@sabaiway/agent-workflow-kit 2.0.0 → 3.0.0

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -14,7 +14,8 @@
 #   1. POSTURE   read-only second-opinion reviewer; findings only, no edits/commits
 #   2. GUARD     do NOT opine on AI model names/versions or your knowledge cutoff
 #   3. FACTS     "## Grounded facts — review AGAINST these, do NOT guess the code"
-#                (omitted -> a one-line note in-prompt + a LOUD stderr warning)
+#                (code mode REFUSES pre-spend without a non-empty payload — escapes:
+#                --ungrounded / AGY_PROBE=1; plan/diff omitted -> a LOUD stderr warning)
 #   4. DECIDED   "## Decisions already made / already addressed — do NOT re-raise"
 #                (optional; the anti-circling lever — the round-2 payload)
 #   5. FOCUS     the merged --focus / trailing focus text (optional)
@@ -27,7 +28,7 @@
 # facts (--facts), the already-decided list (--decided), and the focus (--focus).
 #
 # Usage (installed on PATH as `agy-review`):
-#   agy-review code   [--facts @f] [--decided @f] [--focus "…"] [extra focus…]
+#   agy-review code   [--facts @f] [--ungrounded] [--decided @f] [--focus "…"] [extra focus…]
 #   agy-review plan   <plan-file> [--facts @f] [--decided @f] [--focus "…"]
 #   agy-review diff   <diff-file> [--facts @f] [--decided @f] [--focus "…"]
 #   agy-review --continue          [--decided @f] [--focus "…"]   # round-2 delta (no mode, no re-assembly)
@@ -55,19 +56,22 @@ case "${1:-}" in
 agy-review — grounded read-only ADVISORY review by Google's Antigravity CLI (agy; subscription-only).
 
 Usage:
-  agy-review code [--facts @f] [--decided @f] [--focus "…"] [extra focus…]
+  agy-review code [--facts @f] [--ungrounded] [--decided @f] [--focus "…"] [extra focus…]
   agy-review plan <plan-file> [--facts @f] [--decided @f] [--focus "…"]
   agy-review diff <diff-file> [--facts @f] [--decided @f] [--focus "…"]
 
 Flags:
-  --facts @f — verified facts the review runs AGAINST (omit ⇒ loud ungrounded-review warning)
+  --facts @f — verified facts the review runs AGAINST (code mode REQUIRES a non-empty payload; plan/diff warn loudly when omitted)
+  --ungrounded — deliberately ungrounded CODE review, a throwaway opinion (code mode only, contradicts --facts; the receipt records grounded:false and never attests)
   --decided @f — already-decided / already-addressed list; do NOT re-raise (anti-circling; the round-2 payload)
   --focus "…" — extra focus (repeatable; code mode also takes trailing focus words)
 
 Grounding:
   grounded review — agy reads NOTHING by default, an ungrounded review GUESSES:
   --facts @f = the verified facts to review AGAINST; --decided @f = decisions
-  already made, do NOT re-raise (anti-circling)
+  already made, do NOT re-raise (anti-circling). code mode REQUIRES a non-empty
+  --facts payload and refuses BEFORE spending a run (escapes: --ungrounded,
+  AGY_PROBE=1); plan/diff proceed with a loud warning
 
 Notes:
   pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts
@@ -88,20 +92,35 @@ Receipt:
   sockets — are excluded from the domain entirely, untracked symlinks/directories ride as
   name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict
   recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK);
-  grounded = whether a NON-EMPTY --facts payload was supplied (an empty payload records
+  grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without
+  one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records
   grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts
   payload; a continuation receipt is fresh:false (informational-only — it cannot attest the
   folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY
   receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe
-  review never attests) and equally rejects an unmarked one (silence is not a declaration); a write
-  failure warns, never fails the review
+  review never attests) and equally rejects an unmarked one (silence is not a declaration);
+  posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the
+  gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the
+  review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL
+  explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses
+  pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty
+  output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session
+  error); a write failure warns, never fails the review
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
   AGY_HARD_TIMEOUT — hard wall-clock cap, duration string like 5m/30m/90s (built-in default 30m)
   AGY_REVIEW_ALLOW_ADDDIR — boolean 0/1: 1 arms the oversized --add-dir escape (re-enables the Issue-001 stall risk; default 0)
 
