@sabaiway/agent-workflow-kit 10.0.0 → 10.2.0

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -10,283 +10,11 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const WRAPPER = join(HERE, 'agy-review.sh');
-
-// Hermetic fake `agy`. PORTING TRAP: agy takes the prompt as the `-p` ARGV value, NOT stdin — so the
-// fake captures the -p value from argv (a stdin capture would make every prompt assertion vacuous).
-// It also records full argv, a couple of env vars, an invocation sentinel, and — for the oversized
-// --add-dir escape — the staging dir's perms + the offloaded artifact's perms/contents WHILE they
-// still exist (agy-review's trap removes the staging dir on exit). Kept inline so the file is
-// standalone (the kit mirror is byte-equality; no shared helper grows that set).
-// The envelope `agy --output-format json` returns: ONE object whose `response` carries the model's
-// text VERBATIM. Encoded in node so an arbitrary body (quotes, backslashes, multibyte) round-trips
-// exactly — hand-rolled JSON quoting in bash is the defect farm this fake exists to avoid.
-const FAKE_ENVELOPE_ENCODER = [
-  'const text = require("node:fs").readFileSync(0, "utf8");',
-  'const [cid, status, shape] = process.argv.slice(1);',
-  'const envelope = { conversation_id: cid, status, response: text, duration_seconds: 1.5, num_turns: 1,',
-  '  usage: { input_tokens: 10, output_tokens: 5, thinking_tokens: 0, cache_read_tokens: 0, total_tokens: 15 } };',
-  // The fed lane ROUTES later turns at this field, so the two ways it can be present-but-unusable —
-  // absent, and present with the wrong TYPE — are knobs, not just a bad-grammar string.
-  'if (shape === "missing") delete envelope.conversation_id;',
-  'if (shape === "number") envelope.conversation_id = 42;',
-  'process.stdout.write(`${JSON.stringify(envelope)}\\n`);',
-].join('\n');
-
-const FAKE_AGY = [
-  '#!/usr/bin/env bash',
-  'set -u',
-  // A capability probe is NOT a paid dispatch: --help / --version answer BEFORE any capture file is
-  // touched, so the wrapper's pre-spend door can never read as a spent run (the sentinel) nor shift
-  // the fed lane's per-turn counter. Keyed on the FIRST argument like the real CLI, so a prompt that
-  // merely CONTAINS "--help" is never intercepted.
-  'case "${1:-}" in',
-  '  --help|-h)',
-  '    if [[ -n "${AGY_FAKE_HELP_EXIT:-}" ]]; then echo "fake agy: help unavailable" >&2; exit "$AGY_FAKE_HELP_EXIT"; fi',
-  '    for f in --output-format --json-schema --disable-slash-commands --effort --mode; do',
-  '      if [[ "$f" == "${AGY_FAKE_HELP_OMIT:-}" ]]; then continue; fi',
-  '      printf "  %s   fake capability line\\n" "$f"',
-  '    done',
-  '    if [[ -n "${AGY_FAKE_HELP_EXTRA:-}" ]]; then printf "%s\\n" "$AGY_FAKE_HELP_EXTRA"; fi',
-  '    exit 0 ;;',
-  '  --version) printf "%s\\n" "${AGY_FAKE_VERSION:-1.1.13}"; exit 0 ;;',
-  'esac',
-  ': "${AGY_FAKE_ARGV:=/dev/null}"',
-  ': "${AGY_FAKE_ENV:=/dev/null}"',
-  ': "${AGY_FAKE_PROMPT:=/dev/null}"',
-  ': "${AGY_FAKE_SENTINEL:=/dev/null}"',
-  'printf invoked > "$AGY_FAKE_SENTINEL"',
-  // The fed lane dispatches from the private staging dir (deliberately — see the wrapper), so the
-  // fake's own cwd is the only handle a test has on a directory the exit trap then removes.
-  'printf "%s" "$PWD" > "${AGY_FAKE_CWD:-/dev/null}"',
-  '{ for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_FAKE_ARGV"',
-  '{ echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "ANTIGRAVITY_API_KEY=${ANTIGRAVITY_API_KEY:-<unset>}"; } > "$AGY_FAKE_ENV"',
-  'prompt=""',
-  'prev=""; for a in "$@"; do if [[ "$prev" == "-p" ]]; then prompt="$a"; printf "%s" "$a" > "$AGY_FAKE_PROMPT"; fi; prev="$a"; done',
-  // Every answer leaves through ONE emitter, so the transport is a property of the INVOCATION
-  // (`--output-format json` ⇒ an envelope, otherwise text) and every existing output knob keeps
-  // meaning exactly what it meant. AGY_FAKE_RAW_STDOUT bypasses the encoder entirely — the
-  // unparseable-payload arm; AGY_FAKE_STDERR is the CLI's own diagnostic.
