@junghanacs/entwurf 0.38.0 → 0.39.0

package/BASELINE.md

@@ -23,7 +23,8 @@ or **unverified**. Since 0.20.0 the table also carries two qualifiers:
 runner is not a physical host, so bare **certified** still means a physical-host
 doctor green; and **NOT CERTIFIED — pending physical host** marks a rail whose
 missing evidence only a physical host can supply. That is an evidence boundary,
-not **UNSUPPORTED** — the deliberate never, which today is native Windows only.
+not **UNSUPPORTED** — the deliberate never, which today names the native-Windows surfaces
+outside the experimental preview (rows below).
 
 | Surface | Verdict | Evidence |
 |---|---|---|
@@ -43,8 +44,11 @@ not **UNSUPPORTED** — the deliberate never, which today is native Windows only
 | Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
 | setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
 | macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
-| WSL2 | unverified | Counts as Linux evidence, never a Windows surface (AGENTS Hard Rule 17) |
-| native Windows | UNSUPPORTED | Locked pending GLG; a scope decision, not an evidence gap |
+| WSL2 Entwurf-only install + zero-token Pi citizen (GitHub Actions `windows-2025` runner, not a physical machine) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/wsl2-install-surface.yml` run 39098773010 @ `b03d646` ([#78 receipt](https://github.com/junghan0611/entwurf/issues/78#issuecomment-6245947301)). Guest kernel `6.18.40.1-microsoft-standard-WSL2`, host `wsl --list --verbose` VERSION 2, guest fstype quoted raw as `ext2/ext3`. The run's packed tgz digest is equal across producer, host and guest; guest Node 24.18.1; harness-absent `setup` green with protected auth/harness state unchanged. Pi 1.3.0 (sha512 pinned to the registry integrity) wired by `setup`: one V3 record whose filename is its gid, a gid-keyed control socket with a native connect, `peer-facts` alive; only `get_state` was sent and no `agent_start` was observed. Pi creating an empty `auth.json` is not a login. It certifies no harness rail. Linux-guest runtime evidence only: not native-Windows evidence, and not a substitute for the required Linux CI jobs. |
+| WSL2 delivery, non-pi harnesses, vendor turn, physical user machine | unverified | No receipt. Authentication and model turns were deliberately excluded from the CI cells' scope (not a CI impossibility); non-pi harnesses, delivery, fresh/resume and physical machines are unmeasured. |
+| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0; 0.39.0 candidate, not yet released; release and npm publication pending; the evidence below is the feature-branch CI artifact at `3b65bdc`) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/windows-native-preview.yml` run 39123555360 @ `3b65bdc`, with the required `ci.yml` four jobs green at the same SHA (run 39123555224). Build: MSVC (VS 2026, toolset v145, SDK 10.0.26100.0), two builds byte-identical (`entwurf_win.node` sha256 `9837893521ec…`), imports advapi32 + kernel32 with `node.exe` the only delay-load; node-gyp 13.1.0 and the Node headers/`node.lib` pinned. The pack carries exactly the addon and its manifest; npm installed it into a sandboxed consumer prefix; Pi came from a tarball checked against its pinned SRI. Six addon cells PASS (final-component reparse and non-regular refusals on the read handle, no connect through a symlink to a pipe, one-deadline timeout with reclaim, pipe-name stability and loader refusals). B1: two `pi --entwurf-control` citizens, one V3 record each, record-derived pipes alive through the product probe, `peer-facts` alive, graceful exit with both addresses dead afterwards. D1: A's model called `entwurf_v2` toward B's garden id with a nonce; A's receipt `control-socket → sent`, B's model context and B's transcript `entwurf-message` entry from A carry it. The model is an offline pi-ai `fauxProvider`: no vendor turn and no comprehension claim. The transcript fact is the harness's assertion; the raw transcript is not archived. The run used the elevated Administrators owner branch, so user-SID-only privacy is not measured. Pi's `peerDependencies` warning was observed, not waived. Not evidence for any other harness on Windows. |
+| native Windows: own pre-existing pipe-name birth refusal, record link/rename syscalls, descendant cleanup after a forced kill, cross-user, mixed elevation, remote callers, user-SID-only privacy, physical user machine | unverified | No receipt; the preview cells name these as unmeasured. |
+| native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
 
 Notes the table cannot carry without becoming prose again:
 