-Closed grammar: unknown flags are rejected; no '--' passthrough (the only escapes are AGY_PROBE=1 and AGY_REVIEW_ALLOW_ADDDIR=1).
+Honesty + posture (D4/D5):
+  a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4
+  with NO receipt: a FAILED review to RE-RUN, never a fatal session error. One stderr banner line
+  states the ACTUAL run posture (review posture: model=…) and the receipt records the same
+  posture {model} (agy has no tier). An ATTESTING review with AGY_MODEL explicitly emptied
+  refuses pre-spend (the actual model would be unknowable; AGY_PROBE=1 is exempt), and a model
+  string carrying control bytes refuses pre-spend in every mode.
+
+Closed grammar: unknown flags are rejected; no '--' passthrough (the flag escape is --ungrounded; the env escapes are AGY_PROBE=1 and AGY_REVIEW_ALLOW_ADDDIR=1).
 Requires at run time: the agy CLI on PATH + a Google AI subscription login (--help needs neither).
 HELP
     exit 0
@@ -220,9 +239,15 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.1 Pro (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="2.7.0"
+AW_BRIDGE_VERSION="4.0.0"
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
+# D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
+# other interpolation) can echo raw newline/ESC bytes into stderr/the terminal (round-2 fold).
+if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f']* ]]; then
+  echo "error: AGY_MODEL contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
 # Frontier review models. ANY model is allowed; a sub-frontier one only earns a soft, silenceable warning.
 FRONTIER_SET=("Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonnet 4.6 (Thinking)")
 
@@ -439,6 +464,26 @@ receipt_json_scalar() {
   if [[ -z "${1:-}" ]]; then printf 'null'; else printf '"%s"' "$1"; fi
 }
 
+# STRICT JSON string encoding for the ONE free-form receipt field (the posture model display
+# string): backslash then double-quote escaped. Control bytes never reach here — the posture
+# resolution refuses them pre-spend (D5), so these two escapes make the encoding total.
+json_string_escape() {
+  local s="${1//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  printf '%s' "$s"
+}
+
+# The D5 posture object this wrapper writes into EVERY receipt (agy has no tier — the label is
+# the model display string). An unknowable model (explicitly emptied on an exempt probe run) is
+# recorded null, never guessed.
+posture_json() {
+  if [[ -z "${AGY_MODEL:-}" ]]; then
+    printf '{"model":null}'
+  else
+    printf '{"model":"%s"}' "$(json_string_escape "$AGY_MODEL")"
+  fi
+}
+
 # write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false]
 # Appends ONE receipt line (the AD-038 fixture shape) as a side effect of a SUCCESSFUL review —
 # to $AW_REVIEW_RECEIPTS when set, else <git dir>/agent-workflow-review-receipts.jsonl (inside the
@@ -462,28 +507,29 @@ write_review_receipt() {
   fi
   local line probe_field=',"probe":false'
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s}' \
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
   fi
 }
 
-# Parse the mandated '### Verdict' section of a captured review: the first non-empty line after the
-# heading, matched against the closed verdict vocabulary (SHIP WITH NITS before SHIP — substring).
-# No heading / no match → "unknown" (recorded, never guessed).
+# Parse the mandated '### Verdict' section of a captured review: the first non-empty line after
+# the EXACT heading (`### Verdicts` or any suffix never matches), tested against the closed
+# vocabulary as an ANCHORED PREFIX with a word boundary — the verdict line must START with the
+# token and the next char must be non-word/EOL (SHIP WITH NITS before SHIP; `NOT SHIP` and
+# `SHIPPING` never match). No heading / no match → "unknown" (the D4 failed-run arm owns it).
 parse_agy_verdict() { # $1 = captured-output file
   local line
-  line="$(awk '/^### Verdict/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null)"
-  case "$line" in
-    *"SHIP WITH NITS"*) printf 'SHIP WITH NITS' ;;
-    *REWORK*)           printf 'REWORK' ;;
-    *SHIP*)             printf 'SHIP' ;;
-    *)                  printf 'unknown' ;;
-  esac
+  line="$(awk '/^### Verdict[[:space:]]*$/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null)"
+  if [[ "$line" =~ ^SHIP\ WITH\ NITS([^[:alnum:]_]|$) ]]; then printf 'SHIP WITH NITS'
+  elif [[ "$line" =~ ^REWORK([^[:alnum:]_]|$) ]]; then printf 'REWORK'
+  elif [[ "$line" =~ ^SHIP([^[:alnum:]_]|$) ]]; then printf 'SHIP'
+  else printf 'unknown'
+  fi
 }
 
