@sabaiway/agent-workflow-kit 10.1.0 → 10.3.0

package/CHANGELOG.md

@@ -4,6 +4,64 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 10.3.0 — a deployed project is never in an unnamed spec-adoption state, and a skip names a fact the tree can check (AD-123)
+
+A consumer's `upgrade` printed `specs: skipped-no-node — no package.json at the project root` beside
+its own deployed `scripts/check-docs-size.mjs`; the same project's advisor said `no recommendations —
+flow optimal.` over a tree with no `docs/ai/specs/` at all. Both lines were false about the tree they
+described, and nothing in the kit could say so.
+
+**Node is PROVEN, never proxied.** `tools/node-evidence.mjs` (contract `docs/ai/specs/kit/node-evidence.md`)
+answers `package-json` · `deployed-node-scripts` (any kit-seeded `scripts/*.mjs`, the list pinned
+against the bundle) · `none` · `unreadable`. The enforcement-script and spec-layer ensures seed on either
+evidence, skip ONLY on `none` with the new token `skipped-no-node-evidence` — a line naming every probe
+and every wrong-kind path — and fail closed on `unreadable` with the new cause
+`node-evidence-unverifiable`. `skipped-no-node` is retired: a skip whose reason the tool could itself
+disprove may not exist. `upgrade.md` and `deploy-tail.md` add the agent-facing half — a skip line that
+contradicts the observed tree is raised as a finding in the report, never pasted as neutral.
+
+**The adoption state is a surface.** `tools/spec-adoption.mjs` (contract `kit/spec-adoption`) reads the
+store through `spec-check`'s now-exported census and read (`kit/spec-check` rev 2) and answers
+`not-adopted` · `adopting` · `adopted` · `unreadable`. The advisor's 18th probe renders `spec-adoption`:
+the seed on an absent store (apply: the spec-layer ensure one-liner; recipe line: the decline
+preview as a named hand-apply alternative), the decline while a store holds no live contract — both
+OPTIONAL, the frozen registry keeping attention for a broken configured declaration — and a stated
+skip over a store it cannot read;
+so `flow optimal` cannot render over a store nobody observed. `status` prints one `specs` line in every
+state, with ` — declined` once the `spec-adoption` ack lane (`specAdoptionAck`) records the choice, and
+its own `(decline ack unreadable: …)` when that read fails.
+
+**The ack store has one reader.** `tools/ack-store.mjs` (contract `kit/ack-store`) now owns the store
+path, the keys, the closed lane registry, `factFingerprint` and `readAckValue`; the advisor re-exports
+them and `recipeFingerprint` derives through the same leaf. The leaf read moved from a path-based
+`readFile` after `lstat` to the descriptor-bound no-follow door.
+
+Docs: `status.md` documents the line and doc-parity binds the four state tokens into it; the
+`recommendations.md` posture note names both arms and the lane; both `agent_rules.md` templates carry
+the re-rendered Spec-first lens, the zero-state wording in §1.2 and the contradicted-skip bullet in
+§2.5 (`COMMS_PRIORS` gains the outgoing state-block canon so a deployed §2.5 refreshes instead of
+reading as a custom edit). Tarball pin 259 → 262.
+
+Not shipped, with reason: the brief's mechanical refusal of a bare "zero governing specs" once the
+store exists — no plan-shape checker exists and the citation has no literal grammar; queued with its
+entry condition.
+
+## 10.2.0 — a review can no longer pass a change it called broken (AD-122)
+
+Ships antigravity-cli-bridge **5.4.0** in the bundled bridge tree. A consumer recorded a clean
+`SHIP WITH NITS` receipt over a review body that named a correctness bug and a security violation
+under `### Blocking` — the wrapper read the verdict line and nothing read the section. Now a
+ship-class verdict beside a numbered Blocking item is a verdict-body contradiction and takes the
+existing failed-review arm: exit 4, no receipt, both halves named, re-run the review. `REWORK` is
+never refused — a veto needs no corroboration, only a pass does — an absent Blocking section is not
+a contradiction, and a repeated heading terminates the scan, so exactly one section is ever judged.
+
+The guard was written to a contract first (`docs/ai/specs/bridges/agy-review-verdict.md`, eight
+scenarios), and the bridge's test suite was split in the same change: the shared fixture surface
+moved to `bin/agy-review-harness.test.mjs`, the wrapper suite shrank to 2893 lines with all 213
+existing arms green, and the new contract got its own topic file. Both new files ship with the
+bridge tree, so the tarball count pin moves 257 → 259.
+
 ## 10.1.0 — no work without a specification, and a ratchet that does not trust its own file (AD-121)
 
 A shipped tool that no LIVE contract claims is now a REFUSAL, not a preference. `tools/spec-coverage.mjs`

