@junghanacs/entwurf 0.38.1 → 0.39.0

package/BASELINE.md

@@ -23,7 +23,8 @@ or **unverified**. Since 0.20.0 the table also carries two qualifiers:
 runner is not a physical host, so bare **certified** still means a physical-host
 doctor green; and **NOT CERTIFIED — pending physical host** marks a rail whose
 missing evidence only a physical host can supply. That is an evidence boundary,
-not **UNSUPPORTED** — the deliberate never, which today is native Windows only.
+not **UNSUPPORTED** — the deliberate never, which today names the native-Windows surfaces
+outside the experimental preview (rows below).
 
 | Surface | Verdict | Evidence |
 |---|---|---|
@@ -43,8 +44,11 @@ not **UNSUPPORTED** — the deliberate never, which today is native Windows only
 | Doctor fail-closed on unreadable environ | Linux measured; Darwin unmeasured | Copilot launch-flag and omp identity-carrier: missing `/proc/<pid>/environ` as predicate INPUT is `UNVERIFIABLE` (non-green), not a benign note. omp distinguishes `pgrep` exit 1 (absent) from exit 2 (enumeration failed); copilot distinguishes ENOENT/ESRCH (gone) from other errno (read denied). |
 | setup on uncertified platform with harness present | named non-green | All 13 harness units ask `harness_rail_certified_platform()`; uncertified → FAIL whose wording is not "install failed". Harness-absent Darwin setup (the CI cell) can still be computed green. |
 | macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
-| WSL2 | unverified | Counts as Linux evidence, never a Windows surface (AGENTS Hard Rule 17) |
-| native Windows | UNSUPPORTED | Locked pending GLG; a scope decision, not an evidence gap |
+| WSL2 Entwurf-only install + zero-token Pi citizen (GitHub Actions `windows-2025` runner, not a physical machine) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/wsl2-install-surface.yml` run 39098773010 @ `b03d646` ([#78 receipt](https://github.com/junghan0611/entwurf/issues/78#issuecomment-6245947301)). Guest kernel `6.18.40.1-microsoft-standard-WSL2`, host `wsl --list --verbose` VERSION 2, guest fstype quoted raw as `ext2/ext3`. The run's packed tgz digest is equal across producer, host and guest; guest Node 24.18.1; harness-absent `setup` green with protected auth/harness state unchanged. Pi 1.3.0 (sha512 pinned to the registry integrity) wired by `setup`: one V3 record whose filename is its gid, a gid-keyed control socket with a native connect, `peer-facts` alive; only `get_state` was sent and no `agent_start` was observed. Pi creating an empty `auth.json` is not a login. It certifies no harness rail. Linux-guest runtime evidence only: not native-Windows evidence, and not a substitute for the required Linux CI jobs. |
+| WSL2 delivery, non-pi harnesses, vendor turn, physical user machine | unverified | No receipt. Authentication and model turns were deliberately excluded from the CI cells' scope (not a CI impossibility); non-pi harnesses, delivery, fresh/resume and physical machines are unmeasured. |
+| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0; 0.39.0 candidate, not yet released; release and npm publication pending; the evidence below is the feature-branch CI artifact at `3b65bdc`) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/windows-native-preview.yml` run 39123555360 @ `3b65bdc`, with the required `ci.yml` four jobs green at the same SHA (run 39123555224). Build: MSVC (VS 2026, toolset v145, SDK 10.0.26100.0), two builds byte-identical (`entwurf_win.node` sha256 `9837893521ec…`), imports advapi32 + kernel32 with `node.exe` the only delay-load; node-gyp 13.1.0 and the Node headers/`node.lib` pinned. The pack carries exactly the addon and its manifest; npm installed it into a sandboxed consumer prefix; Pi came from a tarball checked against its pinned SRI. Six addon cells PASS (final-component reparse and non-regular refusals on the read handle, no connect through a symlink to a pipe, one-deadline timeout with reclaim, pipe-name stability and loader refusals). B1: two `pi --entwurf-control` citizens, one V3 record each, record-derived pipes alive through the product probe, `peer-facts` alive, graceful exit with both addresses dead afterwards. D1: A's model called `entwurf_v2` toward B's garden id with a nonce; A's receipt `control-socket → sent`, B's model context and B's transcript `entwurf-message` entry from A carry it. The model is an offline pi-ai `fauxProvider`: no vendor turn and no comprehension claim. The transcript fact is the harness's assertion; the raw transcript is not archived. The run used the elevated Administrators owner branch, so user-SID-only privacy is not measured. Pi's `peerDependencies` warning was observed, not waived. Not evidence for any other harness on Windows. |
+| native Windows: own pre-existing pipe-name birth refusal, record link/rename syscalls, descendant cleanup after a forced kill, cross-user, mixed elevation, remote callers, user-SID-only privacy, physical user machine | unverified | No receipt; the preview cells name these as unmeasured. |
+| native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
 