@@ -65,7 +69,8 @@ Notes the table cannot carry without becoming prose again:
 - **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
   CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
   physical host (rental remains unscheduled). The package-level `os` field stays
-  unrestricted, and native Windows is UNSUPPORTED.
+  unrestricted, and native Windows is an experimental preview (0.39.0 candidate, not
+  yet released; release and npm publication pending) with its own named gaps (rows above), not a supported platform.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released
 artifact, restart every old Claude process, open a new session, and run the doctor

package/CHANGELOG.md

@@ -4,6 +4,227 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.39.0 - 2026-10-18
+
+### Native Windows (experimental preview, #78)
+
+- **A native-Windows Pi citizen, shape-only.** On Windows x64 the package carries a small
+  N-API addon (`native/win32-x64/entwurf_win.node` plus its `manifest.json`), loaded by
+  `pi-extensions/lib/win32-native.js` only after the manifest's schema, platform, arch,
+  file, sha256 and `napiVersion` 8 agree with the bytes (`ENTWURF_WIN32_UNSUPPORTED` /
+  `ENTWURF_WIN32_NATIVE_DRIFT` otherwise). It supplies the two primitives POSIX gets from
+  the OS: the record read refuses a final-component reparse point (`ELOOP`) and a
+  non-regular file (`ENTWURF_ENOTREG`) on the read handle itself, and the control
+  address is a named pipe `\\.\pipe\entwurf-<sha256(root)[:16]>-<gid>` whose
+  probe and RPC check the server's owner SID and connect at identification level. The
+  POSIX `O_NOFOLLOW` and ancestor policies are unchanged, and non-Windows hosts take the
+  existing POSIX branches of the shared modules; each axis's own CI and LIVE gates are
+  that evidence, not a claim of zero impact.
+- **Wiring.** `meta-session`, `control-socket-path`, `socket-probe`, `socket-discovery`,
+  `entwurf-control-rpc`, `entwurf-control` and the bridge take the win32 branch through
+  that loader; pipe names come from records and are never stat-ed; nothing unlinks or
+  GCs a pipe on win32.
+- **Carrier and provenance.** The release carrier is produced in CI (MSVC, `/Brepro`, two builds
+  compared byte-for-byte, imports exactly advapi32 + kernel32 with `node.exe` the only
+  delay-load, node-gyp 13.1.0 and the Node headers/`node.lib` pinned) and ships with
+  node-gyp's MIT notice (`LICENSES/node-gyp.txt`). `check-pack` reports the carrier as
+  `absent`, `pair-broken`, `invalid` or `present <sha>` through the loader's own verifier.
+  A Linux checkout pack is addon-less, so this release's candidate is the preview
+  workflow's pack at the prepared SHA (release skill M3w), not a local `npm pack`.
+- **Measured scope.** windows-native-preview run 39123555360 @ `3b65bdc` on a GitHub
+  Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0: six addon cells, then two
+  `pi --entwurf-control` citizens (one V3 record each, pipes alive through the product
+  probe, `peer-facts`, graceful exit with both addresses dead) and one garden-id
+  `entwurf_v2` delivery between them (`control-socket → sent`, B's model context and
+  transcript entry from A), with an offline pi-ai `fauxProvider`: no vendor turn.
+- **Limits.** Experimental and shape-only; not a supported platform. UNSUPPORTED: other
+  harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over
+  16 MiB, reparse-backed store folders. Unmeasured: the own pre-existing pipe-name birth
+  refusal, record link/rename syscalls, descendant cleanup after a forced kill,
+  cross-user, mixed elevation and remote callers, user-SID-only privacy (the runs took
+  the elevated Administrators owner branch), worker/environment teardown with a pipe
+  call in flight, and any physical user machine. Rows in BASELINE.
+
+### Verification
+
+- **Windows workflows (#78).** `windows-native-probe.yml`, `-e1a.yml`, `-e1b.yml` and
+  `-preview.yml` are experimental and non-voting; their push triggers name the feature
+  branch, so on main they run only by dispatch. The release oracle still reads only the
+  four required `ci.yml` jobs. New gates `check-win32-preview` and
+  `check-pack-win32-carrier` (in `check:contracts`); one new mutant lane, `win32-preview`
+  (19 claims), and the carrier's 2 claims appended to the existing `pack-install` lane.
+  The committed set is now 1000 mutants across 73 lanes.
+- **Experimental WSL2 workflow (#78).** `.github/workflows/wsl2-install-surface.yml`
+  installs this run's packed tgz inside a real WSL2 guest on a GitHub-hosted Windows runner,
+  runs a harness-absent `setup`, then births a zero-token Pi citizen (record, socket,
+  `peer-facts`; `get_state` only). It is not a release axis: the release oracle reads only
+  `ci.yml`, whose four required jobs are unchanged. It runs when the workflow file changes
+  on main, or by manual dispatch. No WSL2 support, harness rail or physical-machine claim.
+
+### Release boundary and verification
+
+- **Implementation commits.** WSL2 `afcda79`..`9b492a4` (landed `86f0eb5`); native
+  Windows `95933c7`..`5da8f12`, landed with the carrier supply contract `32fcc1c`
+  (exact push CI 39128022109, four jobs green). The runtime proof stays on `3b65bdc`'s
+  own SHA. Coordinator-routed independent reviews (primary and supplemental) closed
+  every shipped implementation leaf.
