@sabaiway/agent-workflow-kit 10.4.0 → 10.6.0

package/tools/procedures.mjs

@@ -35,7 +35,7 @@ import { resolveEngineDir, readEngineFragment, PROCEDURES_FRAGMENT_REL } from '.
 import { plansInFlight, PLANS_REL } from './plan-files.mjs';
 // The family's ONE shell quoter for a RENDERED command operand (bare when the value is already safe,
 // single-quoted otherwise) — the same leaf eight other command renderers here read through.
-import { shellQuoteArg } from './repo-lex.mjs';
+import { shellQuoteArg, isSeedablePathToken, isRenderableLine, escapeForDisplay, isArtifactPathCarriable } from './repo-lex.mjs';
 // The config schema/read core (orchestration-config.mjs, the single config contract): the reader +
 // the SHARED slot/recipe validity, never the fs-writer (orchestration-write.mjs) DIRECTLY — the
 // import-split test pins the direct-import rule.
@@ -46,7 +46,10 @@ import { AUTONOMY_REL, loadAutonomy, resolveAutonomy, isSparseSeedConfig } from
 // orchestration-write (the import-split test pins both direct rules; the TRANSITIVE claim is
 // structural — test/read-graph-purity.test.mjs pins it).
 import { resolveFlowStorePath, readFlowStore } from './flow-store-read.mjs';
+import { readDelegationLedger } from './dispatch-store-read.mjs';
+import { foldLaneLines, HELD_RECEIPT_BACKEND, judgeLedger } from './held-session.mjs';
 import { CHAIN_KIND } from './flow-record.mjs';
+import { readRegistration } from './mcp-registration.mjs';
 // The declared source-size practice (D-17 U1), read through the practice's PURE READ core — never
 // source-size-check.mjs, which owns the writer half: this advisor is a read root of
 // test/read-graph-purity.test.mjs, and the core exists so a surface can ask without reaching a writer.
@@ -166,7 +169,7 @@ const resolveAllSlots = ({ activity, config, detection, overrides }) => {
     // planRecipe's drift-guarded dispatch for WHICH backends, then resolve each (backend, role) to its
     // manifest wrapper cmd via the bridge registry — no wrapper name is hand-composed here. A vehicle
     // step is NOT a bridge: it carries its own state and is never looked up in a manifest.
-    const { dispatch } = planRecipe(resolved.recipe, detection);
+    const { dispatch } = resolved.roster ? { dispatch: [] } : planRecipe(resolved.recipe, detection);
     const vehicles = dispatch.filter((d) => d.vehicle != null).map((d) => ({ backend: d.backend, state: d.vehicle }));
     const bridged = dispatch.filter((d) => d.vehicle == null);
     const backends = bridged.map((d) => wrapperCmdFor(d.backend, d.role)).filter(Boolean);
@@ -189,8 +192,9 @@ const resolveAllSlots = ({ activity, config, detection, overrides }) => {
 // carrier-typed slot (registry-driven — no slot name is spelled here), solo when it has none.
 const effectiveCarrier = (slots) => slots.find((s) => s.slotType === 'carrier')?.recipe ?? 'solo';
 
-// An unsatisfiable EXPLICIT override is the only "warning" (loud, flagged for the agent to relay). A
-// graceful config/default degradation is reported as a per-slot reason, not a warning.
+// An unsatisfiable EXPLICIT override is a warning (loud, flagged for the agent to relay); a graceful
+// config/default degradation remains a per-slot reason. Canon/registry slot-skew warnings are
+// collected separately, after the live section is read.
 const collectWarnings = (slots) =>
   slots
     .filter((s) => s.overrideUnsatisfied)
@@ -216,24 +220,34 @@ const backendSetLabel = (backends) =>
       : ` → ${backends[0]}`;
 
