@sabaiway/agent-workflow-kit 1.44.0 → 1.45.0

package/tools/inject-methodology.mjs

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 // Marker-slot injection + reconciliation — the composition root's only mutation of a deployed
-// AGENTS.md. A deployed entry point carries TWO reconciled marker slots, each filled LIVE from the
+// AGENTS.md. A deployed entry point carries THREE reconciled marker slots, each filled LIVE from the
 // installed agent-workflow-engine (the family's one source of truth, no bundled mirror):
 //   1. workflow:methodology  — the plan→execute→review pointer (references/methodology-slot.md).
 //   2. workflow:orchestration — the recipe-vocabulary pointer  (references/orchestration-slot.md).
+//   3. workflow:autonomy     — the autonomy-policy read contract (references/autonomy-slot.md).
 //
-// Both share ONE generic marker engine (a slot DESCRIPTOR parameterizes the markers / anchor /
+// All share ONE generic marker engine (a slot DESCRIPTOR parameterizes the markers / anchor /
 // empty-slot / leading-blank). The methodology exports (findSlot / injectMethodology / ensureSlot /
 // reconcileSlot / slotNeedsFill / extractSlot) delegate to it byte-for-byte, so the methodology
-// contract is unchanged; the orchestration slot is the SAME engine with a different descriptor.
+// contract is unchanged; the later slots are the SAME engine with different descriptors.
 //
 // Contract per slot, strictly enforced:
 //   exactly one ordered start→end pair → replace only the bytes between them;
@@ -31,6 +32,8 @@ export const START_MARKER = '<!-- workflow:methodology:start -->';
 export const END_MARKER = '<!-- workflow:methodology:end -->';
 export const ORCH_START_MARKER = '<!-- workflow:orchestration:start -->';
 export const ORCH_END_MARKER = '<!-- workflow:orchestration:end -->';
+export const AUTONOMY_START_MARKER = '<!-- workflow:autonomy:start -->';
+export const AUTONOMY_END_MARKER = '<!-- workflow:autonomy:end -->';
 export const AGENTS_MD_CAP = 100; // the deployed AGENTS.md line budget (its own footer rule)
 
 const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -59,11 +62,16 @@ export const METHODOLOGY_ANCHOR = /^.*Read it before any code change\..*$/m;
 // The orchestration pair lands right BELOW the methodology end marker — so its anchor is that line.
 // A well-formed entry point carries exactly one methodology end marker → exactly one anchor.
 export const ORCH_ANCHOR = new RegExp(`^.*${escapeRegExp(END_MARKER)}.*$`, 'm');
+// The autonomy pair chains right below the orchestration pair — its anchor is the orchestration end
+// marker line. The anchor can legitimately be ABSENT (a legacy file whose orchestration pair was
+// itself skipped) — the chained CLI classifies that as a soft skip, never a hard STOP (D4).
+export const AUTONOMY_ANCHOR = new RegExp(`^.*${escapeRegExp(ORCH_END_MARKER)}.*$`, 'm');
 
 // The canonical empty slots (an ordered start→end pair, nothing between) — what a fresh template
 // ships and what ensureSlot inserts. LF form; ensureSlot rewrites the newline to match the document.
 export const EMPTY_SLOT = `${START_MARKER}\n${END_MARKER}`;
 export const ORCH_EMPTY_SLOT = `${ORCH_START_MARKER}\n${ORCH_END_MARKER}`;
+export const AUTONOMY_EMPTY_SLOT = `${AUTONOMY_START_MARKER}\n${AUTONOMY_END_MARKER}`;
 
