@sabaiway/agent-workflow-kit 2.1.0 → 3.1.0

package/bridges/codex-cli-bridge/bin/codex-review-honesty.test.mjs

@@ -0,0 +1,156 @@
+// codex-review-honesty.test.mjs — the round-1 hardening pins for the D4/D5 arms (strip Phase 4):
+// the schema-mode verdict is parsed STRUCTURALLY (a legal multiline JSON parses; a decoy
+// "verdict" inside a findings string never substitutes the top-level field; out-of-enum and
+// malformed JSON die on the D4 arm), and the control-byte pre-spend screen covers the RAW
+// CODEX_SERVICE_TIER BEFORE tier validation (no multiline warning echo, no silent standard-tier
+// run). Colocated separately — codex-review.test.mjs is red-proof-frozen; standalone harness.
+
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync, cpSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const WRAPPER = join(HERE, 'codex-review.sh');
+
+const FAKE_CODEX = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  'if [[ "${1:-}" == "login" ]]; then echo "Logged in using ChatGPT"; exit 0; fi',
+  'printf invoked > "${CODEX_FAKE_SENTINEL:-/dev/null}"',
+  'cat >/dev/null',
+  'out=""; prev=""',
+  'for a in "$@"; do if [[ "$prev" == "-o" || "$prev" == "--output-last-message" ]]; then out="$a"; fi; prev="$a"; done',
+  'if [[ -n "$out" ]]; then if [[ -z "${CODEX_FAKE_FINAL+x}" ]]; then printf "Verdict: ship\\n" >"$out"; else printf "%s\\n" "$CODEX_FAKE_FINAL" >"$out"; fi; fi',
+  'echo \'{"type":"thread.started","thread_id":"honesty-fake"}\'',
+  'exit 0',
+  '',
+].join('\n');
+
+const makePathWithout = (root, exclude = []) => {
+  const skip = new Set(exclude);
+  const dir = mkdtempSync(join(root, 'nobin-'));
+  for (const d of (process.env.PATH || '').split(':').filter(Boolean)) {
+    let names;
+    try { names = readdirSync(d); } catch { continue; }
+    for (const name of names) {
+      if (skip.has(name)) continue;
+      const link = join(dir, name);
+      if (existsSync(link)) continue;
+      try { symlinkSync(resolve(d, name), link); } catch { /* dup / race — ignore */ }
+    }
+  }
+  return dir;
+};
+
+// Farm + sandbox base are READ-ONLY per invocation — built ONCE, shared (a per-run farm rebuild
+// plus a per-test `git init`+commit dominate the wall otherwise).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'codex-honesty-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const FARM = makePathWithout(SHARED_ROOT, ['codex']);
+
+const TEMPLATE_ROOT = (() => {
+  const root = join(SHARED_ROOT, 'template-root');
+  const bin = join(root, 'bin');
+  mkdirSync(bin, { recursive: true });
+  writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
+  const repo = join(root, 'repo');
+  mkdirSync(repo);
+  const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  g('init', '-q');
+  g('config', 'user.email', 'probe@example.com');
+  g('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'AGENTS.md'), '# Hard Constraints\n');
+  g('add', '-A');
+  g('commit', '-qm', 'base');
+  writeFileSync(join(repo, 'pending.txt'), 'PENDING\n');
+  return root;
+})();
+
+const makeSandbox = () => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-honesty-'));
+  cpSync(TEMPLATE_ROOT, root, { recursive: true });
+  const bin = join(root, 'bin');
+  chmodSync(join(bin, 'codex'), 0o755);
+  return { root, bin, repo: join(root, 'repo') };
+};
+
+const run = (sb, { args = ['code'], env = {} } = {}) => {
+  const sentinel = join(sb.root, 'cap-sentinel');
+  const r = spawnSync('bash', [WRAPPER, ...args], {
+    cwd: sb.repo,
+    encoding: 'utf8',
+    timeout: 30000,
+    env: {
+      HOME: sb.repo,
+      PATH: `${sb.bin}:${FARM}`,
+      TMPDIR: process.env.TMPDIR ?? '/tmp',
+      CODEX_HOME: join(sb.root, 'codex-home'),
+      CODEX_FAKE_SENTINEL: sentinel,
+      ...env,
+    },
+  });
+  return { ...r, invoked: existsSync(sentinel) };
+};
+
+const readReceipts = (repo) => {
+  const p = join(repo, '.git', 'agent-workflow-review-receipts.jsonl');
+  if (!existsSync(p)) return [];
+  return readFileSync(p, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+};
+
+describe('codex-review — schema-mode verdict is parsed STRUCTURALLY (M2)', () => {
+  it('a LEGAL multiline JSON final message (key/value split across lines) parses and attests', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{\n  "verdict":\n  "ship",\n  "findings": []\n}' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].verdict, 'ship', 'a formatting choice never fails a legal schema payload');
+  });
+
+  it('a DECOY "verdict" inside a findings STRING never substitutes the top-level field', () => {
+    const sb = makeSandbox();
+    const decoy = '{"verdict":"revise","findings":["the text \\"verdict\\": \\"ship\\" appeared in a doc line"]}';
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: decoy } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].verdict, 'revise', 'the TOP-LEVEL field is authoritative — a quoted decoy never wins');
+  });
+
+  it('an OUT-OF-ENUM top-level verdict dies on the D4 arm (no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{"verdict":"maybe","findings":[]}' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('MALFORMED JSON in schema mode dies on the D4 arm (no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{not json' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+});
+
+describe('codex-review — the RAW tier is control-byte-screened BEFORE validation (M4)', () => {
+  it('a CODEX_SERVICE_TIER carrying a control byte refuses pre-spend — codex never runs, no warning echo', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_SERVICE_TIER: `priority${String.fromCharCode(1)}` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false, 'refused BEFORE any spend');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i, 'named as the control-byte class');
+    assert.doesNotMatch(r.stderr, /not a supported service tier/, 'the validity warning never echoes a hostile value');
+  });
+});

