@junghanacs/entwurf 0.41.0 → 0.41.2

package/scripts/mutants/source-install.json

@@ -27,6 +27,72 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:SOURCE-OPERATOR-FAILS-LOUD]",
 			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-SAME-TARGET-PASSES",
+			"title": "the exclusivity check compares the unresolved entry path again, so a duplicate PATH entry or a second link to this very checkout reads as another root and blocks a correct developer install",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["        if os.path.lexists(path) and os.path.realpath(path) != target:"],
+			"replace": ["        if os.path.lexists(path) and os.path.abspath(path) != target:"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-SAME-TARGET-PASSES]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-LATER-ROOT-FAILS",
+			"title": "the exclusivity check reads only the head of PATH again, so an old global shim later in PATH stays selectable by a shell with another PATH order while setup reports a developer install",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["for d in os.environ.get(\"PATH\", \"\").split(\":\"):"],
+			"replace": ["for d in os.environ.get(\"PATH\", \"\").split(\":\")[:1]:"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-LATER-ROOT-FAILS]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-GLOBAL-BIN-OTHER-ROOT",
+			"title": "the package manager's reported global bin dir is queried but never searched, so another root there passes whenever that dir is absent from this PATH",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["        add(to_bin(value), label)\n"],
+			"replace": ["        pass\n"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-GLOBAL-BIN-OTHER-ROOT]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-GLOBAL-QUERY-REFUSED",
+			"title": "a package manager that fails or hangs is read as not installed again, so an uninspectable global bin dir yields a clean developer-install verdict",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["        errors.append(value)\n"],
+			"replace": ["        skipped.append(value)\n"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-GLOBAL-QUERY-REFUSED]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-EXCLUSIVE-WIRED",
+			"title": "source setup's bins step drops the exclusivity verdict again and returns its pre-repair success, so another selectable root is reported as a developer install",
+			"subject": "run.sh",
+			"find": ["  [ \"$rc\" -eq 0 ] && return \"$ex_rc\"\n"],
+			"replace": ["  [ \"$rc\" -eq 0 ] && return 0\n"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-EXCLUSIVE-WIRED]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "SOURCE-MANIFEST-UNREADABLE-REFUSED",
+			"title": "an unreadable or wrong-shaped package manifest is read as zero bin names again, so the exclusivity check finds no other root by checking nothing and source setup reports a developer install",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["    sys.exit(6)  # an unreadable manifest is never \"0 names, no other root\"\n"],
+			"replace": ["    bins = {}  # regressed: an unreadable manifest read as zero names\n"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SOURCE-MANIFEST-UNREADABLE-REFUSED]",
+			"signatureSource": "scripts/smoke-agy-install-state.sh"
 		}
 	]
 }

package/scripts/remote-pair-receive.ts

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 /**
- * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1).
+ * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1, #149).
  *
- * The receiving host's entry for one declared remote pair. The sending host runs it over one
+ * The receiving host's entry for its declared remote pairs. The sending host runs it over one
  * SSH call and writes one JSON claim to stdin. This entry reads the operator-named pair
- * declaration once, applies the pair scope check, and hands a matching claim to the existing
- * v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
+ * declaration once, selects the one route whose two ends are the claim's, and hands a matching
+ * claim to the existing v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
  *
  * Scope: `--pair` must name THIS host's own opt-in file (`remotePairOptInPath()`), absolute and
- * normalized-equal; any other path — even a valid declaration — is exit 2. That one file is the pair
- * this host accepts and, because it names the sender's host as its route, the declared route back.
+ * normalized-equal; any other path — even a valid declaration — is exit 2. That one file holds the
+ * pairs this host accepts and, because each route names the sender's host, the declared route back.
  * The sender's declaration carries the path only so the argv shape is explicit; it selects nothing.
  *
  * EXIT CONTRACT (stdout carries a JSON receipt line only where named):
@@ -47,7 +47,7 @@ if (args.length !== 2 || args[0] !== "--pair") {
 }
 const pairFile = args[1];
 
