@junghanacs/entwurf 0.38.1 → 0.40.0

package/scripts/mutants/remote-pair-display.json

@@ -0,0 +1,53 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-display",
+	"mutants": [
+		{
+			"claim": "REMOTE-DISPLAY-LOCAL-UNCHANGED",
+			"title": "the remote branch is taken for every non-replyable sender, so an ordinary external or meta-session header turns into a remote line naming a route that does not exist",
+			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
+			"find": ["\tconst remote = !replyable ? sender.remote : undefined;"],
+			"replace": [
+				"\tconst remote = !replyable ? (sender.remote ?? { via: \"?\", replyRoute: \"none\" as const }) : undefined;"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-DISPLAY-LOCAL-UNCHANGED]",
+			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-DISPLAY-SESSIONLINE",
+			"title": "a remote sender with a declared route back is told to reply via entwurf_v2 as if that route had been probed",
+			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
+			"find": ["\"reply route declared, not probed\""],
+			"replace": ["\"reply via entwurf_v2 to this sessionId\""],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-DISPLAY-SESSIONLINE]",
+			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-DISPLAY-SENDER-HOST-CWD",
+			"title": "a remote sender's cwd is abbreviated against this host's HOME, so a path on the other machine reads as a local one",
+			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
+			"find": ["\tconst where = remote ? `${sender.cwd} (sender-host path)` : abbreviateHome(sender.cwd);"],
+			"replace": ["\tconst where = abbreviateHome(sender.cwd);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-DISPLAY-SENDER-HOST-CWD]",
+			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/remote-pair-installed-audit.json

@@ -0,0 +1,28 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-installed-audit",
+	"mutants": [
+		{
+			"claim": "RPI-AUDIT-REAL-PATH",
+			"title": "the installed-closure audit judges a resolved file by its link path, so an installed file that is a symlink into a checkout passes as inside the consumer",
+			"subject": "scripts/lib/remote-pair-installed-audit.ts",
+			"find": ["\t\t\tconst real = fs.realpathSync(fileURLToPath(url));"],
+			"replace": ["\t\t\tconst real = fileURLToPath(url);"],
+			"gate": ["bash", "run.sh", "check-remote-pair-installed-audit"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RPI-AUDIT-REAL-PATH]",
+			"signatureSource": "test/remote-pair-installed-audit.test.ts"
+		},
+		{
+			"claim": "RPI-AUDIT-ROOT-BOUNDARY",
+			"title": "the installed-closure audit treats any path that merely starts with the consumer prefix as inside it, so a sibling directory such as <prefix>-x passes",
+			"subject": "scripts/lib/remote-pair-installed-audit.ts",
+			"find": ["\t\t\tif (real !== realRoot && !real.startsWith(`${realRoot}${path.sep}`)) out.add(real);"],
+			"replace": ["\t\t\tif (real !== realRoot && !real.startsWith(realRoot)) out.add(real);"],
+			"gate": ["bash", "run.sh", "check-remote-pair-installed-audit"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RPI-AUDIT-ROOT-BOUNDARY]",
+			"signatureSource": "test/remote-pair-installed-audit.test.ts"
+		}
+	]
+}

package/scripts/mutants/remote-pair-receive.json

@@ -0,0 +1,126 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-receive",
+	"mutants": [
+		{
+			"claim": "REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION",
+			"title": "the receiving entry stops checking the claimed sender against the declared pair, so any gid the SSH account writes is dispatched into the declared target's mailbox",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tif (claim.from !== decl.remoteGardenId) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION",
+			"title": "the receiving entry stops checking the claimed target against the declared pair, so a declared remote can reach every deliverable citizen on this host",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tif (claim.target !== decl.localGardenId) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-IGNORES-AMBIENT-SENDER",
+			"title": "the receiving entry lets an ambient PI_SESSION_ID in the SSH environment stand in for the sender, so the header names whoever's carrier leaked instead of the claim",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\t\tsessionId: claim.from,"],
+			"replace": ["\t\tsessionId: process.env.PI_SESSION_ID ?? claim.from,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-IGNORES-AMBIENT-SENDER]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-MATCH-DISPATCHES-ONCE",
+			"title": "the receiving entry marks a remote sender replyable, so the body tells the receiver to reply via entwurf_v2 as if a live local reply route had been probed — none was",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\t\treplyable: false,"],
+			"replace": ["\t\treplyable: true,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-MATCH-DISPATCHES-ONCE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-CLAIM-EXACT-SHAPE",
+			"title": "the claim parser accepts extra or missing fields, so a sender-side field the receiver never reads can ride in and a partial claim is dispatched",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tif (got.length !== want.length || got.some((k, i) => k !== want[i])) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-CLAIM-EXACT-SHAPE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-ENTRY-REFUSES-OUTSIDE",
+			"title": "the entry reports a pair refusal as exit 0, so the sending host cannot tell a refused claim from a dispatched one without parsing prose",
+			"subject": "scripts/remote-pair-receive.ts",
+			"find": ["emit(receipt, receipt.kind === \"rejected\" ? 3 : receipt.isError ? 4 : 0);"],
+			"replace": ["emit(receipt, receipt.kind === \"rejected\" ? 0 : receipt.isError ? 4 : 0);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-ENTRY-REFUSES-OUTSIDE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-ENTRY-USAGE",
+			"title": "the entry accepts any --pair it is given, so the sender picks which declaration scopes the claim on the receiving host",
+			"subject": "scripts/remote-pair-receive.ts",
+			"find": ["\tif (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-ENTRY-USAGE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-ENTRY-REPLY-ROUTE-DECLARED",
+			"title": "the entry reports no route back for a claim its own opt-in pairs with, so the receiver is told it cannot answer a sender it has declared",
+			"subject": "scripts/remote-pair-receive.ts",
+			"find": ["\treplyRoute: \"declared\","],
+			"replace": ["\treplyRoute: \"none\","],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-ENTRY-REPLY-ROUTE-DECLARED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/remote-pair-roundtrip.json

