@sabaiway/agent-workflow-kit 2.1.0 → 3.1.0

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -98,14 +98,28 @@ Receipt:
   payload; a continuation receipt is fresh:false (informational-only — it cannot attest the
   folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY
   receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe
-  review never attests) and equally rejects an unmarked one (silence is not a declaration); a write
-  failure warns, never fails the review
+  review never attests) and equally rejects an unmarked one (silence is not a declaration);
+  posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the
+  gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the
+  review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL
+  explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses
+  pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty
+  output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session
+  error); a write failure warns, never fails the review
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
   AGY_HARD_TIMEOUT — hard wall-clock cap, duration string like 5m/30m/90s (built-in default 30m)
   AGY_REVIEW_ALLOW_ADDDIR — boolean 0/1: 1 arms the oversized --add-dir escape (re-enables the Issue-001 stall risk; default 0)
 
+Honesty + posture (D4/D5):
+  a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4
+  with NO receipt: a FAILED review to RE-RUN, never a fatal session error. One stderr banner line
+  states the ACTUAL run posture (review posture: model=…) and the receipt records the same
+  posture {model} (agy has no tier). An ATTESTING review with AGY_MODEL explicitly emptied
+  refuses pre-spend (the actual model would be unknowable; AGY_PROBE=1 is exempt), and a model
+  string carrying control bytes refuses pre-spend in every mode.
+
 Closed grammar: unknown flags are rejected; no '--' passthrough (the flag escape is --ungrounded; the env escapes are AGY_PROBE=1 and AGY_REVIEW_ALLOW_ADDDIR=1).
 Requires at run time: the agy CLI on PATH + a Google AI subscription login (--help needs neither).
 HELP
@@ -225,9 +239,15 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.1 Pro (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="3.0.0"
+AW_BRIDGE_VERSION="4.0.0"
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
+# D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
+# other interpolation) can echo raw newline/ESC bytes into stderr/the terminal (round-2 fold).
+if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f']* ]]; then
+  echo "error: AGY_MODEL contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
 # Frontier review models. ANY model is allowed; a sub-frontier one only earns a soft, silenceable warning.
 FRONTIER_SET=("Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonnet 4.6 (Thinking)")
 
@@ -444,6 +464,26 @@ receipt_json_scalar() {
   if [[ -z "${1:-}" ]]; then printf 'null'; else printf '"%s"' "$1"; fi
 }
 
+# STRICT JSON string encoding for the ONE free-form receipt field (the posture model display
+# string): backslash then double-quote escaped. Control bytes never reach here — the posture
+# resolution refuses them pre-spend (D5), so these two escapes make the encoding total.
+json_string_escape() {
+  local s="${1//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  printf '%s' "$s"
+}
+
+# The D5 posture object this wrapper writes into EVERY receipt (agy has no tier — the label is
+# the model display string). An unknowable model (explicitly emptied on an exempt probe run) is
+# recorded null, never guessed.
+posture_json() {
+  if [[ -z "${AGY_MODEL:-}" ]]; then
+    printf '{"model":null}'
+  else
+    printf '{"model":"%s"}' "$(json_string_escape "$AGY_MODEL")"
+  fi
+}
+
 # write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false]
 # Appends ONE receipt line (the AD-038 fixture shape) as a side effect of a SUCCESSFUL review —
 # to $AW_REVIEW_RECEIPTS when set, else <git dir>/agent-workflow-review-receipts.jsonl (inside the
@@ -467,28 +507,29 @@ write_review_receipt() {
   fi
   local line probe_field=',"probe":false'
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s}' \
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
   fi
 }
 
