@sabaiway/agent-workflow-kit 14.20.0 → 14.21.0

package/tools/bridge-settings.mjs

@@ -11,29 +11,97 @@
 // out-of-range value, and — loudly, naming the key — a file that already carries DUPLICATE keys (it
 // never emits duplicates and never edits blindly around them). It touches only the KEY= line it owns,
 // preserving every comment/blank/other line verbatim, and creates the dir + file on first apply via
-// the hardened out-of-tree atomic writer (symlink/parent/TOCTOU-safe). Model/effort are NOT in the
-// allowlist — the wrappers' quality-first guard is untouched (D4). CODEX_SERVICE_TIER carries the
+// the hardened out-of-tree atomic writer (symlink/parent/TOCTOU-safe). The model keys (kind `posture`,
+// spec bridge-settings) are settable: the read-out shows each bridge's host posture and the models its
+// installed CLI offers, and a set naming a model key is judged against that bridge's catalog before
+// any write. It runs only the catalog commands, never a model. CODEX_SERVICE_TIER carries the
 // credit-rate caveat wherever it renders (from the manifest `effect`).
 //
 // Output is ENGLISH/structured (repo-artifact Hard Constraint); the agent localizes when narrating.
-// Exit codes: 0 success (reader, preview, or apply); 2 usage (bad args / unknown key / invalid value);
-// 1 precondition STOP (duplicate-carrying / symlinked / unreadable file, a write STOP) or a corrupt
-// bundle (cannot determine the allowlist). main(argv, ctx) → { code, stdout, stderr }; getenv / home /
-// bundleRoot / fs are injectable for host-independent tests.
+// Exit codes: 0 success (reader, preview, or apply); 2 usage (bad args / unknown key / invalid value /
+// a model or effort the catalog does not offer); 1 precondition STOP (duplicate-carrying / symlinked /
+// unreadable file, a write STOP) or a corrupt bundle (cannot determine the allowlist).
+// main(argv, ctx) → Promise of { code, stdout, stderr }; getenv / home / bundleRoot / fs and the
+// catalog bounds are injectable for host-independent tests.
 //
 // Dependency-free, Node >= 22. No side effects on import (the isDirectRun idiom).
 
 import { isDirectRun } from './direct-run.mjs';
 import { settingValueValid } from './manifest/validate.mjs';
 import { writeHostConfigFileAtomic } from './atomic-write.mjs';
+import { readCatalogs } from './bridge-catalog.mjs';
 import {
   SETTINGS_SUBDIR, SETTINGS_FILENAME, fail, loadRegistry, allowedLabel, settingsDir, settingsPath,
   joinLines, readFileState, parseSettings, duplicateKeys, effectiveOf, displayValue,
 } from './bridge-settings-read.mjs';
 
