@junghanacs/entwurf 0.50.0 → 0.52.0

package/pi/pi-durable/overlay/upstream-pin.json

@@ -70,20 +70,20 @@
 			{
 				"name": "runtime.js",
 				"source": "pi/pi-durable/src/experimental/durable/runtime.ts",
-				"blob": "bb5715ab143945e9f2c067ff71d890fe29875d09",
-				"sha256": "437834997b9870ab0383aea7d86ff7880ef7e2ebbbfe4c6360f67d8d36f777ec"
+				"blob": "00646b1b1fbd7e935fb3e66b7578a2befc01f3c8",
+				"sha256": "b47113364b7525abd3bf9286ecb0069f78ac96688b8a271bdbca3a54b9d864c5"
 			},
 			{
 				"name": "tui.js",
 				"source": "pi/pi-durable/src/experimental/durable/tui.ts",
-				"blob": "405600f6ba1558bf6bf22d144afdcf3f1295c282",
-				"sha256": "d4bf4e2861bde917e1dcdea6f063bdc3e101ab500107a9c5fab0e3ce97fb2c4a"
+				"blob": "4b5dd1876ceac8f51910bb11ed5f0024003f4f34",
+				"sha256": "7fefe490d9d462e6a91621901b82b767546926f4a9f4e88d585fe74b727a02c1"
 			},
 			{
 				"name": "harness-setup.js",
 				"source": "pi/pi-durable/src/experimental/durable/harness-setup.ts",
-				"blob": "e8561809321ce8833a13e3757c172f4e38faabcc",
-				"sha256": "eb1158030a8ab95187a4fdd5e7b90816a7995e5f446d09a8184d4f5007e7ac5f"
+				"blob": "5a799bfbfbbedbec229761b26f639fbe2702b623",
+				"sha256": "70b50044ab14c1293a2ace53b375dc48ad940ea9eeacc131d498ccb1ce040617"
 			},
 			{
 				"name": "prompt.js",
@@ -100,8 +100,8 @@
 			{
 				"name": "subagent.js",
 				"source": "pi/pi-durable/src/experimental/durable/subagent.ts",
-				"blob": "3fa9aebbe93e82cfff436e7b9d4c9877e0ed0e27",
-				"sha256": "1cb2390b673a0d914117bc07708c39b004fb10e48b31436bf9d9d2b953a64220"
+				"blob": "8c18e24a030f0b701167f15a33579195303f5ac5",
+				"sha256": "208618441e8e81813de2f44fa9ad5d5bdcdbb78a754679bb7a93d82480e7bece"
 			},
 			{
 				"name": "session-name.js",
@@ -138,17 +138,18 @@
 		]
 	},
 	"sdk": {
-		"comment": "The published library set the carrier runs against, derived from the 1.4.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.4.0 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
+		"comment": "The published library set the carrier runs against, derived from the 1.5.2 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare (1.5.0 adds pi-schema, declared by chord, pi-agent-core, pi-ai and pi-durable). direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.5.2 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
 		"members": {
-			"@earendil-works/chord": "1.4.0",
-			"@earendil-works/pi-agent-core": "1.4.0",
-			"@earendil-works/pi-ai": "1.4.0",
-			"@earendil-works/pi-codemode": "1.4.0",
-			"@earendil-works/pi-coding-agent": "1.4.0",
-			"@earendil-works/pi-durable": "1.4.0",
-			"@earendil-works/pi-mcp": "1.4.0",
-			"@earendil-works/pi-telemetry": "1.4.0",
-			"@earendil-works/pi-tui": "1.4.0"
+			"@earendil-works/chord": "1.5.2",
+			"@earendil-works/pi-agent-core": "1.5.2",
+			"@earendil-works/pi-ai": "1.5.2",
+			"@earendil-works/pi-codemode": "1.5.2",
+			"@earendil-works/pi-coding-agent": "1.5.2",
+			"@earendil-works/pi-durable": "1.5.2",
+			"@earendil-works/pi-mcp": "1.5.2",
+			"@earendil-works/pi-schema": "1.5.2",
+			"@earendil-works/pi-telemetry": "1.5.2",
+			"@earendil-works/pi-tui": "1.5.2"
 		},
 		"direct": {
 			"proper-lockfile": "4.1.2"