 Notes the table cannot carry without becoming prose again:
 
@@ -65,7 +69,8 @@ Notes the table cannot carry without becoming prose again:
 - **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
   CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
   physical host (rental remains unscheduled). The package-level `os` field stays
-  unrestricted, and native Windows is UNSUPPORTED.
+  unrestricted, and native Windows is an experimental preview (0.39.0 candidate, not
+  yet released; release and npm publication pending) with its own named gaps (rows above), not a supported platform.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released
 artifact, restart every old Claude process, open a new session, and run the doctor

package/CHANGELOG.md

@@ -4,6 +4,93 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.39.0 - 2026-10-18
+
+### Native Windows (experimental preview, #78)
+
+- **A native-Windows Pi citizen, shape-only.** On Windows x64 the package carries a small
+  N-API addon (`native/win32-x64/entwurf_win.node` plus its `manifest.json`), loaded by
+  `pi-extensions/lib/win32-native.js` only after the manifest's schema, platform, arch,
+  file, sha256 and `napiVersion` 8 agree with the bytes (`ENTWURF_WIN32_UNSUPPORTED` /
+  `ENTWURF_WIN32_NATIVE_DRIFT` otherwise). It supplies the two primitives POSIX gets from
+  the OS: the record read refuses a final-component reparse point (`ELOOP`) and a
+  non-regular file (`ENTWURF_ENOTREG`) on the read handle itself, and the control
+  address is a named pipe `\\.\pipe\entwurf-<sha256(root)[:16]>-<gid>` whose
+  probe and RPC check the server's owner SID and connect at identification level. The
+  POSIX `O_NOFOLLOW` and ancestor policies are unchanged, and non-Windows hosts take the
+  existing POSIX branches of the shared modules; each axis's own CI and LIVE gates are
+  that evidence, not a claim of zero impact.
+- **Wiring.** `meta-session`, `control-socket-path`, `socket-probe`, `socket-discovery`,
+  `entwurf-control-rpc`, `entwurf-control` and the bridge take the win32 branch through
+  that loader; pipe names come from records and are never stat-ed; nothing unlinks or
+  GCs a pipe on win32.
+- **Carrier and provenance.** The release carrier is produced in CI (MSVC, `/Brepro`, two builds
+  compared byte-for-byte, imports exactly advapi32 + kernel32 with `node.exe` the only
+  delay-load, node-gyp 13.1.0 and the Node headers/`node.lib` pinned) and ships with
+  node-gyp's MIT notice (`LICENSES/node-gyp.txt`). `check-pack` reports the carrier as
+  `absent`, `pair-broken`, `invalid` or `present <sha>` through the loader's own verifier.
+  A Linux checkout pack is addon-less, so this release's candidate is the preview
+  workflow's pack at the prepared SHA (release skill M3w), not a local `npm pack`.
+- **Measured scope.** windows-native-preview run 39123555360 @ `3b65bdc` on a GitHub
+  Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0: six addon cells, then two
+  `pi --entwurf-control` citizens (one V3 record each, pipes alive through the product
+  probe, `peer-facts`, graceful exit with both addresses dead) and one garden-id
+  `entwurf_v2` delivery between them (`control-socket → sent`, B's model context and
+  transcript entry from A), with an offline pi-ai `fauxProvider`: no vendor turn.
+- **Limits.** Experimental and shape-only; not a supported platform. UNSUPPORTED: other
+  harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over
