@junghanacs/entwurf 0.41.1 → 0.45.0

package/native/win32-x64/manifest.json

@@ -3,7 +3,7 @@
 	"platform": "win32",
 	"arch": "x64",
 	"file": "entwurf_win.node",
-	"sha256": "9837893521ec1d033913ca6cd1b705cb6e942e8d5c288948a1ed0ca0e28655e5",
+	"sha256": "0864b2753a8c22831874dd00959febf597616315670130910aa45147aaa61d17",
 	"napiVersion": 8,
 	"builtWith": {
 		"node": "24.18.1",
@@ -12,7 +12,7 @@
 		"windowsTargetPlatformVersion": "10.0.26100.0",
 		"visualStudio": {
 			"displayName": "Visual Studio Enterprise 2026",
-			"installationVersion": "18.10.12224.181"
+			"installationVersion": "18.11.12315.225"
 		}
 	},
 	"source": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.41.1",
+	"version": "0.45.0",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request and reopen pi or Claude Code in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -39,6 +39,7 @@
 	],
 	"type": "module",
 	"files": [
+		"ENTWURF.json",
 		"protocol.js",
 		"pi-extensions/",
 		"native/win32-x64/",
@@ -196,10 +197,10 @@
 		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
-		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-native-push-paused && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-agent-guidance-beside && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module && ./run.sh check-remote-pair-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
-		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
+		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-argv-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [

package/pi-extensions/lib/agent-guidance.ts

@@ -0,0 +1,341 @@
+/**
+ * Product-owned natural-language logic, authored only in root ENTWURF.json (#154).
+ * One module-relative file, read once. The compiled layout carries an exact copy at
+ * dist/ENTWURF.json; no cwd/HOME search, override, old-text fallback or hot reload.
+ * Existing operator engraving and user-configuration contracts are unrelated.
+ */
+import { readFileSync } from "node:fs";
+
+const TOOL_SPEC = {
+	entwurf_v2: { durable: true, parameters: ["target", "intent", "message", "mode", "wants_reply"] },
+	entwurf_self: { durable: true, parameters: [] },
+	entwurf_peers: { durable: true, parameters: [] },
+	entwurf_inbox_read: { durable: true, parameters: ["gardenId"] },
+	entwurf_register_native: { durable: false, parameters: ["backend", "nativeSessionId", "cwd"] },
+	entwurf_fresh_call: {
+		durable: true,
+		parameters: ["backend", "model", "task", "cwd", "placement.tmuxSession", "placement"],
+	},
+	entwurf_resume_call: { durable: true, parameters: ["target"] },
+	entwurf_retire_call: { durable: true, parameters: ["target"] },
+	entwurf_callback: { durable: true, parameters: [] },
+} as const;
+
+/** Frozen entwurf_v2 reject wire ids whose static next-step hint text lives in the root file. */
+const REJECT_HINT_REASONS = [
+	"dormant-fire-forget-unsupported",
+	"indeterminate-no-spawn",
+	"native-push-target-dead",
+	"native-push-probe-indeterminate",
+	"native-push-paused",
+] as const;
+
+export type RejectHintReason = (typeof REJECT_HINT_REASONS)[number];
+
+/** Frozen entwurf_resume_call record/liveness reject wire ids whose static hint text lives in the root file. */
+const RESUME_REJECT_HINT_REASONS = [
+	"target-invalid",
+	"target-backend-unsupported",
+	"target-locked",
+	"target-live",
+	"target-indeterminate",
