@sabaiway/agent-workflow-kit 10.1.0 → 10.2.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 10.2.0 — a review can no longer pass a change it called broken (AD-122)
+
+Ships antigravity-cli-bridge **5.4.0** in the bundled bridge tree. A consumer recorded a clean
+`SHIP WITH NITS` receipt over a review body that named a correctness bug and a security violation
+under `### Blocking` — the wrapper read the verdict line and nothing read the section. Now a
+ship-class verdict beside a numbered Blocking item is a verdict-body contradiction and takes the
+existing failed-review arm: exit 4, no receipt, both halves named, re-run the review. `REWORK` is
+never refused — a veto needs no corroboration, only a pass does — an absent Blocking section is not
+a contradiction, and a repeated heading terminates the scan, so exactly one section is ever judged.
+
+The guard was written to a contract first (`docs/ai/specs/bridges/agy-review-verdict.md`, eight
+scenarios), and the bridge's test suite was split in the same change: the shared fixture surface
+moved to `bin/agy-review-harness.test.mjs`, the wrapper suite shrank to 2893 lines with all 213
+existing arms green, and the new contract got its own topic file. Both new files ship with the
+bridge tree, so the tarball count pin moves 257 → 259.
+
 ## 10.1.0 — no work without a specification, and a ratchet that does not trust its own file (AD-121)
 
 A shipped tool that no LIVE contract claims is now a REFUSAL, not a preference. `tools/spec-coverage.mjs`

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '10.1.0'
+  version: '10.2.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '5.3.0'
+  version: '5.4.0'
 ---
 
 # antigravity-cli-bridge
@@ -163,7 +163,9 @@ billed turn restating the model's own prose (16,585 → 33,446 tokens on a match
 
 **Honesty + posture (D4/D5):** a run with no recognized `### Verdict` section — empty output
 included — **exits 4 with NO receipt**: treat it as a *failed review to re-run*, never a fatal
-session error. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
+session error. The verdict vocabulary is closed (SHIP / SHIP WITH NITS / REWORK), and a
+ship-class verdict arriving beside a numbered `### Blocking` finding is a verdict-body
+contradiction: the same exit 4, NO receipt, both halves named. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
 and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
 pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`

package/bridges/antigravity-cli-bridge/bin/agy-review-harness.test.mjs

@@ -0,0 +1,288 @@
+// Shared harness for the agy-review wrapper suites. PORTING TRAP: agy takes the prompt as the
+// `-p` ARGV value, NOT stdin — the fake captures the -p value from argv.
+import assert from 'node:assert/strict';
+import { after } from 'node:test';
+import {
+  mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFile } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const WRAPPER = join(HERE, 'agy-review.sh');
+
+const FAKE_ENVELOPE_ENCODER = [
+  'const text = require("node:fs").readFileSync(0, "utf8");',
+  'const [cid, status, shape] = process.argv.slice(1);',
+  'const envelope = { conversation_id: cid, status, response: text, duration_seconds: 1.5, num_turns: 1,',
+  '  usage: { input_tokens: 10, output_tokens: 5, thinking_tokens: 0, cache_read_tokens: 0, total_tokens: 15 } };',
+  'if (shape === "missing") delete envelope.conversation_id;',
+  'if (shape === "number") envelope.conversation_id = 42;',
+  'process.stdout.write(`${JSON.stringify(envelope)}\\n`);',
+].join('\n');
+
+export const FAKE_AGY = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  // --help / --version answer BEFORE any capture file is touched — a probe is never a paid dispatch.
+  'case "${1:-}" in',
+  '  --help|-h)',
+  '    if [[ -n "${AGY_FAKE_HELP_EXIT:-}" ]]; then echo "fake agy: help unavailable" >&2; exit "$AGY_FAKE_HELP_EXIT"; fi',
+  '    for f in --output-format --json-schema --disable-slash-commands --effort --mode; do',
+  '      if [[ "$f" == "${AGY_FAKE_HELP_OMIT:-}" ]]; then continue; fi',
+  '      printf "  %s   fake capability line\\n" "$f"',
+  '    done',
+  '    if [[ -n "${AGY_FAKE_HELP_EXTRA:-}" ]]; then printf "%s\\n" "$AGY_FAKE_HELP_EXTRA"; fi',
+  '    exit 0 ;;',
+  '  --version) printf "%s\\n" "${AGY_FAKE_VERSION:-1.1.13}"; exit 0 ;;',
+  'esac',
+  ': "${AGY_FAKE_ARGV:=/dev/null}"',
+  ': "${AGY_FAKE_ENV:=/dev/null}"',
+  ': "${AGY_FAKE_PROMPT:=/dev/null}"',
+  ': "${AGY_FAKE_SENTINEL:=/dev/null}"',
+  'printf invoked > "$AGY_FAKE_SENTINEL"',
+  'printf "%s" "$PWD" > "${AGY_FAKE_CWD:-/dev/null}"',
+  '{ for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_FAKE_ARGV"',
+  '{ echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "ANTIGRAVITY_API_KEY=${ANTIGRAVITY_API_KEY:-<unset>}"; } > "$AGY_FAKE_ENV"',
+  'prompt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "-p" ]]; then prompt="$a"; printf "%s" "$a" > "$AGY_FAKE_PROMPT"; fi; prev="$a"; done',
+  'aw_fmt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "--output-format" ]]; then aw_fmt="$a"; fi; prev="$a"; done',
+  // AGY_FAKE_BAD_TURN scopes the transport-breaking knobs to ONE turn; AGY_FAKE_RAW_STDOUT bypasses
+  // the envelope encoder entirely.
