v0.14.0

Two arcs meet in this release. The product arc makes sibling sessions visible: opening and resuming a garden citizen is now an explicit, observable act, and the hidden alternatives were removed rather than kept as compatibility surface. The verification arc keeps the product from being swallowed by its own test cost: the everyday gate now runs in under a minute while the release floor stays strict. Claude Code native + pi + the meta-record store remain the main rail; the ACP backends (Claude ACP, Cortex) are optional service adapters on top of it.

Changed

• ACTION REQUIRED — the Pi runtime floor is now 0.84.1. Installing this release upgrades a 0.82.x/0.83.x host rather than leaving it in place: the peer range is >=0.84.1 <0.85, the development pin is exactly 0.84.1, and installed-package acceptance pins the expanded Pi package constellation. Claude ACP moves to 0.66.0: the 0.65.0 permission metadata reaches the wire but is label-independent, the steered-turn change stays structurally unreachable because entwurf does not send session/steer, and 0.66.0's new goal extension changes no entwurf behavior — entwurf never sends _session/goal, does not consume the initialize advert, a /goal prompt still reaches the model unchanged (the adapter only adds a goal notification), and that inbound session_info_update can reach the wire but falls inert to the event mapper's ignore path.
• Delivery is visible-first and single-verb. entwurf_v2 fire-and-forget never starts a process; a dormant control-socket citizen rejects as dormant-fire-forget-unsupported, and the reject hint now points at the visible resume verb instead of a manual workaround. The hidden spawn-bg/owned-outcome resume path and its gates were removed rather than retained as dead compatibility surface.
• ACP streamSimple honors Pi's request hook contract without fabricating HTTP evidence. onPayload receives and may replace the exact ACP {sessionId,prompt} request on new and reused turns under fail-closed validation and abort ordering; onResponse is an explicit zero-call exemption because ACP has no truthful HTTP status/header boundary.
• Visible team formation and role authority are separate operating phases. Fresh tasks form exact callback-correlated citizens and stop; the operator's later direct visible grant supplies coordinator/implementer/reviewer authority. No role database, watcher, retry loop, or orchestrator was added.
• Verification is tiered by meaning, not by elapsed time. pnpm check is the everyday core — it completes in under 60 seconds on the reference host (36s measured on this candidate) and prints its own wall time; pnpm run check:full is the deterministic candidate floor that push CI, the release gate, and prepublishOnly all agree on by name. check-gate-qualification runs once per frozen candidate, in every push CI check job, and as a release-gate MUST step — never inside the inner loop. The subtraction behind this was loud, not silent: the probe-ordering mutant lane's 84 infrastructure replants were succeeded 1:1 by direct assertions with an 84-entry ledger (#70), bringing qualification to 165 mutants across 22 lanes with the infrastructure-subject share down from 111 of 247 to 27 of 165. What did not happen is also part of the record: the hand-built surface shrank by only ~1.6% in lines — the cost shape changed, not the mass. Gates move tier only by semantic-class decision.

Added

• Visible mux lifecycle verbs now cover both creation and same-id Pi resume. entwurf_fresh_call opens one visible Pi or Claude Code sibling with an explicit runtime model and learns its garden id only from the sibling's exact nonce callback envelope. entwurf_resume_call reopens a dormant Pi citizen in the operator's tmux session under its existing garden id, keeps LAUNCH and OBSERVATION receipts separate, and runs no turn; Claude Code honestly refuses same-id resume as target-not-pi.
• Owner-normalized local identity facts are available through entwurf meta-facts. The deterministic JSON projection exposes the strict V3 garden/native/transcript join and in-band defects by reusing the record owner's parser and store authority, so same-user consumers no longer need to maintain a weaker copy of the certification contract.
• Vitest 4.1.9 enters as the standard test runner — a beachhead, not an occupation. The fresh-call surface/provider lane boots the real bridge, captures native registration and the Anthropic provider conversion path, and validates host-regex patterns against a Rust-family engine; a second lane moves the ACP SDK dependency/resolver contract behind the same stable run.sh shim. Two hand-built gates migrated; new contracts now default to being born in the framework, and further migration stays deliberate and lane-by-lane.
• An entwurf-dev operator skill rides in the repository (not in the npm package). It is a development/verification tour tool: it lets the operator drive the current surface — list citizens, open a fresh visible sibling, correlate its nonce callback, send, resume — in natural language without memorizing tool calls.