 // ── known-prior canonical fragments (drift-guarded, APPEND-ONLY per slot) ───────
 // The EXACT content a PREVIOUS release's engine fragment shipped (what a filled slot would carry today).
@@ -113,6 +121,21 @@ export const ORCHESTRATION_DESCRIPTOR = {
   upgradeAdvice:
     'the orchestration-recipes pointer predates the read-at-start clause — add "read `docs/ai/orchestration.json` at session start; set it with /agent-workflow-kit set-recipe", or set your preference now with /agent-workflow-kit set-recipe.',
 };
+// The autonomy-policy slot (AD-044 Plan 3) — first canon, so no known priors yet: any future
+// fragment change must append the outgoing content to a KNOWN_PRIOR_AUTONOMY_SLOT store first.
+export const AUTONOMY_DESCRIPTOR = {
+  startMarker: AUTONOMY_START_MARKER,
+  endMarker: AUTONOMY_END_MARKER,
+  anchor: AUTONOMY_ANCHOR,
+  emptySlot: AUTONOMY_EMPTY_SLOT,
+  leadingBlank: false,
+  markerName: 'autonomy',
+  anchorLabel: 'autonomy anchor (the orchestration end-marker line)',
+  knownPriorCanonicals: [],
+  upgradeSignature: 'docs/ai/autonomy.json',
+  upgradeAdvice:
+    'the autonomy pointer does not name the per-project policy file — add "read `docs/ai/autonomy.json` at session start; set it with /agent-workflow-kit set-autonomy", or refresh the slot to the current canon.',
+};
 
 // ── generic marker-slot engine (descriptor-parameterized) ──────────────────────
 
@@ -283,15 +306,22 @@ export const markerSlotUpgradeHint = (text, descriptor) => {
 // stable "(cap N)" substring both cap messages carry, so the dual-slot reconcile can skip the
 // orchestration pointer (loud) while keeping the methodology fill, instead of aborting both.
 const isCapRefusal = (errorMessage) => typeof errorMessage === 'string' && errorMessage.includes('(cap ');
+// The autonomy lane distinguishes the TWO cap messages "(cap " conflates (D4 cap-lane honesty):
+// only a FILL-overflow from an in-cap input (injectIntoSlot's "injection would push …") is the soft
+// skip — the pointer was genuinely withheld. An ALREADY-over-cap custom file (reconcileMarkerSlot's
+// "AGENTS.md is N lines … trim the file") keeps its distinct over-cap report as a hard refusal,
+// never a mislabeled "skipped". Exported so the split is pinned against the real messages.
+export const isFillCapRefusal = (errorMessage) =>
+  isCapRefusal(errorMessage) && errorMessage.includes('injection would push');
 
 const main = async (argv) => {
   const { readFile, writeFile, rename, rm } = await import('node:fs/promises');
   const { dirname, basename, join, resolve } = await import('node:path');
   const { homedir } = await import('node:os');
-  const { resolveEngineDir, readEngineFragment, detectEngine, ENGINE_FRAGMENT_REL, ORCHESTRATION_FRAGMENT_REL } = await import('./engine-source.mjs');
+  const { resolveEngineDir, readEngineFragment, detectEngine, ENGINE_FRAGMENT_REL, ORCHESTRATION_FRAGMENT_REL, AUTONOMY_FRAGMENT_REL } = await import('./engine-source.mjs');
 
   // `reconcile <AGENTS.md> [fragment.md]` = ensure-slot + inject-if-empty + cap (bootstrap/upgrade) for
-  // BOTH slots; `<AGENTS.md> [fragment.md]` = the legacy inject-into-existing-(methodology)-slot mode.
+  // ALL THREE slots; `<AGENTS.md> [fragment.md]` = the legacy inject-into-existing-(methodology)-slot mode.
   const mode = argv[0] === 'reconcile' ? 'reconcile' : 'inject';
   const rest = mode === 'reconcile' ? argv.slice(1) : argv;
   const agentsPath = rest[0];
@@ -323,36 +353,32 @@ const main = async (argv) => {
     }
   };
 