+  'aw_fake_emit() {',
+  '  local body="$1" aw_status="${AGY_FAKE_STATUS:-SUCCESS}" aw_raw=""',
+  '  if [[ -n "${AGY_FAKE_RAW_STDOUT+x}" ]]; then aw_raw=1; fi',
+  '  if [[ -n "${AGY_FAKE_BAD_TURN:-}" && "$turn" != "${AGY_FAKE_BAD_TURN}" ]]; then aw_status="SUCCESS"; aw_raw=""; fi',
+  '  if [[ -n "${AGY_FAKE_STDERR:-}" ]]; then printf "%s\\n" "$AGY_FAKE_STDERR" >&2; fi',
+  '  if [[ -n "$aw_raw" ]]; then printf "%s" "$AGY_FAKE_RAW_STDOUT"; return 0; fi',
+  '  if [[ "$aw_fmt" != "json" ]]; then printf "%s\\n" "$body"; return 0; fi',
+  `  printf "%s\\n" "$body" | node -e '${FAKE_ENVELOPE_ENCODER}' \\`,
+  '    "${AGY_FAKE_CONV_ID:-11111111-2222-3333-4444-555555555555}" "$aw_status" "${AGY_FAKE_CONV_SHAPE:-ok}"',
+  '}',
+  'prev=""; for a in "$@"; do',
+  '  if [[ "$prev" == "--add-dir" ]]; then',
+  '    printf "%s" "$a" > "${AGY_FAKE_ADDDIR:-/dev/null}"',
+  '    stat -c "%a" "$a" > "${AGY_FAKE_ADDDIR_MODE:-/dev/null}" 2>/dev/null || true',
+  '    art="$a/precomputed-change-set"',
+  '    if [[ -f "$art" ]]; then stat -c "%a" "$art" > "${AGY_FAKE_ARTIFACT_MODE:-/dev/null}" 2>/dev/null || true; cp "$art" "${AGY_FAKE_ARTIFACT_COPY:-/dev/null}" 2>/dev/null || true; fi',
+  '  fi; prev="$a"',
+  'done',
+  'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
+  // The fed lane needs a PER-TURN record: each invocation writes prompt/argv to "<file>.<turn>".
+  'turn=1',
+  'if [[ -n "${AGY_FAKE_TURNS:-}" ]]; then',
+  '  if [[ -s "$AGY_FAKE_TURNS" ]]; then turn=$(( $(cat "$AGY_FAKE_TURNS") + 1 )); fi',
+  '  printf "%s" "$turn" > "$AGY_FAKE_TURNS"',
+  '  printf "%s" "$prompt" > "${AGY_FAKE_PROMPT}.$turn"',
+  '  { for a in "$@"; do printf "%s\\n" "$a"; done; } > "${AGY_FAKE_ARGV}.$turn"',
+  'fi',
+  'if [[ -n "${AGY_FAKE_FAIL_TURN:-}" && "$turn" == "${AGY_FAKE_FAIL_TURN}" ]]; then',
+  '  printf "FAKE_TURN_FAILURE\\n" >&2; exit 3',
+  'fi',
+  // A FEED turn deliberately misbehaves (a premature verdict) so the isolation invariant is proven
+  // against the worst case.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"--- BEGIN CHANGE-SET PART "* && "$prompt" != *"Requested addresses"* ]]; then',
+  '  aw_fake_emit "$(printf "PREMATURE_FEED_CHATTER\\n### Verdict\\nREWORK")"; exit 0',
+  'fi',
+  // The FINAL turn answers the delivery-proof request honestly: by reading the bodies it was fed.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"Requested addresses"* ]]; then',
+  '  req="$(printf "%s" "$prompt" | awk "/^Requested addresses/{f=1; next} f && /^###/{exit} f{print}")"',
+  '  entries=()',
+  '  mapfile -t _items <<< "$req"',
+  '  for _it in "${_items[@]}"; do',
+  '    [[ -n "$_it" ]] || continue',
+  '    k="$(printf "%s" "$_it" | awk "{print \\$2}")"; l="$(printf "%s" "$_it" | awk "{print \\$4}")"',
+  '    src="$k"',
+  '    if [[ "${AGY_FAKE_PROOF_DUP:-}" == "1" ]]; then src=1; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OMIT:-}" == "$k" ]]; then continue; fi',
+  '    body="$(awk -v want="$l" "f && /^--- END CHANGE-SET PART /{exit} f{c++; if (c==want) {print; exit}} /^--- BEGIN CHANGE-SET PART /{f=1}" "${AGY_FAKE_PROMPT}.$src")"',
+  '    if [[ "${AGY_FAKE_PROOF_CORRUPT:-}" == "$k" ]]; then body="${body}X"; fi',
+  '    entry="$(printf "part %s line %s: %s" "$k" "$l" "$body")"',
+  '    if [[ "${AGY_FAKE_PROOF_BULLET:-}" == "1" ]]; then entry="- $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_NESTED:-}" == "$k" ]]; then entry="note: I believe $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_PAD:-}" == "1" ]]; then entry="$(printf "part %02d line %04d: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then entry="$(printf "Part %s Line %s: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_HUGE:-}" == "$k" ]]; then entry="$(printf "part %s line 99999999999999999999: %s" "$k" "$body")"; fi',
+  '    entries+=("$entry")',
+  '    if [[ "${AGY_FAKE_PROOF_TWICE:-}" == "1" ]]; then entries+=("$entry"); fi',
+  '  done',
+  '  if [[ "${AGY_FAKE_PROOF_EXTRA:-}" == "1" ]]; then entries+=("part 99 line 1: an address nobody asked for"); fi',
+  '  if [[ "${AGY_FAKE_PROOF_HUGE_EXTRA:-}" == "1" ]]; then entries+=("part 99999999999999999999 line 1: an invented giant address"); fi',
+  '  out="$( {',
+  '    if [[ "${AGY_FAKE_PROOF_LATE:-}" == "1" ]]; then printf "### Verdict\\nSHIP\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then printf "### Delivery Proof\\n"; else printf "### Delivery proof\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OUTSIDE:-}" == "1" ]]; then',
+  '      printf "(nothing here)\\n### Verdict\\nSHIP\\n"',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '    else',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '      printf "### Verdict\\nSHIP\\n"',
+  '    fi',
+  '    if [[ -n "${AGY_FAKE_FINAL_APPEND:-}" ]]; then printf "%s\\n" "$AGY_FAKE_FINAL_APPEND"; fi',
+  '  } )"',
+  '  aw_fake_emit "$out"',
+  '  exit 0',
+  'fi',
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then aw_fake_emit "$(printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP")"; else aw_fake_emit "$AGY_FAKE_OUTPUT"; fi',
+  'exit "${AGY_FAKE_EXIT:-0}"',
+  '',
+].join('\n');
+
+// A PATH whose entries are symlinks to the real PATH binaries EXCEPT the excluded names.