 // The review-loop economics block (M1 + M6's firing half) — printed when the activity engages a review
-// backend (a slot resolving reviewed | council) and OMITTED for solo. It paraphrases the procedures.md
+// member: a slot RESOLVING reviewed | council, a roster, or one whose config or override REQUESTED a
+// review recipe and degraded (readiness removes no configured obligation, and the table still judges
+// it); omitted only for a solo nobody asked to be otherwise. It paraphrases the procedures.md
 // Fold + loop step + orchestration §4 canon (no rival rule): the ≤2-round architecture cap, the bar met by RAISING a
 // surviving major to an acceptance invariant (not exhausting prose), backend divergence = the crossover
 // stop, the thin-plan/diff-review carve-out, a self-consistency read before every re-review, and the
 // REQUIRED per-round structured emission {round N · finding-origin tally · per-backend verdict}. Only a
-// review slot can resolve reviewed|council (execute floors at solo|delegated), so gate on the recipe.
+// review slot can resolve or request reviewed|council (execute floors at solo|delegated), so the gate
+// reads the recipe, the requested recipe and the roster.
 const REVIEW_RECIPES = new Set(['reviewed', 'council']);
+const CONSULT_LINE = '  • Before every fold of a finding raised by a review member (a bridge backend or a placed lens): ASK that member whether the proposed fold solves it and adds no new problem; WAIT for its answer, READ it, then edit only as accepted or corrected — agy: agy-review --continue --decided @f --focus "Finding: <finding>. Proposed fold: <exact fold>. Does this proposed fold solve the finding and add no new problem? Reply accept, or correct with exact replacement text."; codex: fresh codex-review plan <consult-brief> written before the working tree changes; a placed lens: re-dispatch the same lens vehicle with the finding and the proposed fold. A self-review finding, or any finding when no review member ran, is folded directly — the exemption is the finding\'s ORIGIN, never the recipe word on the slot line.';
+const ARMED_CONSULT_LINE = '  • ARMED pre-fold sequence for a bridge-raised finding: the round is open → dispatch that bridge\'s consult with a nonce → WAIT and READ → fold accepted or corrected → flow-writer consult-attestation <planId> --backend <id> --nonce <n> --proposed-fix-digest <the-sha256-of-the-fold-text> → then edit. A lens-raised finding re-dispatches the lens without a nonce, WAIT and READ, then edit as accepted or corrected — it mints no manifest and no attestation — only its per-round participation rides its internal-attestation.';
 // activity-aware (AD-046): the triage classification vocabulary rides EVERY review-backed activity;
 // the LEDGER pointer renders ONLY for plan-execution — the ledger is plan-execution-scoped (AD-045),
 // and pointing plan-authoring at it would send rounds of the wrong activity into the code loop's gate.
-const reviewLoopAdvice = (slots, activity) =>
-  slots.some((s) => REVIEW_RECIPES.has(s.recipe))
+// A lens-only roster resolves to `solo` and a fully degraded request resolves to `solo`: both still run
+// a review round, which is why the gate never reads the effective recipe alone.
+const reviewLoopAdvice = (slots, activity, flowArmed = false, plans = []) =>
+  slots.some((s) => s.roster != null || REVIEW_RECIPES.has(s.recipe) || REVIEW_RECIPES.has(s.degradedFrom))
     ? [
         'Review-loop economics (procedures.md Fold + loop · orchestration.md §4) — the review this recipe runs:',
+        CONSULT_LINE,
+        ...(activity === 'plan-execution' && flowArmed ? [ARMED_CONSULT_LINE] : []),
         '  • Cap architecture plan-review at ≤2 rounds; the bar is met by RAISING a surviving major to an acceptance invariant (or handing it to Execute/diff-review), never by exhausting the strictest backend.',
         '  • Backend divergence (one backend grounded-ships while another keeps revising mechanics) IS the crossover stop.',
         '  • Route an all-mechanics/CI or prose-only artifact to a thin plan + diff-review; run a self-consistency read before every re-review.',
         '  • Each round MUST emit {round N · finding-origin tally (first-draft / fold-induced / mechanics) · per-backend verdict} so the crossover is a computed signal.',
+        ...(activity === 'plan-authoring' ? roundRenderAdvice(slots, plans) : []),
         '  • At the cap, classify every surviving blocking finding: fixable-bug (fold ONCE as a red→green test, re-review) / inherent-layer-residual (document + raise to an acceptance criterion) / escalate (the maintainer decides); a minor never forces triage.',
         ...(activity === 'plan-execution'
           ? [
@@ -246,38 +260,119 @@ const reviewLoopAdvice = (slots, activity) =>
 // The grounding pre-step (AD-038, extending the AD-033 verbatim-contract rendering): whenever the
 // resolved dispatch includes agy-review, print the CONCRETE facts-assembly invocation + the
 // --facts form as a copy-paste pre-step — population, not placeholders. Plan-path population rule
-// (the review-state plan-in-flight detector): exactly ONE plan in flight → render it populated;
-// zero or several → the explicit `--plan <path>` placeholder + a one-line discovery caveat. The
+// (the review-state plan-in-flight detector): exactly ONE renderable plan in flight → render it
+// populated; zero, several, or a name a one-line render cannot carry → the explicit placeholder + a
+// one-line discovery caveat; a name the receipt encoder refuses falls back on the receipt-minting
+// or receipt-matching command only (`agy-review plan`, the round table). The
 // suggested --out lives OUTSIDE the repo (/tmp) — grounding.mjs refuses a non-scratch destination.
 // Exported for the bridge-tier byte-parity pin (AD-044 Plan 4): the velocity tier seeds the
 // grounding rule in EXACTLY this rendered spelling — `node "${GROUNDING_TOOL}"` — so seeded and
 // rendered forms can never drift apart.
 export const GROUNDING_TOOL = join(dirname(fileURLToPath(import.meta.url)), 'grounding.mjs');
+export const REVIEW_ROUNDS_TOOL = join(dirname(fileURLToPath(import.meta.url)), 'review-rounds-cli.mjs');
+export const REPO_SEARCH_TOOL = join(dirname(fileURLToPath(import.meta.url)), 'repo-search.mjs');
 const GROUNDING_FACTS_OUT = '/tmp/review-facts.md';
+const MINTS_RECEIPT = Object.freeze({ mintsReceipt: true });
+
+// The round table judges what review-rounds-cli resolves from the config (S27), never this render's
+// override or degradation, so the advisor states that fact beneath the command instead of predicting
+// when the two agree; a bridge-less roster gets the fact that no receipt can exist in the command's place.
+// A requested review recipe renders the command even when every bridge is unavailable here: readiness
+// degradation removes no configured obligation, so the table still has something to say.
+const ROUND_RENDER_FACT_LINE = "  ↳ the table judges the obligation review-rounds-cli resolves from docs/ai/orchestration.json (S27) — the configured recipe, or the computed default for a silent slot — never this run's --override or a degraded recipe; it reads receipts only: a backend that did not run shows as missing (no receipts when none ran), and its degrade record is judged by review-state and core-evidence summary, not here.";
+const ROUND_RENDER_NO_BRIDGE_LINE = "  • Round render: a roster with no bridge mints no receipt, so review-rounds-cli cannot supply this round's verdicts — emit the finding-origin tally plus each lens member's verdict (or silent) directly.";
+const roundRenderAdvice = (slots, plans) => {