-  // The orchestration fragment is the SECOND (less-critical) pointer. Source it lazily, but DISTINGUISH
-  // two failures keyed off the engine's own detection (not message text): an engine that is VALID but
-  // simply TOO OLD to ship `orchestration-slot.md` (e.g. <1.2.0) is a SOFT skip — the methodology fill
-  // is kept and the recipes pointer is reported as withheld (parallel to the cap-skip); only a FULLY
-  // absent/invalid engine (it cannot supply EITHER pointer) is a hard STOP. Returns
-  // { fragment } on success, { skip } for the soft case, or process.exit(1) for the hard STOP.
-  const sourceOrchestrationFragment = async () => {
+  // The orchestration + autonomy fragments are the CHAINED (less-critical) pointers. Source each
+  // lazily, but DISTINGUISH two failures keyed off the engine's own detection (not message text): an
+  // engine that is VALID but simply TOO OLD to ship the requested fragment is a SOFT skip — the prior
+  // fills are kept and the pointer is reported as withheld (parallel to the cap-skip); only a FULLY
+  // absent/invalid engine (it cannot supply ANY pointer) is a hard STOP. A read error on a PRESENT
+  // fragment is a real corruption STOP, NEVER a "too old" skip (don't mislabel a current engine with
+  // an unreadable fragment). Returns { fragment } on success, { skip } for the soft case, or
+  // process.exit(1) for the hard STOP.
+  const sourceChainedFragment = async (rel) => {
     const { dir, source } = resolveEngineDir({ env: process.env, home: homedir() });
     const stop = (err) => {
       console.error(`[inject-methodology] reconcile STOP — ${err.message}`);
       process.exit(1);
     };
-    // The orchestration fragment FILE is present + the engine is valid → read it. A read error on a
-    // PRESENT fragment is a real corruption STOP, NEVER a "too old" skip (don't mislabel a current
-    // engine with an unreadable fragment).
-    if (detectEngine(dir, { source, rel: ORCHESTRATION_FRAGMENT_REL }).ok) {
+    if (detectEngine(dir, { source, rel }).ok) {
       try {
-        return { fragment: readEngineFragment(dir, { source, rel: ORCHESTRATION_FRAGMENT_REL }) };
+        return { fragment: readEngineFragment(dir, { source, rel }) };
       } catch (err) {
         stop(err);
       }
     }
-    // The orchestration fragment is NOT a usable file. SOFT-skip ONLY when the engine is otherwise
-    // valid (it can still supply the methodology fragment) — a genuine too-old (<1.2.0) engine. A
-    // fully absent/invalid engine cannot supply EITHER fragment → hard STOP with the install command.
     if (detectEngine(dir, { source }).ok) {
       return { skip: 'the installed engine is too old to supply it — refresh with `npx @sabaiway/agent-workflow-engine@latest init`' };
     }
     try {
-      readEngineFragment(dir, { source, rel: ORCHESTRATION_FRAGMENT_REL }); // throws the canonical install-me error
+      readEngineFragment(dir, { source, rel }); // throws the canonical install-me error
     } catch (err) {
       stop(err);
     }
@@ -398,7 +424,7 @@ const main = async (argv) => {
       for (const n of notes) console.log(`[inject-methodology] note: ${n}`);
     };
 
-    // ── Explicit [fragment.md] binds methodology ONLY → skip the orchestration reconcile ──
+    // ── Explicit [fragment.md] binds methodology ONLY → skip the orchestration + autonomy reconciles ──
     if (explicitFragmentArg) {
       if (afterMeth === text) {
         console.log('[inject-methodology] methodology slot already present and filled — nothing to do (zero-diff).');
@@ -416,7 +442,7 @@ const main = async (argv) => {
     let orchSkipped = false;
 
     const orchSource = markerSlotNeedsFill(afterMeth, ORCHESTRATION_DESCRIPTOR)
-      ? await sourceOrchestrationFragment()
+      ? await sourceChainedFragment(ORCHESTRATION_FRAGMENT_REL)
       : { fragment: '' };
     if (orchSource.skip) {
       // Engine too old to supply the recipes pointer → SOFT skip, parallel to the cap-skip: the
@@ -453,16 +479,79 @@ const main = async (argv) => {
       }
     }
 
