@sabaiway/agent-workflow-kit 3.0.0 → 3.1.0

package/tools/recipes.mjs

@@ -460,7 +460,7 @@ export const composeActiveRecipeLine = ({ config, source } = {}, detection, auto
   const rec = recommendRecipe(detection);
   const origin = source === 'none' || config == null ? 'no config file — computed defaults apply' : `from ${source}`;
   // A MALFORMED policy must surface LOUDLY on this paste surface too — silently rendering cells
-  // without levels would hide the required STOP signal (codex R1, Segment B). One line always.
+  // without levels would hide the required STOP signal (Segment B). One line always.
   const malformed = autonomy?.error
     ? ` · autonomy: MALFORMED policy — ${String(autonomy.error).replace(/[\s]+/g, ' ').trim()}`
     : '';
@@ -485,7 +485,7 @@ export const buildReport = (detection, settings = null, autonomy = null, posture
     recommendation,
     plans: RECIPES.map((r) => planRecipe(r.id, detection)),
     // The SAME autonomy facts the --status-line surface renders — the --json envelope must never
-    // expose a stale machine-composed status line (codex R1, Segment B).
+    // expose a stale machine-composed status line (Segment B).
     statusLine: composeStatusLine(detection, recommendation, settings, autonomy, posture),
   };
 };

package/tools/recommendations.mjs

@@ -59,6 +59,7 @@ import { resolveGitHooksPath } from './commit-guard.mjs';
 import { loadConfig } from './orchestration-config.mjs';
 import { DEFAULT_BUNDLE_ROOT, SETTINGS_FILENAME, settingsPath, parseSettings, duplicateKeys } from './bridge-settings-read.mjs';
 import { assertContainedRealPath } from './fs-safe.mjs';
+import { loadWorktreesConfig, resolveProbeDir } from './worktrees.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const toolPath = (rel) => join(HERE, rel);
@@ -108,6 +109,7 @@ export const SEVERITIES = Object.freeze({
   'agy-adddir': SEVERITY_OPTIONAL,
   'agy-adddir.invalid-env': SEVERITY_ATTENTION,
   'sandbox-lane': SEVERITY_OPTIONAL,
+  'worktrees-dir': SEVERITY_OPTIONAL,
 });
 // The per-item render tags (frozen presentation data, same language contract as the templates).
 export const SEVERITY_LABELS = Object.freeze({
@@ -165,6 +167,7 @@ export const WHATS = Object.freeze({
   'agy-adddir': 'agy-review is placed but AGY_REVIEW_ALLOW_ADDDIR is not set ({file}) — an oversized code review refuses instead of offloading',
   'agy-adddir.invalid-env': 'AGY_REVIEW_ALLOW_ADDDIR is set to an INVALID value ({value}) — refuse-mode applies and the settings file is shadowed while it is set',
   'sandbox-lane': 'the wired review wrappers declare a session-sandbox recipe (egress hosts + writable state dirs) not yet acknowledged for this project',
+  'worktrees-dir': 'write access to the worktrees parent dir {dir} is not confirmed — provision may still stop',
 });
 
 // ── the shape contract (D2): registry strings AND composed items stay one line under the cap ────
@@ -215,6 +218,7 @@ export const BENEFITS = Object.freeze({
   'sandbox-masks': 'zero clutter — git status shows only your changes (the review domain already ignores the masks by construction)',
   'agy-adddir': 'large reviews — an oversized agy code review offloads to a staging dir instead of refusing',
   'sandbox-lane': 'discoverability — the manifest-declared observed sandbox recipe for bridge runs surfaces itself instead of waiting to be asked',
+  'worktrees-dir': 'parallel features — the host-specific write allowance or terminal fallback is surfaced before provision',
 });
 