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -64,8 +64,14 @@ Receipt:
   verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge,
   factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on
   EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a
-  probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a
-  write failure warns, never fails the review
+  probe review never attests) and equally rejects an unmarked one (silence is not a declaration);
+  posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written
+  on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5
+  wrapper minted it; re-run the review), one stderr banner line states the same posture, and a
+  posture value carrying control bytes refuses pre-spend in every mode; a run whose final message
+  carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included —
+  exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write
+  failure warns, never fails the review
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -73,6 +79,13 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 1800)
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
+Honesty + posture (D4/D5):
+  a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or
+  missing output included — exits 4 with NO receipt: a FAILED review to RE-RUN, never a fatal
+  session error. One stderr banner line states the ACTUAL run posture (review posture: model=…
+  effort=… tier=…) and the receipt records the same posture {model, effort, tier} (tier null on
+  the standard tier). A posture value carrying control bytes refuses pre-spend in every mode.
+
 Environment: CODEX_REVIEW_SCHEMA=1 (structured JSON findings), CODEX_HARD_TIMEOUT (seconds, default 1800), CODEX_PROBE=1 (throwaway probe only), AW_REVIEW_RECEIPTS (receipt file override).
 Requires at run time: the codex CLI on PATH, a ChatGPT-subscription login, a git work tree with a root AGENTS.md (--help needs none of these).
 HELP
@@ -193,7 +206,7 @@ DEFAULT_CODEX_EFFORT="xhigh"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="2.8.0"
+AW_BRIDGE_VERSION="3.0.0"
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
 # Generous hard cap for a slow xhigh review (subscription latency varies).
@@ -209,6 +222,15 @@ CODEX_REVIEW_MAX_TOTAL_BYTES="${CODEX_REVIEW_MAX_TOTAL_BYTES:-1500000}"
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
+# D5 pre-spend control-byte screen — BEFORE tier validation (a malformed value is not a policy
+# question; validating first would echo the hostile value into a multiline warning and then run
+# on the standard tier, defeating the stated refusal). Screens the RAW model/effort/tier.
+for _posture_pair in "CODEX_MODEL=$CODEX_MODEL" "CODEX_EFFORT=$CODEX_EFFORT" "CODEX_SERVICE_TIER=$CODEX_SERVICE_TIER"; do
+  if [[ "${_posture_pair#*=}" == *[$'\x01'-$'\x1f']* ]]; then
+    echo "error: ${_posture_pair%%=*} contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+    exit 2
+  fi
+done
 if [[ -n "$CODEX_SERVICE_TIER" ]] && ! aw_settings_valid CODEX_SERVICE_TIER "$CODEX_SERVICE_TIER"; then
   echo "warning: CODEX_SERVICE_TIER='$CODEX_SERVICE_TIER' is not a supported service tier ('priority') — running on the standard tier." >&2
   CODEX_SERVICE_TIER=""
@@ -219,6 +241,11 @@ if [[ -n "$CODEX_SERVICE_TIER" ]]; then
 fi
 CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 
+# --- D5 banner (one line, the ACTUAL run posture) -------------------------------------------
+# The control-byte screen already ran above (BEFORE tier validation); the banner states the
+# EFFECTIVE posture (post tier validation) and the receipt records the same fields.
+echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard}" >&2
+
 # --- Quality-first guard: refuse a silent model/effort downgrade ---------------
 # A relaxed run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
 # review-state gate rejects it — "do NOT use this as a real review" becomes a mechanism, not a plea.
@@ -421,6 +448,24 @@ receipt_json_scalar() {
   if [[ -z "${1:-}" ]]; then printf 'null'; else printf '"%s"' "$1"; fi
 }
 
