@sabaiway/agent-workflow-kit 14.20.0 → 14.22.0

package/tools/bridge-catalog.mjs

@@ -0,0 +1,114 @@
+// bridge-catalog.mjs — reads the models each installed bridge CLI offers, exactly as the bridge
+// wrappers read them before a run (spec bridge-model: Catalog check; spec bridge-settings): codex
+// `codex debug models -c model_provider=openai`, the `visibility: list` slugs each with its efforts;
+// agy `agy models`, the display string after the TAB of each line carrying one. Each read runs on the
+// caller's PATH with every *_API_KEY (and, for codex, OPENAI_BASE_URL) removed, so the list is the
+// subscription catalog the runs use. A read is bounded by the wrapper's own constant, then killed with
+// its whole process group after the wrapper's kill grace. Read-only: it runs no model, writes nothing.
+//
+// Dependency-free, Node >= 22. No side effects on import.
+
+import { spawn } from 'node:child_process';
+import { accessSync, statSync, constants } from 'node:fs';
+import { delimiter, isAbsolute, join } from 'node:path';
+
+// The wrappers' constants: codex-exec.sh CODEX_CATALOG_TIMEOUT_S=15, agy.sh AGY_CATALOG_TIMEOUT=30s,
+// both under `timeout --kill-after=5s`.
+export const CATALOG_BOUNDS_MS = Object.freeze({ 'codex-cli-bridge': 15000, 'antigravity-cli-bridge': 30000 });
+export const CATALOG_KILL_GRACE_MS = 5000;
+
+const CONTROL = /[\u0000-\u001f\u007f]/u;
+const unreadable = (cause) => ({ state: 'unreadable', cause, entries: [] });
+
+export const parseCodexCatalog = (text) => {
+  let doc;
+  try { doc = JSON.parse(text); } catch { return unreadable('its output is not JSON'); }
+  if (doc === null || typeof doc !== 'object' || !Array.isArray(doc.models)) return unreadable('it carries no models[]');
+  const offered = doc.models.filter((m) => m !== null && typeof m === 'object' && m.visibility === 'list');
+  if (offered.some((m) => typeof m.slug !== 'string' || m.slug === '' || CONTROL.test(m.slug))) return unreadable('an offered entry carries no usable slug');
+  if (offered.length === 0) return unreadable('it offers no model');
+  const effortsOf = (m) => (Array.isArray(m.supported_reasoning_levels)
+    && m.supported_reasoning_levels.every((l) => l !== null && typeof l === 'object' && typeof l.effort === 'string' && l.effort !== '' && !CONTROL.test(l.effort))
+    ? m.supported_reasoning_levels.map((l) => l.effort) : null);
+  return { state: 'offered', cause: null, entries: offered.map((m) => ({ model: m.slug, efforts: effortsOf(m) })) };
+};
+
+export const parseAgyCatalog = (text) => {
+  const entries = text.split('\n')
+    .map((line) => line.replace(/\r$/u, ''))
+    .filter((line) => line.includes('\t'))
+    .map((line) => line.slice(line.indexOf('\t') + 1))
+    .filter((model) => model !== '' && !CONTROL.test(model))
+    .map((model) => ({ model }));
+  return entries.length ? { state: 'offered', cause: null, entries } : unreadable('it offers no model');
+};
+
+const CLIS = {
+  'codex-cli-bridge': { cli: 'codex', args: ['debug', 'models', '-c', 'model_provider=openai'], parse: parseCodexCatalog, clears: ['OPENAI_BASE_URL'] },
+  'antigravity-cli-bridge': { cli: 'agy', args: ['models'], parse: parseAgyCatalog, clears: [] },
+};
+
+// The environment a catalog read runs in: the caller's, minus every *_API_KEY and the bridge's own
+// base-URL variable — the variables the wrapper's subscription guard clears before its own read.
+export const catalogEnv = (name, getenv) => Object.fromEntries(Object.entries(getenv)
+  .filter(([key]) => !/_API_KEY$/u.test(key) && !(CLIS[name]?.clears ?? []).includes(key)));
+
+const resolveOnPath = (cli, env) => {
+  for (const dir of String(env.PATH ?? '').split(delimiter)) {
+    if (!dir || !isAbsolute(dir)) continue;
+    const candidate = join(dir, cli);
+    try {
+      if (!statSync(candidate).isFile()) continue;
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch { /* not this directory */ }
+  }
+  return null;
+};
+
+const killGroup = (child, signal) => {
+  try { process.kill(-child.pid, signal); } catch { try { child.kill(signal); } catch { /* already gone */ } }
+};
+
+const readOne = (name, ctx) => new Promise((done) => {
+  const spec = CLIS[name];
+  if (!spec) return done(unreadable(`no catalog reader for ${name}`));
+  const env = catalogEnv(name, ctx.getenv ?? process.env);
+  const bin = resolveOnPath(spec.cli, env);
+  if (bin === null) return done({ state: 'not-installed', cause: `${spec.cli} is not on PATH`, entries: [] });
+  const boundMs = ctx.catalogBoundsMs?.[name] ?? CATALOG_BOUNDS_MS[name];
+  const graceMs = ctx.catalogKillGraceMs ?? CATALOG_KILL_GRACE_MS;
+  const label = `${spec.cli} ${spec.args.slice(0, name === 'codex-cli-bridge' ? 2 : 1).join(' ')}`;
+  const chunks = [];
+  let timedOut = false;
+  let settled = false;
+  let bound;
+  let kill;
+  const finish = (result) => { if (!settled) { settled = true; clearTimeout(bound); clearTimeout(kill); done(result); } };
+  // spawn THROWS for an execve errno it does not emit (ETXTBSY: the binary is being replaced).
+  let child;
+  try {
+    child = spawn(bin, spec.args, { env, stdio: ['ignore', 'pipe', 'ignore'], detached: process.platform !== 'win32' });
+  } catch (err) {
+    return finish(unreadable(`${label} could not start (${err.code ?? err.message})`));
+  }
+  bound = setTimeout(() => {
+    timedOut = true;
+    killGroup(child, 'SIGTERM');
+    kill = setTimeout(() => killGroup(child, 'SIGKILL'), graceMs);
+  }, boundMs);
+  child.stdout?.on('data', (chunk) => chunks.push(chunk));
+  child.on('error', (err) => finish(unreadable(`${label} could not start (${err.code ?? err.message})`)));
+  child.on('close', (code, signal) => {
+    if (timedOut) return finish(unreadable(`it exceeded ${boundMs / 1000}s`));
+    if (code !== 0) return finish(unreadable(`${label} exited ${code ?? signal}`));
+    return finish(spec.parse(Buffer.concat(chunks).toString('utf8')));
+  });
+});
+
+// names: bridge names (the family-members `name`). Resolves to { [name]: { state, cause, entries } },
+// state `offered` | `unreadable` | `not-installed`; the reads run concurrently and never reject.
+export const readCatalogs = async (names, ctx = {}) => {
+  const results = await Promise.all(names.map((name) => readOne(name, ctx)));
+  return Object.fromEntries(names.map((name, i) => [name, results[i]]));
+};