+- Kill-power re-measured at this shipped SHA: none (all 1000 committed claims not
+  re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 864e026877ca surface
+  200536056020 -- `["bash","run.sh","check-win32-preview"]` 19/19 receipt b4de9e681dfb
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 864e026877ca surface
+  200536056020 -- `["bash","run.sh","check-pack-win32-carrier"]` 2/2 receipt
+  c51ef11b84a6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e527cdbea81 surface
+  8f5cc4c34473 -- `["bash","run.sh","check-node-floor-coherence"]` 2/2 receipt
+  6c0ec40a291f
+- **Static/LIVE split.** Local P4/M0 `check:full` is not run on this operator host (its
+  FULL includes Herdr checks prohibited here) and is not counted as passed: the whole
+  static floor is owed to this prepared SHA's exact push CI.
+- **Cut blockers.** VERIFY §3.4 (strict `doctor-meta-bridge` on an installed 0.39.0
+  Claude host in a new post-install session) and §3.7 (three agy doctors and a same-gid
+  native-push reply in a new operator conversation) need the operator and are not met by
+  this record; no tag or GitHub release until they are or GLG decides otherwise. npm
+  publication is outside the current authorization and was not performed; it needs a
+  separate GLG GO.
+- **Herdr follows core.** `plugins/herdr/runtime-lock.json` stays on the closed
+  `herdr-checkout` source (comment re-dated only); no plugin manifest version, registry
+  pin or snapshot changes in this release.
+
+## 0.38.1 - 2026-10-17
+
+### pi-durable
+
+- **Background compaction returns to the SDK default (#146).** The owned Harness settings
+  hand the SDK Pi's compaction settings unchanged instead of forcing `backgroundTokens: 0`
+  (#143, 0.37.0-0.38.0), so the SDK's own default background policy applies again; no
+  Entwurf copy of its value exists. Past the background threshold a summary runs beside the
+  turn, which answers without waiting for it; threshold, overflow and manual compaction are
+  unchanged. Transport and the other Harness mappings are unchanged.
+- **Limits.** A process started from 0.37.0-0.38.0 keeps the forced 0 it imported until the
+  operator restarts it. The beside proof is a faux scheduling proof on a loopback wire, not
+  live GPT latency, billing or overload evidence; thresholds for a given window are
+  predictions from the SDK's policy, not measurements. `backgroundTokens` has no operator
+  tuning entry, and Pi's per-model compaction overrides are not applied by the app.
+- **Use native capabilities; refuse what a harness lacks.** `docs/durable-native-support.md`
+  now states the receive-side principle with the Pi / pi-durable contrast and maps which
+  layer decides each Harness setting.
+
+### Release boundary and verification
+
+- **Implementation commits.** `58c4d0f` (principle doc) and `9229452` (#146 source, carrier,
+  pin, proof, mutant, docs). Coordinator independent review B0/D0 after one amendment;
+  additional independent review (ee20b5) B0/D0/O4.
+- **Earlier-candidate PARTIAL (not this SHA):** `["bash","run.sh","check-pi-durable-carrier"]`
+  30/30 killed, control ok, on the uncommitted amendment-1 surface (worktree diff
+  `fc146d97`, head beb5925), receipt seal `7906a9c0d88d`; the other 949 committed claims
+  not run there.
+- **Kill-power at this SHA: not yet measured.** The final same-SHA manual `qualify=true`
+  whole BODY is required before the tag; its result is recorded in the #146 ledger and the
+  GitHub release, not in this frozen text.
+- **Static/LIVE split.** Local P4/M0 `check:full` is not run on this operator host (its FULL
+  includes Herdr checks prohibited here) and is not counted as passed: the whole static
+  floor is owed to this prepared SHA's exact push CI.
+- **Earlier LIVE r1 (history of the RED SHA c90b5bf, not this release's LIVE): MUST
+  (non-static 23) PASS=23 FAIL=0 SKIP=0 UNRUN=0; BEHAVIOR PASS=1 FAIL=0.** It ran once on
+  2026-10-17 15:11:01-15:15:47 KST through the 0.38.0 stepwise driver. Its step lines are
+  unchanged, and `run.sh` is unchanged since d25b71e. Candidate: 9229452 plus `CHANGELOG.md`,
+  `NEXT.md` and `package.json`, which still carried the 0.38.0 npm runtime lock; the
+  fingerprint was equal at freeze, before and after. `smoke-codex-fresh-live` ran against an
+  owned app-server in its own session A, with `gpt-5.6-luna` / `openai-codex/gpt-5.6-luna`,
+  stopped by TERM afterwards. Receipts: `.tmp-verify/release-0.38.1/live-r1/` (`live.log`
+  3ce295e1, `steps.SHA256SUMS` 5a18e7da). It was not a local `release-gate --cut` PASS.
+- **Herdr follows core.** `plugins/herdr/runtime-lock.json` returns to the closed
+  `herdr-checkout` source for this unpublished candidate, as at the 0.37.1 and 0.38.0 cuts:
+  an npm lock must name the checkout's own version (`certifyLockCoherence`), and 0.38.1 has
+  no registry bytes yet. No plugin manifest version or registry pin changes; the npm pin
+  returns only in a separate Herdr snapshot after the operator publishes 0.38.1.
+- **First prepared SHA was RED.** `c90b5bf` kept the 0.38.0 npm lock; its push run
+  39009471179 failed `check` at `check-herdr-plugin-build` `[QK:HPB-DEFAULT-LOCK-READ]`
+  (`runtime-lock-incoherent`), with the other three jobs green. That gate is prohibited on
+  this operator host, so it first showed in CI. The RED run and that SHA's LIVE r1 stay as