+const makePathWithout = (root, exclude = []) => {
+  const skip = new Set(exclude);
+  const dir = mkdtempSync(join(root, 'nobin-'));
+  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const name of names) {
+      if (skip.has(name)) continue;
+      const link = join(dir, name);
+      if (existsSync(link)) continue;
+      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
+    }
+  }
+  return dir;
+};
+
+// Farms and the sandbox template are read-only per invocation, so both are built ONCE and shared.
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const farms = new Map();
+export const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
+const TEMPLATE_HOME = (() => {
+  const home = join(SHARED_ROOT, 'template-home');
+  const bin = join(home, '.local', 'bin');
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
+  const repo = join(home, 'repo');
+  mkdirSync(repo);
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  g('init', '-q');
+  g('config', 'user.email', 'probe@example.com');
+  g('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'base.txt'), 'committed base\n');
+  g('add', '-A');
+  g('commit', '-qm', 'base');
+  return home;
+})();
+
+// `clean: true` leaves a pristine committed tree; the default leaves one untracked file so `code`
+// mode has a diff to review.
+export const makeSandbox = ({ clean = false } = {}) => {
+  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
+  cpSync(TEMPLATE_HOME, home, { recursive: true });
+  const bin = join(home, '.local', 'bin');
+  chmodSync(join(bin, 'agy'), 0o755);
+  const repo = join(home, 'repo');
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
+  return { home, bin, repo, g };
+};
+
+let runSeq = 0;
+// Asynchronous on purpose: a blocking spawnSync pinned the whole suite to one core.
+export const run = (sb, { args, env = {}, cwd, wrapper } = {}) => new Promise((settle) => {
+  const { home, bin, repo } = sb;
+  const farm = farmFor(['agy', 'agy-run']);
+  const tag = `cap-${++runSeq}`;
+  const cap = {
+    argv: join(home, `${tag}-argv`), env: join(home, `${tag}-env`), prompt: join(home, `${tag}-prompt`),
+    sentinel: join(home, `${tag}-sentinel`), adddir: join(home, `${tag}-adddir`),
+    adddirMode: join(home, `${tag}-adddir-mode`), artifactMode: join(home, `${tag}-artifact-mode`),
+    artifactCopy: join(home, `${tag}-artifact-copy`), turns: join(home, `${tag}-turns`),
+    dispatchCwd: join(home, `${tag}-dispatch-cwd`),
+  };
+  const child = execFile('bash', [wrapper || WRAPPER, ...args], {
+    cwd: cwd || repo,
+    encoding: 'utf8',
+    timeout: 30000,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      HOME: home,
+      PATH: `${bin}:${farm}`,
+      TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
+      AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
+      AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
+      AGY_FAKE_TURNS: cap.turns, AGY_FAKE_CWD: cap.dispatchCwd,
+      ...env,
+    },
+  }, (error, stdout, stderr) => {
+    const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+    const turns = existsSync(cap.turns) ? Number(readFileSync(cap.turns, 'utf8')) : 0;
+    const prompts = [];
+    const argvs = [];
+    for (let i = 1; i <= turns; i += 1) {
+      prompts.push(readIf(`${cap.prompt}.${i}`));
+      argvs.push(readIf(`${cap.argv}.${i}`));
+    }
+    settle({
+      status: error ? (error.code ?? 1) : 0, signal: error?.signal ?? null, stdout, stderr,
+      invoked: existsSync(cap.sentinel),
+      argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
+      adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
+      artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
+      dispatchCwd: readIf(cap.dispatchCwd).trim(), turns, prompts, argvs,
+    });
+  });
+  // Only EPIPE is a refusal working — any other stdin write failure must reach the test.
+  child.stdin.on('error', (err) => { if (err.code !== 'EPIPE') throw err; });
+  child.stdin.end();
+});
+
+export const runAsync = run;
+
+export const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
+export const readReceipts = (repo) => {
+  const p = join(repo, RECEIPTS_REL);
+  if (!existsSync(p)) return [];
+  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+};
+
+// The chunked-feed lane: an over-cap change set is DELIVERED over turns and its delivery is PROVEN
+// by verbatim line echoes the final answer must reproduce.
+export const ARTIFACT_HEADER = '## The change set under review (assembled working-tree diff — repo-complete)';
+export const SHAPE_HEADER = '\n## Output — Markdown, this exact shape, nothing else';
+export const FED_CAP = 6000;
+export const MAX_COUNTABLE_PROOF_ADDRESS = 40;
+export const FED_WIDE_CAP = 24000;
+export const isAssemblerBanner = (line) =>
+  /^=== (repo file map|git status|staged diff|unstaged diff|untracked)/.test(line) && line.endsWith(' ===');
+
+export const seedFedChangeSet = (sb, { lines = 400, multibyte = false } = {}) => {
+  const body = Array.from({ length: lines }, (_, i) =>
+    multibyte
+      ? `line ${String(i).padStart(4, '0')} — multibyte marker ${'\u044e'.repeat(20)}`
+      : `unique change-set line ${String(i).padStart(4, '0')} — a distinctive body marker ${'x'.repeat(20)}`).join('\n');
+  writeFileSync(join(sb.repo, 'oversized.txt'), `${body}\n`);
+};
+
+export const inlineArtifactOf = (prompt) => prompt.slice(prompt.indexOf(ARTIFACT_HEADER), prompt.indexOf(SHAPE_HEADER));
+export const bodyOf = (turnPrompt) => {
+  const begin = turnPrompt.match(/--- BEGIN CHANGE-SET PART \d+ OF \d+ ---\n/);
+  if (!begin) return null;
+  const start = begin.index + begin[0].length;
+  return turnPrompt.slice(start, turnPrompt.indexOf('\n--- END CHANGE-SET PART ', start));
+};
+export const requestedBlockOf = (finalPrompt) => {
+  const start = finalPrompt.indexOf('Requested addresses');
+  assert.notEqual(start, -1, 'the final turn states which lines it requires');
+  const after2 = finalPrompt.slice(finalPrompt.indexOf('\n', start) + 1);
+  return after2.slice(0, after2.indexOf('\n###')).split('\n').filter(Boolean);
+};
+export const requestedOf = (finalPrompt) => requestedBlockOf(finalPrompt).map((item) => {
+  const [, part, line] = item.match(/^part (\d+) line (\d+)$/);
+  return { part: Number(part), line: Number(line) };
+});
+export const fedRun = (sb, extraEnv = {}) =>
+  run(sb, { args: ['code', '--facts', 'grounded fact'], env: { AGY_MAX_PROMPT_BYTES: String(FED_CAP), ...extraEnv } });

package/bridges/antigravity-cli-bridge/bin/agy-review-verdict.test.mjs

@@ -0,0 +1,109 @@
+// Contract under test: docs/ai/specs/bridges/agy-review-verdict.md (verdict-body honesty).
