@sabaiway/agent-workflow-kit 2.1.0 → 3.1.0

package/tools/inject-methodology.mjs

@@ -18,7 +18,7 @@
 // The live read is lazy + fail-loud: resolve+read the engine ONLY when a fill is actually needed, and
 // STOP loudly (never a silent fallback) when the engine is needed but absent/invalid.
 //
-// Pure string functions (testable with byte-preservation fixtures); dependency-free, Node >= 18.
+// Pure string functions (testable with byte-preservation fixtures); dependency-free, Node >= 22.
 //
 // Canonical-refresh (AD-025): a slot filled BEFORE a clause existed is normally preserved verbatim
 // (reconcile only fills an EMPTY slot). To push a NEW canonical clause to the EXISTING filled base
@@ -314,11 +314,31 @@ const isCapRefusal = (errorMessage) => typeof errorMessage === 'string' && error
 export const isFillCapRefusal = (errorMessage) =>
   isCapRefusal(errorMessage) && errorMessage.includes('injection would push');
 
-const main = async (argv) => {
+const EXIT = Symbol('inject-methodology.exit');
+
+// The return-code entry point (5.1): argv[] + injected env/home → { code, stdout, stderr }, no
+// process.argv / process.exit / console inside — an in-process caller is as hermetic as a spawned
+// one. The thin shell at the bottom is the only process-coupled code.
+export const runCli = async (argv, deps = {}) => {
   const { readFile, writeFile, rename, rm } = await import('node:fs/promises');
   const { dirname, basename, join, resolve } = await import('node:path');
   const { homedir } = await import('node:os');
   const { resolveEngineDir, readEngineFragment, detectEngine, ENGINE_FRAGMENT_REL, ORCHESTRATION_FRAGMENT_REL, AUTONOMY_FRAGMENT_REL } = await import('./engine-source.mjs');
+  const env = deps.env ?? process.env;
+  const home = deps.home ?? homedir();
+
+  const stdoutLines = [];
+  const stderrLines = [];
+  const log = (line) => stdoutLines.push(line);
+  const logError = (line) => stderrLines.push(line);
+  const result = (code) => ({
+    code,
+    stdout: stdoutLines.length > 0 ? `${stdoutLines.join('\n')}\n` : '',
+    stderr: stderrLines.length > 0 ? `${stderrLines.join('\n')}\n` : '',
+  });
+  // Nested sourcing helpers end the run from arbitrary depth — a tagged throw the catch below
+  // translates into the result code (the process.exit of the pre-entry-point CLI).
+  const stop = (code) => Object.assign(new Error(`exit ${code}`), { [EXIT]: code });
 
   // `reconcile <AGENTS.md> [fragment.md]` = ensure-slot + inject-if-empty + cap (bootstrap/upgrade) for
   // ALL THREE slots; `<AGENTS.md> [fragment.md]` = the legacy inject-into-existing-(methodology)-slot mode.
@@ -326,10 +346,11 @@ const main = async (argv) => {
   const rest = mode === 'reconcile' ? argv.slice(1) : argv;
   const agentsPath = rest[0];
   if (!agentsPath) {
-    console.error('usage: inject-methodology.mjs [reconcile] <path/to/AGENTS.md> [fragment.md]');
-    process.exit(2);
+    logError('usage: inject-methodology.mjs [reconcile] <path/to/AGENTS.md> [fragment.md]');
+    return result(2);
   }
   const explicitFragmentArg = rest[1];
+  try {
   const text = await readFile(resolve(agentsPath), 'utf8');
 
   // Source a bounded fragment LAZILY, per slot. An explicit [fragment.md] arg (tests + manual) wins and
@@ -339,7 +360,7 @@ const main = async (argv) => {
   // the install command. The caller only invokes this when a fill is actually needed (the laziness).
   const sourceFragment = async (rel) => {
     if (explicitFragmentArg) return readFile(resolve(explicitFragmentArg), 'utf8');
-    const { dir, source } = resolveEngineDir({ env: process.env, home: homedir() });
+    const { dir, source } = resolveEngineDir({ env, home });
     return readEngineFragment(dir, { source, rel }); // sync; throws loudly when the engine is absent/invalid
   };
   const sourceFragmentOrStop = async (label, rel) => {
@@ -348,8 +369,8 @@ const main = async (argv) => {
     } catch (err) {
       // Engine needed-but-absent → a hard STOP, distinct from the soft cap-skip. The "methodology
       // engine not found/invalid" prefix lets the agent classify this exit (SKILL.md).
-      console.error(`[inject-methodology] ${label} — ${err.message}`);
-      process.exit(1);
+      logError(`[inject-methodology] ${label} — ${err.message}`);
+      throw stop(1);
     }
   };
 