package/README.md

@@ -231,7 +231,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit backends` | any time | **read-only** check of the optional execution-backends (the `codex` / `agy` bridges): what's set up vs missing and the next step. Never writes, never commits, never runs a subscription CLI (credentials = marker-file presence, not a live login). |
 | `/agent-workflow-kit gates` | any time | **project gate runner** — runs the verification commands **your project itself declares** in `docs/ai/gates.json` (seeded at deploy; hand-editable `{ id, title, cmd }` entries plus the optional boolean `lcovProducer`, each `cmd` one bash line) as one batch: a per-gate **PASS/FAIL table** + one machine-readable summary line, exit 0 iff all green; a failing gate's own output is shown verbatim; `--only <id>` re-runs one. Honest distinct outcomes for a missing / empty / malformed declaration — never a silent green. The runner writes nothing **by default** and never commits — opt-in `--final` runs the FULL declared matrix and mints ONE final-run receipt into the git-dir core-evidence store (status green/red, pre/post tree fingerprints, the declaration, the consumed lcov's sha; the receipt the commit-guard binds); it executes only your own declared commands (a batching convenience, not a sandbox). The velocity tier auto-approves only the exact no-`--final` form — the recording run stays explicit. |
 | `/agent-workflow-kit setup [backend]` | opt-in, any time | **link-only** auto-setup of a bridge: places the bundled bridge skill (only into an absent / empty / managed dir — never overwrites an unmanaged one) + links its wrappers onto `PATH` via managed symlinks (idempotent; refuses to clobber a non-symlink; try `--dry-run` to preview). The binary install + the one-time subscription login stay **manual**: it prints the exact **login** command and points the binary install at each bridge's `setup/README.md`. POSIX wrappers — on Windows use WSL. Never commits, never runs a subscription CLI. |
-| `/agent-workflow-kit status` | any time | **read-only** single view of **versions + deployment + settings + bridges**: which members (kit / memory / engine / the two bridges) are installed and at what version (with an honest "installed on this machine" note when one is behind) and — in a project — what's deployed (`docs/ai`, the version stamps, and the **visibility**: visible / hidden / unclear), plus your settings (orchestration recipes, attribution, velocity) and the bridges' readiness. The two version axes (package number vs deployment-structure head) stay decoupled. Never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit status` | any time | **read-only** single view of **versions + deployment + settings + bridges**: which members (kit / memory / engine / the two bridges) are installed and at what version (with an honest "installed on this machine" note when one is behind) and — in a project — what's deployed (`docs/ai`, the version stamps, and the **visibility**: visible / hidden / unclear), and the **feature-spec adoption state** (`not adopted` / `adopting (N draft)` / `adopted (N live, M draft)` / `could not be read`, plus `declined` when recorded), plus your settings (orchestration recipes, attribution, velocity) and the bridges' readiness. The two version axes (package number vs deployment-structure head) stay decoupled. Never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit recipes` | any time | **read-only** orchestration advisor: presents four named recipes for composing the bridges into plan → execute → review — **Solo / Reviewed / Council / Delegated** — plans + recommends one for your environment (degrading with a stated reason when a backend isn't ready), and offers the choice. The orchestrator runs it via the bridge skills and **always commits**; the kit never executes a recipe, never runs a subscription CLI, never commits. |
 | `/agent-workflow-kit procedures <activity>` | any time | **read-only** activity-procedures advisor: prints a named activity's ordered steps (`plan-authoring` / `plan-execution`) read **live** from the engine, plus the **resolved recipe per slot** from your `docs/ai/orchestration.json` (agent-writable via `set-recipe`, or hand-edited) + backend readiness (default Reviewed when a backend is ready, Council on request, slot-aware incl. Delegated) — and, for every dispatched backend, the **full driving contract at the point of use** (exact copy-pasteable invocation, grounding levers like agy's `--facts`/`--decided`, the round-2 `--continue` delta, guarded passthrough), verbatim from the bridge manifests (drift-guarded; each wrapper's `--help` prints the same). `--override <slot>=<recipe>` adjusts one slot per run. Composes with `recipes`; never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit set-recipe` | any time | **config writer** for `docs/ai/orchestration.json`: tell the agent your preference in plain language and it maps it to explicit `--set <activity>.<slot>=<recipe>` / `--unset` ops; the kit validates, **previews by default**, and writes only on `--write` (deployment-gated, atomic, symlink/TOCTOU-safe), resolving the effective recipe vs live readiness. Writes **only** that file — **never runs a backend, never commits**; hand-editing stays fully supported. |