+  16 MiB, reparse-backed store folders. Unmeasured: the own pre-existing pipe-name birth
+  refusal, record link/rename syscalls, descendant cleanup after a forced kill,
+  cross-user, mixed elevation and remote callers, user-SID-only privacy (the runs took
+  the elevated Administrators owner branch), worker/environment teardown with a pipe
+  call in flight, and any physical user machine. Rows in BASELINE.
+
+### Verification
+
+- **Windows workflows (#78).** `windows-native-probe.yml`, `-e1a.yml`, `-e1b.yml` and
+  `-preview.yml` are experimental and non-voting; their push triggers name the feature
+  branch, so on main they run only by dispatch. The release oracle still reads only the
+  four required `ci.yml` jobs. New gates `check-win32-preview` and
+  `check-pack-win32-carrier` (in `check:contracts`); one new mutant lane, `win32-preview`
+  (19 claims), and the carrier's 2 claims appended to the existing `pack-install` lane.
+  The committed set is now 1000 mutants across 73 lanes.
+- **Experimental WSL2 workflow (#78).** `.github/workflows/wsl2-install-surface.yml`
+  installs this run's packed tgz inside a real WSL2 guest on a GitHub-hosted Windows runner,
+  runs a harness-absent `setup`, then births a zero-token Pi citizen (record, socket,
+  `peer-facts`; `get_state` only). It is not a release axis: the release oracle reads only
+  `ci.yml`, whose four required jobs are unchanged. It runs when the workflow file changes
+  on main, or by manual dispatch. No WSL2 support, harness rail or physical-machine claim.
+
+### Release boundary and verification
+
+- **Implementation commits.** WSL2 `afcda79`..`9b492a4` (landed `86f0eb5`); native
+  Windows `95933c7`..`5da8f12`, landed with the carrier supply contract `32fcc1c`
+  (exact push CI 39128022109, four jobs green). The runtime proof stays on `3b65bdc`'s
+  own SHA. Coordinator-routed independent reviews (primary and supplemental) closed
+  every shipped implementation leaf.
+- Kill-power re-measured at this shipped SHA: none (all 1000 committed claims not
+  re-proved, #144).
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 864e026877ca surface
+  200536056020 -- `["bash","run.sh","check-win32-preview"]` 19/19 receipt b4de9e681dfb
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 864e026877ca surface
+  200536056020 -- `["bash","run.sh","check-pack-win32-carrier"]` 2/2 receipt
+  c51ef11b84a6
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 3e527cdbea81 surface
+  8f5cc4c34473 -- `["bash","run.sh","check-node-floor-coherence"]` 2/2 receipt
+  6c0ec40a291f
+- **Static/LIVE split.** Local P4/M0 `check:full` is not run on this operator host (its
+  FULL includes Herdr checks prohibited here) and is not counted as passed: the whole
+  static floor is owed to this prepared SHA's exact push CI.
+- **Cut blockers.** VERIFY §3.4 (strict `doctor-meta-bridge` on an installed 0.39.0
+  Claude host in a new post-install session) and §3.7 (three agy doctors and a same-gid
+  native-push reply in a new operator conversation) need the operator and are not met by
+  this record; no tag or GitHub release until they are or GLG decides otherwise. npm
+  publication is outside the current authorization and was not performed; it needs a
+  separate GLG GO.
+- **Herdr follows core.** `plugins/herdr/runtime-lock.json` stays on the closed
+  `herdr-checkout` source (comment re-dated only); no plugin manifest version, registry
+  pin or snapshot changes in this release.
+
 ## 0.38.1 - 2026-10-17
 