@@ -362,16 +383,16 @@ const main = async (argv) => {
   // an unreadable fragment). Returns { fragment } on success, { skip } for the soft case, or
   // process.exit(1) for the hard STOP.
   const sourceChainedFragment = async (rel) => {
-    const { dir, source } = resolveEngineDir({ env: process.env, home: homedir() });
-    const stop = (err) => {
-      console.error(`[inject-methodology] reconcile STOP — ${err.message}`);
-      process.exit(1);
+    const { dir, source } = resolveEngineDir({ env, home });
+    const chainedStop = (err) => {
+      logError(`[inject-methodology] reconcile STOP — ${err.message}`);
+      throw stop(1);
     };
     if (detectEngine(dir, { source, rel }).ok) {
       try {
         return { fragment: readEngineFragment(dir, { source, rel }) };
       } catch (err) {
-        stop(err);
+        chainedStop(err);
       }
     }
     if (detectEngine(dir, { source }).ok) {
@@ -380,7 +401,7 @@ const main = async (argv) => {
     try {
       readEngineFragment(dir, { source, rel }); // throws the canonical install-me error
     } catch (err) {
-      stop(err);
+      chainedStop(err);
     }
   };
 
@@ -402,8 +423,8 @@ const main = async (argv) => {
     if (methResult.status === 'error') {
       // cap-refusal OR malformed/anchor STOP — preserve the single-slot classification (SKILL.md
       // distinguishes by the message); the file is byte-for-byte unchanged either way.
-      console.error(`[inject-methodology] reconcile refused — ${methResult.error}`);
-      process.exit(1);
+      logError(`[inject-methodology] reconcile refused — ${methResult.error}`);
+      return result(1);
     }
     const afterMeth = methResult.text; // === text when the methodology slot was already filled (custom)
     const describeMeth = {
@@ -421,18 +442,18 @@ const main = async (argv) => {
       const u = markerSlotUpgradeHint(afterMeth, METHODOLOGY_DESCRIPTOR); if (u) notes.push(u);
     }
     const reportNotes = () => {
-      for (const n of notes) console.log(`[inject-methodology] note: ${n}`);
+      for (const n of notes) log(`[inject-methodology] note: ${n}`);
     };
 
     // ── Explicit [fragment.md] binds methodology ONLY → skip the orchestration + autonomy reconciles ──
     if (explicitFragmentArg) {
       if (afterMeth === text) {
-        console.log('[inject-methodology] methodology slot already present and filled — nothing to do (zero-diff).');
-        return;
+        log('[inject-methodology] methodology slot already present and filled — nothing to do (zero-diff).');
+        return result(0);
       }
       await writeAtomic(afterMeth);
-      console.log(`[inject-methodology] reconcile: ${describeMeth}.`);
-      return;
+      log(`[inject-methodology] reconcile: ${describeMeth}.`);
+      return result(0);
     }
 