-    // ── One atomic write of the final (both-slot) text ──
+    // ── Slot 3: autonomy, chained on the orchestration-reconciled text (same combined ≤100 guard).
+    //    D4 invariant: every failure lane SPECIFIC to this slot is a LOUD soft skip that preserves
+    //    the prior fills and exits 0 — (i) a too-old engine (no autonomy fragment), (ii) a
+    //    fill-overflow cap refusal, (iii) an ABSENT anchor (the orchestration pair is absent or was
+    //    itself skipped above — a 0-anchors ensure error must not discard the methodology fill).
+    //    Malformed autonomy markers, an already-over-cap custom file, a present-but-unreadable
+    //    fragment, and a fully absent/invalid engine stay hard STOPs. ──
+    let describeAut;
+    let autSkipped = false;
+    const autSlot = findMarkerSlot(finalText, AUTONOMY_DESCRIPTOR);
+    if (autSlot.state === 'malformed') {
+      // Malformed markers are a hard STOP on EVERY lane — validated before the soft-skip
+      // short-circuits so a duplicate/reversed autonomy pair can never ride out as a "skip"
+      // alongside a partial (methodology) write.
+      console.error(`[inject-methodology] reconcile refused (autonomy) — ${autSlot.reason}`);
+      process.exit(1);
+    }
+    if (orchSkipped) {
+      // The chain is CAUSAL, not merely positional: a pointer never lands in a run that withheld
+      // the pointer it chains below (cap or too-old) — otherwise a partially-shipped engine could
+      // fill autonomy under an unfilled recipes pointer, and a near-cap file could spend its last
+      // lines on the less-critical pointer. LOUD soft skip. This branch also subsumes the D4 (iii)
+      // anchor-absent lane: after a non-skipped orchestration reconcile the orchestration pair —
+      // the autonomy anchor — is present by construction, so orchSkipped is the ONLY route to a
+      // missing anchor (a separate anchor check would be dead code; coverage proved it).
+      autSkipped = true;
+      describeAut =
+        'autonomy pointer skipped — chained below the orchestration pointer, which was itself skipped this run; re-run once it lands';
+    } else {
+      const autSource = markerSlotNeedsFill(finalText, AUTONOMY_DESCRIPTOR)
+        ? await sourceChainedFragment(AUTONOMY_FRAGMENT_REL)
+        : { fragment: '' };
+      if (autSource.skip) {
+        autSkipped = true;
+        describeAut = `autonomy pointer skipped — ${autSource.skip}`;
+      } else {
+        const autResult = reconcileMarkerSlot(finalText, AUTONOMY_DESCRIPTOR, autSource.fragment, { maxLines: AGENTS_MD_CAP });
+        if (autResult.status === 'error') {
+          if (isFillCapRefusal(autResult.error)) {
+            // SOFT skip — only the genuine fill-overflow withholds the pointer; an already-over-cap
+            // custom file keeps its distinct over-cap report via the hard-STOP branch below.
+            autSkipped = true;
+            describeAut = `autonomy pointer skipped — ${autResult.error}`;
+          } else {
+            console.error(`[inject-methodology] reconcile refused (autonomy) — ${autResult.error}`);
+            process.exit(1);
+          }
+        } else {
+          finalText = autResult.text;
+          describeAut = {
+            'reconciled-inserted': 'inserted the autonomy pointer below it and filled it',
+            'reconciled-filled': 'filled the empty autonomy pointer',
+            'reconciled-refreshed': 'refreshed the autonomy pointer to the current canon',
+            'present-filled': 'autonomy pointer already present',
+          }[autResult.status];
+          if (autResult.status === 'present-filled') {
+            const u = markerSlotUpgradeHint(finalText, AUTONOMY_DESCRIPTOR);
+            if (u) notes.push(u);
+          }
+        }
+      }
+    }
+
+    // ── One atomic write of the final (three-slot) text ──
     if (finalText === text) {
-      // Byte-unchanged. Still report a cap-skip (it is not "nothing to do" — a pointer was withheld).
-      if (orchSkipped) console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}.`);
-      else console.log('[inject-methodology] reconcile: both pointers already present and filled — nothing to do (zero-diff).');
+      // Byte-unchanged. Still report a skip (it is not "nothing to do" — a pointer was withheld).
+      if (orchSkipped || autSkipped) console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
+      else console.log('[inject-methodology] reconcile: all three pointers already present and filled — nothing to do (zero-diff).');
       reportNotes();
       return;
     }
     await writeAtomic(finalText);
-    console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}.`);
+    console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
     reportNotes();
     return;
   }