 ### pi-durable

package/LICENSES/node-gyp.txt

@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2012 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -78,8 +78,20 @@ Plain MCP registration alone does not make a garden citizen.
 installation is **CERTIFIED (CI)**, weaker than a physical-host doctor; its native
 harness rails, ACP and mux remain **NOT CERTIFIED — pending physical host**.
 Detected harness wiring on Darwin can therefore be written while setup stays
-non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
-restriction; that is not certification of every platform's harness rails.
+non-green. WSL2: a CI runner (experimental) measured the Entwurf-only install and a
+zero-token Pi citizen; general, physical-machine or harness-parity WSL2 support is **not
+declared**, and delivery, other harnesses and physical machines are unmeasured. Native
+Windows has an **experimental first preview**, a CI-built x64 addon on `main` for the
+0.39.0 candidate (not yet released; release and npm publication pending); the registry's
+0.38.1 has no Windows addon. On a GitHub Actions `windows-2025` x64 runner with Node
+24.18.1 and Pi 1.3.0, a CI-built artifact was installed, wired with `pi install`, birthed
+two Pi citizens and
+delivered one garden-id `entwurf_v2` message between them, with an offline scripted model
+and no vendor turn. Every other native-Windows surface (other harnesses, `setup` and the
+`.sh` bins, fresh/resume, mux/Herdr/ACP, physical machines) is **not declared**; the
+measured scope and its named gaps are in [BASELINE](./BASELINE.md#release-host-baseline).
+The package has no npm `os` restriction; that is not certification of every platform's
+harness rails.
 
 ### Native durable (pi-durable)
 

package/VERIFY.md

@@ -276,14 +276,16 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
 | Exact release commit | the exact SHA's push run: all four required CI jobs green (the qualification body is not read, #144) | A different green SHA is not transferable evidence. |
 | macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven `entwurf-bridge` MCP tools of that date; eight today), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |
+| Native-Windows carrier (carrier-bearing release, from 0.39.0) | one `windows-native-preview.yml` dispatch at the exact prepared SHA after its four `ci.yml` jobs are green: accepted build receipt (two byte-identical MSVC builds, exact import set), `pack` printing `present`, eight Windows addon/citizen cells on the installed tarball; that run's `win32-preview-tgz` is the release candidate, retrieved (never packed locally) with its `SHA256SUMS`, the Windows-printed install hash and the downloaded hash equal, then accepted by the Linux `check-install-container` unchanged (release skill M3w) | Experimental, shape-only, non-voting for `ci.yml`: no vendor turn, x64 runner only, named gaps in BASELINE. The four `ci.yml` jobs (incl. macOS) saw an addon-less pack, so the carrier-bearing tarball's macOS install is unmeasured. Artifacts expire after 14 days; the preserved copy is the durable one. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |
 | Native Codex host | caller-seat topology accepted 2026-09-16 (56 assertions, exit 0); caller-DIRECTORY axis accepted the same day (65 assertions, exit 0) | Operator-owned birth/MCP/statusline/terminal-title atoms and the on-demand four-coordinate chain are measured on Linux at Codex 0.153.4: the app-server alone in session A (`$30/@41/%45`, pid 737636), and initial Pi / omitted-placement fresh Codex / Codex-opened outbound Pi all in a different session S (`$2`, `@46`/`@47`/`@48`; `@58`/`@59`/`@61` in the lane C run); exact callbacks and addressed delivery both ways. A ≠ S is the load-bearing half — the app-server's inherited `TMUX` names A, so the outbound Pi landing in S can only have come from the caller's own pane title, and its receipt records `seat-source=codex-title-anchor`. **#95 lane C added the second axis to the same card: WHERE the sibling starts.** Hop 1 joins four authorities that cannot borrow from each other — the pane's `#{pane_current_path}`, the vendor rollout's `session_meta.cwd`, the Entwurf record and the requested scratch — and hop 1's leg requests a cwd while hop 2 requests NONE, so hop 2's directory can only come from the Codex caller's own record; both are asserted different from the app-server's live `/proc/<pid>/cwd`. 65 and 56 are different contracts, not a regression. The 2026-09-12 fixed-home chain is PAST CONTRACT (#95 D1); `DELIVERY.md` owns every receipt and digest. Placement beside a TUI whose thread nobody named is unsupported and unclaimed. |
 
 The repo-local `entwurf-release` skill owns the `land → prepare → make → publish`
-state machine. Each mode is a separate GLG authorization. Preserve one candidate,
-accept and publish those exact bytes without repacking, and record its digest and
+state machine. Each mode is a separate GLG authorization. Preserve one candidate
+(for a carrier-bearing release, the one retrieved from the preview run, never a local
+pack), accept and publish those exact bytes without repacking, and record its digest and
 consumer image outside this standing protocol.
 