     // ── Slot 2: orchestration, reconciled on the methodology-reconciled text (the cap-check then guards
@@ -459,8 +480,8 @@ const main = async (argv) => {
           describeOrch = `orchestration-recipes pointer skipped — ${orchResult.error}`;
         } else {
           // Malformed orchestration slot/anchor → a hard STOP. No partial write.
-          console.error(`[inject-methodology] reconcile refused (orchestration) — ${orchResult.error}`);
-          process.exit(1);
+          logError(`[inject-methodology] reconcile refused (orchestration) — ${orchResult.error}`);
+          return result(1);
         }
       } else {
         finalText = orchResult.text;
@@ -493,8 +514,8 @@ const main = async (argv) => {
       // Malformed markers are a hard STOP on EVERY lane — validated before the soft-skip
       // short-circuits so a duplicate/reversed autonomy pair can never ride out as a "skip"
       // alongside a partial (methodology) write.
-      console.error(`[inject-methodology] reconcile refused (autonomy) — ${autSlot.reason}`);
-      process.exit(1);
+      logError(`[inject-methodology] reconcile refused (autonomy) — ${autSlot.reason}`);
+      return result(1);
     }
     if (orchSkipped) {
       // The chain is CAUSAL, not merely positional: a pointer never lands in a run that withheld
@@ -523,8 +544,8 @@ const main = async (argv) => {
             autSkipped = true;
             describeAut = `autonomy pointer skipped — ${autResult.error}`;
           } else {
-            console.error(`[inject-methodology] reconcile refused (autonomy) — ${autResult.error}`);
-            process.exit(1);
+            logError(`[inject-methodology] reconcile refused (autonomy) — ${autResult.error}`);
+            return result(1);
           }
         } else {
           finalText = autResult.text;
@@ -545,34 +566,44 @@ const main = async (argv) => {
     // ── One atomic write of the final (three-slot) text ──
     if (finalText === text) {
       // Byte-unchanged. Still report a skip (it is not "nothing to do" — a pointer was withheld).
-      if (orchSkipped || autSkipped) console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
-      else console.log('[inject-methodology] reconcile: all three pointers already present and filled — nothing to do (zero-diff).');
+      if (orchSkipped || autSkipped) log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
+      else log('[inject-methodology] reconcile: all three pointers already present and filled — nothing to do (zero-diff).');
       reportNotes();
-      return;
+      return result(0);
     }
     await writeAtomic(finalText);
-    console.log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
+    log(`[inject-methodology] reconcile: ${describeMeth}; ${describeOrch}; ${describeAut}.`);
     reportNotes();
-    return;
+    return result(0);
   }
 
   // Legacy inject-into-existing-slot mode (METHODOLOGY only). injectMethodology no-ops on absent markers
   // and errors on a malformed slot WITHOUT reading the fragment, so resolve+read the engine only when
   // there is a present (ok) slot to fill — a markerless legacy AGENTS.md stays a no-op without the engine.
   const fragment = findSlot(text).state === 'ok' ? await sourceFragmentOrStop('STOP', ENGINE_FRAGMENT_REL) : '';
-  const result = injectMethodology(text, fragment, { maxLines: AGENTS_MD_CAP });
-  if (result.status === 'error') {
-    console.error(`[inject-methodology] malformed slot — refusing to edit: ${result.error}`);
-    process.exit(1);
+  const injected = injectMethodology(text, fragment, { maxLines: AGENTS_MD_CAP });
+  if (injected.status === 'error') {
+    logError(`[inject-methodology] malformed slot — refusing to edit: ${injected.error}`);
+    return result(1);
+  }
+  if (injected.status === 'noop-absent') {
+    log('[inject-methodology] no methodology markers found — nothing to inject (legacy AGENTS.md).');
+    return result(0);
   }
-  if (result.status === 'noop-absent') {
-    console.log('[inject-methodology] no methodology markers found — nothing to inject (legacy AGENTS.md).');
-    return;
+  await writeAtomic(injected.text);
+  log('[inject-methodology] injected the bounded methodology fragment into the slot.');
+  return result(0);
+  } catch (err) {
+    if (err[EXIT] !== undefined) return result(err[EXIT]);
+    throw err;
   }
-  await writeAtomic(result.text);
-  console.log('[inject-methodology] injected the bounded methodology fragment into the slot.');
 };
 
 const { pathToFileURL } = await import('node:url');
 const isDirectRun = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
-if (isDirectRun) await main(process.argv.slice(2));
+if (isDirectRun) {
+  const { code, stdout, stderr } = await runCli(process.argv.slice(2));
+  if (stdout) process.stdout.write(stdout);
+  if (stderr) process.stderr.write(stderr);
+  process.exitCode = code;
+}

package/tools/known-footprint.mjs

@@ -14,7 +14,7 @@
 // count sentinel + intrinsic invariants (anchoring, uniqueness, disjointness, no subsumption) — and
 // references/contracts.md carries the human-readable mirror table, kept in sync by review.
 //
-// Pure, dependency-free, Node >= 18. The only fs touch is expandGlob (readdir/stat of a glob parent),
+// Pure, dependency-free, Node >= 22. The only fs touch is expandGlob (readdir/stat of a glob parent),
 // injected so the registry stays unit-testable without the real filesystem.
 
 import { readdirSync, statSync } from 'node:fs';

package/tools/labels.mjs

@@ -7,7 +7,7 @@
 // imports family-registry for vocabulary, and family-registry imports + re-exports the public subset
 // it exported before (the 7 state constants + DISPLAY_NAMES), so every existing importer stays green.
 //
-// Pure data, no side effects, Node >= 18. Every export is frozen — this is a contract, not a mutable.
+// Pure data, no side effects, Node >= 22. Every export is frozen — this is a contract, not a mutable.
 