@@ -0,0 +1,83 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-roundtrip",
+	"mutants": [
+		{
+			"claim": "REMOTE-ROUNDTRIP-A-TO-B",
+			"title": "the bridge never reads the opt-in, so a declared remote target falls through to the local decider as bad-target",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t\t\troute: readRemotePairOptIn(remotePairOptInPath()),"],
+			"replace": ["\t\t\t\t\troute: null,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-A-TO-B]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-REVERSE-DISPATCH",
+			"title": "the bridge's transport never reaches the other host and always answers exit 1, so every declared remote send in either direction becomes indeterminate",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t\t\ttransport: processTransport,"],
+			"replace": [
+				"\t\t\t\t\ttransport: { run: async () => ({ exitCode: 1, signal: null, timedOut: false, stdout: \"\", stderr: \"\" }) },"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-REVERSE-DISPATCH]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-OPT-IN-ABSENT-OFF",
+			"title": "the bridge replaces the local surface on the remote path's behalf, so a host with no opt-in stops running the existing local decider",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t\t\trunLocal: (params, opts) => runAndRenderEntwurfV2FromSurface(params, opts),"],
+			"replace": ["\t\t\t\t\trunLocal: async () => ({ isError: false, text: \"local skipped\" }),"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-OPT-IN-ABSENT-OFF]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-OTHER-HOST-REFUSES",
+			"title": "the sender renders the other host's pair refusal without naming it, so A cannot tell B refused the pair from any other failure",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["refused by the other host's pair: ${o.reason} (${o.detail})"],
+			"replace": ["failed"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-OTHER-HOST-REFUSES]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-LOCAL-TRACE-BOTH-SOCKET-DIRS",
+			"title": "the bridge checks only its own ENTWURF_DIR, so a live local socket in the decider's canonical dir is bypassed and the gid is sent away",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t\t\t\tcontrolSocketDirs: [CONTROL_SOCKET_DIR, ENTWURF_DIR],"],
+			"replace": ["\t\t\t\t\t\tcontrolSocketDirs: [ENTWURF_DIR],"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-LOCAL-TRACE-BOTH-SOCKET-DIRS]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/remote-pair-send.json