@@ -242,7 +242,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit core-evidence` | any time | **the ONE loop-evidence writer** (strip-the-kit) — every core evidence record lands in a single append-only JSONL store inside the git dir (never committable; versioned schema, latest-per-key supersession, byte-identical duplicates refused, malformed lines fail every reader closed). `red-proof "<file>#<pattern>"` declares an observed-red **BEFORE a bugfix** (N/N red runs + content custody + base + the pre-fix fingerprint; green/mixed/timeout are DISTINGUISHED refusals — nothing written); `degrade --backend --reason` is the ONLY escape for an unavailable review backend (per-tree, never all backends); `summary` renders the whole loop state statelessly (gate result · per-backend verdicts · red-proofs · degrades) — no ledger, no rounds, nothing remembered. Honest residual: records are forgeable — self-discipline, not a security boundary. Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit coverage-check` | any time | **the final-run checker** (D3(c)+(d)) — **certifies coverage ONLY inside the `--final` run that owns the lcov** (ownership is exclusive by CONVENTION over the fixed path, not enforced — a concurrent writer to it is a stated residual, queued as LCOV-EXCLUSIVE-OWNERSHIP): an artifact on disk proves nothing about the tree it came from, so a standalone run prints its findings and states `attested=no` / `NO VERDICT` rather than a PASS (an lcov that predates an edit would otherwise certify a line the suite never executed). `attested=` claims a verdict was ISSUED, pass or fail — a run over uncovered lines still reads `attested=yes` and still exits 1, and a run whose coverage arm never executed (no lcov) reads `attested=no` even inside `--final`, because nothing was read and nothing is certified. The runner passes a nonce whose one-way commitment over `{nonce, fingerprint, base}` is the `final-start.attempt` it recorded; a context describing another tree, or matching no recorded attempt, is a REFUSAL, never a verdict. Findings are unchanged — reads the lcov the declared `unit-tests` gate produced at the FIXED git-dir path and fails on any uncovered CHANGED executable Node line (listed `file:line`; a changed file absent from the map is a file-level red; out-of-domain/unsupported files are LISTED — the claim narrowed honestly); VERIFIES every current-base red-proof declaration (bound test exists · custody hash unchanged · green N/N now · pre-fix fingerprint differs); prints `lcov-sha256=<hex|none>` of the exact bytes it consumed — the sha the `--final` receipt binds and re-hashes. An absent lcov is a LOUD `skipped-no-lcov`; a symlinked path is a refusal. `--check` is the gate exit code — declare it as the LAST gate (`run-gates --final` refuses otherwise). Read-only. |
 | `/agent-workflow-kit commit-guard` | any time | **the read-only pre-commit guard** (D10) — makes the commit capture the whole current working tree, so «verified» and «about to be committed» are the same bytes (the receipt itself has a stated residual — see the mode doc). FIRST it refuses an **INDEX that lags the verified working tree** (the gates and the fingerprint describe the WORKING tree while `git commit` takes the INDEX alone, and the fingerprint cannot tell them apart — so a lagging index used to ship a strict subset of what was verified): unstaged tracked paths or reviewable untracked-not-ignored paths, named up to a bounded cap with the remainder stated, a dirty tracked **submodule** named separately with its own recovery, and fail-closed on an undecidable probe. This deliberately blocks a partial commit. Then it binds the LATEST completed `run-gates --final` receipt to the EXACT current tree: refuses on a missing/red/stale receipt, fingerprint drift under the run, a dangling later attempt, declaration content drift, evidence-hash or lcov drift, or unsatisfied review obligations (the same review-state decision, recomputed over a sanitized env — forged out-of-repo stores never satisfy). Re-runs NO gate or test. Wire it into `.git/hooks/pre-commit` (the installer writes the RESOLVED invocation). `git commit --no-verify` stays the stated residual. |
-| `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, or the agents hidden-mode reconcile follow-up) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe, a feature-spec layer never adopted) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, the agents hidden-mode reconcile follow-up, or the spec-adoption decline preview) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit doc-parity` | any time | **read-only doc-parity lint** (AD-049) — kills the doc-drift class where a mode-contract doc silently lags a code constant (a `--check` doc still reading `300` after the diff cap moved to `400`): a **closed, exported registry** binds each live constant (review caps, schema versions, the ledger's own class/scope vocabulary, and the autonomy-doctor EXIT/status/trusted-dir contract) to the exact token its `references/modes/*.md` contract must carry, and asserts the CURRENT value renders into every bound file — a drifted doc, an unreadable file, or an absent token **fails closed**. The values are sourced from the live imports (never re-typed), so the lint can't itself go stale; adding a binding is adding a checked entry (closed-world, edit-safe). `--check` is a gate exit code for `docs/ai/gates.json`. Never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit dispatch` | any time | **the delegation engine** — makes "how much does delegating a sub-task actually buy?" a measured number instead of a feeling. `check <file>` validates a sub-task brief's contract block and exits 0/1 naming the first violated field — **form only**: whether the task is genuinely bounded, its design decided and its acceptance adequate stays your judgment, and a well-formed absurdity passes here by construction. `advise --step-class <c>` answers the question that comes BEFORE that one — which vehicle should carry this kind of sub-task, whether it is even present on this machine, and what the ledger has already recorded