 // A typed usage failure (exit 2) — the codebase's typed-error idiom (no classes).
@@ -297,7 +301,7 @@ const probeSandboxProvision = ({ root, deps, add, skip }) => {
     const variant = plan.tuple ? 'sandbox-provision.installable' : 'sandbox-provision';
     const reason = truncatedTo(oneLineOf(p.reason), templateBudget(WHATS[variant]) - (plan.tuple ? String(plan.tuple).length : 0));
     // The doctor reads process.cwd() (deployment-gated) and takes no --cwd flag — the one-liner
-    // pins the target project via a cd prefix (codex R2, Segment B).
+    // pins the target project via a cd prefix (Segment B).
     add('sandbox-provision', fillTemplate(WHATS[variant], { reason, tuple: plan.tuple }), `cd ${q(root)} && node ${q(toolPath('autonomy-doctor.mjs'))}`);
   } catch (err) {
     skip('sandbox-provision', err);
@@ -306,7 +310,7 @@ const probeSandboxProvision = ({ root, deps, add, skip }) => {
 
 const probeReviewRecipe = ({ root, deps, add, skip }) => {
   try {
-    // The VALIDATED reader (codex R2, Segment B): a schema-invalid config (unknown activity/slot,
+    // The VALIDATED reader (Segment B): a schema-invalid config (unknown activity/slot,
     // bad recipe) throws here and becomes a stated skip — raw JSON.parse would silently ignore it.
     const { config } = loadConfig(root, deps.readFile ?? readFileSync, deps.lstat ?? lstatSync);
     const detection = detectBackends(deps);
@@ -330,7 +334,7 @@ const probeGates = ({ root, deps, add, skip }) => {
     const sg = surveyGateHook(root, deps);
     if (sg.error) throw new Error(sg.error);
     if (sg.declarationPresent && sg.declaredGates === null) throw new Error(sg.declarationError ?? 'gates.json present but unreadable');
-    // An ABSENT file and the seeded-EMPTY list are equally undeclared (codex R2, Segment B); the
+    // An ABSENT file and the seeded-EMPTY list are equally undeclared (Segment B); the
     // apply is the consent-gated gates-init PREVIEW (it proposes entries from the project's own
     // scripts and writes only on an explicit yes) — never the runner.
     if (!sg.declarationPresent || sg.declaredGates === 0) {
@@ -467,7 +471,7 @@ const probeMasksItem = ({ root, deps, add, skip }) => {
     if (!needsMasksApply(p)) return;
     const variant = p.staleReal.length > 0 ? 'sandbox-masks.stale-real' : 'sandbox-masks';
     // A stale-real-only fence (EMPTY derivation over a non-empty block) makes the plain --apply
-    // REFUSE — the exact one-liner must carry --clear there (codex R1, Segment B).
+    // REFUSE — the exact one-liner must carry --clear there (Segment B).
     const apply = p.masks.length === 0 && p.staleReal.length > 0 ? `${p.applyCmd} --clear` : p.applyCmd;
     add('sandbox-masks', fillTemplate(WHATS[variant], { n: p.masks.length, m: p.staleReal.length }), apply);
   } catch (err) {
@@ -480,7 +484,7 @@ const probeAgyAdddir = ({ deps, add, skip }) => {
     const probePlaced = deps.findWrapper ?? ((cmd) => findOnPath(cmd, deps).state === 'present');
     if (!probePlaced('agy-review')) return;
     // Configured means a VALID boolean value (the wrapper validates and falls back to the default
-    // on garbage — presence alone proves nothing; codex R3). An explicit valid 0 is a user CHOICE
+    // on garbage — presence alone proves nothing). An explicit valid 0 is a user CHOICE
     // (refuse mode) — respected, never nagged. env > file, the wrappers' own precedence.
     const isValidBool = (v) => v === '0' || v === '1';
     const env = deps.getenv ?? process.env;
@@ -681,7 +685,7 @@ const readReadLaneToggle = (root, deps) => {
 // D3: the risk-marked keys — every key here has a per-item posture note in the mode doc, surfaced
 // at the consent moment; the static contract test asserts EXACT bidirectional coverage
 // (risk-marked keys == mode-doc note keys — a dropped note goes red, not silent).
-export const RISK_NOTED_KEYS = Object.freeze(['agy-adddir', 'sandbox-lane', 'read-lane']);
+export const RISK_NOTED_KEYS = Object.freeze(['agy-adddir', 'sandbox-lane', 'read-lane', 'worktrees-dir']);
 
 const probeSandboxLane = ({ root, deps, add, skip }) => {
   try {
@@ -738,6 +742,28 @@ const probeSandboxLane = ({ root, deps, add, skip }) => {
   }
 };
 