+  history.
+- **Repaired candidate LIVE r2 (RED, kept as history): MUST PASS=4 FAIL=1 UNRUN=19;
+  BEHAVIOR not reached.** It ran 15:31:58-15:37:27 KST on c90b5bf plus `CHANGELOG.md`,
+  `NEXT.md`, `plugins/herdr/README.md` and `plugins/herdr/runtime-lock.json`. Step
+  `smoke-mux-lifecycle-live` failed. In its pi-native arm, the sibling's first model turn
+  (`openai-codex/gpt-6.1-sol:low`) showed "Codex error: An error occurred while processing
+  your request", no nonce callback came, and the gate gave up after 300 s; the claude-code
+  arm passed. Whether that error is transient was not measured. Receipts:
+  `.tmp-verify/release-0.38.1/live-r2/` (`LIVE-R2-RED.md` 96070f72).
+- **Local LIVE r3, this release's LIVE: MUST (non-static 23) PASS=23 FAIL=0 SKIP=0 UNRUN=0;
+  BEHAVIOR PASS=1 FAIL=0.** It ran once, 15:41:19-15:45:47 KST, on the same frozen repaired
+  candidate as r2 (fingerprint equal at freeze, before and after), with the same driver and
+  models. GLG approved this single re-measurement and allowed a repeat of that one vendor
+  failure to be recorded and continued past; it did not repeat, so the exception and its
+  continuation driver were not used. Each LIVE ran against a fresh owned app-server in its
+  own session A, stopped by TERM afterwards. Receipts: `.tmp-verify/release-0.38.1/live-r3/`
+  (`live.log` 929b7952, `steps.SHA256SUMS` 99f87db2). It was not a local
+  `release-gate --cut` PASS: the static step did not run locally.
+- **Post-LIVE delta: evidence records only.** After r3, `CHANGELOG.md` and `NEXT.md` took
+  these records; `package.json`, the lockfile, `run.sh`, `plugins/herdr/` and all
+  source/carrier bytes equal the r3 candidate. The repaired prepared SHA's exact push CI is
+  owed.
+
+## v2026.10.16-herdr.0.38.0 — Herdr Entwurf plugin 0.38.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.38.0 and its
+`v0.38.0` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.38.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that core 0.38.0
+  rode to production npm source `@junghanacs/entwurf@0.38.0` with the registry's measured
+  sha512 (`sha512-A7Pd4FOe…aqbA==`). The plugin manifest moves 0.37.0 → 0.38.0; admission
+  remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **Pi 1.3 first, then the plugin.** The runtime this snapshot acquires carries core 0.38.0, whose
+  accepted Pi range is `>=1.3.0 <1.4` (#145). A host still on Pi 1.2 is refused by name
+  (`outside the supported range`) at plugin activation, the same check `entwurf setup` applies,
+  and no Pi settings are written. Upgrade Pi to 1.3, then install or reinstall the plugin. The
+  plugin README's Requirements say so.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.37.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest 0.38.0, repair 0.12.8-repair.1, 599 files. The
+  registry's `dist.integrity` and `dist.shasum` equal the sha512 and sha1 independently
+  computed from the preserved accepted core candidate (SHA256
+  `6d21699b1a37a8441c9631bd9128f413aecd37146dfb091cc768eb7a69ea7438`, 11144202 bytes), so
+  core make's Docker consumer of those bytes (`node:24-bookworm`, repoDigest
+  `node@sha256:6dac556d…`) is reused here, not repeated. A sandboxed `pi install` of the
+  registry package resolved its bridge inside the sandbox, recorded the registry URL with that
+  integrity, and listed the curated Claude anchors with `--list-models entwurf`.
+- **The npm runtime swap against the real registry**, by the registry-shipped helper (byte-equal
+  to this checkout's) in sandboxed user roots, 22/22 checks. The 0.37.0 runtime was seeded from
+  its own committed lock; the swap to 0.38.0 took one acquisition, the cached tarball's sha512
+  equals the lock and its sha256 equals both the ready journal's observed digest and the
+  accepted candidate. The `installing` journal carried the 0.37.0 identity as
+  `previousRuntime` and the `runtime-ready` journal carries `null`; when acquisition began the
+  0.37.0 tree was still at the active address. A manually seeded torn swap (the active tree
+  moved to the backup address with a half candidate in staging; not a killed process) was
+  restored before acquisition and reported `recovered: torn-swap-with-candidate`. An exact
+  re-request acquired nothing and left journal and tree byte-identical, and the owned removal
+  reclaimed cache, runtime and journal. The helper is a leaf that probes no Pi, so these cells
+  certify neither a Pi upgrade nor Herdr's install/update relocation, harness wiring, the
+  installed CLI's deactivate path, a model turn, or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45)
+  and `check-gate-manifests` (979 committed mutants across 72 lanes validated, none executed).
+  `check-herdr-plugin-build` and `check-herdr-sandbox` were not run locally because they run
+  the operator's own herdr; they ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI and the public-ref
+  install/use/deactivate journey on Herdr 0.9.5 with Pi 1.3.0. Earlier npm or checkout-carrier
+  receipts cannot certify these source-specific axes. This section is the prepared source
+  record; the actual post-push, public-ref and CI outcomes are recorded at the snapshot's
+  [acceptance ledger](https://github.com/junghan0611/entwurf/issues/145#issuecomment-6209375125).
+
 ## 0.38.0 - 2026-10-16
 
