@sabaiway/agent-workflow-kit 14.26.0 → 14.28.0

package/tools/manifest/validate.mjs

@@ -638,10 +638,10 @@ export const validateManifest = (skillDir) => {
   }
 
   // `networkHosts` (AD-044 Plan 4, consult-locked): the backend CLI's OBSERVED egress host
-  // families. `velocity-profile --bridge-tier` seeds them into sandbox.network.allowedDomains for
-  // placed bridges (AD-172; the pre-allow widens egress for EVERY sandboxed command, stated at that
-  // consent), and a malformed list FAILS --strict like `settings`: the tier writes it and the
-  // Recommendations advisor renders it verbatim, so a bad entry would corrupt a seeded line.
+  // families. `velocity-profile --bridge-tier` seeds them into sandbox.network.allowedDomains
+  // for USED bridges (a recipe slot uses them, revision 4; AD-172); the pre-allow widens egress for EVERY
+  // sandboxed command, stated at that consent. A malformed list FAILS --strict like `settings`:
+  // the tier writes it and the Recommendations advisor renders it verbatim, so a bad entry would corrupt a seeded line.
   const networkHosts = manifest.networkHosts;
   if (networkHosts != null) {
     if (!Array.isArray(networkHosts) || networkHosts.length === 0) {
@@ -659,11 +659,11 @@ export const validateManifest = (skillDir) => {
     }
   }
 
-  // `writableDirs` (REC-UX-REWORK, D6): the backend CLI's writable state-dir declarations —
-  // {env, default} entries the Recommendations advisor RESOLVES at run time (a NON-EMPTY env
-  // value wins, else the default) and renders into the sandbox-lane recipe. Unlike `networkHosts`
-  // this is a DOCUMENTATION source (the kit never seeds filesystem allowances), and a malformed
-  // list FAILS --strict for the same reason: the resolved dir is rendered into a hand-applied line.
+  // `writableDirs` (REC-UX-REWORK, D6): {env, default} entries the tier RESOLVES (a NON-EMPTY
+  // env value wins, else the default) and seeds home-relative into sandbox.filesystem.allowWrite
+  // for USED bridges via `bridge-state-dirs.mjs`; the advisor's `bridge-tier` item counts and names them.
+  // A malformed list FAILS --strict: the resolved dir is written into the settings and rendered
+  // on the Recommendations advisor's ONE-LINE `recipe:` line.
   const writableDirs = manifest.writableDirs;
   if (writableDirs != null) {
     if (!Array.isArray(writableDirs) || writableDirs.length === 0) {
@@ -685,8 +685,8 @@ export const validateManifest = (skillDir) => {
           return;
         }
         if (/[*?[\]]/.test(dir)) errors.push(`${at}.default must not carry glob characters ("${dir}")`);
-        // The resolved dir is rendered into a ONE-LINE hand-applied recipe — a control character
-        // (newline, CR, NUL, …) would break the line or the shell paste.
+        // The resolved dir is written into `allowWrite` and rendered on a ONE-LINE advisor line —
+        // a control character (newline, CR, NUL, …) would break that line or the settings entry.
         // eslint-disable-next-line no-control-regex
         if (/[\x00-\x1f\x7f]/.test(dir)) errors.push(`${at}.default must not carry control characters (${JSON.stringify(dir)})`);
         if (dir.endsWith('/')) errors.push(`${at}.default must not end with a trailing slash ("${dir}")`);

package/tools/recipes.mjs

@@ -40,6 +40,12 @@ export { ACTIVITIES, POLICY_ACTIVITIES, SLOT_RECIPES, isSwitchSlot, EXECUTOR_APP
 
 const [CODEX, AGY] = BACKEND_PRIORITY;
 
+// Mirror bridge-wiring.mjs states: a static import would cycle through bridge-sandbox-recipe.mjs.
+const WIRED = 'wired';
+const UNWIRED = 'not wired';
+const UNCHECKED = 'unchecked';
+const NOT_COVERED = 'not covered';
+
 // Keyed by readiness-array provider name; executor is the only `carry` provider.
 export const BACKEND_ROLES = {
   [CODEX]: ['execute', 'review'],
@@ -237,6 +243,20 @@ export const recommendRecipe = (detection) => {
   return { recipe: 'solo', clause: `Solo — ${DISPLAY_ALIASES[best.name] ?? best.name}: ${remedy} to unlock Reviewed` };
 };
 
+const orderedWiringEntries = (wiring) => [...(wiring?.bridges ?? [])]
+  .sort((a, b) => priorityIndex(a.bridge) - priorityIndex(b.bridge));
+
+export const recommendWiredRecipe = (detection, wiring) => {
+  const base = recommendRecipe(detection);
+  const entries = orderedWiringEntries(wiring);
+  const uncovered = entries.filter((entry) => entry.review === NOT_COVERED)
+    .map((entry) => `${DISPLAY_ALIASES[entry.bridge] ?? entry.bridge} (review) — ${entry.reviewRoute}`).join('; ');
+  const unchecked = entries.filter((entry) => entry.review === UNCHECKED)
+    .map((entry) => DISPLAY_ALIASES[entry.bridge] ?? entry.bridge).join(', ');
+  const tail = (uncovered ? ` · ${UNWIRED}: ${uncovered}` : '') + (unchecked ? ` · ${UNCHECKED}: ${unchecked}` : '');
+  return tail ? { recipe: base.recipe, clause: base.clause + tail } : base;
+};
+
 // ── activity procedures: per-slot recipe resolution ────────────────────────────────
 // The computed default for a silent slot. NEVER Council (opt-in: it spends two backends' quota) and
 // deliberately not recommendRecipe, which drives the status line rather than a per-slot default.
@@ -317,14 +337,26 @@ export const composeConfiguredPosture = (ctx = {}) => {
 // mode, and only the recipe lattice sees it.
 export const bridgeEntries = (readiness) => readiness.filter((b) => b.name !== EXECUTOR_PROVIDER);
 