package/tools/bridge-posture.mjs

@@ -12,9 +12,18 @@ const validPosture = (posture) => posture !== null && typeof posture === 'object
   && (!Object.hasOwn(posture, 'tier') || posture.tier === null || (typeof posture.tier === 'string' && posture.tier.length > 0))
   && Object.keys(posture).every((key) => ['model', 'effort', 'tier'].includes(key));
 
+// A posture key the settings file or the environment sets replaces the manifest default and names its
+// source; an explicitly empty AGY_MODEL (value null) renders as no model.
+const overlaid = (slot, fallback, backend, settings) => {
+  const row = (settings?.posture ?? []).find((r) => r.bridge === backend.name && r.source !== 'default'
+    && (r.key.endsWith('_EFFORT') ? 'effort' : 'model') === slot);
+  if (!row) return oneLine(fallback);
+  return `${row.value == null ? 'none' : oneLine(row.value)} (${row.source})`;
+};
+
 const postureString = (posture, backend, settings) => {
-  const parts = [`model=${oneLine(posture.model)}`];
-  if (Object.hasOwn(posture, 'effort')) parts.push(`effort=${oneLine(posture.effort)}`);
+  const parts = [`model=${overlaid('model', posture.model, backend, settings)}`];
+  if (Object.hasOwn(posture, 'effort')) parts.push(`effort=${overlaid('effort', posture.effort, backend, settings)}`);
   if (Object.hasOwn(posture, 'tier')) {
     const knob = (settings?.active ?? []).find((row) => row.key === 'CODEX_SERVICE_TIER' && row.bridge === backend.name);
     parts.push(knob ? `tier=${oneLine(knob.value)} (bridge-settings)` : `tier=${posture.tier ?? 'standard'}`);