+// ── host posture (the model keys) ──────────────────────────────────────────────────────
+
+const slotOf = (key) => (key.endsWith('_EFFORT') ? 'effort' : 'model');
+const postureBridges = (registry) => [...new Set([...registry.values()].filter((e) => e.kind === 'posture').map((e) => e.bridge))];
+
+// One bridge's posture as { model: {key, value, source, note}, effort?: … } under the given env.
+const postureOfBridge = (registry, parsed, getenv, bridge) => Object.fromEntries([...registry.values()]
+  .filter((e) => e.kind === 'posture' && e.bridge === bridge)
+  .map((e) => {
+    const eff = effectiveOf(e, parsed, getenv);
+    return [slotOf(e.key), { key: e.key, value: eff.value, source: eff.source, note: eff.note ?? null, retired: e.retired ?? null }];
+  }));
+
+const showModel = (v) => (v == null ? '(none)' : v);
+const offeredLabel = (catalog) => catalog.entries
+  .map((e) => (e.efforts === undefined ? e.model : `${e.model} (${e.efforts === null ? 'efforts unknown' : e.efforts.join(', ')})`))
+  .join(', ');
+const catalogWarning = (bridge, catalog) => (catalog.state === 'not-installed'
+  ? `⚠ ${bridge}: not installed (${catalog.cause}) — no offered list`
+  : `⚠ ${bridge}: the model catalog is unreadable (${catalog.cause}) — the offered list is unknown`);
+
+const renderPosture = (registry, parsed, getenv, catalogs) => {
+  const lines = ['', '  host posture (the model each bridge runs; the offered models are read from the installed CLI, none is run):'];
+  for (const bridge of postureBridges(registry)) {
+    const p = postureOfBridge(registry, parsed, getenv, bridge);
+    const effort = p.effort ? ` · effort ${showModel(p.effort.value)} [${p.effort.source}]` : '';
+    const notes = [p.model.note, p.effort?.note].filter(Boolean).map((n) => `  — ${n}`).join('');
+    lines.push(`    ${bridge}: model ${showModel(p.model.value)} [${p.model.source}]${effort}${notes}`);
+    const catalog = catalogs[bridge];
+    lines.push(catalog.state === 'offered' ? `      offered: ${offeredLabel(catalog)}` : `      ${catalogWarning(bridge, catalog)}`);
+  }
+  return lines;
+};
+
+const postureJson = (registry, parsed, getenv, catalogs) => postureBridges(registry).map((bridge) => ({
+  bridge, ...postureOfBridge(registry, parsed, getenv, bridge), catalog: catalogs[bridge],
+}));
+
+// The set judgment: the posture the file would give after the ops (the environment ignored), judged
+// against each touched bridge's catalog. Refuses (exit 2) only a model the catalog does not offer or a
+// codex effort that model does not offer; an unreadable catalog yields an "unchecked" statement.
+const judgePosture = async (ops, registry, newLines, ctx) => {
+  const bridges = [...new Set(ops.map((op) => registry.get(op.key)).filter((e) => e.kind === 'posture').map((e) => e.bridge))];
+  if (!bridges.length) return [];
+  const after = parseSettings(joinLines(newLines));
+  const catalogs = await readCatalogs(bridges, ctx);
+  const unchecked = [];
+  for (const bridge of bridges) {
+    const { model, effort } = postureOfBridge(registry, after, {}, bridge);
+    const catalog = catalogs[bridge];
+    if (catalog.state !== 'offered') {
+      unchecked.push(`${bridge}: the value was not checked — ${catalog.state === 'not-installed' ? 'not installed' : 'the model catalog is unreadable'} (${catalog.cause}); the wrapper checks it at run time`);
+      continue;
+    }
+    const entry = catalog.entries.find((e) => e.model === model.value);
+    if (!entry) throw fail(2, `${model.key}=${model.value} is not a model the installed ${bridge} catalog offers — refusing before any write. Offered: ${catalog.entries.map((e) => e.model).join(', ')}`);
+    if (effort && entry.efforts === null) unchecked.push(`${bridge}: the effort was not checked — the catalog entry for ${model.value} lists no efforts; the wrapper checks it at run time`);
+    else if (effort && !entry.efforts.includes(effort.value)) {
+      throw fail(2, `${effort.key}=${effort.value} is not an effort the installed ${bridge} catalog offers for ${model.value} — refusing before any write. Offered: ${entry.efforts.join(', ')}`);
+    }
+  }
+  return unchecked;
+};
+
 // ── reader render ──────────────────────────────────────────────────────────────────
 
-const renderReader = (registry, parsed, fileState, ctx, path) => {
+const renderReader = (registry, parsed, fileState, ctx, path, catalogs) => {
   const getenv = ctx.getenv ?? process.env;
   const lines = [`bridge settings — ${path}`];
   if (fileState.state === 'absent') lines.push('  (no settings file yet — every knob is at its built-in default)');
@@ -43,10 +111,12 @@ const renderReader = (registry, parsed, fileState, ctx, path) => {
     const eff = effectiveOf(entry, parsed, getenv);
     const note = eff.note ? `  — ${eff.note}` : '';
     const retired = entry.retired ? '  ⚠ RETIRED' : '';
-    lines.push(`    ${entry.key} = ${displayValue(eff.value)}  [${eff.source}]${retired}${note}`);
+    const shown = entry.kind === 'posture' ? showModel(eff.value) : displayValue(eff.value);
+    lines.push(`    ${entry.key} = ${shown}  [${eff.source}]${retired}${note}`);
     lines.push(`        ${entry.bridge} · ${allowedLabel(entry)} · ${entry.effect}`);
     if (entry.retired) lines.push(`        RETIRED — ${entry.retired}`);
   }
+  lines.push(...renderPosture(registry, parsed, getenv, catalogs));
   const dups = duplicateKeys(parsed);
   const unknown = [...parsed.byKey.keys()].filter((k) => !registry.has(k));
   if (dups.length) lines.push('', `  ⚠ duplicate keys in the file (last wins at read time; the writer refuses to edit until you fix these): ${dups.join(', ')}`);
@@ -56,7 +126,7 @@ const renderReader = (registry, parsed, fileState, ctx, path) => {
   return lines.join('\n');
 };
 