+# STRICT JSON string encoding for the free-form posture fields (model/effort ride env/settings):
+# backslash then double-quote escaped. Control bytes never reach here — the D5 pre-spend gate
+# refuses them, so these two escapes make the encoding total.
+json_string_escape() {
+  local s="${1//\\/\\\\}"
+  s="${s//\"/\\\"}"
+  printf '%s' "$s"
+}
+
+# The D5 posture object this wrapper writes into EVERY receipt: the ACTUAL {model, effort, tier}
+# of the run (tier null on the standard tier — the validated CODEX_SERVICE_TIER is the one source).
+posture_json() {
+  local tier_json='null'
+  if [[ -n "${CODEX_SERVICE_TIER:-}" ]]; then tier_json="\"$(json_string_escape "$CODEX_SERVICE_TIER")\""; fi
+  printf '{"model":"%s","effort":"%s","tier":%s}' \
+    "$(json_string_escape "$CODEX_MODEL")" "$(json_string_escape "$CODEX_EFFORT")" "$tier_json"
+}
+
 # write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false]
 # Appends ONE receipt line (the AD-038 fixture shape) as a side effect of a SUCCESSFUL review —
 # to $AW_REVIEW_RECEIPTS when set, else <git dir>/agent-workflow-review-receipts.jsonl (inside the
@@ -444,10 +489,10 @@ write_review_receipt() {
   fi
   local line probe_field=',"probe":false'
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s}' \
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
@@ -648,7 +693,11 @@ codex_cmd=("${codex_flags[@]}" -)
 invoke_codex
 
 # Raw-text fallback: if the structured-findings run failed (not a timeout), retry
-# once WITHOUT the schema rather than lose the review — loud, never silent.
+# once WITHOUT the schema rather than lose the review — loud, never silent. The verdict parse
+# tracks the run that actually SUCCEEDED: a fallback run emits the TEXT verdict line, so parsing
+# it in schema mode would read every fallback as verdict-less (a guaranteed D4 failure).
+verdict_parse_mode="text"
+if [[ -n "$schema_file" ]]; then verdict_parse_mode="schema"; fi
 if [[ -n "$schema_file" && $rc -ne 0 && $rc -ne 124 && $rc -ne 137 ]]; then
   echo "warning: the --output-schema run failed (exit $rc) — retrying once without the schema constraint." >&2
   codex_cmd=()
@@ -657,6 +706,7 @@ if [[ -n "$schema_file" && $rc -ne 0 && $rc -ne 124 && $rc -ne 137 ]]; then
     codex_cmd+=("$_f")
   done
   codex_cmd+=(-)
+  verdict_parse_mode="text"
   invoke_codex
 fi
 