 ### Verifying the two capabilities a gate cannot fully judge
@@ -385,6 +387,13 @@ not certified, a detected harness is named non-green (FAIL) whose wording is
 not an install failure: the wiring WAS written, but the rail is NOT CERTIFIED —
 pending physical host. That FAIL is the honest setup verdict, not a skip.
 
+WSL2: a separate experimental workflow (`.github/workflows/wsl2-install-surface.yml`)
+measures the Entwurf-only install and a zero-token Pi citizen inside a real WSL2 guest on
+a GitHub-hosted Windows runner. The release oracle does not read it
+(`verify-exact-ci.sh` selects only `ci.yml` runs), so it is not a release axis and a red
+there blocks no cut. It runs when that workflow file changes on main, or by manual
+dispatch. Recorded in [BASELINE.md](./BASELINE.md).
+
 ### 1.1 Variables (optional)
 
 ```bash
@@ -518,7 +527,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 The minimum passing bar:
 
 1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), in the exact-SHA CI push run of the same prepared candidate (criterion 2's run). The qualification body is not a criterion (#144).
-2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
+2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. For a carrier-bearing release those CI tarballs are addon-less and are NOT the release candidate: the exact release bytes are the M3w-retrieved preview tarball, accepted separately by the eight Windows cells and the Linux container (axes row "Native-Windows carrier"). The four-job floor, macOS included, is unchanged. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.
 5. **Honest self-recognition:** the bridged model identifies its actual harness/backend, lists `entwurf-bridge` as the single MCP server with its eight current tools, and presents a backend-native (not normalized) tool surface.

package/docs/setup-clean-host.md

@@ -18,7 +18,9 @@ evidence split, and its three states must not collapse into "macOS is supported"
   ACP turn, mux. Wiring may be written; that is not a rail receipt. The remaining
   unmeasured Darwin doctor reason is per-process environment DISCOVERY
   (start-key is portable).
-- **UNSUPPORTED** — native Windows only. macOS is never this.
+- **UNSUPPORTED** — native Windows `setup` and its harness rails. macOS is never this.
+  An experimental native-Windows Pi preview (0.39.0 candidate, not yet released; release
+  and npm publication pending) exists outside `setup`; see [BASELINE](../BASELINE.md#release-host-baseline).
 
 ## Requirements
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -84,6 +84,7 @@ import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequ
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
+import { probeSocketLiveness } from "../../../pi-extensions/lib/socket-probe.js";
 const HOME = os.homedir();
 // ============================================================================
 // OMP root policy — FIRST, before any lazy default-root consumer (#87 B1).
@@ -110,6 +111,14 @@ catch (err) {
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
+/** Is this session's own control address up? A socket file's presence on Linux/macOS. On
+ * Windows (#78) the address is a named pipe, which has no file to look at and must not be
+ * opened by a stat (that connects): the owner-validated probe answers instead. */
+async function controlAddressPresent(socketPath) {
+    if (process.platform === "win32")
+        return (await probeSocketLiveness(socketPath)) === "alive";
+    return existsSync(socketPath);
+}
 // ============================================================================
 // Live control-socket discovery for entwurf_peers lives in the TS fact-provider
 // (pi-extensions/lib/entwurf-fact-provider.ts → listEntwurfFacts), which the
@@ -171,7 +180,7 @@ class EntwurfSenderIdentityError extends Error {
             "the send is then marked external/non-replyable).");
     }
 }
-function buildStrictPiSenderEnvelope() {
+async function buildStrictPiSenderEnvelope() {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
@@ -195,7 +204,7 @@ function buildStrictPiSenderEnvelope() {
     const socketPath = controlSocketPathIn(ENTWURF_DIR, sessionId);
     const self = computeSelfAddressability({
         origin: "pi-session",
-        socketAlive: existsSync(socketPath),
