@sabaiway/agent-workflow-kit 10.0.0 → 10.2.0

package/CHANGELOG.md

@@ -4,6 +4,46 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 10.2.0 — a review can no longer pass a change it called broken (AD-122)
+
+Ships antigravity-cli-bridge **5.4.0** in the bundled bridge tree. A consumer recorded a clean
+`SHIP WITH NITS` receipt over a review body that named a correctness bug and a security violation
+under `### Blocking` — the wrapper read the verdict line and nothing read the section. Now a
+ship-class verdict beside a numbered Blocking item is a verdict-body contradiction and takes the
+existing failed-review arm: exit 4, no receipt, both halves named, re-run the review. `REWORK` is
+never refused — a veto needs no corroboration, only a pass does — an absent Blocking section is not
+a contradiction, and a repeated heading terminates the scan, so exactly one section is ever judged.
+
+The guard was written to a contract first (`docs/ai/specs/bridges/agy-review-verdict.md`, eight
+scenarios), and the bridge's test suite was split in the same change: the shared fixture surface
+moved to `bin/agy-review-harness.test.mjs`, the wrapper suite shrank to 2893 lines with all 213
+existing arms green, and the new contract got its own topic file. Both new files ship with the
+bridge tree, so the tarball count pin moves 257 → 259.
+
+## 10.1.0 — no work without a specification, and a ratchet that does not trust its own file (AD-121)
+
+A shipped tool that no LIVE contract claims is now a REFUSAL, not a preference. `tools/spec-coverage.mjs`
+(the rule) and `tools/spec-coverage-cli.mjs` (argv, fs and the one write) read each contract's own
+`## Module` list as the coverage map — coverage is never declared twice — and a project declares the
+check as a gate. Measured at adoption in this repo: 122 tool modules, 14 governed by a contract.
+
+The other 108 are owed, and what is owed is never STORED — it is a subtraction. `adopted` is the set
+measured once at adoption and never rewritten; `settled` names the adopted paths whose contract has
+since been written; the debt is the difference. So there is no list a hand can edit into a lie: the
+only editable claim is "this one was paid", and every run checks that claim against the contracts
+themselves — a settled path no live contract covers refuses, and refuses twice, because the tool is
+uncovered again. A stored debt list was the first design and a review killed it: `--write-debt`
+refusing to add a path guaranteed nothing while nobody was obliged to use it.
+
+The scope file is validated before it is used: a wrong schema, an empty `roots` or `extensions`, a
+non-string entry, or a census of ZERO files all refuse — a gate that passes because it looked at
+nothing is not a pass. Exclusions are path-component boundaries, so excluding `x/fixtures` never also
+hides `x/fixtures-escape.mjs`. `draft` and `retired` contracts cover nothing.
+
+Also in this release: `tools/spec-check.mjs` counts a scenario marker as a WHOLE ordinal, so a store
+reaching ten scenarios no longer refuses a correct binding while naming the wrong scenario
+(`spec:x/S1` used to occur twice the moment `spec:x/S11` was written beside it).
+
 ## 10.0.0 — a symlinked docs file gets named instead of skipped (AD-119)
 
 Mirrors the memory canon: `references/scripts/check-docs-size.mjs` no longer lets a symlinked docs

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '10.0.0'
+  version: '10.2.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '5.3.0'
+  version: '5.4.0'
 ---
 
 # antigravity-cli-bridge
@@ -163,7 +163,9 @@ billed turn restating the model's own prose (16,585 → 33,446 tokens on a match
 
 **Honesty + posture (D4/D5):** a run with no recognized `### Verdict` section — empty output
 included — **exits 4 with NO receipt**: treat it as a *failed review to re-run*, never a fatal
-session error. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
+session error. The verdict vocabulary is closed (SHIP / SHIP WITH NITS / REWORK), and a
+ship-class verdict arriving beside a numbered `### Blocking` finding is a verdict-body
+contradiction: the same exit 4, NO receipt, both halves named. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
 and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
 pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`

package/bridges/antigravity-cli-bridge/bin/agy-review-harness.test.mjs

@@ -0,0 +1,288 @@
+// Shared harness for the agy-review wrapper suites. PORTING TRAP: agy takes the prompt as the
+// `-p` ARGV value, NOT stdin — the fake captures the -p value from argv.