for threads of that class (finished, failed, closed without a fold, and still open — counted separately) — and it decides nothing: it refuses no dispatch, gates no verb, and a choice that diverges from the advice is noted rather than blocked. It reads the filesystem only: nothing is launched to find out what is installed, an absent ledger prints "no recorded history", an unreadable one prints the store's own words, and either way the advice still prints. The same block appears as a footer under a form-valid `check` — never under a refusal, so it can never hide one. `register` pre-registers an acceptance wave (step classes, pairing key, minimum observations per class, the mean and first-pass thresholds) so the bar can never be chosen after the results it judges — immutable per wave. `observe` records ONE hand-written observation (`solo-construction`, the baseline whose ratio is 1 by construction — except over a scope measuring zero bytes, which has no ratio at all and is recorded ineligible by name — or `self-reported`) — delegated numbers are never hand-written, they are derived. The writer verbs are where that derivation happens: `open` puts a delegated thread on the record with every mint-time field copied from the brief's own header, refusing a deadline the wrapper's cap plus its kill grace would not fit inside, and recording whether the tree it started from was clean (a dirty one makes the result honestly unmeasurable rather than quietly counted); `await` waits for that one dispatch to answer and writes nothing — only the finished receipt satisfies it, a run still holding the nonce means keep waiting, and a wait that runs out says so with its own exit code, names whether the deadline or your own timeout ended it, and authorizes nothing: a wait that ended without an answer is a question for you, never permission to dispatch again; `return` absorbs the receipt the wrapper minted — only a finished one, checked against the contract it actually ran, its deadline and its own report, and refused outright when the tree hides changes from git or moves while the return is being computed — and derives the bytes from git rather than from anyone's claim; `fold` is the acceptance, and it refuses if the tree moved since the return — precisely, it re-confirms **equality of the visible canonical payload**, which is a change detector rather than a cryptographic identity of the tree: that payload is unframed and carries no file mode, so a content or symlink target that imitates the marker opening the next entry can alias two trees, and an executable-bit flip moves nothing (both named as residuals in the mode doc, with the fix queued). Where the payload cannot follow an object's bytes at all — a binary, a non-regular path, a submodule, a symlink whose target is not valid UTF-8 — `return` and `fold` **refuse** rather than promise what they cannot check. `degrade` closes a thread that never earned a fold, on the record and with its reason. `aggregate` prints one wave: the registered thresholds, every observation as context, and per step class the finished threads — a folded success with git-provable bytes contributes its ratio, one whose bytes are unprovable is excluded from the mean but still counts in the first-pass rate, and a failed thread, a degrade-closed one, or one folded after failing acceptance each count as a real zero. Below the registered minimum nothing is computed (insufficient); at or above it is computed and labeled PILOT evidence. It REFUSES rather than guessing: no pre-registration, an unfinished thread in scope, a recorded refusal-to-delegate that never opened a thread, or an ambiguous wave each stop the computation by name. `handoff-return --slug <s>` closes the worktree loop after `land --prepare`: it re-attests that main still holds exactly the prepared tree under the same HEAD (both recorded in the handoff at prepare time), prints the satellite handoff's user-owned content byte for byte with its boundaries, byte lengths and the main-owned destinations each part folds into, prints the handoff digest and both OIDs as its proof, states the after-the-fold order (a fold landed after the gates leaves them stale), and records ONE self-reported worktree-stream observation only when the whole prepared change set is measurable — a deletion, a rename, a symlink, a submodule or a mode-only change ends with a named NOT RECORDED instead, never a partial number. Writes only its own append-only ledger inside the git dir (never committable); never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first — printed only for a link whose RAW TARGET is MAIN's `node_modules`, since a foreign or unreadable link is reported as such with no removal advised); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `prompt <slug>` is read-only too and re-prints the satellite's cold-start prompt — the same text `provision` ends its report with: where the worktree is, its ONE seeded plan, the handoff as the one channel back, MAIN's orientation (shared series index, landing) and, under its own heading because it is probed on the satellite, that checkout's install posture — every value derived LIVE rather than replayed from the frozen provision record, a recorded value that no longer matches NAMED as a divergence (with the cause its source makes likely) instead of printed as the runnable one, every offered command marked with WHO runs it (`MAIN $ …` for the landing, `HERE $ …` for this checkout's own install, a posture with nothing to run staying prose), and a control character in any rendered value a typed STOP rather than a forged prompt line; `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '10.1.0'
+  version: '10.3.0'
 ---
 