-# Parse the mandated '### Verdict' section of a captured review: the first non-empty line after the
-# heading, matched against the closed verdict vocabulary (SHIP WITH NITS before SHIP — substring).
-# No heading / no match → "unknown" (recorded, never guessed).
+# Parse the mandated '### Verdict' section of a captured review: the first non-empty line after
+# the EXACT heading (`### Verdicts` or any suffix never matches), tested against the closed
+# vocabulary as an ANCHORED PREFIX with a word boundary — the verdict line must START with the
+# token and the next char must be non-word/EOL (SHIP WITH NITS before SHIP; `NOT SHIP` and
+# `SHIPPING` never match). No heading / no match → "unknown" (the D4 failed-run arm owns it).
 parse_agy_verdict() { # $1 = captured-output file
   local line
-  line="$(awk '/^### Verdict/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null)"
-  case "$line" in
-    *"SHIP WITH NITS"*) printf 'SHIP WITH NITS' ;;
-    *REWORK*)           printf 'REWORK' ;;
-    *SHIP*)             printf 'SHIP' ;;
-    *)                  printf 'unknown' ;;
-  esac
+  line="$(awk '/^### Verdict[[:space:]]*$/{flag=1; next} flag && NF {print; exit}' "$1" 2>/dev/null)"
+  if [[ "$line" =~ ^SHIP\ WITH\ NITS([^[:alnum:]_]|$) ]]; then printf 'SHIP WITH NITS'
+  elif [[ "$line" =~ ^REWORK([^[:alnum:]_]|$) ]]; then printf 'REWORK'
+  elif [[ "$line" =~ ^SHIP([^[:alnum:]_]|$) ]]; then printf 'SHIP'
+  else printf 'unknown'
+  fi
 }
 
 # Emit the full review surface to stdout: repo map, status (never-committable untracked records
@@ -828,6 +869,21 @@ else
   fi
 fi
 
+# --- D5 pre-spend posture gate + banner (one line, the ACTUAL run posture) ------------------
+# The control-byte screen already ran at AGY_MODEL resolution (before any interpolation). An
+# ATTESTING review (fresh code mode, guards on) whose wrapper cannot know the actual model
+# (AGY_MODEL explicitly emptied → the CLI's own settings default decides) refuses pre-spend;
+# AGY_PROBE=1 runs are exempt (their receipts never attest and record model null).
+# Scoped to the ATTESTING branch only (grounded code, guards on): plan / diff / --ungrounded
+# code mint receipts that never attest, so an emptied model just records posture.model null.
+if [[ -z "$AGY_MODEL" && -z "$resume_mode" && "$REVIEW_PROBE" != "true" && "$REVIEW_ARTIFACT" == "code" && -n "$FACTS_CONTENT" ]]; then
+  echo "error: AGY_MODEL is explicitly empty, so the ACTUAL review model is unknowable (the agy CLI's" >&2
+  echo "       own settings default decides) — an attesting review refuses pre-spend. Fix: unset" >&2
+  echo "       AGY_MODEL (wrapper default), or set the real model display string; AGY_PROBE=1 is exempt." >&2
+  exit 2
+fi
+echo "review posture: model=${AGY_MODEL:-<agy settings default>}" >&2
+
 # --- Execute via agy-run (single home of timeout + subscription + byte ceiling) ---
 # The output is teed into the private staging dir so the mandated '### Verdict' section can be
 # parsed into the review receipt — the user-facing stream is unchanged.
@@ -845,8 +901,17 @@ fi
 set -e
 