-let decl: RemotePairDeclaration;
+let decls: RemotePairDeclaration[];
 let claim: ReturnType<typeof parseRemoteClaim>;
 try {
 	// The scope is THIS host's own opt-in, never a file the sender picks: `--pair` must name it
@@ -56,17 +56,17 @@ try {
 	if (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {
 		throw new Error(`--pair must be this host's opt-in file ${own} (got ${pairFile})`);
 	}
-	const route = readRemotePairOptIn(own);
-	if (route === null) throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
-	decl = { remoteGardenId: route.remoteGardenId, ssh: route.ssh, localGardenId: route.localGardenId };
+	const optIn = readRemotePairOptIn(own);
+	if (optIn === null) throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
+	decls = optIn.routes.map((r) => ({ remoteGardenId: r.remoteGardenId, ssh: r.ssh, localGardenId: r.localGardenId }));
 	claim = parseRemoteClaim(readFileSync(0, "utf8"));
 } catch (err) {
 	emit({ kind: "invalid", detail: err instanceof Error ? err.message : String(err) }, 2);
 }
 
-const receipt = await receiveRemoteClaim(claim, decl, {
+const receipt = await receiveRemoteClaim(claim, decls, {
 	dispatch: (params, sender) => runAndRenderEntwurfV2FromSurface(params, { senderProvider: () => sender }),
-	// The scope file IS this host's own opt-in, and it names the sender's host as its route: a
+	// The scope file IS this host's own opt-in, and the matched route names the sender's host: a
 	// matching claim always has a declared route back. Declared, not probed.
 	replyRoute: "declared",
 });

package/scripts/smoke-agy-install-state.sh

@@ -461,6 +461,126 @@ export ENTWURF_AGY_STATUSLINE_TARGET="$SB/fake-status.sh"
 export ENTWURF_AGY_IMPRINT_TARGET="$SB/fake-aux.sh"
 export ENTWURF_COPILOT_STATUSLINE_TARGET="$SB/fake-aux.sh"
 