+	"target-receiver-absent",
+	"target-receiver-corrupt",
+	"target-receiver-mismatch",
+	"target-receiver-unbound",
+	"target-address-conflict",
+	"launch-refused",
+] as const;
+
+export type ResumeRejectHintReason = (typeof RESUME_REJECT_HINT_REASONS)[number];
+
+/** Frozen entwurf_fresh_call tmux launch-stage reject wire ids whose static hint text lives in the root file. */
+const FRESH_LAUNCH_REJECT_HINT_REASONS = [
+	"no-tmux-context",
+	"anchor-malformed",
+	"anchor-unresolved",
+	"anchor-mismatch",
+	"caller-identity-unavailable",
+	"cwd-not-absolute",
+	"cwd-format-token",
+	"cwd-missing",
+	"cwd-not-directory",
+	"tmux-session-name-invalid",
+	"tmux-session-missing",
+	"model-empty",
+	"task-empty",
+	"runtime-unresolved",
+	"runtime-not-absolute",
+	"runtime-path-whitespace",
+	"runtime-missing",
+	"runtime-not-regular-file",
+	"runtime-not-executable",
+] as const;
+
+export type FreshLaunchRejectHintReason = (typeof FRESH_LAUNCH_REJECT_HINT_REASONS)[number];
+
+/** Frozen entwurf_resume_call tmux launch-stage reject wire ids whose static hint text lives in the root file. */
+const RESUME_LAUNCH_REJECT_HINT_REASONS = [
+	"no-tmux-context",
+	"anchor-malformed",
+	"anchor-unresolved",
+	"anchor-mismatch",
+	"cwd-not-absolute",
+	"cwd-format-token",
+	"cwd-missing",
+	"cwd-not-directory",
+	"herdr-resume-unsupported",
+	"runtime-unresolved",
+	"runtime-not-absolute",
+	"runtime-path-whitespace",
+	"runtime-missing",
+	"runtime-not-regular-file",
+	"runtime-not-executable",
+] as const;
+
+export type ResumeLaunchRejectHintReason = (typeof RESUME_LAUNCH_REJECT_HINT_REASONS)[number];
+
+/** Frozen keys of the static delivery-result clauses whose text lives in the root file; the
+ * receipts around them (syntax, branch conditions, slots, punctuation) stay code-owned. */
+const DELIVERY_RESULT_CLAUSE_KEYS = [
+	"finalized-rejected",
+	"dirty-lock",
+	"remote-accepted",
+	"remote-reported-error",
+	"remote-indeterminate",
+] as const;
+
+export type DeliveryResultClauseKey = (typeof DELIVERY_RESULT_CLAUSE_KEYS)[number];
+
+/** Frozen wire ids of the reject hints whose authored text sits on either side of ONE code-owned
+ * slot, and each one's exact segment keys. The slot value, the reason branch and the
+ * concatenation stay code-owned; the root file holds only the text around the slot. */
+const SLOTTED_REJECT_HINT_SEGMENTS = {
+	"record-less-socket": ["beforeFreshCutPrescription", "afterFreshCutPrescription"],
+} as const;
+
+export type SlottedRejectHintReason = keyof typeof SLOTTED_REJECT_HINT_SEGMENTS;
+type SlottedRejectHints = {
+	readonly [R in SlottedRejectHintReason]: Readonly<Record<(typeof SLOTTED_REJECT_HINT_SEGMENTS)[R][number], string>>;
+};
+
+type ToolName = keyof typeof TOOL_SPEC;
+type ToolGuidance<K extends ToolName> = {
+	readonly descriptions: (typeof TOOL_SPEC)[K]["durable"] extends true
+		? { readonly mcp: string; readonly durable: string }
+		: { readonly mcp: string };
+	readonly parameters: Readonly<Record<(typeof TOOL_SPEC)[K]["parameters"][number], string>>;
+};
+
+export interface EntwurfGuidance {
+	readonly _about: Readonly<Record<"purpose" | "ownership" | "scope" | "editing", string>>;
+	readonly schemaVersion: 6;
+	readonly revision: number;
+	readonly history: readonly {
+		readonly revision: number;
+		readonly source: string;
+		readonly issue: string;