+  const review = slots.find((s) => s.slot === 'review');
+  if (review === undefined) return [];
+  const roster = review.roster ?? null;
+  const shouldRenderCommand = roster === null
+    ? (review.backends ?? []).length > 0 || REVIEW_RECIPES.has(review.degradedFrom)
+    : roster.some((row) => row.kind === 'bridge');
+  if (!shouldRenderCommand) return [ROUND_RENDER_NO_BRIDGE_LINE];
+  const lensMembers = (roster ?? []).filter((row) => row.kind === 'lens').map((row) => row.member);
+  const operand = populatedPlan(plans, MINTS_RECEIPT);
+  return [
+    `  • Round render (verdict half of the per-round emission; the finding-origin tally stays the orchestrator's): node ${renderToolPath(REVIEW_ROUNDS_TOOL)} --artifact ${operand ?? '<plan-file>'}`,
+    ...planDiscoveryCaveat(plans, '--artifact', 'populate --artifact with the plan file under review.', operand === null ? ['--artifact'] : []),
+    ROUND_RENDER_FACT_LINE,
+    ...(lensMembers.length > 0 ? [`  ↳ the table carries the bridge verdicts only — add each lens member's verdict (or silent) by hand: ${lensMembers.join(', ')}`] : []),
+  ];
+};
+
+// The ONE plan in flight as a pasteable operand: shell-significant bytes ride shellQuoteArg; a name a
+// one-line render cannot carry is never populated, nor one the receipt encoder refuses (S21) for a
+// command that MINTS or MATCHES a plan receipt: agy-review plan would be refused pre-spend by name, the
+// round table would match no receipt.
+const populatedPlan = (plans, { mintsReceipt = false } = {}) => {
+  if (plans.length !== 1 || !isRenderableLine(plans[0])) return null;
+  if (mintsReceipt && !isArtifactPathCarriable(plans[0])) return null;
+  return shellQuoteArg(`${PLANS_REL}/${plans[0]}`);
+};
+const planDiscoveryCaveat = (plans, flag, noPlanAction, fellBack = []) => {
+  if (plans.length === 0) return [`  ↳ plan discovery: no plan in flight under ${PLANS_REL} — ${noPlanAction}`];
+  if (plans.length > 1) return [`  ↳ plan discovery: ${plans.length} plans in flight under ${PLANS_REL} (${plans.map(escapeForDisplay).join(', ')}) — populate ${flag} with the one under review.`];
+  return fellBack.length === 0
+    ? []
+    : [`  ↳ plan discovery: the plan in flight ${escapeForDisplay(plans[0])} carries a character that either a review receipt or a rendered command cannot carry — ${fellBack.join(' and ')} ${fellBack.length === 1 ? 'stays a placeholder' : 'stay placeholders'}; rename the plan.`];
+};
+
+// The kit-tools tier seeds `Bash(node <abs>/tools/repo-search.mjs:*)` BARE (velocity-profile.mjs
+// deriveKitToolsAllowlist, the same predicate), so a seedable path renders bare — a quoted path is
+// a different prefix and the allow rule is dead. A path the tier could never seed has no rule to
+// match and is single-quoted for a safe paste (double quotes would still expand `$` and backticks).
+const renderToolPath = (abs) => (isSeedablePathToken(abs) ? abs : shellQuoteArg(abs));
+// `registered` is the registration on disk, never the tool's availability in this session — the
+// command line stays as the fallback under the typed form. `toolPath` is a test seam (an unseedable
+// kit path is not constructible from a test against the real checkout).
+const readersSweepAdvice = (activity, registered, toolPath = REPO_SEARCH_TOOL) => {
+  if (activity !== 'plan-authoring') return [];
+  return [
+    'Readers sweep (before the first review) — for every changed config key, registry entry, exported constant, receipt field or canon sentence:',
+    ...(registered ? ['  use: repo_search {"pattern": "<the literal>"} — the kit\'s read-only MCP tool (registration complete; if it is not loaded in this session, the command below)'] : []),
+    `  run: node ${renderToolPath(toolPath)} --pattern <the literal> (a pattern carrying a shell-significant byte goes through --pattern-file <f> instead)`,
+    '  classify every reader as a ledger row, a stated non-goal, or unchanged with its proof',
+  ];
+};
+
+// The canon's own claim — the kit "parses only each section's `Slots:` line" — made true: an installed
+// engine older (or newer) than this kit's registry prints its section verbatim, so the skew is SAID.
+// A section without a Slots line is a customized canon, not a skew: silent. Never the exit code.
+const SLOTS_LINE = /^Slots:[ \t]*(.+?)[ \t]*$/mu;
+const slotSkewWarning = (section, activity) => {
+  const listed = section.match(SLOTS_LINE)?.[1].split(',').map((s) => s.trim()).filter(Boolean);
+  const registry = Object.keys(ACTIVITIES[activity].slots);
+  if (listed == null || listed.join(',') === registry.join(',')) return [];
+  return [`the installed engine's canon lists slots (${listed.join(', ')}) for ${activity} while this kit's registry names (${registry.join(', ')}) — the resolved lines follow the registry; the engine and this kit are out of step — /agent-workflow-kit status names which member is behind: upgrade that one. Tell the user.`];
+};
 const groundingPreStepAdvice = (activity, slots, plans) => {
   if (!slots.some((s) => (s.backends ?? []).includes('agy-review'))) return [];
-  const planArg = plans.length === 1 ? `--plan "${PLANS_REL}/${plans[0]}"` : '--plan <path>';
-  // plan-authoring reviews the plan FILE — when exactly one plan is in flight, the review command
-  // is populated with the same discovered path (a known path never renders a placeholder).
+  const operand = populatedPlan(plans);
+  const planArg = operand === null ? '--plan <path>' : `--plan ${operand}`;
+  const reviewOperand = populatedPlan(plans, MINTS_RECEIPT);
+  // plan-authoring reviews the plan FILE — a plain name in flight renders the review command populated;
+  // the renderability and receipt-carriability fallbacks are the only placeholders a known path produces.
   const reviewForm =
     activity === 'plan-authoring'
-      ? plans.length === 1
-        ? `agy-review plan "${PLANS_REL}/${plans[0]}"`
-        : 'agy-review plan <plan-file>'
+      ? reviewOperand === null
+        ? 'agy-review plan <plan-file>'
+        : `agy-review plan ${reviewOperand}`
       : 'agy-review code';
   // `run:`/`then:` prefixes keep these POPULATED command lines machine-distinguishable from the
   // verbatim contract DESCRIPTORS above (the descriptor drift guard set-equals bare wrapper lines).
-  // Path arguments are double-quoted — a skill dir or plan name with a space must stay copy-pasteable.
+  // The TOOL path stays double-quoted (the bridge tier seeds that exact byte-form); the plan operand
+  // rides shellQuoteArg — bare when safe, single-quoted otherwise.
   const lines = [
     'Grounding pre-step (agy is dispatched — assemble the verified facts BEFORE the review; grounding.mjs slices verbatim, judgment additions stay yours):',
     `  run:  node "${GROUNDING_TOOL}" --constraints --autonomy ${planArg} --out ${GROUNDING_FACTS_OUT}`,
     `  then: ${reviewForm} --facts @${GROUNDING_FACTS_OUT}`,
   ];
-  if (plans.length === 0) {
-    lines.push(`  ↳ plan discovery: no plan in flight under ${PLANS_REL} — substitute the plan file you are reviewing against, or drop --plan for constraints+autonomy facts.`);
-  } else if (plans.length > 1) {
-    lines.push(`  ↳ plan discovery: ${plans.length} plans in flight under ${PLANS_REL} (${plans.join(', ')}) — populate --plan with the one under review.`);
-  }
+  const fellBack = [operand === null ? '--plan' : null, activity === 'plan-authoring' && reviewOperand === null ? 'agy-review plan' : null].filter(Boolean);
+  lines.push(...planDiscoveryCaveat(
+    plans,
+    '--plan',
+    'substitute the plan file you are reviewing against, or drop --plan for constraints+autonomy facts.',
+    fellBack,
+  ));
   return lines;
 };
 