-const buildReaderJson = (registry, parsed, fileState, ctx, path) => {
+const buildReaderJson = (registry, parsed, fileState, ctx, path, catalogs) => {
   const getenv = ctx.getenv ?? process.env;
   return {
     path,
@@ -65,6 +135,7 @@ const buildReaderJson = (registry, parsed, fileState, ctx, path) => {
       const eff = effectiveOf(entry, parsed, getenv);
       return { key: entry.key, bridge: entry.bridge, kind: entry.kind, effective: eff.value, source: eff.source, note: eff.note ?? null, default: entry.default, retired: entry.retired ?? null };
     }),
+    bridges: postureJson(registry, parsed, getenv, catalogs),
     duplicateKeys: duplicateKeys(parsed),
     unknownKeys: [...parsed.byKey.keys()].filter((k) => !registry.has(k)),
     malformedLines: parsed.malformed.map((m) => m.index + 1),
@@ -182,12 +253,22 @@ const changeLine = (c) => {
   return `  ${c.key}: ${b} → ${a}`;
 };
 
-const renderWriter = ({ changes, wrote, path, willWrite, envShadows, caveats }) => {
+// A model key's env value off the host posture is a one-off the wrappers refuse (spec bridge-model),
+// so its shadow line says that instead of "it wins".
+const SHADOW_EFFECT = {
+  'codex-cli-bridge': 'an environment value off the host posture is a one-off, which codex-exec and codex-review refuse unless CODEX_PROBE=1; unset it.',
+  'antigravity-cli-bridge': 'an environment value off the host posture (an empty one included) is a one-off, which agy-review refuses unless AGY_PROBE=1 (agy-run, the probe role, runs it); unset it.',
+};
+const shadowLine = (entry) => `  ⚠ ${entry.key} is currently set in the environment — ${entry.kind === 'posture'
+  ? SHADOW_EFFECT[entry.bridge] : 'the env value overrides the file for this session (unset it, or it wins until you do).'}`;
+
+const renderWriter = ({ registry, changes, wrote, path, willWrite, envShadows, caveats, unchecked }) => {
   const lines = [];
   lines.push(wrote ? `wrote ${path}` : 'bridge-settings — preview (nothing written; re-run with --apply to write)');
   for (const c of changes) lines.push(changeLine(c));
   for (const cav of caveats) lines.push(`      ↳ ${cav}`);
-  for (const key of envShadows) lines.push(`  ⚠ ${key} is currently set in the environment — the env value overrides the file for this session (unset it, or it wins until you do).`);
+  for (const u of unchecked) lines.push(`  ⚠ ${u}`);
+  for (const key of envShadows) lines.push(shadowLine(registry.get(key)));
   if (!wrote && willWrite) lines.push('', `re-run with --apply to write ${path}.`);
   if (!wrote && !willWrite) lines.push('  no change — the file already reads this way.');
   return lines.join('\n');
@@ -200,7 +281,9 @@ const HELP = `bridge-settings — read / write the host-level bridge settings fi
   ${'${XDG_CONFIG_HOME:-~/.config}'}/${SETTINGS_SUBDIR}/${SETTINGS_FILENAME}   (KEY=VALUE lines; parsed, never sourced)
 
 Usage:
-  node bridge-settings.mjs                          show every knob's effective value + source
+  node bridge-settings.mjs                          show every knob's effective value + source, each
+                                                    bridge's model (codex: and effort) and the models
+                                                    its installed CLI offers
   node bridge-settings.mjs --set KEY=VALUE          preview a change (writes nothing)
   node bridge-settings.mjs --set KEY=VALUE --apply  write the change (atomic; creates the file on first use)
   node bridge-settings.mjs --unset KEY [--apply]    return a knob to its built-in default
@@ -209,14 +292,17 @@ Usage:
                                                     keys (preserved verbatim), never writes
 