 ### Pi SDK 1.3.0

package/LICENSES/node-gyp.txt

@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2012 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -78,8 +78,20 @@ Plain MCP registration alone does not make a garden citizen.
 installation is **CERTIFIED (CI)**, weaker than a physical-host doctor; its native
 harness rails, ACP and mux remain **NOT CERTIFIED — pending physical host**.
 Detected harness wiring on Darwin can therefore be written while setup stays
-non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
-restriction; that is not certification of every platform's harness rails.
+non-green. WSL2: a CI runner (experimental) measured the Entwurf-only install and a
+zero-token Pi citizen; general, physical-machine or harness-parity WSL2 support is **not
+declared**, and delivery, other harnesses and physical machines are unmeasured. Native
+Windows has an **experimental first preview**, a CI-built x64 addon on `main` for the
+0.39.0 candidate (not yet released; release and npm publication pending); the registry's
+0.38.1 has no Windows addon. On a GitHub Actions `windows-2025` x64 runner with Node
+24.18.1 and Pi 1.3.0, a CI-built artifact was installed, wired with `pi install`, birthed
+two Pi citizens and
+delivered one garden-id `entwurf_v2` message between them, with an offline scripted model
+and no vendor turn. Every other native-Windows surface (other harnesses, `setup` and the
+`.sh` bins, fresh/resume, mux/Herdr/ACP, physical machines) is **not declared**; the
+measured scope and its named gaps are in [BASELINE](./BASELINE.md#release-host-baseline).
+The package has no npm `os` restriction; that is not certification of every platform's
+harness rails.
 