+		readonly change: string;
+	}[];
+	readonly tools: { readonly [K in ToolName]: ToolGuidance<K> };
+	readonly rejectHints: Readonly<Record<RejectHintReason, string>>;
+	readonly resumeRejectHints: Readonly<Record<ResumeRejectHintReason, string>>;
+	readonly freshLaunchRejectHints: Readonly<Record<FreshLaunchRejectHintReason, string>>;
+	readonly resumeLaunchRejectHints: Readonly<Record<ResumeLaunchRejectHintReason, string>>;
+	readonly deliveryResultClauses: Readonly<Record<DeliveryResultClauseKey, string>>;
+	readonly slottedRejectHints: SlottedRejectHints;
+}
+
+function record(value: unknown, at: string): asserts value is Record<string, unknown> {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error(`ENTWURF.json ${at}: expected an object`);
+	}
+}
+
+function keys(value: Record<string, unknown>, expected: readonly string[], at: string): void {
+	const actual = Object.keys(value).sort();
+	const wanted = [...expected].sort();
+	if (actual.length !== wanted.length || actual.some((key, i) => key !== wanted[i])) {
+		throw new Error(`ENTWURF.json ${at}: keys must be exactly ${wanted.join(", ")}`);
+	}
+}
+
+function text(value: unknown, at: string): void {
+	if (typeof value !== "string" || value.length === 0) {
+		throw new Error(`ENTWURF.json ${at}: expected a non-empty string`);
+	}
+}
+
+/**
+ * JSON.parse owns strict grammar, but its last-key-wins value is never enough.
+ * Walk the ORIGINAL, already grammar-checked tokens and reject duplicate DECODED
+ * object keys before returning data. Object scopes are independent; strings that
+ * are values (including punctuation and escaped quotes) are never key tokens.
+ */
+function rejectDuplicateKeys(source: string): void {
+	let pos = 0;
+	const space = (): void => {
+		while (pos < source.length && /[\x20\t\r\n]/.test(source[pos])) pos++;
+	};
+	const string = (): string => {
+		const start = pos++;
+		while (pos < source.length) {
+			if (source[pos] === "\\") pos += 2;
+			else if (source[pos++] === '"') return JSON.parse(source.slice(start, pos)) as string;
+		}
+		throw new Error("ENTWURF.json: unterminated string");
+	};
+	const value = (): void => {
+		space();
+		if (source[pos] === "{") {
+			pos++;
+			space();
+			const seen = new Set<string>();
+			if (source[pos] !== "}") {
+				for (;;) {
+					space();
+					const key = string();
+					if (seen.has(key)) throw new Error(`ENTWURF.json: duplicate object key ${JSON.stringify(key)}`);
+					seen.add(key);
+					space();
+					pos++; // colon; JSON.parse already certified the grammar
+					value();
+					space();
+					if (source[pos] !== ",") break;
+					pos++;
+				}
+			}
+			pos++;
+		} else if (source[pos] === "[") {
+			pos++;
+			space();
+			if (source[pos] !== "]") {
+				for (;;) {
+					value();
+					space();
+					if (source[pos] !== ",") break;
+					pos++;
+				}
+			}
+			pos++;
+		} else if (source[pos] === '"') {
+			string();
+		} else {
+			while (pos < source.length && !/[\x20\t\r\n,}\]]/.test(source[pos])) pos++;
+		}
+	};
+	value();
+}
+
+function freeze(value: unknown): void {
+	if (value === null || typeof value !== "object") return;
+	for (const child of Object.values(value)) freeze(child);
+	Object.freeze(value);
+}
+
+/** Pure data-validation seam; production always reads the one fixed module URL below. */
+export function parseEntwurfGuidance(source: string): EntwurfGuidance {