package/tools/manifest/schema.md

@@ -18,6 +18,7 @@ expansion), never via the shell. The validator is [`validate.mjs`](./validate.mj
 | `roles` | object | yes | keys ⊆ `provides`; see *Roles* |
 | `detect` | object | no | `installed` (skill on the machine) + `deployed` (substrate set up in cwd) |
 | `settings` | array | no | the bridge's **settings-file surface** (typed; see *Settings*). Unlike `contract`, a malformed entry **fails** `--strict`. |
+| `networkHosts` | string[] | no | the backend CLI's **observed egress host families** (see *Network hosts*). A malformed list **fails** `--strict`. |
 | `install` / `uninstall` | object | no | `install.npm` is a package name, not a path |
 | `cost` / `quota` / `provenance` | misc | no | informational |
 | `available` | boolean | no | `false` = a declared-but-not-installed stub; skips fs/version checks |
@@ -85,6 +86,25 @@ Wrappers never parse JSON at run time: each carries its own shell registry/valid
 drift-guarded set-equal to this block by the bridge `bin/*.test.mjs` suites (help section keys,
 `aw_settings_known` registry, `AW_SETTINGS_APPLIED` subset, `aw_settings_valid` typed arms).
 
+## Network hosts (AD-044 Plan 4, consult-locked)
+
+`networkHosts` declares the hosts the backend CLI is **observed** to contact (synthetic examples:
+`*.api.backend.example`, `accounts.backend.example`; the real observed lists live in each bridge's
+`capability.json`) — the **single documentation
+source** for a hand-applied sandbox/network allowlist (session sandbox config, or a hand-pasted
+`sandbox.network.allowedDomains` entry). Rules:
+
+- Each entry is a bare dotted hostname or a `*.family` wildcard — never a scheme/path/port.
+  Entries must be unique. A malformed list **fails** `--strict` (the entries are pasted verbatim
+  into allowlist lines by the Recommendations advisor).
+- **The kit never seeds these into settings** (bridge council 2026-07-11, both backends concur):
+  a network pre-allow widens egress for **every** sandboxed command, so running the wrappers
+  **outside** the sandbox (`sandbox.excludedCommands`, the `--bridge-tier` wiring) stays the
+  primary lane; the hosts list exists for the **hand-apply** fallback under harness-managed
+  sandboxes where settings-level exclusions are inert.
+- Observed-minimal, honestly incomplete: a blocked host names itself at run time — extend the
+  hand-applied list by hand; the manifest list records what was actually observed.
+
 ## Path-field rules (Windows-safe, traversal-safe)
 
 - **No absolute paths**, **no `..` traversal**, **no unresolved placeholders** (`{{…}}` / `${…}`)

package/tools/manifest/validate.mjs

@@ -63,6 +63,10 @@ export const settingValueValid = (entry, value) => {
 const hasTraversal = (p) => p.split(/[\\/]/).includes('..');
 const isUnresolved = (s) => /\{\{|\}\}|\$\{/.test(s);
 
+// A `networkHosts` entry: a bare dotted hostname, optionally a `*.` family wildcard — never a
+// scheme, a path, a port, or whitespace (the entry is pasted verbatim into an allowlist line).
+export const NETWORK_HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i;
+
 // Cross-platform "absolute-like": POSIX root (/x), Windows drive (C:\ or C:/), UNC (\\host),
 // or a leading backslash. node:path.isAbsolute() alone is platform-dependent, so a Windows path
 // would slip through unchecked on a POSIX CI runner — Windows-safety requires rejecting both.
@@ -313,6 +317,28 @@ export const validateManifest = (skillDir) => {
     }
   }
 