 // ── manifestState values (internal; the detect-backends precedence, generalized to any member) ──────
 // These are INTERNAL — they must never reach a user surface verbatim (mapped through STATE_PUBLIC

package/tools/lcov.mjs

@@ -1,11 +1,7 @@
 #!/usr/bin/env node
-// lcov.mjs — a dependency-free LCOV parser for the fold-completeness runner's coverage.kind:"lcov"
-// branch (BUGFREE-3, AD-049 — the language-independence contract). When a verification profile
-// declares coverage.kind:"lcov", the consumer's OWN suite leaves an LCOV file at the declared path
-// (the diff-cover / c8 --reporter=lcov pattern) and this module reads it into a per-file
-// line→hits map, keyed by the SAME canonical absolute path the V8 coverage map uses — so the
-// runner's ONE uncovered-changed loop consumes either source unchanged (computeUncoveredLines /
-// effectiveCount stay the V8-only path, D10).
+// lcov.mjs — a dependency-free LCOV parser for the coverage-check final-run checker (D3(d)).
+// The declared unit-tests gate leaves an LCOV file at the fixed git-dir path and this module reads
+// it into a per-file line→hits map, keyed by a canonical absolute path.
 //
 // FAIL-CLOSED posture (the whole reason the fold gate exists): a malformed record can never mark a
 // line COVERED — a DA with a valid line but a non-integer HIT count reads the line UNCOVERED (hits 0,
@@ -16,7 +12,7 @@
 // changed executable line with NO DA entry reads non-executable — LCOV carries no separate
 // executability signal; the V8 path, which reads an absent line as uncovered, differs by format.)
 //
-// Dependency-free, Node >= 18. No side effects on import.
+// Dependency-free, Node >= 22. No side effects on import.
 
 import { join, resolve, isAbsolute, sep } from 'node:path';
 import { realpathSync } from 'node:fs';
@@ -80,8 +76,8 @@ const defaultCanon = (p) => {
 };
 
 // Segment-safe containment ('/a' never contains '/ab'); correct at the filesystem root (mirrors
-// fold-completeness-run.mjs containsPath). Defined locally so lcov.mjs never imports the runner (the
-// runner imports THIS module).
+// core-evidence.mjs containsPath). Defined locally so lcov.mjs imports no family module (its
+// consumers import THIS module).
 const containsPath = (realRoot, realAbs) =>
   realAbs === realRoot || realAbs.startsWith(realRoot.endsWith(sep) ? realRoot : realRoot + sep);
 

package/tools/lens-region.mjs

@@ -22,7 +22,7 @@
 // never a silent truncate; a file without frontmatter/`maxLines` skips the guard with a stated
 // note (such a file is outside the docs cap gate anyway).
 //
-// Pure string functions (fs only in the CLI); dependency-free, Node >= 18.
+// Pure string functions (fs only in the CLI); dependency-free, Node >= 22.
 
 import { normalizeCanonical } from './orchestration-config.mjs';
 

package/tools/manifest/validate.mjs

@@ -704,6 +704,25 @@ export const validateManifest = (skillDir) => {
     else validateModeCatalog(modeCatalog, roles, errors);
   }
 