+import assert from 'node:assert/strict';
+import { after } from 'node:test';
+import {
+  mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFile } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const WRAPPER = join(HERE, 'agy-review.sh');
+
+const FAKE_ENVELOPE_ENCODER = [
+  'const text = require("node:fs").readFileSync(0, "utf8");',
+  'const [cid, status, shape] = process.argv.slice(1);',
+  'const envelope = { conversation_id: cid, status, response: text, duration_seconds: 1.5, num_turns: 1,',
+  '  usage: { input_tokens: 10, output_tokens: 5, thinking_tokens: 0, cache_read_tokens: 0, total_tokens: 15 } };',
+  'if (shape === "missing") delete envelope.conversation_id;',
+  'if (shape === "number") envelope.conversation_id = 42;',
+  'process.stdout.write(`${JSON.stringify(envelope)}\\n`);',
+].join('\n');
+
+export const FAKE_AGY = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  // --help / --version answer BEFORE any capture file is touched — a probe is never a paid dispatch.
+  'case "${1:-}" in',
+  '  --help|-h)',
+  '    if [[ -n "${AGY_FAKE_HELP_EXIT:-}" ]]; then echo "fake agy: help unavailable" >&2; exit "$AGY_FAKE_HELP_EXIT"; fi',
+  '    for f in --output-format --json-schema --disable-slash-commands --effort --mode; do',
+  '      if [[ "$f" == "${AGY_FAKE_HELP_OMIT:-}" ]]; then continue; fi',
+  '      printf "  %s   fake capability line\\n" "$f"',
+  '    done',
+  '    if [[ -n "${AGY_FAKE_HELP_EXTRA:-}" ]]; then printf "%s\\n" "$AGY_FAKE_HELP_EXTRA"; fi',
+  '    exit 0 ;;',
+  '  --version) printf "%s\\n" "${AGY_FAKE_VERSION:-1.1.13}"; exit 0 ;;',
+  'esac',
+  ': "${AGY_FAKE_ARGV:=/dev/null}"',
+  ': "${AGY_FAKE_ENV:=/dev/null}"',
+  ': "${AGY_FAKE_PROMPT:=/dev/null}"',
+  ': "${AGY_FAKE_SENTINEL:=/dev/null}"',
+  'printf invoked > "$AGY_FAKE_SENTINEL"',
+  'printf "%s" "$PWD" > "${AGY_FAKE_CWD:-/dev/null}"',
+  '{ for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_FAKE_ARGV"',
+  '{ echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "ANTIGRAVITY_API_KEY=${ANTIGRAVITY_API_KEY:-<unset>}"; } > "$AGY_FAKE_ENV"',
+  'prompt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "-p" ]]; then prompt="$a"; printf "%s" "$a" > "$AGY_FAKE_PROMPT"; fi; prev="$a"; done',
+  'aw_fmt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "--output-format" ]]; then aw_fmt="$a"; fi; prev="$a"; done',
+  // AGY_FAKE_BAD_TURN scopes the transport-breaking knobs to ONE turn; AGY_FAKE_RAW_STDOUT bypasses
+  // the envelope encoder entirely.