-  'aw_fmt=""',
-  'prev=""; for a in "$@"; do if [[ "$prev" == "--output-format" ]]; then aw_fmt="$a"; fi; prev="$a"; done',
-  // AGY_FAKE_BAD_TURN scopes the two transport-breaking knobs to ONE turn: a fed run whose turn 1
-  // answers normally and whose turn 2 does not is the only way to reach the "no LATER turn is spent"
-  // arms — an unscoped knob breaks turn 1 and the run never gets there.
-  'aw_fake_emit() {',
-  '  local body="$1" aw_status="${AGY_FAKE_STATUS:-SUCCESS}" aw_raw=""',
-  '  if [[ -n "${AGY_FAKE_RAW_STDOUT+x}" ]]; then aw_raw=1; fi',
-  '  if [[ -n "${AGY_FAKE_BAD_TURN:-}" && "$turn" != "${AGY_FAKE_BAD_TURN}" ]]; then aw_status="SUCCESS"; aw_raw=""; fi',
-  '  if [[ -n "${AGY_FAKE_STDERR:-}" ]]; then printf "%s\\n" "$AGY_FAKE_STDERR" >&2; fi',
-  '  if [[ -n "$aw_raw" ]]; then printf "%s" "$AGY_FAKE_RAW_STDOUT"; return 0; fi',
-  '  if [[ "$aw_fmt" != "json" ]]; then printf "%s\\n" "$body"; return 0; fi',
-  `  printf "%s\\n" "$body" | node -e '${FAKE_ENVELOPE_ENCODER}' \\`,
-  '    "${AGY_FAKE_CONV_ID:-11111111-2222-3333-4444-555555555555}" "$aw_status" "${AGY_FAKE_CONV_SHAPE:-ok}"',
-  '}',
-  'prev=""; for a in "$@"; do',
-  '  if [[ "$prev" == "--add-dir" ]]; then',
-  '    printf "%s" "$a" > "${AGY_FAKE_ADDDIR:-/dev/null}"',
-  '    stat -c "%a" "$a" > "${AGY_FAKE_ADDDIR_MODE:-/dev/null}" 2>/dev/null || true',
-  '    art="$a/precomputed-change-set"',
-  '    if [[ -f "$art" ]]; then stat -c "%a" "$art" > "${AGY_FAKE_ARTIFACT_MODE:-/dev/null}" 2>/dev/null || true; cp "$art" "${AGY_FAKE_ARTIFACT_COPY:-/dev/null}" 2>/dev/null || true; fi',
-  '  fi; prev="$a"',
-  'done',
-  'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
-  // ── multi-turn support (the fed lane) ──────────────────────────────────────────────────────────
-  // The single-file captures above record the LAST invocation; a chunked feed needs a PER-TURN
-  // record, so each invocation also writes prompt/argv to "<file>.<turn>" and bumps a counter file.