+  // `networkHosts` (AD-044 Plan 4, consult-locked): the backend CLI's OBSERVED egress host
+  // families — a DOCUMENTATION source for hand-applied sandbox/network allowlists. The kit never
+  // seeds these into settings (exclusion stays primary; a network pre-allow widens egress for
+  // EVERY sandboxed command), but a malformed list FAILS --strict like `settings`: the
+  // Recommendations advisor renders it verbatim, so a bad entry would corrupt a pasted line.
+  const networkHosts = manifest.networkHosts;
+  if (networkHosts != null) {
+    if (!Array.isArray(networkHosts) || networkHosts.length === 0) {
+      errors.push('`networkHosts` must be a non-empty array of host strings');
+    } else {
+      const seenHosts = new Set();
+      networkHosts.forEach((host, i) => {
+        if (typeof host !== 'string' || !NETWORK_HOST_RE.test(host)) {
+          errors.push(`\`networkHosts[${i}]\` must be a bare hostname or a *.family wildcard (${JSON.stringify(host)})`);
+          return;
+        }
+        if (seenHosts.has(host)) errors.push(`duplicate networkHosts entry "${host}" (\`networkHosts[${i}]\`)`);
+        else seenHosts.add(host);
+      });
+    }
+  }
+
   if (!isStub) {
     const auth = readAuthoritativeVersion(skillDir);
     if (auth.version == null) errors.push(`could not resolve an authoritative version (${auth.from})`);

package/tools/procedures.mjs

@@ -36,6 +36,7 @@ import { plansInFlight, PLANS_REL } from './review-state.mjs';
 // (an import-split test pins it). CONFIG_REL is RE-EXPORTED so existing importers (procedures.test.mjs,
 // historically) keep their import site working.
 import { CONFIG_REL, fail, loadConfig, assertSlotRecipe } from './orchestration-config.mjs';
+import { AUTONOMY_REL, loadAutonomy, resolveAutonomy, isSparseSeedConfig } from './autonomy-config.mjs';
 export { CONFIG_REL };
 
 // ── argument + override parsing (usage errors → exit 2) ─────────────────────────────
@@ -224,7 +225,10 @@ const reviewLoopAdvice = (slots, activity) =>
 // (the review-state plan-in-flight detector): exactly ONE plan in flight → render it populated;
 // zero or several → the explicit `--plan <path>` placeholder + a one-line discovery caveat. The
 // suggested --out lives OUTSIDE the repo (/tmp) — grounding.mjs refuses a non-scratch destination.
-const GROUNDING_TOOL = join(dirname(fileURLToPath(import.meta.url)), 'grounding.mjs');
+// Exported for the bridge-tier byte-parity pin (AD-044 Plan 4): the velocity tier seeds the
+// grounding rule in EXACTLY this rendered spelling — `node "${GROUNDING_TOOL}"` — so seeded and
+// rendered forms can never drift apart.
+export const GROUNDING_TOOL = join(dirname(fileURLToPath(import.meta.url)), 'grounding.mjs');
 const GROUNDING_FACTS_OUT = '/tmp/review-facts.md';
 const groundingPreStepAdvice = (activity, slots, plans) => {
   if (!slots.some((s) => (s.backends ?? []).includes('agy-review'))) return [];
@@ -242,17 +246,42 @@ const groundingPreStepAdvice = (activity, slots, plans) => {
   // Path arguments are double-quoted — a skill dir or plan name with a space must stay copy-pasteable.
   const lines = [
     'Grounding pre-step (agy is dispatched — assemble the verified facts BEFORE the review; grounding.mjs slices verbatim, judgment additions stay yours):',
-    `  run:  node "${GROUNDING_TOOL}" --constraints ${planArg} --out ${GROUNDING_FACTS_OUT}`,
+    `  run:  node "${GROUNDING_TOOL}" --constraints --autonomy ${planArg} --out ${GROUNDING_FACTS_OUT}`,
     `  then: ${reviewForm} --facts @${GROUNDING_FACTS_OUT}`,
   ];
   if (plans.length === 0) {
-    lines.push(`  ↳ plan discovery: no plan in flight under ${PLANS_REL} — substitute the plan file you are reviewing against, or drop --plan for constraints-only facts.`);
+    lines.push(`  ↳ plan discovery: no plan in flight under ${PLANS_REL} — substitute the plan file you are reviewing against, or drop --plan for constraints+autonomy facts.`);
   } else if (plans.length > 1) {
     lines.push(`  ↳ plan discovery: ${plans.length} plans in flight under ${PLANS_REL} (${plans.join(', ')}) — populate --plan with the one under review.`);
   }
   return lines;
 };
 