+# Hermetic PATH for every dev-bin cell: the host's own entwurf entrypoints (e.g. a real
+# ~/.local/bin/entwurf into some checkout) and its real pnpm/npm global bin dirs must not leak into
+# the exclusivity verdict. Drop every host PATH dir that carries a package bin name, and put fixture
+# package managers first; FAKE_PM_MODE picks their answer. Restored after the dev-bin cells.
+DEVBIN_ORIG_PATH="$PATH"
+PACKAGE_BINS="$(python3 -c 'import json,sys; print(" ".join(json.load(open(sys.argv[1]))["bin"]))' "$REPO_DIR/package.json")"
+HERMETIC_PATH=""
+IFS=':' read -r -a _dirs <<<"$PATH"
+for _d in "${_dirs[@]}"; do
+  [ -n "$_d" ] || continue
+  for _b in $PACKAGE_BINS; do { [ -e "$_d/$_b" ] || [ -L "$_d/$_b" ]; } && continue 2; done
+  HERMETIC_PATH="${HERMETIC_PATH:+$HERMETIC_PATH:}$_d"
+done
+unset _dirs _d _b
+FAKE_PM="$SB/fake-pm"; PM_ROOT="$SB/pm"; mkdir -p "$FAKE_PM"
+for _pm in pnpm npm; do
+  case "$_pm" in pnpm) _q="bin -g"; _a="$PM_ROOT/pnpm-bin" ;; npm) _q="prefix -g"; _a="$PM_ROOT/npm-prefix" ;; esac
+  cat > "$FAKE_PM/$_pm" <<SH
+#!/usr/bin/env bash
+[ "\$*" = "$_q" ] || { echo "fixture $_pm answers only: $_q" >&2; exit 64; }
+case "\${FAKE_PM_MODE:-ok}" in
+  ok) [ "$_pm" = npm ] || case ":\$PATH:" in *":$_a:"*) ;; *) echo "[ERROR] The configured global bin directory \"$_a\" is not in PATH" >&2; exit 1 ;; esac
+      echo "$_a" ;;
+  fail) echo "ERR_FIXTURE_$_pm boom" >&2; exit 1 ;;
+  hang) exec sleep 30 ;;
+esac
+SH
+  chmod +x "$FAKE_PM/$_pm"
+done
+unset _pm _q _a
+mkdir -p "$PM_ROOT/pnpm-bin"   # an existing, empty pnpm global bin dir
+export PATH="$FAKE_PM:$HERMETIC_PATH:$PM_ROOT/pnpm-bin"   # pnpm 11 answers `bin -g` only when that dir is on PATH
+want "dev-bin hermetic PATH: no package bin name resolves, and pnpm/npm are the fixtures" \
+  "! command -v entwurf >/dev/null && [ \"\$(command -v pnpm)\" = '$FAKE_PM/pnpm' ] && [ \"\$(command -v npm)\" = '$FAKE_PM/npm' ]"
+
+# J-X: developer-install exclusivity (dev-bin.sh exclusive). A certified PATH winner alone let an
+# old global shim LATER in PATH stay selectable by a shell with another PATH order (non-interactive
+# SSH picked it). Every cell links by NAME so an operator-set mutant elsewhere cannot reach here.
+bash "$DEVBIN" expose entwurf >/dev/null 2>&1
+bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1
+SAME_DIR="$SB/same-root"; mkdir -p "$SAME_DIR"
+ln -s "$SB/fake-entwurf.sh" "$SAME_DIR/entwurf"   # a second link, same target
+ln -s "$DLINK" "$SAME_DIR/entwurf-bridge"         # a chain through our link, same target
+set +e; OUT="$(PATH="$DBIN_DIR:$DBIN_DIR:$SAME_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: duplicate PATH entries and links resolving to our target are the same install [QK:SOURCE-SAME-TARGET-PASSES]" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'no other root under the 6 package bin names'"
+want "dev-bin exclusive: an existing-but-empty package-manager global bin is checked and clean, and the PASS names its limit" \
+  "printf '%s' \"\$OUT\" | grep -q 'pnpm global bin $PM_ROOT/pnpm-bin' && printf '%s' \"\$OUT\" | grep -q 'another shell.s PATH or another package manager is not covered'"
+TOOLS_ONLY="$SB/tools-only"; mkdir -p "$TOOLS_ONLY"
+for _t in bash python3 dirname env; do ln -s "$(command -v "$_t")" "$TOOLS_ONLY/$_t"; done; unset _t
+set +e; OUT="$(PATH="$TOOLS_ONLY:$DBIN_DIR" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an absent package manager is a named not-checked line, not a failure" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'not checked: pnpm not on PATH' && printf '%s' \"\$OUT\" | grep -q 'not checked: npm not on PATH'"
+rm -rf "$SAME_DIR"
+
+OTHER_DIR="$SB/old-global/bin"; mkdir -p "$OTHER_DIR"
+printf '#!/bin/sh\nexec /old/global/entwurf "$@"\n' > "$OTHER_DIR/entwurf"; chmod +x "$OTHER_DIR/entwurf"
+want "dev-bin control: with an old shim LATER in PATH the winner is still ours, so verify alone passes" \
+  "PATH='$DBIN_DIR:$OTHER_DIR':\"\$PATH\" bash '$DEVBIN' verify entwurf >/dev/null 2>&1"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an old root LATER in PATH is named and refused, not hidden behind our winner [QK:SOURCE-LATER-ROOT-FAILS]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF 'another entwurf root is still selectable: $OTHER_DIR/entwurf'"
+want "dev-bin exclusive: the refusal removes nothing and says so" \
+  "[ \"\$(sed -n 2p '$OTHER_DIR/entwurf')\" = 'exec /old/global/entwurf \"\$@\"' ] && [ -L '$OLINK' ] && printf '%s' \"\$OUT\" | grep -q 'nothing was removed'"
+mkdir -p "$SB/other-checkout/mcp/entwurf-bridge"; printf '#!/bin/sh\n' > "$SB/other-checkout/mcp/entwurf-bridge/start.sh"