+  'aw_fake_emit() {',
+  '  local body="$1" aw_status="${AGY_FAKE_STATUS:-SUCCESS}" aw_raw=""',
+  '  if [[ -n "${AGY_FAKE_RAW_STDOUT+x}" ]]; then aw_raw=1; fi',
+  '  if [[ -n "${AGY_FAKE_BAD_TURN:-}" && "$turn" != "${AGY_FAKE_BAD_TURN}" ]]; then aw_status="SUCCESS"; aw_raw=""; fi',
+  '  if [[ -n "${AGY_FAKE_STDERR:-}" ]]; then printf "%s\\n" "$AGY_FAKE_STDERR" >&2; fi',
+  '  if [[ -n "$aw_raw" ]]; then printf "%s" "$AGY_FAKE_RAW_STDOUT"; return 0; fi',
+  '  if [[ "$aw_fmt" != "json" ]]; then printf "%s\\n" "$body"; return 0; fi',
+  `  printf "%s\\n" "$body" | node -e '${FAKE_ENVELOPE_ENCODER}' \\`,
+  '    "${AGY_FAKE_CONV_ID:-11111111-2222-3333-4444-555555555555}" "$aw_status" "${AGY_FAKE_CONV_SHAPE:-ok}"',
+  '}',
+  'prev=""; for a in "$@"; do',
+  '  if [[ "$prev" == "--add-dir" ]]; then',
+  '    printf "%s" "$a" > "${AGY_FAKE_ADDDIR:-/dev/null}"',
+  '    stat -c "%a" "$a" > "${AGY_FAKE_ADDDIR_MODE:-/dev/null}" 2>/dev/null || true',
+  '    art="$a/precomputed-change-set"',
+  '    if [[ -f "$art" ]]; then stat -c "%a" "$art" > "${AGY_FAKE_ARTIFACT_MODE:-/dev/null}" 2>/dev/null || true; cp "$art" "${AGY_FAKE_ARTIFACT_COPY:-/dev/null}" 2>/dev/null || true; fi',
+  '  fi; prev="$a"',
+  'done',
+  'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
+  // The fed lane needs a PER-TURN record: each invocation writes prompt/argv to "<file>.<turn>".
+  'turn=1',
+  'if [[ -n "${AGY_FAKE_TURNS:-}" ]]; then',
+  '  if [[ -s "$AGY_FAKE_TURNS" ]]; then turn=$(( $(cat "$AGY_FAKE_TURNS") + 1 )); fi',
+  '  printf "%s" "$turn" > "$AGY_FAKE_TURNS"',
+  '  printf "%s" "$prompt" > "${AGY_FAKE_PROMPT}.$turn"',
+  '  { for a in "$@"; do printf "%s\\n" "$a"; done; } > "${AGY_FAKE_ARGV}.$turn"',
+  'fi',
+  'if [[ -n "${AGY_FAKE_FAIL_TURN:-}" && "$turn" == "${AGY_FAKE_FAIL_TURN}" ]]; then',
+  '  printf "FAKE_TURN_FAILURE\\n" >&2; exit 3',
+  'fi',
+  // A FEED turn deliberately misbehaves (a premature verdict) so the isolation invariant is proven
+  // against the worst case.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"--- BEGIN CHANGE-SET PART "* && "$prompt" != *"Requested addresses"* ]]; then',
+  '  aw_fake_emit "$(printf "PREMATURE_FEED_CHATTER\\n### Verdict\\nREWORK")"; exit 0',
+  'fi',
+  // The FINAL turn answers the delivery-proof request honestly: by reading the bodies it was fed.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"Requested addresses"* ]]; then',
+  '  req="$(printf "%s" "$prompt" | awk "/^Requested addresses/{f=1; next} f && /^###/{exit} f{print}")"',
+  '  entries=()',
+  '  mapfile -t _items <<< "$req"',
+  '  for _it in "${_items[@]}"; do',
+  '    [[ -n "$_it" ]] || continue',
+  '    k="$(printf "%s" "$_it" | awk "{print \\$2}")"; l="$(printf "%s" "$_it" | awk "{print \\$4}")"',
+  '    src="$k"',
+  '    if [[ "${AGY_FAKE_PROOF_DUP:-}" == "1" ]]; then src=1; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OMIT:-}" == "$k" ]]; then continue; fi',
+  '    body="$(awk -v want="$l" "f && /^--- END CHANGE-SET PART /{exit} f{c++; if (c==want) {print; exit}} /^--- BEGIN CHANGE-SET PART /{f=1}" "${AGY_FAKE_PROMPT}.$src")"',
+  '    if [[ "${AGY_FAKE_PROOF_CORRUPT:-}" == "$k" ]]; then body="${body}X"; fi',
+  '    entry="$(printf "part %s line %s: %s" "$k" "$l" "$body")"',