package/pi-extensions/lib/entwurf-control-rpc.ts

@@ -50,7 +50,11 @@ export interface SenderEnvelope {
  * renders nothing (etiquette marker, not transport contract).
  */
 export function formatSenderInfoBlock(sender: SenderEnvelope, wantsReply = false): string {
-	return `\n\n<sender_info>${JSON.stringify({
+	const replyGuidance =
+		sender.replyable === true
+			? "\n\n[entwurf: When a reply is requested, send the result via entwurf_v2 to the requested recipient (default: sender_info.sessionId); a local final is not delivery. Honor routing and no-send instructions; an absent or false wants_reply does not cancel a request. A replyable address alone needs no acknowledgment.]"
+			: "";
+	return `${replyGuidance}\n\n<sender_info>${JSON.stringify({
 		sessionId: sender.sessionId,
 		agentId: sender.agentId,
 		cwd: sender.cwd,

package/pi-extensions/lib/entwurf-v2-contract-schema.ts

@@ -1,7 +1,7 @@
 /**
- * entwurf-v2-contract-schema — the pi-side TypeBox REPRESENTATION of the frozen
- * `entwurf_v2` contract. This module exists ONLY to carry the pi-ai TypeBox
- * schema builders (`StringEnum`, `Type`) out of the pi-free core
+ * entwurf-v2-contract-schema — the pi-side JSON Schema REPRESENTATION of the frozen
+ * `entwurf_v2` contract. This module exists ONLY to carry the pi schema builders
+ * (pi-ai's `StringEnum`, pi-schema's `obj`/`str`/…) out of the pi-free core
  * (`entwurf-v2-contract.ts`); the constants/types/decision logic live there.
  *
  * ⚠️ pi LANE ONLY — the MCP bridge (`mcp/entwurf-bridge/src/index.ts`) MUST NOT
@@ -11,18 +11,21 @@
  * the contract CONSTANTS + `resolveDispatch` (pi-free core), never these schemas.
  * Consumer: `check-entwurf-v2-contract` ONLY. This is a gate-side REPRESENTATION of the
  * frozen contract, not a shipped tool schema — measured 2026-07-27, nothing else in the
- * import graph reaches it. The two surfaces a model actually reads build their own:
- * `pi-extensions/entwurf-control.ts` (TypeBox `entwurfV2Parameters` + tool description) and
- * `mcp/entwurf-bridge/src/index.ts` (Zod). Change a model-facing description THERE; changing
- * it here reaches no model, and `check-entwurf-v2-surface` is what pins those two.
+ * import graph reaches it. The surface a model actually reads builds its own:
+ * `mcp/entwurf-bridge/src/index.ts` (Zod, descriptions from ENTWURF.json), which a pi citizen
+ * reaches through Pi's built-in MCP since the native pi tools were retired (2f7c883, Pi 0.99).
+ * Change a model-facing description THERE; changing it here reaches no model.
  *
- * StringEnum (typebox 1.x) inside Type.Object (typebox 0.34) — the same mix the
- * existing entwurf tools use. The logic types in the core are hand-written unions,
- * NOT `Static<>` inferences, so the 0.34/1.x widening caveat does not touch them;
- * `check-entwurf-v2-contract` keeps these schemas and the core types in lockstep.
+ * Pi SDK 1.5 (#155) removed pi-ai's TypeBox re-export (`Type`); its builders are now
+ * `@earendil-works/pi-schema`, which emits plain JSON Schema (obj() closed by default,
+ * opt() leaves a property out of `required`, lit() is `{const}`), and pi-ai's
+ * `StringEnum` still emits `{type:"string", enum}`. The logic types in the core are
+ * hand-written unions, NOT `Static<>` inferences; `check-entwurf-v2-contract` keeps
+ * these schemas and the core types in lockstep.
  */
 