+// The worktrees-dir arming item (parallel feature worktrees): fires when the resolved worktrees
+// parent dir (docs/ai/worktrees.json parentDir, else the repo's own parent) is not confirmed
+// writable by a trusted host signal. The provision preflight remains the real create+delete test.
+const probeWorktreesDir = ({ root, deps, add, skip }) => {
+  try {
+    const config = loadWorktreesConfig(root, deps);
+    const parent = config.parentDir == null ? dirname(root) : resolve(root, config.parentDir);
+    // the SAME canonical derivation the provision preflight probes (worktrees.mjs) — an absent
+    // configured dir resolves to its nearest existing ancestor, never a false denial
+    const probeDir = resolveProbeDir(parent, deps);
+    if (deps.canWriteDir?.(probeDir) === true) return;
+    const dir = truncatedTo(oneLineOf(probeDir), templateBudget(WHATS['worktrees-dir']));
+    add(
+      'worktrees-dir',
+      fillTemplate(WHATS['worktrees-dir'], { dir }),
+      `HAND-APPLY: add ${JSON.stringify(probeDir)} to sandbox.filesystem.allowWrite in .claude/settings.json on settings-native hosts; on harness-managed hosts grant this dir for the session or use the provision terminal fallback`,
+    );
+  } catch (err) {
+    skip('worktrees-dir', err);
+  }
+};
+
 // ── assembly (frozen presentation order) ─────────────────────────────────────────────────────────
 const PROBES = Object.freeze([
   probeVelocityItems,
@@ -751,6 +777,7 @@ const PROBES = Object.freeze([
   probeMasksItem,
   probeAgyAdddir,
   probeSandboxLane,
+  probeWorktreesDir,
 ]);
 
 export const buildRecommendations = ({ cwd, deps = {} } = {}) => {
@@ -793,7 +820,7 @@ export const formatRecommendations = ({ items, skips }) => {
   const verdict = composeVerdict({ attention, optional: items.length - attention, skipped: skips.length });
   if (verdict == null) {
     // The flow-optimal claim renders ONLY when every probe ran and none fired — an empty item
-    // list beside skipped checks would falsely attest optimality (codex R1, Segment B).
+    // list beside skipped checks would falsely attest optimality (Segment B).
     lines.push(RECOMMENDATIONS_EMPTY_LINE);
     return lines.join('\n');
   }

package/tools/release-scan.mjs

@@ -35,6 +35,9 @@ const ATTRIBUTION = [
   { re: /reviewed by (claude|codex|chatgpt|gpt|gemini|copilot|cursor|the (ai|model|agent))/i, label: 'AI review attribution' },
   { re: /authored[- ]by[: ][^\n]{0,40}\b(claude|chatgpt|gemini|copilot)\b/i, label: 'AI authorship attribution' },
 ];
+const REVIEWER_IDENTITY = [
+  { re: /\b(?:agy|codex)(?:\s+|-)r\d+(?:(?:\+|\/)r?\d+)*(?:-[a-z0-9]+)*\b/i, label: 'reviewer-round identity' },
+];
 
 const allowlistCovers = (matched, allowlist) =>
   allowlist.some((term) => matched.toLowerCase().includes(term.toLowerCase()));
@@ -49,6 +52,10 @@ export const scanText = (text, { allowlist = ALLOWLIST } = {}) => {
         findings.push({ line: idx + 1, kind: 'attribution', detail: `${label}: "${m[0]}"` });
       }
     }
+    for (const { re, label } of REVIEWER_IDENTITY) {
+      const m = line.match(re);
+      if (m) findings.push({ line: idx + 1, kind: 'reviewer-identity', detail: `${label}: "${m[0]}"` });
+    }
   });
   return findings;
 };
@@ -83,7 +90,7 @@ export const scanPaths = (paths, opts = {}) => {
   return report;
 };
 
-const main = (argv) => {
+export const main = (argv) => {
   const reportOnly = argv.includes('--report');
   const paths = argv.filter((a) => a !== '--report');
   if (paths.length === 0) {
@@ -93,7 +100,7 @@ const main = (argv) => {
   const report = scanPaths(paths);
   for (const r of report) console.log(`[${r.kind}] ${r.file}:${r.line} — ${r.detail}`);
   if (report.length === 0) {
-    console.log('[release-scan] clean — no AI attribution found.');
+    console.log('[release-scan] clean — no AI attribution or reviewer-round identity found.');
     return;
   }
   console.log(`\n[release-scan] ${report.length} finding(s).`);

package/tools/review-state.mjs

@@ -162,7 +162,7 @@ export const countNeverCommittableUntracked = (cwd, { lstat = lstatSync } = {})
 