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rmSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeSandbox, run, readReceipts, seedFedChangeSet, fedRun } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const CONTRADICTION_OUTPUT = '### Verdict\nSHIP WITH NITS — solid, two nits.\n### Blocking\n1. correctness: drops the last chunk\n2. security: path traversal in the staging dir\n### Non-blocking\nnone\n### Questions\nnone';
+
+describe('agy-review.sh — a ship-class verdict cannot ride numbered Blocking findings', { concurrency: 2 }, () => {
+  // spec:agy-review-verdict/S1
+  it('a ship-class verdict beside a numbered Blocking item exits 4 with NO receipt — fresh and fed lanes alike', async () => {
+    const fresh = makeSandbox();
+    const r = await run(fresh, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const freshReceipts = readReceipts(fresh.repo);
+    rmSync(fresh.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(r.invoked, true, 'the contradiction is judged AFTER the run — a failed review, not a pre-spend refusal');
+    assert.equal(freshReceipts.length, 0, 'a contradictory run mints nothing');
+    const sb = makeSandbox();
+    seedFedChangeSet(sb);
+    const fed = await fedRun(sb, { AGY_FAKE_FINAL_APPEND: '### Blocking\n1. a numbered blocker the verdict ignores' });
+    const fedReceipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(fed.status, 4, fed.stderr);
+    assert.equal(fedReceipts.length, 0, 'the fed lane refuses the same shape after a PROVEN delivery');
+  });
+
+  // spec:agy-review-verdict/S2
+  it('a Blocking body of none — any case, trailing punctuation — mints exactly as today', async () => {
+    for (const noneForm of ['none', 'None.', 'NONE']) {
+      const sb = makeSandbox();
+      const output = `### Verdict\nSHIP WITH NITS — fine.\n### Blocking\n${noneForm}\n### Non-blocking\nnone\n### Questions\nnone`;
+      const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, `"${noneForm}" must pass: ${r.stderr}`);
+      assert.equal(receipts.length, 1);
+      assert.equal(receipts[0].verdict, 'SHIP WITH NITS');
+    }
+  });
+
+  // spec:agy-review-verdict/S3
+  it('REWORK is never refused by the cross-check, numbered Blocking items or not', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nREWORK — two real blockers.\n### Blocking\n1. the guard fails open\n2. the receipt lies\n### Non-blocking\nnone\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'a veto needs no corroboration');
+    assert.equal(receipts[0].verdict, 'REWORK');
+  });
+
+  // spec:agy-review-verdict/S4
+  it('an absent Blocking section is not a contradiction — the verdict-only read is unchanged', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: '### Verdict\nSHIP — clean, no sections beyond this one.' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the shape mandate lives in the prompt; absence is not judged here');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S5
+  it('the continuation lane refuses a contradictory verdict before its informational receipt', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['--continue'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(receipts.length, 0, 'a fresh:false receipt must not encode a contradiction either');
+  });
+
+  // spec:agy-review-verdict/S6
+  it('the refusal names both halves and the verdict is never rewritten or downgraded', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4);
+    assert.match(r.stderr, /SHIP WITH NITS — solid, two nits\./, 'the RAW verdict line is named, reason text included');
+    assert.match(r.stderr, /drops the last chunk/, 'the first numbered Blocking item is named');
+    assert.match(r.stderr, /[Rr]e-run the review/, 'the recovery is the same as every failed review');
+    assert.equal(receipts.length, 0, 'no rewritten or downgraded verdict is ever minted');
+  });
+
+  // spec:agy-review-verdict/S8
+  it('a second Blocking heading terminates the scan — only the first section is judged', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nSHIP — clean.\n### Blocking\nnone\n### Blocking\n1. a numbered item under a duplicate heading\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the first section said none — a later heading cannot suppress the receipt');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S7
+  it('the loadable skill text names the closed verdict vocabulary', async () => {
+    const skill = readFileSync(resolve(HERE, '..', 'SKILL.md'), 'utf8');
+    assert.match(skill, /SHIP \/ SHIP WITH NITS \/ REWORK/, 'the closed vocabulary is spelled in SKILL.md, not only in --help and failure stderr');
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -338,7 +338,7 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.7 Flash (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="5.3.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="5.4.0"  # aw-version-anchor
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
@@ -1070,6 +1070,14 @@ parse_agy_verdict() { # $1 = captured-output file
   fi
 }
 
+parse_agy_verdict_line() { # $1 = captured-output file
+  awk '/^### Verdict[[:space:]]*$/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null
+}
+
+parse_agy_blocking_first_numbered() { # $1 = captured-output file
+  awk 'flag && /^### /{exit} /^### Blocking[[:space:]]*$/{flag=1; next} flag && /^[0-9]+[.)]/{print; exit}' "$1" 2>/dev/null
+}
+
 # The repo file map is a FIXED cost that scales with REPO SIZE, not change size (measured 28,735
 # bytes in the home repo — 24% of agy's 120000-byte single-argv ceiling), so an unbounded map taxes
 # the change budget of every review. AW_REVIEW_MAP_BUDGET_BYTES bounds it; the value is set by each
@@ -2111,6 +2119,16 @@ if [[ $rc -eq 0 ]]; then
     echo "       the review; if it recurs, inspect the captured output for what the model produced." >&2
     exit 4
   fi
+  if [[ "$verdict" == "SHIP" || "$verdict" == "SHIP WITH NITS" ]]; then
+    first_blocking_item="$(parse_agy_blocking_first_numbered "$review_out_file")"
+    if [[ -n "$first_blocking_item" ]]; then
+      verdict_line="$(parse_agy_verdict_line "$review_out_file")"
+      echo "error: verdict-body contradiction — '### Verdict' reads '$verdict_line' while '### Blocking'" >&2
+      echo "       carries a numbered finding ($first_blocking_item). A ship-class verdict cannot" >&2
+      echo "       ride blocking findings; NO receipt was written. Re-run the review." >&2
+      exit 4
+    fi
+  fi
   if [[ -n "$resume_mode" ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -10,283 +10,11 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const WRAPPER = join(HERE, 'agy-review.sh');
-
-// Hermetic fake `agy`. PORTING TRAP: agy takes the prompt as the `-p` ARGV value, NOT stdin — so the
-// fake captures the -p value from argv (a stdin capture would make every prompt assertion vacuous).