@@ -688,16 +738,27 @@ fi
 
 # --- Review receipt (AD-038): parse the verdict, append one receipt line ------
 # Text mode parses the mandated literal 'Verdict: <ship|revise|rethink>' line; CODEX_REVIEW_SCHEMA=1
-# reads the schema's "verdict" field instead; absent either way → "unknown" (recorded, never guessed).
+# reads the schema's "verdict" field instead. D4 (wrapper honesty): NO recognized verdict —
+# empty/missing final message included — is a FAILED review: non-zero exit, NO receipt; a failed
+# review to RE-RUN, never a fatal session error (documented in --help).
 verdict=""
 if [[ -f "$out" && -s "$out" ]]; then
-  if [[ "${CODEX_REVIEW_SCHEMA:-}" == "1" ]]; then
-    verdict="$(sed -nE 's/.*"verdict"[[:space:]]*:[[:space:]]*"(ship|revise|rethink)".*/\1/p' "$out" | tail -n1)"
+  if [[ "$verdict_parse_mode" == "schema" ]]; then
+    # STRUCTURAL parse (round-1 fold): the TOP-LEVEL `verdict` field of the schema payload,
+    # accepted only inside the closed enum — a legal multiline layout parses, a decoy "verdict"
+    # inside a findings string never substitutes, malformed/out-of-enum stays empty (the D4
+    # failed-run arm). Node ≥22 is a family floor, so the one-liner adds no dependency.
+    verdict="$(node -e 'try{const v=JSON.parse(require("node:fs").readFileSync(process.argv[1],"utf8")).verdict;if(["ship","revise","rethink"].includes(v))process.stdout.write(v);}catch{}' "$out" 2>/dev/null || true)"
   else
     verdict="$(sed -nE 's/^Verdict: (ship|revise|rethink)[[:space:]]*$/\1/p' "$out" | tail -n1)"
   fi
 fi
-[[ -z "$verdict" ]] && verdict="unknown"
+if [[ -z "$verdict" ]]; then
+  echo "error: the review produced no recognized 'Verdict: <ship|revise|rethink>' line (empty or" >&2
+  echo "       verdict-less final message) — a FAILED review; NO receipt was written. Re-run the" >&2
+  echo "       review; if it recurs, inspect the captured output for what the model produced." >&2
+  exit 4
+fi
 # codex is grounded by construction (AGENTS.md auto-merge + the precomputed change set): grounded
 # true, factsHash null (native grounding — no separate facts payload exists). Every codex run is a
 # full fresh run (one-shot, no resume) → fresh:true. $REVIEW_PROBE marks a guards-relaxed run.

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -1,13 +1,13 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import {
   mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
-  existsSync, readdirSync, symlinkSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -37,7 +37,9 @@ const FAKE_CODEX = [
   '  if [[ "$prev" == "-o" || "$prev" == "--output-last-message" ]]; then out="$a"; fi',
   '  prev="$a"',
   'done',
-  'if [[ -n "$out" && "${CODEX_FAKE_NO_OUT:-}" != "1" ]]; then echo "${CODEX_FAKE_FINAL:-FAKE_FINAL_MESSAGE}" >"$out"; fi',
+  // Unset CODEX_FAKE_FINAL → a verdict-carrying default (D4: a verdict-less run is a FAILURE, so
+  // the success-path tests need one); an EXPLICIT empty value exercises the empty-output failure.
+  'if [[ -n "$out" && "${CODEX_FAKE_NO_OUT:-}" != "1" ]]; then if [[ -z "${CODEX_FAKE_FINAL+x}" ]]; then printf "FAKE_FINAL_MESSAGE\\nVerdict: ship\\n" >"$out"; else printf "%s\\n" "$CODEX_FAKE_FINAL" >"$out"; fi; fi',
   'if [[ "${CODEX_FAKE_NO_THREAD:-}" != "1" ]]; then',
   'cat <<EOF',
   '{"type":"thread.started","thread_id":"${CODEX_FAKE_THREAD_ID:-fake-thread-123}"}',
@@ -52,16 +54,23 @@ const FAKE_CODEX = [
   '',
 ].join('\n');
 