-export const composeStatusLine = (detection, recommendation, settings = null, autonomy = null, posture = null) => {
+export const composeStatusLine = (detection, recommendation, settings = null, autonomy = null, posture = null, wiring = null) => {
+  // A raw env value may carry newlines/control chars — collapse them so the one-line contract holds.
+  const oneLine = (s) => String(s).replace(/[\s]+/g, ' ').trim();
   const backends = bridgeEntries(detection)
     .sort((a, b) => priorityIndex(a.name) - priorityIndex(b.name))
-    .map((b) => `${DISPLAY_ALIASES[b.name] ?? b.name} ${b.readiness === READY ? '✓' : '✗'} ${b.readiness}`)
+    .map((b) => {
+      const alias = DISPLAY_ALIASES[b.name] ?? b.name;
+      const entry = b.readiness === READY ? wiring?.bridges.find((row) => row.bridge === b.name) : null;
+      if (entry && entry.state !== WIRED) {
+        if (entry.state === UNWIRED) {
+          return `${alias} ✗ ${UNWIRED}${entry.used ? '' : ' (unused)'} — ${entry.count} sandbox entr(ies) missing`;
+        }
+        if (entry.state === UNCHECKED) return `${alias} ✗ ${UNCHECKED} — ${oneLine(entry.reason)}`;
+      }
+      return `${alias} ${b.readiness === READY ? '✓' : '✗'} ${b.readiness}`;
+    })
     .join(' · ');
-  const base = `backends: ${backends} — run /agent-workflow-kit backends · recipes: ${recommendation.clause} — see /agent-workflow-kit recipes`;
-  // A raw env value may carry newlines/control chars — collapse them so the one-line contract holds.
-  const oneLine = (s) => String(s).replace(/[\s]+/g, ' ').trim();
+  const clause = wiring == null ? recommendation.clause : recommendWiredRecipe(detection, wiring).clause;
+  const base = `backends: ${backends} — run /agent-workflow-kit backends · recipes: ${clause} — see /agent-workflow-kit recipes`;
+  const sandboxSegment = wiring == null ? '' : ` · sandbox: ${oneLine(wiring.condition)}`;
   const active = settings?.active ?? [];
   // A RETIRED knob renders as retired: hiding the user's line would be a silent deletion, reading it
   // as active would claim a capability the wrapper no longer has.
@@ -332,7 +364,7 @@ export const composeStatusLine = (detection, recommendation, settings = null, au
   // Each optional segment renders ONLY when its facts are supplied; an omitted param changes nothing.
   const autonomySegment = autonomy == null ? '' : ` · autonomy: ${oneLine(formatAutonomySegment(autonomy))}`;
   const postureSegment = posture == null ? '' : ` · posture: ${oneLine(posture)}`;
-  return base + suffix + autonomySegment + postureSegment;
+  return base + sandboxSegment + suffix + autonomySegment + postureSegment;
 };
 
 const formatAutonomySegment = (a) => {
@@ -432,7 +464,7 @@ export const composeActiveRecipeLine = ({ config, source } = {}, detection, auto
 // ── report + CLI ─────────────────────────────────────────────────────────────────
 
 // The structured report behind `--json`, incl. the same one-line status the --status-line mode emits.
-export const buildReport = (detection, settings = null, autonomy = null, posture = null) => {
+export const buildReport = (detection, settings = null, autonomy = null, posture = null, wiring = null) => {
   const recommendation = recommendRecipe(detection);
   return {
     recipes: RECIPES.map(({ id, title, role, minBackends, degradesTo, summary }) => ({
@@ -446,19 +478,31 @@ export const buildReport = (detection, settings = null, autonomy = null, posture
     recommendation,
     plans: RECIPES.map((r) => planRecipe(r.id, detection)),
     // The --json envelope must never expose a status line staler than the --status-line surface.
-    statusLine: composeStatusLine(detection, recommendation, settings, autonomy, posture),
+    statusLine: composeStatusLine(detection, recommendation, settings, autonomy, posture, wiring),
+    ...(wiring == null ? {} : { wiring }),
   };
 };
 
