@sabaiway/agent-workflow-kit 12.0.0 → 12.2.0

package/CHANGELOG.md

@@ -4,6 +4,80 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 12.2.0 — the bundled agy bridge defaults to Gemini 3.8 Flash (High) (AD-136; antigravity-cli-bridge 5.7.0)
+
+**MINOR: a default moved, nothing was removed.** The kit bundles the agy bridge mirror, so the bridge's pin move rides
+this release; no kit tool changed behaviour.
+
+- **`Gemini 3.8 Flash (High)` is the bridge default for both roles** — `agy-run` and `agy-review` — and joins the review
+  wrapper's frontier set. The string is what `agy models` on the installed CLI (1.1.28, probed 2026-09-09) prints; a model
+  display string is matched exactly, so a stale default is a dispatch that refuses before it spends anything (AD-095).
+  `Gemini 3.7 Flash (High)` stays in the frontier set: a host that pins it explicitly keeps an advisory-silent council
+  review. Any model remains selectable through `AGY_MODEL`; the sub-frontier advisory is still a warning, never a gate.
+- **The catalog tables gain the three 3.8 rows**, enumerated individually, in the skill, the model reference and the
+  driving playbook; the wrapper's header inventory names the 3.8 family. No row is removed.
+- **The posture render follows the pin.** The status line and the D5 posture footer read the bundled manifest, so they
+  now print `agy model=Gemini 3.8 Flash (High)`; the posture-parity test pins the pair.
+
+## 12.1.0 — a queue row carries a plain name a person can read, and `now` renders where the work stands from the evidence, never from the plan's own text (AD-134)
+
+**MINOR: two additive surfaces, one series, one new refusal.** The name judge is advisory until a gate line opts in, and `now` is
+a new read-only command beside `status`. The one behaviour a deployed `queue-audit --check` line can see change: a heading a row
+swallows (an ATX line indented one to three spaces inside a row's body) now refuses with exit 2 and both one-keystroke corrections,
+where the audit used to scope around it silently and misjudge the rows after it — a document the corpus never writes.
+
+**The name judge (plan 1 of the series, landed repo-only in `da196b9`).** `tools/queue-row-name.mjs` cuts a row's display
+title at the id the row PRESENTS as one and judges the rest as a sentence: three or more words, one of the first three carrying
+a lower-case letter, a letter somewhere, never the id restated, never a run of the row's own status segments. `titleOf` returns
+`{ text, name, id, judged, endLine }` from ONE parse and every `auditQueue` row now carries `name`, `id`, `nameFindings` and
+`buckets` — the full line-numbered heading LINEAGE above the row, computed once inside the one parser.
+`queue-audit-cli --check --require-names` is the opt-in that turns a name finding into exit 1; without it every finding is a
+note and a gate line written before this release keeps its verdict byte for byte. A heading a row swallows — an ATX line
+indented one to three spaces inside a row's body — is REFUSED with its line and both one-keystroke corrections, because the
+document and the row scan read that line two ways and the corpus writes none. Two classifier defects fixed red-first: a live
+marker counts at a segment head or wherever dated, and a record prefix owes an adjacent date at every segment head but the title's; `feedback-record`'s
+row writer puts the claim sentence ahead of the id so the kit passes the gate it offers. Measured over this repo's queue: the
+shipped judge reports findings on 165 of the 247 work-carrying rows of `## Pending / backlog` before the migration, and the migration moved no class cell.
+
+**`now` (plan 2).** `/agent-workflow-kit now` — `node tools/now-cli.mjs --dir <project> [--format plain|ansi|json | --json]` —
+renders four blocks: **NOW** (every plan `plansInFlight` returns, its derived phase, the current and the next step, the tree
+fingerprint, the per-backend review verdict, the final receipt and the red-proof currency from `buildSummaryState`), **STEPS**
+(the ledger rows of each plan, one status each), **QUEUE** (every work-carrying row of `docs/plans/queue.md` folded under the heading PATH it
+carries, per-bucket per-class counts over all five classes, names never ids — an unnamed row prints `unnamed (line N)`; position is called priority
+ONLY in a bucket whose path passes through `## Pending / backlog`, every other bucket is archive), **CAMPAIGN** (the source-size
+practice's figures and config state; an absent opt-in config is a rendered state). The contract is `docs/ai/specs/kit/now.md`
+(live, S1–S10 bound). Its red line: a status is a function of the row's (path, verb) pair and the evidence at that path — the
+path fact, the changed set (ONE cached `diff --cached --name-only -z --no-renames`, both sides of a rename listed, then
+`computeWorkingState`'s unstaged and untracked
+sets, then the path fact; a path in both staged and unstaged is the named disagreement), and the exclusion fact (ONE cached
+`check-ignore -z --stdin`) — and the row's prose moves none: a checked box or a terminal marker outside quotation is a CLAIM
+printed beside the evidence-derived status wherever the two disagree. Four statuses, a closed set (`landed`, `in progress`, `pending`, `unjudged`); three
+annotations (claim, over-budget anomaly, a red-proof bound to the row's path at the current base). A present, clean `modify`
+row is `unjudged` and the render names WHICH fact is missing — `excluded from git here, no changed-set evidence` or `no
+base-motion reader` — never `landed`. A sweep row (`dir/**`, `modify` only) is judged as a SET: present when its expansion on disk is non-empty, changed when
+its pattern matches any path of a changed set (a deleted member included), excluded only when every member is. A git-dir
+store the summary cannot trust (a malformed receipts or evidence line) withholds the tree line with the store's own cause
+while every plan still renders; the final-run line names the receipt's verdict and gate count before its coverage token.
+Every status line carries its evidence source. The command writes nothing in any state:
+every git query it adds runs under `GIT_OPTIONAL_LOCKS=0`, and the suite proves a recursive content hash of `.git` identical
+before and after a run. Exit 0 whenever anything rendered (a WITHHELD block with its cause included), 1 when nothing did (a
+`--dir` that is not a git work tree), 2 for usage. Five modules — `now-status.mjs` (pure rules), `now-plan-facts.mjs`,
+`now-facts.mjs` (the IO shell), `now-render.mjs`, `now-cli.mjs` — registered in the catalog (Inspect, read-only), `SKILL.md`,
+`references/modes/now.md` and the README; the tarball pin counts 294. Stated residual: no reader in this family tells a
+tracked, unmodified file a plan already rewrote from one it never touched, so STEPS is complete when the base-motion reader
+lands; the write-nothing claim is proved dynamically, the structural read-graph proof waits on the core-evidence decomposition.
+
+**Bundled codex bridge 3.8.0 — the pin moves to `gpt-6-astra` at effort `high` (AD-135).** Both wrappers pin the model
+and the effort the maintainer chose; the quality-first guard stays a pin-integrity guard and now refuses `xhigh` exactly as it
+refuses `low` — every shipped sentence that called the pin "the maximum effort" says "the pinned effort", in the wrappers,
+the manifest `posture`, the bridge docs and the kit surfaces composed from the manifest (`recipes --status-line`,
+`bridge-settings`, `procedures`). The Fast tier stays a consented per-host knob (AD-043); its copy carries the codex
+catalog's own words for gpt-6-astra ("2x speed, increased usage", cache fetched 2026-09-05, no credit-rate figure stated)
+and the sol-era figures (~1.5x speed, 2.5x credit rate, probed 2026-07-05) are retired from every reader. The tier caveat
+still rides every render (`SPEND KNOB`). Version anchors: `capability.json`, `SKILL.md`, both `AW_BRIDGE_VERSION`
+lines; the kit mirror is byte-equal to the canon. A host that arms `CODEX_SERVICE_TIER=priority` runs gpt-6-astra /
+high / priority.
+
 ## 12.0.0 — the reader mirror refuses an open-list clause, the outgoing reader becomes a prior, the consult line names the second case and the lens walks around every check (AD-133)
 