 ### Native durable (pi-durable)
 

package/VERIFY.md

@@ -233,8 +233,8 @@ are the visible-terminal and consumer subjects. The 1.2 bootstrap child also obs
 reopening the chosen session and cancelling to nothing (#143). Two more sandboxed children reach the
 reference app's settings and prompt mapping: one drives the real bootstrap against a loopback
 WebSocket Responses endpoint, whose received frames decide the forwarded transport and its
-continuation and the reference compaction policy (no background summary; blocking and overflow
-kept, #143); the other renders the carrier prompt's skills section with no model, against a fixture
+continuation and the reference compaction policy (the SDK's background summary beside the turn, held on the
+wire while the turn answers; blocking and overflow kept, #146); the other renders the carrier prompt's skills section with no model, against a fixture
 of both settings scopes, an absolute entry, a same-name pair and a wrong-base decoy.
 `check-pi-runtime-version` asks the
 same installed verifier (`check-pi-durable-beside`) whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
@@ -276,14 +276,16 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | the exact SHA's push run: all four required CI jobs green (the qualification body is not read, #144) | A different green SHA is not transferable evidence. |
 | macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven `entwurf-bridge` MCP tools of that date; eight today), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |
+| Native-Windows carrier (carrier-bearing release, from 0.39.0) | one `windows-native-preview.yml` dispatch at the exact prepared SHA after its four `ci.yml` jobs are green: accepted build receipt (two byte-identical MSVC builds, exact import set), `pack` printing `present`, eight Windows addon/citizen cells on the installed tarball; that run's `win32-preview-tgz` is the release candidate, retrieved (never packed locally) with its `SHA256SUMS`, the Windows-printed install hash and the downloaded hash equal, then accepted by the Linux `check-install-container` unchanged (release skill M3w) | Experimental, shape-only, non-voting for `ci.yml`: no vendor turn, x64 runner only, named gaps in BASELINE. The four `ci.yml` jobs (incl. macOS) saw an addon-less pack, so the carrier-bearing tarball's macOS install is unmeasured. Artifacts expire after 14 days; the preserved copy is the durable one. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
 | Native Codex host | caller-seat topology accepted 2026-09-16 (56 assertions, exit 0); caller-DIRECTORY axis accepted the same day (65 assertions, exit 0) | Operator-owned birth/MCP/statusline/terminal-title atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: the app-server alone in session A (`$30/@41/%45`, pid 737636), and initial Pi / omitted-placement fresh Codex / Codex-opened outbound Pi all in a different session S (`$2`, `@46`/`@47`/`@48`; `@58`/`@59`/`@61` in the lane C run); exact callbacks and addressed delivery both ways. A ≠ S is the load-bearing half — the app-server's inherited `TMUX` names A, so the outbound Pi landing in S can only have come from the caller's own pane title, and its receipt records `seat-source=codex-title-anchor`. **#95 lane C added the second axis to the same card: WHERE the sibling starts.** Hop 1 joins four authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor rollout's `session_meta.cwd`, the Entwurf record and the requested scratch — and hop 1's leg requests a cwd while hop 2 requests NONE, so hop 2's directory can only come from the Codex caller's own record; both are asserted different from the app-server's live `/proc/<pid>/cwd`. 65 and 56 are different contracts, not a regression. The 2026-09-12 fixed-home chain is PAST CONTRACT (#95 D1); `DELIVERY.md` owns every receipt and digest. Placement beside a TUI whose thread nobody named is unsupported and unclaimed. |
 
 The repo-local `entwurf-release` skill owns the `land → prepare → make → publish`
-state machine. Each mode is a separate GLG authorization. Preserve one candidate,
-accept and publish those exact bytes without repacking, and record its digest and
+state machine. Each mode is a separate GLG authorization. Preserve one candidate
+(for a carrier-bearing release, the one retrieved from the preview run, never a local
+pack), accept and publish those exact bytes without repacking, and record its digest and
 consumer image outside this standing protocol.
 
 ### Verifying the two capabilities a gate cannot fully judge
@@ -385,6 +387,13 @@ not certified, a detected harness is named non-green (FAIL) whose wording is
 not an install failure: the wiring WAS written, but the rail is NOT CERTIFIED —
 pending physical host. That FAIL is the honest setup verdict, not a skip.
 