-// It also records full argv, a couple of env vars, an invocation sentinel, and — for the oversized
-// --add-dir escape — the staging dir's perms + the offloaded artifact's perms/contents WHILE they
-// still exist (agy-review's trap removes the staging dir on exit). Kept inline so the file is
-// standalone (the kit mirror is byte-equality; no shared helper grows that set).
-// The envelope `agy --output-format json` returns: ONE object whose `response` carries the model's
-// text VERBATIM. Encoded in node so an arbitrary body (quotes, backslashes, multibyte) round-trips
-// exactly — hand-rolled JSON quoting in bash is the defect farm this fake exists to avoid.
-const FAKE_ENVELOPE_ENCODER = [
-  'const text = require("node:fs").readFileSync(0, "utf8");',
-  'const [cid, status, shape] = process.argv.slice(1);',
-  'const envelope = { conversation_id: cid, status, response: text, duration_seconds: 1.5, num_turns: 1,',
-  '  usage: { input_tokens: 10, output_tokens: 5, thinking_tokens: 0, cache_read_tokens: 0, total_tokens: 15 } };',
-  // The fed lane ROUTES later turns at this field, so the two ways it can be present-but-unusable —
-  // absent, and present with the wrong TYPE — are knobs, not just a bad-grammar string.
-  'if (shape === "missing") delete envelope.conversation_id;',
-  'if (shape === "number") envelope.conversation_id = 42;',
-  'process.stdout.write(`${JSON.stringify(envelope)}\\n`);',
-].join('\n');
-
-const FAKE_AGY = [
-  '#!/usr/bin/env bash',
-  'set -u',
-  // A capability probe is NOT a paid dispatch: --help / --version answer BEFORE any capture file is
-  // touched, so the wrapper's pre-spend door can never read as a spent run (the sentinel) nor shift
-  // the fed lane's per-turn counter. Keyed on the FIRST argument like the real CLI, so a prompt that
-  // merely CONTAINS "--help" is never intercepted.
-  'case "${1:-}" in',
-  '  --help|-h)',
-  '    if [[ -n "${AGY_FAKE_HELP_EXIT:-}" ]]; then echo "fake agy: help unavailable" >&2; exit "$AGY_FAKE_HELP_EXIT"; fi',
-  '    for f in --output-format --json-schema --disable-slash-commands --effort --mode; do',
-  '      if [[ "$f" == "${AGY_FAKE_HELP_OMIT:-}" ]]; then continue; fi',
-  '      printf "  %s   fake capability line\\n" "$f"',
-  '    done',
-  '    if [[ -n "${AGY_FAKE_HELP_EXTRA:-}" ]]; then printf "%s\\n" "$AGY_FAKE_HELP_EXTRA"; fi',
-  '    exit 0 ;;',
-  '  --version) printf "%s\\n" "${AGY_FAKE_VERSION:-1.1.13}"; exit 0 ;;',
-  'esac',
-  ': "${AGY_FAKE_ARGV:=/dev/null}"',
-  ': "${AGY_FAKE_ENV:=/dev/null}"',
-  ': "${AGY_FAKE_PROMPT:=/dev/null}"',
-  ': "${AGY_FAKE_SENTINEL:=/dev/null}"',
-  'printf invoked > "$AGY_FAKE_SENTINEL"',
-  // The fed lane dispatches from the private staging dir (deliberately — see the wrapper), so the
-  // fake's own cwd is the only handle a test has on a directory the exit trap then removes.
-  'printf "%s" "$PWD" > "${AGY_FAKE_CWD:-/dev/null}"',
-  '{ for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_FAKE_ARGV"',
-  '{ echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "ANTIGRAVITY_API_KEY=${ANTIGRAVITY_API_KEY:-<unset>}"; } > "$AGY_FAKE_ENV"',
-  'prompt=""',
-  'prev=""; for a in "$@"; do if [[ "$prev" == "-p" ]]; then prompt="$a"; printf "%s" "$a" > "$AGY_FAKE_PROMPT"; fi; prev="$a"; done',
-  // Every answer leaves through ONE emitter, so the transport is a property of the INVOCATION
-  // (`--output-format json` ⇒ an envelope, otherwise text) and every existing output knob keeps
-  // meaning exactly what it meant. AGY_FAKE_RAW_STDOUT bypasses the encoder entirely — the
-  // unparseable-payload arm; AGY_FAKE_STDERR is the CLI's own diagnostic.
-  'aw_fmt=""',
-  'prev=""; for a in "$@"; do if [[ "$prev" == "--output-format" ]]; then aw_fmt="$a"; fi; prev="$a"; done',
-  // AGY_FAKE_BAD_TURN scopes the two transport-breaking knobs to ONE turn: a fed run whose turn 1
-  // answers normally and whose turn 2 does not is the only way to reach the "no LATER turn is spent"
-  // arms — an unscoped knob breaks turn 1 and the run never gets there.