 // Shell-quote one argument for a COPY-PASTE advisory command: plain safe tokens stay bare; anything
 // else rides single quotes (a space/metacharacter path must never render a dead or unsafe paste —
-// codex R1). Exported for the sandbox-masks probe, which renders the same apply one-liner.
+// Exported for the sandbox-masks probe, which renders the same apply one-liner.
 export const shellQuoteArg = (s) => (/^[A-Za-z0-9_/.\-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`);
 
 const maskAdvisoryLine = (state) =>
@@ -282,7 +282,7 @@ export const degradeRecordSet = ({ cwd, env = process.env, fingerprint }) => {
 // EVERY project-relative read (orchestration config, docs/plans, receipts) anchors at the git
 // work-tree ROOT when one exists — the fingerprint is root-anchored, so a subdirectory invocation
 // must read the same config/plans or a dirty unreceipted tree could false-PASS as "no plan in
-// flight" (codex R1 finding). Outside a git tree the cwd is the only anchor (and --check exits 0).
+// flight". Outside a git tree the cwd is the only anchor (and --check exits 0).
 export const buildState = ({ cwd, env = process.env, detect = detectBackends, lstat = lstatSync } = {}) => {
   const root = gitLine(['rev-parse', '--show-toplevel'], cwd) ?? cwd;
   const { config, source: configSource } = loadConfig(root);
@@ -618,7 +618,7 @@ export const mainAwait = async (argv, ctx = {}) => {
 };
 
 const emitResult = (r) => {
-  // Exact writes + a natural exit: process.exit() can truncate unflushed piped stdio (codex R2).
+  // Exact writes + a natural exit: process.exit() can truncate unflushed piped stdio.
   if (r.stdout) process.stdout.write(r.stdout.endsWith('\n') ? r.stdout : `${r.stdout}\n`);
   if (r.stderr) process.stderr.write(r.stderr.endsWith('\n') ? r.stderr : `${r.stderr}\n`);
   process.exitCode = r.code;

package/tools/sandbox-masks.mjs

@@ -69,7 +69,7 @@ const listUntrackedUnfilteredZ = (root) => {
 // name can never shadow a deeper real path), glob metacharacters + leading-! / leading-# handled
 // by the anchor, trailing whitespace escaped (gitignore trims it otherwise).
 // Trailing SPACES are escapable in gitignore (`\ `); a trailing TAB is not expressible — such a
-// name is classified unrenderable by the derivation (codex R12), so it never reaches this renderer.
+// name is classified unrenderable by the derivation, so it never reaches this renderer.
 export const toExcludePattern = (rel) => {
   const escaped = rel.replace(/([\\*?[\]])/g, '\\$1').replace(/ +$/, (m) => '\\ '.repeat(m.length));
   return `/${escaped}`;
@@ -79,7 +79,7 @@ export const toExcludePattern = (rel) => {
 // lstat class is never-committable (char/block/FIFO/socket). Everything else is refused by
 // construction — tracked paths never appear in an --others walk; regular/dir/symlink/missing fail
 // the predicate. A CR/LF-carrying mask NAME cannot be expressed as ONE gitignore rule — rendering
-// it would split into several rules and could hide unrelated committable paths (codex R3) — so it
+// it would split into several rules and could hide unrelated committable paths — so it
 // is a LOUD unrenderable skip, never written (the review domain already ignores the mask itself).
 export const deriveMasks = ({ root, lstat = lstatSync, listUntracked = listUntrackedUnfilteredZ } = {}) => {
   const entries = listUntracked(root);
@@ -95,7 +95,7 @@ export const deriveMasks = ({ root, lstat = lstatSync, listUntracked = listUntra
     }
     if (!isNeverCommittableStat(stat)) continue;
     // CR/LF anywhere, or a trailing TAB (inexpressible in gitignore — only trailing SPACES escape
-    // as `\ `; codex R12), make the name unrenderable as ONE exclude rule.
+    // as `\ `), make the name unrenderable as ONE exclude rule.
     if (/[\r\n]/.test(rel) || /\t$/.test(rel)) unrenderable.push(rel);
     else masks.push(rel);
   }
@@ -115,11 +115,11 @@ export const findMasksFence = (lines) => {
 