+	const data: unknown = JSON.parse(source);
+	rejectDuplicateKeys(source);
+	record(data, "root");
+	if (data.schemaVersion !== 6) throw new Error("ENTWURF.json: unsupported schemaVersion");
+	keys(
+		data,
+		[
+			"_about",
+			"schemaVersion",
+			"revision",
+			"history",
+			"tools",
+			"rejectHints",
+			"resumeRejectHints",
+			"freshLaunchRejectHints",
+			"resumeLaunchRejectHints",
+			"deliveryResultClauses",
+			"slottedRejectHints",
+		],
+		"root",
+	);
+	if (!Number.isSafeInteger(data.revision) || (data.revision as number) < 1) {
+		throw new Error("ENTWURF.json: revision must be a positive safe integer");
+	}
+	record(data._about, "_about");
+	keys(data._about, ["purpose", "ownership", "scope", "editing"], "_about");
+	for (const [key, value] of Object.entries(data._about)) text(value, `_about.${key}`);
+	if (!Array.isArray(data.history) || data.history.length === 0) {
+		throw new Error("ENTWURF.json: history must be a non-empty array");
+	}
+	for (const entry of data.history) {
+		record(entry, "history entry");
+		keys(entry, ["revision", "source", "issue", "change"], "history entry");
+		if (
+			!Number.isSafeInteger(entry.revision) ||
+			(entry.revision as number) < 1 ||
+			(entry.revision as number) > (data.revision as number)
+		) {
+			throw new Error("ENTWURF.json: history revision must name an existing payload revision");
+		}
+		for (const key of ["source", "issue", "change"] as const) text(entry[key], `history.${key}`);
+	}
+	record(data.tools, "tools");
+	keys(data.tools, Object.keys(TOOL_SPEC), "tools");
+	for (const name of Object.keys(TOOL_SPEC) as ToolName[]) {
+		const tool = data.tools[name];
+		record(tool, name);
+		keys(tool, ["descriptions", "parameters"], name);
+		record(tool.descriptions, `${name}.descriptions`);
+		keys(tool.descriptions, TOOL_SPEC[name].durable ? ["mcp", "durable"] : ["mcp"], `${name}.descriptions`);
+		for (const [rail, value] of Object.entries(tool.descriptions)) text(value, `${name}.descriptions.${rail}`);
+		record(tool.parameters, `${name}.parameters`);
+		keys(tool.parameters, TOOL_SPEC[name].parameters, `${name}.parameters`);
+		for (const [field, value] of Object.entries(tool.parameters)) text(value, `${name}.parameters.${field}`);
+	}
+	record(data.rejectHints, "rejectHints");
+	keys(data.rejectHints, REJECT_HINT_REASONS, "rejectHints");
+	for (const [reason, value] of Object.entries(data.rejectHints)) text(value, `rejectHints.${reason}`);
+	record(data.resumeRejectHints, "resumeRejectHints");
+	keys(data.resumeRejectHints, RESUME_REJECT_HINT_REASONS, "resumeRejectHints");
+	for (const [reason, value] of Object.entries(data.resumeRejectHints)) text(value, `resumeRejectHints.${reason}`);
+	record(data.freshLaunchRejectHints, "freshLaunchRejectHints");
+	keys(data.freshLaunchRejectHints, FRESH_LAUNCH_REJECT_HINT_REASONS, "freshLaunchRejectHints");
+	for (const [reason, value] of Object.entries(data.freshLaunchRejectHints))
+		text(value, `freshLaunchRejectHints.${reason}`);
+	record(data.resumeLaunchRejectHints, "resumeLaunchRejectHints");
+	keys(data.resumeLaunchRejectHints, RESUME_LAUNCH_REJECT_HINT_REASONS, "resumeLaunchRejectHints");
+	for (const [reason, value] of Object.entries(data.resumeLaunchRejectHints))
+		text(value, `resumeLaunchRejectHints.${reason}`);
+	record(data.deliveryResultClauses, "deliveryResultClauses");