 # --- Review receipt (AD-038): only a SUCCESSFUL review attests --------------------
+# D4 (wrapper honesty): a run that produced NO recognized '### Verdict' section — empty output
+# included — is a FAILED review: non-zero exit, NO receipt. This is a failed review to RE-RUN,
+# never a fatal session error (documented in --help).
 if [[ $rc -eq 0 ]]; then
   verdict="$(parse_agy_verdict "$review_out_file")"
+  if [[ "$verdict" == "unknown" ]]; then
+    echo "error: the review output carries no recognized '### Verdict' section (closed vocabulary:" >&2
+    echo "       SHIP / SHIP WITH NITS / REWORK) — a FAILED review; NO receipt was written. Re-run" >&2
+    echo "       the review; if it recurs, inspect the captured output for what the model produced." >&2
+    exit 4
+  fi
   if [[ -n "$resume_mode" ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -1,13 +1,13 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import {
   mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
-  existsSync, readdirSync, symlinkSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'agy-review.sh');
@@ -38,7 +38,9 @@ const FAKE_AGY = [
   '  fi; prev="$a"',
   'done',
   'if [[ -n "${AGY_FAKE_SLEEP:-}" ]]; then sleep "$AGY_FAKE_SLEEP"; fi',
-  'printf "%s\\n" "${AGY_FAKE_OUTPUT:-FAKE_AGY_REVIEW_OUTPUT}"',
+  // Unset AGY_FAKE_OUTPUT → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
+  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
+  'if [[ -z "${AGY_FAKE_OUTPUT+x}" ]]; then printf "FAKE_AGY_REVIEW_OUTPUT\\n### Verdict\\nSHIP\\n"; else printf "%s\\n" "$AGY_FAKE_OUTPUT"; fi',
   'exit "${AGY_FAKE_EXIT:-0}"',
   '',
 ].join('\n');
@@ -63,15 +65,23 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
-// `clean: true` leaves a pristine committed tree (for the no-diff preflight); the default leaves one
-// untracked file so `code` mode has a diff to review.
-const makeSandbox = ({ clean = false } = {}) => {
-  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
+// The PATH farms and the sandbox base are READ-ONLY per invocation, so both are built ONCE and
+// shared: a per-run farm rebuild (thousands of symlinks) plus a per-test `git init`+commit were
+// the suite's dominant wall cost, not the wrapper under test.
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-review-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const farms = new Map();
+const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
+const TEMPLATE_HOME = (() => {
+  const home = join(SHARED_ROOT, 'template-home');
   const bin = join(home, '.local', 'bin');
   mkdirSync(bin, { recursive: true });
-  const stub = join(bin, 'agy');
-  writeFileSync(stub, FAKE_AGY, { mode: 0o755 });
-  chmodSync(stub, 0o755);
+  writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
   const repo = join(home, 'repo');
   mkdirSync(repo);
   const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
@@ -81,13 +91,25 @@ const makeSandbox = ({ clean = false } = {}) => {
   writeFileSync(join(repo, 'base.txt'), 'committed base\n');
   g('add', '-A');
   g('commit', '-qm', 'base');
+  return home;
+})();
+
+// `clean: true` leaves a pristine committed tree (for the no-diff preflight); the default leaves one
+// untracked file so `code` mode has a diff to review.
+const makeSandbox = ({ clean = false } = {}) => {
+  const home = mkdtempSync(join(tmpdir(), 'agy-review-test-'));
+  cpSync(TEMPLATE_HOME, home, { recursive: true });
+  const bin = join(home, '.local', 'bin');
+  chmodSync(join(bin, 'agy'), 0o755);
+  const repo = join(home, 'repo');
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
   if (!clean) writeFileSync(join(repo, 'pending.txt'), 'PENDING_UNTRACKED_BODY\n');
   return { home, bin, repo, g };
 };
 
 const run = (sb, { args, env = {}, cwd } = {}) => {
   const { home, bin, repo } = sb;
-  const farm = makePathWithout(home, ['agy', 'agy-run']);
+  const farm = farmFor(['agy', 'agy-run']);
   const cap = {
     argv: join(home, 'cap-argv'), env: join(home, 'cap-env'), prompt: join(home, 'cap-prompt'),
     sentinel: join(home, 'cap-sentinel'), adddir: join(home, 'cap-adddir'),
@@ -120,6 +142,44 @@ const run = (sb, { args, env = {}, cwd } = {}) => {
   };
 };
 