-  'turn=1',
-  'if [[ -n "${AGY_FAKE_TURNS:-}" ]]; then',
-  '  if [[ -s "$AGY_FAKE_TURNS" ]]; then turn=$(( $(cat "$AGY_FAKE_TURNS") + 1 )); fi',
-  '  printf "%s" "$turn" > "$AGY_FAKE_TURNS"',
-  '  printf "%s" "$prompt" > "${AGY_FAKE_PROMPT}.$turn"',
-  '  { for a in "$@"; do printf "%s\\n" "$a"; done; } > "${AGY_FAKE_ARGV}.$turn"',
-  'fi',
-  'if [[ -n "${AGY_FAKE_FAIL_TURN:-}" && "$turn" == "${AGY_FAKE_FAIL_TURN}" ]]; then',
-  '  printf "FAKE_TURN_FAILURE\\n" >&2; exit 3',
-  'fi',
-  // A FEED turn: the model was told to reply OK only. This fake deliberately misbehaves — it emits a
-  // PREMATURE verdict — so the isolation invariant (feed output never reaches stdout or the parsed
-  // capture) is proven against the worst case, not the polite one.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"--- BEGIN CHANGE-SET PART "* && "$prompt" != *"Requested addresses"* ]]; then',
-  '  aw_fake_emit "$(printf "PREMATURE_FEED_CHATTER\\n### Verdict\\nREWORK")"; exit 0',
-  'fi',
-  // The FINAL turn carries the delivery-proof request. The fake answers it the only honest way:
-  // by reading the bodies it was actually fed, turn by turn — so a wrapper that never delivered a
-  // part cannot be satisfied by this stub either.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"Requested addresses"* ]]; then',
-  '  req="$(printf "%s" "$prompt" | awk "/^Requested addresses/{f=1; next} f && /^###/{exit} f{print}")"',
-  '  entries=()',
-  '  mapfile -t _items <<< "$req"',
-  '  for _it in "${_items[@]}"; do',
-  '    [[ -n "$_it" ]] || continue',
-  '    k="$(printf "%s" "$_it" | awk "{print \\$2}")"; l="$(printf "%s" "$_it" | awk "{print \\$4}")"',
-  '    src="$k"',
-  '    if [[ "${AGY_FAKE_PROOF_DUP:-}" == "1" ]]; then src=1; fi',
-  '    if [[ "${AGY_FAKE_PROOF_OMIT:-}" == "$k" ]]; then continue; fi',
-  '    body="$(awk -v want="$l" "f && /^--- END CHANGE-SET PART /{exit} f{c++; if (c==want) {print; exit}} /^--- BEGIN CHANGE-SET PART /{f=1}" "${AGY_FAKE_PROMPT}.$src")"',
-  '    if [[ "${AGY_FAKE_PROOF_CORRUPT:-}" == "$k" ]]; then body="${body}X"; fi',
-  '    entry="$(printf "part %s line %s: %s" "$k" "$l" "$body")"',
-  // Shape knobs the grammar must survive (a bullet) or reject (everything else).
-  '    if [[ "${AGY_FAKE_PROOF_BULLET:-}" == "1" ]]; then entry="- $entry"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_NESTED:-}" == "$k" ]]; then entry="note: I believe $entry"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_PAD:-}" == "1" ]]; then entry="$(printf "part %02d line %04d: %s" "$k" "$l" "$body")"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then entry="$(printf "Part %s Line %s: %s" "$k" "$l" "$body")"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_HUGE:-}" == "$k" ]]; then entry="$(printf "part %s line 99999999999999999999: %s" "$k" "$body")"; fi',
-  '    entries+=("$entry")',
-  '    if [[ "${AGY_FAKE_PROOF_TWICE:-}" == "1" ]]; then entries+=("$entry"); fi',
-  '  done',
-  '  if [[ "${AGY_FAKE_PROOF_EXTRA:-}" == "1" ]]; then entries+=("part 99 line 1: an address nobody asked for"); fi',
-  '  if [[ "${AGY_FAKE_PROOF_HUGE_EXTRA:-}" == "1" ]]; then entries+=("part 99999999999999999999 line 1: an invented giant address"); fi',
-  '  out="$( {',
-  '    if [[ "${AGY_FAKE_PROOF_LATE:-}" == "1" ]]; then printf "### Verdict\\nSHIP\\n"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then printf "### Delivery Proof\\n"; else printf "### Delivery proof\\n"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_OUTSIDE:-}" == "1" ]]; then',
-  '      printf "(nothing here)\\n### Verdict\\nSHIP\\n"',
-  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
-  '    else',
-  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
-  '      printf "### Verdict\\nSHIP\\n"',
-  '    fi',
-  '  } )"',
-  '  aw_fake_emit "$out"',
-  '  exit 0',
-  'fi',
-  // Unset AGY_FAKE_OUTPUT → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
-  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then aw_fake_emit "$(printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP")"; else aw_fake_emit "$AGY_FAKE_OUTPUT"; fi',
-  'exit "${AGY_FAKE_EXIT:-0}"',
-  '',
-].join('\n');
-
-// A PATH whose entries are symlinks to the real PATH binaries EXCEPT the excluded names. Excluding
-// `agy-run` forces agy-review onto its `$HERE/agy.sh` fallback (the repo's CURRENT agy.sh, not a
-// possibly-stale installed one), keeping the test hermetic; excluding `agy` ensures the only agy is
-// our fake (prepended via $HOME/.local/bin). Ported from codex-review.test.mjs.