package/tools/bridge-settings-read.mjs

@@ -75,6 +75,7 @@ export const allowedLabel = (entry) => {
     case 'integer': return `integer ${entry.min}..${entry.max}`;
     case 'duration': return 'duration (e.g. 5m, 30m, 90s — a unit is required, nonzero)';
     case 'boolean': return '"0" | "1"';
+    case 'posture': return 'a value the installed CLI offers (checked when set)';
     default: return entry.kind;
   }
 };
@@ -172,8 +173,34 @@ const REFUSED = (key, v) => ({ value: null, source: 'default', configuredIn: 'en
 // built-in default (`source: 'default'`) while still being an explicit line the operator wrote — and
 // for a RETIRED knob that is exactly the line the retirement asks them to clear, so it must not
 // vanish from the surfaces (council fold: `AGY_REVIEW_ALLOW_ADDDIR=2` and `=` both disappeared).
+// A posture key (the model and effort, spec bridge-model) follows the wrappers' aw_read_posture, not
+// the applied-settings lane: an env key set at all wins, its empty value meaning the key's default
+// (AGY_MODEL: no model, agy's own settings decide); else a non-empty, control-free file value; else the
+// default. Its sources are the wrappers' banner words: default, setting, environment.
+const EMPTY_ENV_DROPS_MODEL = new Set(['AGY_MODEL']);
+const postureOf = (entry, parsed, getenv) => {
+  const key = entry.key;
+  if (Object.prototype.hasOwnProperty.call(getenv, key)) {
+    const v = getenv[key];
+    if (v === '' && EMPTY_ENV_DROPS_MODEL.has(key)) return { value: null, source: 'environment', configuredIn: 'env', note: `the env ${key}= drops the model — agy's own settings decide` };
+    if (v === '') return { value: entry.default, source: 'environment', configuredIn: 'env', note: `the env ${key}= selects the built-in default` };
+    if (hasControlByte(v)) return { value: null, source: 'environment', configuredIn: 'env', note: `env value "${safeShow(v)}" carries control bytes for ${key} — ${entry.bridge === 'antigravity-cli-bridge'
+      ? 'agy-review refuses the run pre-spend; agy-run has no control-byte screen and refuses it only through its catalog check (it runs it when the catalog is unreadable)'
+      : 'the codex wrappers refuse the run pre-spend'}` };
+    return { value: v, source: 'environment', configuredIn: 'env' };
+  }
+  const fileEntries = parsed.byKey.get(key);
+  if (fileEntries && fileEntries.length) {
+    const v = fileEntries[fileEntries.length - 1].value;
+    if (v !== '' && !hasControlByte(v)) return { value: v, source: 'setting', configuredIn: 'file' };
+    return { value: entry.default, source: 'default', configuredIn: 'file', note: `file value "${safeShow(v)}" is empty or carries a control byte — falls back to the built-in default` };
+  }
+  return { value: entry.default, source: 'default', configuredIn: null };
+};
+
 export const effectiveOf = (entry, parsed, getenv) => {
   const key = entry.key;
+  if (entry.kind === 'posture') return postureOf(entry, parsed, getenv);
   if (Object.prototype.hasOwnProperty.call(getenv, key)) {
     const v = getenv[key];
     // An EXPLICITLY-EMPTY env (`KEY=`) suppresses the FILE override for this run (the wrapper skips a
@@ -222,21 +249,29 @@ export const displayValue = (v) => (v == null ? '(unset — wrapper built-in app
 // ── the fact-only snapshot the read-only status/advisor surfaces consume ────────────────
 
 // Best-effort, never throws: the ACTIVE knobs (a non-default value is in play — source env/file,
-// non-null) plus file presence + any unknown/duplicate keys. Model/effort are structurally excluded
-// from the registry, so `active` can NEVER carry a model claim (the fact-only guarantee). A corrupt
-// bundle or fs error degrades to `{ error }` — the caller renders that localized-on-error, never crashes.
+// non-null), every posture key's effective value and source (`posture`), plus file presence + any
+// unknown/duplicate keys. A posture key's sources are default/setting/environment, so it never enters
+// `active`. A corrupt bundle or fs error degrades to `{ error }` — the caller renders that
+// localized-on-error, never crashes.
+const postureRows = (registry, parsed, getenv) => [...registry.values()]
+  .filter((entry) => entry.kind === 'posture')
+  .map((entry) => {
+    const eff = effectiveOf(entry, parsed, getenv);
+    return { key: entry.key, bridge: entry.bridge, value: eff.value, source: eff.source, retired: entry.retired ?? null };
+  });
+
 export const settingsSnapshot = (ctx = {}) => {
   try {
     const registry = loadRegistry(ctx);
     const path = settingsPath(ctx);
     const fileState = readFileState(path, ctx);
+    const getenv = ctx.getenv ?? process.env;
     // A symlink / non-regular / unreadable file is IGNORED by the wrappers (built-in defaults apply) —
     // surface that honestly instead of silently omitting it (the wrappers warn; the status must too).
     if (fileState.state === 'unusable') {
-      return { path, fileState: 'unusable', active: [], unknown: [], duplicates: [], error: 'the settings file is a symlink / not a regular file — ignored, built-in defaults apply' };
+      return { path, fileState: 'unusable', active: [], posture: postureRows(registry, parseSettings(''), getenv), unknown: [], duplicates: [], error: 'the settings file is a symlink / not a regular file — ignored, built-in defaults apply' };
     }
     const parsed = parseSettings(fileState.text ?? '');
-    const getenv = ctx.getenv ?? process.env;
     const active = [];
     for (const entry of registry.values()) {
       const eff = effectiveOf(entry, parsed, getenv);
@@ -262,6 +297,7 @@ export const settingsSnapshot = (ctx = {}) => {
       path,
       fileState: fileState.state,
       active,
+      posture: postureRows(registry, parsed, getenv),
       unknown: [...parsed.byKey.keys()].filter((k) => !registry.has(k)),
       duplicates: duplicateKeys(parsed),
     };