+  // `posture` (strip-the-kit D5): the DEFAULT dispatch posture pins the wrapper ships — the
+  // checkable source the kit renders the configured posture from (before D5 these lived only in
+  // shell defaults + prose). ADDITIVE-OPTIONAL like modeCatalog (absence = a bridge predating
+  // posture labeling); a PRESENT block is typed-validated with the SAME shape rule the receipt
+  // predicate applies (isValidReceiptPosture's manifest twin): `model` a non-empty string;
+  // `effort` (when present) a non-empty string; `tier` (when present) a non-empty string or null.
+  if (Object.hasOwn(manifest, 'posture')) {
+    const posture = manifest.posture;
+    if (posture === null || typeof posture !== 'object' || Array.isArray(posture)) {
+      errors.push('`posture` must be an object of dispatch-posture pins');
+    } else {
+      if (typeof posture.model !== 'string' || posture.model.length === 0) errors.push('`posture.model` must be a non-empty string');
+      if (Object.hasOwn(posture, 'effort') && (typeof posture.effort !== 'string' || posture.effort.length === 0)) errors.push('`posture.effort` (when declared) must be a non-empty string');
+      if (Object.hasOwn(posture, 'tier') && posture.tier !== null && (typeof posture.tier !== 'string' || posture.tier.length === 0)) errors.push('`posture.tier` (when declared) must be a non-empty string or null');
+      const unknown = Object.keys(posture).filter((k) => !['model', 'effort', 'tier'].includes(k));
+      if (unknown.length > 0) errors.push(`\`posture\` carries unknown key(s): ${unknown.join(', ')} (closed vocabulary: model, effort, tier)`);
+    }
+  }
+
   if (!isStub) {
     const auth = readAuthoritativeVersion(skillDir);
     if (auth.version == null) errors.push(`could not resolve an authoritative version (${auth.from})`);

package/tools/migrate-adr-store.mjs

@@ -23,7 +23,7 @@
 //
 // Write discipline: preview (--dry-run) is the DEFAULT and writes NOTHING; --apply performs the
 // migration. It NEVER commits. Exit codes: 0 done / dry-run / no-op; 1 precondition STOP (no
-// deployment, no writable snapshot base, a failed migration); 2 usage. Dependency-free, Node >= 18.
+// deployment, no writable snapshot base, a failed migration); 2 usage. Dependency-free, Node >= 22.
 // No side effects on import.
 
 import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, writeFileSync, chmodSync } from 'node:fs';
@@ -65,7 +65,7 @@ conservation proof) and writes NOTHING. --apply snapshots, force-refreshes the e
 then runs the conservation-checked migration. It NEVER commits — review the tree and commit yourself.`;
 
 // The mutually-exclusive dry-run/apply parse (a consent-gated writer never lets a later flag silently
-// decide whether it mutates) + --cwd, cloned from the seed-gates writer contract.
+// decide whether it mutates) + --cwd — the family's shared consented-writer contract.
 export const parseArgs = (argv) => {
   const parsed = argv.reduce(
     (acc, a, i) => {
@@ -125,7 +125,7 @@ const isUnder = (child, parent) => {
 
 // The ordered snapshot bases that are provably NOT stageable: the git dir first (always safe), then the
 // fallback base ONLY when its snapshot dir lands OUTSIDE cwd (else it is in the work tree and could be
-// committed — reject it; codex R1 minor). Returns [{ base, dir, viaGitDir }] (possibly empty).
+// committed — reject it). Returns [{ base, dir, viaGitDir }] (possibly empty).
 const snapshotBases = (cwd, stamp, gitDir, fallbackBase) => {
   const bases = [];
   if (gitDir) bases.push({ base: gitDir, dir: resolve(gitDir, `${SNAPSHOT_PREFIX}-${stamp}`), viaGitDir: true });
@@ -226,14 +226,14 @@ export const main = (argv = process.argv.slice(2), deps = {}) => {
       log(`  snapshot → ${preview.dir ? `${preview.dir} (${preview.viaGitDir ? 'git dir' : 'out-of-tree fallback'})` : 'NONE — no out-of-tree location; run inside a git repo (apply would refuse otherwise)'}`);
       log(`  refresh ${refresh.length} enforcement script(s) to this kit's version${drifted.length ? ` (${drifted.length} locally differ: ${drifted.map((r) => r.name).join(', ')})` : ''}`);
       log('  then the conservation-checked rotation:');
-      // Surface the rotation's own exit code (codex R1 major): a failed dry-run must NOT print the
+      // Surface the rotation's own exit code: a failed dry-run must NOT print the
       // "run with --apply" go-ahead nor exit 0 — it would send the user to --apply on an unsafe tree.
       const code = runMigrate(['--migrate'], { root: cwd, log: (m) => log(`    ${m}`), logError: (m) => error(`    ${m}`) });
       if (code !== EXIT_OK) {
         throw stop(`the dry-run rotation would not conserve every ADR (exit ${code}) — NOT safe to --apply; fix the reported problem, then re-run.`);
       }
       // A null preview means --apply would refuse (no out-of-tree snapshot base) — never green-light it
-      // (codex R2 minor: a dry-run go-ahead must not send the user to an apply that will STOP).
+      // A dry-run go-ahead must not send the user to an apply that will STOP.
       if (preview.dir === null) {
         throw stop('no out-of-tree snapshot location — --apply would refuse; run inside a git repo (or point the fallback outside the project), then re-run.');
       }

