@junghanacs/entwurf 0.41.1 → 0.41.2

package/scripts/lib/codex-fresh-source-receipts.ts

@@ -9,6 +9,11 @@ export interface SourceToolReceipt {
 	text: string;
 	status: SourceToolStatus;
 	isError: boolean;
+	/** Pi only: the transcript row index of this call's assistant message. Rows are appended in
+	 * order, so this is a source fact about WHEN the call was recorded. Codex leaves it unset. */
+	callOrdinal?: number;
+	/** Pi only: the transcript row index of this call's toolResult. Unset while pending and on Codex. */
+	resultOrdinal?: number;
 }
 
 export interface ExpectedSourceToolCall {
@@ -104,6 +109,107 @@ export function assertExactSourceToolCalls(
 	if (remaining.length > 0) throw new Error(`${label}: missing source calls ${JSON.stringify(remaining)}`);
 }
 
+/** The callback a fresh sibling makes before its task, and the one read-only check it may make first. */
+export interface BootstrapOrderExpectation {
+	/** Exact arguments of the read-only `entwurf_peers` check the framing offers before the callback. */
+	peersArguments: Record<string, unknown>;
+	/** The callback role: zero-argument `entwurf_callback`, or Codex's `entwurf_v2` to the caller. */
+	callback: ExpectedSourceToolCall;
+	/** A GUIDED launch that asked for the check requires at least this many peers checks. Absent = 0:
+	 * the check is optional everywhere else, and a fixture's guided task is not a product rule. */
+	minPeersPrefix?: number;
+}
+
+/**
+ * Bootstrap arguments: `entwurf_v2` keeps its schema default (absent `wants_reply` IS false — see
+ * `normalizeSourceArguments`), because Codex's callback IS that verb and a model that omits the key
+ * has obeyed it. Every other verb compared here is byte-exact: `entwurf_callback` is ZERO-argument,
+ * so `{ wants_reply: false }` is a model supplying a parameter the verb does not have, and the peers
+ * check is held to the exact call the framing offers.
+ */
+function bootstrapArgumentsMatch(toolName: string, expected: Record<string, unknown>, actual: Record<string, unknown>) {
+	return toolName === "entwurf_v2" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);
+}
+
+/**
+ * The bootstrap order of one fresh sibling, judged on its source receipts IN CALL ORDER:
+ * zero or more successful exact `entwurf_peers` checks, then exactly one successful exact callback,
+ * then the rest — which is returned for the existing exact-once role audit. `[GLG 직접, 2026-10-24]`
+ * checking the caller and then calling back is the right order; nothing else may come first.
+ *
+ * Refused: any other call before the callback (a `bash true`, a task role), a peers check with other
+ * arguments or that did not succeed, a missing / pending / failed callback, a callback with drifted
+ * arguments, a peers check or a second exact callback AFTER the callback, and — where the source
+ * records it — a callback CALLED before a peers check's RESULT was recorded, or a later call recorded
+ * before the callback's RESULT.
+ *
+ * WHAT THE ORDER PROVES DEPENDS ON THE SOURCE. Pi rows carry `callOrdinal`/`resultOrdinal`, so on Pi
+ * this proves every peers result was recorded before the callback was called, and the callback's
+ * result before every later call. Codex `thread/read` gives item order and a status read at audit
+ * time, nothing more, so on Codex this proves CALL ORDER and completion-at-audit only; that a peers
+ * result preceded the callback call, and that the callback result preceded the next call, are both
+ * UNVERIFIED there.
+ * The peers check is never filtered out by position: it is admitted only as a prefix.
+ *
+ * SCOPE. This is the audit's condition for the short fixture tasks that call it ("use no other tool
+ * before the callback"), not a universal list of what a fresh sibling may do; a sibling whose own
+ * check does not hold up may also hold the callback, which these fixtures then see as no callback.
+ */
+export function assertBootstrapOrder(
+	receipts: readonly SourceToolReceipt[],
+	expected: BootstrapOrderExpectation,
+	label: string,
+): SourceToolReceipt[] {
+	let at = 0;
+	for (; at < receipts.length && receipts[at]?.toolName === "entwurf_peers"; at++) {
+		const check = receipts[at] as SourceToolReceipt;
+		if (!isDeepStrictEqual(check.arguments, expected.peersArguments))
+			throw new Error(
+				`${label}: pre-callback entwurf_peers arguments differ\nexpected=${JSON.stringify(expected.peersArguments)}\nactual=${JSON.stringify(check.arguments)}`,
+			);
+		if (check.status !== "completed" || check.isError)
+			throw new Error(`${label}: pre-callback entwurf_peers ${check.isError ? "failed" : check.status}`);
+	}