 # Emit the full review surface to stdout: repo map, status (never-committable untracked records
@@ -541,7 +587,7 @@ case "${1:-}" in
 esac
 
 usage() {
-  echo "usage: $0 code   [--facts @f] [--decided @f] [--focus \"…\"] [extra focus…]" >&2
+  echo "usage: $0 code   [--facts @f] [--ungrounded] [--decided @f] [--focus \"…\"] [extra focus…]" >&2
   echo "       $0 plan   <plan-file> [--facts @f] [--decided @f] [--focus \"…\"]" >&2
   echo "       $0 diff   <diff-file> [--facts @f] [--decided @f] [--focus \"…\"]" >&2
   echo "       $0 --continue          [--decided @f] [--focus \"…\"]" >&2
@@ -580,6 +626,7 @@ fi
 # --- Flag parse (--facts / --decided / --focus + trailing focus) -------------
 FACTS_RAW=""
 DECIDED_RAW=""
+UNGROUNDED=0
 FOCUS_PARTS=()
 # A value-taking flag must be followed by a real value — never end-of-args and never another flag.
 # Otherwise `agy-review code --facts --focus x` would silently take "--focus" as the facts and spend a
@@ -598,6 +645,12 @@ while [[ $# -gt 0 ]]; do
         exit 2
       fi
       need_value "$1" "${2:-}"; FACTS_RAW="$2"; shift 2 ;;
+    --ungrounded)
+      if [[ -n "$resume_mode" ]]; then
+        echo "error: --ungrounded is not valid on a continuation (the original round already set its grounding)." >&2
+        exit 2
+      fi
+      UNGROUNDED=1; shift ;;
     --decided)
       need_value "$1" "${2:-}"; DECIDED_RAW="$2"; shift 2 ;;
     --focus)
@@ -623,6 +676,18 @@ done
 # Merge --focus values and trailing focus words, in parse order, into ONE focus block.
 FOCUS="${FOCUS_PARTS[*]:-}"
 
+# --ungrounded closed grammar (D4): code-mode only, and an explicit contradiction with --facts refuses.
+if [[ "$UNGROUNDED" == "1" ]]; then
+  if [[ -n "$FACTS_RAW" ]]; then
+    echo "error: --ungrounded contradicts --facts — pass the verified facts (grounded) or drop them (--ungrounded), never both." >&2
+    exit 2
+  fi
+  if [[ "$mode" != "code" ]]; then
+    echo "error: --ungrounded is only valid in code mode — $mode mode already proceeds ungrounded with a loud warning." >&2
+    exit 2
+  fi
+fi
+
 # Resolve @file / literal for --facts and --decided NOW (cwd = invocation, before any code-mode cd).
 # The `@file` existence check runs at TOP LEVEL (not inside a command substitution) so its exit-2 exits
 # the whole script, not just a subshell.
@@ -648,6 +713,25 @@ if [[ -n "$DECIDED_RAW" ]]; then
 fi
 