+rm -f "$OTHER_DIR/entwurf"; ln -s "$SB/other-checkout/mcp/entwurf-bridge/start.sh" "$OTHER_DIR/entwurf-bridge"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a helper name from another checkout is refused like the operator" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF '$OTHER_DIR/entwurf-bridge -> $SB/other-checkout/mcp/entwurf-bridge/start.sh'"
+rm -rf "$SB/old-global"
+
+mkdir -p "$PM_ROOT/npm-prefix/bin"; printf '#!/bin/sh\n' > "$SB/other-checkout/run.sh"
+ln -s "$SB/other-checkout/run.sh" "$PM_ROOT/npm-prefix/bin/entwurf"   # npm's <prefix>/bin, OFF this PATH
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: another root in npm's global bin dir is refused although that dir is not on this PATH [QK:SOURCE-GLOBAL-BIN-OTHER-ROOT]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF '$PM_ROOT/npm-prefix/bin/entwurf -> $SB/other-checkout/run.sh' && printf '%s' \"\$OUT\" | grep -qx '  seen via: npm global bin'"
+want "dev-bin exclusive: the removal hint is conditional on the package manager, never asserted" \
+  "printf '%s' \"\$OUT\" | grep -qF 'if a global @junghanacs/entwurf installed it: npm uninstall -g @junghanacs/entwurf' && printf '%s' \"\$OUT\" | grep -q 'otherwise remove it through whoever owns it'"
+rm -rf "$PM_ROOT/npm-prefix"
+
+set +e; OUT="$(FAKE_PM_MODE=fail PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a package manager that cannot answer is refused, not read as clean [QK:SOURCE-GLOBAL-QUERY-REFUSED]" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect a package manager — \`pnpm bin -g\` exited 1: ERR_FIXTURE_pnpm boom'"
+set +e; OUT="$(FAKE_PM_MODE=hang ENTWURF_DEV_BIN_PM_TIMEOUT=1 PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a package manager that hangs is bounded and refused" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -q 'did not answer within 1s'"
+set +e; OUT="$(PATH="$DBIN_DIR:$FAKE_PM:$HERMETIC_PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: pnpm refusing because its global bin dir is off PATH is an inspect failure, not a clean dir" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'is not in PATH'"
+
+# The package manifest is read by the verdict step itself: an unreadable or wrong-shaped one is an
+# inspect failure, never "0 names, no other root". Driven on a copy of THIS dev-bin.sh beside a
+# sandbox package.json, so the repo's own manifest is never touched.
+MANI="$SB/manifest-copy"; mkdir -p "$MANI/scripts"; cp "$DEVBIN" "$MANI/scripts/dev-bin.sh"
+cp "$REPO_DIR/package.json" "$MANI/package.json"
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive control: the copied script with the real manifest checks all 6 names and passes" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'no other root under the 6 package bin names'"
+printf 'not json{' > "$MANI/package.json"
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an unreadable package manifest is refused, never read as zero names [QK:SOURCE-MANIFEST-UNREADABLE-REFUSED]" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect the package manifest $MANI/package.json' && ! printf '%s' \"\$OUT\" | grep -q '0 package bin names'"
+for _shape in '{"name":"x"}' '{"bin":"./run.sh"}' '{"bin":{}}' '{"bin":{"entwurf-bridge":"./x"}}'; do
+  printf '%s' "$_shape" > "$MANI/package.json"
+  set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+  want "dev-bin exclusive: manifest $_shape is refused as uninspectable" \
+    "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect the package manifest'"
+done
+unset _shape; rm -rf "$MANI"
+
+OTHER_DIR="$SB/old-global/bin"; mkdir -p "$OTHER_DIR"
+printf '#!/bin/sh\nexec /old/global/entwurf "$@"\n' > "$OTHER_DIR/entwurf"; chmod +x "$OTHER_DIR/entwurf"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "source setup's bins step fails when another root is still selectable [QK:SOURCE-EXCLUSIVE-WIRED]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF 'another entwurf root is still selectable: $OTHER_DIR/entwurf'"
+rm -rf "$SB/old-global" "$SB/other-checkout" "$TOOLS_ONLY"
+bash "$DEVBIN" remove >/dev/null 2>&1   # the helper links expose-dev-bin just made
+bash "$DEVBIN" remove entwurf >/dev/null 2>&1         # by NAME, like the expose above: the
+bash "$DEVBIN" remove entwurf-bridge >/dev/null 2>&1  # managed list itself may be under test
+
 # J-0: the setup wrapper calls no-arg expose. This is the cross-contract cell the #82 regression
 # lacked: an npm consumer gets `entwurf` from package bin linking, and source setup must expose the
 # same operator command without a second global package install.
@@ -578,6 +698,7 @@ ok "dev-bin migrate: foreign legacy refused (linkPath basename != entwurf-bridge
 rm -f "$LEGACY" "$DLINK" "$DSTATE"
 bash "$DEVBIN" remove >/dev/null 2>&1
 unset ENTWURF_DEV_BIN_DIR ENTWURF_OPERATOR_TARGET ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
+export PATH="$DEVBIN_ORIG_PATH"
 unset ENTWURF_AGY_IMPRINT_TARGET ENTWURF_COPILOT_STATUSLINE_TARGET
 