+	const callback = receipts[at];
+	if (callback === undefined) throw new Error(`${label}: no callback after ${at} pre-callback check(s)`);
+	const minPeers = expected.minPeersPrefix ?? 0;
+	if (at < minPeers)
+		throw new Error(`${label}: the guided caller check was not made (peers prefix=${at}, required ≥ ${minPeers})`);
+	const role = expected.callback;
+	if (
+		callback.toolName !== role.toolName ||
+		!bootstrapArgumentsMatch(role.toolName, role.arguments, callback.arguments)
+	)
+		throw new Error(
+			`${label}: unexpected pre-callback call ${callback.toolName} ${JSON.stringify(callback.arguments)} — only the read-only entwurf_peers check may precede ${role.toolName} ${JSON.stringify(role.arguments)}`,
+		);
+	if (callback.status !== "completed" || callback.isError)
+		throw new Error(`${label}: the callback ${callback.isError ? "failed" : `remained ${callback.status}`}`);
+	// A check is a check only if its answer was in hand before the callback was made.
+	for (const check of receipts.slice(0, at)) {
+		if (
+			check.resultOrdinal !== undefined &&
+			callback.callOrdinal !== undefined &&
+			!(check.resultOrdinal < callback.callOrdinal)
+		)
+			throw new Error(`${label}: ${callback.toolName} was called before the entwurf_peers result was recorded`);
+	}
+	const rest = receipts.slice(at + 1);
+	for (const later of rest) {
+		if (later.toolName === "entwurf_peers")
+			throw new Error(`${label}: entwurf_peers after the callback — the check is offered only before it`);
+		if (later.toolName === role.toolName && bootstrapArgumentsMatch(role.toolName, role.arguments, later.arguments))
+			throw new Error(`${label}: duplicate callback ${later.toolName}`);
+		if (
+			callback.resultOrdinal !== undefined &&
+			later.callOrdinal !== undefined &&
+			later.callOrdinal < callback.resultOrdinal
+		)
+			throw new Error(`${label}: ${later.toolName} was called before the callback result was recorded`);
+	}
+	return rest;
+}
+
 /** The only production leaf that turns joined source receipts into cleanup window authority. */
 export function sourceCleanupWindows(receipts: readonly SourceToolReceipt[]): string[] {
 	const windows: string[] = [];
@@ -199,9 +305,9 @@ function piSourceVerb(nativeName: string): string {
 /** Join Pi's own toolCall and toolResult rows by native id, retaining pending calls.
  * Native-name equality is checked before translating the exact current Pi dialect. */
 export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolReceipt[] {
-	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown> }>();
-	const results = new Map<string, { toolName: string; text: string; isError: boolean }>();
-	for (const raw of entries) {
+	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown>; callOrdinal: number }>();
+	const results = new Map<string, { toolName: string; text: string; isError: boolean; resultOrdinal: number }>();
+	for (const [ordinal, raw] of entries.entries()) {
 		if (typeof raw !== "object" || raw === null) continue;
 		const entry = raw as { type?: unknown; message?: unknown };
 		if (entry.type !== "message" || typeof entry.message !== "object" || entry.message === null) continue;
@@ -229,6 +335,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				calls.set(block.id, {
 					toolName: block.name,
 					arguments: block.arguments as Record<string, unknown>,
+					callOrdinal: ordinal,
 				});
 			}
 		}
@@ -242,6 +349,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				toolName: message.toolName,
 				text: textContent(message.content),
 				isError: message.isError,
+				resultOrdinal: ordinal,
 			});
 		}
 	}
@@ -263,6 +371,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 			text: result.text,
 			status: result.isError ? "failed" : "completed",
 			isError: result.isError,
+			resultOrdinal: result.resultOrdinal,
 		});
 	}
 	return joined;

package/scripts/lib/pi-durable-fresh-live-receipts.ts

@@ -11,8 +11,12 @@
  * its entry kinds — `pi.system` (tool offering, applied as toolsAdded/toolsRemoved in order),
  * `pi.assistant` (the model that answered, and the tool calls in order) and `pi.tool-result` (each
  * call's settled result, joined by toolCallId).
+ *
+ * Each call also carries the native ENTRY ids of its call and of its result (`callOrdinal` /
+ * `resultOrdinal`). Entries are read in id order, so the ids order what the store recorded — the same
+ * fact Pi's transcript row index gives the bootstrap-order leaf (`assertBootstrapOrder`).
  */
-import { piCallbackSenders } from "./codex-fresh-source-receipts.ts";
+import { piCallbackSenders, type SourceToolReceipt } from "./codex-fresh-source-receipts.ts";
 