+WSL2: a separate experimental workflow (`.github/workflows/wsl2-install-surface.yml`)
+measures the Entwurf-only install and a zero-token Pi citizen inside a real WSL2 guest on
+a GitHub-hosted Windows runner. The release oracle does not read it
+(`verify-exact-ci.sh` selects only `ci.yml` runs), so it is not a release axis and a red
+there blocks no cut. It runs when that workflow file changes on main, or by manual
+dispatch. Recorded in [BASELINE.md](./BASELINE.md).
+
 ### 1.1 Variables (optional)
 
 ```bash
@@ -518,7 +527,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 The minimum passing bar:
 
 1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), in the exact-SHA CI push run of the same prepared candidate (criterion 2's run). The qualification body is not a criterion (#144).
-2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
+2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. For a carrier-bearing release those CI tarballs are addon-less and are NOT the release candidate: the exact release bytes are the M3w-retrieved preview tarball, accepted separately by the eight Windows cells and the Linux container (axes row "Native-Windows carrier"). The four-job floor, macOS included, is unchanged. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its eight current tools, and presents a backend-native (not normalized) tool surface.

package/docs/setup-clean-host.md

@@ -18,7 +18,9 @@ evidence split, and its three states must not collapse into "macOS is supported"
   ACP turn, mux. Wiring may be written; that is not a rail receipt. The remaining
   unmeasured Darwin doctor reason is per-process environment DISCOVERY
   (start-key is portable).
-- **UNSUPPORTED** — native Windows only. macOS is never this.
+- **UNSUPPORTED** — native Windows `setup` and its harness rails. macOS is never this.
+  An experimental native-Windows Pi preview (0.39.0 candidate, not yet released; release
+  and npm publication pending) exists outside `setup`; see [BASELINE](../BASELINE.md#release-host-baseline).
 
 ## Requirements
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -84,6 +84,7 @@ import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequ
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
+import { probeSocketLiveness } from "../../../pi-extensions/lib/socket-probe.js";
 const HOME = os.homedir();
 // ============================================================================
 // OMP root policy — FIRST, before any lazy default-root consumer (#87 B1).
@@ -110,6 +111,14 @@ catch (err) {
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
+/** Is this session's own control address up? A socket file's presence on Linux/macOS. On
+ * Windows (#78) the address is a named pipe, which has no file to look at and must not be
+ * opened by a stat (that connects): the owner-validated probe answers instead. */
+async function controlAddressPresent(socketPath) {
+    if (process.platform === "win32")
+        return (await probeSocketLiveness(socketPath)) === "alive";
+    return existsSync(socketPath);
+}
 // ============================================================================
 // Live control-socket discovery for entwurf_peers lives in the TS fact-provider
 // (pi-extensions/lib/entwurf-fact-provider.ts → listEntwurfFacts), which the
@@ -171,7 +180,7 @@ class EntwurfSenderIdentityError extends Error {
             "the send is then marked external/non-replyable).");
     }
 }
-function buildStrictPiSenderEnvelope() {
+async function buildStrictPiSenderEnvelope() {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
@@ -195,7 +204,7 @@ function buildStrictPiSenderEnvelope() {
     const socketPath = controlSocketPathIn(ENTWURF_DIR, sessionId);
     const self = computeSelfAddressability({
         origin: "pi-session",
-        socketAlive: existsSync(socketPath),
+        socketAlive: await controlAddressPresent(socketPath),
         socketPathComputable: true,
     });
     return {
@@ -258,7 +267,7 @@ async function buildMetaSenderEnvelope(identity, cwd, trustedMarker) {
 async function resolveAuthoritativeSender(context, cwd = process.cwd()) {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
-    const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+    const pi = sessionId && agentId && cwd ? await buildStrictPiSenderEnvelope() : null;
     const marker = resolveTrustedMetaSenderIdentity({
         markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
     });
@@ -463,7 +472,7 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
             // live socket). The old code synthesized the path and printed it as if
             // it existed — a lie when the session has no --entwurf-control (SE-1).
             const socketPath = controlSocketPathIn(ENTWURF_DIR, sender.sessionId);
-            const socketState = existsSync(socketPath) ? "alive" : "expected";
+            const socketState = (await controlAddressPresent(socketPath)) ? "alive" : "expected";
             extra.socketPath = socketPath;
             extra.socketState = socketState;
             lines.push(socketState === "alive"

package/mcp/entwurf-bridge/dist/pi-extensions/lib/control-socket-path.js

@@ -24,8 +24,17 @@
  * adapter keeps its own root policy: the pi side derives from HOME, the MCP
  * bridge honours `ENTWURF_DIR`. What is unified is the grammar, not the policy.
  *
- * Keep dependency-free except `node:path`.
+ * Windows (#78) has no socket files: the address is a named pipe,
+ * `\\.\pipe\entwurf-<sha256(canonRoot(dir))[:16]>-<gardenId>`. The digest keeps two
+ * store roots on one host apart without putting a path in the pipe namespace; it is not
+ * a new address axis (still the garden id plus the store root). The inverse grammar has
+ * no Windows half because nothing scans the pipe namespace: candidates come from records.
+ *
+ * Keep dependency-free except node builtins (`node:path`, and `node:crypto`/`node:fs`
+ * for the Windows root canonicalisation only).
  */
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
 import * as path from "node:path";
 /** Control-socket filename suffix. The stem is a bare garden id. */
 export const CONTROL_SOCKET_SUFFIX = ".sock";