-const makePathWithout = (root, exclude = []) => {
-  const skip = new Set(exclude);
-  const dir = mkdtempSync(join(root, 'nobin-'));
-  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
-    let names;
-    try { names = readdirSync(d); } catch { continue; }
-    for (const name of names) {
-      if (skip.has(name)) continue;
-      const link = join(dir, name);
-      if (existsSync(link)) continue;
-      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
-    }
-  }
-  return dir;
-};
-
-// The PATH farms and the sandbox base are READ-ONLY per invocation, so both are built ONCE and
-// shared: a per-run farm rebuild (thousands of symlinks) plus a per-test `git init`+commit were
-// the suite's dominant wall cost, not the wrapper under test.
-const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
-after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
-const farms = new Map();
-const farmFor = (exclude) => {
-  const key = exclude.join('|');
-  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
-  return farms.get(key);
-};
-
-const TEMPLATE_HOME = (() => {
-  const home = join(SHARED_ROOT, 'template-home');
-  const bin = join(home, '.local', 'bin');
-  mkdirSync(bin, { recursive: true });
-  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
-  const repo = join(home, 'repo');
-  mkdirSync(repo);
-  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
-  g('init', '-q');
-  g('config', 'user.email', 'probe@example.com');
-  g('config', 'user.name', 'probe');
-  writeFileSync(join(repo, 'base.txt'), 'committed base\n');
-  g('add', '-A');
-  g('commit', '-qm', 'base');
-  return home;
-})();
-
-// `clean: true` leaves a pristine committed tree (for the no-diff preflight); the default leaves one
-// untracked file so `code` mode has a diff to review.
-const makeSandbox = ({ clean = false } = {}) => {
-  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
-  cpSync(TEMPLATE_HOME, home, { recursive: true });
-  const bin = join(home, '.local', 'bin');
-  chmodSync(join(bin, 'agy'), 0o755);
-  const repo = join(home, 'repo');
-  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
-  if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
-  return { home, bin, repo, g };
-};
-
-// Capture files are per-INVOCATION: a second run() on the same sandbox must not inherit the first
-// run's turn counter or per-turn prompt files (the fed lane reads them back by turn index).
-let runSeq = 0;
-// ASYNCHRONOUS on purpose. A blocking spawnSync here holds the event loop for the whole dispatch,
-// which pinned this file to ONE core: 208 points in a serial chain, 91.4s solo at 103% CPU while
-// the other seven cores idled. Awaiting the child instead lets a `{ concurrency }` describe
-// overlap its tests. The per-test environment still rides the CHILD's options — `process.env` is
-// never mutated, which is what keeps overlapping tests from reading each other's PATH.
-const run = (sb, { args, env = {}, cwd, wrapper } = {}) => new Promise((settle) => {
-  const { home, bin, repo } = sb;
-  const farm = farmFor(['agy', 'agy-run']);
-  const tag = `cap-${++runSeq}`;
-  const cap = {
-    argv: join(home, `${tag}-argv`), env: join(home, `${tag}-env`), prompt: join(home, `${tag}-prompt`),
-    sentinel: join(home, `${tag}-sentinel`), adddir: join(home, `${tag}-adddir`),
-    adddirMode: join(home, `${tag}-adddir-mode`), artifactMode: join(home, `${tag}-artifact-mode`),
-    artifactCopy: join(home, `${tag}-artifact-copy`), turns: join(home, `${tag}-turns`),
-    dispatchCwd: join(home, `${tag}-dispatch-cwd`),
-  };
-  const child = execFile('bash', [wrapper || WRAPPER, ...args], {
-    cwd: cwd || repo,
-    encoding: 'utf8',
-    timeout: 30000,
-    maxBuffer: 64 * 1024 * 1024,
-    env: {
-      HOME: home,
-      PATH: `${bin}:${farm}`,
-      // Keep the wrapper's mktemp working when the suite runs inside an OS sandbox whose /tmp is
-      // read-only (only $TMPDIR is writable there).
-      TMPDIR: process.env.TMPDIR ?? '/tmp',
-      AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
-      AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
-      AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
-      AGY_FAKE_TURNS: cap.turns, AGY_FAKE_CWD: cap.dispatchCwd,
-      ...env,
-    },
-  }, (error, stdout, stderr) => {
-    const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
-    // Per-turn captures are read EAGERLY: callers rmSync the sandbox before asserting.