 /** The one Pi transcript row whose exact payload arrived from `expectedSender`, or null. */
 export function piExactDeliveryRow(
@@ -43,6 +47,10 @@ export interface PdToolCall {
 	name: string;
 	arguments: Record<string, unknown>;
 	result: { text: string; isError: boolean } | null;
+	/** Native entry id of the assistant row that made this call. */
+	callOrdinal: number;
+	/** Native entry id of the tool-result row joined to it, or null while none is recorded. */
+	resultOrdinal: number | null;
 }
 export interface PdRootView {
 	offering: string[];
@@ -98,6 +106,8 @@ export function pdRootView(entries: readonly PdNativeRow[], rootConversationId:
 						name: b.name,
 						arguments: (b.arguments ?? {}) as Record<string, unknown>,
 						result: null,
+						callOrdinal: row.id,
+						resultOrdinal: null,
 					};
 					calls.push(call);
 					byId.set(b.id, call);
@@ -115,12 +125,30 @@ export function pdRootView(entries: readonly PdNativeRow[], rootConversationId:
 					)
 					.join("");
 				call.result = { text, isError: message.isError === true };
+				call.resultOrdinal = row.id;
 			}
 		}
 	}
 	return { offering, models: [...models], calls };
 }
 
+/**
+ * The root calls as source receipts, in call order, for the bootstrap-order leaf: a call with no joined
+ * result is PENDING, an errored result is FAILED. pd's verbs are its own bare tool names, so no
+ * dialect translation happens here.
+ */
+export function pdSourceToolReceipts(calls: readonly PdToolCall[]): SourceToolReceipt[] {
+	return calls.map((call) => ({
+		toolName: call.name,
+		arguments: call.arguments,
+		text: call.result?.text ?? "",
+		status: call.result === null ? "pending" : call.result.isError ? "failed" : "completed",
+		isError: call.result?.isError ?? false,
+		callOrdinal: call.callOrdinal,
+		...(call.resultOrdinal === null ? {} : { resultOrdinal: call.resultOrdinal }),
+	}));
+}
+
 /** The doorbell submission for exactly this mailbox message, on the root conversation. */
 export function pdDoorbellSubmission(
 	submissions: readonly PdNativeSubmissionRow[],

package/scripts/mutants/chain-terminus-publication.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "chain-terminus-publication",
+	"mutants": [
+		{
+			"claim": "CHAIN-TERMINUS-WAITS-FOR-SIGNAL",
+			"title": "the terminus wait stops at the first body again, so smoke-entwurf-chain-live checks the doorbell while enqueueMetaMessage is still between its .msg write and its inbox.signal write and reports a false RED",
+			"subject": "scripts/lib/chain-terminus-publication.ts",
+			"find": ["\t\tif (msgs.length > 0 && signalled) break;"],
+			"replace": ["\t\tif (msgs.length > 0) break;"],
+			"gate": ["bash", "run.sh", "check-chain-terminus-publication"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:CHAIN-TERMINUS-WAITS-FOR-SIGNAL]",
+			"signatureSource": "test/chain-terminus-publication.test.ts"
+		}
+	]
+}