 Precedence at run time: explicit env (even empty: KEY= disables) > this file > the wrapper's built-in
-default. Allowed keys + value rules come from the bundled bridge manifests; model/effort are NOT
-settable here (the wrappers' quality guard is untouched). This host file survives every kit upgrade —
+default. Allowed keys + value rules come from the bundled bridge manifests. CODEX_MODEL, CODEX_EFFORT
+and AGY_MODEL set each bridge's host posture; a set of one is checked against that bridge's installed
+CLI catalog before anything is written (an unreadable catalog leaves it unchecked, and says so). The
+command runs only the catalog commands, never a model. This host file survives every kit upgrade —
 a kit refresh never writes or clobbers it.
 
-Exit codes: 0 success (read / preview / write); 2 usage (bad args, unknown key, invalid value);
-            1 precondition STOP (duplicate-carrying / symlinked / unreadable file, or a corrupt bundle).`;
+Exit codes: 0 success (read / preview / write); 2 usage (bad args, unknown key, invalid value, a model
+            or effort the catalog does not offer); 1 precondition STOP (duplicate-carrying / symlinked /
+            unreadable file, or a corrupt bundle).`;
 
-export const main = (argv = [], ctx = {}) => {
+export const main = async (argv = [], ctx = {}) => {
   const getenv = ctx.getenv ?? process.env;
   try {
     if (argv.includes('--help') || argv.includes('-h')) return { code: 0, stdout: HELP, stderr: '' };
@@ -236,9 +322,10 @@ export const main = (argv = [], ctx = {}) => {
     if (ops.length === 0) {
       const fileState = readFileState(path, ctx);
       const parsed = parseSettings(fileState.text ?? '');
+      const catalogs = await readCatalogs(postureBridges(registry), ctx);
       const stdout = json
-        ? JSON.stringify(buildReaderJson(registry, parsed, fileState, ctx, path), null, 2)
-        : renderReader(registry, parsed, fileState, ctx, path);
+        ? JSON.stringify(buildReaderJson(registry, parsed, fileState, ctx, path, catalogs), null, 2)
+        : renderReader(registry, parsed, fileState, ctx, path, catalogs);
       return { code: 0, stdout, stderr: '' };
     }
 
@@ -271,15 +358,16 @@ export const main = (argv = [], ctx = {}) => {
 
     const newLines = ops.reduce(applyOp, parsed.lines);
     const body = joinLines(newLines);
+    const unchecked = await judgePosture(ops, registry, newLines, ctx);
 
     // The machine surface carries the SAME spend/credit-rate caveats the human preview prints (D4) — a
     // --json consumer must not miss the spend consent warning the human render shows.
-    const jsonBody = (wrote) => ({ path, wrote, noop, changes: changes.map((c) => ({ key: c.key, kind: c.kind, before: c.before, after: c.after })), envShadows, caveats });
+    const jsonBody = (wrote) => ({ path, wrote, noop, changes: changes.map((c) => ({ key: c.key, kind: c.kind, before: c.before, after: c.after })), envShadows, caveats, unchecked });
 
     if (!apply || noop) {
       const stdout = json
         ? JSON.stringify(jsonBody(false), null, 2)
-        : renderWriter({ changes, wrote: false, path, willWrite: !noop, envShadows, caveats });
+        : renderWriter({ registry, changes, wrote: false, path, willWrite: !noop, envShadows, caveats, unchecked });
       return { code: 0, stdout, stderr: '' };
     }
 