 // Deterministic human advisor text: the recipes, the recommendation, and the per-recipe plan here.
-export const formatRecipes = (detection) => {
+export const formatRecipes = (detection, wiring = null) => {
   const lines = [
     'agent-workflow orchestration recipes (read-only — the orchestrator executes via the bridge skills or the executor vehicle and always commits)',
     '',
   ];
   for (const r of RECIPES) lines.push(`  ${r.title} (${r.id}) — ${r.summary}`);
-  const rec = recommendRecipe(detection);
-  lines.push('', `recommended here: ${rec.recipe} — ${rec.clause}`, '', 'plan for the current environment:');
+  const rec = wiring == null ? recommendRecipe(detection) : recommendWiredRecipe(detection, wiring);
+  lines.push('', `recommended here: ${rec.recipe} — ${rec.clause}`);
+  for (const entry of orderedWiringEntries(wiring)) {
+    const alias = DISPLAY_ALIASES[entry.bridge] ?? entry.bridge;
+    if (entry.state === UNWIRED) {
+      const missing = [['excludedCommands', entry.missing.excludedCommands], ['allowedDomains', entry.missing.hosts], ['allowWrite', entry.missing.dirs]]
+        .filter(([, entries]) => entries.length)
+        .map(([key, entries]) => `${key} [${entries.join(', ')}]`).join('; ');
+      lines.push(`  ${UNWIRED}: ${alias} — missing ${missing}; ${wiring.condition}; ${entry.route}`);
+    }
+    if (entry.state === UNCHECKED) lines.push(`  ${UNCHECKED}: ${alias} — ${entry.reason}`);
+  }
+  lines.push('', 'plan for the current environment:');
   for (const r of RECIPES) {
     const p = planRecipe(r.id, detection);
     const arrow = p.degraded ? ` → ${p.effective}` : '';
@@ -493,6 +537,15 @@ export const composeReadiness = (cwd, deps = {}) => {
   return withVehicle(detection, survey);
 };
 
+// The wiring the status line, --json and the default output render. Lazy imports: the leaf reaches
+// this module through bridge-sandbox-recipe.mjs. A failed import fails the run loudly.
+const composeWiring = async (cwd, readiness) => {
+  const { composeBridgeWiring } = await import('./bridge-wiring.mjs');
+  const { preflightVelocityProfile } = await import('./velocity-profile.mjs');
+  const root = projectTopOf(cwd);
+  return composeBridgeWiring({ root, readiness }, { preflight: () => preflightVelocityProfile({ cwd: root }) });
+};
+
 const main = async (argv, deps = {}) => {
   if (argv.includes('--help') || argv.includes('-h')) {
     console.log(`recipes — read-only orchestration-recipe advisor for the agent-workflow family.
@@ -510,7 +563,13 @@ CONFIGURED recipe per activity/slot, resolved from the per-project docs/ai/orche
 from the current directory) + live readiness, with degradation stated and each activity's autonomy
 level beside its cells; paste it verbatim at session start / into the handover "Active recipes:" slot.
 --json emits the structured report (incl. the same line as \`statusLine\`); the three are mutually
-exclusive. Detection only — never writes, never commits, never runs a subscription CLI.`);
+exclusive. Detection only — never writes, never commits, never runs a subscription CLI.
+
+Where the project settings enable the sandbox, a ready bridge whose sandbox entries they lack
+reads "<alias> ✗ not wired — <n> sandbox entr(ies) missing" ("not wired (unused)" when no slot
+uses it), one that cannot be judged "<alias> ✗ unchecked — <reason>"; the status line carries
+" · sandbox: <condition>" after the recipes pointer, and the default output lists the missing
+entries and the route per bridge.`);
     return;
   }
   const unknown = argv.find((a) => !KNOWN_ARGS.has(a));
@@ -525,6 +584,7 @@ exclusive. Detection only — never writes, never commits, never runs a subscrip
   }
   const cwd = process.cwd();
   const readiness = composeReadiness(cwd, deps);
+  const wiring = argv.includes('--active-line') ? null : await composeWiring(cwd, readiness);
   if (argv.includes('--active-line')) {
     // Lazy: orchestration-config.mjs statically imports this module — no static cycle.
     const { loadConfig } = await import('./orchestration-config.mjs');
@@ -541,12 +601,12 @@ exclusive. Detection only — never writes, never commits, never runs a subscrip
     }
   } else if (argv.includes('--status-line')) {
     const snapshot = settingsSnapshot();
-    console.log(composeStatusLine(readiness, recommendRecipe(readiness), snapshot, await composeAutonomyFacts(cwd), composeConfiguredPosture({ settings: snapshot })));
+    console.log(composeStatusLine(readiness, recommendRecipe(readiness), snapshot, await composeAutonomyFacts(cwd), composeConfiguredPosture({ settings: snapshot }), wiring));
   } else if (argv.includes('--json')) {
     const snapshot = settingsSnapshot();
-    console.log(JSON.stringify(buildReport(readiness, snapshot, await composeAutonomyFacts(cwd), composeConfiguredPosture({ settings: snapshot })), null, 2));
+    console.log(JSON.stringify(buildReport(readiness, snapshot, await composeAutonomyFacts(cwd), composeConfiguredPosture({ settings: snapshot }), wiring), null, 2));
   }
-  else console.log(formatRecipes(readiness));
+  else console.log(formatRecipes(readiness, wiring));
   return 0;
 };
 