package/scripts/mutants/codex-native.json

@@ -1066,6 +1066,104 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:CODEX-SOCKET-LISTEN-ROW-ONLY]",
 			"signatureSource": "test/codex-socket-listener.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PEERS-PREFIX-THEN-EXACT-CALLBACK",
+			"title": "the bootstrap ORDER removed: everything before the first callback is skipped instead of only an exact peers check, so `bash true → callback → task` — the r3 RED — passes again, and a task call made before the callback is no longer refused",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tfor (; at < receipts.length && receipts[at]?.toolName === \"entwurf_peers\"; at++) {"],
+			"replace": [
+				"\tfor (; at < receipts.length && receipts[at]?.toolName !== expected.callback.toolName; at++) {\n\t\tif (receipts[at]?.toolName !== \"entwurf_peers\") continue;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PEERS-PREFIX-THEN-EXACT-CALLBACK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PEERS-ONLY-AS-PREFIX",
+			"title": "the peers check filtered out wherever it appears instead of admitted only as a prefix — a check after the callback disappears from the audit, which is the position-independent filter the contract forbids",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tconst rest = receipts.slice(at + 1);"],
+			"replace": ["\tconst rest = receipts.slice(at + 1).filter((r) => r.toolName !== \"entwurf_peers\");"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PEERS-ONLY-AS-PREFIX]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-ZERO-ARG-CALLBACK-STRICT",
+			"title": "the v2 wants_reply default stretched over the zero-argument callback: `entwurf_callback {wants_reply:false}` reads as `{}`, so a model supplying a parameter the verb does not have passes as the exact callback",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": [
+				"\treturn toolName === \"entwurf_v2\" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);"
+			],
+			"replace": ["\treturn sourceArgumentsMatch(expected, actual);"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-ZERO-ARG-CALLBACK-STRICT]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-CODEX-V2-CALLBACK-DEFAULT",
+			"title": "deep-strict comparison forced onto Codex's entwurf_v2 callback too — a Codex callback that omits wants_reply (schema default false) is refused, resurrecting the 2026-09-16 default-false RED",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": [
+				"\treturn toolName === \"entwurf_v2\" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);"
+			],
+			"replace": ["\treturn isDeepStrictEqual(expected, actual);"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-CODEX-V2-CALLBACK-DEFAULT]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PI-RESULT-BEFORE-TASK-CALL",
+			"title": "the Pi result-ordinal check dropped: a task call made in the same assistant row as the callback — before the callback result existed — passes on call order alone",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\t\t\tcallback.resultOrdinal !== undefined &&"],
+			"replace": ["\t\t\tfalse &&"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PI-RESULT-BEFORE-TASK-CALL]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "CODEX-LIVE-INITIAL-PI-BOOTSTRAP-TASK",
+			"title": "the initial Pi's task restored to the retired forced-first wording — `Your FIRST tool call must be … callback … and nothing before it` with a blanket identity-recheck ban — so the LIVE task forbids the read-only caller check the shared framing offers and the order audit admits",
+			"subject": "scripts/lib/codex-fresh-live-protocol.ts",
+			"find": [
+				"\t\t\"This launch is a guided caller check: first call mcp__entwurf_bridge__entwurf_peers once (read-only, no \" +\n\t\t\"arguments) to corroborate your caller, and only after its result call mcp__entwurf_bridge__entwurf_callback \" +\n\t\t\"with no arguments. Use no other tool before the callback. \" +"
+			],
+			"replace": [
+				"\t\t\"Do not recheck identity with other tools. Your FIRST tool call must be mcp__entwurf_bridge__entwurf_callback with no arguments, and nothing before it. \" +"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-LIVE-INITIAL-PI-BOOTSTRAP-TASK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PI-PEERS-RESULT-BEFORE-CALLBACK",
+			"title": "the peers-result-before-callback ordinal check dropped: a callback made in the same assistant row as the peers check — before its answer existed — passes as if the caller had been checked",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\t\t\tcheck.resultOrdinal !== undefined &&"],
+			"replace": ["\t\t\tfalse &&"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PI-PEERS-RESULT-BEFORE-CALLBACK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-GUIDED-PEERS-REQUIRED",
+			"title": "the guided launch's required check ignored: a guided initial Pi that called back without the peers check it was asked for passes, so a zero-check PASS is counted as the positive path",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tif (at < minPeers)"],
+			"replace": ["\tif (false && at < minPeers)"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-GUIDED-PEERS-REQUIRED]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
 		}
 	]
 }

package/scripts/mutants/control-send-receipt.json

@@ -166,10 +166,10 @@
 			"title": "the pi queue oracle's public coordinate is dropped from `check:vitest`, so the file that proves every claim the receipt makes about a receiver's queues is green only when somebody runs `pnpm test` by hand — the discovery door deliberately does not select `test/**`, so nothing else would notice",
 			"subject": "package.json",
 			"find": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication\""
 			],
 			"replace": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication\""
 			],
 			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
 			"timeoutSeconds": 600,