 # agent-workflow-kit

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '5.3.0'
+  version: '5.4.0'
 ---
 
 # antigravity-cli-bridge
@@ -163,7 +163,9 @@ billed turn restating the model's own prose (16,585 → 33,446 tokens on a match
 
 **Honesty + posture (D4/D5):** a run with no recognized `### Verdict` section — empty output
 included — **exits 4 with NO receipt**: treat it as a *failed review to re-run*, never a fatal
-session error. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
+session error. The verdict vocabulary is closed (SHIP / SHIP WITH NITS / REWORK), and a
+ship-class verdict arriving beside a numbered `### Blocking` finding is a verdict-body
+contradiction: the same exit 4, NO receipt, both halves named. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
 and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
 pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`

package/bridges/antigravity-cli-bridge/bin/agy-review-harness.test.mjs

@@ -0,0 +1,288 @@
+// Shared harness for the agy-review wrapper suites. PORTING TRAP: agy takes the prompt as the
+// `-p` ARGV value, NOT stdin — the fake captures the -p value from argv.
+import assert from 'node:assert/strict';
+import { after } from 'node:test';
+import {
+  mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFile } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const WRAPPER = join(HERE, 'agy-review.sh');
+
+const FAKE_ENVELOPE_ENCODER = [
+  'const text = require("node:fs").readFileSync(0, "utf8");',
+  'const [cid, status, shape] = process.argv.slice(1);',
+  'const envelope = { conversation_id: cid, status, response: text, duration_seconds: 1.5, num_turns: 1,',
+  '  usage: { input_tokens: 10, output_tokens: 5, thinking_tokens: 0, cache_read_tokens: 0, total_tokens: 15 } };',
+  'if (shape === "missing") delete envelope.conversation_id;',
+  'if (shape === "number") envelope.conversation_id = 42;',
+  'process.stdout.write(`${JSON.stringify(envelope)}\\n`);',
+].join('\n');
+
+export const FAKE_AGY = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  // --help / --version answer BEFORE any capture file is touched — a probe is never a paid dispatch.
+  'case "${1:-}" in',
+  '  --help|-h)',
+  '    if [[ -n "${AGY_FAKE_HELP_EXIT:-}" ]]; then echo "fake agy: help unavailable" >&2; exit "$AGY_FAKE_HELP_EXIT"; fi',
+  '    for f in --output-format --json-schema --disable-slash-commands --effort --mode; do',
+  '      if [[ "$f" == "${AGY_FAKE_HELP_OMIT:-}" ]]; then continue; fi',
+  '      printf "  %s   fake capability line\\n" "$f"',
+  '    done',
+  '    if [[ -n "${AGY_FAKE_HELP_EXTRA:-}" ]]; then printf "%s\\n" "$AGY_FAKE_HELP_EXTRA"; fi',
+  '    exit 0 ;;',
+  '  --version) printf "%s\\n" "${AGY_FAKE_VERSION:-1.1.13}"; exit 0 ;;',
+  'esac',
+  ': "${AGY_FAKE_ARGV:=/dev/null}"',
+  ': "${AGY_FAKE_ENV:=/dev/null}"',
+  ': "${AGY_FAKE_PROMPT:=/dev/null}"',
+  ': "${AGY_FAKE_SENTINEL:=/dev/null}"',
+  'printf invoked > "$AGY_FAKE_SENTINEL"',
+  'printf "%s" "$PWD" > "${AGY_FAKE_CWD:-/dev/null}"',
+  '{ for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_FAKE_ARGV"',
+  '{ echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "ANTIGRAVITY_API_KEY=${ANTIGRAVITY_API_KEY:-<unset>}"; } > "$AGY_FAKE_ENV"',
+  'prompt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "-p" ]]; then prompt="$a"; printf "%s" "$a" > "$AGY_FAKE_PROMPT"; fi; prev="$a"; done',
+  'aw_fmt=""',
+  'prev=""; for a in "$@"; do if [[ "$prev" == "--output-format" ]]; then aw_fmt="$a"; fi; prev="$a"; done',
+  // AGY_FAKE_BAD_TURN scopes the transport-breaking knobs to ONE turn; AGY_FAKE_RAW_STDOUT bypasses
+  // the envelope encoder entirely.
+  'aw_fake_emit() {',
+  '  local body="$1" aw_status="${AGY_FAKE_STATUS:-SUCCESS}" aw_raw=""',
+  '  if [[ -n "${AGY_FAKE_RAW_STDOUT+x}" ]]; then aw_raw=1; fi',
+  '  if [[ -n "${AGY_FAKE_BAD_TURN:-}" && "$turn" != "${AGY_FAKE_BAD_TURN}" ]]; then aw_status="SUCCESS"; aw_raw=""; fi',
+  '  if [[ -n "${AGY_FAKE_STDERR:-}" ]]; then printf "%s\\n" "$AGY_FAKE_STDERR" >&2; fi',
+  '  if [[ -n "$aw_raw" ]]; then printf "%s" "$AGY_FAKE_RAW_STDOUT"; return 0; fi',
+  '  if [[ "$aw_fmt" != "json" ]]; then printf "%s\\n" "$body"; return 0; fi',
+  `  printf "%s\\n" "$body" | node -e '${FAKE_ENVELOPE_ENCODER}' \\`,
+  '    "${AGY_FAKE_CONV_ID:-11111111-2222-3333-4444-555555555555}" "$aw_status" "${AGY_FAKE_CONV_SHAPE:-ok}"',
+  '}',
+  'prev=""; for a in "$@"; do',
+  '  if [[ "$prev" == "--add-dir" ]]; then',
+  '    printf "%s" "$a" > "${AGY_FAKE_ADDDIR:-/dev/null}"',
+  '    stat -c "%a" "$a" > "${AGY_FAKE_ADDDIR_MODE:-/dev/null}" 2>/dev/null || true',
+  '    art="$a/precomputed-change-set"',
+  '    if [[ -f "$art" ]]; then stat -c "%a" "$art" > "${AGY_FAKE_ARTIFACT_MODE:-/dev/null}" 2>/dev/null || true; cp "$art" "${AGY_FAKE_ARTIFACT_COPY:-/dev/null}" 2>/dev/null || true; fi',
+  '  fi; prev="$a"',
+  'done',
+  'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
+  // The fed lane needs a PER-TURN record: each invocation writes prompt/argv to "<file>.<turn>".
+  'turn=1',
+  'if [[ -n "${AGY_FAKE_TURNS:-}" ]]; then',
+  '  if [[ -s "$AGY_FAKE_TURNS" ]]; then turn=$(( $(cat "$AGY_FAKE_TURNS") + 1 )); fi',