package/tools/orchestration-config.mjs

@@ -16,7 +16,7 @@
 //
 // This module performs NO filesystem WRITES — only reads (loadConfig). The single fs-writer lives in
 // orchestration-write.mjs, which procedures.mjs never imports, so "procedures never reaches a writer"
-// is structurally true. Pure-where-possible (fs injectable), dependency-free, Node >= 18. No side
+// is structurally true. Pure-where-possible (fs injectable), dependency-free, Node >= 22. No side
 // effects on import.
 
 import { readFileSync, lstatSync } from 'node:fs';

package/tools/orchestration-write.mjs

@@ -10,7 +10,7 @@
 // consumed here with this module's own STOP identity, so the public API + error contract are
 // unchanged (this file's tests pin them, characterize-first).
 //
-// Dependency-free, Node >= 18. Every fs primitive is injectable (deps.*) so the guards are unit-testable.
+// Dependency-free, Node >= 22. Every fs primitive is injectable (deps.*) so the guards are unit-testable.
 
 import { CONFIG_REL, serializeConfig } from './orchestration-config.mjs';
 import { writeDocsAiFileAtomic } from './atomic-write.mjs';

package/tools/presentation.mjs

@@ -6,7 +6,7 @@
 // in the user's language per SKILL.md §4.4 — it never reads this file. Keeping the vocabulary here (a
 // frozen leaf) means the renderers carry no inline strings and the phrasing is pinned by tests.
 //
-// Pure data, no side effects, Node >= 18. Every export frozen.
+// Pure data, no side effects, Node >= 22. Every export frozen.
 
 // public state token (STATE_PUBLIC value) → the direct-CLI English phrase. `installed` is null because
 // an installed member shows its VERSION, not a phrase (the renderer special-cases it). Mirrors the

package/tools/procedures.mjs

@@ -9,7 +9,7 @@
 //
 // Invariants (mirror recipes.mjs): pure-where-possible, READ-ONLY (never writes, never commits, never
 // runs a subscription CLI). The deterministic resolution lives in the kit (resolveActivityRecipe), not
-// in the agent. Dependency-free, Node >= 18.
+// in the agent. Dependency-free, Node >= 22.
 //
 // Exit codes: 0 success (an unsatisfiable explicit override degrades LOUDLY but still exits 0 — it is a
 // valid request that gracefully degraded); 2 usage (unknown <activity> / bad --override syntax);
@@ -213,7 +213,7 @@ const reviewLoopAdvice = (slots, activity) =>
         '  • At the cap, classify every surviving blocking finding: fixable-bug (fold ONCE as a red→green test, re-review) / inherent-layer-residual (document + raise to an acceptance criterion) / escalate (the maintainer decides); a minor never forces triage.',
         ...(activity === 'plan-execution'
           ? [
-              '  • The computed instrument for THIS loop: run the FULL gate matrix with run-gates --record BEFORE recording a round (the green-baseline receipt the writer demands), then record each round + triage via review-ledger (record / classify); rounds, caps, and teeth are per SEGMENT (base = HEAD — the counter resets only at a gated commit); read the stop with review-ledger --status (its render replaces the hand-composed tally); gate the commit with review-ledger --check.',
+              '  • The computed instrument for THIS loop: declare each bugfix red BEFORE the fix (core-evidence red-proof — observed N/N red, custody-hashed); an unavailable backend gets an explicit core-evidence degrade record, never a silent skip; then stage everything, run the reviews on the STAGED tree, and mint the ONE receipt with run-gates --final (coverage + red-proof verification ride the final run); the commit is gated by commit-guard --check (the D13 ordering: any edit after the final run re-stales it); read the loop state statelessly with core-evidence summary.',
             ]
           : []),
       ]
@@ -234,7 +234,7 @@ const groundingPreStepAdvice = (activity, slots, plans) => {
   if (!slots.some((s) => (s.backends ?? []).includes('agy-review'))) return [];
   const planArg = plans.length === 1 ? `--plan "${PLANS_REL}/${plans[0]}"` : '--plan <path>';
   // plan-authoring reviews the plan FILE — when exactly one plan is in flight, the review command
-  // is populated with the same discovered path (codex R3: a known path never renders a placeholder).
+  // is populated with the same discovered path (a known path never renders a placeholder).
   const reviewForm =
     activity === 'plan-authoring'
       ? plans.length === 1