Fixed

• Garden-id creation is exclusive across the certified active store. CREATE writes the record bytes to a same-directory temp file first and publishes with an exclusive link(2); an occupied final path fails loud with a named MetaRecordError — the refusal is occupancy-based, there is no retry, no check-then-write TOCTOU window exists, and the occupying record's bytes stay untouched. ATTACH keeps atomic in-place replacement of its own record; a collision surfaces as an error, never as an overwrite.
• Mux LIVE smokes cannot delete a retargeted real Claude launcher. A shared fail-closed fence pins the PATH-selected launcher, link, resolved target, and content before launch; both smokes restore the operator's exact XDG presence/value and verify launcher integrity before conditional fixture cleanup on success and failure paths.
• Fresh-call verification now observes the host boundaries that source-text checks missed. The escaped schema defect is replanted against Rust-family regex compilation and actual provider request bytes, and the session-identity generator oracle no longer relies on a probabilistic collision-free sample.
• The install surfaces hold the public MCP tool set as an exact seven — and the shipped protocol suite's tool assertion runs at all. Three independent installed-consumer gates required only the five pre-0.14 verbs: entwurf check-bridge (which under node_modules is the prebuilt-dist branch of start.sh), the packed-install boot inside check-pack-install, and the checkout-invisible check-install-container that release acceptance hands the preserved candidate. An artifact that booted and answered tools/list without entwurf_fresh_call / entwurf_resume_call therefore passed the very gates that exist to catch "green clone, dead consumer" — the two verbs this release ships were covered by no installed-surface assertion at all. All three now compare the whole set and refuse a missing, extra, or duplicated verb. Underneath them sat something worse: the tarball-shipped mcp/entwurf-bridge/test.sh wrote its tool check as python3 - <<'PY' <<<"$TOOLS_JSON", two redirections onto one stdin, so Python executed the JSON payload as its program while the here-doc assertions never ran once and the ok: line printed unconditionally. That block is live for the first time, with duplicate detection and the v1-verb negative kept as its own named diagnosis. check-entwurf-bridge-boot gains the same equality as G1f under [QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET] with its own exact-once mutant, because every assertion before it was existential and entwurf_fresh_call was named by none of them. Stale enumerations that drifted when 0.14 added the two verbs were repaired with the gates: the bridge module header, the agy auto-grant exclusion list (two named exclusions, now four — the mux verbs launch into the caller's own tmux session, which an agy conversation is not), the external-MCP-host and mux-rail docs, and the check-bridge progress line that named only the dev strip-types branch to an operator reading it from an npm install.

Removed

• The unimplemented tmux-live receipt transport has been removed from the v2 contract. A mux window is an operator view — it may later expose a runtime, but it is never address authority or delivery evidence.
• Injected session ids and hidden background resume are no longer launch substrates. Fresh identity comes from the callback sender envelope; dormant lifecycle is the explicit visible resume verb.

Verification

• Pre-version landing HEAD 9e14df518fb33bad59be14af31c64d71107b558d passed exact-SHA GitHub Actions run 31258659484: check, install-surface, and artifact-consumer all success.
• The 0.14.0 prepared tree passed pnpm run check:full (full deterministic floor, 303s, exit 0); check-pack counted 342 files.
• The initial prepared tree's LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.0.r8r31u --cut completed MUST PASS=20 FAIL=0 SKIP=0 (including the check-gate-qualification MUST step at 165/165 killed across 22 lanes), BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut: OK. Full log: /tmp/entwurf-release-gate-0.14.0.r8r31u/release-gate.log; per-step scratch/artifact paths are preserved in that log. The active LIVE set is native Claude Code, native pi, and pi+ACP; Cortex stays the documented on-demand host-auth axis, and no model-in-loop AGY step is in the aggregate.
• Closing verification-surface inventory (the #70 after-picture, measured by scripts/inventory-verification-surface.ts): 203 files / 58,893 lines combined, against the #62/#70 baseline of 201 files / 59,775 lines — lines below baseline (−882) with the file count reported transparently (+2). The prepared tree measured 58,845 before the install-surface repair below added 48 lines of gate text; the shipping number is the one stated here, so an independent recount lands on it.
• Install-surface repair and amended-tree re-acceptance. The whole deterministic and installed-consumer set was re-taken on one frozen amended tree: pnpm run check:full 299s exit 0 with check-pack at 342 files, ./run.sh check-gate-qualification 166/166 killed across 22 lanes (the +1 is the new BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET), ./run.sh check-pack-install exit 0 with the installed boot listing all seven verbs, and ENTWURF_REQUIRE_DOCKER=1 ./run.sh check-install-container reaching container-consumer: PASS with the same seven from a frozen non-root global install. A project-local npm install under a sandboxed HOME was additionally driven through the operator-facing first command, entwurf check-bridge: exit 0, seven verbs, from the dist branch. The aggregate was then re-run against that amended tree on 2026-08-09 (oracle): LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.14.0-is.52cPh0 --cut — MUST PASS=20 FAIL=0 SKIP=0 (qualification MUST at 166/166 across 22 lanes), BEHAVIOR PASS=1 FAIL=0 SKIP=0, cut: OK, exit 0. HEAD, porcelain, and the repo-root work-surface hash were identical before and after; the complete 3,943-line log is /tmp/claude-1000/-home-junghan-repos-gh-entwurf/4a6914ab-d9da-4f67-9db2-5bf20f0ed168/scratchpad/p5-live.log (SHA-256 0e0f7f6168fa7484aed9db1b42a7b8945e9bcfcdb5745a23c9615992275efb7c).
• Exact prepared-HEAD CI and the preserved-candidate container acceptance remain make responsibilities.

Notes

• Known open issues shipped with eyes open: #60 (native-push drops wants_reply/caller envelope), #68 (naming the valid no-transcript resume refusal), #71 (skipDangerousModePermissionPrompt pinned while defaultMode stays operator-owned), and an observed long-turn error pattern on the optional Claude ACP rail that a post-release audit will reproduce and classify. None of these gates this release; all are tracked.
• Ecosystem: the agent-config repository's entwurf-peek skill was reworked against this release as its baseline — an advanced-operator density tool, not a requirement.