@@ -287,7 +375,7 @@ export const main = (argv = [], ctx = {}) => {
     writeHostConfigFileAtomic(settingsDir(ctx), SETTINGS_FILENAME, body, ctx, { noun: 'the bridge settings file' });
     const stdout = json
       ? JSON.stringify(jsonBody(true), null, 2)
-      : renderWriter({ changes, wrote: true, path, willWrite: false, envShadows, caveats });
+      : renderWriter({ registry, changes, wrote: true, path, willWrite: false, envShadows, caveats, unchecked });
     return { code: 0, stdout, stderr: '' };
   } catch (err) {
     return { code: err.exitCode ?? 1, stdout: '', stderr: `bridge-settings: ${err.message}` };
@@ -295,7 +383,7 @@ export const main = (argv = [], ctx = {}) => {
 };
 
 if (isDirectRun(import.meta.url)) {
-  const r = main(process.argv.slice(2));
+  const r = await main(process.argv.slice(2));
   if (r.stdout) console.log(r.stdout);
   if (r.stderr) console.error(r.stderr);
   process.exit(r.code);

package/tools/detect-backends.mjs

@@ -75,7 +75,7 @@ const RAW_BACKENDS = [
           'codex-exec --resume-last [--nonce <n>] <plan-file|->',
           'codex-exec --resume <session-id> [--nonce <n>] <plan-file|->',
         ],
-        receipt: "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, no node.",
+        receipt: "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, and it needs no node.",
         passthrough: {
           policy: 'guarded',
           blocked: ['-c*', '--config*', '-s*', '--sandbox*', '--dangerously-bypass-approvals-and-sandbox', '--dangerously-bypass-hook-trust', '--full-auto', '--oss', '--local-provider*', '-p*', '--profile*', '-m*', '--model*', '-o*', '--output-last-message*', '--json*', '--color*', '--output-schema*', '--ephemeral*'],
@@ -83,9 +83,9 @@ const RAW_BACKENDS = [
         },
         notes: [
           'nested-sandbox limit: codex-exec ships its OWN OS sandbox (bwrap workspace-write) and cannot run nested inside a harness sandbox (the FS turns read-only) — route it OUTSIDE the harness sandbox (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a preemptive blanket',
-          'exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend',
+          'exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend',
           'threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent environment. A hostile parent environment — including exported shell functions or PATH substitution of core/backend commands — is outside the threat model and can substitute the backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental shadowing; it is not an environment security boundary',
-          'the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it is never persisted in a receipt or session sidecar',
+          'the exec posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: neither is persisted in a receipt or session sidecar',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
           'every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN (a nonzero exit_code, or the serialized status "failed"); a null exit_code is never failure by itself, tokens split across two items never fire, and a successful command\'s output never fires. The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit status alone can still bank an ungrounded answer — the stderr warning is the signal',
         ],
@@ -99,7 +99,7 @@ const RAW_BACKENDS = [
         continue: [],
         receipt: 'side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of [blocker] and [major] lines (schema mode: findings with either severity; a payload whose findings cannot be counted fails the run, no receipt); artifactPath = the normalized realpath on plan receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit\'s review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized \'Verdict: <ship|revise|rethink>\' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review',
         notes: [
-          'the review posture banner appends a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity',
+          'the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
         ],
       },
@@ -139,11 +139,11 @@ const RAW_BACKENDS = [
           'agy-review --continue [--decided @f] [--focus "…"] [--nonce <n>]',
           'agy-review --conversation <id> [--decided @f] [--focus "…"] [--nonce <n>]',
         ],
-        receipt: "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
+        receipt: "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, a one-off model (an explicitly empty AGY_MODEL included) refuses pre-spend unless AGY_PROBE=1, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         notes: [
           'transport: every review dispatch drives the CLI in --output-format json (plus --disable-slash-commands) and the returned envelope is parsed in node (bin/agy-envelope.mjs) — the operator-facing invocations and flags above do NOT change, and on a ZERO exit the wrapper still PRINTS the review text, never JSON. A missing or unreadable envelope on a zero exit is a loud failure with NO receipt, never a downgraded verdict and never a fallback to raw-stdout parsing; a non-zero CLI exit keeps its own code and message, and publishes the captured stdout unchanged from the SINGLE dispatch or the FINAL fed turn (which may therefore be a JSON or partial payload — the envelope is parsed only on a zero exit); an INTERMEDIATE feed turn is the exception, its output stays private (Invariant E) and its failure prints only a named error. Enforced by a PRE-SPEND capability probe, not a version floor: agy --help must advertise --output-format and --disable-slash-commands, node must be >= 22, and bin/agy-envelope.mjs must be present — otherwise the review refuses before any run is spent and names the missing capability',
           'pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt',
-          'the review posture banner appends a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity',
+          'the review posture banner appends a banner-only source=model:<s> field — where the model came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
         ],
       },