+  '    if [[ "${AGY_FAKE_PROOF_BULLET:-}" == "1" ]]; then entry="- $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_NESTED:-}" == "$k" ]]; then entry="note: I believe $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_PAD:-}" == "1" ]]; then entry="$(printf "part %02d line %04d: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then entry="$(printf "Part %s Line %s: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_HUGE:-}" == "$k" ]]; then entry="$(printf "part %s line 99999999999999999999: %s" "$k" "$body")"; fi',
+  '    entries+=("$entry")',
+  '    if [[ "${AGY_FAKE_PROOF_TWICE:-}" == "1" ]]; then entries+=("$entry"); fi',
+  '  done',
+  '  if [[ "${AGY_FAKE_PROOF_EXTRA:-}" == "1" ]]; then entries+=("part 99 line 1: an address nobody asked for"); fi',
+  '  if [[ "${AGY_FAKE_PROOF_HUGE_EXTRA:-}" == "1" ]]; then entries+=("part 99999999999999999999 line 1: an invented giant address"); fi',
+  '  out="$( {',
+  '    if [[ "${AGY_FAKE_PROOF_LATE:-}" == "1" ]]; then printf "### Verdict\\nSHIP\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then printf "### Delivery Proof\\n"; else printf "### Delivery proof\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OUTSIDE:-}" == "1" ]]; then',
+  '      printf "(nothing here)\\n### Verdict\\nSHIP\\n"',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '    else',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '      printf "### Verdict\\nSHIP\\n"',
+  '    fi',
+  '    if [[ -n "${AGY_FAKE_FINAL_APPEND:-}" ]]; then printf "%s\\n" "$AGY_FAKE_FINAL_APPEND"; fi',
+  '  } )"',
+  '  aw_fake_emit "$out"',
+  '  exit 0',
+  'fi',
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then aw_fake_emit "$(printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP")"; else aw_fake_emit "$AGY_FAKE_OUTPUT"; fi',
+  'exit "${AGY_FAKE_EXIT:-0}"',
+  '',
+].join('\n');
+
+// A PATH whose entries are symlinks to the real PATH binaries EXCEPT the excluded names.
+const makePathWithout = (root, exclude = []) => {
+  const skip = new Set(exclude);
+  const dir = mkdtempSync(join(root, 'nobin-'));
+  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const name of names) {
+      if (skip.has(name)) continue;
+      const link = join(dir, name);
+      if (existsSync(link)) continue;
+      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
+    }
+  }
+  return dir;
+};
+
+// Farms and the sandbox template are read-only per invocation, so both are built ONCE and shared.
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const farms = new Map();
+export const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
+const TEMPLATE_HOME = (() => {
+  const home = join(SHARED_ROOT, 'template-home');
+  const bin = join(home, '.local', 'bin');
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
+  const repo = join(home, 'repo');
+  mkdirSync(repo);
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  g('init', '-q');
+  g('config', 'user.email', 'probe@example.com');
+  g('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'base.txt'), 'committed base\n');
+  g('add', '-A');
+  g('commit', '-qm', 'base');
+  return home;
+})();
+
+// `clean: true` leaves a pristine committed tree; the default leaves one untracked file so `code`
+// mode has a diff to review.