@@ -486,7 +581,22 @@ const contractLines = ({ cmd, contract, settings }) => {
   return lines;
 };
 
-const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flowHalves, declaredPractice, foldScope, specCheck }) => {
+const foldLaneAdvice = ({
+  activity,
+  slots,
+  cwd,
+  env,
+  resolveStore,
+  readStore,
+  audit,
+  readHead,
+}) => {
+  if (activity !== 'plan-execution' || slots.find((slot) => slot.slot === 'execute')?.recipe !== 'delegated') return [];
+  const ledger = readDelegationLedger(cwd, env, { resolveStore, readStore, audit, readHead });
+  return foldLaneLines(judgeLedger(ledger, { backend: HELD_RECEIPT_BACKEND, degrades: [] }));
+};
+
+const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flowHalves, flowArmed, readersSweep, declaredPractice, foldScope, specCheck, foldLane }) => {
   const lines = [
     section,
     '',
@@ -506,13 +616,15 @@ const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flow
       for (const line of dispatchForm({ activity, slot: s.slot, state: v.state })) lines.push(`      ${line}`);
     }
     for (const c of s.contracts ?? []) lines.push(...contractLines(c));
+    if (s.slot === 'execute' && foldLane.length) lines.push('', ...foldLane);
   }
   if ((flowHalves ?? []).length) lines.push('', ...flowHalves);
   const autonomyBlock = autonomyAdvice(activity, autonomy);
   if (autonomyBlock.length) lines.push('', ...autonomyBlock);
+  if (readersSweep.length) lines.push('', ...readersSweep);
   const grounding = groundingPreStepAdvice(activity, slots, plans);
   if (grounding.length) lines.push('', ...grounding);
-  const advice = reviewLoopAdvice(slots, activity);
+  const advice = reviewLoopAdvice(slots, activity, flowArmed, plans);
   if (advice.length) lines.push('', ...advice);
   if (foldScope.length) lines.push('', ...foldScope);
   if (specCheck.length) lines.push('', ...specCheck);
@@ -525,15 +637,19 @@ const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flow
   return lines.join('\n');
 };
 