-// `clean: true` leaves a committed, pristine tree (for the no-diff preflight);
-// the default leaves one uncommitted untracked file so `code` mode has a diff to
-// review (otherwise the new no-diff preflight short-circuits before codex runs).
-const makeSandbox = ({ clean = false } = {}) => {
-  const root = mkdtempSync(join(tmpdir(), 'codex-review-test-'));
+// The PATH farms and the sandbox base are READ-ONLY per invocation, so both are built ONCE and
+// shared (a per-call farm rebuild is thousands of symlinks; a per-test `git init`+commit
+// dominates the sandbox cost).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'codex-review-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const farms = new Map();
+const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
+const TEMPLATE_ROOT = (() => {
+  const root = join(SHARED_ROOT, 'template-root');
   const bin = join(root, 'bin');
   mkdirSync(bin, { recursive: true });
-  const stub = join(bin, 'codex');
-  writeFileSync(stub, FAKE_CODEX, { mode: 0o755 });
-  chmodSync(stub, 0o755);
+  writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
   const repo = join(root, 'repo');
   mkdirSync(repo);
   const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
@@ -72,6 +81,18 @@ const makeSandbox = ({ clean = false } = {}) => {
   writeFileSync(join(repo, 'plan.md'), '# Plan\n\nDo a thing in two steps.\n');
   g('add', '-A');
   g('commit', '-qm', 'base');
+  return root;
+})();
+
+// `clean: true` leaves a committed, pristine tree (for the no-diff preflight);
+// the default leaves one uncommitted untracked file so `code` mode has a diff to
+// review (otherwise the new no-diff preflight short-circuits before codex runs).
+const makeSandbox = ({ clean = false } = {}) => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-review-test-'));
+  cpSync(TEMPLATE_ROOT, root, { recursive: true });
+  const bin = join(root, 'bin');
+  chmodSync(join(bin, 'codex'), 0o755);
+  const repo = join(root, 'repo');
   if (!clean) writeFileSync(join(repo, 'pending.txt'), 'an uncommitted change to review\n');
   return { root, bin, repo };
 };
@@ -121,6 +142,35 @@ const run = ({ repo, bin }, { args = ['code'], env = {}, path, cwd } = {}) => {
   return { ...r, codexHome, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) };
 };
 
+// Async twin of run() for the sleep-bound timeout test: spawnSync blocks the event loop for
+// the whole deliberate wait, so a concurrent describe could not overlap it. Same contract.
+const runAsync = ({ repo, bin }, { args = ['code'], env = {}, path, cwd } = {}) =>
+  new Promise((done) => {
+    const argvFile = join(repo, '.cap-argv');
+    const envFile = join(repo, '.cap-env');
+    const stdinFile = join(repo, '.cap-stdin');
+    const codexHome = join(repo, '..', 'codex-home');
+    const child = execFile('bash', [WRAPPER, ...args], {
+      cwd: cwd || repo,
+      encoding: 'utf8',
+      timeout: 30000,
+      env: {
+        PATH: path || `${bin}:${process.env.PATH}`,
+        HOME: repo,
+        TMPDIR: process.env.TMPDIR ?? '/tmp',
+        CODEX_HOME: codexHome,
+        CODEX_FAKE_ARGV: argvFile,
+        CODEX_FAKE_ENV: envFile,
+        CODEX_FAKE_STDIN: stdinFile,
+        ...env,
+      },
+    }, (error, stdout, stderr) => {
+      const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+      done({ status: error ? (error.code ?? 1) : 0, stdout, stderr, codexHome, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) });
+    });
+    child.stdin.end();
+  });
+
 describe('codex-review.sh — quality-first model/effort guard (1.1)', () => {
   it('refuses a non-default CODEX_MODEL', () => {
     const sb = makeSandbox();
@@ -253,11 +303,11 @@ describe('codex-review.sh — subscription / config isolation (invariant)', () =
   });
 });
 
-describe('codex-review.sh — hard timeout (1.3)', () => {
-  it('kills a hung review at CODEX_HARD_TIMEOUT and reports it', () => {
+describe('codex-review.sh — hard timeout (1.3)', { concurrency: true }, () => {
+  it('kills a hung review at CODEX_HARD_TIMEOUT and reports it', async () => {
     const sb = makeSandbox();
     const started = Date.now();
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
     const elapsed = Date.now() - started;
     rmSync(sb.root, { recursive: true, force: true });
     assert.ok(elapsed < 18000, `must return well under the kill-after window, took ${elapsed}ms`);
@@ -267,7 +317,7 @@ describe('codex-review.sh — hard timeout (1.3)', () => {
 