+export const makeSandbox = ({ clean = false } = {}) => {
+  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
+  cpSync(TEMPLATE_HOME, home, { recursive: true });
+  const bin = join(home, '.local', 'bin');
+  chmodSync(join(bin, 'agy'), 0o755);
+  const repo = join(home, 'repo');
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
+  return { home, bin, repo, g };
+};
+
+let runSeq = 0;
+// Asynchronous on purpose: a blocking spawnSync pinned the whole suite to one core.
+export const run = (sb, { args, env = {}, cwd, wrapper } = {}) => new Promise((settle) => {
+  const { home, bin, repo } = sb;
+  const farm = farmFor(['agy', 'agy-run']);
+  const tag = `cap-${++runSeq}`;
+  const cap = {
+    argv: join(home, `${tag}-argv`), env: join(home, `${tag}-env`), prompt: join(home, `${tag}-prompt`),
+    sentinel: join(home, `${tag}-sentinel`), adddir: join(home, `${tag}-adddir`),
+    adddirMode: join(home, `${tag}-adddir-mode`), artifactMode: join(home, `${tag}-artifact-mode`),
+    artifactCopy: join(home, `${tag}-artifact-copy`), turns: join(home, `${tag}-turns`),
+    dispatchCwd: join(home, `${tag}-dispatch-cwd`),
+  };
+  const child = execFile('bash', [wrapper || WRAPPER, ...args], {
+    cwd: cwd || repo,
+    encoding: 'utf8',
+    timeout: 30000,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      HOME: home,
+      PATH: `${bin}:${farm}`,
+      TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
+      AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
+      AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
+      AGY_FAKE_TURNS: cap.turns, AGY_FAKE_CWD: cap.dispatchCwd,
+      ...env,
+    },
+  }, (error, stdout, stderr) => {
+    const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+    const turns = existsSync(cap.turns) ? Number(readFileSync(cap.turns, 'utf8')) : 0;
+    const prompts = [];
+    const argvs = [];
+    for (let i = 1; i <= turns; i += 1) {
+      prompts.push(readIf(`${cap.prompt}.${i}`));
+      argvs.push(readIf(`${cap.argv}.${i}`));
+    }
+    settle({
+      status: error ? (error.code ?? 1) : 0, signal: error?.signal ?? null, stdout, stderr,
+      invoked: existsSync(cap.sentinel),
+      argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
+      adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
+      artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
+      dispatchCwd: readIf(cap.dispatchCwd).trim(), turns, prompts, argvs,
+    });
+  });
+  // Only EPIPE is a refusal working — any other stdin write failure must reach the test.
+  child.stdin.on('error', (err) => { if (err.code !== 'EPIPE') throw err; });
+  child.stdin.end();
+});
+
+export const runAsync = run;
+
+export const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
+export const readReceipts = (repo) => {
+  const p = join(repo, RECEIPTS_REL);
+  if (!existsSync(p)) return [];
+  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+};
+
+// The chunked-feed lane: an over-cap change set is DELIVERED over turns and its delivery is PROVEN
+// by verbatim line echoes the final answer must reproduce.