+  '  printf "%s" "$turn" > "$AGY_FAKE_TURNS"',
+  '  printf "%s" "$prompt" > "${AGY_FAKE_PROMPT}.$turn"',
+  '  { for a in "$@"; do printf "%s\\n" "$a"; done; } > "${AGY_FAKE_ARGV}.$turn"',
+  'fi',
+  'if [[ -n "${AGY_FAKE_FAIL_TURN:-}" && "$turn" == "${AGY_FAKE_FAIL_TURN}" ]]; then',
+  '  printf "FAKE_TURN_FAILURE\\n" >&2; exit 3',
+  'fi',
+  // A FEED turn deliberately misbehaves (a premature verdict) so the isolation invariant is proven
+  // against the worst case.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"--- BEGIN CHANGE-SET PART "* && "$prompt" != *"Requested addresses"* ]]; then',
+  '  aw_fake_emit "$(printf "PREMATURE_FEED_CHATTER\\n### Verdict\\nREWORK")"; exit 0',
+  'fi',
+  // The FINAL turn answers the delivery-proof request honestly: by reading the bodies it was fed.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" && "$prompt" == *"Requested addresses"* ]]; then',
+  '  req="$(printf "%s" "$prompt" | awk "/^Requested addresses/{f=1; next} f && /^###/{exit} f{print}")"',
+  '  entries=()',
+  '  mapfile -t _items <<< "$req"',
+  '  for _it in "${_items[@]}"; do',
+  '    [[ -n "$_it" ]] || continue',
+  '    k="$(printf "%s" "$_it" | awk "{print \\$2}")"; l="$(printf "%s" "$_it" | awk "{print \\$4}")"',
+  '    src="$k"',
+  '    if [[ "${AGY_FAKE_PROOF_DUP:-}" == "1" ]]; then src=1; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OMIT:-}" == "$k" ]]; then continue; fi',
+  '    body="$(awk -v want="$l" "f && /^--- END CHANGE-SET PART /{exit} f{c++; if (c==want) {print; exit}} /^--- BEGIN CHANGE-SET PART /{f=1}" "${AGY_FAKE_PROMPT}.$src")"',
+  '    if [[ "${AGY_FAKE_PROOF_CORRUPT:-}" == "$k" ]]; then body="${body}X"; fi',
+  '    entry="$(printf "part %s line %s: %s" "$k" "$l" "$body")"',
+  '    if [[ "${AGY_FAKE_PROOF_BULLET:-}" == "1" ]]; then entry="- $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_NESTED:-}" == "$k" ]]; then entry="note: I believe $entry"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_PAD:-}" == "1" ]]; then entry="$(printf "part %02d line %04d: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then entry="$(printf "Part %s Line %s: %s" "$k" "$l" "$body")"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_HUGE:-}" == "$k" ]]; then entry="$(printf "part %s line 99999999999999999999: %s" "$k" "$body")"; fi',
+  '    entries+=("$entry")',
+  '    if [[ "${AGY_FAKE_PROOF_TWICE:-}" == "1" ]]; then entries+=("$entry"); fi',
+  '  done',
+  '  if [[ "${AGY_FAKE_PROOF_EXTRA:-}" == "1" ]]; then entries+=("part 99 line 1: an address nobody asked for"); fi',
+  '  if [[ "${AGY_FAKE_PROOF_HUGE_EXTRA:-}" == "1" ]]; then entries+=("part 99999999999999999999 line 1: an invented giant address"); fi',
+  '  out="$( {',
+  '    if [[ "${AGY_FAKE_PROOF_LATE:-}" == "1" ]]; then printf "### Verdict\\nSHIP\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_CASE:-}" == "1" ]]; then printf "### Delivery Proof\\n"; else printf "### Delivery proof\\n"; fi',
+  '    if [[ "${AGY_FAKE_PROOF_OUTSIDE:-}" == "1" ]]; then',
+  '      printf "(nothing here)\\n### Verdict\\nSHIP\\n"',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '    else',
+  '      if (( ${#entries[@]} > 0 )); then printf "%s\\n" "${entries[@]}"; fi',
+  '      printf "### Verdict\\nSHIP\\n"',
+  '    fi',
+  '    if [[ -n "${AGY_FAKE_FINAL_APPEND:-}" ]]; then printf "%s\\n" "$AGY_FAKE_FINAL_APPEND"; fi',
+  '  } )"',
+  '  aw_fake_emit "$out"',
+  '  exit 0',
+  'fi',
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then aw_fake_emit "$(printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP")"; else aw_fake_emit "$AGY_FAKE_OUTPUT"; fi',
+  'exit "${AGY_FAKE_EXIT:-0}"',
+  '',
+].join('\n');
+
+// A PATH whose entries are symlinks to the real PATH binaries EXCEPT the excluded names.
+const makePathWithout = (root, exclude = []) => {
+  const skip = new Set(exclude);
+  const dir = mkdtempSync(join(root, 'nobin-'));
+  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const name of names) {
+      if (skip.has(name)) continue;
+      const link = join(dir, name);
+      if (existsSync(link)) continue;
+      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
+    }
+  }
+  return dir;
+};
+
+// Farms and the sandbox template are read-only per invocation, so both are built ONCE and shared.
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const farms = new Map();
+export const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
+const TEMPLATE_HOME = (() => {
+  const home = join(SHARED_ROOT, 'template-home');
+  const bin = join(home, '.local', 'bin');
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
+  const repo = join(home, 'repo');
+  mkdirSync(repo);
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  g('init', '-q');
+  g('config', 'user.email', 'probe@example.com');
+  g('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'base.txt'), 'committed base\n');
+  g('add', '-A');
+  g('commit', '-qm', 'base');
+  return home;
+})();
+
+// `clean: true` leaves a pristine committed tree; the default leaves one untracked file so `code`
+// mode has a diff to review.
+export const makeSandbox = ({ clean = false } = {}) => {