-const buildJson = ({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, declaredPractice, foldScope, specCheck }) => ({
+const buildJson = ({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, flowArmed, readersSweep, declaredPractice, foldScope, specCheck, foldLane }) => ({
   activity,
   section,
   slots: Object.fromEntries(
     // `backends: string[]` is the STABLE pre-existing shape (wrapper names) — never repurposed.
     // `contracts` is the ADDITIVE per-dispatch driving-contract field (empty for solo).
-    slots.map((s) => [s.slot, { recipe: s.recipe, source: s.source, degradedFrom: s.degradedFrom, reason: s.reason, backends: s.backends, contracts: s.contracts }]),
+    slots.map((s) => [s.slot, {
+      recipe: s.recipe, source: s.source, degradedFrom: s.degradedFrom, reason: s.reason, backends: s.backends, contracts: s.contracts,
+      ...(s.roster ? { roster: s.roster } : {}),
+    }]),
   ),
-  reviewLoop: reviewLoopAdvice(slots, activity),
+  reviewLoop: reviewLoopAdvice(slots, activity, flowArmed, plans),
+  readersSweep,
   // ADDITIVE (AD-038): the populated grounding pre-step, structured (empty when agy is not dispatched).
   groundingPreStep: groundingPreStepAdvice(activity, slots, plans),
   // ADDITIVE (cost-tiered execution): the unconditional cost-lane advisory, structured.
@@ -542,6 +658,7 @@ const buildJson = ({ activity, section, slots, configSource, warnings, plans, au
   foldScope,
   // ADDITIVE (spec layer 2b): the spec-store block, structured (empty outside plan-execution).
   specCheck,
+  foldLane,
   // ADDITIVE (AD-044 Plan 4): the per-activity autonomy block, structured (empty when unresolvable).
   autonomy: autonomyAdvice(activity, autonomy),
   // ADDITIVE (D-17 U1): the SAME composed lines the human render prints — one array, two renders, so
@@ -608,7 +725,7 @@ export const main = (argv, ctx = {}) => {
       ),
     });
     const slots = resolveAllSlots({ activity, config, detection, overrides });
-    const warnings = [...detectWarnings, ...collectWarnings(slots)];
+    const warnings = [...detectWarnings, ...collectWarnings(slots), ...slotSkewWarning(section, activity)];
     const plans = plansInFlight(cwd);
     // The autonomy facts (AD-044 Plan 4): resolved levels + red-lines from the policy file. A
     // malformed policy renders LOUDLY in the block AND flips the exit to 1 (config error) — the
@@ -628,13 +745,26 @@ export const main = (argv, ctx = {}) => {
     // The flow armed-halves block (P8): probed ONLY when the config carries a flow block — an
     // unarmed project keeps byte-identical output (human AND JSON) and never pays the store probe.
     const flowProbe = ctx.flowProbe ?? defaultFlowProbe;
-    const flowHalves = config?.flow == null ? null : flowHalvesAdvice(config.flow, flowProbe(cwd));
+    const flowState = config?.flow == null ? null : flowProbe(cwd);
+    const flowHalves = flowState == null ? null : flowHalvesAdvice(config.flow, flowState);
+    const registrationReader = ctx.readRegistration ?? readRegistration;
+    const readersSweep = readersSweepAdvice(activity, activity === 'plan-authoring' && registrationReader(cwd).registered, ctx.repoSearchTool);
     const declaredPractice = declaredPracticeAdvice(cwd, readFile, lstat);
     const foldScope = foldScopeAdvice(activity, config, plans);
     const specCheck = specCheckAdvice(activity);
+    const foldLane = foldLaneAdvice({
+      activity,
+      slots,
+      cwd,
+      env,
+      resolveStore: ctx.resolveDelegationStorePath,
+      readStore: ctx.readDelegationStore,
+      audit: ctx.auditDelegationStoreSemantics,
+      readHead: ctx.readHeadInstant,
+    });
     const stdout = json
-      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, declaredPractice, foldScope, specCheck }), null, 2)
-      : formatHuman({ activity, section, slots, warnings, plans, autonomy, flowHalves, declaredPractice, foldScope, specCheck });
+      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, flowArmed: flowState?.armed === true, readersSweep, declaredPractice, foldScope, specCheck, foldLane }), null, 2)
+      : formatHuman({ activity, section, slots, warnings, plans, autonomy, flowHalves, flowArmed: flowState?.armed === true, readersSweep, declaredPractice, foldScope, specCheck, foldLane });
     if (autonomy?.error) {
       return { code: 1, stdout, stderr: `procedures: malformed ${AUTONOMY_REL} — ${autonomy.error}` };
     }

package/tools/recipes.mjs

@@ -1,19 +1,9 @@
 #!/usr/bin/env node
-// Recipe planner — the pure brain behind the read-only `/agent-workflow-kit recipes` advisor.
-//
-// A "recipe" is a NAMED orchestration pattern over the family's optional carriers: the
-// subscription-CLI bridges (codex-cli-bridge → `codex`, antigravity-cli-bridge → `agy`) and the
-// executor subagent vehicle. The ENGINE owns the canonical narrative
-// (agent-workflow-engine/references/orchestration.md, kept in lockstep by the recipe-name parity
-// guard in recipes.test.mjs); this module owns the EXECUTABLE dispatch. The activity/slot registry
-// lives in carriers.mjs, re-exported here so every importer keeps its './recipes.mjs' path.
-// Invariants: pure (no fs/network/CLI in planRecipe/recommendRecipe), read-only, NEVER runs a
-// subscription CLI. The orchestrator executes a recipe and always makes the single commit; a
-// backend or a subagent is advisory or delegated, never autonomous. Dependency-free, Node >= 22.
+// Read-only recipe planner. The engine owns the narrative; carriers.mjs owns the activity/slot
+// registry re-exported here. Pure planning functions never run a subscription CLI.
 
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-// The READ-ONLY settings core, never the writer: this advisor never pulls in the atomic-write core.
 import { settingsSnapshot, DEFAULT_BUNDLE_ROOT } from './bridge-settings-read.mjs';
 import { isDirectRun } from './direct-run.mjs';
 import {
@@ -29,10 +19,13 @@ import {
   vehicleDegradeReason,
   EXECUTOR_APPLY,
   safeLine,
+  DISPLAY_ALIASES,
+  BACKEND_PRIORITY,
 } from './carriers.mjs';
-// The READ core of the vehicle surface, never the writer: this advisor can never reach a module
-// that creates `.claude/agents/`.
-import { surveyExecutorVehicle } from './cheap-agents-read.mjs';
+import { surveyExecutorVehicle, surveyVehicle } from './cheap-agents-read.mjs';
+import { obligationsOf } from './review-roster.mjs';
+import { resolveRoster, activeLineCell, remedyFor } from './review-roster-resolve.mjs';
+import { posturesByBackend } from './bridge-posture.mjs';
 import {
   detectBackends,
   wrapperCmdFor,
@@ -43,32 +36,32 @@ import {
   DEGRADED,
 } from './detect-backends.mjs';
 