-    const turns = existsSync(cap.turns) ? Number(readFileSync(cap.turns, 'utf8')) : 0;
-    const prompts = [];
-    const argvs = [];
-    for (let i = 1; i <= turns; i += 1) {
-      prompts.push(readIf(`${cap.prompt}.${i}`));
-      argvs.push(readIf(`${cap.argv}.${i}`));
-    }
-    settle({
-      status: error ? (error.code ?? 1) : 0, signal: error?.signal ?? null, stdout, stderr,
-      invoked: existsSync(cap.sentinel),
-      argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
-      adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
-      artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
-      dispatchCwd: readIf(cap.dispatchCwd).trim(), turns, prompts, argvs,
-    });
-  });
-  // The wrapper refuses many inputs BEFORE it reads stdin, so the pipe can already be closed here.
-  // The blocking spawn swallowed that; an async one throws EPIPE at the test. A closed pipe is the
-  // refusal working — but ONLY EPIPE is: any other write failure is a real fault and must reach
-  // the test instead of passing as a green.
-  child.stdin.on('error', (err) => { if (err.code !== 'EPIPE') throw err; });
-  child.stdin.end();
-});
-
-// runAsync was the async twin kept for the two sleep-bound timeout tests, back when run() blocked.
-// run() IS that twin now, with the fuller capture surface, so the twin is one name pointing at it
-// — two spawn paths could only drift.
-const runAsync = run;
+import {
+  WRAPPER, farmFor, makeSandbox, run, runAsync, readReceipts, RECEIPTS_REL,
+  ARTIFACT_HEADER, SHAPE_HEADER, FED_CAP, FED_WIDE_CAP, MAX_COUNTABLE_PROOF_ADDRESS,
+  isAssemblerBanner, seedFedChangeSet, inlineArtifactOf, bodyOf, requestedBlockOf, requestedOf, fedRun,
+} from './agy-review-harness.test.mjs';
 
 describe('agy-review.sh — model policy advisory (1)', { concurrency: 2 }, () => {
   it('warns for a non-frontier model but still runs', async () => {
@@ -935,59 +663,6 @@ describe('agy-review.sh — repo file map budget (Phase 2)', { concurrency: 2 },
   });
 });
 
-// ── the chunked-feed code review with PROVEN delivery (Phase 3) ──────────────────────────────────
-// agy takes its prompt as ONE argv, and this host AUTO-DENIES agy's native read_file tool — so an
-// over-cap change set can never be FETCHED by the model. It is DELIVERED instead: partitioned into
-// under-cap parts, fed over continuation turns, then reviewed in a final turn. Delivery is PROVEN,
-// never assumed: the wrapper picks a line from each part's body AFTER assembly and the final answer
-// must reproduce every picked line verbatim. Envelope and body are formally separate — only BODIES
-// concatenate, and they concatenate to the change set byte-for-byte.
-const ARTIFACT_HEADER = '## The change set under review (assembled working-tree diff — repo-complete)';
-const SHAPE_HEADER = '\n## Output — Markdown, this exact shape, nothing else';
-const FED_CAP = 6000;
-// The proof asks the model to COUNT to the address with no tool, so the address has to be reachable
-// that way. The walk used to start at each part's middle: measured 847..1024 on a 701464-byte change
-// set, which is where the three live false refusals sat. FED_WIDE_CAP gives the countability
-// regression parts wide enough that a midpoint address is unmistakably out of reach — under the
-// narrow FED_CAP the midpoint lands at 80, close enough to the bar that fixture drift could hide it.
-const MAX_COUNTABLE_PROOF_ADDRESS = 40;
-const FED_WIDE_CAP = 24000;
-// The assembler's OWN section banners — the vocabulary the proof selector refuses, because it emits
-// them for every change set and a model can rebuild the per-path forms from part 1's git-status
-// block. A change set's own `=== … ===` line is NOT in this set and stays admissible.
-const isAssemblerBanner = (line) =>
-  /^=== (repo file map|git status|staged diff|unstaged diff|untracked)/.test(line) && line.endsWith(' ===');
-
-// A change set big enough to need several parts under FED_CAP.
-const seedFedChangeSet = (sb, { lines = 400, multibyte = false } = {}) => {
-  const body = Array.from({ length: lines }, (_, i) =>
-    multibyte
-      ? `line ${String(i).padStart(4, '0')} — multibyte marker ${'\u044e'.repeat(20)}`
-      : `unique change-set line ${String(i).padStart(4, '0')} — a distinctive body marker ${'x'.repeat(20)}`).join('\n');
-  writeFileSync(join(sb.repo, 'oversized.txt'), `${body}\n`);
-};
-
-const inlineArtifactOf = (prompt) => prompt.slice(prompt.indexOf(ARTIFACT_HEADER), prompt.indexOf(SHAPE_HEADER));
-const bodyOf = (turnPrompt) => {
-  const begin = turnPrompt.match(/--- BEGIN CHANGE-SET PART \d+ OF \d+ ---\n/);
-  if (!begin) return null;
-  const start = begin.index + begin[0].length;
-  return turnPrompt.slice(start, turnPrompt.indexOf('\n--- END CHANGE-SET PART ', start));
-};
-// The addresses ride ONE PER LINE — that format is what makes a collision with a proof candidate
-// constructively impossible, so the parser reads lines, never a delimiter-joined field.