   it('warns and runs uncapped when neither timeout nor gtimeout is on PATH', () => {
     const sb = makeSandbox();
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['timeout', 'gtimeout'])}`;
+    const path = `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`;
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -366,7 +416,8 @@ describe('codex-review.sh — precomputed diff for code mode (2.1)', () => {
 describe('codex-review.sh — optional structured findings (2.2)', () => {
   it('CODEX_REVIEW_SCHEMA=1 passes --output-schema to codex', () => {
     const sb = makeSandbox();
-    const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1' } });
+    // Schema mode parses the schema's verdict FIELD (D4) — the fixture output must carry it.
+    const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FINAL: '{"verdict":"ship","findings":[]}' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.argv, /(^|\n)--output-schema(\n|$)/);
@@ -379,8 +430,11 @@ describe('codex-review.sh — optional structured findings (2.2)', () => {
     assert.doesNotMatch(r.argv, /--output-schema/);
   });
 
-  it('falls back to a raw-text run when the schema run fails (loud; exit 0)', () => {
+  it('falls back to a raw-text run when the schema run fails (loud; exit 0) — and parses the TEXT verdict', () => {
     const sb = makeSandbox();
+    // No CODEX_FAKE_FINAL: the fallback run emits the TEXT default (FAKE_FINAL_MESSAGE +
+    // Verdict: ship) — the wrapper must parse the mode of the run that actually SUCCEEDED,
+    // or every fallback would read verdict-less and die on the D4 arm.
     const r = run(sb, { args: ['code'], env: { CODEX_REVIEW_SCHEMA: '1', CODEX_FAKE_FAIL_ON_SCHEMA: '1' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -408,7 +462,7 @@ describe('codex-review.sh — optional structured findings (2.2)', () => {
 describe('codex-review.sh — environment preflight (fail fast, before a run)', () => {
   it('STOPs with 127 when codex is not on PATH', () => {
     const sb = makeSandbox();
-    const path = makePathWithout(sb.root, ['codex']); // no fake codex, no real codex
+    const path = farmFor(['codex']); // no fake codex, no real codex
     const r = run(sb, { args: ['code'], path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 127);
@@ -527,13 +581,13 @@ describe('codex-review.sh — assemble & output edge cases', () => {
     assert.match(r.capStdin, /Extra focus: watch the parser/);
   });
 
-  it('warns and prints the trace tail when codex writes no final-message file', () => {
+  it('warns and prints the trace tail when codex writes no final-message file (then fails the D4 arm)', () => {
     const sb = makeSandbox();
     const r = run(sb, { args: ['code'], env: { CODEX_FAKE_NO_OUT: '1' } });
     rmSync(sb.root, { recursive: true, force: true });
-    assert.equal(r.status, 0, r.stderr);
+    assert.notEqual(r.status, 0, 'no final message ⇒ no verdict ⇒ a FAILED review (D4)');
     assert.match(r.stderr, /no final-message file/);
-    assert.match(r.stdout, /turn\.completed/, 'the trace tail carries the event stream');
+    assert.match(r.stdout, /turn\.completed/, 'the trace tail still carries the event stream');
   });
 
   it('prints no session line when codex emits no thread id', () => {
@@ -564,7 +618,7 @@ const runHelp = (arg) => {
   const root = mkdtempSync(join(tmpdir(), 'codex-review-help-'));
   const nongit = join(root, 'nongit');
   mkdirSync(nongit, { recursive: true });
-  const path = makePathWithout(root, ['codex', 'agy', 'git']);
+  const path = farmFor(['codex', 'agy', 'git']);
   const r = spawnSync('bash', [WRAPPER, arg], {
     cwd: nongit, encoding: 'utf8', timeout: 15000, env: { HOME: root, PATH: path },
   });
@@ -812,7 +866,7 @@ describe('codex-review.sh — mode catalog ⟷ wrapper reality (manifest-pinned)
 // The normative fixture: the AD-038 shape + the D3 self-declaring probe marker (field VALUES with
 // dynamic content are asserted by shape):
 const RECEIPT_FIXTURE = JSON.parse(
-  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false}',
+  '{"schema":1,"artifact":"code","fresh":true,"fingerprint":"<sha256hex>","backend":"codex","verdict":"revise","grounded":true,"factsHash":null,"wrapperVersion":"2.3.0","timestamp":"2026-07-03T12:00:00Z","probe":false,"posture":{"model":"<m>","effort":"<e>","tier":null}}',
 );
 const RECEIPTS_REL = join('.git', 'agent-workflow-review-receipts.jsonl');
 const readReceipts = (repo) => {
@@ -905,13 +959,13 @@ describe('codex-review.sh — review receipts (AD-038)', () => {
     assert.equal(receipts[0].verdict, 'ship');
   });
 