-import { StringEnum, Type } from "@earendil-works/pi-ai";
+import { StringEnum } from "@earendil-works/pi-ai";
+import { bool, lit, nul, obj, opt, type Properties, type Schema, str, union } from "@earendil-works/pi-schema";
 import {
 	ENTWURF_INTENTS,
 	ENTWURF_V2_ACTIONS,
@@ -34,36 +37,43 @@ import {
 } from "./entwurf-v2-contract.ts";
 import { SESSION_ID_RE } from "./session-id.js";
 
-export const EntwurfV2InputSchema = Type.Object(
-	{
-		// R2/F6 executable: the garden-id shape is enforced by pattern, not prose —
-		// a malformed/typo gid fails the schema (→ bad-target) and can never reach a
-		// spawn. SSOT regex = SESSION_ID_RE (pi-extensions/lib/session-id.js).
-		target: Type.String({
-			pattern: SESSION_ID_RE.source,
+/**
+ * The face the drift guard reads. pi-schema types a schema as `{[keyword]: unknown}`; obj() always emits
+ * `properties`, so this names that one keyword without asserting anything else about the shape.
+ */
+type ObjectSchema = Schema & { readonly properties: Readonly<Record<string, Schema>> };
+
+/** obj() — closed, so it emits `additionalProperties: false` — under the face above. */
+const closedObject = (properties: Properties): ObjectSchema => obj(properties) as ObjectSchema;
+
+export const EntwurfV2InputSchema = closedObject({
+	// R2/F6 executable: the garden-id shape is enforced by pattern, not prose —
+	// a malformed/typo gid fails the schema (→ bad-target) and can never reach a
+	// spawn. SSOT regex = SESSION_ID_RE (pi-extensions/lib/session-id.js).
+	target: str({
+		pattern: SESSION_ID_RE.source,
+		description:
+			"garden-id of an EXISTING citizen (pattern-enforced). Fresh sibling creation is out of scope on every current surface — there is no fallback verb that still spawns. A malformed/typo gid is bad-target, never a new spawn.",
+	}),
+	intent: StringEnum(ENTWURF_INTENTS, {
+		description:
+			"caller's declared outcome contract (F1). ONE member since the visible-first cut: fire-and-forget = ack only. The second, owned-outcome (caller owns completion), resumed a dormant citizen by launching a hidden background child and was withdrawn — a dormant citizen is currently unreachable by this verb.",
+	}),
+	mode: opt(
+		StringEnum(ENTWURF_V2_MODES, {
 			description:
-				"garden-id of an EXISTING citizen (pattern-enforced). Fresh sibling creation is out of scope on every current surface — there is no fallback verb that still spawns. A malformed/typo gid is bad-target, never a new spawn.",
+				"delivery mode — NOT the ownership axis (F1) nor liveness routing. steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
 		}),
-		intent: StringEnum(ENTWURF_INTENTS, {
-			description:
-				"caller's declared outcome contract (F1). ONE member since the visible-first cut: fire-and-forget = ack only. The second, owned-outcome (caller owns completion), resumed a dormant citizen by launching a hidden background child and was withdrawn — a dormant citizen is currently unreachable by this verb.",
+	),
+	wantsReply: opt(
+		bool({
+			description: "conversation etiquette only — NOT ownership; never triggers an auto-send (Q2).",
 		}),
-		mode: Type.Optional(
-			StringEnum(ENTWURF_V2_MODES, {
-				description:
-					"delivery mode — NOT the ownership axis (F1) nor liveness routing. steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. MEANINGLESS on the meta-mailbox transport (F-mailbox): a mailbox ack is enqueue+doorbell, not a turn injection, so steer/follow_up does not apply when the verdict transport is meta-mailbox.",
-			}),
-		),
-		wantsReply: Type.Optional(
-			Type.Boolean({
-				description: "conversation etiquette only — NOT ownership; never triggers an auto-send (Q2).",
-			}),
-		),
-		// `additionalProperties: false` — a frozen contract input is exact; an unknown
-		// key is a caller error, not silently ignored.
-	},
-	{ additionalProperties: false },
-);
+	),
+	// `additionalProperties: false` — a frozen contract input is exact; an unknown
+	// key is a caller error, not silently ignored. obj() is closed by default (it
+	// emits `additionalProperties: false` unless `open: true`).
+});
 