+// The per-activity autonomy block (AD-044 Plan 4): the resolved level for THIS activity + what it
+// implies, rendered from resolveAutonomy — never retyped constants. Read at session start beside
+// the resolved recipes (the AGENTS.md autonomy pointer's read contract). A malformed policy
+// surfaces LOUDLY here (the session-start read is exactly where "malformed → STOP, never guess"
+// must be visible); an absent file states the computed-defaults origin honestly.
+const autonomyAdvice = (activity, facts) => {
+  if (facts == null) return [];
+  if (facts.error) return [`Autonomy (${AUTONOMY_REL}): MALFORMED — ${facts.error} — STOP and fix the policy file, never guess around it.`];
+  const level = facts.activities?.[activity]?.autonomy;
+  if (!level) return [];
+  const origin = facts.source === 'none'
+    ? `computed defaults — no ${AUTONOMY_REL}`
+    : facts.defaultsEquivalent
+      ? `computed defaults — ${AUTONOMY_REL} is the sparse defaults-equivalent seed`
+      : `from ${facts.source}`;
+  const redlines = Object.entries(facts.redlines).map(([k, v]) => `${k}=${v}`).join(', ');
+  const implies = level === 'sandbox'
+    ? 'the OS sandbox confines and auto-allows confined commands — work runs to the next checkpoint without per-command prompts'
+    : 'every non-allowlisted command prompts (the sandbox, where enabled, still confines)';
+  return [
+    `Autonomy for "${activity}" (${origin}): ${level} — ${implies}.`,
+    `  red-lines (always): ${redlines} — commit/push/publish keep their maintainer asks regardless of level.`,
+  ];
+};
+
 // The cost-lane advisory block (cost-tiered execution — orchestration.md §5 canon, paraphrased
 // at the point of use like reviewLoopAdvice paraphrases §9/§4). Rendered UNCONDITIONALLY for
 // every activity — the lanes route EVERY step, review-backed or not (unlike reviewLoopAdvice,
@@ -267,6 +296,7 @@ const costLanesAdvice = () => [
   '  • L2 subscription bridge (codex / agy) — reviews per the resolved recipe above, on frontier bridge models (quality-first).',
   '  • L3 frontier — judgment: plan/fold/synthesis, ADR/handover/changelog-entry wording, persuasive copy, go/no-go, real code.',
   '  • A step with no named guardrail does not move down a lane; red lines never move down (council review models · real code · memory/copy wording · the maintainer approval asks).',
+  '  • Sandbox lanes (under an OS sandbox): the L0 surfaces are sandbox-safe — gates/ledger/state/fold checks, git reads, plain no-network tests; the bridge wrappers are genuinely unsandboxed (network); npm-cache-touching commands are COMMAND-SHAPE dependent — first try the sandbox-safe shape (cache under $TMPDIR, offline/notifier off). Move ONLY the failing command out of the sandbox, never its class; BATCH consecutive unsandboxed calls.',
 ];
 
 // The verbatim per-backend DRIVING CONTRACT block (M-contract): the exact invocation descriptor(s),
@@ -297,7 +327,7 @@ const contractLines = ({ cmd, contract, settings }) => {
   return lines;
 };
 