 # ── K: permission grant — the OTHER half of a usable bridge ───────────────────

package/scripts/smoke-agy-native-push-live.ts

@@ -48,6 +48,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { SenderEnvelope } from "../pi-extensions/lib/entwurf-control-rpc.ts";
+import { nativePushPaused } from "../pi-extensions/lib/entwurf-v2-contract.ts";
 import { makeProductionEntwurfV2Deps } from "../pi-extensions/lib/entwurf-v2-production.ts";
 import type { EntwurfV2RunResult } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
@@ -79,6 +80,18 @@ function smokeSender(gardenId: string, cwd: string): SenderEnvelope {
 }
 
 async function main(): Promise<void> {
+	// #152: agy native-push is PAUSED by product policy, so this positive LIVE acceptance cannot
+	// run — every cell below would drive the paused rail. It exits NON-ZERO by name (neither a PASS
+	// nor the protocol SKIP), and touches no agy process, port or conversation. The pause itself is
+	// proven deterministically beside the behavior (pi-extensions/lib/native-push/paused.test.ts).
+	if (nativePushPaused("antigravity")) {
+		console.error(
+			"[entwurf:paused] smoke-agy-native-push-live — agy native-push is paused (#152: its language " +
+				"server refused entwurf's measured external calls for a missing CSRF token). This LIVE acceptance does not run while " +
+				"the pause holds; it is not a PASS.",
+		);
+		process.exit(2);
+	}
 	if (process.env.LIVE !== "1") {
 		skipLive(
 			"smoke-agy-native-push-live",