+        socketAlive: await controlAddressPresent(socketPath),
         socketPathComputable: true,
     });
     return {
@@ -258,7 +267,7 @@ async function buildMetaSenderEnvelope(identity, cwd, trustedMarker) {
 async function resolveAuthoritativeSender(context, cwd = process.cwd()) {
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
-    const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+    const pi = sessionId && agentId && cwd ? await buildStrictPiSenderEnvelope() : null;
     const marker = resolveTrustedMetaSenderIdentity({
         markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
     });
@@ -463,7 +472,7 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
             // live socket). The old code synthesized the path and printed it as if
             // it existed — a lie when the session has no --entwurf-control (SE-1).
             const socketPath = controlSocketPathIn(ENTWURF_DIR, sender.sessionId);
-            const socketState = existsSync(socketPath) ? "alive" : "expected";
+            const socketState = (await controlAddressPresent(socketPath)) ? "alive" : "expected";
             extra.socketPath = socketPath;
             extra.socketState = socketState;
             lines.push(socketState === "alive"

package/mcp/entwurf-bridge/dist/pi-extensions/lib/control-socket-path.js

@@ -24,8 +24,17 @@
  * adapter keeps its own root policy: the pi side derives from HOME, the MCP
  * bridge honours `ENTWURF_DIR`. What is unified is the grammar, not the policy.
  *
- * Keep dependency-free except `node:path`.
+ * Windows (#78) has no socket files: the address is a named pipe,
+ * `\\.\pipe\entwurf-<sha256(canonRoot(dir))[:16]>-<gardenId>`. The digest keeps two
+ * store roots on one host apart without putting a path in the pipe namespace; it is not
+ * a new address axis (still the garden id plus the store root). The inverse grammar has
+ * no Windows half because nothing scans the pipe namespace: candidates come from records.
+ *
+ * Keep dependency-free except node builtins (`node:path`, and `node:crypto`/`node:fs`
+ * for the Windows root canonicalisation only).
  */
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
 import * as path from "node:path";
 /** Control-socket filename suffix. The stem is a bare garden id. */
 export const CONTROL_SOCKET_SUFFIX = ".sock";
@@ -47,8 +56,54 @@ export function defaultControlSocketDir(home) {
  * @returns {string}
  */
 export function controlSocketPathIn(dir, gardenId) {
+    if (process.platform === "win32")
+        return win32PipeNameFor(dir, gardenId);
     return path.join(dir, `${gardenId}${CONTROL_SOCKET_SUFFIX}`);
 }
+/** Every Windows control pipe this package names starts here. */
+export const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\entwurf-";
+/**
+ * The one spelling of a Windows store root, so Pi A, Pi B, the bridge and peer-facts
+ * derive the same pipe name from differently written paths. The nearest EXISTING ancestor
+ * of `path.win32.resolve(dir)` goes through `realpath` (8.3 names expanded, case from the
+ * filesystem); the components below it are appended as written. Separators become `\`,
+ * there is no trailing separator, and the whole string is lower-cased. Nothing is created
+ * or touched, so the control dir need not exist yet. A failure other than ENOENT throws.
+ *
+ * @param {string} dir
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function canonRootWin32(dir, realpath = fs.realpathSync.native) {
+    let head = path.win32.resolve(dir);
+    /** @type {string[]} */
+    const tail = [];
+    for (;;) {
+        try {
+            const joined = path.win32.join(realpath(head), ...tail);
+            return joined.replace(/[\\/]+$/, "").toLowerCase();
+        }
+        catch (err) {
+            const parent = path.win32.dirname(head);
+            if ( /** @type {{ code?: unknown }} */(err).code !== "ENOENT" || parent === head)
+                throw err;
+            tail.unshift(path.win32.basename(head));
+            head = parent;
+        }
+    }
+}
+/**
+ * Forward grammar on Windows: `\\.\pipe\entwurf-<16 hex>-<gardenId>`.
+ *
+ * @param {string} dir
+ * @param {string} gardenId
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function win32PipeNameFor(dir, gardenId, realpath) {