-const requestedBlockOf = (finalPrompt) => {
-  const start = finalPrompt.indexOf('Requested addresses');
-  assert.notEqual(start, -1, 'the final turn states which lines it requires');
-  const after = finalPrompt.slice(finalPrompt.indexOf('\n', start) + 1);
-  return after.slice(0, after.indexOf('\n###')).split('\n').filter(Boolean);
-};
-const requestedOf = (finalPrompt) => requestedBlockOf(finalPrompt).map((item) => {
-  const [, part, line] = item.match(/^part (\d+) line (\d+)$/);
-  return { part: Number(part), line: Number(line) };
-});
-const fedRun = (sb, extraEnv = {}) =>
-  run(sb, { args: ['code', '--facts', 'grounded fact'], env: { AGY_MAX_PROMPT_BYTES: String(FED_CAP), ...extraEnv } });
 
 describe('agy-review.sh — chunked feed: the change set is DELIVERED (Phase 3)', { concurrency: 2 }, () => {
   it('an over-cap code review feeds every part and the concatenated BODIES reproduce the change set exactly', async () => {
@@ -2368,12 +2043,6 @@ describe('agy-review.sh — declared contract is really accepted (forward guard)
 const RECEIPT_FIXTURE = JSON.parse(
   '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<display>"},"delivery":"inline"}',
 );
-const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
-const readReceipts = (repo) => {
-  const p = join(repo, RECEIPTS_REL);
-  if (!existsSync(p)) return [];
-  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
-};
 const sha256HexOf = async (buf) => {
   const { createHash } = await import('node:crypto');
   return createHash('sha256').update(buf).digest('hex');

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.7 Flash (High)" },
   "roles": {

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/tools/fold-scope.mjs

@@ -44,25 +44,52 @@ const contains = (haystack, needle) => normalize(haystack).toLowerCase().include
 // AND a boundary: it closes the block it interrupts, so text past a fence can never join the bullet
 // before it (which would let a far-side literal satisfy a near-side claim). A `-` plus any whitespace
 // run opens a block; a blank or indented line continues it; any other unindented line closes it.
-// Blocks are returned RAW (their own lines) — the queue reader needs the field lines inside them.
-const bulletBlocks = (lines, fencedLines, from, to) => {
+// Blocks are returned RAW (their own lines) — the queue reader needs the field lines inside them —
+// each carrying the body index it OPENS at, because a second reader (queue-audit.mjs) reports rows by
+// file line and a scan that dropped the index would have to re-derive it against a different grammar.
+//
+// `fenceContinues` is the SECOND reader's question, and it is a different one. A deferral row asks
+// what a bullet CLAIMS, so a fence must cut it. A queue row asks what a bullet COSTS and whether it
+// is still work, and there the fence-as-boundary is a hole: measured, a row carrying a code block
+// reported ONE line and its `**DONE 2026-01-01:**` two lines further down was invisible, so the
+// per-row cap could be walked straight past and a closure went unseen.
+//
+// Under the option only a NESTED fence continues an open block — one whose opening line is indented,
+// which is what makes it part of the list item at all. A fence opening at column 0 is a
+// DOCUMENT-level block and still closes the row, exactly as an unindented line does; absorbing it
+// charged a one-line row for six. The run is decided ONCE, at its opening line, so a content line
+// inside it cannot re-decide the question.
+//
+// The absorbed lines never enter `lines` — a marker inside a quotation is not a status — so the
+// block records where they were: `span` is the row's PHYSICAL extent, and `gaps` holds the `lines`
+// indices a fence run follows, so a reader assembling a multi-line span cannot join text from both
+// sides of a code block into one claim.