package/scripts/smoke-codex-fresh-live.ts

@@ -75,12 +75,14 @@ import {
 } from "../pi-extensions/lib/native-push/codex-ws-client.ts";
 import {
 	buildCodexInstruction,
+	buildInitialPiBootstrapTask,
 	buildInitialPiPhaseOne,
 	buildInitialPiRelay,
 	runCleanupStages,
 	selectReport,
 } from "./lib/codex-fresh-live-protocol.ts";
 import {
+	assertBootstrapOrder,
 	assertExactSourceToolCalls,
 	assertSourceCallScopes,
 	codexCallbackSenders,
@@ -978,11 +980,7 @@ async function run(): Promise<void> {
 		backend: "pi",
 		model: piModel,
 		cwd: scratch,
-		task:
-			"Session-info already supplies device and time. Do not recheck time, cwd, or identity with shell or other tools. " +
-			"Your FIRST tool call must be mcp__entwurf_bridge__entwurf_callback with no arguments, and nothing before it. " +
-			`After your required callback receipt, end the turn and wait passively for one addressed message containing ${initialPiWaitToken}. ` +
-			"That message is the only authority to open the Codex sibling. Do not call shell, sleep, terminal, or any tool to wait.",
+		task: buildInitialPiBootstrapTask(initialPiWaitToken),
 	});
 	receipts["2-initial-pi-launch"] = initialPiLaunch.text;
 	ok(
@@ -1082,7 +1080,8 @@ async function run(): Promise<void> {
 	const codexWaitToken = `CODEX-WAIT-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	const finalToken = `CODEX-PI-FINAL-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	expectedReportTokens.push(finalToken);
-	const outboundPiTask = "After your automatic callback succeeds, answer ACK and stop. Do not open another sibling.";
+	const outboundPiTask =
+		"Your automatic callback is the whole task and there is no result to send. After it succeeds, end the turn: no message, no report, no further tool call. Do not open another sibling.";
 	const codexTask =
 		`After your required callback receipt, end the turn and wait passively for the addressed instruction containing ${codexWaitToken}. ` +
 		"Do not call shell, sleep, terminal, or any tool to wait.";
@@ -1439,25 +1438,33 @@ async function run(): Promise<void> {
 		const observed = await readCodexThread(codexSocketPath, codexThreadId, true);
 		return codexThreadIsTerminal(observed) ? observed : null;
 	});
+	// THE BOOTSTRAP ORDER, THEN THE ROLES — two leaves, composed. `[GLG 직접, 2026-10-24]` a fresh
+	// sibling may check its caller with the read-only listing the framing offers, then calls back,
+	// then works. `assertBootstrapOrder` admits only that prefix (successful exact `entwurf_peers`
+	// checks), requires the exact callback once and successfully, and hands the rest to the
+	// unchanged exact-once role audit — so `bash true` before the callback (the r3 RED) is still
+	// refused, by the order leaf now rather than by a count. On Pi the receipts carry transcript
+	// ordinals, so this also proves every peers RESULT was recorded before the callback was called,
+	// and the callback RESULT before every task call.
+	//
+	// The callback is the ZERO-ARGUMENT eighth verb and `{}` is compared byte-exactly: a target, a
+	// message or a `wants_reply` typed here is a parameter the verb does not have. Nothing is
+	// weakened by the nonce not being in THIS expectation: the correlation is proven earlier and from
+	// the delivered body — `the initial Pi callback carries the exact launch nonce` reads the
+	// fixture's own mailbox, requires exactly one exact match and refuses duplicates, and the two
+	// cells beside it bind that callback's sender envelope to a real pi V3 citizen.
+	const initialPiSources = piSourceToolReceipts(readInitialPiEntries());
+	const initialPiTaskCalls = assertBootstrapOrder(
+		initialPiSources,
+		// The guided task asked this Pi to take the offered check, so a zero-check PASS is not positive evidence.
+		{ peersArguments: {}, callback: { toolName: "entwurf_callback", arguments: {} }, minPeersPrefix: 1 },
+		"initial Pi bootstrap order",
+	);
+	// The verified prefix count: the order leaf admitted exactly these many leading peers checks.
+	const piPeersPrefix = initialPiSources.length - initialPiTaskCalls.length - 1;
 	assertExactSourceToolCalls(
-		piSourceToolReceipts(readInitialPiEntries()),
+		initialPiTaskCalls,
 		[
-			// 0.24.0 moved a pi sibling's first action to the ZERO-ARGUMENT eighth verb, and this
-			// smoke's own launch receipt says so in the same run: "its first action is the
-			// zero-argument callback verb (codex is the one arm that still sends the nonce as
-			// arguments)". The Codex audit below therefore keeps its `entwurf_v2` shape, and only
-			// this one moves. `{}` is matched by deep-strict equality, so it pins the verb's actual
-			// contract — a target or message typed here would be a second address axis and the verb
-			// refuses it by name.
-			//
-			// Nothing is weakened by dropping the nonce from THIS expectation: the correlation is
-			// proven earlier and from the delivered body, which is where a nonce can actually be
-			// corrupted — `the initial Pi callback carries the exact launch nonce` (:970-973) reads
-			// the fixture's own mailbox, requires exactly one exact match and refuses duplicates,
-			// and the two cells beside it bind that callback's sender envelope to a real pi V3
-			// citizen. This audit's job is the different one its name says: exactly these calls,
-			// once each, and nothing else.
-			{ toolName: "entwurf_callback", arguments: {} },
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: {
@@ -1479,10 +1486,18 @@ async function run(): Promise<void> {
 		],
 		"initial Pi final exact-once audit",
 	);
-	assertExactSourceToolCalls(
-		codexSourceToolReceipts(codexThread),
-		[
-			{
+	// Codex: the same composition over the Entwurf MCP calls `thread/read` reports (this smoke's
+	// Codex scope — no vendor-native action taxonomy). Its callback is `entwurf_v2` to the initial Pi
+	// with the nonce, so `wants_reply` keeps its schema default there. `thread/read` gives item order
+	// and a status at audit time only: on Codex this proves CALL ORDER and completion-at-audit; that a
+	// peers result preceded the callback call, and that the callback result preceded the next call,
+	// are both UNVERIFIED.
+	const codexFinalSources = codexSourceToolReceipts(codexThread);
+	const codexTaskCalls = assertBootstrapOrder(
+		codexFinalSources,
+		{
+			peersArguments: {},
+			callback: {
 				toolName: "entwurf_v2",
 				arguments: {
 					target: initialPiGid,
@@ -1491,6 +1506,13 @@ async function run(): Promise<void> {
 					message: codexNonce,
 				},
 			},
+		},
+		"Codex bootstrap order",
+	);
+	const codexPeersPrefix = codexFinalSources.length - codexTaskCalls.length - 1;
+	assertExactSourceToolCalls(
+		codexTaskCalls,
+		[
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: { backend: "pi", model: piModel, task: outboundPiTask },
@@ -1507,7 +1529,9 @@ async function run(): Promise<void> {
 		],
 		"Codex final exact-once audit",
 	);
-	receipts["16-source-final-audit"] = "initial-pi=3/3 completed exact\ncodex=3/3 completed exact";
+	receipts["16-source-final-audit"] =
+		`initial-pi=bootstrap order (peers prefix=${piPeersPrefix} → callback, results-before-next-call by transcript ordinal) + 2/2 task roles exact\n` +
+		`codex=bootstrap order (peers prefix=${codexPeersPrefix} → callback, call order only) + 2/2 task roles exact`;
 }
 