package/tools/recommendations.mjs

@@ -19,11 +19,10 @@
 // below) and VERDICT-FIRST (D1): every non-optimal state opens with ONE composed verdict line.
 // Registry strings are frozen tool DATA, fact-true, one line under the shape cap (D2); posture/
 // risk prose lives in the mode doc at the consent moment (D3). A probe failure is a stated
-// skipped-item line — never a crash, never a fabricated item. sandbox.filesystem.allowWrite stays
-// HAND-APPLY territory; sandbox.network.allowedDomains is seeded only by the consented
-// `velocity-profile --bridge-tier` (AD-172); the sandbox-lane item's convergence is a NEUTRAL
-// fingerprint-bound acknowledgement recorded by the consent-gated ack writer into the family-owned
-// docs/ai/acks.json (AD-055 relocated it off the host settings schema), never a security key (D4).
+// skipped-item line — never a crash, never a fabricated item. The consented
+// `velocity-profile --bridge-tier` seeds used bridges' allow rules, <wrapper> * exclusions
+// (codex-exec * where an execute slot delegates), hosts in sandbox.network.allowedDomains and
+// state dirs in sandbox.filesystem.allowWrite; its recipe: line names the missing entries.
 //
 // Read-only: never writes, never commits, never runs a subscription CLI. The reused probes are all
 // exported read-only surfaces of their owning tools (velocity/autonomy/doctor/backends/recipes/
@@ -42,15 +41,13 @@ import {
   probeSandboxAvailability,
   isExecutableFile,
   readSettingsFile,
-  BRIDGE_REVIEW_WRAPPERS,
-  BRIDGE_REVIEW_MODE,
   SETTINGS_FILE,
   SETTINGS_LOCAL_FILE,
 } from './velocity-profile.mjs';
 import { loadAutonomy, isSparseSeedConfig, AUTONOMY_REL } from './autonomy-config.mjs';
 import { deriveDoctorPlan, TRUSTED_DIRS } from './autonomy-doctor.mjs';
 import { laneOf, applySlot } from './write-lanes.mjs';
-import { detectBackends, findOnPath } from './detect-backends.mjs';
+import { detectBackends } from './detect-backends.mjs';
 import { isDirectRun } from './direct-run.mjs';
 import { ACTIVITIES, resolveActivityRecipe, composeReadiness, safeLine } from './recipes.mjs';
 import { surveyFamily, surveyGateHook, surveyAdrLayoutStrict } from './family-registry.mjs';
@@ -79,7 +76,8 @@ import { CHECKER_CLAIM, INITIAL_ADOPTION_REASON, SOURCE_SIZE_GATE_ID, classifySo
 import { resolveDeclaredDir, dirCovers, isResolvableDeclaredEntry } from './declared-paths.mjs';
 import { resolveGitHooksPath } from './commit-guard.mjs';
 import { loadConfig } from './orchestration-config.mjs';
-import { bundledSandboxRecipe } from './bridge-sandbox-recipe.mjs';
+import { homeRelative } from './bridge-state-dirs.mjs';
+import { sandboxEnabled, HOST_HONORS_QUALIFIER } from './bridge-wiring.mjs';
 import { assertContainedRealPath } from './fs-safe.mjs';
 import { loadWorktreesConfig, resolveProbeDir } from './worktrees.mjs';
 import { preflightCheapAgents, EXECUTOR_VEHICLE } from './cheap-agents.mjs';
@@ -197,7 +195,6 @@ export const SEVERITIES = Object.freeze({
   'adr-store-migration': SEVERITY_ATTENTION,
   'sandbox-masks': SEVERITY_OPTIONAL,
   'sandbox-masks.unfenced-mount': SEVERITY_ATTENTION,
-  'sandbox-lane': SEVERITY_OPTIONAL,
   'worktrees-dir': SEVERITY_OPTIONAL,
   // The layer is opt-in, so both arms are OFFERS under the frozen registry (attention is a CONFIGURED
   // declaration that is broken): an absent store offers the seed, a store with no live contract offers
@@ -248,7 +245,7 @@ export const composeVerdict = ({ attention, optional, skipped }) => {
 export const WHATS = Object.freeze({
   'velocity-core': 'routine read-only commands still prompt — {n} audited read-only allowlist entr(ies) not seeded',
   'kit-tools-tier': "the kit's own read-only tools still prompt — {n} kit-tools tier entr(ies) not seeded",
-  'bridge-tier': 'bridge-wrappers tier incomplete — {n} entr(ies) missing (allow rules, sandbox exclusions or declared hosts of placed bridges)',
+  'bridge-tier': 'bridge-wrappers tier incomplete — {n} entr(ies) missing (allow rules, exclusions, hosts or state dirs of used bridges)',
   'autonomy-policy': 'no {path} — the computed defaults apply implicitly (red-lines ask/deny; every activity floors at prompt)',
   'autonomy-render': 'the declared autonomy policy is not rendered into .claude/settings.json — drift: {drift}',
   'sandbox-provision': 'the OS sandbox is unavailable: {reason}',
@@ -279,7 +276,6 @@ export const WHATS = Object.freeze({
   'adr-store-migration': 'still on the retired 3-tier ADR layout — {shape}',
   'sandbox-masks': '{n} sandbox mask(s) clutter git status — the managed exclude block is absent or stale',
   'sandbox-masks.stale-real': '{n} sandbox mask(s) clutter git status — the exclude block is stale; {m} fenced entr(ies) are REAL paths (a fresh apply drops them)',
-  'sandbox-lane': 'the wired review wrappers declare a session-sandbox recipe (egress hosts + writable state dirs) not yet acknowledged for this project',
   'worktrees-dir': 'write access to the worktrees parent dir {dir} is not confirmed — provision may still stop',
   'spec-adoption': 'feature-spec store absent (docs/ai/specs) — no feature contract can govern a plan here yet; seed the store, or record the decline',
   'profile-gap': '{what}',
@@ -324,7 +320,7 @@ export const BENEFITS = Object.freeze({
   'velocity-core': 'velocity — routine read-only commands stop prompting while the maintainer is away',
   'kit-tools-tier': "velocity — the kit's own read-only tools run promptless (audited, resolved-absolute tier)",
   'bridge-tier':
-    'velocity — placed review wrappers run code-mode council reviews promptless (plan/diff modes and delegated execution keep their prompt)',