-  'aw_fake_emit() {',
-  '  local body="$1" aw_status="${AGY_FAKE_STATUS:-SUCCESS}" aw_raw=""',
-  '  if [[ -n "${AGY_FAKE_RAW_STDOUT+x}" ]]; then aw_raw=1; fi',
-  '  if [[ -n "${AGY_FAKE_BAD_TURN:-}" && "$turn" != "${AGY_FAKE_BAD_TURN}" ]]; then aw_status="SUCCESS"; aw_raw=""; fi',
-  '  if [[ -n "${AGY_FAKE_STDERR:-}" ]]; then printf "%s\\n" "$AGY_FAKE_STDERR" >&2; fi',
-  '  if [[ -n "$aw_raw" ]]; then printf "%s" "$AGY_FAKE_RAW_STDOUT"; return 0; fi',
-  '  if [[ "$aw_fmt" != "json" ]]; then printf "%s\\n" "$body"; return 0; fi',
-  `  printf "%s\\n" "$body" | node -e '${FAKE_ENVELOPE_ENCODER}' \\`,
-  '    "${AGY_FAKE_CONV_ID:-11111111-2222-3333-4444-555555555555}" "$aw_status" "${AGY_FAKE_CONV_SHAPE:-ok}"',
-  '}',
-  'prev=""; for a in "$@"; do',
-  '  if [[ "$prev" == "--add-dir" ]]; then',
-  '    printf "%s" "$a" > "${AGY_FAKE_ADDDIR:-/dev/null}"',
-  '    stat -c "%a" "$a" > "${AGY_FAKE_ADDDIR_MODE:-/dev/null}" 2>/dev/null || true',
-  '    art="$a/precomputed-change-set"',
-  '    if [[ -f "$art" ]]; then stat -c "%a" "$art" > "${AGY_FAKE_ARTIFACT_MODE:-/dev/null}" 2>/dev/null || true; cp "$art" "${AGY_FAKE_ARTIFACT_COPY:-/dev/null}" 2>/dev/null || true; fi',
-  '  fi; prev="$a"',
-  'done',
-  'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
-  // ── multi-turn support (the fed lane) ──────────────────────────────────────────────────────────
-  // The single-file captures above record the LAST invocation; a chunked feed needs a PER-TURN
-  // record, so each invocation also writes prompt/argv to "<file>.<turn>" and bumps a counter file.
-  'turn=1',
-  'if [[ -n "${AGY_FAKE_TURNS:-}" ]]; then',
-  '  if [[ -s "$AGY_FAKE_TURNS" ]]; then turn=$(( $(cat "$AGY_FAKE_TURNS") + 1 )); fi',
-  '  printf "%s" "$turn" > "$AGY_FAKE_TURNS"',
-  '  printf "%s" "$prompt" > "${AGY_FAKE_PROMPT}.$turn"',
-  '  { for a in "$@"; do printf "%s\\n" "$a"; done; } > "${AGY_FAKE_ARGV}.$turn"',
-  'fi',
-  'if [[ -n "${AGY_FAKE_FAIL_TURN:-}" && "$turn" == "${AGY_FAKE_FAIL_TURN}" ]]; then',
-  '  printf "FAKE_TURN_FAILURE\\n" >&2; exit 3',
-  'fi',
-  // A FEED turn: the model was told to reply OK only. This fake deliberately misbehaves — it emits a
-  // PREMATURE verdict — so the isolation invariant (feed output never reaches stdout or the parsed
-  // capture) is proven against the worst case, not the polite one.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"--- BEGIN CHANGE-SET PART "* && "$prompt" != *"Requested addresses"* ]]; then',
-  '  aw_fake_emit "$(printf "PREMATURE_FEED_CHATTER\\n### Verdict\\nREWORK")"; exit 0',
-  'fi',
-  // The FINAL turn carries the delivery-proof request. The fake answers it the only honest way:
-  // by reading the bodies it was actually fed, turn by turn — so a wrapper that never delivered a
-  // part cannot be satisfied by this stub either.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"Requested addresses"* ]]; then',
-  '  req="$(printf "%s" "$prompt" | awk "/^Requested addresses/{f=1; next} f && /^###/{exit} f{print}")"',
-  '  entries=()',
-  '  mapfile -t _items <<< "$req"',
-  '  for _it in "${_items[@]}"; do',
-  '    [[ -n "$_it" ]] || continue',
-  '    k="$(printf "%s" "$_it" | awk "{print \\$2}")"; l="$(printf "%s" "$_it" | awk "{print \\$4}")"',
-  '    src="$k"',
-  '    if [[ "${AGY_FAKE_PROOF_DUP:-}" == "1" ]]; then src=1; fi',
-  '    if [[ "${AGY_FAKE_PROOF_OMIT:-}" == "$k" ]]; then continue; fi',
-  '    body="$(awk -v want="$l" "f && /^--- END CHANGE-SET PART /{exit} f{c++; if (c==want) {print; exit}} /^--- BEGIN CHANGE-SET PART /{f=1}" "${AGY_FAKE_PROMPT}.$src")"',
-  '    if [[ "${AGY_FAKE_PROOF_CORRUPT:-}" == "$k" ]]; then body="${body}X"; fi',
-  '    entry="$(printf "part %s line %s: %s" "$k" "$l" "$body")"',
-  // Shape knobs the grammar must survive (a bullet) or reject (everything else).
-  '    if [[ "${AGY_FAKE_PROOF_BULLET:-}" == "1" ]]; then entry="- $entry"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_NESTED:-}" == "$k" ]]; then entry="note: I believe $entry"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_PAD:-}" == "1" ]]; then entry="$(printf "part %02d line %04d: %s" "$k" "$l" "$body")"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then entry="$(printf "Part %s Line %s: %s" "$k" "$l" "$body")"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_HUGE:-}" == "$k" ]]; then entry="$(printf "part %s line 99999999999999999999: %s" "$k" "$body")"; fi',
-  '    entries+=("$entry")',
-  '    if [[ "${AGY_FAKE_PROOF_TWICE:-}" == "1" ]]; then entries+=("$entry"); fi',
-  '  done',
-  '  if [[ "${AGY_FAKE_PROOF_EXTRA:-}" == "1" ]]; then entries+=("part 99 line 1: an address nobody asked for"); fi',
-  '  if [[ "${AGY_FAKE_PROOF_HUGE_EXTRA:-}" == "1" ]]; then entries+=("part 99999999999999999999 line 1: an invented giant address"); fi',
-  '  out="$( {',
-  '    if [[ "${AGY_FAKE_PROOF_LATE:-}" == "1" ]]; then printf "### Verdict\\nSHIP\\n"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then printf "### Delivery Proof\\n"; else printf "### Delivery proof\\n"; fi',
-  '    if [[ "${AGY_FAKE_PROOF_OUTSIDE:-}" == "1" ]]; then',
-  '      printf "(nothing here)\\n### Verdict\\nSHIP\\n"',
-  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
-  '    else',
-  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
-  '      printf "### Verdict\\nSHIP\\n"',
-  '    fi',
-  '  } )"',
-  '  aw_fake_emit "$out"',
-  '  exit 0',
-  'fi',
-  // Unset AGY_FAKE_OUTPUT → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
-  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
-  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then aw_fake_emit "$(printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP")"; else aw_fake_emit "$AGY_FAKE_OUTPUT"; fi',
-  'exit "${AGY_FAKE_EXIT:-0}"',
-  '',
-].join('\n');
-
-// A PATH whose entries are symlinks to the real PATH binaries EXCEPT the excluded names. Excluding
-// `agy-run` forces agy-review onto its `$HERE/agy.sh` fallback (the repo's CURRENT agy.sh, not a
-// possibly-stale installed one), keeping the test hermetic; excluding `agy` ensures the only agy is
-// our fake (prepended via $HOME/.local/bin). Ported from codex-review.test.mjs.
