@junghanacs/entwurf 0.39.0 → 0.41.0

package/AGENTS.md

@@ -32,7 +32,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
 6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`. Native extension modules enter only through the owning bootstrap, from an operator-named absolute file or an operator-named absolute directory read once at launch: top level only, exact suffix filter, deterministic order, every selected entry a regular file. Neither discovers ambient or default locations, takes module paths from settings or environment, recurses, watches, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
-7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
+7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; roll forward a stale reader that rejects a newly known backend or V3 key. Reader-version skew is not a generation change: preserve identities and records, and verify every participating reader before claiming rollout complete. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
 10. **Native-push is distinct.** It is neither mailbox nor pi socket. Native-push citizens are record-backed plus probe-alive, with no receiver/watch state or resume authority. Antigravity retries only after bounded re-probe; Codex never replays queue acceptance. Codex sender identity is request-scoped metadata; app-server environment carries root/placement, never citizen identity.
@@ -66,8 +66,10 @@ History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue thre
 
 A pi control session and native bridge session are citizens for the same reason: each has a V3 record.
 
+**Retirement is operator-requested, never autonomous.** A real citizen may be retired only when the operator explicitly requests that target/action, like the separate approval needed for a push. Development, tool exposure, a coordinator role, record-backed attribution or delegated release judgement is not a standing retirement grant. No timer, idle heuristic, roster cleanup or agent initiative substitutes for that request. Preserve request attribution without inventing a self-signed permission boolean or role database. Test-owned lifecycle gates require their own named execution scope; working siblings are never incidental test targets.
+
 - Pi owns its native session lifecycle; `birthPiCitizen` attaches `(backend: "pi", nativeSessionId)` to the stable garden id. Socket and env values are record-derived carriers.
-- `entwurf_resume_call {target}` is a separate pi-only lifecycle verb, not delivery intent. It reopens the same dormant id visibly, runs no turn, and receives transcript/model/provider/cwd solely from the record. A launch receipt and socket observation are distinct; an unobserved window stays visible. No watcher, retry, or supervisor.
+- `entwurf_resume_call {target}` is a separate lifecycle verb for pi and Claude Code targets, not delivery intent. It reopens the same dormant id visibly, submits no prompt, and uses the record as the sole address authority (Pi: the record selects an absolute transcript whose native id must match; its session-header cwd and first `model_change` provider/model feed the launch resolver, with no record/host cwd fallback; Claude Code: record session id and cwd, with no model or permission flag restored). Dormancy is rail-specific: a dead pi control socket, or — for Claude Code — the last validated owner the Entwurf hook armed is proven gone (`classifyMarkerOwner` dead) AND the record, re-read after that verdict, still carries the same non-null `attachIncarnation` (arm revision) the marker copied; an absent, unreadable, mismatched, inconclusive or unbound marker refuses. That guarantees only committed hook attaches: a process holding the session without one (hooks disabled, a record-arm lock timeout or store failure at its start) is invisible to it — a boundary GLG accepted on 2026-10-21. A launch receipt and the observation (same-id socket, or a NEW live owner in the opened pane re-arming the marker with a fresh binding the record carries) are distinct; an unobserved window stays visible. The caller is attributed, never authorised by that. Inside herdr it refuses; there is no herdr resume rail. No watcher, retry, or supervisor.
 - **control-socket:** live send under per-target lock; dormant rejects.
 - **self-fetch:** active receiver plus deliverable mailbox; no resume authority. Sender/receiver joins are owner-kind specific and must not be generalized across vendors.
 - **native-push:** probe-alive direct injection; no mailbox and no resume authority.

