, { readOnly: true });
+		try {
+			const rows = live.prepare("SELECT status, record FROM submissions").all() as Array<{
+				status: string;
+				record: string;
+			}>;
+			const hit = rows.find((r) => (JSON.parse(r.record) as { requestId?: unknown }).requestId === doorbellRequestId);
+			return hit?.status === "done" || hit?.status === "unanswered" ? hit.status : null;
+		} finally {
+			live.close();
+		}
+	});
+}
 const snapshot = path.join(receiptsDir, "pd-session.snapshot.sqlite");
 fs.mkdirSync(receiptsDir, { recursive: true });
-const sqlite = await import("node:sqlite");
 {
 	const source = new sqlite.DatabaseSync(liveDb, { readOnly: true });
 	try {
@@ -599,8 +619,7 @@ ok(
 	JSON.stringify(pdToPi),
 );
 receipts["6-pd-to-pi-settled"] = JSON.stringify(pdToPi);
-const msgName = /meta-mailbox → enqueued \(([^)]+)\)/.exec(piToPd.text)?.[1] ?? "";
-const doorbell = pdDoorbellSubmission(nativeSubmissions, rootId, `entwurf-doorbell:${pdGid}:${msgName}`);
+const doorbell = pdDoorbellSubmission(nativeSubmissions, rootId, doorbellRequestId);
 receipts["6-native-doorbell-submission"] = JSON.stringify(doorbell);
 ok(
 	"the doorbell admitted THIS message's notice to the root conversation and the submission is done",