+    const digest = createHash("sha256").update(canonRootWin32(dir, realpath), "utf8").digest("hex").slice(0, 16);
+    return `${WIN32_PIPE_PREFIX}${digest}-${gardenId}`;
+}
 /**
  * Inverse grammar: a socket filename back to its garden id, or `null` when the
  * name does not carry the suffix.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-control-rpc.js

@@ -14,6 +14,7 @@
  * asked to open, and touches nothing pi-specific — it is a pure transport over a path.
  */
 import * as net from "node:net";
+import { win32Native } from "./win32-native.js";
 /**
  * THE `<sender_info>` synthesis — the one place the sender envelope becomes
  * message text. ONE consumer since the visible-first cut (#50 C3):
@@ -101,6 +102,8 @@ export async function fetchControlSocketRuntimeInfo(socketPath, options = {}) {
 }
 export async function sendRpcCommand(socketPath, command, options = {}) {
     const { timeout = 5000 } = options;
+    if (process.platform === "win32")
+        return await sendPipeRpcCommand(socketPath, command, timeout);
     return new Promise((resolve, reject) => {
         const socket = net.createConnection(socketPath);
         socket.setEncoding("utf8");
@@ -173,3 +176,25 @@ export async function sendRpcCommand(socketPath, command, options = {}) {
         });
     });
 }
+/**
+ * The Windows client (#78). The addon makes one owner-validated connect, writes the request
+ * line and returns the first response line, all inside one deadline; a timeout is
+ * `ETIMEDOUT`, a pipe owned by anyone but this token's expected owner is `EPERM` before any
+ * byte. The protocol is request-bound on its own connection, so that first line IS the
+ * answer: anything other than this command's response is refused, never waited past.
+ */
+async function sendPipeRpcCommand(pipeName, command, timeout) {
+    const { responseLine } = await win32Native().pipeRpc(pipeName, JSON.stringify(command), Math.max(0, Math.floor(timeout)));
+    let msg;
+    try {
+        msg = JSON.parse(responseLine.trim());
+    }
+    catch {
+        throw new Error(`control pipe answered ${command.type} with a line that is not JSON`);
+    }
+    const response = msg;
+    if (response?.type !== "response" || response.command !== command.type) {
+        throw new Error(`control pipe answered something other than the ${command.type} response`);
+    }
+    return { response };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -52,6 +52,7 @@
 import { execFileSync } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
+import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
 import { generateSessionId, SESSION_ID_RE } from "./session-id.js";
@@ -845,6 +846,8 @@ const O_NONBLOCK_FLAG = typeof fs.constants.O_NONBLOCK === "number" ? fs.constan
  * Shaping a message is the job of the caller that knows what the answer is FOR.
  */
 export function readStoreRecordFile(file) {
+    if (process.platform === "win32")
+        return win32RecordReader()(file).toString("utf8");
     if (O_NOFOLLOW_FLAG === 0) {
         throw new MetaRecordError(`cannot read meta-record ${path.basename(file)} safely: this platform exposes no O_NOFOLLOW, so a record ` +
             "read cannot refuse a symlink swapped in at the final component. entwurf certifies Linux only.");
@@ -863,6 +866,17 @@ export function readStoreRecordFile(file) {
         fs.closeSync(fd);
     }
 }
+/**
+ * Windows has no `O_NOFOLLOW` (libuv defines it as 0), so the same three decisions — a
+ * final-component reparse point refused as `ELOOP`, a non-regular entry as
+ * `ENTWURF_ENOTREG`, both on the handle the read uses — are made by the preview addon
+ * (#78). It is reached only here and only on win32, through `createRequire`, so the
+ * installers that copy this file without its siblings never load it on Linux or macOS.
+ */
+function win32RecordReader() {
+    const native = createRequire(import.meta.url)("./win32-native.js");
+    return native.win32ReadNoFollow;
+}
 /** The reader every store-WIDE scan pairs with {@link readActiveStoreEntries}. The
  * caller's entry kind decides the POLICY — whether a non-regular entry is a defect
  * (certification), a diagnostic (listing) or a non-candidate (the rival scan) — because

package/mcp/entwurf-bridge/dist/pi-extensions/lib/socket-discovery.js

@@ -51,7 +51,7 @@
  */
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