-export { ACTIVITIES, POLICY_ACTIVITIES, SLOT_RECIPES, isSwitchSlot, EXECUTOR_APPLY, safeLine };
+export { ACTIVITIES, POLICY_ACTIVITIES, SLOT_RECIPES, isSwitchSlot, EXECUTOR_APPLY, safeLine, DISPLAY_ALIASES };
 
-const CODEX = 'codex-cli-bridge';
-const AGY = 'antigravity-cli-bridge';
+const [CODEX, AGY] = BACKEND_PRIORITY;
 
-// The manifest-name → human-alias map (the detector emits manifest names; humans say codex/agy).
-export const DISPLAY_ALIASES = { [CODEX]: 'codex', [AGY]: 'agy' };
-
-// The provider → role table, keyed by the name the readiness array carries, NOT the display alias.
-// The bridge rows are drift-guarded against each capability.json `provides[]`; the executor row is
-// the vehicle withVehicle appends, and the ONLY provider of `carry`.
+// Keyed by readiness-array provider name; executor is the only `carry` provider.
 export const BACKEND_ROLES = {
   [CODEX]: ['execute', 'review'],
   [AGY]: ['review', 'probe'],
   [EXECUTOR_PROVIDER]: [CARRY_ROLE],
 };
 
-// Review obligations from the CONFIGURED plan-execution.review recipe — the RAW config value, never
-// the readiness-degraded one. Homed HERE so review-state and flow-check share one backend set (#42).
-export const requiredBackendsForConfiguredRecipe = ({ config, readiness = [], detectionFailed = false } = {}) => {
-  const configured = config?.['plan-execution']?.review;
+// Review obligations from the CONFIGURED activity's review recipe — the RAW config value, never
+// the readiness-degraded one. The default preserves review-state and flow-check's backend set (#42).
+export const requiredBackendsForConfiguredRecipe = ({ config, readiness = [], detectionFailed = false, activity = 'plan-execution' } = {}) => {
+  if (!Object.hasOwn(ACTIVITIES, activity) || !Object.hasOwn(ACTIVITIES[activity].slots, 'review')) {
+    throw new Error(`activity "${activity}" has no review slot`);
+  }
+  const configured = config?.[activity]?.review;
   const providers = Object.values(DISPLAY_ALIASES); // every review-capable backend, codex first
   if (configured == null && detectionFailed) {
     // No config + no readiness signal: the computed default is UNKNOWABLE — fail closed upstream.
     return { recipe: null, source: 'default', backends: [], minShip: 0, perBackend: false, unknowable: true };
   }
+  if (Array.isArray(configured)) {
+    return { ...obligationsOf(configured), source: 'config', unknowable: false };
+  }
   // Role-filtered: a ready EXECUTOR vehicle is a carry provider, never a reviewer, so it must not
   // turn a silent review config into `reviewed`.
   const anyReady = readyProvidersOf('review', readiness).length >= 1;
@@ -90,8 +83,6 @@ export const BACKEND_META = {
   },
 };
 
-// Deterministic tie-break: codex before agy — the more reliable default for substantive reviews.
-const BACKEND_PRIORITY = [CODEX, AGY];
 const priorityIndex = (name) => {
   const i = BACKEND_PRIORITY.indexOf(name);
   return i === -1 ? BACKEND_PRIORITY.length : i;
@@ -137,14 +128,6 @@ export const RECIPES = [
 
 const recipeById = (id) => RECIPES.find((r) => r.id === id);
 
-// Read-only file-presence remedies — never a claim about whether a backend's service is responsive.
-const READINESS_REASON = {
-  [NEEDS_SKILL]: 'bridge skill not installed — run /agent-workflow-kit setup',
-  [NEEDS_CLI]: 'the CLI is not installed',
-  [NEEDS_CREDENTIALS]: 'not signed in (credentials missing)',
-  [DEGRADED]: 'wrapper not on PATH — run /agent-workflow-kit setup',
-};
-
 // ── pure planner ───────────────────────────────────────────────────────────────
 
 const providersOf = (role, detection) => detection.filter((b) => (BACKEND_ROLES[b.name] ?? []).includes(role));
@@ -171,7 +154,7 @@ const degradeReason = (recipe, detection) => {
     .filter((b) => b.readiness !== READY)
     .map((b) => (b.name === EXECUTOR_PROVIDER
       ? vehicleDegradeReason(b.vehicle, EXECUTOR_APPLY)
-      : `${DISPLAY_ALIASES[b.name] ?? b.name}: ${READINESS_REASON[b.readiness] ?? b.readiness}`))
+      : `${DISPLAY_ALIASES[b.name] ?? b.name}: ${remedyFor({ readiness: b.readiness })}`))
     .join('; ');
   return `${recipe.title} needs ${recipe.minBackends} provider(s) providing ${recipe.role}, but only ${ready.length} ready${detail ? ` — ${detail}` : ''}`;
 };
@@ -268,7 +251,7 @@ const computedDefaultForSlot = (slotType, detection) => {
 // The effective recipe for ONE slot. Precedence: an explicit `override` (degrades LOUDLY, so the
 // agent tells the user) > the `config` entry (graceful) > the computed default. Satisfiability and
 // the lattice REUSE planRecipe — one source. Pure; never mutates.
-export const resolveActivityRecipe = ({ config = {}, readiness = [], activity, slot, override } = {}) => {
+export const resolveActivityRecipe = ({ config = {}, readiness = [], activity, slot, override, surveyLens, postures } = {}) => {
   const activityDef = ACTIVITIES[activity];
   if (!activityDef) throw new Error(`unknown activity: ${activity}`);
   const slotType = activityDef.slots[slot];
@@ -278,6 +261,21 @@ export const resolveActivityRecipe = ({ config = {}, readiness = [], activity, s
   const requested = override ?? configured ?? computedDefaultForSlot(slotType, readiness);
   const source = override != null ? 'override' : configured != null ? 'config' : 'default';
 