+    'velocity — used bridges get <wrapper> * exclusions (codex-exec * if delegated), hosts, state dirs (allowWrite); reviews: code-mode allows',
   'autonomy-policy': 'clarity — the per-activity autonomy policy becomes an explicit, versioned declaration instead of implicit computed defaults',
   'autonomy-render': `velocity — confined commands auto-allow per your declared policy; ${DUAL_SECURITY_BENEFIT}`,
   'sandbox-provision': `velocity — confined ad-hoc commands stop prompting; ${DUAL_SECURITY_BENEFIT}`,
@@ -343,7 +339,6 @@ export const BENEFITS = Object.freeze({
   'family-freshness': 'currency — placed family members carry the latest shipped fixes and features',
   'adr-store-migration': 'durability — every decision becomes its own file with a generated navigator, instead of one hand-rotated pile',
   'sandbox-masks': 'zero clutter — a mask git ignores through the block leaves git status; a mount-only one leaves git add -A and the review fingerprint too',
-  'sandbox-lane': 'discoverability — the manifest-declared observed sandbox recipe for bridge runs surfaces itself instead of waiting to be asked',
   'worktrees-dir': 'parallel features — the host-specific write allowance or terminal fallback is surfaced before provision',
   'spec-adoption': 'contracts — a plan names the contract it builds to, and a change to a governed slice is visible at review instead of after it',
   'profile-gap': 'full flow — each difference from the reference profile is previewed by its own writer; a declined one returns only at a lineage step',
@@ -371,7 +366,6 @@ export const OPT_IN_CAPABILITIES = Object.freeze([
   { id: 'kit-tools-tier', mode: 'velocity', advisorKey: 'kit-tools-tier' },
   { id: 'bridge-tier', mode: 'velocity', advisorKey: 'bridge-tier' },
   { id: 'autonomy-render', mode: 'velocity', advisorKey: 'autonomy-render' },
-  { id: 'sandbox-lane', mode: 'velocity', advisorKey: 'sandbox-lane' },
   { id: 'autonomy-policy', mode: 'set-autonomy', advisorKey: 'autonomy-policy' },
   { id: 'sandbox-provision', mode: 'autonomy-doctor', advisorKey: 'sandbox-provision' },
   { id: 'gates-declaration', mode: 'gates', advisorKey: 'gates-declaration' },
@@ -409,9 +403,9 @@ export const OPT_IN_CAPABILITIES = Object.freeze([
   // state that makes a configured subagent carrier run solo.
   { id: 'executor-vehicle', mode: 'agents', advisorKey: 'executor-vehicle' },
   // Exempt, not un-audited. `acceptEdits` auto-applies Edit/Write and auto-runs mkdir/touch/mv/cp:
-  // a TRUST-POSTURE change. The kit never nudges a user toward weakening their approval posture (the
-  // same doctrine that keeps sandbox filesystem allowances HAND-APPLY); velocity presents the
-  // full honest posture at its own consent moment, where the user is already deciding.
+  // a TRUST-POSTURE change. Velocity presents its full posture at its own consent moment;
+  // the bridge tier separately seeds used bridges' allow rules, <wrapper> * exclusions
+  // (codex-exec * where delegated), hosts and state dirs (allowWrite).
   {
     id: 'accept-edits',
     mode: 'velocity',
@@ -460,10 +454,41 @@ const probeVelocityItems = ({ root, deps, add, skip }) => {
     skip('kit-tools-tier', err);
   }
   try {
-    const bt = planVelocityProfile(preflight, { bridgeTier: true, findWrapper: deps.findWrapper, bundleRoot: deps.bundleRoot, readdir: deps.readdir, readFile: deps.readFile });
-    const delta = bt.bridgeToAdd.length + bt.excludedToAdd.length + bt.hostsToAdd.length;
+    const bt = planVelocityProfile(preflight, {
+      bridgeTier: true, findWrapper: deps.findWrapper,
+      bundleRoot: deps.bundleRoot, readdir: deps.readdir, readFile: deps.readFile,
+      detect: deps.detect, env: deps.getenv ?? deps.env, home: deps.home,
+    });
+    const delta = bt.bridgeToAdd.length + bt.excludedToAdd.length + bt.hostsToAdd.length + bt.dirsToAdd.length;
     if (delta > 0) {
-      add('bridge-tier', fillTemplate(WHATS['bridge-tier'], { n: delta }), applyLine(' --bridge-tier'));
+      const entrySeparator = ', ';
+      const missing = [
+        ['allow rules', bt.bridgeToAdd],
+        ['exclusions', bt.excludedToAdd],
+        ['hosts', bt.hostsToAdd],
+        ['state dirs', bt.dirsToAdd],
+      ].filter(([, entries]) => entries.length > 0)
+        .map(([kind, entries]) => `${kind}: ${entries.join(entrySeparator)}`).join('; ');
+      const executeMissing = [...bt.executeToAdd.excludedCommands, ...bt.executeToAdd.hosts, ...bt.executeToAdd.dirs];
+      const executeDetail = executeMissing.length > 0
+        ? `; the execution wrapper codex-exec needs: ${executeMissing.join(entrySeparator)}`
+        : '';
+      const hostCondition = (() => {
+        try {
+          return sandboxEnabled(preflight.projectSettings.data, preflight.localSettings.data)
+            ? ` — once added, wired ${HOST_HONORS_QUALIFIER}`
+            : '';
+        } catch (err) {
+          return ` — host condition unchecked: ${oneLineOf(err?.message ?? String(err))}`;
+        }
+      })();
+      add(
+        'bridge-tier',
+        fillTemplate(WHATS['bridge-tier'], { n: delta }),
+        applyLine(' --bridge-tier'),
+        'bridge-tier',
+        `missing — ${missing}${executeDetail}${hostCondition}`,
+      );
     }
   } catch (err) {
     skip('bridge-tier', err);
@@ -1159,18 +1184,6 @@ const probeMasksItem = ({ root, deps, add, skip }) => {
 // knob is retired in the wrappers (recognized, arms nothing) and an oversized code review is now a
 // chunked feed with a per-part delivery proof, so there is nothing left to offer.
 
-// D6 resolution, mirroring the wrappers' byte-semantics (`${VAR:-default}` + the exact case-arms:
-// `~` / `~/…` / `/…` ride as-given; EVERY other form — including `~user/…`, which the wrappers
-// never resolve as a home path — anchors like a relative path). The advisor anchors to the TARGET
-// PROJECT ROOT (the pinned --cwd), matching what a wrapper invoked from the project root resolves
-// (the documented dispatch form; the wrapper itself anchors to its invocation $PWD).
-const resolveWritableDir = (entry, { env, root }) => {
-  const value = entry.env == null ? '' : (env[entry.env] ?? '');
-  if (value === '') return entry.default;
-  if (value === '~' || value.startsWith('~/') || value.startsWith('/')) return value;
-  return resolve(root, value);
-};
-
 // The NEUTRAL recipe fingerprint (D4): a hash over the resolved hosts ∪ dirs data — an
 // acknowledgement token, never a security key. Canonical form is HOME-SYMBOLIC: an
 // absolute dir under the resolved home canonicalizes BACK to its `~/…` form and tilde forms stay
@@ -1179,21 +1192,13 @@ const resolveWritableDir = (entry, { env, root }) => {
 // churns between them); only a genuinely-outside-home absolute override stays absolute
 // (machine-specific by nature). Any change to the recipe re-fires the item.
 export const recipeFingerprint = ({ hosts, dirs, home }) => {
-  const homeAbs = resolve(home);
-  const norm = (d) => {
-    if (d === '~') return '~';
-    if (d.startsWith('~/')) return `~/${d.slice(2)}`;
-    const abs = resolve(d);
-    if (abs === homeAbs) return '~';
-    return abs.startsWith(`${homeAbs}/`) ? `~/${abs.slice(homeAbs.length + 1)}` : abs;
-  };
+  const norm = (dir) => homeRelative(dir, home);
   return factFingerprint(JSON.stringify({ hosts: [...hosts].sort(), dirs: [...new Set(dirs.map(norm))].sort() }));
 };
 
-// The ack store (D4; AD-055 Part I) is the kit-owned PRIMARY ack channel; the legacy settings-scope
-// keys below are read for one deprecation window. An ack lane exists for a state the maintainer can
-// only ANSWER, never converge — a dead checker/producer pair is fixed, not acknowledged, so no lane
-// names it. The store's path, keys, lane registry and reader are ack-store.mjs (re-exported above).
+// The ack store (D4; AD-055 Part I) is the kit-owned ack channel. An ack lane exists for a state the
+// maintainer can only ANSWER, never converge — a dead checker/producer pair is fixed, not acknowledged,
+// so no lane names it. The store's path, keys, lane registry and reader are ack-store.mjs.
 
 // The opt-in read-lane toggle file (AD-055 Part II) — the SAME kit-owned docs/ai/lanes.json the
 // placed hook reads live. The read-lane item offers to enable it once the hook is placed+wired.
@@ -1268,11 +1273,6 @@ const declarationCarriesMarker = (root, deps) => {
   return declaration.outcome === 'loaded' && declaration.gates.some((gate) => Object.hasOwn(gate, LCOV_PRODUCER_KEY));
 };
 
-// The LEGACY neutral ack namespace (pre-AD-055): read from BOTH settings scopes until the next kit
-// MAJOR (2.0.0) so a never-migrated host stays converged across the deprecation window (Decisions 3).
-export const SANDBOX_LANE_ACK_PARENT = 'agentWorkflow';
-export const SANDBOX_LANE_ACK_KEY = 'sandboxLaneAck';
-
 // Read the opt-in read-lane toggle for the read-lane item. An ABSENT file (or absent docs/ai) →
 // false (the lane is off — offer it). `readLane === true` → enabled (converged). A parse/IO error on
 // an EXISTING file, a symlinked ancestor/leaf, an escape, or a non-object root THROWS — the probe
@@ -1303,7 +1303,7 @@ const readReadLaneToggle = (root, deps) => {
 // D3: the risk-marked keys — every key here has a per-item posture note in the mode doc, surfaced
 // at the consent moment; the static contract test asserts EXACT bidirectional coverage
 // (risk-marked keys == mode-doc note keys — a dropped note goes red, not silent).
-export const RISK_NOTED_KEYS = Object.freeze(['bridge-tier', 'sandbox-lane', 'read-lane', 'worktrees-dir', 'adr-store-migration', 'gates-inert', 'source-size', 'gate-hook', 'mcp-channel', 'spec-adoption', 'enforcement', 'profile-gap', 'jev-connect', 'jev-skill']);
+export const RISK_NOTED_KEYS = Object.freeze(['bridge-tier', 'read-lane', 'worktrees-dir', 'adr-store-migration', 'gates-inert', 'source-size', 'gate-hook', 'mcp-channel', 'spec-adoption', 'enforcement', 'profile-gap', 'jev-connect', 'jev-skill']);
 
 // The feature-spec layer's adoption state (contract: kit/spec-adoption). The canon lets a plan cite
 // zero governing specs while a project adopts the layer, and nothing ever said whether adoption had
@@ -1336,63 +1336,6 @@ export const probeSpecAdoption = ({ root, deps, add, skip }) => {
   }
 };
 
-const probeSandboxLane = ({ root, deps, add, skip }) => {
-  try {
-    const settings = readSettingsFile(join(root, SETTINGS_FILE), { ...deps, cwd: root });
-    const localSettings = readSettingsFile(join(root, SETTINGS_LOCAL_FILE), { ...deps, cwd: root });
-    const sandbox = settings.data?.sandbox;
-    const excluded = Array.isArray(sandbox?.excludedCommands) ? sandbox.excludedCommands : [];
-    const probePlaced = deps.findWrapper ?? ((cmd) => findOnPath(cmd, deps).state === 'present');
-    // Wired = the two-surface proof the tier wrote before AD-172 (the wrapper in the PROJECT
-    // excludedCommands + its code-mode allow rule, either scope) — surfacing the recipe before those
-    // exist would front-run the bridge-tier item (codex terminal). The hosts surface (AD-172) is
-    // deliberately not required: the recipe also carries the writable dirs no tier seeds, so it may
-    // render beside a bridge-tier item offering the hosts re-run. Byte-form from the tier's own constants.
-    const allowRules = [
-      ...(Array.isArray(settings.data?.permissions?.allow) ? settings.data.permissions.allow : []),
-      ...(Array.isArray(localSettings.data?.permissions?.allow) ? localSettings.data.permissions.allow : []),
-    ];
-    const wired = BRIDGE_REVIEW_WRAPPERS.filter(
-      (w) => excluded.includes(w) && probePlaced(w) && allowRules.includes(`Bash(${w} ${BRIDGE_REVIEW_MODE}:*)`),
-    );
-    if (wired.length === 0) return; // the tier's rules and exclusions are not wired — the bridge-tier item covers first
-    const { hosts, dirEntries } = bundledSandboxRecipe(wired, deps);
-    const env = deps.getenv ?? process.env;
-    const home = deps.home ?? homedir();
-    const dirs = [];
-    for (const entry of dirEntries) {
-      const resolved = resolveWritableDir(entry, { env, root });
-      if (!dirs.includes(resolved)) dirs.push(resolved);
-    }
-    const fingerprint = recipeFingerprint({ hosts, dirs, home });
-    // Convergence is the NEUTRAL fingerprint-bound acknowledgement: the item converges iff the
-    // CURRENT fingerprint equals the ack in ANY consulted store — the family-owned acks.json FIRST,
-    // then the legacy settings scopes; a stale value in one store is ignored when another matches
-    // (Decisions 2). A changed recipe (hosts, dirs, or an env override) re-fires the item (D4).
-    const acks = [
-      readAckValue(root, deps, ACKS_LANE_KEY),
-      settings.data?.[SANDBOX_LANE_ACK_PARENT]?.[SANDBOX_LANE_ACK_KEY],
-      localSettings.data?.[SANDBOX_LANE_ACK_PARENT]?.[SANDBOX_LANE_ACK_KEY],
-    ];
-    if (acks.includes(fingerprint)) return; // the acknowledged recipe — the item converged
-    // The item joins the CONSENT-GATED WRITER class (Decisions 4): the apply is the ack writer's
-    // PREVIEW one-liner (pure executable, cwd-independent), carrying the neutral fingerprint — never
-    // a security key. The LIVE recipe (egress hosts + resolved writable dirs) rides a separate
-    // rendered `recipe:` line (the fill source for the mode doc's lane-(2) hand-apply block); the
-    // fingerprint encodes it, so a changed recipe re-fires with a fresh command.
-    const recipe = `egress hosts [${hosts.join(', ')}]; writable state dirs [${dirs.join(', ')}] (observed-minimal; a blocked host names itself at run time)`;
-    add(
-      'sandbox-lane',
-      fillTemplate(WHATS['sandbox-lane'], {}),
-      `node ${q(toolPath('ack-write.mjs'))} --fingerprint ${fingerprint} --cwd ${q(root)}`,
-      'sandbox-lane',
-      recipe,
-    );
-  } catch (err) {
-    skip('sandbox-lane', err);
-  }
-};
-
 // D7 lane 1 — the DECLARATION confirmation. A settings entry is not proof of writable CAPABILITY
 // (runtime truth stays with the provision preflight's real create+delete probe); it is proof the
 // maintainer applied this item's own advice, which is what the item may converge on. Both scopes
@@ -1446,8 +1389,8 @@ const declaresWritableDir = (root, probeDir, deps) => {
 };
 
 // D7 lane 2 — the ack fallback for a host that ignores the settings key, bound to the PROBED DIR
-// through the shared neutral fingerprint (the same home-symbolic canonicalization the sandbox-lane
-// ack uses, so a home-anchored dir acks portably). The binding is to the RESOLVED probe dir, so the
+// through the worktrees-dir fingerprint's home-symbolic canonicalization, so a home-anchored dir
+// acks portably. The binding is to the RESOLVED probe dir, so the
 // item re-fires only when that resolved dir changes — two ABSENT parentDir values sharing an
 // existing ancestor resolve to the same dir and keep the same ack.
 export const worktreesDirFingerprint = (probeDir, home) => recipeFingerprint({ hosts: [], dirs: [probeDir], home });
@@ -1643,7 +1586,6 @@ const PROBES = Object.freeze([
   probeFamilyFreshness,
   probeAdrStore,
   probeMasksItem,
-  probeSandboxLane,
   probeWorktreesDir,
   probeMcpChannel,
   probeSpecAdoption,
@@ -1667,8 +1609,8 @@ export const buildRecommendations = ({ cwd, deps = {} } = {}) => {
   // smoke asserting a specific false-green never returns) can assert the exact outcome instead of
   // pattern-matching prose that is free to be reworded.
   // `detail` (optional) is an extra rendered `recipe:` line — factual context that is TOO LONG for
-  // the capped WHAT and does NOT belong in the pure-command apply (the sandbox-lane live recipe:
-  // egress hosts + resolved writable dirs; the worktrees-dir hand-apply-first grant advice; the
+  // the capped WHAT and does NOT belong in the pure-command apply (the bridge-tier missing-entries
+  // line; the worktrees-dir hand-apply-first grant advice; the
   // agents hidden-mode reconcile follow-up). Single-line like apply; absent for every other item.
   // Returns whether the item really RENDERED. One probe's disposition depends on another's having
   // spoken (the marker-stale ⟷ read-lane.stale precedence), and "the conditions still look right"
@@ -1759,17 +1701,21 @@ Usage:
 
 Computes the deterministic Recommendations section every kit upgrade ends with — VERDICT-FIRST:
 one composed verdict line opens every non-optimal render, then per item {severity · what is
-sub-optimal · the benefit in one plain line · the lane · an optional \`recipe:\` line (the sandbox-lane live
-recipe, the worktrees-dir hand-apply-first grant advice, or the agents hidden-mode reconcile
+sub-optimal · the benefit in one plain line · the lane · an optional \`recipe:\` line (the bridge-tier
+missing-entries line, the worktrees-dir hand-apply-first grant advice, or the agents hidden-mode reconcile
 follow-up) · the harness check line · the exact consent-gated apply one-liner}. --cwd is
 REQUIRED (the target project is explicit, never inferred from the shell's current directory). The
 section renders present-even-when-empty ("${RECOMMENDATIONS_EMPTY_LINE}"); a probe failure is a
 stated skipped-item line. Apply lines are cwd-independent (absolute tool paths, a pinned --cwd;
 the doctor item pins via a cd prefix; the ONE exception is the set-autonomy item — a
 conversational skill invocation labeled "run IN the target project") and preserve each writer's
-own consent semantics; sandbox filesystem allowances stay HAND-APPLY territory, the placed bridges' declared hosts reach sandbox.network.allowedDomains only through the
-consented velocity-profile --bridge-tier, and the sandbox-lane convergence is a neutral fingerprint acknowledgement recorded by
-the consent-gated ack writer into docs/ai/acks.json (never a security key).
+own consent semantics. The consented velocity-profile --bridge-tier seeds used bridges' code-mode
+allow rules, <wrapper> * exclusions (codex-exec * where an execute slot delegates), hosts in
+sandbox.network.allowedDomains and state dirs in sandbox.filesystem.allowWrite. Where the host
+honors the settings sandbox keys, an excluded wrapper runs outside the sandbox, every sandboxed
+command of the project can reach each host, and every sandboxed command can write each state dir;
+plan/diff review modes and delegated execution keep their prompt. Items marked HAND-APPLY stay
+the user's own step.
 
 Read-only: never writes, never commits, never runs a subscription CLI. Exit codes: 0 report
 rendered (items or empty); 1 error; 2 usage.`;