 **MAJOR by the AD-117 class.** `references/scripts/spec-schema.mjs` and its test are the memory 8.0.0 bodies

package/README.md

@@ -232,6 +232,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit gates` | any time | **project gate runner** — runs the verification commands **your project itself declares** in `docs/ai/gates.json` (seeded at deploy; hand-editable `{ id, title, cmd }` entries plus the optional boolean `lcovProducer`, each `cmd` one bash line) as one batch: a per-gate **PASS/FAIL table** + one machine-readable summary line, exit 0 iff all green; a failing gate's own output is shown verbatim; `--only <id>` re-runs one. Honest distinct outcomes for a missing / empty / malformed declaration — never a silent green. The runner writes nothing **by default** and never commits — opt-in `--final` runs the FULL declared matrix and mints ONE final-run receipt into the git-dir core-evidence store (status green/red, pre/post tree fingerprints, the declaration, the consumed lcov's sha; the receipt the commit-guard binds); it executes only your own declared commands (a batching convenience, not a sandbox). The velocity tier auto-approves only the exact no-`--final` form — the recording run stays explicit. |
 | `/agent-workflow-kit setup [backend]` | opt-in, any time | **link-only** auto-setup of a bridge: places the bundled bridge skill (only into an absent / empty / managed dir — never overwrites an unmanaged one) + links its wrappers onto `PATH` via managed symlinks (idempotent; refuses to clobber a non-symlink; try `--dry-run` to preview). The binary install + the one-time subscription login stay **manual**: it prints the exact **login** command and points the binary install at each bridge's `setup/README.md`. POSIX wrappers — on Windows use WSL. Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit status` | any time | **read-only** single view of **versions + deployment + settings + bridges**: which members (kit / memory / engine / the two bridges) are installed and at what version (with an honest "installed on this machine" note when one is behind) and — in a project — what's deployed (`docs/ai`, the version stamps, and the **visibility**: visible / hidden / unclear), and the **feature-spec adoption state** (`not adopted` / `adopting (N draft)` / `adopted (N live, M draft)` / `could not be read`, plus `declined` when recorded), plus your settings (orchestration recipes, attribution, velocity) and the bridges' readiness. The two version axes (package number vs deployment-structure head) stay decoupled. Never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit now` | any time | **read-only** answer to where work stands in four blocks: **NOW** names every plan in flight, its phase, current and next step, and the tree evidence; **STEPS** gives every ledger row its evidence-derived status; **QUEUE** folds named rows under their full heading paths and calls position priority only in the judged backlog; **CAMPAIGN** shows the source-size practice figures and config state. The plan's own text never sets a status; a contradicted claim prints beside it. A block that cannot be derived is WITHHELD with its cause; NOW has two halves, plans and tree, each independently a value or WITHHELD, and NOW itself is WITHHELD only when both are. Never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit recipes` | any time | **read-only** orchestration advisor: presents five named recipes for composing the carriers of a step — the bridges and the full-tool executor subagent — into plan → execute → review — **Solo / Reviewed / Council / Delegated / Subagent** — plans + recommends one for your environment (degrading with a stated reason when a backend isn't ready, or when the executor vehicle is missing/unusable), and offers the choice. The activity/slot registry (four activities) is rendered by `procedures` and by `set-recipe --help`. The orchestrator runs it via the bridge skills or the executor vehicle and **always commits**; the kit never executes a recipe, never runs a subscription CLI, never commits. |
 | `/agent-workflow-kit procedures <activity>` | any time | **read-only** activity-procedures advisor: prints a named activity's ordered steps (`plan-authoring` / `plan-execution` / `routine` / `feedback-triage`) read **live** from the engine, plus the **resolved recipe per slot** from your `docs/ai/orchestration.json` (agent-writable via `set-recipe`, or hand-edited) + carrier readiness (`plan-authoring`: author, fold, review; default Reviewed when a backend is ready, Council on request; slot-aware incl. Delegated and Subagent) — and, for every dispatched backend, the **full driving contract at the point of use** (exact copy-pasteable invocation, grounding levers like agy's `--facts`/`--decided`, the round-2 `--continue` delta, guarded passthrough), verbatim from the bridge manifests (drift-guarded; each wrapper's `--help` prints the same) — except `feedback-triage`, whose record-bound block carries the check with `--excerpts`, the resolved member lines (ready bridge commands, the ready lens brief, or explicit skipped members), and either the record round-table command for a bridge obligation or the no-receipt fact otherwise: the record is the artifact. `--override <slot>=<value>` adjusts one slot per run. Composes with `recipes`; never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit set-recipe` | any time | **config writer** for `docs/ai/orchestration.json`: tell the agent your preference in plain language and it maps it to explicit `--set <activity>.<slot>=<value>` / `--unset` ops; the kit validates, **previews by default**, and writes only on `--write` (deployment-gated, atomic, symlink/TOCTOU-safe), resolving the effective recipe vs live readiness. Writes **only** that file — **never runs a backend or a subagent, never commits**; hand-editing stays fully supported. |
@@ -251,7 +252,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit agents` | Claude Code · opt-in | **subagent vehicles** — places the five bundled subagent definitions into `.claude/agents/`: **four read-only vehicles + one full-tool `executor`**. **No read-only vehicle gets `Bash`**, and that is the load-bearing property: a read-only fan-out on a full-tool subagent shells out for facts it could have read, and every shelled command is an approval prompt you never needed to see. Three of the four ride a **cheap model** (haiku, low effort) for mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage; the fourth, **`review-lens`**, is an ADDITIONAL independent read-only review opinion on code your configured backends have already seen (never a replacement for your review recipe, advisory like every review). The fifth, **`executor`** (`model: opus`, all tools), is the ONE vehicle with a shell and the instrument behind the **Subagent** recipe: dispatched only for a bounded, file-disjoint execution / authoring / routine slice you verify afterwards — never for read-only work, never as a review backend, and it never commits. Its state (`placed` / `customized` / `unusable` / `missing`) is what a `subagent` slot's readiness resolves from. Writing code and running gates stay off the four read-only vehicles; the executor carries a bounded slice you re-verify on your main lane, and every vehicle's output is verified. Preview by default (`--apply` writes); an existing customized file is **preserved, never overwritten**; never touches `settings*.json`, never commits. |
 | `/agent-workflow-kit hook` | Claude Code · opt-in | **gate-approval hook** — places a self-contained PreToolUse hook (`.claude/hooks/`) and wires it into `.claude/settings.json`: a Bash command **byte-identical** to a gate you declared in `docs/ai/gates.json` (run from the project root) is auto-approved — no prompt, no idle; a seeded read-only command carrying a runtime residual (output redirection, command substitution, `--output` writes) now **asks** even where an allow rule would have silently passed it (proven live — hook `ask` overrides an allow rule). Detection is a conservative string scan, so it over-asks on a byte that is ordinary text — searching for `=>`, or a read wearing `2>/dev/null`, prompts. That is a documented open limit: 4.1.0 built three mechanisms to narrow it and removed all three in review, each counterexample kept as a test (see Mode: hook). Exact matches only, never patterns; never `deny`; a broken `gates.json` only disables auto-approval, never the guard. An opt-in **read-lane** (`--read-lane` → `docs/ai/lanes.json`, a **separate** file from `gates.json`) additionally auto-approves *compounds* of seeded read-only commands carrying no shell metaprogramming; `--apply --read-lane` verifies the placed hook is current first (delete-to-reseed otherwise). Preview by default; never writes `settings.local.json`; never commits. |
 | `/agent-workflow-kit state-block-guard` | Claude Code · opt-in | **closing-block detector** — a `Stop` hook that reads the turn's final assistant message and warns when the closing state block is defective: the «what I need from you» slot answering *nothing* (a turn that ENDS always needs a resume, so the answer is false, not merely unhelpful), or a first-person promise of imminent work in a turn that is over. Judged on the slot's first clause, so a real ask followed by a clause break and "nothing else" passes, and a promise gated on something named passes; matching is word-bounded and Unicode-aware, quoted and fenced examples are stripped, and the last STARTED block decides — an incomplete tail counts as no block rather than falling back to an earlier one. A message carrying no block at all is silent unless you pass `--require-block` — this kit does not mandate the block, and a hook that runs every turn must not warn every turn. The judgement is lexical and the mode doc names every residual it leaves. **Detection, never prevention** — a `Stop` hook cannot un-send the message it judges; what it buys is that a silent recurrence becomes a visible one. Warns via `systemMessage` and **exits 0 on every path**: never `deny`, never blocks the stop, never re-enters the model. Reads nothing but the message, makes no network call, approves nothing. This mode is **read-only and has no writer** — it ships the self-contained hook and a paste-ready wiring block you merge into `.claude/settings.json` yourself. |
-| `/agent-workflow-kit bridge-settings` | opt-in, any time | **host-level bridge settings** — read or change the bridges' `KEY=VALUE` config file (`${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`), the **one place a knob survives kit upgrades** (it lives outside every kit tree; a refresh never touches it, and now states loudly if it ever overwrote a local edit). First knobs: the **codex Fast tier** (`CODEX_SERVICE_TIER=priority` — ~1.5× speed at a **2.5× credit rate**, quality-neutral, default off — a consented spend), the codex/agy hard timeouts, the codex review byte cap, and `AGY_REVIEW_MAX_TOTAL_BYTES` (the ceiling on what an oversized agy code review may feed before it refuses pre-spend). `AGY_REVIEW_ALLOW_ADDDIR` is a **retired** compatibility key: still recognized so an existing line never warns as unknown, but it arms nothing — the writer refuses to set it and `--unset` clears it. Allowed keys + value rules come from the bundled bridge manifests; **model/effort are never settable** (the quality guard is untouched). **Previews by default**; refuses an unknown key, an out-of-range value, or a duplicate-carrying file; writes atomically (symlink/TOCTOU-safe). Never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit bridge-settings` | opt-in, any time | **host-level bridge settings** — read or change the bridges' `KEY=VALUE` config file (`${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`), the **one place a knob survives kit upgrades** (it lives outside every kit tree; a refresh never touches it, and now states loudly if it ever overwrote a local edit). First knobs: the **codex Fast tier** (`CODEX_SERVICE_TIER=priority` — "2x speed, **increased usage**" in the catalog's own words, quality-neutral, default off — a consented spend), the codex/agy hard timeouts, the codex review byte cap, and `AGY_REVIEW_MAX_TOTAL_BYTES` (the ceiling on what an oversized agy code review may feed before it refuses pre-spend). `AGY_REVIEW_ALLOW_ADDDIR` is a **retired** compatibility key: still recognized so an existing line never warns as unknown, but it arms nothing — the writer refuses to set it and `--unset` clears it. Allowed keys + value rules come from the bundled bridge manifests; **model/effort are never settable** (the quality guard is untouched). **Previews by default**; refuses an unknown key, an out-of-range value, or a duplicate-carrying file; writes atomically (symlink/TOCTOU-safe). Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit autonomy-doctor` | opt-in, any time | **guarded sandbox provisioner "doctor"** — can this machine run the Claude sandbox, and (only with your consent) fix it: macOS Seatbelt built-in / Linux+WSL2 needs `bwrap`+`socat` / native Windows → WSL2. Flagless = **FS-only preview** (the diagnosis, the exact absolute-path command it WOULD run, the exact `--apply <pm>:<pkgs>` consent tuple — runs nothing, never claims ready); `--verify` runs the unprivileged proof (a `bwrap` user-namespace smoke + `socat -V`) — the **only** source of a Linux "ready (verified)" claim; `--apply <pm>:<pkgs>` is the consent-gated privileged install (the tuple must equal the previewed plan; everything executed resolves to absolute paths inside `/usr/bin:/bin:/usr/sbin:/sbin`; the exact command is re-printed immediately before execution), then verifies. Honest loud degrades (unknown PM, untrusted location, nested-sandbox INDETERMINATE, root-unproven) and a stated restart step. Sits **outside every velocity auto-approve tier**; never auto-runs, never writes repo files, never commits. |
 
 It **never auto-commits** and **never overwrites** an existing `AGENTS.md` without asking.

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '12.0.0'
+  version: '12.2.0'
 ---
 
 # agent-workflow-kit
@@ -111,6 +111,10 @@ writer — read `${CLAUDE_SKILL_DIR}/references/modes/setup.md` before acting.
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/status.md` before acting.
 
+### Mode: now
+
+read-only — read `${CLAUDE_SKILL_DIR}/references/modes/now.md` before acting.
+
 ### Mode: recommendations
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/recommendations.md` before acting.

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its headless behaviour.
 metadata:
-  version: '5.6.0'
+  version: '5.7.0'
 ---
 
 # antigravity-cli-bridge
@@ -53,20 +53,23 @@ keep probes short (see *How the main agent drives agy*).
 ## Models
 
 Pass the **exact display string** to `--model` (or set `AGY_MODEL`). The wrapper defaults to
-`Gemini 3.7 Flash (High)`. Run `agy models` for the live list — if it differs from this table, the
+`Gemini 3.8 Flash (High)`. Run `agy models` for the live list — if it differs from this table, the
 live list wins.
 
 | Model string | Use it for |
 |---|---|
-| `Gemini 3.7 Flash (Low)` | cheapest; reachability checks, smoke tests, simple transforms |
-| `Gemini 3.7 Flash (Medium)` | cheap probes, context-reachability checks, quick summaries |
-| `Gemini 3.7 Flash (High)` | wrapper + review default; asserted frontier-grade (fork (a)) |
-| `Gemini 3.6 Flash (Low)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.6 Flash (Medium)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.6 Flash (High)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (Low)` | older Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (Medium)` | older Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (High)` | older Flash generation, still served — prefer 3.7 |
+| `Gemini 3.8 Flash (Low)` | cheapest; reachability checks, smoke tests, simple transforms |
+| `Gemini 3.8 Flash (Medium)` | cheap probes, context-reachability checks, quick summaries |
+| `Gemini 3.8 Flash (High)` | wrapper + review default; asserted frontier-grade (AD-136) |
+| `Gemini 3.7 Flash (Low)` | previous Flash generation, still served — prefer 3.8 |
+| `Gemini 3.7 Flash (Medium)` | previous Flash generation, still served — prefer 3.8 |
+| `Gemini 3.7 Flash (High)` | previous Flash generation, still frontier-grade for review (fork (a)) |
+| `Gemini 3.6 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.6 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.6 Flash (High)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (High)` | older Flash generation, still served — prefer 3.8 |
 | `Gemini 3.1 Pro (Low)` | cheaper Pro pass for medium reasoning |
 | `Gemini 3.1 Pro (High)` | hard reasoning, plan critique, architecture review (slower, deeper) |
 | `Claude Sonnet 4.6 (Thinking)` | a Claude second opinion through the same subscription |
@@ -100,7 +103,7 @@ can ride passthrough (`-- --output-format json`) but this wrapper adds no parsin
 you need structure, ask for Markdown with explicit headings and validate it yourself. (The `review`
 role is the one that adopted the JSON envelope — see below.) Wrapper inputs: first argument is the
 prompt (`text`, `-` for stdin, or `@file`);
-`AGY_MODEL` (default `Gemini 3.7 Flash (High)`); `AGY_TIMEOUT` → `--print-timeout` (default `5m`);
+`AGY_MODEL` (default `Gemini 3.8 Flash (High)`); `AGY_TIMEOUT` → `--print-timeout` (default `5m`);
 `AGY_HARD_TIMEOUT` → hard `timeout(1)` wall-clock cap (default = `AGY_TIMEOUT`); extra `agy` flags
 after `--`. Full detail: [`references/models-and-flags.md`](references/models-and-flags.md).
 
@@ -189,7 +192,7 @@ release). `agy-review … --nonce <n>` is the plain-argument equivalent
 (one seam; flag and a non-empty env must agree, a disagreeing pair refuses pre-spend) — the lane
 for hosts whose dispatch policy has no env-prefix form.
 
-Frontier default `Gemini 3.7 Flash (High)`; **any** model is allowed (a sub-frontier one earns a
+Frontier default `Gemini 3.8 Flash (High)`; **any** model is allowed (a sub-frontier one earns a
 silenceable `AGY_PROBE=1` advisory). An oversized `code` review is **DELIVERED, not refused**: the
 change set is cut into under-cap parts, fed over continuation turns and reviewed in a final turn, and
 the answer must reproduce a line the wrapper picked from each part — a missing or wrong echo is a

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -35,7 +35,7 @@
 #   agy-review --conversation <id> [--decided @f] [--focus "…"]   # resume a specific conversation
 #
 # Environment (every optional var has an explicit default so a no-env run is safe under set -u):
-#   AGY_MODEL                default "Gemini 3.7 Flash (High)"; ANY model allowed (advisory warn off-frontier).
+#   AGY_MODEL                default "Gemini 3.8 Flash (High)"; ANY model allowed (advisory warn off-frontier).
 #                            Set empty (AGY_MODEL=) to drop --model and use agy's settings.json.
 #   AGY_HARD_TIMEOUT         default 30m  (duration string; the timeout(1) hard cap via agy-run)
 #   AGY_TIMEOUT              default = AGY_HARD_TIMEOUT (agy's soft --print-timeout)
@@ -339,11 +339,11 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_AGY_REVIEW_MODEL="Gemini 3.7 Flash (High)"
+DEFAULT_AGY_REVIEW_MODEL="Gemini 3.8 Flash (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="5.6.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="5.7.0"  # aw-version-anchor
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
@@ -353,8 +353,9 @@ if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
   exit 2
 fi
 # Frontier review models. ANY model is allowed; a sub-frontier one only earns a soft, silenceable
-# warning. Gemini 3.7 Flash (High) is asserted frontier-grade (fork (a), maintainer 2026-08-14).
-FRONTIER_SET=("Gemini 3.7 Flash (High)" "Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonnet 4.6 (Thinking)")
+# warning. Gemini 3.8 Flash (High) is asserted frontier-grade (AD-136, maintainer 2026-09-09); 3.7 Flash
+# (High) stays in the set (fork (a), maintainer 2026-08-14).
+FRONTIER_SET=("Gemini 3.8 Flash (High)" "Gemini 3.7 Flash (High)" "Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonnet 4.6 (Thinking)")
 
 # Duration-string timeouts (NOT codex's bare seconds): agy-run forwards a duration to --print-timeout,
 # and the timeout(1) hard cap is a duration too — never numerically compared, so 30m vs 2h is fine.

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -42,10 +42,10 @@ describe('agy-review.sh — model policy advisory (1)', { concurrency: 2 }, () =
     rmSync(sb.home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.doesNotMatch(r.stderr, /non-frontier model/);
-    assert.match(r.argv, /Gemini 3\.7 Flash \(High\)/, 'the frontier default reaches agy');
+    assert.match(r.argv, /Gemini 3\.8 Flash \(High\)/, 'the frontier default reaches agy');
   });
 
-  it('an explicit Gemini 3.7 Flash (High) is FRONTIER — no advisory (fork (a), maintainer 2026-08-14)', async () => {
+  it('an explicit Gemini 3.7 Flash (High) stays FRONTIER after the 3.8 pin move — no advisory (AD-136)', async () => {
     const sb = makeSandbox();
     const r = await run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: 'Gemini 3.7 Flash (High)' } });
     rmSync(sb.home, { recursive: true, force: true });
@@ -2776,8 +2776,8 @@ describe('agy-review.sh — dispatch-posture labeling (D5)', { concurrency: 2 },
     const receipts = readReceipts(sb.repo);
     rmSync(sb.home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=Gemini 3\.7 Flash \(High\)/, 'the banner states the actual run posture');
-    assert.deepEqual(receipts[0].posture, { model: 'Gemini 3.7 Flash (High)' }, 'banner ↔ receipt parity');
+    assert.match(r.stderr, /review posture: model=Gemini 3\.8 Flash \(High\)/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'Gemini 3.8 Flash (High)' }, 'banner ↔ receipt parity');
     assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
   });
 
@@ -2830,7 +2830,7 @@ describe('agy-review.sh — dispatch-posture labeling (D5)', { concurrency: 2 },
     const receipts = readReceipts(sb.repo);
     rmSync(sb.home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /^review posture: model=Gemini 3\.7 Flash \(High\) timeout=30m$/m);
+    assert.match(r.stderr, /^review posture: model=Gemini 3\.8 Flash \(High\) timeout=30m$/m);
     assert.deepEqual(Object.keys(receipts[0].posture), ['model'], 'timeout never enters the receipt posture');
   });
 

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -19,8 +19,8 @@
 #
 # Model families (compact inventory only; run `agy models` for exact display strings, then pass
 # one via AGY_MODEL):
-#   Gemini 3.7 Flash (Low|Medium|High), Gemini 3.6 Flash (Low|Medium|High),
-#   Gemini 3.5 Flash (Low|Medium|High), Gemini 3.1 Pro (Low|High),
+#   Gemini 3.8 Flash (Low|Medium|High), Gemini 3.7 Flash (Low|Medium|High),
+#   Gemini 3.6 Flash (Low|Medium|High), Gemini 3.5 Flash (Low|Medium|High), Gemini 3.1 Pro (Low|High),
 #   Claude Sonnet 4.6 (Thinking), Claude Opus 4.6 (Thinking), GPT-OSS 120B (Medium)
 #
 # Usage (installed on PATH as `agy-run`):
@@ -240,8 +240,8 @@ if ! command -v agy >/dev/null 2>&1; then
 fi
 
 # `-` (empty) => skip --model and let agy use settings.json; default to Flash (High) — asserted
-# frontier-grade (fork (a), maintainer 2026-08-14).
-AGY_MODEL="${AGY_MODEL-Gemini 3.7 Flash (High)}"
+# frontier-grade (fork (a), maintainer 2026-08-14; the 3.8 pin AD-136, 2026-09-09).
+AGY_MODEL="${AGY_MODEL-Gemini 3.8 Flash (High)}"
 AGY_TIMEOUT="${AGY_TIMEOUT:-5m}"
 AGY_TIMEOUT="$(aw_effective_timeout AGY_TIMEOUT 5m)"
 # Hard wall-clock cap (defaults to AGY_TIMEOUT). agy's own --print-timeout is NOT a reliable

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -449,7 +449,7 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', { concurrency: true
 
 // ── the wrapper's OWN default model (fork (a), round-1 council F3) ────────────────
 describe('agy.sh — default model pin', () => {
-  it('absent AGY_MODEL → the stub argv carries --model Gemini 3.7 Flash (High)', () => {
+  it('absent AGY_MODEL → the stub argv carries --model Gemini 3.8 Flash (High)', () => {
     const home = makeSandbox(ARGV_STUB);
     const argvFile = join(home, 'argv.txt');
     const r = runWrapper(home, { AGY_STUB_ARGV: argvFile });
@@ -457,7 +457,7 @@ describe('agy.sh — default model pin', () => {
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(argv, /^--model$/m, 'the default run passes --model');
-    assert.match(argv, /^Gemini 3\.7 Flash \(High\)$/m, 'the wrapper default is the probed display string');
+    assert.match(argv, /^Gemini 3\.8 Flash \(High\)$/m, 'the wrapper default is the probed display string');
   });
 
   it("explicit AGY_MODEL='' drops --model entirely (settings.json takes over)", () => {

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,9 +3,9 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "provides": ["review", "probe"],
-  "posture": { "model": "Gemini 3.7 Flash (High)" },
+  "posture": { "model": "Gemini 3.8 Flash (High)" },
   "roles": {
     "review": {
       "cmd": "agy-review",
@@ -181,7 +181,7 @@
       ],
       "guardrails": [
         { "value": "subscription-only — every *_API_KEY env var is unset before the run", "enforcement": "enforced", "source": "bin/agy.sh" },
-        { "value": "any model is selectable via AGY_MODEL; the default is Gemini 3.7 Flash (High)", "enforcement": "advisory", "source": "bin/agy.sh" },
+        { "value": "any model is selectable via AGY_MODEL; the default is Gemini 3.8 Flash (High)", "enforcement": "advisory", "source": "bin/agy.sh" },
         { "value": "hard wall-clock cap AGY_HARD_TIMEOUT (built-in default 5m)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped", "source": "capability.json settings.AGY_HARD_TIMEOUT" },
         { "value": "the prompt rides a single argv — over AGY_MAX_PROMPT_BYTES (120000) the run refuses", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "no review posture, no grounding, no receipt — the reply is raw model output", "enforcement": "advisory", "source": "bin/agy.sh" }

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -18,14 +18,15 @@ edits, verification, and final judgment.
 
 | Task | Model |
 |---|---|
-| Reachability / smoke / "is it wired?" | `Gemini 3.7 Flash (Low)` |
-| Cheap probes, summaries | `Gemini 3.7 Flash (Medium)` |
-| Review, reasoning, careful drafting | `Gemini 3.7 Flash (High)` (wrapper default; asserted frontier-grade) |
+| Reachability / smoke / "is it wired?" | `Gemini 3.8 Flash (Low)` |
+| Cheap probes, summaries | `Gemini 3.8 Flash (Medium)` |
+| Review, reasoning, careful drafting | `Gemini 3.8 Flash (High)` (wrapper default; asserted frontier-grade, AD-136) |
+| The previous Flash generation, still frontier-grade for review | `Gemini 3.7 Flash (High)` (fork (a)) |
 | Slower, deeper reasoning pass | `Gemini 3.1 Pro (High)` |
 | Same Pro reasoning, lower quota cost | `Gemini 3.1 Pro (Low)` |
 | A different engine's opinion | `Claude Sonnet 4.6 (Thinking)`, `Claude Opus 4.6 (Thinking)`, or `GPT-OSS 120B (Medium)` |
 
-The 3.6 / 3.5 Flash families remain served — prefer 3.7 (newest generation at the same tiers).
+The 3.7 / 3.6 / 3.5 Flash families remain served — prefer 3.8 (newest generation at the same tiers).
 Don't reach for Pro by reflex — Flash answers most reachability/probe questions for a fraction of the
 quota.
 
@@ -95,7 +96,7 @@ What it does for you, and what YOU must supply:
   `AGY_REVIEW_ALLOW_ADDDIR` is **RETIRED** (recognized, arms nothing): headless `agy` auto-denies its
   own `read_file`, so the offload it armed could return a confident fabrication with no way to tell.
   The kit never grants that permission — the feed exists so none is needed.
-- **Model:** frontier default `Gemini 3.7 Flash (High)`; any model is allowed (a sub-frontier one earns a
+- **Model:** frontier default `Gemini 3.8 Flash (High)`; any model is allowed (a sub-frontier one earns a
   silenceable `AGY_PROBE=1` advisory). The service can still **stall on large/substantive prompts**
   (Issue-001) — keep reviews **focused**; the hard timeout is the guard.
 - **Posture banner — quote it verbatim.** Every review states its ACTUAL posture on ONE stderr line

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -46,7 +46,7 @@ Environment:
 
 | Var | Default | Effect |
 |---|---|---|
-| `AGY_MODEL` | `Gemini 3.7 Flash (High)` | model display string; set empty (`AGY_MODEL=`) to drop `--model` and let `agy` use `settings.json` |
+| `AGY_MODEL` | `Gemini 3.8 Flash (High)` | model display string; set empty (`AGY_MODEL=`) to drop `--model` and let `agy` use `settings.json` |
 | `AGY_TIMEOUT` | `5m` | value passed to `--print-timeout` |
 | `AGY_HARD_TIMEOUT` | `= AGY_TIMEOUT` | hard `timeout(1)` wall-clock cap (a duration string) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | single-argv byte ceiling. `agy` takes the prompt as ONE `-p` argv; past `MAX_ARG_STRLEN` (~131072) `execve` fails with a cryptic `Argument list too long`. The wrapper measures the resolved `-`/`@file` prompt and fails loud over the ceiling. A huge **literal** `agy-run "<huge>"` fails at the wrapper's own `exec`, so route large prompts via `-`/`@file`. |
@@ -71,7 +71,7 @@ agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   #
 
 | Var | Default | Effect |
 |---|---|---|
-| `AGY_MODEL` | `Gemini 3.7 Flash (High)` | frontier default (fork (a), 2026-08-14); **any** model is allowed — a sub-frontier one earns a silenceable advisory (quality-first, not a gate) |
+| `AGY_MODEL` | `Gemini 3.8 Flash (High)` | frontier default (AD-136, 2026-09-09; 3.7 Flash (High) stays frontier, fork (a)); **any** model is allowed — a sub-frontier one earns a silenceable advisory (quality-first, not a gate) |
 | `AGY_PROBE` | `0` | `1` silences the off-frontier model advisory AND lets `code` run without `--facts` (an ungrounded probe never attests — its receipt is probe-marked) |
 | `AGY_REVIEW_MAX_TOTAL_BYTES` | `240000` | the ceiling on the SUM of all outgoing prompt bytes an oversized `code` review's chunked feed may send; checked BEFORE the first turn is spent |
 | `AGY_REVIEW_ALLOW_ADDDIR` | `0` | **RETIRED** — recognized so an existing settings line never warns as unknown, but it arms nothing. An oversized `code` review is a chunked feed with a per-part delivery proof; the `--add-dir` offload it armed could not be verified (headless `agy` auto-denies `read_file`) |
@@ -97,15 +97,18 @@ Pass the **exact display string** from `agy models`, or set `AGY_MODEL`.
 
 | Model string | Practical use |
 |---|---|
-| `Gemini 3.7 Flash (Low)` | lowest-cost smoke tests, cheap probes, simple rewrites (newest Flash) |
-| `Gemini 3.7 Flash (Medium)` | fast summaries, context-reachability checks |
-| `Gemini 3.7 Flash (High)` | wrapper + review default — asserted frontier-grade (fork (a)) |
-| `Gemini 3.6 Flash (Low)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.6 Flash (Medium)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.6 Flash (High)` | previous Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (Low)` | older Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (Medium)` | older Flash generation, still served — prefer 3.7 |
-| `Gemini 3.5 Flash (High)` | older Flash generation, still served — prefer 3.7 |
+| `Gemini 3.8 Flash (Low)` | lowest-cost smoke tests, cheap probes, simple rewrites (newest Flash) |
+| `Gemini 3.8 Flash (Medium)` | fast summaries, context-reachability checks |
+| `Gemini 3.8 Flash (High)` | wrapper + review default — asserted frontier-grade (AD-136) |
+| `Gemini 3.7 Flash (Low)` | previous Flash generation, still served — prefer 3.8 |
+| `Gemini 3.7 Flash (Medium)` | previous Flash generation, still served — prefer 3.8 |
+| `Gemini 3.7 Flash (High)` | previous Flash generation, still frontier-grade for review (fork (a)) |
+| `Gemini 3.6 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.6 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.6 Flash (High)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
+| `Gemini 3.5 Flash (High)` | older Flash generation, still served — prefer 3.8 |
 | `Gemini 3.1 Pro (Low)` | cheaper Pro pass for medium reasoning |
 | `Gemini 3.1 Pro (High)` | hard reasoning, plan critique, architecture review (slower, deeper) |
 | `Claude Sonnet 4.6 (Thinking)` | cross-vendor reasoning comparison |

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.7.0'
+  version: '3.8.0'
 ---
 
 # codex-cli-bridge
@@ -48,9 +48,9 @@ this skill. Both wrappers enforce the subscription path before invoking codex:
 
 ## Models quality-first pinned
 
-Delegated codex work ALWAYS runs on the **PINNED model at maximum reasoning effort**: the wrappers
-**pin** `gpt-5.6-sol` / `xhigh` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
-— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-5.6-sol`
+Delegated codex work ALWAYS runs on the **PINNED model at the PINNED reasoning effort**: the wrappers
+**pin** `gpt-6-astra` / `high` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
+— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-6-astra`
 names one model rather than following the CLI's current default. That the pinned id is also the
 *strongest* selectable Codex model is a **separate, time-bounded claim**, checked BY HAND against
 <https://developers.openai.com/codex/models>. There is **no automated gate and this file records no
@@ -63,8 +63,10 @@ either way between releases:
   available until someone re-checks the page.
 
 The guard is therefore a **pin-integrity** guard, not a quality guarantee: it enforces that runs use
-the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. Read a
-refusal as "not the pinned id", never as "a downgrade was prevented".
+the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. The effort
+pin is the same kind of decision: `high` is a deliberate posture, not the catalog maximum (`xhigh`,
+`max` and `ultra` exist above it), and the guard refuses a higher effort exactly as it refuses a lower
+one. Read a refusal as "not the pinned id", never as "a downgrade was prevented".
 
 Economy comes only from **quality-neutral waste removal** (clean capture, a hard timeout,
 a precomputed review diff, `resume` instead of re-sending context), never from a downgrade.
@@ -75,8 +77,8 @@ output as real delegated work.
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-5.6-sol` (pinned) | model passed to `-m`; a non-default is REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `xhigh` (pinned) | reasoning effort (`-c model_reasoning_effort=…`); non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model passed to `-m`; a non-default is REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | `high` (pinned) | reasoning effort (`-c model_reasoning_effort=…`); non-default REFUSED unless `CODEX_PROBE=1` |
 
 `codex --version` reports the CLI version, **not** the model list. Quota is metered in **messages**
 (a rolling 5h window + a weekly cap), not raw tokens — which is why the levers above are about removing
@@ -156,10 +158,10 @@ defeat a policy is guarded — see [§ Models](#models-quality-first-pinned).
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-5.6-sol` (pinned) | model; non-default REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `xhigh` (pinned) | reasoning effort; non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model; non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | `high` (pinned) | reasoning effort; non-default REFUSED unless `CODEX_PROBE=1` |
 | `CODEX_HARD_TIMEOUT` | `3600` (exec) / `1800` (review) | hard wall-clock cap (seconds) via `timeout`/`gtimeout`; exit 124/137 ⇒ "exceeded hard cap". No `timeout` binary ⇒ a nonce-less exec warns loudly + runs uncapped, a **nonced** exec REFUSES pre-spend (an accounted dispatch that cannot be capped can never honour the terminal-exit rule), and `codex-review` REFUSES pre-spend (fail-closed preflight). |
-| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = ~1.5× token speed at a **2.5× credit rate** on gpt-5.6-sol — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-pinned 2026-07-05), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
+| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = "2x speed, **increased usage**" in the codex catalog's own words for gpt-6-astra (cache fetched 2026-09-05); it states no credit-rate figure — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-verified), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
 | `CODEX_SESSION_FILE` | `./.codex-last-session` | where `codex-exec` records the session id and where `--resume-last` reads it |
 | `CODEX_REVIEW_MAX_TOTAL_BYTES` | `1500000` | `codex-review code`: above this the assembled diff goes via a git-dir temp file instead of inline — never truncated |
 | `AW_REVIEW_NONCE` | unset | the flow dispatch nonce (safe grammar `[A-Za-z0-9._-]{1,64}` — anything else refuses pre-spend). `codex-review … --nonce <n>` is the plain-argument equivalent (one seam; flag and a non-empty env must agree, a disagreeing pair refuses pre-spend) — the lane for hosts whose dispatch policy has no env-prefix form. When supplied, a successful review first mints the finding MANIFEST `agent-workflow-finding-manifest-codex-<nonce>.json` beside the receipts file (atomic, no-clobber, ORDERED before the receipt append) — a failed mint EXCLUDES the receipt, so a nonce-supplied dispatch never lands a receipt without its readable manifest; nonce-less runs add no nonce field and mint nothing (the `wrapperVersion` field every receipt carries moves with each release) |
@@ -210,7 +212,7 @@ skipped entirely without a nonce: the wrapper is byte-unchanged, writes no artif
 `${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf` holds `KEY=VALUE` lines,
 **parsed, never sourced** — a file line can never execute code. Precedence: explicit env (even
 empty — `KEY=` disables a knob for one run) > file > built-in default. File-settable keys for this
-bridge: `CODEX_SERVICE_TIER` (the Fast tier — **2.5× credit rate**; enabling it is a consented
+bridge: `CODEX_SERVICE_TIER` (the Fast tier — **increased usage**; enabling it is a consented
 per-host spend decision, never a default), `CODEX_HARD_TIMEOUT`, `CODEX_REVIEW_MAX_TOTAL_BYTES` —
 exactly the manifest `settings` block (the single source; the wrapper constants and `--help` are
 drift-guarded against it). Model/effort keys are **not** file-settable — the quality guard above

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -13,12 +13,12 @@
 #   - network access OFF: new dependencies / network installs are done by a human
 #   - approval_policy=never: there is no TTY in exec; anything needing escalation
 #     is refused and reported, then handled by hand
-#   - the PINNED model at maximum reasoning effort (quality-first — see below)
+#   - the PINNED model at the PINNED reasoning effort (quality-first — see below)
 #   - git WRITES are blocked by a physical shim (codex spawns git via execve, which
 #     bypasses shell functions) — the orchestrator owns the commit boundary.
 #
 # Quality-first (hard rule): delegated codex work ALWAYS runs on the PINNED
-# model at maximum reasoning effort. The defaults below are pinned and the wrapper
+# model at the PINNED reasoning effort. The defaults below are pinned and the wrapper
 # REFUSES a non-default CODEX_MODEL/CODEX_EFFORT — knowingly-worse output is never
 # traded for quota. The ONLY exception is a throwaway probe whose result does not
 # depend on effort: set CODEX_PROBE=1 (echoed loudly) to relax the guard. Economy
@@ -149,7 +149,7 @@ Notes:
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
-  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — ~1.5x speed at a 2.5x credit rate on gpt-5.6-sol); a consented SPEND knob, default off (standard tier)
+  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6-astra, cache fetched 2026-09-05; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 3600)
 
 Environment: CODEX_HARD_TIMEOUT (seconds, default 3600), CODEX_PROBE=1 (throwaway probe only), AW_DISPATCH_NONCE (delegation dispatch nonce — mints the exec receipt; the --nonce <n> flag is its plain-argument equivalent), AW_DELEGATION_STORE (absolute delegation-store path; its dirname is where the receipt lands).
@@ -319,19 +319,20 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-5.6-sol"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
-DEFAULT_CODEX_EFFORT="xhigh"    # maximum reasoning effort — pinned
+DEFAULT_CODEX_MODEL="gpt-6-astra"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
+DEFAULT_CODEX_EFFORT="high"    # pinned reasoning effort — a deliberate posture, not the catalog maximum
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
-# Generous hard wall-clock cap, sized for a slow xhigh run (subscription latency
+# Generous hard wall-clock cap, sized for a slow run at the pinned effort (subscription latency
 # varies — a trivial reply was observed taking minutes). Raise for a known-healthy
 # long run; lowering it only risks killing real work.
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-3600}"
-# Codex service tier (quality-neutral speed knob; live-probed 2026-07-05): default EMPTY ⇒ no
+# Codex service tier (quality-neutral speed knob): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
-# display name "Fast": ~1.5x token speed at a 2.5x credit rate on gpt-5.6-sol; quality-neutral —
-# same model). codex itself accepts ANY -c service_tier string silently (probe-verified), so
+# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6-astra, cache
+# fetched 2026-09-05; it states no credit-rate figure; quality-neutral — same model). codex itself
+# accepts ANY -c service_tier string silently (probe-verified), so
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
@@ -372,14 +373,14 @@ CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 # receipt this wrapper mints; scripts/release/version-sync.mjs bumps it under the one-anchor-per-file
 # rule, so a release can never leave it behind (the AD-053 drift class).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.7.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="3.8.0"  # aw-version-anchor
 # The kill grace handed to timeout(1) as --kill-after, and recorded in the receipt as killGraceS:
 # ONE constant, so the number the ledger checks against the dispatch deadline is the number the run
 # actually applied.
 CODEX_KILL_GRACE_S=15
 
 # --- Quality-first guard: refuse any non-pinned model/effort ---------------
-# Real delegated runs must use the pinned model at max effort. A throwaway probe
+# Real delegated runs must use the pinned model at the pinned effort. A throwaway probe
 # (effort-independent result) may opt out with CODEX_PROBE=1, announced loudly.
 if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   echo "warning: CODEX_PROBE=1 — THROWAWAY PROBE MODE. Quality guards relaxed; do NOT use this run's" >&2
@@ -387,13 +388,13 @@ if [[ "${CODEX_PROBE:-}" == "1" ]]; then
 else
   if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
     echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       Delegated codex work must run on the pinned model at max effort (quality-first)." >&2
+    echo "       Delegated codex work must run on the pinned model at the pinned effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
   if [[ "$CODEX_EFFORT" != "$DEFAULT_CODEX_EFFORT" ]]; then
-    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned max effort '$DEFAULT_CODEX_EFFORT'." >&2
-    echo "       Delegated codex work must run at max reasoning effort (quality-first)." >&2
+    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned effort '$DEFAULT_CODEX_EFFORT'." >&2
+    echo "       Delegated codex work must run at the pinned reasoning effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
@@ -932,7 +933,7 @@ if [[ -n "$resume_mode" ]]; then
 else
   # `-o` writes ONLY codex's final message; `--json` streams structured events
   # (thread.started carries the session id). CoT is dropped and colour disabled, so
-  # the captured surfaces stay clean. Reasoning still runs at xhigh — quality is
+  # the captured surfaces stay clean. Reasoning still runs at the pinned effort — quality is
   # unchanged; we only stop printing the noise.
   codex_cmd=(codex exec
     --ignore-user-config