package/tools/family-registry.mjs

@@ -672,9 +672,9 @@ export const surveyBridges = (deps = {}) => {
     // Preserve findOnPath's THREE-state result (present | missing | unknown): an `unknown` (EACCES,
     // "cannot confirm") must stay distinct from a real `missing` — never flattened to a false boolean.
     const wrappers = m.wrapperCmds.map((cmd) => ({ cmd, state: probe(cmd, deps).state }));
-    // Fact-only: the settings knobs ACTIVE (env/file, non-default) for THIS bridge. Model/effort are
-    // structurally absent from the registry, so this can NEVER carry a model claim (the survey's
-    // no-default-model-claim invariant). Localized-on-error like every other survey.
+    // Fact-only: the settings knobs ACTIVE (env/file, non-default) for THIS bridge. The model keys are
+    // knobs too, but their rows live in the snapshot's `posture`, never `active`, so the survey still
+    // emits no model field (its no-default-model-claim invariant). Localized-on-error like every survey.
     const settings = snapshot.error
       ? { error: snapshot.error }
       : { active: snapshot.active.filter((a) => a.bridge === m.name) };

package/tools/manifest/schema.md

@@ -68,7 +68,7 @@ unlike `contract`, it is validated by `validate.mjs` itself: a malformed entry *
 this block). Each entry:
 
 - `key` (string, required) — UPPER_SNAKE_CASE env-var name; unique across the array.
-- `kind` (string, required) — `enum | integer | duration | boolean`.
+- `kind` (string, required) — `enum | integer | duration | boolean | posture` (`posture`: a non-empty string with no control byte and no leading or trailing whitespace — a bridge model or effort; the catalog, not the kind, decides which values a host offers).
   - `enum` → `values` (string[], non-empty, unique).
   - `integer` → `min` / `max` (safe integers, `min <= max`); values are decimal strings.
   - `duration` → the wrappers' shell duration grammar (`5m`, `30m`, `90s`): a unit suffix

package/tools/manifest/validate.mjs

@@ -40,7 +40,7 @@ export const INVALID = 'invalid';
 // declared `default`), the kit-side bridge-settings writer (for a user-supplied value), and — mirrored
 // in shell as aw_settings_valid — the wrappers all use, so a value the writer accepts is exactly a
 // value a wrapper honors. A value is always compared as a STRING (the settings-file wire format).
-export const SETTING_KINDS = new Set(['enum', 'integer', 'duration', 'boolean']);
+export const SETTING_KINDS = new Set(['enum', 'integer', 'duration', 'boolean', 'posture']);
 // The wrappers' shell duration grammar: a unit suffix is REQUIRED (a bare integer is invalid), and
 // zero durations are rejected — `timeout 0` DISABLES a hard cap, so a persistent settings line could
 // otherwise silently remove the stall guard.
@@ -56,6 +56,7 @@ export const settingValueValid = (entry, value) => {
     }
     case 'duration': return DURATION_RE.test(value) && !ZERO_DURATION_RE.test(value);
     case 'boolean': return value === '0' || value === '1';
+    case 'posture': return value !== '' && !/[\u0000-\u001f\u007f]/u.test(value) && !/^\s|\s$/u.test(value);
     default: return false;
   }
 };
@@ -613,7 +614,7 @@ export const validateManifest = (skillDir) => {
           }
         }
         if (!SETTING_KINDS.has(entry.kind)) {
-          errors.push(`${at}.kind must be one of enum|integer|duration|boolean`);
+          errors.push(`${at}.kind must be one of enum|integer|duration|boolean|posture`);
           return; // the typed checks below are meaningless without a kind
         }
         if (entry.kind === 'enum'