-const makePathWithout = (root, exclude = []) => {
-  const skip = new Set(exclude);
-  const dir = mkdtempSync(join(root, 'nobin-'));
-  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
-    let names;
-    try { names = readdirSync(d); } catch { continue; }
-    for (const name of names) {
-      if (skip.has(name)) continue;
-      const link = join(dir, name);
-      if (existsSync(link)) continue;
-      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
-    }
-  }
-  return dir;
-};
-
-// The PATH farms and the sandbox base are READ-ONLY per invocation, so both are built ONCE and
-// shared: a per-run farm rebuild (thousands of symlinks) plus a per-test `git init`+commit were
-// the suite's dominant wall cost, not the wrapper under test.
-const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
-after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
-const farms = new Map();
-const farmFor = (exclude) => {
-  const key = exclude.join('|');
-  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
-  return farms.get(key);
-};
-
-const TEMPLATE_HOME = (() => {
-  const home = join(SHARED_ROOT, 'template-home');
-  const bin = join(home, '.local', 'bin');
-  mkdirSync(bin, { recursive: true });
-  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
-  const repo = join(home, 'repo');
-  mkdirSync(repo);
-  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
-  g('init', '-q');
-  g('config', 'user.email', 'probe@example.com');
-  g('config', 'user.name', 'probe');
-  writeFileSync(join(repo, 'base.txt'), 'committed base\n');
-  g('add', '-A');
-  g('commit', '-qm', 'base');
-  return home;
-})();
-
-// `clean: true` leaves a pristine committed tree (for the no-diff preflight); the default leaves one
-// untracked file so `code` mode has a diff to review.
-const makeSandbox = ({ clean = false } = {}) => {
-  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
-  cpSync(TEMPLATE_HOME, home, { recursive: true });
-  const bin = join(home, '.local', 'bin');
-  chmodSync(join(bin, 'agy'), 0o755);
-  const repo = join(home, 'repo');
-  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
-  if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
-  return { home, bin, repo, g };
-};
-
-// Capture files are per-INVOCATION: a second run() on the same sandbox must not inherit the first
-// run's turn counter or per-turn prompt files (the fed lane reads them back by turn index).
-let runSeq = 0;
-// ASYNCHRONOUS on purpose. A blocking spawnSync here holds the event loop for the whole dispatch,
-// which pinned this file to ONE core: 208 points in a serial chain, 91.4s solo at 103% CPU while
-// the other seven cores idled. Awaiting the child instead lets a `{ concurrency }` describe
-// overlap its tests. The per-test environment still rides the CHILD's options — `process.env` is
-// never mutated, which is what keeps overlapping tests from reading each other's PATH.
-const run = (sb, { args, env = {}, cwd, wrapper } = {}) => new Promise((settle) => {
-  const { home, bin, repo } = sb;
-  const farm = farmFor(['agy', 'agy-run']);
-  const tag = `cap-${++runSeq}`;
-  const cap = {
-    argv: join(home, `${tag}-argv`), env: join(home, `${tag}-env`), prompt: join(home, `${tag}-prompt`),
-    sentinel: join(home, `${tag}-sentinel`), adddir: join(home, `${tag}-adddir`),
-    adddirMode: join(home, `${tag}-adddir-mode`), artifactMode: join(home, `${tag}-artifact-mode`),
-    artifactCopy: join(home, `${tag}-artifact-copy`), turns: join(home, `${tag}-turns`),
-    dispatchCwd: join(home, `${tag}-dispatch-cwd`),
-  };
-  const child = execFile('bash', [wrapper || WRAPPER, ...args], {
-    cwd: cwd || repo,
-    encoding: 'utf8',
-    timeout: 30000,
-    maxBuffer: 64 * 1024 * 1024,
-    env: {
-      HOME: home,
-      PATH: `${bin}:${farm}`,
-      // Keep the wrapper's mktemp working when the suite runs inside an OS sandbox whose /tmp is
-      // read-only (only $TMPDIR is writable there).
-      TMPDIR: process.env.TMPDIR ?? '/tmp',
-      AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
-      AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
-      AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
-      AGY_FAKE_TURNS: cap.turns, AGY_FAKE_CWD: cap.dispatchCwd,
-      ...env,
-    },
-  }, (error, stdout, stderr) => {
-    const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
-    // Per-turn captures are read EAGERLY: callers rmSync the sandbox before asserting.
-    const turns = existsSync(cap.turns) ? Number(readFileSync(cap.turns, 'utf8')) : 0;
-    const prompts = [];
-    const argvs = [];
-    for (let i = 1; i <= turns; i += 1) {
-      prompts.push(readIf(`${cap.prompt}.${i}`));
-      argvs.push(readIf(`${cap.argv}.${i}`));
-    }
-    settle({
-      status: error ? (error.code ?? 1) : 0, signal: error?.signal ?? null, stdout, stderr,
-      invoked: existsSync(cap.sentinel),
-      argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
-      adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
-      artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
-      dispatchCwd: readIf(cap.dispatchCwd).trim(), turns, prompts, argvs,
-    });
-  });
-  // The wrapper refuses many inputs BEFORE it reads stdin, so the pipe can already be closed here.