+	keys(data.deliveryResultClauses, DELIVERY_RESULT_CLAUSE_KEYS, "deliveryResultClauses");
+	for (const [key, value] of Object.entries(data.deliveryResultClauses)) text(value, `deliveryResultClauses.${key}`);
+	record(data.slottedRejectHints, "slottedRejectHints");
+	keys(data.slottedRejectHints, Object.keys(SLOTTED_REJECT_HINT_SEGMENTS), "slottedRejectHints");
+	for (const reason of Object.keys(SLOTTED_REJECT_HINT_SEGMENTS) as SlottedRejectHintReason[]) {
+		const segments = data.slottedRejectHints[reason];
+		record(segments, `slottedRejectHints.${reason}`);
+		keys(segments, SLOTTED_REJECT_HINT_SEGMENTS[reason], `slottedRejectHints.${reason}`);
+		for (const [key, value] of Object.entries(segments)) text(value, `slottedRejectHints.${reason}.${key}`);
+	}
+	freeze(data);
+	return data as unknown as EntwurfGuidance;
+}
+
+const guidance = parseEntwurfGuidance(readFileSync(new URL("../../ENTWURF.json", import.meta.url), "utf8"));
+
+/** Only these exact payload strings enter tool schemas; _about/history never do. */
+export const ENTWURF_TOOL_GUIDANCE = guidance.tools;
+/** Static next-step text appended to these entwurf_v2 rejections; the decider and wire ids stay code-owned. */
+export const ENTWURF_REJECT_HINTS = guidance.rejectHints;
+/** Static next-step text in these entwurf_resume_call record/liveness rejections; the verb and the shared ACP model hint stay code-owned. */
+export const ENTWURF_RESUME_REJECT_HINTS = guidance.resumeRejectHints;
+/** Static tmux launch-stage hints of entwurf_fresh_call; slot-bearing, ACP and preflight-leaf hints stay code-owned. */
+export const ENTWURF_FRESH_LAUNCH_REJECT_HINTS = guidance.freshLaunchRejectHints;
+/** Static tmux launch-stage hints of entwurf_resume_call, kept apart from the fresh verb even where the text matches. */
+export const ENTWURF_RESUME_LAUNCH_REJECT_HINTS = guidance.resumeLaunchRejectHints;
+/** Static delivery-result clauses of the entwurf_v2 dirty-lock and remote-pair receipts; the receipt syntax around them stays code-owned. */
+export const ENTWURF_DELIVERY_RESULT_CLAUSES = guidance.deliveryResultClauses;
+/** Text on either side of one code-owned slot per reject reason; the slot value and the concatenation stay with the consumer. */
+export const ENTWURF_SLOTTED_REJECT_HINTS = guidance.slottedRejectHints;
+export const ENTWURF_GUIDANCE_VERSION = Object.freeze({
+	schemaVersion: guidance.schemaVersion,
+	revision: guidance.revision,
+});

package/pi-extensions/lib/entwurf-self-address.ts

@@ -77,6 +77,8 @@ export interface SelfAddressabilityFacts {
 	watchArmed?: boolean;
 	/** meta-session (native-push): an adapter probe found this citizen's live native conversation. */
 	probeAlive?: boolean;
+	/** meta-session (native-push): #152 — this backend's native-push is paused, so no probe ran. */
+	nativePushPaused?: boolean;
 }
 
 export interface SelfAddressabilityResult {
@@ -118,6 +120,17 @@ export function computeSelfAddressability(facts: SelfAddressabilityFacts): SelfA
 			// default fail-closed row).
 			switch (facts.metaDeliveryDomain) {
 				case "native-push": {
+					// #152 policy, decided BEFORE the pure record+probe predicate and kept out of it:
+					// only a record-backed citizen can be "paused" (a record-less one keeps its own
+					// reason), and no probe was run for this answer, so none is reported.