 // Receipt = a DISCRIMINATED union on `ok` (R3/F6) — NOT one flat object with
 // optionals. Each branch is EXACT (`additionalProperties: false`): without it,
@@ -72,35 +82,29 @@ export const EntwurfV2InputSchema = Type.Object(
 // With it, success carries action/transport/ownership and rejects a stray reason;
 // reject carries reason and rejects any allow facet — the branches are mutually
 // exclusive at the schema level, not merely by declared-property convention.
-export const EntwurfV2ReceiptSuccessSchema = Type.Object(
-	{
-		ok: Type.Literal(true),
-		action: StringEnum(ENTWURF_V2_ACTIONS),
-		transport: StringEnum(ENTWURF_V2_TRANSPORTS),
-		ownership: StringEnum(ENTWURF_V2_OWNERSHIPS),
-		observedLiveness: StringEnum(FACT_LIVENESSES, {
-			description: "the 4-value fact liveness the verdict was computed from (R1/R3).",
-		}),
-	},
-	{ additionalProperties: false },
-);
+export const EntwurfV2ReceiptSuccessSchema = closedObject({
+	ok: lit(true),
+	action: StringEnum(ENTWURF_V2_ACTIONS),
+	transport: StringEnum(ENTWURF_V2_TRANSPORTS),
+	ownership: StringEnum(ENTWURF_V2_OWNERSHIPS),
+	observedLiveness: StringEnum(FACT_LIVENESSES, {
+		description: "the 4-value fact liveness the verdict was computed from (R1/R3).",
+	}),
+});
 
-export const EntwurfV2ReceiptRejectSchema = Type.Object(
-	{
-		ok: Type.Literal(false),
-		reason: StringEnum(ENTWURF_V2_REJECT_REASONS),
-		// ？6: required-nullable, NOT optional — a reject branch ALWAYS carries the
-		// key, and it is `null` for the pre-probe rejects (PRE_PROBE_REJECT_REASONS)
-		// and a real FactLiveness otherwise. Optional would lose the "key always
-		// present, value may be null" shape and weaken the discriminated union; the
-		// reason-dependent null/non-null rule is enforced semantically (the gate's
-		// rejectObservedLivenessWellFormed fixture), not by this blanket union.
-		observedLiveness: Type.Union([StringEnum(FACT_LIVENESSES), Type.Null()], {
-			description:
-				"the 4-value fact liveness the reject was computed from (R1/R3); null for the pre-probe rejects (bad-target / target-locked / target-address-conflict) where no probe ran.",
-		}),
-	},
-	{ additionalProperties: false },
-);
+export const EntwurfV2ReceiptRejectSchema = closedObject({
+	ok: lit(false),
+	reason: StringEnum(ENTWURF_V2_REJECT_REASONS),
+	// ？6: required-nullable, NOT optional — a reject branch ALWAYS carries the
+	// key, and it is `null` for the pre-probe rejects (PRE_PROBE_REJECT_REASONS)
+	// and a real FactLiveness otherwise. Optional would lose the "key always
+	// present, value may be null" shape and weaken the discriminated union; the
+	// reason-dependent null/non-null rule is enforced semantically (the gate's
+	// rejectObservedLivenessWellFormed fixture), not by this blanket union.
+	observedLiveness: union([StringEnum(FACT_LIVENESSES), nul()], {
+		description:
+			"the 4-value fact liveness the reject was computed from (R1/R3); null for the pre-probe rejects (bad-target / target-locked / target-address-conflict) where no probe ran.",
+	}),
+});
 