-  // The blocking spawn swallowed that; an async one throws EPIPE at the test. A closed pipe is the
-  // refusal working — but ONLY EPIPE is: any other write failure is a real fault and must reach
-  // the test instead of passing as a green.
-  child.stdin.on('error', (err) => { if (err.code !== 'EPIPE') throw err; });
-  child.stdin.end();
-});
-
-// runAsync was the async twin kept for the two sleep-bound timeout tests, back when run() blocked.
-// run() IS that twin now, with the fuller capture surface, so the twin is one name pointing at it
-// — two spawn paths could only drift.
-const runAsync = run;
+import {
+  WRAPPER, farmFor, makeSandbox, run, runAsync, readReceipts, RECEIPTS_REL,
+  ARTIFACT_HEADER, SHAPE_HEADER, FED_CAP, FED_WIDE_CAP, MAX_COUNTABLE_PROOF_ADDRESS,
+  isAssemblerBanner, seedFedChangeSet, inlineArtifactOf, bodyOf, requestedBlockOf, requestedOf, fedRun,
+} from './agy-review-harness.test.mjs';
 
 describe('agy-review.sh — model policy advisory (1)', { concurrency: 2 }, () => {
   it('warns for a non-frontier model but still runs', async () => {
@@ -935,59 +663,6 @@ describe('agy-review.sh — repo file map budget (Phase 2)', { concurrency: 2 },
   });
 });
 
-// ── the chunked-feed code review with PROVEN delivery (Phase 3) ──────────────────────────────────
-// agy takes its prompt as ONE argv, and this host AUTO-DENIES agy's native read_file tool — so an
-// over-cap change set can never be FETCHED by the model. It is DELIVERED instead: partitioned into
-// under-cap parts, fed over continuation turns, then reviewed in a final turn. Delivery is PROVEN,
-// never assumed: the wrapper picks a line from each part's body AFTER assembly and the final answer
-// must reproduce every picked line verbatim. Envelope and body are formally separate — only BODIES
-// concatenate, and they concatenate to the change set byte-for-byte.
-const ARTIFACT_HEADER = '## The change set under review (assembled working-tree diff — repo-complete)';
-const SHAPE_HEADER = '\n## Output — Markdown, this exact shape, nothing else';
-const FED_CAP = 6000;
-// The proof asks the model to COUNT to the address with no tool, so the address has to be reachable
-// that way. The walk used to start at each part's middle: measured 847..1024 on a 701464-byte change
-// set, which is where the three live false refusals sat. FED_WIDE_CAP gives the countability
-// regression parts wide enough that a midpoint address is unmistakably out of reach — under the
-// narrow FED_CAP the midpoint lands at 80, close enough to the bar that fixture drift could hide it.
-const MAX_COUNTABLE_PROOF_ADDRESS = 40;
-const FED_WIDE_CAP = 24000;
-// The assembler's OWN section banners — the vocabulary the proof selector refuses, because it emits
-// them for every change set and a model can rebuild the per-path forms from part 1's git-status
-// block. A change set's own `=== … ===` line is NOT in this set and stays admissible.
-const isAssemblerBanner = (line) =>
-  /^=== (repo file map|git status|staged diff|unstaged diff|untracked)/.test(line) && line.endsWith(' ===');
-
-// A change set big enough to need several parts under FED_CAP.
-const seedFedChangeSet = (sb, { lines = 400, multibyte = false } = {}) => {
-  const body = Array.from({ length: lines }, (_, i) =>
-    multibyte
-      ? `line ${String(i).padStart(4, '0')} — multibyte marker ${'\u044e'.repeat(20)}`
-      : `unique change-set line ${String(i).padStart(4, '0')} — a distinctive body marker ${'x'.repeat(20)}`).join('\n');
-  writeFileSync(join(sb.repo, 'oversized.txt'), `${body}\n`);
-};
-
-const inlineArtifactOf = (prompt) => prompt.slice(prompt.indexOf(ARTIFACT_HEADER), prompt.indexOf(SHAPE_HEADER));
-const bodyOf = (turnPrompt) => {
-  const begin = turnPrompt.match(/--- BEGIN CHANGE-SET PART \d+ OF \d+ ---\n/);
-  if (!begin) return null;
-  const start = begin.index + begin[0].length;
-  return turnPrompt.slice(start, turnPrompt.indexOf('\n--- END CHANGE-SET PART ', start));
-};
-// The addresses ride ONE PER LINE — that format is what makes a collision with a proof candidate
-// constructively impossible, so the parser reads lines, never a delimiter-joined field.
-const requestedBlockOf = (finalPrompt) => {
-  const start = finalPrompt.indexOf('Requested addresses');
-  assert.notEqual(start, -1, 'the final turn states which lines it requires');
-  const after = finalPrompt.slice(finalPrompt.indexOf('\n', start) + 1);
-  return after.slice(0, after.indexOf('\n###')).split('\n').filter(Boolean);
-};
-const requestedOf = (finalPrompt) => requestedBlockOf(finalPrompt).map((item) => {
-  const [, part, line] = item.match(/^part (\d+) line (\d+)$/);
-  return { part: Number(part), line: Number(line) };
-});
-const fedRun = (sb, extraEnv = {}) =>
-  run(sb, { args: ['code', '--facts', 'grounded fact'], env: { AGY_MAX_PROMPT_BYTES: String(FED_CAP), ...extraEnv } });
 
 describe('agy-review.sh — chunked feed: the change set is DELIVERED (Phase 3)', { concurrency: 2 }, () => {
   it('an over-cap code review feeds every part and the concatenated BODIES reproduce the change set exactly', async () => {
@@ -2368,12 +2043,6 @@ describe('agy-review.sh — declared contract is really accepted (forward guard)
 const RECEIPT_FIXTURE = JSON.parse(
   '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<display>"},"delivery":"inline"}',
 );
-const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
-const readReceipts = (repo) => {
-  const p = join(repo, RECEIPTS_REL);
-  if (!existsSync(p)) return [];
-  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
-};
 const sha256HexOf = async (buf) => {
   const { createHash } = await import('node:crypto');
   return createHash('sha256').update(buf).digest('hex');

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.7 Flash (High)" },
   "roles": {

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "10.1.0",
+  "version": "10.2.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "10.1.0",
+  "version": "10.2.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",