+					if (facts.recordBacked === true && facts.nativePushPaused === true) {
+						return {
+							replyable: false,
+							socketState: "none",
+							reason:
+								"native-push unreachable — native-push for this backend is paused (#152); no probe ran for this answer",
+						};
+					}
 					const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
 					return {
 						replyable: push.deliverable,

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -134,6 +134,26 @@ export function nativePushSupported(backend: string): backend is NativePushBacke
 	return (NATIVE_PUSH_BACKENDS as readonly string[]).includes(backend);
 }
 
+// ── Paused native-push backends (#152) ─────────────────────────────────────
+// A native-push backend whose SEND is paused by product policy. On the external send path
+// entwurf measured, Antigravity's language server refused the `agentapi` call with
+// `Unauthenticated: missing CSRF token` (agy 1.2.16 in #128; agy 1.4.6 again for #152).
+// Whether a first-party own-tool shell holds a token entwurf could legitimately present is
+// UNMEASURED, not ruled out. So instead of probing a port that refused on that path and
+// reporting it as an inconclusive liveness, the three public entries that would reach the agy LS —
+// v2 dispatch, a sender's own `replyable`, and `entwurf_register_native` — refuse by name
+// BEFORE any probe. This is a fixed constant, not a flag: no env, config or runtime toggle
+// can lift it. The backend stays in NATIVE_PUSH_BACKENDS, so existing agy records, the V3
+// reader and the peers listing are unchanged; only the native-push traffic stops.
+// The one probe that is NOT behind this guard is the fresh-cut quiescence check
+// (scripts/meta-bridge-fresh-cut.ts), which protects an operator-named archive and must keep
+// failing closed rather than read the pause as a departed host.
+export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = ["antigravity"];
+
+export function nativePushPaused(backend: string): boolean {
+	return (NATIVE_PUSH_PAUSED_BACKENDS as readonly string[]).includes(backend);
+}
+
 // NativePushLiveness = the 3-value liveness the native-push adapter probe yields.
 // The SAME three values as SocketLiveness, reused so there is ONE 3-value liveness
 // vocabulary — but these are NOT socket-bound (봉인 2: "주석만 socket-전용 오독 정정"):
@@ -173,6 +193,7 @@ export const ENTWURF_V2_REJECT_REASONS = [
 	"mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
 	"native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead.
 	"native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never coerced to dead.
+	"native-push-paused", // #152: fire-and-forget to a native-push backend whose send is paused by product policy (NATIVE_PUSH_PAUSED_BACKENDS — antigravity). Pre-probe, observedLiveness = null: nothing was probed, so no liveness is claimed — never coerced to dead or indeterminate.
 	"bad-target", // R2: absent/typo garden-id (no existing citizen); fresh creation out of v2 scope
 	"record-less-socket", // #50 C4: a gid-shaped non-symlink control socket exists but NO meta-record claims it. The record is the sole address authority (목표 ②), so a bare socket is not an addressable citizen — it is a diagnostic state, refused for EVERY intent before any lock/probe (pre-probe, observedLiveness=null). NOT `bad-target`: something real answers to this gid, and mislabeling it absent would hide the very state the reject exists to surface.