package/scripts/mutants/mux-fresh-call.json

@@ -69,7 +69,9 @@
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\t\t\t\t\t`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`"],
+			"find": [
+				"\t\t\t\t\t`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`"
+			],
 			"replace": ["\t\t\t\t\t`FINAL ACTION, after completing the task: call ${birthTool} with no arguments.`"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -766,6 +768,19 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:PIIMPORT-CARRIER-FENCE]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-BOOTSTRAP-ORDER",
+			"title": "a pd call with no joined result read as COMPLETED instead of pending, so a callback whose result the native store never recorded passes pd's bootstrap order",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tstatus: call.result === null ? \"pending\" : call.result.isError ? \"failed\" : \"completed\","],
+			"replace": [
+				"\t\tstatus: call.result === null ? \"completed\" : call.result.isError ? \"failed\" : \"completed\","
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-BOOTSTRAP-ORDER]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
 		}
 	]
 }

package/scripts/mutants/native-push-paused.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "native-push-paused",
+	"mutants": [
+		{
+			"claim": "AGY-NATIVE-PUSH-PAUSED",
+			"title": "the paused native-push backend set is emptied, so agy dispatch, sender replyability and register_native reach the agy language server again, whose measured external callers were refused for a missing CSRF token (#128, #152)",
+			"subject": "pi-extensions/lib/entwurf-v2-contract.ts",
+			"find": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [\"antigravity\"];"],
+			"replace": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [];"],
+			"gate": ["bash", "run.sh", "check-native-push-paused"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:AGY-NATIVE-PUSH-PAUSED]",
+			"signatureSource": "pi-extensions/lib/native-push/paused.test.ts"
+		}
+	]
+}

package/scripts/mutants/omp-fresh.json

@@ -169,8 +169,8 @@
 			"claim": "OMP-BOOTSTRAP-CALLBACK-ONLY",
 			"title": "the task folded back into the stage-one prompt, so the sibling is asked to call back AND to work in one message. This is the prompt the failed LIVE actually ran, minus the missing tool: a competing goal beside the callback is what the two-stage split exists to remove, and nothing about argv or readiness would notice it coming back",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt());"],
-			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt()}\\n\\n${payload.task}`);"],
+			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt(opts.callerGardenId));"],
+			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt(opts.callerGardenId)}\\n\\n${payload.task}`);"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-CALLBACK-ONLY]",
@@ -295,6 +295,17 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-EPOCH-ENDS-BEFORE-ENVELOPE]",
 			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
+		},
+		{
+			"claim": "OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED",
+			"title": "a requested omp bootstrap with no well-formed caller target proceeds anyway — the stage silently drops the caller check (or names `undefined` as the caller) and the task is still released, instead of a named refusal",
+			"subject": "pi-extensions/meta-bridge-omp.ts",
+			"find": ["\tif (!caller.ok) {"],
+			"replace": ["\tif (false && !caller.ok) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED]",
+			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/pack-install.json

@@ -60,6 +60,52 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:WIN32-PACK-DIGEST]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-LEAK-CAUGHT",
+			"title": "the dispatcher-verb refusal goes back to the retired verdict, `printf | grep -qF` under pipefail refusing only when that pipeline exits 0, so a leak ahead of more output SIGPIPEs the producer and the cell passes \u2014 killed deterministically only because the self-test front-loads the leak ahead of ~260 KB, past the default 64 KiB pipe buffer (its teeth control measures that); on the real small stand-in output the same restoration would survive",
+			"subject": "run.sh",
+			"find": ["  grep -qF -- \"$token\" <<<\"$out\" || argv_search_rc=$?"],
+			"replace": ["  printf '%s' \"$out\" | grep -qF -- \"$token\" || argv_search_rc=1"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-LEAK-CAUGHT]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CLEAN-PASSES",
+			"title": "the dispatcher-verb refusal stops accepting a clean search (grep rc=1), so every installed copilot / codex-app-server launch is refused, silently",
+			"subject": "run.sh",
+			"find": ["    1) return 0 ;;"],
+			"replace": ["    1) ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CLEAN-PASSES]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED",
+			"title": "a failed dispatcher-verb search (grep rc=2) is accepted as clean, so a search that never ran lets the leak refusal pass",
+			"subject": "run.sh",
+			"find": [
+				"    *) fail \"[check-pack-install] installed 'entwurf $label': the dispatcher-verb search itself failed (rc=$argv_search_rc) \u2014 refused, never read as no leak\" ;;"
+			],
+			"replace": ["    *) return 0 ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CELLS-BOUND",
+			"title": "the copilot leak refusal of check-pack-install goes back to its own `printf | grep -qF` instead of returning through the proved verdict, so the self-test stays green while the heavy cell regains the SIGPIPE window (the codex-app-server call is held by the same text check, with no mutant of its own)",
+			"subject": "run.sh",
+			"find": ["  pack_install_refuse_argv_leak copilot \"$op_out\" 'ARG<copilot>' || return 1"],
+			"replace": ["  if printf '%s' \"$op_out\" | grep -qF 'ARG<copilot>'; then return 1; fi"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CELLS-BOUND]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/mutants/remote-pair-display.json