package/tools/recipes.mjs

@@ -12,14 +12,14 @@
 // Invariants (the backends/status posture): pure (no fs/network/CLI in planRecipe/recommendRecipe),
 // read-only, NEVER runs a subscription CLI. The kit only surfaces/selects/plans a recipe — the
 // orchestrator (the main agent) executes it via the bridge skills and always makes the single commit;
-// a backend is advisory or delegated, never autonomous. Dependency-free, Node >= 18.
+// a backend is advisory or delegated, never autonomous. Dependency-free, Node >= 22.
 
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 // The host-level bridge-settings snapshot (fact-only, best-effort). READ-ONLY core only — never the
 // writer — so this read-only advisor never pulls in the atomic-write core.
-import { settingsSnapshot } from './bridge-settings-read.mjs';
+import { settingsSnapshot, DEFAULT_BUNDLE_ROOT } from './bridge-settings-read.mjs';
 import {
   detectBackends,
   wrapperCmdFor,
@@ -298,7 +298,50 @@ export const resolveActivityRecipe = ({ config = {}, readiness = [], activity, s
 // DISPLAY_ALIASES — the ONE alias table the recommendation clause already uses; ordering is the
 // deterministic BACKEND_PRIORITY (codex before agy), independent of detection emission order.
 // Always exactly one line: no part may carry a newline (pinned by tests).
-export const composeStatusLine = (detection, recommendation, settings = null, autonomy = null) => {
+// composeConfiguredPosture(ctx) → the CONFIGURED dispatch posture (strip-the-kit D5), rendered
+// from the bundled manifests' VALIDATED posture pins overlaid with the ACTIVE bridge-settings —
+// today only the codex tier knob (bridge-settings stays model/effort-free by design, so this
+// surface can never carry a settings-file model claim). Returns null when NO bundled bridge
+// declares a posture block (a pre-D5 bundle keeps every surface byte-identical). Best-effort:
+// a corrupt bundle degrades to null — the posture segment is a footer fact, never a gate.
+export const composeConfiguredPosture = (ctx = {}) => {
+  try {
+    const bundleRoot = ctx.bundleRoot ?? DEFAULT_BUNDLE_ROOT;
+    const read = ctx.readFile ?? readFileSync;
+    const parts = [];
+    for (const name of BACKEND_PRIORITY) {
+      let manifest;
+      try {
+        manifest = JSON.parse(String(read(join(bundleRoot, name, 'capability.json'), 'utf8')));
+      } catch {
+        return null; // an unreadable/corrupt manifest is CORRUPTION — a partial posture would lie
+      }
+      if (!Object.hasOwn(manifest, 'posture')) continue; // a pre-D5 bridge — legitimate absence
+      const posture = manifest.posture;
+      // The FULL closed shape (the validator/receipt-predicate twin): a present-but-invalid
+      // block nulls the WHOLE render — fail closed to silence, never a partial/mangled line.
+      const invalid =
+        posture === null || typeof posture !== 'object' || Array.isArray(posture) ||
+        typeof posture.model !== 'string' || posture.model.length === 0 ||
+        (Object.hasOwn(posture, 'effort') && (typeof posture.effort !== 'string' || posture.effort.length === 0)) ||
+        (Object.hasOwn(posture, 'tier') && posture.tier !== null && (typeof posture.tier !== 'string' || posture.tier.length === 0)) ||
+        Object.keys(posture).some((k) => !['model', 'effort', 'tier'].includes(k));
+      if (invalid) return null;
+      const seg = [`model=${posture.model}`];
+      if (Object.hasOwn(posture, 'effort')) seg.push(`effort=${posture.effort}`);
+      if (Object.hasOwn(posture, 'tier')) {
+        const knob = (ctx.settings?.active ?? []).find((s) => s.key === 'CODEX_SERVICE_TIER' && s.bridge === name);
+        seg.push(knob ? `tier=${knob.value} (bridge-settings)` : `tier=${posture.tier ?? 'standard'}`);
+      }
+      parts.push(`${DISPLAY_ALIASES[name] ?? name} ${seg.join(' ')}`);
+    }
+    return parts.length ? parts.join(' · ') : null;
+  } catch {
+    return null;
+  }
+};
+
+export const composeStatusLine = (detection, recommendation, settings = null, autonomy = null, posture = null) => {
   const backends = [...detection]
     .sort((a, b) => priorityIndex(a.name) - priorityIndex(b.name))
     .map((b) => `${DISPLAY_ALIASES[b.name] ?? b.name} ${b.readiness === READY ? '✓' : '✗'} ${b.readiness}`)
@@ -315,7 +358,10 @@ export const composeStatusLine = (detection, recommendation, settings = null, au
   // suffix precedent). Fact-only: effective per-activity levels + the render-sync state; an absent
   // policy says "computed defaults" honestly; a malformed policy surfaces LOUDLY, never omitted.
   const autonomySegment = autonomy == null ? '' : ` · autonomy: ${oneLine(formatAutonomySegment(autonomy))}`;
-  return base + suffix + autonomySegment;
+  // The D5 posture segment: rendered ONLY when the caller supplies the composed pins-derived
+  // posture (composeConfiguredPosture) — an omitted/null param keeps the line byte-identical.
+  const postureSegment = posture == null ? '' : ` · posture: ${oneLine(posture)}`;
+  return base + suffix + autonomySegment + postureSegment;
 };
 