package/BASELINE.md

@@ -30,7 +30,7 @@ outside the experimental preview (rows below).
 |---|---|---|
 | Node 24 Linux package consumer | shape-only | Required `artifact-consumer` CI |
 | Node 24 macOS package consumer (GitHub Actions runner, not a physical Mac) | shape-only · CERTIFIED (CI) | Required `macos-install-surface` CI run 34303884286 @ `70eda03` (`macos-latest`, 65 s, 10/10 steps): pack → clean consumer install → bin links → `entwurf --help` → `check-bridge` (7 tools) → harness-absent `setup` (all SKIP, computed green, zero no-write-axis writes, `auth.json` byte-identical). Certifies no harness rail. |
-| Claude Code >=2.1.217 exec form | **certified** — supported floor | Topology + floor gates, doctor oracle; B2 live NixOS session |
+| Claude Code exec form (observed at 2.1.217) | **certified** at 2.1.217; the supported floor is now `>=2.1.306` (#147 same-id resume), declared with no LIVE receipt at 2.1.306 itself; the dated n=1 lifecycle round trip below ran on 2.1.307 | Topology + floor gates, doctor oracle; B2 live NixOS session |
 | Claude Code 2.1.138 | **unsupported** | Launcher refuses empty argv; no shell-form fallback |
 | Maintainer NixOS installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 registry install → doctor exit 0 (HISTORY) |
 | Secondary Ubuntu installed package | **certified** for `0.12.8-repair.1` | 2026-07-25 same artifact, isolated agent dir → doctor exit 0 (HISTORY) |
@@ -46,10 +46,65 @@ outside the experimental preview (rows below).
 | macOS physical-host probe | shipped, unrun on a Mac | `scripts/raw-macos-measure/` — `/bin/sh`, cells M1–M9, 3.5 s; needs neither entwurf install nor login. Still unmeasured: Darwin foreign-process environ (`ps -Eww`) and whether macOS `python3` is a CommandLineTools stub. |
 | WSL2 Entwurf-only install + zero-token Pi citizen (GitHub Actions `windows-2025` runner, not a physical machine) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/wsl2-install-surface.yml` run 39098773010 @ `b03d646` ([#78 receipt](https://github.com/junghan0611/entwurf/issues/78#issuecomment-6245947301)). Guest kernel `6.18.40.1-microsoft-standard-WSL2`, host `wsl --list --verbose` VERSION 2, guest fstype quoted raw as `ext2/ext3`. The run's packed tgz digest is equal across producer, host and guest; guest Node 24.18.1; harness-absent `setup` green with protected auth/harness state unchanged. Pi 1.3.0 (sha512 pinned to the registry integrity) wired by `setup`: one V3 record whose filename is its gid, a gid-keyed control socket with a native connect, `peer-facts` alive; only `get_state` was sent and no `agent_start` was observed. Pi creating an empty `auth.json` is not a login. It certifies no harness rail. Linux-guest runtime evidence only: not native-Windows evidence, and not a substitute for the required Linux CI jobs. |
 | WSL2 delivery, non-pi harnesses, vendor turn, physical user machine | unverified | No receipt. Authentication and model turns were deliberately excluded from the CI cells' scope (not a CI impossibility); non-pi harnesses, delivery, fresh/resume and physical machines are unmeasured. |
-| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0; 0.39.0 candidate, not yet released; release and npm publication pending; the evidence below is the feature-branch CI artifact at `3b65bdc`) | shape-only | Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/windows-native-preview.yml` run 39123555360 @ `3b65bdc`, with the required `ci.yml` four jobs green at the same SHA (run 39123555224). Build: MSVC (VS 2026, toolset v145, SDK 10.0.26100.0), two builds byte-identical (`entwurf_win.node` sha256 `9837893521ec…`), imports advapi32 + kernel32 with `node.exe` the only delay-load; node-gyp 13.1.0 and the Node headers/`node.lib` pinned. The pack carries exactly the addon and its manifest; npm installed it into a sandboxed consumer prefix; Pi came from a tarball checked against its pinned SRI. Six addon cells PASS (final-component reparse and non-regular refusals on the read handle, no connect through a symlink to a pipe, one-deadline timeout with reclaim, pipe-name stability and loader refusals). B1: two `pi --entwurf-control` citizens, one V3 record each, record-derived pipes alive through the product probe, `peer-facts` alive, graceful exit with both addresses dead afterwards. D1: A's model called `entwurf_v2` toward B's garden id with a nonce; A's receipt `control-socket → sent`, B's model context and B's transcript `entwurf-message` entry from A carry it. The model is an offline pi-ai `fauxProvider`: no vendor turn and no comprehension claim. The transcript fact is the harness's assertion; the raw transcript is not archived. The run used the elevated Administrators owner branch, so user-SID-only privacy is not measured. Pi's `peerDependencies` warning was observed, not waived. Not evidence for any other harness on Windows. |
+| native Windows experimental preview: Pi citizen + `entwurf_v2` delivery (GitHub Actions `windows-2025` x64 runner, Node 24.18.1, Pi 1.3.0; ships in core 0.39.0; the evidence below is the feature-branch CI artifact at `3b65bdc`, and the released tarball's own Windows cells are preview run 39146098592 @ `551402c`) | shape-only | Released tarball: preview run 39146098592 @ `551402c` installed the core 0.39.0 tarball (sha256 `1d5693241b8c…`) and its eight cells (L0, L0c, R1, R2, T1, N1, B1, D1) PASS, with a faux model and no vendor turn. The text that follows is the earlier feature-branch receipt (same addon sha256 `9837893521ec…`, not the release pack). Experimental, non-voting CI (not read by the release oracle): 2026-10-18, `.github/workflows/windows-native-preview.yml` run 39123555360 @ `3b65bdc`, with the required `ci.yml` four jobs green at the same SHA (run 39123555224). Build: MSVC (VS 2026, toolset v145, SDK 10.0.26100.0), two builds byte-identical (`entwurf_win.node` sha256 `9837893521ec…`), imports advapi32 + kernel32 with `node.exe` the only delay-load; node-gyp 13.1.0 and the Node headers/`node.lib` pinned. The pack carries exactly the addon and its manifest; npm installed it into a sandboxed consumer prefix; Pi came from a tarball checked against its pinned SRI. Six addon cells PASS (final-component reparse and non-regular refusals on the read handle, no connect through a symlink to a pipe, one-deadline timeout with reclaim, pipe-name stability and loader refusals). B1: two `pi --entwurf-control` citizens, one V3 record each, record-derived pipes alive through the product probe, `peer-facts` alive, graceful exit with both addresses dead afterwards. D1: A's model called `entwurf_v2` toward B's garden id with a nonce; A's receipt `control-socket → sent`, B's model context and B's transcript `entwurf-message` entry from A carry it. The model is an offline pi-ai `fauxProvider`: no vendor turn and no comprehension claim. The transcript fact is the harness's assertion; the raw transcript is not archived. The run used the elevated Administrators owner branch, so user-SID-only privacy is not measured. Pi's `peerDependencies` warning was observed, not waived. Not evidence for any other harness on Windows. |
 | native Windows: own pre-existing pipe-name birth refusal, record link/rename syscalls, descendant cleanup after a forced kill, cross-user, mixed elevation, remote callers, user-SID-only privacy, physical user machine | unverified | No receipt; the preview cells name these as unmeasured. |
+| Remote pair (#107): one declared pi-durable pair, Linux server ↔ Linux notebook over operator SSH (feature branch, not a release) | one LIVE exchange recorded (L4, one pair, one run) | 2026-10-20, both hosts at branch commit `e632294`; that commit's exact-SHA CI run 39202248407 was green on all four jobs. B's native `entwurf_v2` → one SSH → A `remote-pair-receive` → A mailbox enqueue `2026-10-19T22-19-47-662Z-13c897.msg`; A's one reply → B inbox read at `2026-10-19T22:20:24.837Z`, with the matching nonce `107-live-20261020T071937-B-A-6e42d1`. Before the send, the selected compiled bridge hash, the post-build bridge start and the record/owner/sender joins were checked on both hosts; the user reopened both visible sessions. Receipt: [#107](https://github.com/junghan0611/entwurf/issues/107#issuecomment-6278665895). |
+| Remote pair: OFF target, negative paths over real SSH, other rails, more than one pair, non-Linux hosts, GUI rendering of the received envelope | unverified | No receipt. The deterministic and installed cells (VERIFY) do not stand for these. |
 | native Windows: other harnesses, `setup` and the `.sh` bins, fresh/resume, mux/Herdr/ACP, ARM64, records over 16 MiB, reparse-backed store folders | UNSUPPORTED | Outside the preview's scope by decision; the preview loader refuses an install without the Windows addon by name. |
 