 	"target-locked", // R5 pre-claim for bucket B F2 per-gid lockfile conflict
@@ -181,12 +202,13 @@ export const ENTWURF_V2_REJECT_REASONS = [
 export type EntwurfV2RejectReason = (typeof ENTWURF_V2_REJECT_REASONS)[number];
 
 // ── Pre-probe reject reasons (？6 — observedLiveness = null) ────────────────
-// These four rejects are decided BEFORE any liveness probe runs, so there is no
+// These five rejects are decided BEFORE any liveness probe runs, so there is no
 // honest 4-value FactLiveness to stamp: `bad-target` (no citizen/backend),
 // `target-locked` (5a lock conflict, before lstat/connect), `target-address-conflict`
 // (address-subject conflict → probing is forbidden), `record-less-socket` (#50 C4:
 // no record ⇒ not a citizen ⇒ no in-domain probe ever runs — the presence hint is
-// a single lstat, not a liveness measurement). `indeterminate` means an
+// a single lstat, not a liveness measurement), `native-push-paused` (#152: the backend's
+// native-push send is paused by policy, so its adapter is never probed). `indeterminate` means an
 // in-domain probe was inconclusive (≠ "not looked yet"); `unsupported` means the
 // backend has no predicate (≠ "pre-probe"). So a pre-probe reject's
 // observedLiveness is `null`, NOT one of the four values. Every OTHER reject —
@@ -203,6 +225,7 @@ export const PRE_PROBE_REJECT_REASONS = [
 	"target-locked",
 	"target-address-conflict",
 	"record-less-socket",
+	"native-push-paused",
 ] as const satisfies readonly EntwurfV2RejectReason[];
 export type PreProbeRejectReason = (typeof PRE_PROBE_REJECT_REASONS)[number];
 

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -52,6 +52,7 @@ import {
 	isLivenessSupported,
 	makeRejectReceipt,
 	type NativePushBackend,
+	nativePushPaused,
 	nativePushSupported,
 	resolveDispatch,
 	resolveNativePushDispatch,
@@ -306,6 +307,12 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 	// branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
 	// volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
 	if (nativePushSupported(identity.backend)) {
+		// #152: a paused native-push backend is refused by name BEFORE its adapter is probed —
+		// on the measured external path that language server refused the call (missing CSRF token),
+		// and a refusal must not be reported as a measured liveness. Pre-probe, observedLiveness null.
+		if (nativePushPaused(identity.backend)) {
+			return reject(makeRejectReceipt("native-push-paused", null));
+		}
 		const probe = await deps.nativePushProbe(identity);
 		const receipt = resolveNativePushDispatch(input.intent, probe.status);
 		if (!receipt.ok) return reject(receipt);

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -18,6 +18,11 @@
  */
 
 import { basename } from "node:path";
+import {
+	ENTWURF_DELIVERY_RESULT_CLAUSES,
+	ENTWURF_REJECT_HINTS,
+	ENTWURF_SLOTTED_REJECT_HINTS,
+} from "./agent-guidance.ts";
 import type { SenderEnvelope } from "./entwurf-control-rpc.ts";
 import type { DispatchInput, EntwurfV2Mode } from "./entwurf-v2-decider.ts";
 import { makeProductionEntwurfV2Deps, type ProductionEntwurfV2Opts } from "./entwurf-v2-production.ts";
@@ -65,7 +70,9 @@ export function toDispatchInput(params: SurfaceEntwurfV2Params): DispatchInput {
  * Detour B (B-a) — actionable rendering of an honest reject. The decider is UNCHANGED:
  * a reject stays a reject (Hard Rule 3). This only appends a one-line "what to do instead"
  * to the reject TEXT, so an honest reject stops reading as "delivery impossible". Returns
- * undefined for rejects with no useful next step.
+ * undefined for rejects with no useful next step. Hint English is authored in root ENTWURF.json
+ * (#154); the reason switch stays here, and so do the record-less-socket slot value and its
+ * concatenation (#154 E1b).
  */
 export function actionableRejectHint(reason: string): string | undefined {
 	switch (reason) {
@@ -74,13 +81,7 @@ export function actionableRejectHint(reason: string): string | undefined {
 			// state — the citizen exists and is not running — matters more than ever now that
 			// there is no verb behind it: a caller that reads "reject" as "wrong id" goes
 			// looking in the wrong place.
-			return (
-				"this citizen's record is intact but its session is not running, and delivery has no way to wake it. " +
-				"The resume that used to answer here launched a hidden background child and was withdrawn under the " +
-				"visible-first rule; the visible same-id resume is the separate lifecycle verb entwurf_resume_call. " +
-				"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; " +
-				"it submits no prompt. This capability hint is not permission to resume automatically."