@@ -10,7 +10,7 @@
 			"replace": [
 				"\tconst remote = !replyable ? (sender.remote ?? { via: \"?\", replyRoute: \"none\" as const }) : undefined;"
 			],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-LOCAL-UNCHANGED]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
@@ -25,7 +25,7 @@
 			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
 			"find": ["\"reply route declared, not probed\""],
 			"replace": ["\"reply via entwurf_v2 to this sessionId\""],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-SESSIONLINE]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
@@ -40,7 +40,7 @@
 			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
 			"find": ["\tconst where = remote ? `${sender.cwd} (sender-host path)` : abbreviateHome(sender.cwd);"],
 			"replace": ["\tconst where = abbreviateHome(sender.cwd);"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-SENDER-HOST-CWD]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",

package/scripts/mutants/remote-pair-receive.json

@@ -6,9 +6,9 @@
 			"claim": "REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION",
 			"title": "the receiving entry stops checking the claimed sender against the declared pair, so any gid the SSH account writes is dispatched into the declared target's mailbox",
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
-			"find": ["\tif (claim.from !== decl.remoteGardenId) {"],
+			"find": ["\tif (fromRoutes.length === 0) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -21,9 +21,9 @@
 			"claim": "REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION",
 			"title": "the receiving entry stops checking the claimed target against the declared pair, so a declared remote can reach every deliverable citizen on this host",
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
-			"find": ["\tif (claim.target !== decl.localGardenId) {"],
-			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"find": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target);"],
+			"replace": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target) ?? fromRoutes[0];"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -38,7 +38,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\t\tsessionId: claim.from,"],
 			"replace": ["\t\tsessionId: process.env.PI_SESSION_ID ?? claim.from,"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-IGNORES-AMBIENT-SENDER]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -53,7 +53,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\t\treplyable: false,"],
 			"replace": ["\t\treplyable: true,"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-MATCH-DISPATCHES-ONCE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -68,7 +68,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\tif (got.length !== want.length || got.some((k, i) => k !== want[i])) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-CLAIM-EXACT-SHAPE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -83,7 +83,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["emit(receipt, receipt.kind === \"rejected\" ? 3 : receipt.isError ? 4 : 0);"],
 			"replace": ["emit(receipt, receipt.kind === \"rejected\" ? 0 : receipt.isError ? 4 : 0);"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-REFUSES-OUTSIDE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -98,7 +98,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["\tif (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-USAGE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -113,7 +113,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["\treplyRoute: \"declared\","],
 			"replace": ["\treplyRoute: \"none\","],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-REPLY-ROUTE-DECLARED]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -121,6 +121,36 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "REMOTE-PAIR-CROSS-PAIR-REFUSED",
+			"title": "the two ends are checked as independent memberships, so a sender declared in one route reaches the local citizen of another route",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target);"],
+			"replace": ["\tconst decl = decls.some((d) => d.localGardenId === claim.target) ? fromRoutes[0] : undefined;"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-CROSS-PAIR-REFUSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-SELECTED-ROUTE-LABEL",
+			"title": "the body is labelled with the first declared route, so a message that came over one host is shown as arriving over another",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst sender = buildRemoteSenderEnvelope(claim, picked.decl,"],
+			"replace": ["\tconst sender = buildRemoteSenderEnvelope(claim, decls[0],"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-SELECTED-ROUTE-LABEL]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
 		}
 	]
 }