+  if (Array.isArray(requested)) {
+    if (slotType !== 'review' || source !== 'config') {
+      throw new Error(`invalid roster for ${slotType} slot of "${activity}"`);
+    }
+    const obligations = obligationsOf(requested);
+    return {
+      recipe: obligations.recipe,
+      source,
+      degradedFrom: null,
+      reason: null,
+      overrideUnsatisfied: false,
+      roster: resolveRoster({ value: requested, readiness, surveyLens, postures }),
+    };
+  }
+
   // Defensive: the IO shell and the CLI validate first, so a stray value here is a programmer error
   // — surfaced loudly rather than silently coerced into a neighbour recipe.
   if (!(SLOT_RECIPES[slotType] ?? []).includes(requested)) {
@@ -300,42 +298,14 @@ export const resolveActivityRecipe = ({ config = {}, readiness = [], activity, s
   };
 };
 
-// ── the one-line backend status (the tool speaks, the agent pastes) ───────────────────────────────
-// Machine-composed so the agent composes NOTHING factual (a session once echoed SKILL.md's canonical
-// example while the detector said otherwise). Always exactly one line.
-
-// The CONFIGURED dispatch posture: the bundled manifests' pins overlaid with the active
-// bridge-settings. No pins or a corrupt bundle → null; the posture segment is a fact, never a gate.
+// Configured posture from bundled manifest pins plus bridge settings; corruption returns null.
 export const composeConfiguredPosture = (ctx = {}) => {
   try {
-    const bundleRoot = ctx.bundleRoot ?? DEFAULT_BUNDLE_ROOT;
-    const read = ctx.readFile ?? readFileSync;
-    const parts = [];
-    for (const name of BACKEND_PRIORITY) {
-      let manifest;
-      try {
-        manifest = JSON.parse(String(read(join(bundleRoot, name, 'capability.json'), 'utf8')));
-      } catch {
-        return null; // an unreadable/corrupt manifest is CORRUPTION — a partial posture would lie
-      }
-      if (!Object.hasOwn(manifest, 'posture')) continue; // a pre-D5 bridge — legitimate absence
-      const posture = manifest.posture;
-      // A present-but-invalid block nulls the WHOLE render — never a partial/mangled line.
-      const invalid =
-        posture === null || typeof posture !== 'object' || Array.isArray(posture) ||
-        typeof posture.model !== 'string' || posture.model.length === 0 ||
-        (Object.hasOwn(posture, 'effort') && (typeof posture.effort !== 'string' || posture.effort.length === 0)) ||
-        (Object.hasOwn(posture, 'tier') && posture.tier !== null && (typeof posture.tier !== 'string' || posture.tier.length === 0)) ||
-        Object.keys(posture).some((k) => !['model', 'effort', 'tier'].includes(k));
-      if (invalid) return null;
-      const seg = [`model=${posture.model}`];
-      if (Object.hasOwn(posture, 'effort')) seg.push(`effort=${posture.effort}`);
-      if (Object.hasOwn(posture, 'tier')) {
-        const knob = (ctx.settings?.active ?? []).find((s) => s.key === 'CODEX_SERVICE_TIER' && s.bridge === name);
-        seg.push(knob ? `tier=${knob.value} (bridge-settings)` : `tier=${posture.tier ?? 'standard'}`);
-      }
-      parts.push(`${DISPLAY_ALIASES[name] ?? name} ${seg.join(' ')}`);
-    }
+    const rows = posturesByBackend({ bundleRoot: ctx.bundleRoot ?? DEFAULT_BUNDLE_ROOT, settings: ctx.settings ?? { active: [] }, readFile: ctx.readFile ?? readFileSync });
+    if (Object.values(rows).some((row) => row.state === 'unreadable')) return null;
+    const parts = Object.entries(rows)
+      .filter(([, row]) => row.state === 'valid')
+      .map(([receiptId, row]) => `${receiptId} ${row.posture}`);
     return parts.length ? parts.join(' · ') : null;
   } catch {
     return null;
@@ -422,19 +392,25 @@ export const composeAutonomyFacts = async (cwd, deps = {}) => {
 // ONE line rendering the CONFIGURED recipe of every activity/slot with its source, degradation and
 // dispatched wrappers — contrasted with the readiness-RECOMMENDED recipe, which is NOT what runs.
 // The session-start checklist and the handover "Active recipes:" slot paste it verbatim.
-export const composeActiveRecipeLine = ({ config, source } = {}, detection, autonomy = null) => {
+export const composeActiveRecipeLine = ({ config, source } = {}, detection, autonomy = null, rosterDeps = null) => {
   const cells = [];
   for (const [activity, def] of Object.entries(ACTIVITIES)) {
     const level = autonomy?.activities?.[activity]?.autonomy;
     const auto = level ? `; autonomy ${level}` : '';
     for (const [slot, slotType] of Object.entries(def.slots)) {
-      const r = resolveActivityRecipe({ config: config ?? {}, readiness: detection, activity, slot });
-      const dispatch = isSwitchSlot(slotType) ? [] : planRecipe(r.recipe, detection).dispatch;
+      const r = resolveActivityRecipe({
+        config: config ?? {}, readiness: detection, activity, slot,
+        surveyLens: rosterDeps?.surveyLens, postures: rosterDeps?.postures,
+      });
+      const dispatch = isSwitchSlot(slotType) || r.roster ? [] : planRecipe(r.recipe, detection).dispatch;
       const wrappers = dispatch.map((d) => wrapperCmdFor(d.backend, d.role)).filter(Boolean);
       const srcLabel = r.source === 'config' ? 'configured' : 'computed default';
+      const renderedValue = r.roster
+        ? activeLineCell(r.roster, { states: rosterDeps !== null })
+        : r.recipe;
       const head = r.degradedFrom
         ? `${activity}.${slot} = ${r.degradedFrom} (${srcLabel}; degrades here to ${r.recipe} — ${r.reason}${auto})`
-        : `${activity}.${slot} = ${r.recipe} (${srcLabel}${isSwitchSlot(slotType) ? '; switch' : ''}${auto})`;
+        : `${activity}.${slot} = ${renderedValue} (${srcLabel}${isSwitchSlot(slotType) ? '; switch' : ''}${auto})`;
       const suffix =
         wrappers.length >= 2
           ? ` → every backend every round: ${wrappers.join(' + ')}`
@@ -553,7 +529,12 @@ exclusive. Detection only — never writes, never commits, never runs a subscrip
     // Lazy: orchestration-config.mjs statically imports this module — no static cycle.
     const { loadConfig } = await import('./orchestration-config.mjs');
     try {
-      console.log(composeActiveRecipeLine(loadConfig(cwd), readiness, await composeAutonomyFacts(cwd)));
+      const snapshot = settingsSnapshot();
+      const surveyLens = deps.surveyLens ?? ((spec) => surveyVehicle(cwd, spec, deps));
+      console.log(composeActiveRecipeLine(
+        loadConfig(cwd), readiness, await composeAutonomyFacts(cwd),
+        { surveyLens, postures: posturesByBackend({ settings: snapshot }) },
+      ));
     } catch (err) {
       console.error(`[agent-workflow-kit] ${err.message}`);
       return err.exitCode ?? 1;