-export const EntwurfV2ReceiptSchema = Type.Union([EntwurfV2ReceiptSuccessSchema, EntwurfV2ReceiptRejectSchema]);
+export const EntwurfV2ReceiptSchema = union([EntwurfV2ReceiptSuccessSchema, EntwurfV2ReceiptRejectSchema]);

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -3,7 +3,7 @@
  * verb (0.11 Stage 0 step 4-pre / 동결결정 10). PURE pi-FREE core: the
  * intent×liveness decision table + the reject taxonomy + a pure resolver.
  * NO runtime dispatch, NO spawn/send, NO I/O — step 5 wires this to transports.
- * The pi-ai TypeBox REPRESENTATION of this contract lives in the separate
+ * The pi-schema REPRESENTATION of this contract lives in the separate
  * `entwurf-v2-contract-schema.ts` (0.12.1 B-1) so this module — which the
  * harness-neutral MCP bridge reaches at boot — carries no pi dependency.
  *
@@ -516,9 +516,9 @@ export function resolveNativePushDispatch(intent: EntwurfIntent, liveness: Nativ
 	};
 }
 
-// ── TypeBox schemas ────────────────────────────────────────────────────────
-// MOVED to `entwurf-v2-contract-schema.ts` (0.12.1 B-1): the pi-ai TypeBox
-// builders (StringEnum/Type) are a pi-lane dependency, so they cannot live in
+// ── JSON schemas ───────────────────────────────────────────────────────────
+// MOVED to `entwurf-v2-contract-schema.ts` (0.12.1 B-1): the pi schema
+// builders (pi-ai StringEnum, pi-schema since #155) are a pi-lane dependency, so they cannot live in
 // this pi-free core — the MCP bridge reaches this module at boot and must stay
 // harness-neutral (check-entwurf-bridge-pi-free). The schemas import the
 // constants/types above; pi-side consumers import the schemas from there.

package/pi-extensions/lib/meta-mailbox-body.ts

@@ -79,7 +79,7 @@ export function formatMetaMailboxBody(sender: MailboxSenderEnvelope, message: st
 	// SENDING host, so it is neither abbreviated against this host's HOME nor shown as a local path.
 	const remote = !replyable ? sender.remote : undefined;
 	const sessionLine = replyable
-		? `${sender.sessionId} (${kind}replyable — reply via entwurf_v2 to this sessionId, intent=fire-and-forget)`
+		? `${sender.sessionId} (${kind}replyable — when a reply is requested, send the result via entwurf_v2 (intent=fire-and-forget) to the requested recipient, defaulting to this sessionId; a local final is not delivery. Honor routing and no-send instructions; an absent or false wants_reply does not cancel a request. A replyable address alone needs no acknowledgment)`
 		: remote
 			? `${sender.sessionId} (remote via ${remote.via}; ${remote.replyRoute === "declared" ? "reply route declared, not probed" : "no reply route declared"})`
 			: isMeta

package/pi-extensions/meta-bridge-pi-durable.ts

@@ -349,7 +349,7 @@ export interface PiDurableRoots {
 // ---------------------------------------------------------------------------
 // Durable surface, typed NARROWLY and locally — read at pi-durable 1.0.2 @cd32f77 (#129,
 // `harness/types.ts`; historical coordinates, not re-anchored here). The current supply is the
-// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.4.0 SDK set
+// carrier emitted from Entwurf's owned source (pi/pi-durable/src, #141) against the 1.5.2 SDK set
 // `pi/pi-durable/overlay/upstream-pin.json` names (origin `abe508e`). `[read 2026-10-13]` at
 // v1.2.0 one shape typed below moved: `ToolExecutionResult.content` is now `output`, beside the new
 // `structuredOutput` (`harness/types.ts`, its CHANGELOG's breaking changes). An omitted `output`