 let failure: unknown = null;

package/scripts/smoke-entwurf-chain-live.ts

@@ -64,6 +64,7 @@ import {
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { awaitTerminusPublication } from "./lib/chain-terminus-publication.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -390,14 +391,11 @@ async function main(): Promise<void> {
 
 		// ── the chain runs on its own from here; wait for the terminus ───────────
 		const boxDir = path.join(mailboxDir, gidD);
-		const until = Date.now() + CHAIN_TIMEOUT_MS;
-		let msgs: string[] = [];
-		while (Date.now() < until) {
-			msgs = (await fsp.readdir(boxDir).catch(() => [] as string[])).filter(
-				(f) => f.endsWith(".msg") || f.endsWith(".msg.delivered"),
-			);
-			if (msgs.length > 0) break;
-			await sleep(POLL_MS);
+		// Body AND doorbell, inside the same deadline: enqueue publishes `.msg` first and
+		// `inbox.signal` last, so a body alone is a publication still in flight (P5 2026-10-24).
+		const { msgs, signalled } = await awaitTerminusPublication(boxDir, Date.now() + CHAIN_TIMEOUT_MS, POLL_MS);
+		if (msgs.length > 0 && !signalled) {
+			console.error(`[smoke-entwurf-chain-live] terminus at timeout: ${msgs.length} body file(s) but no inbox.signal`);
 		}
 		if (msgs.length === 0) {
 			let ownerAlive = false;
@@ -423,7 +421,7 @@ async function main(): Promise<void> {
 			console.error(`[smoke-entwurf-chain-live] C stream tail:\n${streamC.slice(-2000)}`);
 		}
 		ok(`the chain reached the mailbox terminus (${msgs.length} .msg)`, msgs.length === 1);
-		ok("the terminus doorbell was poked", existsSync(path.join(boxDir, "inbox.signal")));
+		ok("the terminus doorbell was poked", signalled);
 
 		const body = await fsp.readFile(path.join(boxDir, msgs[0] as string), "utf8");
 

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -45,7 +45,7 @@
  *                fenced `XDG_CACHE_HOME`, joined to a session by its EXACT `sessionId` — plus
  *                entwurf's own mailbox artifact and hook journal. It proves the public call, the
  *                identity join, the delivered callback, the caller's continuation, the child's
- *                FIRST action, and the codex named reject. It does NOT prove the receipt text or
+ *                callback before any work (a read-only check may precede it), and the codex named reject. It does NOT prove the receipt text or
  *                the final answer content: those have no source artifact on this axis and are
  *                left to GLG's manual validation rather than substituted with a screen read.
  *
@@ -853,7 +853,7 @@ async function main(): Promise<void> {
 				);
 			}
 
-			// ── the child's FIRST action was the callback ───────────────────────────────
+			// ── the child called back before its work ───────────────────────────────────
 			const childNative = String(joined?.nativeSessionId ?? childRow?.sessionValue ?? "");
 			if (cell.childKind === "pi") {
 				const childRecords = transcriptRecords(String(childRow?.sessionValue ?? ""));
@@ -901,8 +901,8 @@ async function main(): Promise<void> {
 				// BOTH. `[측정 2026-09-17, oracle, LIVE]` this cell used to require `order[0] ===
 				// "entwurf_v2"`, and a Sonnet 5 child failed it by calling `entwurf_peers` first and
 				// the callback second. That is not a violation: the framing this rail now sends
-				// OFFERS exactly that corroboration ("you can corroborate the caller first if you
-				// want to"), so the old oracle contradicted our own prompt and would have forbidden
+				// OFFERS exactly that corroboration ("you may corroborate the caller before that
+				// call"), so the old oracle contradicted our own prompt and would have forbidden
 				// the behaviour we asked for. What still must hold is everything the claim was
 				// actually about — the callback lands before any work, it completes, and neither the
 				// callback verb nor the delivery verb failed or timed out anywhere in the log.