+  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
+  cpSync(TEMPLATE_HOME, home, { recursive: true });
+  const bin = join(home, '.local', 'bin');
+  chmodSync(join(bin, 'agy'), 0o755);
+  const repo = join(home, 'repo');
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
+  return { home, bin, repo, g };
+};
+
+let runSeq = 0;
+// Asynchronous on purpose: a blocking spawnSync pinned the whole suite to one core.
+export const run = (sb, { args, env = {}, cwd, wrapper } = {}) => new Promise((settle) => {
+  const { home, bin, repo } = sb;
+  const farm = farmFor(['agy', 'agy-run']);
+  const tag = `cap-${++runSeq}`;
+  const cap = {
+    argv: join(home, `${tag}-argv`), env: join(home, `${tag}-env`), prompt: join(home, `${tag}-prompt`),
+    sentinel: join(home, `${tag}-sentinel`), adddir: join(home, `${tag}-adddir`),
+    adddirMode: join(home, `${tag}-adddir-mode`), artifactMode: join(home, `${tag}-artifact-mode`),
+    artifactCopy: join(home, `${tag}-artifact-copy`), turns: join(home, `${tag}-turns`),
+    dispatchCwd: join(home, `${tag}-dispatch-cwd`),
+  };
+  const child = execFile('bash', [wrapper || WRAPPER, ...args], {
+    cwd: cwd || repo,
+    encoding: 'utf8',
+    timeout: 30000,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      HOME: home,
+      PATH: `${bin}:${farm}`,
+      TMPDIR: process.env.TMPDIR ?? '/tmp',
+      AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
+      AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
+      AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
+      AGY_FAKE_TURNS: cap.turns, AGY_FAKE_CWD: cap.dispatchCwd,
+      ...env,
+    },
+  }, (error, stdout, stderr) => {
+    const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+    const turns = existsSync(cap.turns) ? Number(readFileSync(cap.turns, 'utf8')) : 0;
+    const prompts = [];
+    const argvs = [];
+    for (let i = 1; i <= turns; i += 1) {
+      prompts.push(readIf(`${cap.prompt}.${i}`));
+      argvs.push(readIf(`${cap.argv}.${i}`));
+    }
+    settle({
+      status: error ? (error.code ?? 1) : 0, signal: error?.signal ?? null, stdout, stderr,
+      invoked: existsSync(cap.sentinel),
+      argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
+      adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
+      artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
+      dispatchCwd: readIf(cap.dispatchCwd).trim(), turns, prompts, argvs,
+    });
+  });
+  // Only EPIPE is a refusal working — any other stdin write failure must reach the test.
+  child.stdin.on('error', (err) => { if (err.code !== 'EPIPE') throw err; });
+  child.stdin.end();
+});
+
+export const runAsync = run;
+
+export const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
+export const readReceipts = (repo) => {
+  const p = join(repo, RECEIPTS_REL);
+  if (!existsSync(p)) return [];
+  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+};
+
+// The chunked-feed lane: an over-cap change set is DELIVERED over turns and its delivery is PROVEN
+// by verbatim line echoes the final answer must reproduce.
+export const ARTIFACT_HEADER = '## The change set under review (assembled working-tree diff — repo-complete)';
+export const SHAPE_HEADER = '\n## Output — Markdown, this exact shape, nothing else';
+export const FED_CAP = 6000;
+export const MAX_COUNTABLE_PROOF_ADDRESS = 40;
+export const FED_WIDE_CAP = 24000;
+export const isAssemblerBanner = (line) =>
+  /^=== (repo file map|git status|staged diff|unstaged diff|untracked)/.test(line) && line.endsWith(' ===');
+
+export const seedFedChangeSet = (sb, { lines = 400, multibyte = false } = {}) => {
+  const body = Array.from({ length: lines }, (_, i) =>
+    multibyte
+      ? `line ${String(i).padStart(4, '0')} — multibyte marker ${'\u044e'.repeat(20)}`
+      : `unique change-set line ${String(i).padStart(4, '0')} — a distinctive body marker ${'x'.repeat(20)}`).join('\n');
+  writeFileSync(join(sb.repo, 'oversized.txt'), `${body}\n`);
+};
+
+export const inlineArtifactOf = (prompt) => prompt.slice(prompt.indexOf(ARTIFACT_HEADER), prompt.indexOf(SHAPE_HEADER));
+export const bodyOf = (turnPrompt) => {
+  const begin = turnPrompt.match(/--- BEGIN CHANGE-SET PART \d+ OF \d+ ---\n/);
+  if (!begin) return null;
+  const start = begin.index + begin[0].length;
+  return turnPrompt.slice(start, turnPrompt.indexOf('\n--- END CHANGE-SET PART ', start));
+};
+export const requestedBlockOf = (finalPrompt) => {
+  const start = finalPrompt.indexOf('Requested addresses');
+  assert.notEqual(start, -1, 'the final turn states which lines it requires');
+  const after2 = finalPrompt.slice(finalPrompt.indexOf('\n', start) + 1);
+  return after2.slice(0, after2.indexOf('\n###')).split('\n').filter(Boolean);
+};
+export const requestedOf = (finalPrompt) => requestedBlockOf(finalPrompt).map((item) => {
+  const [, part, line] = item.match(/^part (\d+) line (\d+)$/);
+  return { part: Number(part), line: Number(line) };
+});
+export const fedRun = (sb, extraEnv = {}) =>
+  run(sb, { args: ['code', '--facts', 'grounded fact'], env: { AGY_MAX_PROMPT_BYTES: String(FED_CAP), ...extraEnv } });