+export const ARTIFACT_HEADER = '## The change set under review (assembled working-tree diff — repo-complete)';
+export const SHAPE_HEADER = '\n## Output — Markdown, this exact shape, nothing else';
+export const FED_CAP = 6000;
+export const MAX_COUNTABLE_PROOF_ADDRESS = 40;
+export const FED_WIDE_CAP = 24000;
+export const isAssemblerBanner = (line) =>
+  /^=== (repo file map|git status|staged diff|unstaged diff|untracked)/.test(line) && line.endsWith(' ===');
+
+export const seedFedChangeSet = (sb, { lines = 400, multibyte = false } = {}) => {
+  const body = Array.from({ length: lines }, (_, i) =>
+    multibyte
+      ? `line ${String(i).padStart(4, '0')} — multibyte marker ${'\u044e'.repeat(20)}`
+      : `unique change-set line ${String(i).padStart(4, '0')} — a distinctive body marker ${'x'.repeat(20)}`).join('\n');
+  writeFileSync(join(sb.repo, 'oversized.txt'), `${body}\n`);
+};
+
+export const inlineArtifactOf = (prompt) => prompt.slice(prompt.indexOf(ARTIFACT_HEADER), prompt.indexOf(SHAPE_HEADER));
+export const bodyOf = (turnPrompt) => {
+  const begin = turnPrompt.match(/--- BEGIN CHANGE-SET PART \d+ OF \d+ ---\n/);
+  if (!begin) return null;
+  const start = begin.index + begin[0].length;
+  return turnPrompt.slice(start, turnPrompt.indexOf('\n--- END CHANGE-SET PART ', start));
+};
+export const requestedBlockOf = (finalPrompt) => {
+  const start = finalPrompt.indexOf('Requested addresses');
+  assert.notEqual(start, -1, 'the final turn states which lines it requires');
+  const after2 = finalPrompt.slice(finalPrompt.indexOf('\n', start) + 1);
+  return after2.slice(0, after2.indexOf('\n###')).split('\n').filter(Boolean);
+};
+export const requestedOf = (finalPrompt) => requestedBlockOf(finalPrompt).map((item) => {
+  const [, part, line] = item.match(/^part (\d+) line (\d+)$/);
+  return { part: Number(part), line: Number(line) };
+});
+export const fedRun = (sb, extraEnv = {}) =>
+  run(sb, { args: ['code', '--facts', 'grounded fact'], env: { AGY_MAX_PROMPT_BYTES: String(FED_CAP), ...extraEnv } });

package/bridges/antigravity-cli-bridge/bin/agy-review-verdict.test.mjs

@@ -0,0 +1,109 @@
+// Contract under test: docs/ai/specs/bridges/agy-review-verdict.md (verdict-body honesty).
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rmSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeSandbox, run, readReceipts, seedFedChangeSet, fedRun } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const CONTRADICTION_OUTPUT = '### Verdict\nSHIP WITH NITS — solid, two nits.\n### Blocking\n1. correctness: drops the last chunk\n2. security: path traversal in the staging dir\n### Non-blocking\nnone\n### Questions\nnone';
+
+describe('agy-review.sh — a ship-class verdict cannot ride numbered Blocking findings', { concurrency: 2 }, () => {
+  // spec:agy-review-verdict/S1
+  it('a ship-class verdict beside a numbered Blocking item exits 4 with NO receipt — fresh and fed lanes alike', async () => {
+    const fresh = makeSandbox();
+    const r = await run(fresh, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const freshReceipts = readReceipts(fresh.repo);
+    rmSync(fresh.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(r.invoked, true, 'the contradiction is judged AFTER the run — a failed review, not a pre-spend refusal');
+    assert.equal(freshReceipts.length, 0, 'a contradictory run mints nothing');
+    const sb = makeSandbox();
+    seedFedChangeSet(sb);
+    const fed = await fedRun(sb, { AGY_FAKE_FINAL_APPEND: '### Blocking\n1. a numbered blocker the verdict ignores' });
+    const fedReceipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(fed.status, 4, fed.stderr);
+    assert.equal(fedReceipts.length, 0, 'the fed lane refuses the same shape after a PROVEN delivery');
+  });
+
+  // spec:agy-review-verdict/S2
+  it('a Blocking body of none — any case, trailing punctuation — mints exactly as today', async () => {
+    for (const noneForm of ['none', 'None.', 'NONE']) {
+      const sb = makeSandbox();
+      const output = `### Verdict\nSHIP WITH NITS — fine.\n### Blocking\n${noneForm}\n### Non-blocking\nnone\n### Questions\nnone`;
+      const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, `"${noneForm}" must pass: ${r.stderr}`);
+      assert.equal(receipts.length, 1);
+      assert.equal(receipts[0].verdict, 'SHIP WITH NITS');
+    }
+  });
+
+  // spec:agy-review-verdict/S3