-  it('no parseable verdict → recorded as "unknown", never guessed', () => {
+  it('no parseable verdict is a FAILED run — never recorded as "unknown" (D4 owns the arm)', () => {
     const sb = makeSandbox();
     const r = run(sb, { env: { CODEX_FAKE_FINAL: 'looks fine to me overall' } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
-    assert.equal(r.status, 0, r.stderr);
-    assert.equal(receipts[0].verdict, 'unknown');
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0, 'an unknown verdict never reaches the receipt store');
   });
 
   it('plan mode: artifact "plan", fingerprint = the artifact-file sha256', () => {
@@ -1195,3 +1249,80 @@ describe('codex-review.sh — settings surface ⟷ manifest (D6, manifest-pinned
     }
   });
 });
+
+// ── strip-the-kit Phase 4: wrapper honesty (D4) + dispatch-posture labeling (D5) ────────────────
+describe('codex-review.sh — wrapper honesty: a verdict-less run is a FAILED review (D4)', () => {
+  it('a VERDICT-LESS final message: non-zero exit, NO receipt, the stated re-run recovery', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_FINAL: 'prose without the mandated verdict line' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0, 'a verdict-less review never exits 0');
+    assert.equal(receipts.length, 0, 'NO receipt is minted for a failed review');
+    assert.match(r.stderr, /Verdict/, 'the missing line is named');
+    assert.match(r.stderr, /re-run/i, 'documented as a failed review — re-run, never fatal');
+  });
+
+  it('an EMPTY final message is the same failed run (non-zero, no receipt)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_FINAL: '' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+
+  it('a MISSING final-message file is the same failed run', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_NO_OUT: '1' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(receipts.length, 0);
+  });
+});
+
+describe('codex-review.sh — dispatch-posture labeling (D5)', () => {
+  it('ONE banner line carries the ACTUAL {model, effort, tier} and the receipt carries the SAME posture', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {});
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=standard/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'gpt-5.6-sol', effort: 'xhigh', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
+    assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
+  });
+
+  it('an ARMED Fast tier rides both surfaces (banner tier=priority; receipt tier "priority")', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_SERVICE_TIER: 'priority' } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=priority/);
+    assert.equal(receipts[0].posture.tier, 'priority');
+  });
+
+  it('a HOSTILE model string (quotes + backslash) rides the receipt strictly JSON-encoded (probe lane)', () => {
+    const hostile = 'we"ird \\ mo"del';
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: hostile } });
+    const receipts = readReceipts(sb.repo); // JSON.parse throwing here IS the encoding failure
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.equal(receipts[0].posture.model, hostile, 'the exact bytes round-trip through strict encoding');
+    assert.equal(receipts[0].probe, true, 'an off-pinned model runs only on the probe lane');
+  });
+
+  it('a posture value carrying CONTROL BYTES refuses pre-spend, BEFORE the frontier guard', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(1)}` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.capStdin, '', 'codex is never invoked');
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i, 'named as the control-byte class, not a policy refusal');
+  });
+});

package/bridges/codex-cli-bridge/capability.json

@@ -3,7 +3,8 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "2.8.0",
+  "version": "3.0.0",
+  "posture": { "model": "gpt-5.6-sol", "effort": "xhigh", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
     "execute": {
@@ -42,7 +43,7 @@
         ],
         "grounding": "automatic — the wrapper precomputes the full working-tree change set (repo map, status, diffs, untracked contents) and codex auto-merges the root AGENTS.md; no grounding flags",
         "continue": [],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a write failure warns, never fails the review"
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review"
       }
     }
   },

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "2.1.0",
+  "version": "3.1.0",
   "provides": [],
   "roles": {},
   "detect": {