+### #147 candidate host boundary (2026-10-21; not a certification row)
+
+A checkout-started Pi wrote the new V3 `attachIncarnation` field while older hook/bridge
+readers still rejected it. The observed mixed-reader failures were rolled forward under a
+specific operator-approved repair, preserving the same garden/native identity; no manual
+record deletion, id rewrite, fresh-cut or old-shape rollback was used. Normal attach writes
+continued. Other installed native readers and the external Python mirror were identified as
+stale by source inspection; that is predicted impact, not a measured failure on every rail,
+and the complete G4 host rollout remains open. See [upgrade policy](./docs/fresh-cut-policy.md#upgrade-order).
+
+The candidate's internal Pi control `retire`, pidfd helper, request adapters and private
+injected dispatcher have source/fixture and candidate-local proof, not new native-host
+certification. Pi ACK is not exit/flush; CC fd-process exit is not conversation/children/flush.
+The current `>=2.1.306` floor and a historical B2 delivery receipt do not certify this
+lifecycle. A later CI green also cannot certify the operator's mixed-reader deployment.
+These two paragraphs are the 2026-10-21 state; the next section records what 2026-10-22 measured.
+
+### #147 Native round trip, 2026-10-22 (n=1)
+
+Not a certification row and not a release gate. One Linux host, source `a9c9459` (exact-SHA push
+CI green on its four required jobs), checkout compiled output rebuilt once under the dist lock
+after its previous bytes were preserved. The operator requested this bounded test-owned
+measurement; no working sibling was retired or restarted. Public record:
+[#147 checkpoint comment](https://github.com/junghan0611/entwurf/issues/147#issuecomment-6329217980).
+
+| Axis | Measured |
+|---|---|
+| caller | a fresh pi-durable citizen, identity from its exact nonce callback; its native store (read from an online read-only backup) offered all eight contact tools, the actual model was `openai-codex/gpt-6.1-sol`, and it made exactly four settled lifecycle calls — one retire and one resume per target |
+| ordinary Pi target | fresh, callback-identified. Retire returned `shutdown-requested`; separately, the original pane and control socket were gone, the record unchanged and the paired requested/outcome events present. Dormant `entwurf_v2` rejected. Resume returned separate LAUNCH and OBSERVATION; native session, `createdAt`, cwd and backend kept; transcript byte-identical across the promptless resume; a question omitting the answer recovered the pre-retirement fact |
+| native Claude Code target (CLI 2.1.307) | fresh, callback-identified, bound arm before retirement. Retire returned `exited`; separately, the last bound receiver owner was dead, the original pane gone, the record unchanged and the paired events present. Dormant delivery rejected as an undeliverable mailbox. Resume observed a NEW live owner with a new record-matched arm for the same native session and `createdAt`; transcript byte-identical across the promptless resume; blind recall succeeded |
+
+It does not show: conversation flush, descendant exit or model silence; the `>=2.1.306` floor
+itself (2.1.307 was the measured CLI); ACP-provider Pi, Herdr, pi-durable as a target, Windows or
+macOS; a release artifact; the `smoke-mux-lifecycle-live` MUST; or that any resident process
+reloaded new reader bytes.
+
+**G4 the same day (reader scope closed with Copilot runtime deferral; resident/runtime acceptance separate).** The five stale on-disk reader copies (Codex
+birth, OMP birth and receive, Copilot birth and receive) were preserved and rolled forward with
+their owning installers; their installed meta modules are byte-identical to the current source or
+compiled twin. Codex birth, both OMP units and Copilot receive passed install and doctor. Copilot
+birth passed install and doctor ownership but its doctor runtime axis is RED on a historical
+unrecovered hook error from 2026-10-14; that RED is retained, not cleared or counted as PASS.
+On 2026-10-22 GLG explicitly deferred Copilot Native runtime validation for this landing: Copilot
+is currently a free `auto` account, not a subscription, and GLG reports even a greeting taking over
+a minute to answer, making practical runtime validation unavailable. That latency is an operator
+report, not a benchmark re-measured here. No new Copilot model turn or log-clearing recovery was
+performed. This landing closes the on-disk reader/field-compatibility scope with that explicit
+Copilot runtime deferral; it does not certify Copilot runtime or resident-process reloads.
+The external Python mirror's nullable-field delta has a reviewed local checkpoint (not yet pushed),
+and its owner's one installed schema certification accepted 1,847 records with zero defects — field
+acceptance, not whole-parser equivalence. Resident processes remain unmeasured; broader runtime
+and release acceptance are not silently waived.
+
 Notes the table cannot carry without becoming prose again:
 