+export const bulletBlocks = (lines, fencedLines, from, to, { fenceContinues = false } = {}) => {
   const blocks = [];
   let current = null;
+  let absorbing = null;
   const close = () => {
     if (current) blocks.push(current);
     current = null;
   };
   for (let index = from; index < to; index += 1) {
     if (fencedLines.has(index)) {
-      close();
+      if (absorbing === null) absorbing = Boolean(fenceContinues && current && /^\s+\S/.test(lines[index]));
+      if (!absorbing) close();
+      else {
+        current.span += 1;
+        current.gaps.add(current.lines.length - 1);
+      }
       continue;
     }
+    absorbing = null;
     const line = lines[index];
     if (BULLET.test(line)) {
       close();
-      current = [line];
+      current = { start: index, lines: [line], span: 1, gaps: new Set() };
     } else if (current && (line.trim() === '' || /^\s+\S/.test(line))) {
-      current.push(line);
+      current.lines.push(line);
+      current.span += 1;
     } else {
       close();
     }
@@ -83,7 +110,7 @@ export const extractAcceptance = (planText) => {
   if (!open) return [];
   const next = headings.find((heading) => heading.index > open.index && heading.level <= 2);
   return bulletBlocks(lines, fencedLines, open.index + 1, next ? next.index : lines.length)
-    .map((block) => normalize(block.join('\n').replace(/^-\s+/, '')))
+    .map((block) => normalize(block.lines.join('\n').replace(/^-\s+/, '')))
     .filter(Boolean);
 };
 
@@ -134,7 +161,7 @@ const exposureOf = (value) => {
 
 const topLevelRows = (queueText) => {
   const { lines, fencedLines } = tokenizeMarkdown(String(queueText ?? ''), 'the queue');
-  return bulletBlocks(lines, fencedLines, 0, lines.length).map((block) => block.join('\n'));
+  return bulletBlocks(lines, fencedLines, 0, lines.length).map((block) => block.lines.join('\n'));
 };
 
 const EMPTY_ROW = () => ({ found: false, matches: 0, fields: {}, missing: [...ROW_FIELDS], duplicates: [], exposure: null, closed: null, claimInInvariant: false });

package/tools/queue-audit-cli.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// The CLI half of the queue auditor: argv and fs, no rule (the rule is queue-audit.mjs).
+//
+// Split for the same reason fold-scope is split — a module you can hold whole is the unit of review,
+// and the rules file had reached the source-size cap. Read-only: it reads the file it is pointed at
+// and writes nothing. Dependency-free, Node >= 22.
+//
+// Exit codes: 0 accept; 1 refuse (a terminal/record row still listed, or a cap breach); 2 usage —
+// a missing/unknown flag, a flag with no value, an unreadable path, or a section that is not there.
+
+import { readFileSync } from 'node:fs';
+import { fail } from '../references/scripts/markdown-blocks.mjs';
+import { isDirectRun } from './direct-run.mjs';
+import { CLASSES, DEFAULTS, auditQueue, checkQueue, formatReport } from './queue-audit.mjs';
+
+const HELP = `queue-audit — classify the backlog queue's rows (agent-workflow family).
+
+Usage:
+  node queue-audit-cli.mjs --report <queue-file> [--section "## Pending / backlog (newest)"]
+  node queue-audit-cli.mjs --check  <queue-file> [--section "…"] [--max-rows N] [--max-row-lines N]
+
+--report  one tab-separated line per row: file line, class, row length, title, the literal evidence.
+          Deterministic — this is the manifest a deletion is driven by, never a regex guess.
+--check   refuses when a terminal or record row is still listed, when a row over the per-row line cap
+          carries work (live, parked and ambiguous alike), or when more rows than the row cap carry
+          work. Ambiguous rows are reported and never refuse on their own: a row that contradicts
+          itself, or names a status word outside a status position, is settled by a human.
+
+Classes: ${CLASSES.join(' · ')}. Defaults: --max-rows ${DEFAULTS.maxRows}, --max-row-lines ${DEFAULTS.maxRowLines}.
+
+Exit codes: 0 accept; 1 refuse; 2 usage (missing/unknown flag, unreadable path, bad section).`;
+
+// A flag whose value is MISSING refuses. `--section` with nothing after it used to fall through to
+// `null`, which means "audit the whole document" — silently widening the domain of a report a
+// deletion is driven by, in exactly the direction that costs live rows.
+const valueOf = (argv, index, flag) => {
+  const value = argv[index + 1];
+  if (value === undefined || value === '' || value.startsWith('--')) throw fail(2, `${flag} takes a value`);
+  return value;
+};
+
+const parseArgv = (argv) => {
+  // `--help` is answered ONLY when it is the whole invocation. A help flag that wins from anywhere
+  // makes `--check <dirty-file> --help` exit 0 — the gate's refusal replaced by a help page, which
+  // is the same bypass a second mode flag would be, reached by a flag nobody reads as dangerous.