-			);
+			return ENTWURF_REJECT_HINTS["dormant-fire-forget-unsupported"];
 		case "indeterminate-no-spawn":
 			// The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe
 			// is not a measured death, and dispatching into it could double-deliver. Say
@@ -91,32 +92,27 @@ export function actionableRejectHint(reason: string): string | undefined {
 			// (never dispatch into an indeterminate target), not a capability that still
 			// exists. So the hint's job is to say plainly what did NOT happen: nothing
 			// delivered, nothing started.
-			return (
-				"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a " +
-				"measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen " +
-				"'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). " +
-				"Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at " +
-				"that garden id by a session that died without cleaning up."
-			);
+			return ENTWURF_REJECT_HINTS["indeterminate-no-spawn"];
 		case "native-push-target-dead":
 			// The adapter probe found no live native host serving this conversation/thread. Stays
 			// backend-neutral: agy speaks conversations over an LS port, Codex threads over an
 			// app-server socket, and this hint is read by callers of both.
-			return "the native-push conversation/thread is not live — no native host (harness process or app-server) answered the probe for it. Re-open that conversation/thread in its own harness, then retry; there is nothing to inject into.";
+			return ENTWURF_REJECT_HINTS["native-push-target-dead"];
 		case "native-push-probe-indeterminate":
 			// Native host up, but nothing served this conversation/thread — inconclusive, not a
 			// hard dead. Backend-neutral for the same reason as the dead cell above.
-			return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
-		case "record-less-socket":
+			return ENTWURF_REJECT_HINTS["native-push-probe-indeterminate"];
+		case "native-push-paused":
+			// #152: a policy refusal, not a liveness verdict — this dispatch probed and sent nothing.
+			return ENTWURF_REJECT_HINTS["native-push-paused"];
+		case "record-less-socket": {
 			// #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
-			// state, not an addressable citizen (the record is the address).
-			return (
-				"a control socket exists at this garden id but NO meta-record claims it — the record is the " +
-				"sole address authority, so a bare socket is not an addressable citizen. If a pre-record-era " +
-				"resident owns that socket, restart it under the current runtime (session_start births its " +
-				`record); if the store predates the current generation, quiesce and archive it with ` +
-				`${FRESH_CUT_PRESCRIPTION}. A stale/forged socket should be removed.`
-			);
+			// state, not an addressable citizen (the record is the address). The text on either
+			// side of the fix command is authored in root ENTWURF.json; the command itself stays
+			// with its owner (meta-session.ts), so the root file never copies it.
+			const hint = ENTWURF_SLOTTED_REJECT_HINTS["record-less-socket"];
+			return `${hint.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${hint.afterFreshCutPrescription}`;
+		}
 		default:
 			return undefined;
 	}
@@ -218,17 +214,18 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 				// the same acceptance vocabulary the ordinary receipt uses is named here too — a
 				// dirty lock is a reason to be MORE precise about what happened, not less, because
 				// the operator is about to decide by hand whether anything needs re-sending.
+				// The two static clauses are authored in root ENTWURF.json (#154 E1a); this receipt's
+				// syntax, branches and slots stay here.
 				const what =
 					result.finalizedOutcome === "rejected"
-						? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : ""} — the receiver refused it; nothing was accepted`
+						? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : ""} — ${ENTWURF_DELIVERY_RESULT_CLAUSES["finalized-rejected"]}`
 						: `${result.finalizedBoundary ?? "mailbox-enqueued"}${
 								result.finalizedMessagePath ? ` (enqueued ${basename(result.finalizedMessagePath)})` : ""
 							}`;
 				return {
 					text:
-						`entwurf_v2 ${result.transport} finalized as ${what}, and the lock is DIRTY ` +
-						`(release failed) — do NOT retry, a re-send would double-deliver. Clear the lock by hand.` +
-						`\n  error: ${result.error}`,
+						`entwurf_v2 ${result.transport} finalized as ${what}, and ` +
+						`${ENTWURF_DELIVERY_RESULT_CLAUSES["dirty-lock"]}\n  error: ${result.error}`,
 					isError: true,
 				};
 			}