package/tools/bridge-settings.mjs

@@ -11,29 +11,97 @@
 // out-of-range value, and — loudly, naming the key — a file that already carries DUPLICATE keys (it
 // never emits duplicates and never edits blindly around them). It touches only the KEY= line it owns,
 // preserving every comment/blank/other line verbatim, and creates the dir + file on first apply via
-// the hardened out-of-tree atomic writer (symlink/parent/TOCTOU-safe). Model/effort are NOT in the
-// allowlist — the wrappers' quality-first guard is untouched (D4). CODEX_SERVICE_TIER carries the
+// the hardened out-of-tree atomic writer (symlink/parent/TOCTOU-safe). The model keys (kind `posture`,
+// spec bridge-settings) are settable: the read-out shows each bridge's host posture and the models its
+// installed CLI offers, and a set naming a model key is judged against that bridge's catalog before
+// any write. It runs only the catalog commands, never a model. CODEX_SERVICE_TIER carries the
 // credit-rate caveat wherever it renders (from the manifest `effect`).
 //
 // Output is ENGLISH/structured (repo-artifact Hard Constraint); the agent localizes when narrating.
-// Exit codes: 0 success (reader, preview, or apply); 2 usage (bad args / unknown key / invalid value);
-// 1 precondition STOP (duplicate-carrying / symlinked / unreadable file, a write STOP) or a corrupt
-// bundle (cannot determine the allowlist). main(argv, ctx) → { code, stdout, stderr }; getenv / home /
-// bundleRoot / fs are injectable for host-independent tests.
+// Exit codes: 0 success (reader, preview, or apply); 2 usage (bad args / unknown key / invalid value /
+// a model or effort the catalog does not offer); 1 precondition STOP (duplicate-carrying / symlinked /
+// unreadable file, a write STOP) or a corrupt bundle (cannot determine the allowlist).
+// main(argv, ctx) → Promise of { code, stdout, stderr }; getenv / home / bundleRoot / fs and the
+// catalog bounds are injectable for host-independent tests.
 //
 // Dependency-free, Node >= 22. No side effects on import (the isDirectRun idiom).
 
 import { isDirectRun } from './direct-run.mjs';
 import { settingValueValid } from './manifest/validate.mjs';
 import { writeHostConfigFileAtomic } from './atomic-write.mjs';
+import { readCatalogs } from './bridge-catalog.mjs';
 import {
   SETTINGS_SUBDIR, SETTINGS_FILENAME, fail, loadRegistry, allowedLabel, settingsDir, settingsPath,
   joinLines, readFileState, parseSettings, duplicateKeys, effectiveOf, displayValue,
 } from './bridge-settings-read.mjs';
 
+// ── host posture (the model keys) ──────────────────────────────────────────────────────
+
+const slotOf = (key) => (key.endsWith('_EFFORT') ? 'effort' : 'model');
+const postureBridges = (registry) => [...new Set([...registry.values()].filter((e) => e.kind === 'posture').map((e) => e.bridge))];
+
+// One bridge's posture as { model: {key, value, source, note}, effort?: … } under the given env.
+const postureOfBridge = (registry, parsed, getenv, bridge) => Object.fromEntries([...registry.values()]
+  .filter((e) => e.kind === 'posture' && e.bridge === bridge)
+  .map((e) => {
+    const eff = effectiveOf(e, parsed, getenv);
+    return [slotOf(e.key), { key: e.key, value: eff.value, source: eff.source, note: eff.note ?? null, retired: e.retired ?? null }];
+  }));
+
+const showModel = (v) => (v == null ? '(none)' : v);
+const offeredLabel = (catalog) => catalog.entries
+  .map((e) => (e.efforts === undefined ? e.model : `${e.model} (${e.efforts === null ? 'efforts unknown' : e.efforts.join(', ')})`))
+  .join(', ');
+const catalogWarning = (bridge, catalog) => (catalog.state === 'not-installed'
+  ? `⚠ ${bridge}: not installed (${catalog.cause}) — no offered list`
+  : `⚠ ${bridge}: the model catalog is unreadable (${catalog.cause}) — the offered list is unknown`);
+
+const renderPosture = (registry, parsed, getenv, catalogs) => {
+  const lines = ['', '  host posture (the model each bridge runs; the offered models are read from the installed CLI, none is run):'];
+  for (const bridge of postureBridges(registry)) {
+    const p = postureOfBridge(registry, parsed, getenv, bridge);
+    const effort = p.effort ? ` · effort ${showModel(p.effort.value)} [${p.effort.source}]` : '';
+    const notes = [p.model.note, p.effort?.note].filter(Boolean).map((n) => `  — ${n}`).join('');
+    lines.push(`    ${bridge}: model ${showModel(p.model.value)} [${p.model.source}]${effort}${notes}`);
+    const catalog = catalogs[bridge];
+    lines.push(catalog.state === 'offered' ? `      offered: ${offeredLabel(catalog)}` : `      ${catalogWarning(bridge, catalog)}`);
+  }
+  return lines;
+};
+
+const postureJson = (registry, parsed, getenv, catalogs) => postureBridges(registry).map((bridge) => ({
+  bridge, ...postureOfBridge(registry, parsed, getenv, bridge), catalog: catalogs[bridge],
+}));
+
+// The set judgment: the posture the file would give after the ops (the environment ignored), judged
+// against each touched bridge's catalog. Refuses (exit 2) only a model the catalog does not offer or a
+// codex effort that model does not offer; an unreadable catalog yields an "unchecked" statement.
+const judgePosture = async (ops, registry, newLines, ctx) => {
+  const bridges = [...new Set(ops.map((op) => registry.get(op.key)).filter((e) => e.kind === 'posture').map((e) => e.bridge))];
+  if (!bridges.length) return [];
+  const after = parseSettings(joinLines(newLines));
+  const catalogs = await readCatalogs(bridges, ctx);
+  const unchecked = [];
+  for (const bridge of bridges) {
+    const { model, effort } = postureOfBridge(registry, after, {}, bridge);
+    const catalog = catalogs[bridge];
+    if (catalog.state !== 'offered') {
+      unchecked.push(`${bridge}: the value was not checked — ${catalog.state === 'not-installed' ? 'not installed' : 'the model catalog is unreadable'} (${catalog.cause}); the wrapper checks it at run time`);
+      continue;
+    }
+    const entry = catalog.entries.find((e) => e.model === model.value);
+    if (!entry) throw fail(2, `${model.key}=${model.value} is not a model the installed ${bridge} catalog offers — refusing before any write. Offered: ${catalog.entries.map((e) => e.model).join(', ')}`);
+    if (effort && entry.efforts === null) unchecked.push(`${bridge}: the effort was not checked — the catalog entry for ${model.value} lists no efforts; the wrapper checks it at run time`);
+    else if (effort && !entry.efforts.includes(effort.value)) {
+      throw fail(2, `${effort.key}=${effort.value} is not an effort the installed ${bridge} catalog offers for ${model.value} — refusing before any write. Offered: ${entry.efforts.join(', ')}`);
+    }
+  }
+  return unchecked;
+};
+
 // ── reader render ──────────────────────────────────────────────────────────────────
 
-const renderReader = (registry, parsed, fileState, ctx, path) => {
+const renderReader = (registry, parsed, fileState, ctx, path, catalogs) => {
   const getenv = ctx.getenv ?? process.env;
   const lines = [`bridge settings — ${path}`];
   if (fileState.state === 'absent') lines.push('  (no settings file yet — every knob is at its built-in default)');
@@ -43,10 +111,12 @@ const renderReader = (registry, parsed, fileState, ctx, path) => {
     const eff = effectiveOf(entry, parsed, getenv);
     const note = eff.note ? `  — ${eff.note}` : '';
     const retired = entry.retired ? '  ⚠ RETIRED' : '';
-    lines.push(`    ${entry.key} = ${displayValue(eff.value)}  [${eff.source}]${retired}${note}`);
+    const shown = entry.kind === 'posture' ? showModel(eff.value) : displayValue(eff.value);
+    lines.push(`    ${entry.key} = ${shown}  [${eff.source}]${retired}${note}`);
     lines.push(`        ${entry.bridge} · ${allowedLabel(entry)} · ${entry.effect}`);
     if (entry.retired) lines.push(`        RETIRED — ${entry.retired}`);
   }
+  lines.push(...renderPosture(registry, parsed, getenv, catalogs));
   const dups = duplicateKeys(parsed);
   const unknown = [...parsed.byKey.keys()].filter((k) => !registry.has(k));
   if (dups.length) lines.push('', `  ⚠ duplicate keys in the file (last wins at read time; the writer refuses to edit until you fix these): ${dups.join(', ')}`);
@@ -56,7 +126,7 @@ const renderReader = (registry, parsed, fileState, ctx, path) => {
   return lines.join('\n');
 };
 
-const buildReaderJson = (registry, parsed, fileState, ctx, path) => {
+const buildReaderJson = (registry, parsed, fileState, ctx, path, catalogs) => {
   const getenv = ctx.getenv ?? process.env;
   return {
     path,
@@ -65,6 +135,7 @@ const buildReaderJson = (registry, parsed, fileState, ctx, path) => {
       const eff = effectiveOf(entry, parsed, getenv);
       return { key: entry.key, bridge: entry.bridge, kind: entry.kind, effective: eff.value, source: eff.source, note: eff.note ?? null, default: entry.default, retired: entry.retired ?? null };
     }),
+    bridges: postureJson(registry, parsed, getenv, catalogs),
     duplicateKeys: duplicateKeys(parsed),
     unknownKeys: [...parsed.byKey.keys()].filter((k) => !registry.has(k)),
     malformedLines: parsed.malformed.map((m) => m.index + 1),
@@ -182,12 +253,22 @@ const changeLine = (c) => {
   return `  ${c.key}: ${b} → ${a}`;
 };
 
-const renderWriter = ({ changes, wrote, path, willWrite, envShadows, caveats }) => {
+// A model key's env value off the host posture is a one-off the wrappers refuse (spec bridge-model),
+// so its shadow line says that instead of "it wins".
+const SHADOW_EFFECT = {
+  'codex-cli-bridge': 'an environment value off the host posture is a one-off, which codex-exec and codex-review refuse unless CODEX_PROBE=1; unset it.',
+  'antigravity-cli-bridge': 'an environment value off the host posture (an empty one included) is a one-off, which agy-review refuses unless AGY_PROBE=1 (agy-run, the probe role, runs it); unset it.',
+};
+const shadowLine = (entry) => `  ⚠ ${entry.key} is currently set in the environment — ${entry.kind === 'posture'
+  ? SHADOW_EFFECT[entry.bridge] : 'the env value overrides the file for this session (unset it, or it wins until you do).'}`;
+
+const renderWriter = ({ registry, changes, wrote, path, willWrite, envShadows, caveats, unchecked }) => {
   const lines = [];
   lines.push(wrote ? `wrote ${path}` : 'bridge-settings — preview (nothing written; re-run with --apply to write)');
   for (const c of changes) lines.push(changeLine(c));
   for (const cav of caveats) lines.push(`      ↳ ${cav}`);
-  for (const key of envShadows) lines.push(`  ⚠ ${key} is currently set in the environment — the env value overrides the file for this session (unset it, or it wins until you do).`);
+  for (const u of unchecked) lines.push(`  ⚠ ${u}`);
+  for (const key of envShadows) lines.push(shadowLine(registry.get(key)));
   if (!wrote && willWrite) lines.push('', `re-run with --apply to write ${path}.`);
   if (!wrote && !willWrite) lines.push('  no change — the file already reads this way.');
   return lines.join('\n');
@@ -200,7 +281,9 @@ const HELP = `bridge-settings — read / write the host-level bridge settings fi
   ${'${XDG_CONFIG_HOME:-~/.config}'}/${SETTINGS_SUBDIR}/${SETTINGS_FILENAME}   (KEY=VALUE lines; parsed, never sourced)
 
 Usage:
-  node bridge-settings.mjs                          show every knob's effective value + source
+  node bridge-settings.mjs                          show every knob's effective value + source, each
+                                                    bridge's model (codex: and effort) and the models
+                                                    its installed CLI offers
   node bridge-settings.mjs --set KEY=VALUE          preview a change (writes nothing)
   node bridge-settings.mjs --set KEY=VALUE --apply  write the change (atomic; creates the file on first use)
   node bridge-settings.mjs --unset KEY [--apply]    return a knob to its built-in default
@@ -209,14 +292,17 @@ Usage:
                                                     keys (preserved verbatim), never writes
 
 Precedence at run time: explicit env (even empty: KEY= disables) > this file > the wrapper's built-in
-default. Allowed keys + value rules come from the bundled bridge manifests; model/effort are NOT
-settable here (the wrappers' quality guard is untouched). This host file survives every kit upgrade —
+default. Allowed keys + value rules come from the bundled bridge manifests. CODEX_MODEL, CODEX_EFFORT
+and AGY_MODEL set each bridge's host posture; a set of one is checked against that bridge's installed
+CLI catalog before anything is written (an unreadable catalog leaves it unchecked, and says so). The
+command runs only the catalog commands, never a model. This host file survives every kit upgrade —
 a kit refresh never writes or clobbers it.
 
-Exit codes: 0 success (read / preview / write); 2 usage (bad args, unknown key, invalid value);
-            1 precondition STOP (duplicate-carrying / symlinked / unreadable file, or a corrupt bundle).`;
+Exit codes: 0 success (read / preview / write); 2 usage (bad args, unknown key, invalid value, a model
+            or effort the catalog does not offer); 1 precondition STOP (duplicate-carrying / symlinked /
+            unreadable file, or a corrupt bundle).`;
 
-export const main = (argv = [], ctx = {}) => {
+export const main = async (argv = [], ctx = {}) => {
   const getenv = ctx.getenv ?? process.env;
   try {
     if (argv.includes('--help') || argv.includes('-h')) return { code: 0, stdout: HELP, stderr: '' };
@@ -236,9 +322,10 @@ export const main = (argv = [], ctx = {}) => {
     if (ops.length === 0) {
       const fileState = readFileState(path, ctx);
       const parsed = parseSettings(fileState.text ?? '');
+      const catalogs = await readCatalogs(postureBridges(registry), ctx);
       const stdout = json
-        ? JSON.stringify(buildReaderJson(registry, parsed, fileState, ctx, path), null, 2)
-        : renderReader(registry, parsed, fileState, ctx, path);
+        ? JSON.stringify(buildReaderJson(registry, parsed, fileState, ctx, path, catalogs), null, 2)
+        : renderReader(registry, parsed, fileState, ctx, path, catalogs);
       return { code: 0, stdout, stderr: '' };
     }
 
@@ -271,15 +358,16 @@ export const main = (argv = [], ctx = {}) => {
 
     const newLines = ops.reduce(applyOp, parsed.lines);
     const body = joinLines(newLines);
+    const unchecked = await judgePosture(ops, registry, newLines, ctx);
 
     // The machine surface carries the SAME spend/credit-rate caveats the human preview prints (D4) — a
     // --json consumer must not miss the spend consent warning the human render shows.
-    const jsonBody = (wrote) => ({ path, wrote, noop, changes: changes.map((c) => ({ key: c.key, kind: c.kind, before: c.before, after: c.after })), envShadows, caveats });
+    const jsonBody = (wrote) => ({ path, wrote, noop, changes: changes.map((c) => ({ key: c.key, kind: c.kind, before: c.before, after: c.after })), envShadows, caveats, unchecked });
 
     if (!apply || noop) {
       const stdout = json
         ? JSON.stringify(jsonBody(false), null, 2)
-        : renderWriter({ changes, wrote: false, path, willWrite: !noop, envShadows, caveats });
+        : renderWriter({ registry, changes, wrote: false, path, willWrite: !noop, envShadows, caveats, unchecked });
       return { code: 0, stdout, stderr: '' };
     }
 
@@ -287,7 +375,7 @@ export const main = (argv = [], ctx = {}) => {
     writeHostConfigFileAtomic(settingsDir(ctx), SETTINGS_FILENAME, body, ctx, { noun: 'the bridge settings file' });
     const stdout = json
       ? JSON.stringify(jsonBody(true), null, 2)
-      : renderWriter({ changes, wrote: true, path, willWrite: false, envShadows, caveats });
+      : renderWriter({ registry, changes, wrote: true, path, willWrite: false, envShadows, caveats, unchecked });
     return { code: 0, stdout, stderr: '' };
   } catch (err) {
     return { code: err.exitCode ?? 1, stdout: '', stderr: `bridge-settings: ${err.message}` };
@@ -295,7 +383,7 @@ export const main = (argv = [], ctx = {}) => {
 };
 
 if (isDirectRun(import.meta.url)) {
-  const r = main(process.argv.slice(2));
+  const r = await main(process.argv.slice(2));
   if (r.stdout) console.log(r.stdout);
   if (r.stderr) console.error(r.stderr);
   process.exit(r.code);

package/tools/carriers.mjs

@@ -112,8 +112,8 @@ export const SLICE_BY_SLOT = {
   'plan-execution.execute': 'a slice is a set of file-disjoint ledger rows; wording is copied verbatim where wording is a red line',
   'routine.carrier': "a slice is a bounded mechanical task; a read-only one (a sweep, gate triage) rides its placed read-only vehicle, or is carried solo with a stated reason when that vehicle is absent; a write-capable one (a regeneration, a fixture build) rides the executor; the changelog stays the orchestrator's",
   'epic.author': 'a slice is a brief naming the intent, the value, the non-goals and the stories in order; the subagent drafts the epic file from it, and the orchestrator runs the shape check on the draft as its own',
-  'task.author': 'a slice is one ledger row of the plan with the contracts it reads; the subagent writes the task brief from it, and the orchestrator stamps and checks the brief itself',
-  'task.execute': 'a slice is one stamped brief; the subagent runs it inside the Files the brief names and reports the paths it changed, and the orchestrator runs the Acceptance commands itself',
+  'task.author': "no slice the flow dispatches: the orchestrator writes each row's prompt itself, whatever this slot resolves to",
+  'task.execute': "a slice is one prompt the orchestrator wrote from one ledger row; the subagent runs it inside the Files the prompt names and reports the paths it changed, and the orchestrator runs the row's tests itself",
 };
 
 export const VEHICLE_STATE_TOKEN = '<state>';
@@ -139,12 +139,14 @@ export const SUBAGENT_SLOT_TYPES = Object.entries(SLOT_RECIPES)
 
 // dispatchForm({ activity, slot, state }) → the lines a `subagent`-resolved slot renders: the
 // slot's slice sentence, then the four shared lines with the surveyed vehicle state filled in.
-// A slot whose type cannot hold `subagent` (a review slot) and an unknown activity render nothing.
+// A slot type that cannot hold `subagent` (review) and an unknown activity render nothing; a slot
+// whose slice the flow never dispatches renders its sentence alone.
+const UNDISPATCHED_SLOTS = new Set(['task.author']);
 export const dispatchForm = ({ activity, slot, state } = {}) => {
   const slice = SLICE_BY_SLOT[`${activity}.${slot}`];
   const slotType = ACTIVITIES[activity]?.slots?.[slot];
   if (!slice || !SUBAGENT_SLOT_TYPES.includes(slotType)) return [];
-  return [slice, ...DISPATCH_LINES.map((line) => line.replace(VEHICLE_STATE_TOKEN, state ?? MISSING))];
+  return UNDISPATCHED_SLOTS.has(`${activity}.${slot}`) ? [slice] : [slice, ...DISPATCH_LINES.map((line) => line.replace(VEHICLE_STATE_TOKEN, state ?? MISSING))];
 };
 
 // parallelLine({ value, carrier }) → the `routine` switch line. The concurrency claim is TRUE only

package/tools/cheap-agents.mjs

@@ -94,7 +94,7 @@ const EXIT_USAGE = 2;
 // the internal-attestation evaluation consumes this sentence — a lens set claiming a configured
 // backend's slot without a then-active down-mark REFUSES, quoting it (substitution is recorded,
 // never silent).
-export const FALLBACK_LENS_ADDITIONAL_ONLY = 'review-lens is an ADDITIONAL read-only review opinion, not a replacement for your configured review recipe.';
+export const FALLBACK_LENS_ADDITIONAL_ONLY = 'review-lens is an ADDITIONAL read-only review opinion, not a replacement for your plan or diff review recipe.';
 
 const USAGE = `usage: cheap-agents [--dry-run | --apply] [--cwd <dir>] [--help]
 

package/tools/detect-backends.mjs

@@ -75,7 +75,7 @@ const RAW_BACKENDS = [
           'codex-exec --resume-last [--nonce <n>] <plan-file|->',
           'codex-exec --resume <session-id> [--nonce <n>] <plan-file|->',
         ],
-        receipt: "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, no node.",
+        receipt: "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, and it needs no node.",
         passthrough: {
           policy: 'guarded',
           blocked: ['-c*', '--config*', '-s*', '--sandbox*', '--dangerously-bypass-approvals-and-sandbox', '--dangerously-bypass-hook-trust', '--full-auto', '--oss', '--local-provider*', '-p*', '--profile*', '-m*', '--model*', '-o*', '--output-last-message*', '--json*', '--color*', '--output-schema*', '--ephemeral*'],
@@ -83,9 +83,9 @@ const RAW_BACKENDS = [
         },
         notes: [
           'nested-sandbox limit: codex-exec ships its OWN OS sandbox (bwrap workspace-write) and cannot run nested inside a harness sandbox (the FS turns read-only) — route it OUTSIDE the harness sandbox (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a preemptive blanket',
-          'exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend',
+          'exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend',
           'threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent environment. A hostile parent environment — including exported shell functions or PATH substitution of core/backend commands — is outside the threat model and can substitute the backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental shadowing; it is not an environment security boundary',
-          'the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it is never persisted in a receipt or session sidecar',
+          'the exec posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: neither is persisted in a receipt or session sidecar',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
           'every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN (a nonzero exit_code, or the serialized status "failed"); a null exit_code is never failure by itself, tokens split across two items never fire, and a successful command\'s output never fires. The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit status alone can still bank an ungrounded answer — the stderr warning is the signal',
         ],
@@ -99,7 +99,7 @@ const RAW_BACKENDS = [
         continue: [],
         receipt: 'side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of [blocker] and [major] lines (schema mode: findings with either severity; a payload whose findings cannot be counted fails the run, no receipt); artifactPath = the normalized realpath on plan receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit\'s review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized \'Verdict: <ship|revise|rethink>\' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review',
         notes: [
-          'the review posture banner appends a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity',
+          'the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
         ],
       },
@@ -139,11 +139,11 @@ const RAW_BACKENDS = [
           'agy-review --continue [--decided @f] [--focus "…"] [--nonce <n>]',
           'agy-review --conversation <id> [--decided @f] [--focus "…"] [--nonce <n>]',
         ],
-        receipt: "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
+        receipt: "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of numbered items in the first ### Blocking section; artifactPath = the normalized realpath on plan/diff receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, a one-off model (an explicitly empty AGY_MODEL included) refuses pre-spend unless AGY_PROBE=1, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         notes: [
           'transport: every review dispatch drives the CLI in --output-format json (plus --disable-slash-commands) and the returned envelope is parsed in node (bin/agy-envelope.mjs) — the operator-facing invocations and flags above do NOT change, and on a ZERO exit the wrapper still PRINTS the review text, never JSON. A missing or unreadable envelope on a zero exit is a loud failure with NO receipt, never a downgraded verdict and never a fallback to raw-stdout parsing; a non-zero CLI exit keeps its own code and message, and publishes the captured stdout unchanged from the SINGLE dispatch or the FINAL fed turn (which may therefore be a JSON or partial payload — the envelope is parsed only on a zero exit); an INTERMEDIATE feed turn is the exception, its output stays private (Invariant E) and its failure prints only a named error. Enforced by a PRE-SPEND capability probe, not a version floor: agy --help must advertise --output-format and --disable-slash-commands, node must be >= 22, and bin/agy-envelope.mjs must be present — otherwise the review refuses before any run is spent and names the missing capability',
           'pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt',
-          'the review posture banner appends a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity',
+          'the review posture banner appends a banner-only source=model:<s> field — where the model came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity',
           'quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts',
         ],
       },

package/tools/family-registry.mjs

@@ -672,9 +672,9 @@ export const surveyBridges = (deps = {}) => {
     // Preserve findOnPath's THREE-state result (present | missing | unknown): an `unknown` (EACCES,
     // "cannot confirm") must stay distinct from a real `missing` — never flattened to a false boolean.
     const wrappers = m.wrapperCmds.map((cmd) => ({ cmd, state: probe(cmd, deps).state }));
-    // Fact-only: the settings knobs ACTIVE (env/file, non-default) for THIS bridge. Model/effort are
-    // structurally absent from the registry, so this can NEVER carry a model claim (the survey's
-    // no-default-model-claim invariant). Localized-on-error like every other survey.
+    // Fact-only: the settings knobs ACTIVE (env/file, non-default) for THIS bridge. The model keys are
+    // knobs too, but their rows live in the snapshot's `posture`, never `active`, so the survey still
+    // emits no model field (its no-default-model-claim invariant). Localized-on-error like every survey.
     const settings = snapshot.error
       ? { error: snapshot.error }
       : { active: snapshot.active.filter((a) => a.bridge === m.name) };