-import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir, gardenIdFromSocketFilename, } from "./control-socket-path.js";
+import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir, gardenIdFromSocketFilename, WIN32_PIPE_PREFIX, } from "./control-socket-path.js";
 import { SESSION_ID_RE } from "./session-id.js";
 import { probeSocketLiveness } from "./socket-probe.js";
 /** Canonical control-socket directory; the socket filename IS the gardenId
@@ -81,7 +81,9 @@ export function controlSocketPath(gardenId, dir = CONTROL_SOCKET_DIR) {
  * `record-less-socket` reject (a diagnostic state) — no probe, no acceptance.
  */
 export function isRecordLessSocketCandidate(inspection) {
-    return inspection.kind === "socket-file";
+    // A Windows pipe name (#78) is never lstat-ed (see inspectControlSocketPath), so its
+    // `socket-file` carries no presence evidence and cannot confirm a record-less socket.
+    return inspection.kind === "socket-file" && !inspection.socketPath.startsWith(WIN32_PIPE_PREFIX);
 }
 /**
  * Inspect the EXACT control-socket path given (no gid re-derivation) and classify it by
@@ -94,6 +96,12 @@ export function isRecordLessSocketCandidate(inspection) {
  * symlink is caught as an address-conflict and never connected, P1).
  */
 export async function inspectControlSocketPath(socketPath, lstatFn = (p) => fs.lstat(p)) {
+    // Windows (#78): the address is a named pipe. The pipe filesystem has no symlinks to
+    // catch, and opening the name to stat it would CONNECT to it and consume an instance.
+    // So the name is never stat-ed: it is safe to probe because the probe itself refuses a
+    // pipe whose owner is not this token's expected owner before any byte.
+    if (socketPath.startsWith(WIN32_PIPE_PREFIX))
+        return { kind: "socket-file", socketPath };
     let st;
     try {
         st = await lstatFn(socketPath);
@@ -160,8 +168,12 @@ export async function mapInspectionToLiveness(inspection, probeSocket) {
  */
 export async function scanSocketProbes(piCitizenGardenIds, deps = {}) {
     const dir = deps.dir ?? CONTROL_SOCKET_DIR;
+    // Windows (#78) has no socket files to list and nothing scans the pipe namespace: the
+    // candidates are the record-backed citizens alone.
     const readdir = deps.readdir ??
         (async (d) => {
+            if (process.platform === "win32")
+                return [];
             const dirents = await fs.readdir(d, { withFileTypes: true });
             return dirents.map((e) => ({ name: e.name, isSymbolicLink: e.isSymbolicLink() }));
         });

package/mcp/entwurf-bridge/dist/pi-extensions/lib/socket-probe.js

@@ -28,6 +28,7 @@
  * hidden — `entwurf_peers` shows it and the v2 decider rejects on it by name.
  */
 import * as net from "node:net";
+import { win32Native } from "./win32-native.js";
 export const DEFAULT_PROBE_TIMEOUT_MS = 300;
 /**
  * Pure classification of a connect-time error code into liveness. Only the two
@@ -56,6 +57,8 @@ export function shouldUnlinkOnGc(liveness) {
  */
 export async function probeSocketLiveness(socketPath, opts = {}) {
     const timeoutMs = opts.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+    if (process.platform === "win32")
+        return await probePipeLiveness(socketPath, timeoutMs);
     return await new Promise((resolve) => {
         const socket = net.createConnection(socketPath);
         const timer = setTimeout(() => {
@@ -76,3 +79,21 @@ export async function probeSocketLiveness(socketPath, opts = {}) {
         });
     });
 }
+/**
+ * The Windows probe (#78): the control address is a named pipe, and a connect alone would
+ * talk to whoever holds the name. The addon connects within one deadline and refuses a pipe
+ * whose owner is not this token's expected owner (`EPERM`) before any byte. Only `ENOENT`
+ * (no instance) is dead; a refused owner, a busy pipe past the deadline and every Win32
+ * failure stay indeterminate. A missing or drifted addon is not a liveness fact: that
+ * refusal throws.
+ */
+async function probePipeLiveness(pipeName, timeoutMs) {
+    const native = win32Native();
+    try {
+        await native.pipeProbe(pipeName, Math.max(0, Math.floor(timeoutMs)));
+        return "alive";
+    }
+    catch (err) {
+        return classifyConnectError(err.code);
+    }
+}