-const formatHuman = ({ activity, section, slots, warnings, plans }) => {
+const formatHuman = ({ activity, section, slots, warnings, plans, autonomy }) => {
   const lines = [
     section,
     '',
@@ -309,6 +339,8 @@ const formatHuman = ({ activity, section, slots, warnings, plans }) => {
     if (s.reason) lines.push(`      ↳ ${s.reason}`);
     for (const c of s.contracts ?? []) lines.push(...contractLines(c));
   }
+  const autonomyBlock = autonomyAdvice(activity, autonomy);
+  if (autonomyBlock.length) lines.push('', ...autonomyBlock);
   const grounding = groundingPreStepAdvice(activity, slots, plans);
   if (grounding.length) lines.push('', ...grounding);
   const advice = reviewLoopAdvice(slots, activity);
@@ -321,7 +353,7 @@ const formatHuman = ({ activity, section, slots, warnings, plans }) => {
   return lines.join('\n');
 };
 
-const buildJson = ({ activity, section, slots, configSource, warnings, plans }) => ({
+const buildJson = ({ activity, section, slots, configSource, warnings, plans, autonomy }) => ({
   activity,
   section,
   slots: Object.fromEntries(
@@ -334,6 +366,8 @@ const buildJson = ({ activity, section, slots, configSource, warnings, plans })
   groundingPreStep: groundingPreStepAdvice(activity, slots, plans),
   // ADDITIVE (cost-tiered execution): the unconditional cost-lane advisory, structured.
   costLanes: costLanesAdvice(),
+  // ADDITIVE (AD-044 Plan 4): the per-activity autonomy block, structured (empty when unresolvable).
+  autonomy: autonomyAdvice(activity, autonomy),
   configSource,
   warnings,
 });
@@ -354,7 +388,8 @@ ${CONFIG_REL} + the read-only backend detector, and prints both. A per-run
 Read-only: never writes, never commits, never runs a subscription CLI.
 
 Exit codes: 0 success (an unsatisfiable override degrades loudly, still 0);
-            2 usage (unknown activity / bad --override); 1 config or engine error.`;
+            2 usage (unknown activity / bad --override); 1 config or engine error
+            (incl. a malformed ${AUTONOMY_REL} — the advisory still renders, the exit flips).`;
 
 // ── main ───────────────────────────────────────────────────────────────────────────
 
@@ -387,9 +422,27 @@ export const main = (argv, ctx = {}) => {
     const slots = resolveAllSlots({ activity, config, detection, overrides });
     const warnings = [...detectWarnings, ...collectWarnings(slots)];
     const plans = plansInFlight(cwd);
+    // The autonomy facts (AD-044 Plan 4): resolved levels + red-lines from the policy file. A
+    // malformed policy renders LOUDLY in the block AND flips the exit to 1 (config error) — the
+    // recipes and contracts still print, only the code changes.
+    const autonomy = (() => {
+      try {
+        const { config: autonomyConfig, source } = loadAutonomy(cwd, readFile, lstat);
+        const resolved = resolveAutonomy(autonomyConfig);
+        // Structural seed detection (shared predicate) — a declared-defaults policy reads as
+        // "from docs/ai/autonomy.json", never as the seed (codex, Segment B closing).
+        const defaultsEquivalent = source !== 'none' && isSparseSeedConfig(autonomyConfig);
+        return { source, defaultsEquivalent, ...resolved };
+      } catch (err) {
+        return { error: (err && err.message) || String(err) };
+      }
+    })();
     const stdout = json
-      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans }), null, 2)
-      : formatHuman({ activity, section, slots, warnings, plans });
+      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans, autonomy }), null, 2)
+      : formatHuman({ activity, section, slots, warnings, plans, autonomy });
+    if (autonomy?.error) {
+      return { code: 1, stdout, stderr: `procedures: malformed ${AUTONOMY_REL} — ${autonomy.error}` };
+    }
     return { code: 0, stdout, stderr: '' };
   } catch (err) {
     return { code: err.exitCode ?? 1, stdout: '', stderr: `procedures: ${err.message}` };