 if [[ -z "$FACTS_CONTENT" && -z "$resume_mode" ]]; then
+  # code mode fails CLOSED before the spend (D4): an ungrounded CODE receipt records grounded:false,
+  # which the review-state gate rejects — the run would be paid for and attest nothing. Keyed on the
+  # resolved CONTENT, so --facts naming an empty payload refuses identically.
+  if [[ "$mode" == "code" && "$UNGROUNDED" != "1" && "$AGY_PROBE" != "1" ]]; then
+    # The recovery hint resolves the kit's grounding tool from THIS wrapper's location (monorepo
+    # canon / deployed skills sibling / kit-bundled mirror) — a repo-relative path would not exist
+    # for a globally installed kit. Quoted: an install path may carry spaces.
+    grounding_tool="node <agent-workflow-kit>/tools/grounding.mjs"
+    for _g in "$HERE/../../agent-workflow-kit/tools/grounding.mjs" "$HERE/../../../tools/grounding.mjs"; do
+      if [[ -f "$_g" ]]; then grounding_tool="node \"$_g\""; break; fi
+    done
+    echo "error: 'agy-review code' requires grounded facts and refuses BEFORE spending a run — an" >&2
+    echo "       ungrounded code review GUESSES, and its receipt (grounded:false) never attests." >&2
+    echo "       Assemble the verified facts, then re-run:" >&2
+    echo "         $grounding_tool --constraints [--plan <plan-file>] --out <facts-file>" >&2
+    echo "         agy-review code --facts @<facts-file>" >&2
+    echo "       Explicit escapes: --ungrounded (throwaway opinion) · AGY_PROBE=1 (a probe never attests)." >&2
+    exit 2
+  fi
   echo "warning: no --facts supplied. agy reads NOTHING by default, so an ungrounded review GUESSES" >&2
   echo "         (stale-model and partial-diff false positives). Pass --facts @file with the verified" >&2
   echo "         facts the model must review AGAINST. Proceeding without grounding." >&2
@@ -785,6 +869,21 @@ else
   fi
 fi
 
+# --- D5 pre-spend posture gate + banner (one line, the ACTUAL run posture) ------------------
+# The control-byte screen already ran at AGY_MODEL resolution (before any interpolation). An
+# ATTESTING review (fresh code mode, guards on) whose wrapper cannot know the actual model
+# (AGY_MODEL explicitly emptied → the CLI's own settings default decides) refuses pre-spend;
+# AGY_PROBE=1 runs are exempt (their receipts never attest and record model null).
+# Scoped to the ATTESTING branch only (grounded code, guards on): plan / diff / --ungrounded
+# code mint receipts that never attest, so an emptied model just records posture.model null.
+if [[ -z "$AGY_MODEL" && -z "$resume_mode" && "$REVIEW_PROBE" != "true" && "$REVIEW_ARTIFACT" == "code" && -n "$FACTS_CONTENT" ]]; then
+  echo "error: AGY_MODEL is explicitly empty, so the ACTUAL review model is unknowable (the agy CLI's" >&2
+  echo "       own settings default decides) — an attesting review refuses pre-spend. Fix: unset" >&2
+  echo "       AGY_MODEL (wrapper default), or set the real model display string; AGY_PROBE=1 is exempt." >&2
+  exit 2
+fi
+echo "review posture: model=${AGY_MODEL:-<agy settings default>}" >&2
+
 # --- Execute via agy-run (single home of timeout + subscription + byte ceiling) ---
 # The output is teed into the private staging dir so the mandated '### Verdict' section can be
 # parsed into the review receipt — the user-facing stream is unchanged.
@@ -802,8 +901,17 @@ fi
 set -e
 
 # --- Review receipt (AD-038): only a SUCCESSFUL review attests --------------------
+# D4 (wrapper honesty): a run that produced NO recognized '### Verdict' section — empty output
+# included — is a FAILED review: non-zero exit, NO receipt. This is a failed review to RE-RUN,
+# never a fatal session error (documented in --help).
 if [[ $rc -eq 0 ]]; then
   verdict="$(parse_agy_verdict "$review_out_file")"
+  if [[ "$verdict" == "unknown" ]]; then
+    echo "error: the review output carries no recognized '### Verdict' section (closed vocabulary:" >&2
+    echo "       SHIP / SHIP WITH NITS / REWORK) — a FAILED review; NO receipt was written. Re-run" >&2
+    echo "       the review; if it recurs, inspect the captured output for what the model produced." >&2
+    exit 4
+  fi
   if [[ -n "$resume_mode" ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -38,7 +38,9 @@ const FAKE_AGY = [
   '  fi; prev="$a"',
   'done',
   'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
-  'printf "%s\\n" "${AGY_FAKE_OUTPUT:-FAKE_AGY_REVIEW_OUTPUT}"',
+  // Unset AGY_FAKE_OUTPUT → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
+  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP\\n"; else printf "%s\\n" "$AGY_FAKE_OUTPUT"; fi',
   'exit "${AGY_FAKE_EXIT:-0}"',
   '',
 ].join('\n');
@@ -190,17 +192,100 @@ describe('agy-review.sh — guard + grounding (2, 3)', () => {
     assert.match(r.prompt, /## Focus\nfirst second third/);
   });
 
-  it('warns LOUDLY when --facts is omitted, and proceeds', () => {
+  it('plan mode with no --facts keeps the warning and proceeds (unchanged contract)', () => {
     const sb = makeSandbox();
-    const r = run(sb, { args: ['code'] });
+    writeFileSync(join(sb.repo, 'p.md'), '# plan body\n');
+    const r = run(sb, { args: ['plan', 'p.md'] });
     rmSync(sb.home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /no --facts supplied/);
-    assert.equal(r.invoked, true, 'an ungrounded review still proceeds (warn, not block)');
+    assert.equal(r.invoked, true, 'an ungrounded plan review still proceeds (warn, not block)');
     assert.match(r.prompt, /none supplied/, 'the prompt notes the missing facts in-band');
   });
 });
 
+// ── code mode fails CLOSED without grounded facts (D4) ───────────────────────────
+// An ungrounded CODE receipt records grounded:false, which the kit's review-state gate rejects —
+// the run would be paid for and attest nothing. The wrapper refuses BEFORE the spend, keyed on the
+// resolved CONTENT (an empty --facts payload refuses identically). Escapes: the explicit
+// --ungrounded flag (throwaway opinion) and AGY_PROBE=1 (a probe receipt never attests anyway).
+describe('agy-review.sh — code mode fails CLOSED without grounded facts (D4)', () => {
+  it('code mode with no --facts exits 2 before any agy invocation', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code'] });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 2, r.stderr);
+    assert.equal(r.invoked, false, 'the refusal must fire before any agy invocation — zero runs spent');
+    assert.match(r.stderr, /grounding\.mjs/, 'the refusal names the facts assembler');
+    assert.match(r.stderr, /agy-review code --facts @/, 'the refusal prints the exact re-run line');
+    const hint = r.stderr.match(/node "([^"]+grounding\.mjs)"/);
+    assert.ok(hint, 'the recovery hint resolves and QUOTES a real grounding.mjs path (an install path may carry spaces)');
+    assert.ok(existsSync(hint[1]), 'the resolved hint path exists on this layout');
+  });
+
+  it('code mode with --facts naming an EMPTY payload exits 2 before any agy invocation', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, 'empty-facts.md'), '');
+    const r = run(sb, { args: ['code', '--facts', '@empty-facts.md'] });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 2, 'the refusal keys on the CONTENT, not the flag');
+    assert.equal(r.invoked, false, 'an empty payload must not spend a run');
+    assert.match(r.stderr, /agy-review code --facts @/);
+  });
+
+  it('code --ungrounded proceeds and the receipt records grounded:false', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--ungrounded'], env: { AGY_FAKE_OUTPUT: VERDICT_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.invoked, true, 'the explicit escape lets the run proceed');
+    assert.equal(receipts.length, 1);
+    assert.equal(receipts[0].grounded, false, 'an --ungrounded run still records grounded:false');
+    assert.equal(receipts[0].factsHash, null);
+    assert.match(r.stderr, /no --facts supplied/, 'the escape path stays loud, never silent');
+  });
+
+  it('AGY_PROBE=1 code with no --facts proceeds and the receipt records probe:true', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code'], env: { AGY_PROBE: '1', AGY_FAKE_OUTPUT: VERDICT_OUTPUT } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(r.invoked, true, 'an ungrounded probe is coherent — a probe receipt never attests');
+    assert.equal(receipts[0].probe, true);
+    assert.equal(receipts[0].grounded, false);
+  });
+
+  it('--ungrounded with --facts is a refusal (contradiction)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--ungrounded', '--facts', 'f'] });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 2);
+    assert.equal(r.invoked, false);
+    assert.match(r.stderr, /--ungrounded contradicts --facts/);
+  });
+
+  it('--ungrounded outside code mode is a refusal', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, 'p.md'), '# p\n');
+    const r = run(sb, { args: ['plan', 'p.md', '--ungrounded'] });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 2);
+    assert.equal(r.invoked, false);
+    assert.match(r.stderr, /--ungrounded is only valid in code mode/);
+  });
+
+  it('--ungrounded on a continuation is a refusal', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['--continue', '--ungrounded'] });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 2);
+    assert.equal(r.invoked, false);
+    assert.match(r.stderr, /--ungrounded is not valid on a continuation/);
+  });
+});
+
 describe('agy-review.sh — code-mode precomputed diff (4, 5, 8)', () => {
   it('assembles repo map + status + untracked CONTENTS', () => {
     const sb = makeSandbox();
@@ -754,7 +839,12 @@ describe('agy-review.sh — declared contract is really accepted (forward guard)
     for (const descriptor of REVIEW_CONTRACT.flags) {
       const flag = leadingFlag(descriptor);
       const sb = makeSandbox();
-      const r = run(sb, { args: ['code', flag, 'f'] });
+      // D4: code mode refuses without grounded facts, so a non-facts value flag is driven on a
+      // grounded run; --ungrounded takes no value, contradicts --facts, and is driven alone.
+      const args = flag === '--facts' ? ['code', '--facts', 'f']
+        : flag === '--ungrounded' ? ['code', '--ungrounded']
+          : ['code', '--facts', 'f', flag, 'f'];
+      const r = run(sb, { args });
       rmSync(sb.home, { recursive: true, force: true });
       assert.equal(r.status, 0, `${flag}: ${r.stderr}`);
     }
@@ -782,7 +872,7 @@ describe('agy-review.sh — declared contract is really accepted (forward guard)
 // The normative fixture: the AD-038 shape + the D3 self-declaring probe marker (backend/verdict here
 // carry this bridge's vocabulary; dynamic values are asserted by shape):
 const RECEIPT_FIXTURE = JSON.parse(
-  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false}',
+  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<display>"}}',
 );
 const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
 const readReceipts = (repo) => {
@@ -853,9 +943,9 @@ describe('agy-review.sh — review receipts (AD-038)', () => {
     assert.equal(receipts[0].probe, true, 'both write paths carry the marker — no unmarked probe lane');
   });
 
-  it('an ungrounded fresh run records grounded:false + factsHash null (the vacuous-grounding hole stays visible)', () => {
+  it('an --ungrounded fresh run records grounded:false + factsHash null (the vacuous-grounding hole stays visible)', () => {
     const sb = makeSandbox();
-    const r = run(sb, { args: ['code'], env: { AGY_FAKE_OUTPUT: VERDICT_OUTPUT } });
+    const r = run(sb, { args: ['code', '--ungrounded'], env: { AGY_FAKE_OUTPUT: VERDICT_OUTPUT } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -863,23 +953,21 @@ describe('agy-review.sh — review receipts (AD-038)', () => {
     assert.equal(receipts[0].factsHash, null);
   });
 
-  it('an EMPTY --facts file records grounded:false (fail-closed — vacuous grounding never satisfies the gate) and still warns', () => {
+  it('an EMPTY --facts file in code mode refuses pre-spend — no run, no receipt (D4 fail-closed)', () => {
     const sb = makeSandbox();
     writeFileSync(join(sb.home, 'empty-facts.md'), '');
     const r = run(sb, { args: ['code', '--facts', `@${join(sb.home, 'empty-facts.md')}`], env: { AGY_FAKE_OUTPUT: VERDICT_OUTPUT } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.home, { recursive: true, force: true });
-    assert.equal(r.status, 0, r.stderr);
-    assert.equal(receipts[0].grounded, false, 'an empty payload is recorded as ungrounded, never as grounded-by-flag');
-    assert.equal(receipts[0].factsHash, null);
-    assert.match(r.stderr, /no --facts supplied|ungrounded review GUESSES/, 'the ungrounded warning fires for an empty payload');
+    assert.equal(r.status, 2, 'vacuous grounding no longer spends a run');
+    assert.equal(r.invoked, false);
+    assert.equal(receipts.length, 0, 'no run — no receipt');
   });
 
-  it('parses REWORK and plain SHIP; records "unknown" when the mandated section is absent', () => {
+  it('parses REWORK and plain SHIP verbatim (an absent section is a FAILED run — the D4 describe owns that arm)', () => {
     for (const [output, want] of [
       ['### Verdict\nREWORK — the contract is violated.', 'REWORK'],
       ['### Verdict\nSHIP — clean.', 'SHIP'],
-      ['free-form text with no verdict heading', 'unknown'],
     ]) {
       const sb = makeSandbox();
       const r = run(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_OUTPUT: output } });
@@ -1177,3 +1265,93 @@ describe('agy-review.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
     }
   });
 });
+
+// ── strip-the-kit Phase 4: wrapper honesty (D4) + dispatch-posture labeling (D5) ────────────────
+describe('agy-review.sh — wrapper honesty: a verdict-less run is a FAILED review (D4)', () => {
+  it('a VERDICT-LESS review output: non-zero exit, NO receipt, the stated re-run recovery', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: 'prose without the mandated section' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0, 'a verdict-less review never exits 0');
+    assert.equal(receipts.length, 0, 'NO receipt is minted for a failed review');
+    assert.match(r.stderr, /### Verdict/, 'the missing section is named');
+    assert.match(r.stderr, /re-run/i, 'documented as a failed review — re-run, never fatal');
+  });
+
+  it('EMPTY review output is the same failed run (non-zero, no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('the closed vocabulary still parses (SHIP WITH NITS before SHIP; REWORK) and a recognized run exits 0', () => {
+    for (const [out, want] of [[VERDICT_OUTPUT, 'SHIP WITH NITS'], ['### Verdict\nREWORK — reasons.\n', 'REWORK']]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: out } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, r.stderr);
+      assert.equal(receipts[0].verdict, want);
+    }
+  });
+});
+
+describe('agy-review.sh — dispatch-posture labeling (D5)', () => {
+  it('ONE banner line carries the ACTUAL model and the receipt carries the SAME posture (agy has no tier)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'] });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=Gemini 3\.1 Pro \(High\)/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'Gemini 3.1 Pro (High)' }, 'banner ↔ receipt parity');
+    assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
+  });
+
+  it('an ATTESTING review with AGY_MODEL explicitly emptied REFUSES pre-spend naming the fix', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false, 'refused BEFORE any spend');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /AGY_MODEL/, 'the fix is named');
+  });
+
+  it('AGY_PROBE=1 with AGY_MODEL emptied still runs (probe exempt; posture model null on the probe receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: '', AGY_PROBE: '1' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].probe, true);
+    assert.deepEqual(receipts[0].posture, { model: null }, 'an unknowable model is recorded null, never guessed');
+  });
+
+  it('a HOSTILE model string (quotes + backslash) rides the receipt strictly JSON-encoded', () => {
+    const hostile = 'we"ird \\ mo"del';
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: hostile } });
+    const receipts = readReceipts(sb.repo); // JSON.parse throwing here IS the encoding failure
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].posture.model, hostile, 'the exact bytes round-trip through strict encoding');
+    assert.match(r.stderr, /review posture: /, 'the banner still renders');
+  });
+
+  it('a model string carrying CONTROL BYTES refuses pre-spend (never a broken banner or receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: `bad${String.fromCharCode(1)}model` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false);
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i);
+  });
+});

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,8 +3,9 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "2.7.0",
+  "version": "4.0.0",
   "provides": ["review", "probe"],
+  "posture": { "model": "Gemini 3.1 Pro (High)" },
   "roles": {
     "review": {
       "cmd": "agy-review",
@@ -14,13 +15,14 @@
       "output": "advisory",
       "contract": {
         "invocations": [
-          "agy-review code [--facts @f] [--decided @f] [--focus \"…\"] [extra focus…]",
+          "agy-review code [--facts @f] [--ungrounded] [--decided @f] [--focus \"…\"] [extra focus…]",
           "agy-review plan <plan-file> [--facts @f] [--decided @f] [--focus \"…\"]",
           "agy-review diff <diff-file> [--facts @f] [--decided @f] [--focus \"…\"]"
         ],
-        "grounding": "grounded review — agy reads NOTHING by default, an ungrounded review GUESSES: --facts @f = the verified facts to review AGAINST; --decided @f = decisions already made, do NOT re-raise (anti-circling)",
+        "grounding": "grounded review — agy reads NOTHING by default, an ungrounded review GUESSES: --facts @f = the verified facts to review AGAINST; --decided @f = decisions already made, do NOT re-raise (anti-circling). code mode REQUIRES a non-empty --facts payload and refuses BEFORE spending a run (escapes: --ungrounded, AGY_PROBE=1); plan/diff proceed with a loud warning",
         "flags": [
-          "--facts @f — verified facts the review runs AGAINST (omit ⇒ loud ungrounded-review warning)",
+          "--facts @f — verified facts the review runs AGAINST (code mode REQUIRES a non-empty payload; plan/diff warn loudly when omitted)",
+          "--ungrounded — deliberately ungrounded CODE review, a throwaway opinion (code mode only, contradicts --facts; the receipt records grounded:false and never attests)",
           "--decided @f — already-decided / already-addressed list; do NOT re-raise (anti-circling; the round-2 payload)",
           "--focus \"…\" — extra focus (repeatable; code mode also takes trailing focus words)"
         ],
@@ -28,7 +30,7 @@
           "agy-review --continue [--decided @f] [--focus \"…\"]",
           "agy-review --conversation <id> [--decided @f] [--focus \"…\"]"
         ],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a write failure warns, never fails the review",
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
         "notes": [
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt"
         ]
@@ -50,7 +52,8 @@
       "whenNotTo": ["a clean tree — the wrapper exits before spending a run"],
       "invocationRefs": [{ "contractField": "invocations", "index": 0 }],
       "operands": [
-        { "slot": "[--facts @f]", "required": false, "description": "the verified facts to review AGAINST; omitting it warns loudly and records the review ungrounded" },
+        { "slot": "[--facts @f]", "required": false, "description": "the verified facts to review AGAINST; code mode refuses pre-spend without a non-empty payload (escapes: --ungrounded, AGY_PROBE=1)" },
+        { "slot": "[--ungrounded]", "required": false, "description": "deliberately ungrounded code review — a throwaway opinion; the receipt records grounded:false and never attests" },
         { "slot": "[--decided @f]", "required": false, "description": "decisions already made; the reviewer must not re-raise them (anti-circling)" },
         { "slot": "[--focus \"…\"]", "required": false, "description": "what this review must look at (repeatable)" },
         { "slot": "[extra focus…]", "required": false, "description": "extra focus words appended to the review directive" }
@@ -59,6 +62,7 @@
         { "value": "read-only posture — the prompt forbids edits, commands and git writes", "enforcement": "advisory", "source": "bin/agy-review.sh" },
         { "value": "receives no ambient repo/file context by default — the wrapper passes no --add-dir", "enforcement": "enforced", "source": "bin/agy-review.sh" },
         { "value": "an ungrounded review guesses — stale-model and partial-diff false positives", "enforcement": "advisory", "source": "bin/agy-review.sh" },
+        { "value": "without a non-empty --facts payload the run refuses BEFORE the spend (exit 2) — the only escapes are --ungrounded and AGY_PROBE=1", "enforcement": "enforced", "source": "bin/agy-review.sh" },
         { "value": "an ungrounded run records grounded:false and the review-state gate rejects it", "enforcement": "enforced", "source": "capability.json roles.review.contract.receipt" },
         { "value": "an oversized prompt refuses rather than truncate", "enforcement": "enforced", "condition": "unless AGY_REVIEW_ALLOW_ADDDIR=1 offloads it to a private --add-dir staging dir", "source": "capability.json settings.AGY_REVIEW_ALLOW_ADDDIR" }
       ],
@@ -185,9 +189,9 @@
         "deliberately reviewing with a cheaper non-frontier model"
       ],
       "whenNotTo": ["any run whose output informs what ships — a probe never attests"],
-      "descriptor": "AGY_PROBE=1 agy-review code --facts @<facts-file>",
+      "descriptor": "AGY_PROBE=1 agy-review code [--facts @<facts-file>]",
       "operands": [
-        { "slot": "@<facts-file>", "required": true, "description": "the verified facts the review runs AGAINST" }
+        { "slot": "[--facts @<facts-file>]", "required": false, "description": "the verified facts the review runs AGAINST — a probe may run ungrounded (its receipt never attests either way)" }
       ],
       "guardrails": [
         { "value": "a probe review mints a probe-marked receipt the review-state gate rejects", "enforcement": "enforced", "source": "agent-workflow-kit tools/review-state.mjs" }