+  if (argv.length === 1 && (argv[0] === '--help' || argv[0] === '-h')) return { mode: 'help' };
+  const options = { mode: null, path: null, section: null };
+  // Every option here is a SINGLETON. A repeat used to win silently: a second `--section` moved the
+  // domain the report covers and a softer `--max-rows` moved the ratchet, both without a word — and
+  // both in the direction that lets a queue keep rows a check would have refused.
+  const seen = new Set();
+  const once = (flag) => {
+    if (seen.has(flag)) throw fail(2, `${flag} was given twice — each option is named exactly once`);
+    seen.add(flag);
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') throw fail(2, '--help is answered only when it is the whole invocation — it never rides another mode');
+    else if (arg === '--report' || arg === '--check') {
+      // The mode is set ONCE. A later flag overwriting an earlier one would let `--check <f>
+      // --report <f>` answer a refusal question with an exit-0 report — the gate's verdict replaced
+      // by a listing, silently. Repetition is as wrong as conflict: both mean the caller asked two
+      // questions and only one was answered.
+      if (options.mode) throw fail(2, `--${options.mode} was already given — name exactly one of --report or --check`);
+      options.mode = arg.slice(2);
+      options.path = valueOf(argv, index, arg);
+      index += 1;
+    } else if (arg === '--section') {
+      once(arg);
+      options.section = valueOf(argv, index, arg);
+      index += 1;
+    } else if (arg === '--max-rows' || arg === '--max-row-lines') {
+      once(arg);
+      const value = Number(valueOf(argv, index, arg));
+      if (!Number.isInteger(value) || value <= 0) throw fail(2, `${arg} takes a positive integer, got "${argv[index + 1]}"`);
+      options[arg === '--max-rows' ? 'maxRows' : 'maxRowLines'] = value;
+      index += 1;
+    } else throw fail(2, `unknown argument "${arg}" — run with --help`);
+  }
+  if (!options.mode) throw fail(2, 'one of --report or --check is required — run with --help');
+  if (!options.path) throw fail(2, `${`--${options.mode}`} takes a queue file path`);
+  // A cap named beside `--report` used to be accepted and then ignored, and the run still exited 0 —
+  // so an operator who meant to ask a question about the caps was told nothing and read the silence
+  // as an answer. The caps belong to `--check`; naming one here is a usage error, not a no-op.
+  const capsInReport = ['--max-rows', '--max-row-lines'].filter((flag) => seen.has(flag));
+  if (options.mode === 'report' && capsInReport.length) {
+    throw fail(2, `${capsInReport.join(' and ')} ${capsInReport.length > 1 ? 'are' : 'is'} a --check option — --report lists every row and judges no cap`);
+  }
+  return options;
+};
+
+export const main = (argv, { log = console.log, error = console.error } = {}) => {
+  let options;
+  try {
+    options = parseArgv(argv);
+  } catch (err) {
+    error(err.message);
+    return err.exitCode ?? 2;
+  }
+  if (options.mode === 'help') {
+    log(HELP);
+    return 0;
+  }
+
+  let text;
+  try {
+    text = readFileSync(options.path, 'utf8');
+  } catch (err) {
+    error(`cannot read ${options.path}: ${err.message}`);
+    return 2;
+  }
+
+  try {
+    if (options.mode === 'report') {
+      log(formatReport(auditQueue(text, { section: options.section, label: options.path }), { label: options.path }));
+      return 0;
+    }
+    const result = checkQueue(text, { ...options, label: options.path });
+    for (const note of result.notes) log(note);
+    for (const problem of result.problems) error(problem);
+    log(
+      `${options.path}: ${result.total} rows — ` +
+        CLASSES.map((klass) => `${result.counts[klass]} ${klass}`).join(' · '),
+    );
+    return result.ok ? 0 : 1;
+  } catch (err) {
+    error(err.message);
+    return err.exitCode ?? 1;
+  }
+};
+
+// `process.exitCode`, never `process.exit()`: stdout is a PIPE under a gate runner, and an immediate
+// exit drops whatever of a large `--report` has not been flushed yet. A truncated manifest is worse
+// than none — it is the document a deletion is driven by, and a short one reads as a complete one.
+if (isDirectRun(import.meta.url)) process.exitCode = main(process.argv.slice(2));