@@ -0,0 +1,194 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-send",
+	"mutants": [
+		{
+			"claim": "REMOTE-ROUTE-UNDECLARED-LOCAL-UNCHANGED",
+			"title": "a declared route captures every target, so a gid the declaration never named is sent to the other host instead of the local decider",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (route === null || params.target !== route.remoteGardenId) {"],
+			"replace": ["\tif (route === null) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-UNDECLARED-LOCAL-UNCHANGED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-LOCAL-CONFLICT-FAILS-CLOSED",
+			"title": "a declared remote gid that this host also answers to is sent away anyway, so two hosts' citizens share one address and the sender silently picks the remote",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (await opts.localTrace(route.remoteGardenId)) {"],
+			"replace": ["\tif (Boolean(0)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-LOCAL-CONFLICT-FAILS-CLOSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-SENDER-MUST-BE-DECLARED",
+			"title": "any present envelope may use the route, so an anonymous caller or another citizen on this host speaks to the other host as the declared sender",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (!sender || sender.origin === \"external-mcp\" || sender.sessionId !== route.localGardenId) {"],
+			"replace": ["\tif (!sender || Boolean(0)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-SENDER-MUST-BE-DECLARED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-EXACT-ARGV-ONCE",
+			"title": "the transport runs ssh without BatchMode, so a missing key turns into an interactive prompt nobody can answer instead of a bounded failure",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\t\"BatchMode=yes\","],
+			"replace": ["\t\t\"BatchMode=no\","],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-EXACT-ARGV-ONCE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-NO-RETRY",
+			"title": "the send runs the transport a second time, so an uncertain first attempt can enqueue the same message twice on the other host",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tconst result = await opts.transport.run("],
+			"replace": [
+				"\tawait opts.transport.run(remoteReceiveArgv(route), JSON.stringify(claim), 1);\n\tconst result = await opts.transport.run("
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-NO-RETRY]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-RECEIPT-EXIT-AND-KIND-AGREE",
+			"title": "an accepted-looking JSON line counts as accepted whatever the exit code says, so a refusal or a crash after printing reads as delivery",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": [
+				"\tif (r.exitCode === 0 && keys === \"isError,kind,text\" && o.kind === \"dispatched\" && o.isError === false) {"
+			],
+			"replace": ["\tif (keys === \"isError,kind,text\" && o.kind === \"dispatched\" && o.isError === false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-RECEIPT-EXIT-AND-KIND-AGREE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-DECL-NO-QUOTING-NEEDED",
+			"title": "the remote declaration path may carry spaces or shell metacharacters, which ssh joins into the remote shell string and the other host reinterprets",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["const REMOTE_PATH = /^\\/[A-Za-z0-9._/-]+$/;"],
+			"replace": ["const REMOTE_PATH = /^\\/.+$/;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-DECL-NO-QUOTING-NEEDED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-LOCAL-TRACE-ANY-STATE",
+			"title": "a socket at the gid's control path in a named socket dir is not counted as a local trace, so a live local citizen without a record is bypassed for the remote",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\t\tif (inspection.kind !== \"absent\") return true;"],
+			"replace": ["\t\t\tif (false) return true;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-LOCAL-TRACE-ANY-STATE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-RECEIPT-PATHS-OTHER-HOST",
+			"title": "the accepted receipt drops the note that its paths are on the other host, so the other host's messagePath reads as a file the sender could open",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["read/answer unknown until a reply arrives; paths below are on the other host)"],
+			"replace": ["read/answer unknown until a reply arrives)"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-RECEIPT-PATHS-OTHER-HOST]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-OPT-IN-ABSENT-IS-OFF",
+			"title": "an absent opt-in file throws instead of meaning off, so every local send on a host that never opted in fails",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\tif ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;"],
+			"replace": ["\t\tif (false) return null;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-OPT-IN-ABSENT-IS-OFF]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-OPT-IN-BROKEN-REFUSED",
+			"title": "a symlinked or non-regular opt-in is followed, so the route the bridge walks is whatever the link points at today",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (!st.isFile()) {\n\t\tthrow new RemoteRouteDeclarationError(`remote pair opt-in"],
+			"replace": ["\tif (false) {\n\t\tthrow new RemoteRouteDeclarationError(`remote pair opt-in"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-OPT-IN-BROKEN-REFUSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-REPORTED-ERROR-NO-DELIVERY-INFERENCE",
+			"title": "an error the other host reports after a possible write is headed as a non-delivery, inviting a resend that would deliver twice",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host reported an error while processing; read its receipt below, delivery is not inferred from this line; not retried (paths below are on the other host)\\n${o.text}`,"
+			],
+			"replace": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host did not deliver (paths below are on the other host)\\n${o.text}`,"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-REPORTED-ERROR-NO-DELIVERY-INFERENCE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/remote-pair-transport.json

@@ -0,0 +1,66 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-transport",
+	"mutants": [
+		{
+			"claim": "REMOTE-TRANSPORT-NO-SHELL-SEPARATE-STREAMS",
+			"title": "the transport runs its argv through a shell, so a remote declaration word is expanded on the sending host before ssh ever sees it",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["{ shell: false, stdio: [\"pipe\", \"pipe\", \"pipe\"] }"],
+			"replace": ["{ shell: true, stdio: [\"pipe\", \"pipe\", \"pipe\"] }"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-NO-SHELL-SEPARATE-STREAMS]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-TIMEOUT-REAPS-OWN-CHILD",
+			"title": "the bound only sends TERM, so an ssh child that ignores it outlives the send and the call never returns",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\t\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-TIMEOUT-REAPS-OWN-CHILD]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-SPAWN-FAILURE-INDETERMINATE",
+			"title": "a child that never started reports exit 0, so a missing ssh binary reads as a clean exit instead of an unknown outcome",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\texitCode: spawnError ? null : code,"],
+			"replace": ["\t\t\t\t\texitCode: spawnError ? 0 : code,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-SPAWN-FAILURE-INDETERMINATE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-HELD-PIPES-STILL-SETTLE",
+			"title": "the send waits for a close that a pipe-holding descendant never lets happen, so one stuck remote leaves entwurf_v2 hanging forever",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\tfinalTimer = setTimeout(() => {"],
+			"replace": ["\t\t\t\t\tfinalTimer = setTimeout(() => {\n\t\t\t\t\t\treturn;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-HELD-PIPES-STILL-SETTLE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}