@@ -47,8 +56,54 @@ export function defaultControlSocketDir(home) {
  * @returns {string}
  */
 export function controlSocketPathIn(dir, gardenId) {
+    if (process.platform === "win32")
+        return win32PipeNameFor(dir, gardenId);
     return path.join(dir, `${gardenId}${CONTROL_SOCKET_SUFFIX}`);
 }
+/** Every Windows control pipe this package names starts here. */
+export const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\entwurf-";
+/**
+ * The one spelling of a Windows store root, so Pi A, Pi B, the bridge and peer-facts
+ * derive the same pipe name from differently written paths. The nearest EXISTING ancestor
+ * of `path.win32.resolve(dir)` goes through `realpath` (8.3 names expanded, case from the
+ * filesystem); the components below it are appended as written. Separators become `\`,
+ * there is no trailing separator, and the whole string is lower-cased. Nothing is created
+ * or touched, so the control dir need not exist yet. A failure other than ENOENT throws.
+ *
+ * @param {string} dir
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function canonRootWin32(dir, realpath = fs.realpathSync.native) {
+    let head = path.win32.resolve(dir);
+    /** @type {string[]} */
+    const tail = [];
+    for (;;) {
+        try {
+            const joined = path.win32.join(realpath(head), ...tail);
+            return joined.replace(/[\\/]+$/, "").toLowerCase();
+        }
+        catch (err) {
+            const parent = path.win32.dirname(head);
+            if ( /** @type {{ code?: unknown }} */(err).code !== "ENOENT" || parent === head)
+                throw err;
+            tail.unshift(path.win32.basename(head));
+            head = parent;
+        }
+    }
+}
+/**
+ * Forward grammar on Windows: `\\.\pipe\entwurf-<16 hex>-<gardenId>`.
+ *
+ * @param {string} dir
+ * @param {string} gardenId
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function win32PipeNameFor(dir, gardenId, realpath) {
+    const digest = createHash("sha256").update(canonRootWin32(dir, realpath), "utf8").digest("hex").slice(0, 16);
+    return `${WIN32_PIPE_PREFIX}${digest}-${gardenId}`;
+}
 /**
  * Inverse grammar: a socket filename back to its garden id, or `null` when the
  * name does not carry the suffix.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-control-rpc.js

@@ -14,6 +14,7 @@
  * asked to open, and touches nothing pi-specific — it is a pure transport over a path.
  */
 import * as net from "node:net";
+import { win32Native } from "./win32-native.js";
 /**
  * THE `<sender_info>` synthesis — the one place the sender envelope becomes
  * message text. ONE consumer since the visible-first cut (#50 C3):
@@ -101,6 +102,8 @@ export async function fetchControlSocketRuntimeInfo(socketPath, options = {}) {
 }
 export async function sendRpcCommand(socketPath, command, options = {}) {
     const { timeout = 5000 } = options;
+    if (process.platform === "win32")
+        return await sendPipeRpcCommand(socketPath, command, timeout);
     return new Promise((resolve, reject) => {
         const socket = net.createConnection(socketPath);
         socket.setEncoding("utf8");
@@ -173,3 +176,25 @@ export async function sendRpcCommand(socketPath, command, options = {}) {
         });
     });
 }
+/**
+ * The Windows client (#78). The addon makes one owner-validated connect, writes the request
+ * line and returns the first response line, all inside one deadline; a timeout is
+ * `ETIMEDOUT`, a pipe owned by anyone but this token's expected owner is `EPERM` before any
+ * byte. The protocol is request-bound on its own connection, so that first line IS the
+ * answer: anything other than this command's response is refused, never waited past.
+ */
+async function sendPipeRpcCommand(pipeName, command, timeout) {
+    const { responseLine } = await win32Native().pipeRpc(pipeName, JSON.stringify(command), Math.max(0, Math.floor(timeout)));
+    let msg;
+    try {
+        msg = JSON.parse(responseLine.trim());
+    }
+    catch {
+        throw new Error(`control pipe answered ${command.type} with a line that is not JSON`);
+    }
+    const response = msg;
+    if (response?.type !== "response" || response.command !== command.type) {
+        throw new Error(`control pipe answered something other than the ${command.type} response`);
+    }
+    return { response };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -52,6 +52,7 @@
 import { execFileSync } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
+import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
 import { generateSessionId, SESSION_ID_RE } from "./session-id.js";
@@ -845,6 +846,8 @@ const O_NONBLOCK_FLAG = typeof fs.constants.O_NONBLOCK === "number" ? fs.constan
  * Shaping a message is the job of the caller that knows what the answer is FOR.
  */
 export function readStoreRecordFile(file) {
+    if (process.platform === "win32")
+        return win32RecordReader()(file).toString("utf8");
     if (O_NOFOLLOW_FLAG === 0) {
         throw new MetaRecordError(`cannot read meta-record ${path.basename(file)} safely: this platform exposes no O_NOFOLLOW, so a record ` +
             "read cannot refuse a symlink swapped in at the final component. entwurf certifies Linux only.");
@@ -863,6 +866,17 @@ export function readStoreRecordFile(file) {
         fs.closeSync(fd);
     }
 }
+/**
+ * Windows has no `O_NOFOLLOW` (libuv defines it as 0), so the same three decisions — a
+ * final-component reparse point refused as `ELOOP`, a non-regular entry as
+ * `ENTWURF_ENOTREG`, both on the handle the read uses — are made by the preview addon
+ * (#78). It is reached only here and only on win32, through `createRequire`, so the
+ * installers that copy this file without its siblings never load it on Linux or macOS.
+ */
+function win32RecordReader() {
+    const native = createRequire(import.meta.url)("./win32-native.js");
+    return native.win32ReadNoFollow;
+}
 /** The reader every store-WIDE scan pairs with {@link readActiveStoreEntries}. The
  * caller's entry kind decides the POLICY — whether a non-regular entry is a defect
  * (certification), a diagnostic (listing) or a non-candidate (the rival scan) — because