 // The one-segment autonomy renderer behind composeStatusLine's 4th param.
@@ -414,7 +460,7 @@ export const composeActiveRecipeLine = ({ config, source } = {}, detection, auto
   const rec = recommendRecipe(detection);
   const origin = source === 'none' || config == null ? 'no config file — computed defaults apply' : `from ${source}`;
   // A MALFORMED policy must surface LOUDLY on this paste surface too — silently rendering cells
-  // without levels would hide the required STOP signal (codex R1, Segment B). One line always.
+  // without levels would hide the required STOP signal (Segment B). One line always.
   const malformed = autonomy?.error
     ? ` · autonomy: MALFORMED policy — ${String(autonomy.error).replace(/[\s]+/g, ' ').trim()}`
     : '';
@@ -425,7 +471,7 @@ export const composeActiveRecipeLine = ({ config, source } = {}, detection, auto
 
 // The structured report behind `--json` — the recipes, the recommendation, a plan per recipe, and
 // (additive) the pasteable one-line backend status composed from the same detection.
-export const buildReport = (detection, settings = null, autonomy = null) => {
+export const buildReport = (detection, settings = null, autonomy = null, posture = null) => {
   const recommendation = recommendRecipe(detection);
   return {
     recipes: RECIPES.map(({ id, title, role, minBackends, degradesTo, summary }) => ({
@@ -439,8 +485,8 @@ export const buildReport = (detection, settings = null, autonomy = null) => {
     recommendation,
     plans: RECIPES.map((r) => planRecipe(r.id, detection)),
     // The SAME autonomy facts the --status-line surface renders — the --json envelope must never
-    // expose a stale machine-composed status line (codex R1, Segment B).
-    statusLine: composeStatusLine(detection, recommendation, settings, autonomy),
+    // expose a stale machine-composed status line (Segment B).
+    statusLine: composeStatusLine(detection, recommendation, settings, autonomy, posture),
   };
 };
 
@@ -512,8 +558,13 @@ exclusive. Detection only — never writes, never commits, never runs a subscrip
       console.error(`[agent-workflow-kit] ${err.message}`);
       return err.exitCode ?? 1;
     }
-  } else if (argv.includes('--status-line')) console.log(composeStatusLine(detection, recommendRecipe(detection), settingsSnapshot(), await composeAutonomyFacts(process.cwd())));
-  else if (argv.includes('--json')) console.log(JSON.stringify(buildReport(detection, settingsSnapshot(), await composeAutonomyFacts(process.cwd())), null, 2));
+  } else if (argv.includes('--status-line')) {
+    const snapshot = settingsSnapshot();
+    console.log(composeStatusLine(detection, recommendRecipe(detection), snapshot, await composeAutonomyFacts(process.cwd()), composeConfiguredPosture({ settings: snapshot })));
+  } else if (argv.includes('--json')) {
+    const snapshot = settingsSnapshot();
+    console.log(JSON.stringify(buildReport(detection, snapshot, await composeAutonomyFacts(process.cwd()), composeConfiguredPosture({ settings: snapshot })), null, 2));
+  }
   else console.log(formatRecipes(detection));
   return 0;
 };