+// Async twin of run() for the two sleep-bound timeout tests: spawnSync blocks the event loop
+// for the whole deliberate wait, so a concurrent describe could not overlap them. Same spawn
+// contract and captures.
+const runAsync = (sb, { args, env = {}, cwd } = {}) =>
+  new Promise((done) => {
+    const { home, bin, repo } = sb;
+    const cap = {
+      argv: join(home, 'cap-argv'), env: join(home, 'cap-env'), prompt: join(home, 'cap-prompt'),
+      sentinel: join(home, 'cap-sentinel'), adddir: join(home, 'cap-adddir'),
+      adddirMode: join(home, 'cap-adddir-mode'), artifactMode: join(home, 'cap-artifact-mode'),
+      artifactCopy: join(home, 'cap-artifact-copy'),
+    };
+    const child = execFile('bash', [WRAPPER, ...args], {
+      cwd: cwd || repo,
+      encoding: 'utf8',
+      timeout: 30000,
+      env: {
+        HOME: home,
+        PATH: `${bin}:${farmFor(['agy', 'agy-run'])}`,
+        TMPDIR: process.env.TMPDIR ?? '/tmp',
+        AGY_FAKE_ARGV: cap.argv, AGY_FAKE_ENV: cap.env, AGY_FAKE_PROMPT: cap.prompt,
+        AGY_FAKE_SENTINEL: cap.sentinel, AGY_FAKE_ADDDIR: cap.adddir, AGY_FAKE_ADDDIR_MODE: cap.adddirMode,
+        AGY_FAKE_ARTIFACT_MODE: cap.artifactMode, AGY_FAKE_ARTIFACT_COPY: cap.artifactCopy,
+        ...env,
+      },
+    }, (error, stdout, stderr) => {
+      const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+      done({
+        status: error ? (error.code ?? 1) : 0, stdout, stderr,
+        invoked: existsSync(cap.sentinel),
+        argv: readIf(cap.argv), capEnv: readIf(cap.env), prompt: readIf(cap.prompt),
+        adddir: readIf(cap.adddir).trim(), adddirMode: readIf(cap.adddirMode).trim(),
+        artifactMode: readIf(cap.artifactMode).trim(), artifactCopy: readIf(cap.artifactCopy),
+      });
+    });
+    child.stdin.end();
+  });
+
 describe('agy-review.sh — model policy advisory (1)', () => {
   it('warns for a non-frontier model but still runs', () => {
     const sb = makeSandbox();
@@ -422,11 +482,11 @@ describe('agy-review.sh — resume / round-2 delta (7)', () => {
   });
 });
 
-describe('agy-review.sh — delegated guards inherited via agy-run (9, 10)', () => {
-  it('hard timeout: a sleeping stub is killed at AGY_HARD_TIMEOUT', () => {
+describe('agy-review.sh — delegated guards inherited via agy-run (9, 10)', { concurrency: true }, () => {
+  it('hard timeout: a sleeping stub is killed at AGY_HARD_TIMEOUT', async () => {
     const sb = makeSandbox();
     const started = Date.now();
-    const r = run(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_SLEEP: '30', AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s' } });
+    const r = await runAsync(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_SLEEP: '30', AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s' } });
     const elapsed = Date.now() - started;
     rmSync(sb.home, { recursive: true, force: true });
     assert.ok(elapsed < 20000, `must return well under the kill-after window, took ${elapsed}ms`);
@@ -550,7 +610,7 @@ const runHelp = (arg) => {
   const root = mkdtempSync(join(tmpdir(), 'agy-review-help-'));
   const nongit = join(root, 'nongit');
   mkdirSync(nongit, { recursive: true });
-  const path = makePathWithout(root, ['codex', 'agy', 'git']);
+  const path = farmFor(['codex', 'agy', 'git']);
   const r = spawnSync('bash', [WRAPPER, arg], {
     cwd: nongit, encoding: 'utf8', timeout: 15000, env: { HOME: root, PATH: path },
   });
@@ -870,7 +930,7 @@ describe('agy-review.sh — declared contract is really accepted (forward guard)
 // The normative fixture: the AD-038 shape + the D3 self-declaring probe marker (backend/verdict here
 // carry this bridge's vocabulary; dynamic values are asserted by shape):
 const RECEIPT_FIXTURE = JSON.parse(
-  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false}',
+  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<display>"}}',
 );
 const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
 const readReceipts = (repo) => {
@@ -962,11 +1022,10 @@ describe('agy-review.sh — review receipts (AD-038)', () => {
     assert.equal(receipts.length, 0, 'no run — no receipt');
   });
 
-  it('parses REWORK and plain SHIP; records "unknown" when the mandated section is absent', () => {
+  it('parses REWORK and plain SHIP verbatim (an absent section is a FAILED run — the D4 describe owns that arm)', () => {
     for (const [output, want] of [
       ['### Verdict\nREWORK — the contract is violated.', 'REWORK'],
       ['### Verdict\nSHIP — clean.', 'SHIP'],
-      ['free-form text with no verdict heading', 'unknown'],
     ]) {
       const sb = makeSandbox();
       const r = run(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_OUTPUT: output } });
@@ -1077,7 +1136,7 @@ const writeSettings = (sb, text) => {
 };
 const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
 