package/tools/repo-lex.mjs

@@ -20,3 +20,43 @@ export const lexicalRepoRelative = (rel) => {
 
 // POSIX single-quote for pasteable command rendering (display only — never an execution boundary).
 export const shellQuoteArg = (s) => (/^[A-Za-z0-9_/.\-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`);
+
+// The bytes a settings-level allow rule cannot see past: command separators, redirections,
+// expansions and globs. ONE home for the seeder (velocity-profile.mjs, the allow-rule writer) and
+// the renders that must spell a path in the seeded byte-form (procedures.mjs) — two predicates for
+// one rule drift apart, and a drifted render is a dead allow rule that simply prompts.
+export const SHELL_METACHARACTERS = Object.freeze([
+  '&', '|', ';', '<', '>', '$', '`', '(', ')',
+  '\n', '\r', '\t', '\\', '{', '}', '*', '?', '#', '~', '!',
+]);
+export const hasShellMetacharacter = (cmd) => SHELL_METACHARACTERS.some((ch) => cmd.includes(ch));
+
+// A string a one-line render can carry: no control character (C0 or C1) and no Unicode line or
+// paragraph separator. The receipt-derived fields are REFUSED on it; a plan name is escaped for display.
+const LINE_BREAKING_SOURCE = '[\\p{Cc}\\p{Zl}\\p{Zp}]';
+const LINE_BREAKING = new RegExp(LINE_BREAKING_SOURCE, 'u');
+const LINE_BREAKING_ALL = new RegExp(LINE_BREAKING_SOURCE, 'gu');
+export const isRenderableLine = (value) => typeof value === 'string' && !LINE_BREAKING.test(value);
+export const escapeForDisplay = (value) => String(value).replace(LINE_BREAKING_ALL, (ch) => `\\u${ch.codePointAt(0).toString(16).padStart(4, '0')}`);
+
+// The receipt encoder's carriability rule for an artifact path (S21), the JS twin of the wrappers'
+// refuse_uncarriable_artifact_byte: a quote, a backslash, a C0 control or DEL — deliberately NOT
+// \p{Cc} (C1 is the declared residual, and the two normalizations are parity-pinned on this set).
+// ONE home: the round table's refusal names the byte, the advisor's fallback reads the boolean.
+export const uncarriableArtifactByte = (value) =>
+  value.includes('"') ? 'a double quote' : value.includes('\\') ? 'a backslash' : /[\u0000-\u001f\u007f]/u.test(value) ? 'a control' : null;
+export const isArtifactPathCarriable = (value) => typeof value === 'string' && uncarriableArtifactByte(value) === null;
+
+// Characters that survive whitespace tokenization but break an UNQUOTED byte-exact path rule:
+// shell quoting syntax and glob brackets (SHELL_METACHARACTERS owns the command-level separators/
+// redirections/expansions — `*`/`?` globs included — but not these four).
+const PATH_BREAKING_CHARACTERS = Object.freeze(["'", '"', '[', ']']);
+
+// A path token that can be seeded UNQUOTED into a byte-exact allow rule: POSIX-absolute, no
+// whitespace, no shell metacharacter, no quoting/glob syntax.
+export const isSeedablePathToken = (token) =>
+  typeof token === 'string' &&
+  token.startsWith('/') &&
+  !/\s/u.test(token) &&
+  !hasShellMetacharacter(token) &&
+  !PATH_BREAKING_CHARACTERS.some((ch) => token.includes(ch));