+  it('REWORK is never refused by the cross-check, numbered Blocking items or not', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nREWORK — two real blockers.\n### Blocking\n1. the guard fails open\n2. the receipt lies\n### Non-blocking\nnone\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'a veto needs no corroboration');
+    assert.equal(receipts[0].verdict, 'REWORK');
+  });
+
+  // spec:agy-review-verdict/S4
+  it('an absent Blocking section is not a contradiction — the verdict-only read is unchanged', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: '### Verdict\nSHIP — clean, no sections beyond this one.' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the shape mandate lives in the prompt; absence is not judged here');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S5
+  it('the continuation lane refuses a contradictory verdict before its informational receipt', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['--continue'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(receipts.length, 0, 'a fresh:false receipt must not encode a contradiction either');
+  });
+
+  // spec:agy-review-verdict/S6
+  it('the refusal names both halves and the verdict is never rewritten or downgraded', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4);
+    assert.match(r.stderr, /SHIP WITH NITS — solid, two nits\./, 'the RAW verdict line is named, reason text included');
+    assert.match(r.stderr, /drops the last chunk/, 'the first numbered Blocking item is named');
+    assert.match(r.stderr, /[Rr]e-run the review/, 'the recovery is the same as every failed review');
+    assert.equal(receipts.length, 0, 'no rewritten or downgraded verdict is ever minted');
+  });
+
+  // spec:agy-review-verdict/S8
+  it('a second Blocking heading terminates the scan — only the first section is judged', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nSHIP — clean.\n### Blocking\nnone\n### Blocking\n1. a numbered item under a duplicate heading\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the first section said none — a later heading cannot suppress the receipt');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S7
+  it('the loadable skill text names the closed verdict vocabulary', async () => {
+    const skill = readFileSync(resolve(HERE, '..', 'SKILL.md'), 'utf8');
+    assert.match(skill, /SHIP \/ SHIP WITH NITS \/ REWORK/, 'the closed vocabulary is spelled in SKILL.md, not only in --help and failure stderr');
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -338,7 +338,7 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.7 Flash (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="5.3.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="5.4.0"  # aw-version-anchor
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
@@ -1070,6 +1070,14 @@ parse_agy_verdict() { # $1 = captured-output file
   fi
 }
 
+parse_agy_verdict_line() { # $1 = captured-output file
+  awk '/^### Verdict[[:space:]]*$/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null
+}
+
+parse_agy_blocking_first_numbered() { # $1 = captured-output file
+  awk 'flag && /^### /{exit} /^### Blocking[[:space:]]*$/{flag=1; next} flag && /^[0-9]+[.)]/{print; exit}' "$1" 2>/dev/null
+}
+
 # The repo file map is a FIXED cost that scales with REPO SIZE, not change size (measured 28,735
 # bytes in the home repo — 24% of agy's 120000-byte single-argv ceiling), so an unbounded map taxes
 # the change budget of every review. AW_REVIEW_MAP_BUDGET_BYTES bounds it; the value is set by each
@@ -2111,6 +2119,16 @@ if [[ $rc -eq 0 ]]; then
     echo "       the review; if it recurs, inspect the captured output for what the model produced." >&2
     exit 4
   fi
+  if [[ "$verdict" == "SHIP" || "$verdict" == "SHIP WITH NITS" ]]; then
+    first_blocking_item="$(parse_agy_blocking_first_numbered "$review_out_file")"
+    if [[ -n "$first_blocking_item" ]]; then
+      verdict_line="$(parse_agy_verdict_line "$review_out_file")"
+      echo "error: verdict-body contradiction — '### Verdict' reads '$verdict_line' while '### Blocking'" >&2
+      echo "       carries a numbered finding ($first_blocking_item). A ship-class verdict cannot" >&2
+      echo "       ride blocking findings; NO receipt was written. Re-run the review." >&2
+      exit 4
+    fi
+  fi
   if [[ -n "$resume_mode" ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /