@sabaiway/agent-workflow-kit 14.19.1 → 14.21.0

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -17,23 +17,22 @@
 # policy (no plan contract, no auto-approve, no workspace edits) — that is left
 # to whatever flow we design later, which can opt in via passthrough flags.
 #
-# Model families (compact inventory only; run `agy models` for exact display strings, then pass
-# one via AGY_MODEL):
-#   Gemini 3.8 Flash (Low|Medium|High), Gemini 3.7 Flash (Low|Medium|High),
-#   Gemini 3.6 Flash (Low|Medium|High), Gemini 3.5 Flash (Low|Medium|High), Gemini 3.1 Pro (Low|High),
-#   Claude Sonnet 4.6 (Thinking), Claude Opus 4.6 (Thinking), GPT-OSS 120B (Medium)
+# Model: the host posture — AGY_MODEL in the bridge settings file, else the built-in default
+# "Gemini 3.8 Flash (High)". `/agent-workflow-kit bridge-settings` shows the models the installed
+# agy offers and sets one.
 #
 # Usage (installed on PATH as `agy-run`):
 #   agy-run "your prompt"                    # prompt as an argument
 #   echo "your prompt" | agy-run -           # prompt from stdin
 #   agy-run @path/to/prompt.md               # prompt from a file
-#   AGY_MODEL="Claude Opus 4.6 (Thinking)" agy-run "..."   # pick a model
+#   AGY_MODEL="<display string>" agy-run "..."   # a one-run model (default: the host posture)
 #   AGY_TIMEOUT=10m agy-run "..."            # override print timeout (agy's soft bound)
 #   AGY_HARD_TIMEOUT=8m agy-run "..."        # override the hard wall-clock cap (timeout(1))
 #   AGY_MAX_PROMPT_BYTES=60000 agy-run @big.md    # LOWER the single-argv byte ceiling (default 120000;
 #                                            # the override only tightens it — it can never exceed the OS ~131072 limit)
 #   agy-run "..." -- --add-dir .             # passthrough agy flags (this wrapper stays
-#                                            # flow-agnostic; it never widens agy's own permissions)
+#                                            # flow-agnostic; it never widens agy's own permissions;
+#                                            # --model* and --effort* refuse — the model is AGY_MODEL)
 set -euo pipefail
 
 # --- --help / -h (pre-preflight: no agy, no login needed) ----------------------
@@ -56,7 +55,7 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
   AGY_HARD_TIMEOUT — hard wall-clock cap, duration string like 5m/30m/90s (built-in default = AGY_TIMEOUT, 5m)
 
-Environment: AGY_MODEL (exact display string from `agy models`; empty ⇒ agy's settings.json), AGY_TIMEOUT / AGY_HARD_TIMEOUT (duration strings), AGY_MAX_PROMPT_BYTES (single-argv byte ceiling; the override only lowers it).
+Environment: AGY_MODEL (exact display string from `agy models` — a one-run override of the host posture; empty ⇒ agy's settings.json), AGY_TIMEOUT / AGY_HARD_TIMEOUT (duration strings), AGY_MAX_PROMPT_BYTES (single-argv byte ceiling; the override only lowers it).
 Requires at run time: the agy CLI on PATH + a Google AI subscription login (--help needs neither).
 HELP
     exit 0
@@ -76,6 +75,7 @@ done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
 
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="AGY_HARD_TIMEOUT"
+DEFAULT_AGY_MODEL="Gemini 3.8 Flash (High)"
 
 # --- Bridge settings file (host-level, kit-independent) — byte-identical across the four wrappers ---
 # ${XDG_CONFIG_HOME:-$HOME/.config}/agent-workflow/bridge-settings.conf holds KEY=VALUE lines,
@@ -96,7 +96,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES CODEX_MODEL CODEX_EFFORT AGY_MODEL " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -181,6 +181,35 @@ aw_apply_settings() {
   done
   return 0
 }
+aw_read_posture() {
+  local key="$1" default="$2" empty="$3" file line value notify=1
+  AW_HOST_VALUE="$default"
+  AW_HOST_SOURCE="default"
+  file="$(aw_settings_file)"
+  [[ -n "${AW_SETTINGS_NOTIFIED:-}" ]] && notify=0
+  if [[ -f "$file" && -r "$file" ]]; then
+    line="$(grep "^${key}=" "$file" 2>/dev/null || true)"
+    if [[ -n "$line" ]]; then
+      value="${line##*$'\n'}"
+      value="${value#*=}"
+      if [[ -n "$value" && "$value" != *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+        AW_HOST_VALUE="$value"
+        AW_HOST_SOURCE="setting"
+      elif (( notify )); then
+        echo "warning: $key in bridge settings file '$file' is empty or carries a control byte — using the built-in default '$default'." >&2
+      fi
+    fi
+  fi
+  AW_RUN_VALUE="$AW_HOST_VALUE"
+  AW_RUN_SOURCE="$AW_HOST_SOURCE"
+  if [[ -n "${!key+x}" ]]; then
+    AW_RUN_VALUE="${!key:-$empty}"
+    AW_RUN_SOURCE="environment"
+  fi
+  return 0
+}
+aw_read_posture AGY_MODEL "$DEFAULT_AGY_MODEL" ""
+AGY_MODEL="$AW_RUN_VALUE"; AGY_MODEL_SOURCE="$AW_RUN_SOURCE"
 aw_apply_settings
 
 # --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
@@ -239,9 +268,6 @@ if ! command -v agy >/dev/null 2>&1; then
   exit 127
 fi
 
-# `-` (empty) => skip --model and let agy use settings.json; default to Flash (High) — asserted
-# frontier-grade (fork (a), maintainer 2026-08-14; the 3.8 pin AD-136, 2026-09-09).
-AGY_MODEL="${AGY_MODEL-Gemini 3.8 Flash (High)}"
 AGY_TIMEOUT="${AGY_TIMEOUT:-5m}"
 AGY_TIMEOUT="$(aw_effective_timeout AGY_TIMEOUT 5m)"
 # Hard wall-clock cap (defaults to AGY_TIMEOUT). agy's own --print-timeout is NOT a reliable
@@ -271,6 +297,13 @@ if [[ $# -gt 0 ]]; then
     exit 2
   fi
 fi
+for _arg in ${passthrough[@]+"${passthrough[@]}"}; do
+  case "$_arg" in
+    --model*|--effort*)
+      echo "error: passthrough flag '$_arg' is not allowed — the model is the host posture (AGY_MODEL in $(aw_settings_file)) or the AGY_MODEL environment value for one run, never a flag." >&2
+      exit 2 ;;
+  esac
+done
 
 if [[ "$prompt_src" == "-" ]]; then
   prompt="$(cat)"
@@ -321,6 +354,67 @@ if (( prompt_bytes > AGY_MAX_PROMPT_BYTES )); then
   exit 2
 fi
 
+# The effective model against the installed CLI's catalog, pre-spend — skipped when agy-review read
+# it once for the whole run (its marker), and when AGY_MODEL is explicitly empty (no model string).
+timeout_bin="$(aw_resolve_timeout_bin)"
+AGY_CATALOG_TIMEOUT=30s
+aw_agy_remedy() {
+  if [[ -z "$1" ]]; then
+    echo "       remedy: unset AGY_MODEL in the environment (the host posture then decides)." >&2
+    return 0
+  fi
+  echo "       remedy: set this line in $(aw_settings_file):" >&2
+  echo "         AGY_MODEL=$1" >&2
+  echo "       and unset AGY_MODEL in the environment." >&2
+}
+aw_agy_shown_model() {
+  if [[ -z "$AGY_MODEL" ]]; then printf '%s' "AGY_MODEL= (explicitly empty)"; return 0; fi
+  if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then printf '%s' "AGY_MODEL (a value carrying a control byte)"; return 0; fi
+  printf '%s' "AGY_MODEL='$AGY_MODEL'"
+}
+aw_agy_catalog_check() {
+  local raw="" rc=0 line="" remedy="" reason="" offered=()
+  if [[ -n "$1" ]]; then
+    raw="$("$1" --kill-after=5s "$AGY_CATALOG_TIMEOUT" agy models </dev/null 2>/dev/null)" || rc=$?
+  else
+    raw="$(agy models </dev/null 2>/dev/null)" || rc=$?
+  fi
+  if (( rc == 0 )); then
+    while IFS= read -r line; do
+      line="${line%$'\r'}"
+      [[ "$line" == *$'\t'* ]] || continue
+      line="${line#*$'\t'}"
+      if [[ -n "$line" && "$line" != *[$'\x01'-$'\x1f'$'\x7f']* ]]; then offered+=("$line"); fi
+    done <<<"$raw"
+  fi
+  if (( rc == 124 || rc == 137 )); then
+    reason="it exceeded $AGY_CATALOG_TIMEOUT"
+  elif (( rc != 0 )); then
+    reason="agy models exited $rc"
+  elif (( ${#offered[@]} == 0 )); then
+    reason="it offers no model"
+  fi
+  if [[ -n "$reason" ]]; then
+    echo "warning: the agy model catalog is unreadable ($reason) — the run proceeds unchecked; agy itself refuses a model it does not serve." >&2
+    return 0
+  fi
+  for line in "${offered[@]}"; do
+    if [[ "$line" == "$AGY_MODEL" ]]; then return 0; fi
+  done
+  remedy="${offered[0]}"
+  for line in "${offered[@]}"; do
+    if [[ "$line" == "$2" ]]; then remedy="$line"; fi
+  done
+  echo "error: $(aw_agy_shown_model) ($AGY_MODEL_SOURCE) is not a model the installed agy offers — refusing before any run is spent." >&2
+  printf -v line '%s, ' "${offered[@]}"
+  echo "       offered: ${line%, }" >&2
+  aw_agy_remedy "$remedy"
+  exit 2
+}
+if [[ -n "$AGY_MODEL" && -z "${AW_AGY_CATALOG_READ:-}" ]]; then
+  aw_agy_catalog_check "$timeout_bin" "$DEFAULT_AGY_MODEL"
+fi
+
 model_flag=()
 if [[ -n "$AGY_MODEL" ]]; then
   model_flag=(--model "$AGY_MODEL")
@@ -332,7 +426,6 @@ agy_cmd=(agy "${model_flag[@]}" --print-timeout "$AGY_TIMEOUT" "${passthrough[@]
 # This is the real guard — a backgrounded, hung agy survives its own --print-timeout otherwise.
 # aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
 # `type` itself), normalized to an ABSOLUTE path fail-closed — nothing can masquerade as the cap.
-timeout_bin="$(aw_resolve_timeout_bin)"
 
 if [[ -z "$timeout_bin" ]]; then
   # The review child seam (flow-orchestration Phase 4): agy-review fails CLOSED at its own
@@ -357,8 +450,8 @@ rc=$?
 set -e
 if [[ $rc -eq 124 || $rc -eq 137 ]]; then
   echo "error: agy exceeded the hard cap AGY_HARD_TIMEOUT=$AGY_HARD_TIMEOUT and was terminated." >&2
-  echo "       This usually means a heavy '--add-dir' agentic run, or the slowest model looping." >&2
-  echo "       Retry with a faster model (e.g. AGY_MODEL='Gemini 3.7 Flash (Low)') or a" >&2
-  echo "       self-contained prompt without --add-dir. Raise AGY_HARD_TIMEOUT only if the run is healthy." >&2
+  echo "       This usually means a heavy '--add-dir' agentic run, or a run looping." >&2
+  echo "       Retry with a narrower, self-contained prompt without --add-dir. Raise AGY_HARD_TIMEOUT" >&2
+  echo "       only if the run is healthy." >&2
 fi
 exit $rc

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -52,7 +52,7 @@ describe('agy.sh — hard wall-clock cap (timeout(1))', { concurrency: true }, (
     rmSync(home, { recursive: true, force: true });
     assert.ok(elapsed < 13000, `wrapper must return well under the kill-after window, took ${elapsed}ms`);
     assert.notEqual(r.status, 0, 'a timed-out run must exit non-zero');
-    assert.match(r.stderr, /exceeded the hard cap/, 'must explain the hard-cap kill');
+    assert.ok(/exceeded the hard cap/.test(r.stderr) && !/faster model/i.test(r.stderr), `must explain the hard-cap kill and never send the run to a faster model: ${r.stderr}`);
   });
 
   it('passes a fast agy run through unchanged (exit 0, stdout preserved)', async () => {
@@ -511,7 +511,7 @@ describe('agy.sh — settings surface ⟷ manifest (D6, manifest-pinned)', () =>
   it('--help Settings section keys set-EQUAL the manifest appliesTo subset', () => {
     const section = helpSection(runHelpText(), SETTINGS_HEADER);
     const got = section.filter((l) => /^[A-Z][A-Z0-9_]+ —/.test(l)).map((l) => l.split(' ')[0]);
-    const want = (MANIFEST.settings ?? []).filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = (MANIFEST.settings ?? []).filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0, 'the manifest must declare settings for this wrapper');
     setEq(got, want, 'help Settings keys ⟷ manifest settings.appliesTo');
     assert.ok(section.some((l) => l.includes('agent-workflow/bridge-settings.conf')), 'the section names the settings file');
@@ -529,7 +529,7 @@ describe('agy.sh — settings surface ⟷ manifest (D6, manifest-pinned)', () =>
   it('AW_SETTINGS_APPLIED equals the manifest appliesTo subset for this wrapper', () => {
     const m = source.match(/^AW_SETTINGS_APPLIED="([^"]*)"$/m);
     assert.ok(m, 'AW_SETTINGS_APPLIED not found');
-    const want = ALL_SETTINGS.filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = ALL_SETTINGS.filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0);
     setEq(m[1].trim().split(/\s+/), want, 'applied subset ⟷ manifest appliesTo');
   });
@@ -538,8 +538,8 @@ describe('agy.sh — settings surface ⟷ manifest (D6, manifest-pinned)', () =>
     const body = source.match(/aw_settings_valid\(\) \{[\s\S]*?\n\}/);
     assert.ok(body, 'aw_settings_valid not found');
     const armKeys = [...body[0].matchAll(/^    ([A-Z][A-Z0-9_]*)\)/gm)].map((x) => x[1]);
-    setEq(armKeys, ALL_SETTINGS.map((s) => s.key), 'validation arms ⟷ manifest keys');
-    for (const s of ALL_SETTINGS) {
+    setEq(armKeys, ALL_SETTINGS.filter((s) => s.kind !== 'posture').map((s) => s.key), 'validation arms ⟷ manifest keys (a posture key is read by aw_read_posture, never validated here)');
+    for (const s of ALL_SETTINGS.filter((x) => x.kind !== 'posture')) {
       const arm = body[0].match(new RegExp(`^    ${s.key}\\) (.*) ;;$`, 'm'));
       assert.ok(arm, `no validation arm for ${s.key}`);
       if (s.kind === 'enum') for (const v of s.values) assert.ok(arm[1].includes(`"${v}"`), `${s.key}: enum value '${v}' not pinned`);

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.7.0",
+  "version": "6.0.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.8 Flash (High)" },
   "roles": {
@@ -31,11 +31,11 @@
           "agy-review --continue [--decided @f] [--focus \"…\"] [--nonce <n>]",
           "agy-review --conversation <id> [--decided @f] [--focus \"…\"] [--nonce <n>]"
         ],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, a one-off model (an explicitly empty AGY_MODEL included) refuses pre-spend unless AGY_PROBE=1, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         "notes": [
           "transport: every review dispatch drives the CLI in --output-format json (plus --disable-slash-commands) and the returned envelope is parsed in node (bin/agy-envelope.mjs) — the operator-facing invocations and flags above do NOT change, and on a ZERO exit the wrapper still PRINTS the review text, never JSON. A missing or unreadable envelope on a zero exit is a loud failure with NO receipt, never a downgraded verdict and never a fallback to raw-stdout parsing; a non-zero CLI exit keeps its own code and message, and publishes the captured stdout unchanged from the SINGLE dispatch or the FINAL fed turn (which may therefore be a JSON or partial payload — the envelope is parsed only on a zero exit); an INTERMEDIATE feed turn is the exception, its output stays private (Invariant E) and its failure prints only a named error. Enforced by a PRE-SPEND capability probe, not a version floor: agy --help must advertise --output-format and --disable-slash-commands, node must be >= 22, and bin/agy-envelope.mjs must be present — otherwise the review refuses before any run is spent and names the missing capability",
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
-          "the review posture banner appends a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity",
+          "the review posture banner appends a banner-only source=model:<s> field — where the model came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
         ]
       }
@@ -177,11 +177,11 @@
       "descriptor": "agy-run <prompt|-|@file> -- <extra agy flags...>",
       "operands": [
         { "slot": "<prompt|-|@file>", "required": true, "description": "the prompt text, - to read it from stdin, or @path to read it from a file" },
-        { "slot": "<extra agy flags...>", "required": false, "description": "raw agy flags passed straight through after --" }
+        { "slot": "<extra agy flags...>", "required": false, "description": "raw agy flags after -- (a --model* or --effort* flag refuses pre-spend: the model is the host posture or the AGY_MODEL environment value)" }
       ],
       "guardrails": [
         { "value": "subscription-only — every *_API_KEY env var is unset before the run", "enforcement": "enforced", "source": "bin/agy.sh" },
-        { "value": "any model is selectable via AGY_MODEL; the default is Gemini 3.8 Flash (High)", "enforcement": "advisory", "source": "bin/agy.sh" },
+        { "value": "the model is the host posture (AGY_MODEL in the bridge settings file, else Gemini 3.8 Flash (High)); AGY_MODEL in the environment sets it for one run", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "hard wall-clock cap AGY_HARD_TIMEOUT (built-in default 5m)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped", "source": "capability.json settings.AGY_HARD_TIMEOUT" },
         { "value": "the prompt rides a single argv — over AGY_MAX_PROMPT_BYTES (120000) the run refuses", "enforcement": "enforced", "source": "bin/agy.sh" },
         { "value": "no review posture, no grounding, no receipt — the reply is raw model output", "enforcement": "advisory", "source": "bin/agy.sh" }
@@ -192,10 +192,10 @@
       "key": "AGY_PROBE",
       "kind": "env-hook",
       "parents": ["review.code", "review.plan", "review.diff", "review.continue", "review.conversation"],
-      "purpose": "Silence the off-frontier model advisory for a THROWAWAY probe review.",
+      "purpose": "Run a one-off model for a THROWAWAY probe review — the one route to a one-off.",
       "whenToUse": [
         "a probe whose answer cannot depend on the model",
-        "deliberately reviewing with a cheaper non-frontier model"
+        "trying a model other than the host posture before setting it"
       ],
       "whenNotTo": ["any run whose output informs what ships — a probe never attests"],
       "descriptor": "AGY_PROBE=1 agy-review code [--facts @<facts-file>]",
@@ -208,6 +208,13 @@
     }
   ],
   "settings": [
+    {
+      "key": "AGY_MODEL",
+      "kind": "posture",
+      "default": "Gemini 3.8 Flash (High)",
+      "appliesTo": ["agy-run", "agy-review"],
+      "effect": "the agy model every run uses (the host posture), an exact display string; a set value is checked against the installed agy's catalog first. /agent-workflow-kit bridge-settings shows the models offered."
+    },
     {
       "key": "AGY_HARD_TIMEOUT",
       "kind": "duration",

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -8,7 +8,7 @@ edits, verification, and final judgment.
 ## Delegation checklist
 
 1. Pick the narrowest useful question.
-2. Choose the cheapest model that can answer it.
+2. Run on the host posture (the user's `AGY_MODEL` setting); only an `agy-run` probe names a one-run model.
 3. Include only the relevant excerpts, paths, constraints, and the expected output shape.
 4. State permission boundaries in the prompt (no edits, no git writes).
 5. Run `agy-run` headlessly.
@@ -16,17 +16,11 @@ edits, verification, and final judgment.
 
 ## Model selection
 
-| Task | Model |
-|---|---|
-| Reachability / smoke / "is it wired?" | `Gemini 3.8 Flash (Low)` |
-| Cheap probes, summaries | `Gemini 3.8 Flash (Medium)` |
-| Review, reasoning, careful drafting | `Gemini 3.8 Flash (High)` (wrapper default; asserted frontier-grade, AD-136) |
-| The previous Flash generation, still frontier-grade for review | `Gemini 3.7 Flash (High)` (fork (a)) |
-| Slower, deeper reasoning pass | `Gemini 3.1 Pro (High)` |
-| Same Pro reasoning, lower quota cost | `Gemini 3.1 Pro (Low)` |
-| A different engine's opinion | `Claude Sonnet 4.6 (Thinking)`, `Claude Opus 4.6 (Thinking)`, or `GPT-OSS 120B (Medium)` |
-
-The 3.7 / 3.6 / 3.5 Flash families remain served — prefer 3.8 (newest generation at the same tiers).
+Reviews and kept work run on the host posture: `AGY_MODEL` in the bridge settings file, else
+`Gemini 3.8 Flash (High)`; a weaker model is the user's choice in that setting, never a per-call pick.
+**`/agent-workflow-kit bridge-settings`** shows the models the installed `agy` offers and sets that
+setting; an `agy-run` probe may name any offered display string as its one-run model.
+
 Don't reach for Pro by reflex — Flash answers most reachability/probe questions for a fraction of the
 quota.
 
@@ -96,13 +90,15 @@ What it does for you, and what YOU must supply:
   `AGY_REVIEW_ALLOW_ADDDIR` is **RETIRED** (recognized, arms nothing): headless `agy` auto-denies its
   own `read_file`, so the offload it armed could return a confident fabrication with no way to tell.
   The kit never grants that permission — the feed exists so none is needed.
-- **Model:** frontier default `Gemini 3.8 Flash (High)`; any model is allowed (a sub-frontier one earns a
-  silenceable `AGY_PROBE=1` advisory). The service can still **stall on large/substantive prompts**
+- **Model:** the host posture (the `AGY_MODEL` setting, else `Gemini 3.8 Flash (High)`), checked once
+  per run against `agy models`; an `AGY_MODEL` environment value off it is a one-off, refused pre-spend
+  unless `AGY_PROBE=1` (a probe review never attests). The service can still **stall on large/substantive prompts**
   (Issue-001) — keep reviews **focused**; the hard timeout is the guard.
 - **Posture banner — quote it verbatim.** Every review states its ACTUAL posture on ONE stderr line
-  (`review posture: model=… timeout=…`). When you label a dispatch for a user or a record, **quote
-  the posture banner verbatim** — the banner is the machine-stated posture; a prose re-type drifts.
-  The `timeout=` field is **banner-only** (exactly the duration `agy-run` hands to `timeout(1)`;
+  (`review posture: model=… source=… timeout=…`). When you label a dispatch for a user or a record,
+  **quote the posture banner verbatim** — the banner is the machine-stated posture; a prose re-type
+  drifts. The `source=` field (`model:<s>`, `default`, `setting` or `environment`) and the `timeout=`
+  field are **banner-only** (`timeout=` is exactly the duration `agy-run` hands to `timeout(1)`;
   without a capping binary `agy-review` fails CLOSED pre-spend, so an uncapped review banner no
   longer exists) — informational, never part of the receipt posture.
 
@@ -125,13 +121,13 @@ rewrite history. Return findings and suggested changes only.
 
 ## Project-context prompts
 
-Probe **reachability** from a project root (cheap model) — this is the one place `agy` reading its cwd
+Probe **reachability** from a project root (an `agy-run` probe, so a one-run model is fine) — this is the one place `agy` reading its cwd
 context file is the point of the prompt:
 
 ```bash
-AGY_MODEL="Gemini 3.7 Flash (Low)" agy-run \
+AGY_MODEL="<an offered display string>" agy-run \
   "Read the cwd context file and report the dialogue language plus one Hard Constraint."
-AGY_MODEL="Gemini 3.7 Flash (Low)" agy-run \
+AGY_MODEL="<an offered display string>" agy-run \
   "Without using a file pointer, is there a project-specific planning skill in this repo? Name it and cite its path."
 ```
 

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -46,7 +46,7 @@ Environment:
 
 | Var | Default | Effect |
 |---|---|---|
-| `AGY_MODEL` | `Gemini 3.8 Flash (High)` | model display string; set empty (`AGY_MODEL=`) to drop `--model` and let `agy` use `settings.json` |
+| `AGY_MODEL` | the setting, else `Gemini 3.8 Flash (High)` | model display string, checked pre-spend against `agy models`; the environment value is a one-run model (a probe's one-off); set empty (`AGY_MODEL=`) to drop `--model` and let `agy` use `settings.json` |
 | `AGY_TIMEOUT` | `5m` | value passed to `--print-timeout` |
 | `AGY_HARD_TIMEOUT` | `= AGY_TIMEOUT` | hard `timeout(1)` wall-clock cap (a duration string) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | single-argv byte ceiling. `agy` takes the prompt as ONE `-p` argv; past `MAX_ARG_STRLEN` (~131072) `execve` fails with a cryptic `Argument list too long`. The wrapper measures the resolved `-`/`@file` prompt and fails loud over the ceiling. A huge **literal** `agy-run "<huge>"` fails at the wrapper's own `exec`, so route large prompts via `-`/`@file`. |
@@ -71,8 +71,8 @@ agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   #
 
 | Var | Default | Effect |
 |---|---|---|
-| `AGY_MODEL` | `Gemini 3.8 Flash (High)` | frontier default (AD-136, 2026-09-09; 3.7 Flash (High) stays frontier, fork (a)); **any** model is allowed — a sub-frontier one earns a silenceable advisory (quality-first, not a gate) |
-| `AGY_PROBE` | `0` | `1` silences the off-frontier model advisory AND lets `code` run without `--facts` (an ungrounded probe never attests — its receipt is probe-marked) |
+| `AGY_MODEL` | the setting, else `Gemini 3.8 Flash (High)` | the host posture is the `AGY_MODEL` line of the bridge settings file; an environment value off it (an explicitly empty one included) is a one-off, refused pre-spend unless `AGY_PROBE=1` |
+| `AGY_PROBE` | `0` | `1` is the one route to a one-off model AND lets `code` run without `--facts` (a probe never attests — its receipt is probe-marked) |
 | `AGY_REVIEW_MAX_TOTAL_BYTES` | `240000` | the ceiling on the SUM of all outgoing prompt bytes an oversized `code` review's chunked feed may send; checked BEFORE the first turn is spent |
 | `AGY_REVIEW_ALLOW_ADDDIR` | `0` | **RETIRED** — recognized so an existing settings line never warns as unknown, but it arms nothing. An oversized `code` review is a chunked feed with a per-part delivery proof; the `--add-dir` offload it armed could not be verified (headless `agy` auto-denies `read_file`) |
 | `AGY_HARD_TIMEOUT` | `30m` | the review's hard cap (longer default than a probe — reviews are slower) |
@@ -93,33 +93,16 @@ as "capability present".
 
 ## Models
 
-Pass the **exact display string** from `agy models`, or set `AGY_MODEL`.
-
-| Model string | Practical use |
-|---|---|
-| `Gemini 3.8 Flash (Low)` | lowest-cost smoke tests, cheap probes, simple rewrites (newest Flash) |
-| `Gemini 3.8 Flash (Medium)` | fast summaries, context-reachability checks |
-| `Gemini 3.8 Flash (High)` | wrapper + review default — asserted frontier-grade (AD-136) |
-| `Gemini 3.7 Flash (Low)` | previous Flash generation, still served — prefer 3.8 |
-| `Gemini 3.7 Flash (Medium)` | previous Flash generation, still served — prefer 3.8 |
-| `Gemini 3.7 Flash (High)` | previous Flash generation, still frontier-grade for review (fork (a)) |
-| `Gemini 3.6 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.6 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.6 Flash (High)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.5 Flash (Low)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.5 Flash (Medium)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.5 Flash (High)` | older Flash generation, still served — prefer 3.8 |
-| `Gemini 3.1 Pro (Low)` | cheaper Pro pass for medium reasoning |
-| `Gemini 3.1 Pro (High)` | hard reasoning, plan critique, architecture review (slower, deeper) |
-| `Claude Sonnet 4.6 (Thinking)` | cross-vendor reasoning comparison |
-| `Claude Opus 4.6 (Thinking)` | expensive deep critique when the user wants another high-end pass |
-| `GPT-OSS 120B (Medium)` | open-weights-style comparison / diversity pass |
+Set the **exact display string** from `agy models` as `AGY_MODEL` — in the bridge settings file for
+the host posture, or in the environment for one run (`--model` after `--` is refused). The built-in
+default is `Gemini 3.8 Flash (High)`. **`/agent-workflow-kit bridge-settings`** shows the models the
+installed `agy` offers, in its own order, and sets the host posture after checking it against that list.
 
 Examples:
 
 ```bash
-AGY_MODEL="Gemini 3.7 Flash (Low)" agy-run "Read AGENTS.md and report one Hard Constraint."
-AGY_MODEL="Claude Sonnet 4.6 (Thinking)" AGY_TIMEOUT=10m agy-run @review-prompt.md
+agy-run "Read AGENTS.md and report one Hard Constraint."             # the host posture
+AGY_MODEL="<an offered display string>" AGY_TIMEOUT=10m agy-run @review-prompt.md   # a one-run model
 ```
 
 ## Flags (from `agy --help`, v1.1.13)
@@ -128,7 +111,7 @@ AGY_MODEL="Claude Sonnet 4.6 (Thinking)" AGY_TIMEOUT=10m agy-run @review-prompt.
 |---|---|---|
 | `-p`, `--print`, `--prompt` | run one headless prompt and print the text response | the wrapper uses `-p` |
 | `--print-timeout <dur>` | cap headless wait time | CLI default `5m0s`; wrapper default `5m` via `AGY_TIMEOUT` |
-| `--model <string>` | select a model | must match an `agy models` display string exactly |
+| `--model <string>` | select a model | must match an `agy models` display string exactly; the wrappers set it from `AGY_MODEL` and refuse it after `--` |
 | `-i`, `--prompt-interactive` | run an initial prompt, then continue interactively | not used by the wrapper |
 | `-c`, `--continue` | continue the most recent conversation | pass after the wrapper's `--` |
 | `--conversation <id>` | resume a specific conversation by id | use only when the user provides/records the id |