package/tools/procedures.mjs

@@ -154,8 +154,8 @@ export const extractSection = (text, activity) => {
 
 const resolveAllSlots = ({ activity, config, detection, overrides, surveyLens }) => {
   // The host-level settings knobs (manifest-as-source), best-effort: a corrupt bundle degrades to none
-  // and the advisor never crashes. Attached per wrapper cmd via each knob's `appliesTo`. Fact-only —
-  // model/effort are not knobs, so no model claim can ride here.
+  // and the advisor never crashes. Attached per wrapper cmd via each knob's `appliesTo` — the model
+  // keys included, as knobs with their allowed-value label, never an effective-model claim.
   const registry = (() => {
     try {
       return loadRegistry({});
@@ -494,7 +494,7 @@ const costLanesAdvice = () => [
   'Cost lanes (orchestration.md §5) — route every step to the cheapest adequate executor:',
   '  • L0 deterministic script — run the gate matrix as ONE batch: /agent-workflow-kit gates (the project-declared docs/ai/gates.json); rotation headroom: archive-changelog / archive-issues / archive-decisions --check. An exit code beats a model re-read.',
   '  • L1 cheap subagent (small model, low effort, read-only tools — /agent-workflow-kit agents places the vehicles) — mechanical sweeps, changelog fact-skeletons, gate-failure triage. Extraction/drafting ONLY; the orchestrator verifies the output and owns every conclusion.',
-  '  • L2 subscription bridge (codex / agy) — reviews per the resolved recipe above, on frontier bridge models (quality-first).',
+  '  • L2 subscription bridge (codex / agy) — reviews per the resolved recipe above, on each bridge\'s host posture (the model the user set, else the bridge default); a weaker model is the user\'s setting, never a per-call choice — a probe is the one route to a one-off and its review receipt never attests.',
   '  • L3 frontier — judgment: plan/fold/synthesis, ADR/handover/changelog-entry wording, persuasive copy, go/no-go, real code.',
   '  • A step with no named guardrail does not move down a lane; red lines never move down (council review models · real code · memory/copy wording · the maintainer approval asks).',
   '  • Sandbox lanes (under an OS sandbox): the L0 surfaces are sandbox-safe — gates/ledger/state/fold checks, git reads, plain no-network tests; the bridge wrappers are genuinely unsandboxed (network); npm-cache-touching commands are COMMAND-SHAPE dependent — first try the sandbox-safe shape (cache under $TMPDIR, offline/notifier off). Move ONLY the failing command out of the sandbox, never its class; BATCH consecutive unsandboxed calls. Pre-dispatch host-diff: before the FIRST dispatch of each bridge, diff its manifest networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt. Nested-sandbox honesty: a backend CLI shipping its OWN OS sandbox cannot run nested inside a harness sandbox — route it outside (excludedCommands / a per-run consented bypass) on the OBSERVED failure, never a preemptive blanket.',

package/tools/recipes.mjs

@@ -171,11 +171,11 @@ const dispatchFor = (recipe, detection) => {
     });
 };
 
-const QUOTA_NOTE = "Prefer the cheapest model that fits the task; don't reach for a top-tier model by reflex.";
+const QUOTA_NOTE = "Each bridge runs the host posture the user set; a weaker model is the user's bridge setting, never a per-call choice.";
 const COUNCIL_QUOTA_NOTE = "Council spends two backends' quota for one decision — reserve it for changes that justify the cost.";
 
 // The quota reminder rides a subscription-BACKEND dispatch only: the executor vehicle spends no
-// bridge quota, and its recipe is a frontier one, so the cheapest-model reminder would contradict it.
+// bridge quota, and its recipe is a frontier one, so a bridge-posture reminder would not apply to it.
 const notesFor = (recipe, dispatch) => {
   const notes = [];
   if (dispatch.some((d) => d.role !== CARRY_ROLE)) notes.push(QUOTA_NOTE);

package/tools/review-state.mjs

@@ -48,7 +48,7 @@
 // (artifact ≠ "code") and continuations (fresh:false — agy --continue/--conversation cannot attest
 // a folded tree; only a fresh grounded re-run mints a gate-satisfying receipt).
 // PROBE receipts never satisfy either (BRIDGE-MODES-CATALOG, D3): a CODEX_PROBE=1 / AGY_PROBE=1
-// review runs with the frontier-model/max-effort guard OFF, so the wrappers stamp `probe:true` and
+// review is the one route to a one-off model or effort, so the wrappers stamp `probe:true` and
 // this checker drops those receipts — PER RECEIPT, so a normal receipt at the same fingerprint still
 // satisfies, and a backend whose ONLY current receipts are probes fails with its own stated reason
 // (never the stale one). Every receipt from a marker-aware wrapper SELF-DECLARES — `probe` is written