 - **shape-only is not a live proof.** The `artifact-consumer` job verifies a read-only
@@ -69,8 +124,8 @@ Notes the table cannot carry without becoming prose again:
 - **macOS evidence is split, not a support claim.** The Entwurf-only install surface is
   CERTIFIED (CI) (row above); the harness rails are NOT CERTIFIED — pending
   physical host (rental remains unscheduled). The package-level `os` field stays
-  unrestricted, and native Windows is an experimental preview (0.39.0 candidate, not
-  yet released; release and npm publication pending) with its own named gaps (rows above), not a supported platform.
+  unrestricted, and native Windows is an experimental preview (core 0.39.0) with its own
+  named gaps (rows above), not a supported platform.
 
 **Operator acceptance rule:** on a claimed Claude host, reinstall from the released
 artifact, restart every old Claude process, open a new session, and run the doctor
@@ -251,7 +306,7 @@ Per-question PASS / FAIL / NOTE for grading the model's response.
 ### Q-MCP — MCP enumerate
 - **PASS** — Exactly one: `entwurf-bridge`.
 - **FAIL** — Any second server appears, or `entwurf-bridge` missing.
-- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current server exposes eight tools, including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
+- **NOTE** — Codex naturally writes the name with underscores (`entwurf_bridge`); that is the agent-visible backend marker, not a mutation. The current bridge lists nine tools (since 0.41.0), including the manual `entwurf_register_native` fallback; MCP enumeration asks for the server name, not a stale tool count.
 
 ---