package/bridges/antigravity-cli-bridge/bin/agy-review-verdict.test.mjs

@@ -0,0 +1,109 @@
+// Contract under test: docs/ai/specs/bridges/agy-review-verdict.md (verdict-body honesty).
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rmSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeSandbox, run, readReceipts, seedFedChangeSet, fedRun } from './agy-review-harness.test.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const CONTRADICTION_OUTPUT = '### Verdict\nSHIP WITH NITS — solid, two nits.\n### Blocking\n1. correctness: drops the last chunk\n2. security: path traversal in the staging dir\n### Non-blocking\nnone\n### Questions\nnone';
+
+describe('agy-review.sh — a ship-class verdict cannot ride numbered Blocking findings', { concurrency: 2 }, () => {
+  // spec:agy-review-verdict/S1
+  it('a ship-class verdict beside a numbered Blocking item exits 4 with NO receipt — fresh and fed lanes alike', async () => {
+    const fresh = makeSandbox();
+    const r = await run(fresh, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const freshReceipts = readReceipts(fresh.repo);
+    rmSync(fresh.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(r.invoked, true, 'the contradiction is judged AFTER the run — a failed review, not a pre-spend refusal');
+    assert.equal(freshReceipts.length, 0, 'a contradictory run mints nothing');
+    const sb = makeSandbox();
+    seedFedChangeSet(sb);
+    const fed = await fedRun(sb, { AGY_FAKE_FINAL_APPEND: '### Blocking\n1. a numbered blocker the verdict ignores' });
+    const fedReceipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(fed.status, 4, fed.stderr);
+    assert.equal(fedReceipts.length, 0, 'the fed lane refuses the same shape after a PROVEN delivery');
+  });
+
+  // spec:agy-review-verdict/S2
+  it('a Blocking body of none — any case, trailing punctuation — mints exactly as today', async () => {
+    for (const noneForm of ['none', 'None.', 'NONE']) {
+      const sb = makeSandbox();
+      const output = `### Verdict\nSHIP WITH NITS — fine.\n### Blocking\n${noneForm}\n### Non-blocking\nnone\n### Questions\nnone`;
+      const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, `"${noneForm}" must pass: ${r.stderr}`);
+      assert.equal(receipts.length, 1);
+      assert.equal(receipts[0].verdict, 'SHIP WITH NITS');
+    }
+  });
+
+  // spec:agy-review-verdict/S3
+  it('REWORK is never refused by the cross-check, numbered Blocking items or not', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nREWORK — two real blockers.\n### Blocking\n1. the guard fails open\n2. the receipt lies\n### Non-blocking\nnone\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'a veto needs no corroboration');
+    assert.equal(receipts[0].verdict, 'REWORK');
+  });
+
+  // spec:agy-review-verdict/S4
+  it('an absent Blocking section is not a contradiction — the verdict-only read is unchanged', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: '### Verdict\nSHIP — clean, no sections beyond this one.' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the shape mandate lives in the prompt; absence is not judged here');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S5
+  it('the continuation lane refuses a contradictory verdict before its informational receipt', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['--continue'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4, r.stderr);
+    assert.equal(receipts.length, 0, 'a fresh:false receipt must not encode a contradiction either');
+  });
+
+  // spec:agy-review-verdict/S6
+  it('the refusal names both halves and the verdict is never rewritten or downgraded', async () => {
+    const sb = makeSandbox();
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: CONTRADICTION_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 4);
+    assert.match(r.stderr, /SHIP WITH NITS — solid, two nits\./, 'the RAW verdict line is named, reason text included');
+    assert.match(r.stderr, /drops the last chunk/, 'the first numbered Blocking item is named');
+    assert.match(r.stderr, /[Rr]e-run the review/, 'the recovery is the same as every failed review');
+    assert.equal(receipts.length, 0, 'no rewritten or downgraded verdict is ever minted');
+  });
+
+  // spec:agy-review-verdict/S8
+  it('a second Blocking heading terminates the scan — only the first section is judged', async () => {
+    const sb = makeSandbox();
+    const output = '### Verdict\nSHIP — clean.\n### Blocking\nnone\n### Blocking\n1. a numbered item under a duplicate heading\n### Questions\nnone';
+    const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: output } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts.length, 1, 'the first section said none — a later heading cannot suppress the receipt');
+    assert.equal(receipts[0].verdict, 'SHIP');
+  });
+
+  // spec:agy-review-verdict/S7
+  it('the loadable skill text names the closed verdict vocabulary', async () => {
+    const skill = readFileSync(resolve(HERE, '..', 'SKILL.md'), 'utf8');
+    assert.match(skill, /SHIP \/ SHIP WITH NITS \/ REWORK/, 'the closed vocabulary is spelled in SKILL.md, not only in --help and failure stderr');
+  });
+});

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -338,7 +338,7 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.7 Flash (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="5.3.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="5.4.0"  # aw-version-anchor
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
@@ -1070,6 +1070,14 @@ parse_agy_verdict() { # $1 = captured-output file
   fi
 }
 
+parse_agy_verdict_line() { # $1 = captured-output file
+  awk '/^### Verdict[[:space:]]*$/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null
+}
+
+parse_agy_blocking_first_numbered() { # $1 = captured-output file
+  awk 'flag && /^### /{exit} /^### Blocking[[:space:]]*$/{flag=1; next} flag && /^[0-9]+[.)]/{print; exit}' "$1" 2>/dev/null
+}
+
 # The repo file map is a FIXED cost that scales with REPO SIZE, not change size (measured 28,735
 # bytes in the home repo — 24% of agy's 120000-byte single-argv ceiling), so an unbounded map taxes
 # the change budget of every review. AW_REVIEW_MAP_BUDGET_BYTES bounds it; the value is set by each
@@ -2111,6 +2119,16 @@ if [[ $rc -eq 0 ]]; then
     echo "       the review; if it recurs, inspect the captured output for what the model produced." >&2
     exit 4
   fi
+  if [[ "$verdict" == "SHIP" || "$verdict" == "SHIP WITH NITS" ]]; then
+    first_blocking_item="$(parse_agy_blocking_first_numbered "$review_out_file")"
+    if [[ -n "$first_blocking_item" ]]; then
+      verdict_line="$(parse_agy_verdict_line "$review_out_file")"
+      echo "error: verdict-body contradiction — '### Verdict' reads '$verdict_line' while '### Blocking'" >&2
+      echo "       carries a numbered finding ($first_blocking_item). A ship-class verdict cannot" >&2
+      echo "       ride blocking findings; NO receipt was written. Re-run the review." >&2
+      exit 4
+    fi
+  fi
   if [[ -n "$resume_mode" ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /