@sabaiway/agent-workflow-kit 2.0.0 → 3.0.0

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -58,13 +58,17 @@ prompt for `agy-run`. It **mechanizes the grounded-review contract** (see
 [`review-prompt.md`](./review-prompt.md)) so grounding is the enforced default, not a per-call effort:
 
 ```bash
-agy-review code  [--facts @facts.md] [--decided @decided.md] [--focus "…"] [extra focus…]
-agy-review plan  <plan-file> [--facts @f] [--decided @f] [--focus "…"]
+agy-review code  --facts @facts.md [--decided @decided.md] [--focus "…"] [extra focus…]   # facts REQUIRED — refuses pre-spend
+agy-review code  --ungrounded                  # explicit escape: throwaway ungrounded opinion (never attests)
+agy-review plan  <plan-file> [--facts @f] [--decided @f] [--focus "…"]   # no facts ⇒ loud warning, proceeds
 agy-review diff  <diff-file> [--facts @f] [--decided @f] [--focus "…"]
 agy-review --continue          [--decided @f] [--focus "…"]   # round-2 delta — no re-assembly
 agy-review --conversation <id> [--decided @f] [--focus "…"]
 ```
 
+`code` fails CLOSED without a non-empty `--facts` payload — the refusal fires before any run is
+spent; the explicit escapes are `--ungrounded` and `AGY_PROBE=1` (a probe never attests).
+
 What it does for you, and what YOU must supply:
 
 - **It** assembles POSTURE + a model/cutoff GUARD + your facts + your already-decided list + your focus

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -48,14 +48,15 @@ subscription invariant, and the byte ceiling all apply once. The playbook is in
 [`driving-agy.md`](./driving-agy.md); the surface:
 
 ```bash
-agy-review code|plan <file>|diff <file> [--facts @f] [--decided @f] [--focus "…"]
+agy-review code --facts @f [--decided @f] [--focus "…"]   # facts REQUIRED — refuses pre-spend (escapes: --ungrounded, AGY_PROBE=1)
+agy-review plan <file>|diff <file> [--facts @f] [--decided @f] [--focus "…"]
 agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   # round-2 delta
 ```
 
 | Var | Default | Effect |
 |---|---|---|
 | `AGY_MODEL` | `Gemini 3.1 Pro (High)` | frontier default; **any** model is allowed — a sub-frontier one earns a silenceable advisory (quality-first, not a gate) |
-| `AGY_PROBE` | `0` | `1` silences the off-frontier model advisory (throwaway probe) |
+| `AGY_PROBE` | `0` | `1` silences the off-frontier model advisory AND lets `code` run without `--facts` (an ungrounded probe never attests — its receipt is probe-marked) |
 | `AGY_REVIEW_ALLOW_ADDDIR` | `0` | `1` lets an oversized `code` review offload ONLY the change set to a private staging dir via `--add-dir` (the grounding stays inline; re-enables the Issue-001 stall risk — prefer splitting into focused reviews) |
 | `AGY_HARD_TIMEOUT` | `30m` | the review's hard cap (longer default than a probe — reviews are slower) |
 | `AGY_MAX_PROMPT_BYTES` | `120000` | the same single-argv byte ceiling; oversized → trim/split (or the `--add-dir` escape above) |

package/bridges/antigravity-cli-bridge/references/review-prompt.md

@@ -23,7 +23,7 @@ GUARD    Do NOT comment on AI model names/versions or your own knowledge cutoff
          and a known source of false positives. Review ONLY the engineering, AGAINST the facts.
 
 ## Grounded facts — review AGAINST these, do NOT guess the code
-{{GROUNDED_FACTS}}   # from --facts @file (omitted -> an in-band note + a LOUD stderr warning)
+{{GROUNDED_FACTS}}   # from --facts @file (code: REQUIRED non-empty, refuses pre-spend — escapes --ungrounded / AGY_PROBE=1; plan/diff omitted -> an in-band note + a LOUD stderr warning)
 
 ## Decisions already made / already addressed — do NOT re-raise these
 {{ALREADY_DECIDED}}  # from --decided @file (optional — the anti-circling lever; the round-2 payload)

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '2.8.0'
+  version: '3.0.0'
 ---
 
 # codex-cli-bridge
@@ -96,6 +96,13 @@ codex-review code                                # review the current working-tr
 codex-review code "focus on the new reducer"     # review with extra focus
 ```
 
+**Honesty + posture (D4/D5):** a run whose final message has no recognized
+`Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
+receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
+states the actual posture (`review posture: model=… effort=… tier=…`) and the receipt records the
+same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes in a
+posture value refuse pre-spend in every mode.
+
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's
 **final message** (`-o`; the JSON event stream + reasoning go to a discarded trace), so output is

package/bridges/codex-cli-bridge/bin/codex-review-honesty.test.mjs

@@ -0,0 +1,143 @@
+// codex-review-honesty.test.mjs — the round-1 hardening pins for the D4/D5 arms (strip Phase 4):
+// the schema-mode verdict is parsed STRUCTURALLY (a legal multiline JSON parses; a decoy
+// "verdict" inside a findings string never substitutes the top-level field; out-of-enum and
+// malformed JSON die on the D4 arm), and the control-byte pre-spend screen covers the RAW
+// CODEX_SERVICE_TIER BEFORE tier validation (no multiline warning echo, no silent standard-tier
+// run). Colocated separately — codex-review.test.mjs is red-proof-frozen; standalone harness.
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const WRAPPER = join(HERE, 'codex-review.sh');
+
+const FAKE_CODEX = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  'if [[ "${1:-}" == "login" ]]; then echo "Logged in using ChatGPT"; exit 0; fi',
+  'printf invoked > "${CODEX_FAKE_SENTINEL:-/dev/null}"',
+  'cat >/dev/null',
+  'out=""; prev=""',
+  'for a in "$@"; do if [[ "$prev" == "-o" || "$prev" == "--output-last-message" ]]; then out="$a"; fi; prev="$a"; done',
+  'if [[ -n "$out" ]]; then if [[ -z "${CODEX_FAKE_FINAL+x}" ]]; then printf "Verdict: ship\\n" >"$out"; else printf "%s\\n" "$CODEX_FAKE_FINAL" >"$out"; fi; fi',
+  'echo \'{"type":"thread.started","thread_id":"honesty-fake"}\'',
+  'exit 0',
+  '',
+].join('\n');
+
+const makePathWithout = (root, exclude = []) => {
+  const skip = new Set(exclude);
+  const dir = mkdtempSync(join(root, 'nobin-'));
+  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const name of names) {
+      if (skip.has(name)) continue;
+      const link = join(dir, name);
+      if (existsSync(link)) continue;
+      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
+    }
+  }
+  return dir;
+};
+
+const makeSandbox = () => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-honesty-'));
+  const bin = join(root, 'bin');
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
+  chmodSync(join(bin, 'codex'), 0o755);
+  const repo = join(root, 'repo');
+  mkdirSync(repo);
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  g('init', '-q');
+  g('config', 'user.email', 'probe@example.com');
+  g('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'AGENTS.md'), '# Hard Constraints\n');
+  g('add', '-A');
+  g('commit', '-qm', 'base');
+  writeFileSync(join(repo, 'pending.txt'), 'PENDING\n');
+  return { root, bin, repo };
+};
+
+const run = (sb, { args = ['code'], env = {} } = {}) => {
+  const sentinel = join(sb.root, 'cap-sentinel');
+  const r = spawnSync('bash', [WRAPPER, ...args], {
+    cwd: sb.repo,
+    encoding: 'utf8',
+    timeout: 30000,
+    env: {
+      HOME: sb.repo,
+      PATH: `${sb.bin}:${makePathWithout(sb.root, ['codex'])}`,
+      TMPDIR: process.env.TMPDIR ?? '/tmp',
+      CODEX_HOME: join(sb.root, 'codex-home'),
+      CODEX_FAKE_SENTINEL: sentinel,
+      ...env,
+    },
+  });
+  return { ...r, invoked: existsSync(sentinel) };
+};
+
+const readReceipts = (repo) => {
+  const p = join(repo, '.git', 'agent-workflow-review-receipts.jsonl');
+  if (!existsSync(p)) return [];
+  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+};
+
+describe('codex-review — schema-mode verdict is parsed STRUCTURALLY (M2)', () => {
+  it('a LEGAL multiline JSON final message (key/value split across lines) parses and attests', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{\n  "verdict":\n  "ship",\n  "findings": []\n}' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].verdict, 'ship', 'a formatting choice never fails a legal schema payload');
+  });
+
+  it('a DECOY "verdict" inside a findings STRING never substitutes the top-level field', () => {
+    const sb = makeSandbox();
+    const decoy = '{"verdict":"revise","findings":["the text \\"verdict\\": \\"ship\\" appeared in a doc line"]}';
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: decoy } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].verdict, 'revise', 'the TOP-LEVEL field is authoritative — a quoted decoy never wins');
+  });
+
+  it('an OUT-OF-ENUM top-level verdict dies on the D4 arm (no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{"verdict":"maybe","findings":[]}' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('MALFORMED JSON in schema mode dies on the D4 arm (no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{not json' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+});
+
+describe('codex-review — the RAW tier is control-byte-screened BEFORE validation (M4)', () => {
+  it('a CODEX_SERVICE_TIER carrying a control byte refuses pre-spend — codex never runs, no warning echo', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_SERVICE_TIER: `priority${String.fromCharCode(1)}` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false, 'refused BEFORE any spend');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i, 'named as the control-byte class');
+    assert.doesNotMatch(r.stderr, /not a supported service tier/, 'the validity warning never echoes a hostile value');
+  });
+});

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -64,8 +64,14 @@ Receipt:
   verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge,
   factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on
   EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a
-  probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a
-  write failure warns, never fails the review
+  probe review never attests) and equally rejects an unmarked one (silence is not a declaration);
+  posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written
+  on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5
+  wrapper minted it; re-run the review), one stderr banner line states the same posture, and a
+  posture value carrying control bytes refuses pre-spend in every mode; a run whose final message
+  carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included —
+  exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write
+  failure warns, never fails the review
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -73,6 +79,13 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 1800)
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
+Honesty + posture (D4/D5):
+  a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or
+  missing output included — exits 4 with NO receipt: a FAILED review to RE-RUN, never a fatal
+  session error. One stderr banner line states the ACTUAL run posture (review posture: model=…
+  effort=… tier=…) and the receipt records the same posture {model, effort, tier} (tier null on
+  the standard tier). A posture value carrying control bytes refuses pre-spend in every mode.
+
 Environment: CODEX_REVIEW_SCHEMA=1 (structured JSON findings), CODEX_HARD_TIMEOUT (seconds, default 1800), CODEX_PROBE=1 (throwaway probe only), AW_REVIEW_RECEIPTS (receipt file override).
 Requires at run time: the codex CLI on PATH, a ChatGPT-subscription login, a git work tree with a root AGENTS.md (--help needs none of these).
 HELP
@@ -193,7 +206,7 @@ DEFAULT_CODEX_EFFORT="xhigh"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="2.8.0"
+AW_BRIDGE_VERSION="3.0.0"
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
 # Generous hard cap for a slow xhigh review (subscription latency varies).
@@ -209,6 +222,15 @@ CODEX_REVIEW_MAX_TOTAL_BYTES="${CODEX_REVIEW_MAX_TOTAL_BYTES:-1500000}"
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
+# D5 pre-spend control-byte screen — BEFORE tier validation (a malformed value is not a policy
+# question; validating first would echo the hostile value into a multiline warning and then run
+# on the standard tier, defeating the stated refusal). Screens the RAW model/effort/tier.
+for _posture_pair in "CODEX_MODEL=$CODEX_MODEL" "CODEX_EFFORT=$CODEX_EFFORT" "CODEX_SERVICE_TIER=$CODEX_SERVICE_TIER"; do
+  if [[ "${_posture_pair#*=}" == *[$'\x01'-$'\x1f']* ]]; then
+    echo "error: ${_posture_pair%%=*} contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+    exit 2
+  fi
+done
 if [[ -n "$CODEX_SERVICE_TIER" ]] && ! aw_settings_valid CODEX_SERVICE_TIER "$CODEX_SERVICE_TIER"; then
   echo "warning: CODEX_SERVICE_TIER='$CODEX_SERVICE_TIER' is not a supported service tier ('priority') — running on the standard tier." >&2
   CODEX_SERVICE_TIER=""
@@ -219,6 +241,11 @@ if [[ -n "$CODEX_SERVICE_TIER" ]]; then
 fi
 CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 
+# --- D5 banner (one line, the ACTUAL run posture) -------------------------------------------
+# The control-byte screen already ran above (BEFORE tier validation); the banner states the
+# EFFECTIVE posture (post tier validation) and the receipt records the same fields.
+echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard}" >&2
+
 # --- Quality-first guard: refuse a silent model/effort downgrade ---------------
 # A relaxed run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
 # review-state gate rejects it — "do NOT use this as a real review" becomes a mechanism, not a plea.
@@ -421,6 +448,24 @@ receipt_json_scalar() {
   if [[ -z "${1:-}" ]]; then printf 'null'; else printf '"%s"' "$1"; fi
 }
 
+# STRICT JSON string encoding for the free-form posture fields (model/effort ride env/settings):
+# backslash then double-quote escaped. Control bytes never reach here — the D5 pre-spend gate
+# refuses them, so these two escapes make the encoding total.
+json_string_escape() {
+  local s="${1//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  printf '%s' "$s"
+}
+
+# The D5 posture object this wrapper writes into EVERY receipt: the ACTUAL {model, effort, tier}
+# of the run (tier null on the standard tier — the validated CODEX_SERVICE_TIER is the one source).
+posture_json() {
+  local tier_json='null'
+  if [[ -n "${CODEX_SERVICE_TIER:-}" ]]; then tier_json="\"$(json_string_escape "$CODEX_SERVICE_TIER")\""; fi
+  printf '{"model":"%s","effort":"%s","tier":%s}' \
+    "$(json_string_escape "$CODEX_MODEL")" "$(json_string_escape "$CODEX_EFFORT")" "$tier_json"
+}
+
 # write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false]
 # Appends ONE receipt line (the AD-038 fixture shape) as a side effect of a SUCCESSFUL review —
 # to $AW_REVIEW_RECEIPTS when set, else <git dir>/agent-workflow-review-receipts.jsonl (inside the
@@ -444,10 +489,10 @@ write_review_receipt() {
   fi
   local line probe_field=',"probe":false'
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s}' \
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
@@ -648,7 +693,11 @@ codex_cmd=("${codex_flags[@]}" -)
 invoke_codex
 
 # Raw-text fallback: if the structured-findings run failed (not a timeout), retry
-# once WITHOUT the schema rather than lose the review — loud, never silent.
+# once WITHOUT the schema rather than lose the review — loud, never silent. The verdict parse
+# tracks the run that actually SUCCEEDED: a fallback run emits the TEXT verdict line, so parsing
+# it in schema mode would read every fallback as verdict-less (a guaranteed D4 failure).
+verdict_parse_mode="text"
+if [[ -n "$schema_file" ]]; then verdict_parse_mode="schema"; fi
 if [[ -n "$schema_file" && $rc -ne 0 && $rc -ne 124 && $rc -ne 137 ]]; then
   echo "warning: the --output-schema run failed (exit $rc) — retrying once without the schema constraint." >&2
   codex_cmd=()
@@ -657,6 +706,7 @@ if [[ -n "$schema_file" && $rc -ne 0 && $rc -ne 124 && $rc -ne 137 ]]; then
     codex_cmd+=("$_f")
   done
   codex_cmd+=(-)
+  verdict_parse_mode="text"
   invoke_codex
 fi
 
@@ -688,16 +738,27 @@ fi
 
 # --- Review receipt (AD-038): parse the verdict, append one receipt line ------
 # Text mode parses the mandated literal 'Verdict: <ship|revise|rethink>' line; CODEX_REVIEW_SCHEMA=1
-# reads the schema's "verdict" field instead; absent either way → "unknown" (recorded, never guessed).
+# reads the schema's "verdict" field instead. D4 (wrapper honesty): NO recognized verdict —
+# empty/missing final message included — is a FAILED review: non-zero exit, NO receipt; a failed
+# review to RE-RUN, never a fatal session error (documented in --help).
 verdict=""
 if [[ -f "$out" && -s "$out" ]]; then
-  if [[ "${CODEX_REVIEW_SCHEMA:-}" == "1" ]]; then
-    verdict="$(sed -nE 's/.*"verdict"[[:space:]]*:[[:space:]]*"(ship|revise|rethink)".*/\1/p' "$out" | tail -n1)"
+  if [[ "$verdict_parse_mode" == "schema" ]]; then
+    # STRUCTURAL parse (round-1 fold): the TOP-LEVEL `verdict` field of the schema payload,
+    # accepted only inside the closed enum — a legal multiline layout parses, a decoy "verdict"
+    # inside a findings string never substitutes, malformed/out-of-enum stays empty (the D4
+    # failed-run arm). Node ≥22 is a family floor, so the one-liner adds no dependency.
+    verdict="$(node -e 'try{const v=JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).verdict;if(["ship","revise","rethink"].includes(v))process.stdout.write(v);}catch{}' "$out" 2>/dev/null || true)"
   else
     verdict="$(sed -nE 's/^Verdict: (ship|revise|rethink)[[:space:]]*$/\1/p' "$out" | tail -n1)"
   fi
 fi
-[[ -z "$verdict" ]] && verdict="unknown"
+if [[ -z "$verdict" ]]; then
+  echo "error: the review produced no recognized 'Verdict: <ship|revise|rethink>' line (empty or" >&2
+  echo "       verdict-less final message) — a FAILED review; NO receipt was written. Re-run the" >&2
+  echo "       review; if it recurs, inspect the captured output for what the model produced." >&2
+  exit 4
+fi
 # codex is grounded by construction (AGENTS.md auto-merge + the precomputed change set): grounded
 # true, factsHash null (native grounding — no separate facts payload exists). Every codex run is a
 # full fresh run (one-shot, no resume) → fresh:true. $REVIEW_PROBE marks a guards-relaxed run.

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -37,7 +37,9 @@ const FAKE_CODEX = [
   '  if [[ "$prev" == "-o" || "$prev" == "--output-last-message" ]]; then out="$a"; fi',
   '  prev="$a"',
   'done',
-  'if [[ -n "$out" && "${CODEX_FAKE_NO_OUT:-}" != "1" ]]; then echo "${CODEX_FAKE_FINAL:-FAKE_FINAL_MESSAGE}" >"$out"; fi',
+  // Unset CODEX_FAKE_FINAL → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
+  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
+  'if [[ -n "$out" && "${CODEX_FAKE_NO_OUT:-}" != "1" ]]; then if [[ -z "${CODEX_FAKE_FINAL+x}" ]]; then printf "FAKE_FINAL_MESSAGE\\nVerdict: ship\\n" >"$out"; else printf "%s\\n" "$CODEX_FAKE_FINAL" >"$out"; fi; fi',
   'if [[ "${CODEX_FAKE_NO_THREAD:-}" != "1" ]]; then',
   'cat <<EOF',
   '{"type":"thread.started","thread_id":"${CODEX_FAKE_THREAD_ID:-fake-thread-123}"}',
@@ -366,7 +368,8 @@ describe('codex-review.sh — precomputed diff for code mode (2.1)', () => {
 describe('codex-review.sh — optional structured findings (2.2)', () => {
   it('CODEX_REVIEW_SCHEMA=1 passes --output-schema to codex', () => {
     const sb = makeSandbox();
-    const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1' } });
+    // Schema mode parses the schema's verdict FIELD (D4) — the fixture output must carry it.
+    const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{"verdict":"ship","findings":[]}' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.argv, /(^|\n)--output-schema(\n|$)/);
@@ -379,8 +382,11 @@ describe('codex-review.sh — optional structured findings (2.2)', () => {
     assert.doesNotMatch(r.argv, /--output-schema/);
   });
 
-  it('falls back to a raw-text run when the schema run fails (loud; exit 0)', () => {
+  it('falls back to a raw-text run when the schema run fails (loud; exit 0) — and parses the TEXT verdict', () => {
     const sb = makeSandbox();
+    // No CODEX_FAKE_FINAL: the fallback run emits the TEXT default (FAKE_FINAL_MESSAGE +
+    // Verdict: ship) — the wrapper must parse the mode of the run that actually SUCCEEDED,
+    // or every fallback would read verdict-less and die on the D4 arm.
     const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FAIL_ON_SCHEMA: '1' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -527,13 +533,13 @@ describe('codex-review.sh — assemble & output edge cases', () => {
     assert.match(r.capStdin, /Extra focus: watch the parser/);
   });
 
-  it('warns and prints the trace tail when codex writes no final-message file', () => {
+  it('warns and prints the trace tail when codex writes no final-message file (then fails the D4 arm)', () => {
     const sb = makeSandbox();
     const r = run(sb, { args: ['code'], env: { CODEX_FAKE_NO_OUT: '1' } });
     rmSync(sb.root, { recursive: true, force: true });
-    assert.equal(r.status, 0, r.stderr);
+    assert.notEqual(r.status, 0, 'no final message ⇒ no verdict ⇒ a FAILED review (D4)');
     assert.match(r.stderr, /no final-message file/);
-    assert.match(r.stdout, /turn\.completed/, 'the trace tail carries the event stream');
+    assert.match(r.stdout, /turn\.completed/, 'the trace tail still carries the event stream');
   });
 
   it('prints no session line when codex emits no thread id', () => {
@@ -812,7 +818,7 @@ describe('codex-review.sh — mode catalog ⟷ wrapper reality (manifest-pinned)
 // The normative fixture: the AD-038 shape + the D3 self-declaring probe marker (field VALUES with
 // dynamic content are asserted by shape):
 const RECEIPT_FIXTURE = JSON.parse(
-  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false}',
+  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<m>","effort":"<e>","tier":null}}',
 );
 const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
 const readReceipts = (repo) => {
@@ -905,13 +911,13 @@ describe('codex-review.sh — review receipts (AD-038)', () => {
     assert.equal(receipts[0].verdict, 'ship');
   });
 
-  it('no parseable verdict → recorded as "unknown", never guessed', () => {
+  it('no parseable verdict is a FAILED run — never recorded as "unknown" (D4 owns the arm)', () => {
     const sb = makeSandbox();
     const r = run(sb, { env: { CODEX_FAKE_FINAL: 'looks fine to me overall' } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
-    assert.equal(r.status, 0, r.stderr);
-    assert.equal(receipts[0].verdict, 'unknown');
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0, 'an unknown verdict never reaches the receipt store');
   });
 
   it('plan mode: artifact "plan", fingerprint = the artifact-file sha256', () => {
@@ -1195,3 +1201,80 @@ describe('codex-review.sh — settings surface ⟷ manifest (D6, manifest-pinned
     }
   });
 });
+
+// ── strip-the-kit Phase 4: wrapper honesty (D4) + dispatch-posture labeling (D5) ────────────────
+describe('codex-review.sh — wrapper honesty: a verdict-less run is a FAILED review (D4)', () => {
+  it('a VERDICT-LESS final message: non-zero exit, NO receipt, the stated re-run recovery', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_FINAL: 'prose without the mandated verdict line' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0, 'a verdict-less review never exits 0');
+    assert.equal(receipts.length, 0, 'NO receipt is minted for a failed review');
+    assert.match(r.stderr, /Verdict/, 'the missing line is named');
+    assert.match(r.stderr, /re-run/i, 'documented as a failed review — re-run, never fatal');
+  });
+
+  it('an EMPTY final message is the same failed run (non-zero, no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_FINAL: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('a MISSING final-message file is the same failed run', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_NO_OUT: '1' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+});
+
+describe('codex-review.sh — dispatch-posture labeling (D5)', () => {
+  it('ONE banner line carries the ACTUAL {model, effort, tier} and the receipt carries the SAME posture', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {});
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=standard/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'gpt-5.6-sol', effort: 'xhigh', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
+    assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
+  });
+
+  it('an ARMED Fast tier rides both surfaces (banner tier=priority; receipt tier "priority")', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_SERVICE_TIER: 'priority' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=priority/);
+    assert.equal(receipts[0].posture.tier, 'priority');
+  });
+
+  it('a HOSTILE model string (quotes + backslash) rides the receipt strictly JSON-encoded (probe lane)', () => {
+    const hostile = 'we"ird \\ mo"del';
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: hostile } });
+    const receipts = readReceipts(sb.repo); // JSON.parse throwing here IS the encoding failure
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].posture.model, hostile, 'the exact bytes round-trip through strict encoding');
+    assert.equal(receipts[0].probe, true, 'an off-pinned model runs only on the probe lane');
+  });
+
+  it('a posture value carrying CONTROL BYTES refuses pre-spend, BEFORE the frontier guard', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(1)}` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.capStdin, '', 'codex is never invoked');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i, 'named as the control-byte class, not a policy refusal');
+  });
+});

package/bridges/codex-cli-bridge/capability.json

@@ -3,7 +3,8 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "2.8.0",
+  "version": "3.0.0",
+  "posture": { "model": "gpt-5.6-sol", "effort": "xhigh", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
     "execute": {
@@ -42,7 +43,7 @@
         ],
         "grounding": "automatic — the wrapper precomputes the full working-tree change set (repo map, status, diffs, untracked contents) and codex auto-merges the root AGENTS.md; no grounding flags",
         "continue": [],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a write failure warns, never fails the review"
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review"
       }
     }
   },

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "provides": [],
   "roles": {},
   "detect": {

package/migrations/3.0.0-hardened-core-loop.md

@@ -0,0 +1,44 @@
+# Migration 3.0.0-hardened-core-loop
+
+**From:** versions < 3.0.0   **To:** 3.0.0
+
+## Why
+
+3.0.0 replaces the recorded review-loop machinery (review-ledger / fold-completeness /
+verification-profile) with a COMPUTED core: red-proof custody + changed-line coverage inside
+`run-gates --final`, ship-class review receipts with self-declared probe AND posture markers,
+and an optional pre-commit guard that binds a commit to the latest green final-run receipt.
+The retired tools no longer exist; a declaration or receipt that references them stops working
+loudly, never silently.
+
+## Steps
+
+1. **Node floor:** ensure Node **>= 22** (the built-in lcov reporter the loop consumes).
+2. **Gates declaration:** preview the consented migration —
+   `node <installed-kit>/references/scripts/migrate-gates.mjs --kit-tools <installed-kit>/tools --cwd <project>`
+   — then re-run with `--apply` on an explicit yes. It removes retired ledger/fold gates,
+   wires the lcov reporters into the canonical `unit-tests` cmd, appends the canonical
+   `coverage-check` gate LAST, and cleans retired git-dir stores. CUSTOMIZED entries are
+   reported with a paste-ready recovery — resolve them by hand.
+3. **Review receipts:** receipts minted by pre-3.0.0/4.0.0 bridge wrappers carry no `posture`
+   field and STOP satisfying the review-state gate (fail-closed, the probe-marker precedent).
+   Refresh the placed bridges (init/upgrade does this), then re-run the required reviews.
+4. **Commit guard (optional, consented):** a 2.x deployment's project-local
+   `scripts/install-git-hooks.mjs` PREDATES the arm and the upgrade preserves existing scripts —
+   refresh it FIRST, classified deterministically:
+   `cmp -s scripts/install-git-hooks.mjs <installed-kit>/references/scripts/install-git-hooks.mjs`
+   — identical ⇒ already current; DIFFERING ⇒ the copy is UNKNOWN (older deploy or customized —
+   a consumer cannot enumerate shipped priors) ⇒ STOP and merge/replace by hand, never
+   overwrite unasked (an explicit "my copy is an unmodified older deploy" answer is the one
+   auto-replace lane). Then, once the declaration is final-run-capable, arm it:
+   `node scripts/install-git-hooks.mjs --commit-guard "<installed-kit>/tools/commit-guard.mjs"`
+   (the Recommendations advisor surfaces the exact one-liner) — and VERIFY the arm took:
+   `grep -Fx 'node "<installed-kit>/tools/commit-guard.mjs" --check' "$(git rev-parse --git-path hooks)/pre-commit"`
+   (the FIXED-STRING resolved line, exactly as the installer writes it) — absent ⇒ the arm did
+   not take; re-run the installer refresh above before re-arming.
+5. **Re-stamp:** init/upgrade re-stamps `docs/ai/.workflow-version` to 3.0.0.
+
+## Verification
+
+`node <installed-kit>/tools/run-gates.mjs --final` exits 0 and records a green receipt;
+`node <installed-kit>/tools/review-state.mjs --check` names any remaining obligation.

package/migrations/README.md

@@ -10,7 +10,7 @@ releases add files/templates, which `upgrade` reconciles without a migration.
 1. Read the project's stamped version from `docs/ai/.workflow-version`.
 2. Select every migration whose `<version>` is **strictly newer** than the stamp.
 3. Apply them in **ascending semver order**.
-4. Re-stamp `docs/ai/.workflow-version` to the **deployment-lineage head** (`2.0.0` today — the
+4. Re-stamp `docs/ai/.workflow-version` to the **deployment-lineage head** (`3.0.0` today — the
    shared lineage, **not** this skill's npm package version). A stamp greater than the head → STOP.
 
 ## Authoring rules