-describe('agy-review.sh — bridge settings file (bridges 2.3.0)', () => {
+describe('agy-review.sh — bridge settings file (bridges 2.3.0)', { concurrency: true }, () => {
   it('a file-set AGY_REVIEW_ALLOW_ADDDIR=1 arms the oversized --add-dir escape', () => {
     const sb = makeSandbox();
     writeFileSync(join(sb.repo, 'unique.txt'), `OVERSIZE_UNIQUE_MARKER\n${'x'.repeat(8000)}\n`);
@@ -1122,10 +1181,10 @@ describe('agy-review.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.equal(r.invoked, false);
   });
 
-  it('a file-set AGY_HARD_TIMEOUT flows through the agy-run delegation (killed at the file cap)', () => {
+  it('a file-set AGY_HARD_TIMEOUT flows through the agy-run delegation (killed at the file cap)', async () => {
     const sb = makeSandbox();
     writeSettings(sb, 'AGY_HARD_TIMEOUT=2s\n');
-    const r = run(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_SLEEP: '5' } });
+    const r = await runAsync(sb, { args: ['code', '--facts', 'f'], env: { AGY_FAKE_SLEEP: '5' } });
     rmSync(sb.home, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the file cap must apply end-to-end (reader → agy-run → timeout)');
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
@@ -1264,3 +1323,93 @@ describe('agy-review.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
     }
   });
 });
+
+// ── strip-the-kit Phase 4: wrapper honesty (D4) + dispatch-posture labeling (D5) ────────────────
+describe('agy-review.sh — wrapper honesty: a verdict-less run is a FAILED review (D4)', () => {
+  it('a VERDICT-LESS review output: non-zero exit, NO receipt, the stated re-run recovery', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: 'prose without the mandated section' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0, 'a verdict-less review never exits 0');
+    assert.equal(receipts.length, 0, 'NO receipt is minted for a failed review');
+    assert.match(r.stderr, /### Verdict/, 'the missing section is named');
+    assert.match(r.stderr, /re-run/i, 'documented as a failed review — re-run, never fatal');
+  });
+
+  it('EMPTY review output is the same failed run (non-zero, no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('the closed vocabulary still parses (SHIP WITH NITS before SHIP; REWORK) and a recognized run exits 0', () => {
+    for (const [out, want] of [[VERDICT_OUTPUT, 'SHIP WITH NITS'], ['### Verdict\nREWORK — reasons.\n', 'REWORK']]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_FAKE_OUTPUT: out } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, r.stderr);
+      assert.equal(receipts[0].verdict, want);
+    }
+  });
+});
+
+describe('agy-review.sh — dispatch-posture labeling (D5)', () => {
+  it('ONE banner line carries the ACTUAL model and the receipt carries the SAME posture (agy has no tier)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'] });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=Gemini 3\.1 Pro \(High\)/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'Gemini 3.1 Pro (High)' }, 'banner ↔ receipt parity');
+    assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
+  });
+
+  it('an ATTESTING review with AGY_MODEL explicitly emptied REFUSES pre-spend naming the fix', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false, 'refused BEFORE any spend');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /AGY_MODEL/, 'the fix is named');
+  });
+
+  it('AGY_PROBE=1 with AGY_MODEL emptied still runs (probe exempt; posture model null on the probe receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: '', AGY_PROBE: '1' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].probe, true);
+    assert.deepEqual(receipts[0].posture, { model: null }, 'an unknowable model is recorded null, never guessed');
+  });
+
+  it('a HOSTILE model string (quotes + backslash) rides the receipt strictly JSON-encoded', () => {
+    const hostile = 'we"ird \\ mo"del';
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: hostile } });
+    const receipts = readReceipts(sb.repo); // JSON.parse throwing here IS the encoding failure
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].posture.model, hostile, 'the exact bytes round-trip through strict encoding');
+    assert.match(r.stderr, /review posture: /, 'the banner still renders');
+  });
+
+  it('a model string carrying CONTROL BYTES refuses pre-spend (never a broken banner or receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: `bad${String.fromCharCode(1)}model` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false);
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i);
+  });
+});