 // A fenced pattern back to its relative path (the derivation writes only `/rel` root-anchored
 // escaped forms; unescape is its exact inverse — the escaped-space form `\ ` included, so a
-// trailing-space mask round-trips; codex R1). Non-pattern lines (blank/comment) are skipped;
+// trailing-space mask round-trips). Non-pattern lines (blank/comment) are skipped;
 // only UNESCAPED trailing whitespace is insignificant (gitignore semantics).
 const patternToRel = (line) => {
   // A trailing CR (a CRLF-saved exclude file) strips FIRST — it would otherwise ride into the rel
-  // name and false-ENOENT the revalidation lstat (agy R5); then only UNESCAPED trailing
+  // name and false-ENOENT the revalidation lstat; then only UNESCAPED trailing
   // whitespace is insignificant (gitignore semantics — an escaped `\ ` survives).
   const t = line.replace(/\r$/, '').replace(/^[ \t]+/, '').replace(/(?<!\\)[ \t]+$/, '');
   if (t === '' || t.startsWith('#') || !t.startsWith('/')) return null;
@@ -156,13 +156,13 @@ export const probeSandboxMasks = ({ cwd = process.cwd(), lstat = lstatSync, list
   const commonDirRaw = gitLine(['rev-parse', '--git-common-dir'], cwd);
   if (gitPathRaw == null || commonDirRaw == null) return null;
   const excludeFile = resolve(cwd, gitPathRaw);
-  // The write-containment root (codex R2): info/exclude lives in the COMMON git dir (worktree-safe),
+  // The write-containment root: info/exclude lives in the COMMON git dir (worktree-safe),
   // and the apply must never write through a symlinked component or a non-regular leaf.
   const gitCommonDir = resolve(cwd, commonDirRaw);
   const derived = deriveMasks({ root, lstat, listUntracked });
   if (derived == null) return null;
   const { masks, unrenderable } = derived;
-  // The WHOLE chain is guarded BEFORE any read (codex R7+R8): a symlinked exclude leaf OR a
+  // The WHOLE chain is guarded BEFORE any read: a symlinked exclude leaf OR a
   // symlinked parent (.git/info) must never be read through, and a FIFO/socket leaf would HANG
   // the read-only probe — parent-chain containment + leaf lstat first, fail closed on everything
   // but a plain absent file, then read the existing REGULAR content. The apply re-checks
@@ -190,7 +190,7 @@ export const probeSandboxMasks = ({ cwd = process.cwd(), lstat = lstatSync, list
       content = readFile(excludeFile, 'utf8');
     } catch (err) {
       // The file existed a moment ago — ANY read failure now fails CLOSED (an apply over a misread
-      // "empty" file would overwrite hand content outside the managed block; codex R4).
+      // "empty" file would overwrite hand content outside the managed block).
       throw fail(1, `cannot read ${excludeFile} (${err?.code ?? err?.message ?? err}) — refusing to treat an unreadable exclude file as empty`);
     }
   }
@@ -222,7 +222,7 @@ export const planApply = (probe, { clear = false } = {}) => {
   }
   // --clear takes PRECEDENCE over the derivation (codex, Segment-A receipt): it means "remove the
   // managed block", even while masks are visible — re-writing the block instead of the requested
-  // clear would be a silent divergence. An EMPTY fence (markers, no entries) clears too (codex R8);
+  // clear would be a silent divergence. An EMPTY fence (markers, no entries) clears too;
   // no fence at all is a stated no-op.
   if (clear && probe.fence.state !== 'ok') {
     return { action: 'noop', reason: 'no managed block present — nothing to clear' };
@@ -236,7 +236,7 @@ export const planApply = (probe, { clear = false } = {}) => {
   }
   const masks = clear ? [] : probe.masks;
   const block = masks.length === 0 ? [] : [MASKS_FENCE_START, ...masks.map(toExcludePattern), MASKS_FENCE_END];
-  // EVERY hand byte outside the managed fence is preserved EXACTLY (codex R5+R6): the first-apply
+  // EVERY hand byte outside the managed fence is preserved EXACTLY: the first-apply
   // append adds at most ONE separator newline, and the existing-block replace splices via RAW
   // string offsets around the fence lines — a split/join('\n') rebuild would silently normalize
   // CRLF hand content outside the block. Only the fenced block itself is ours (always LF).
@@ -325,18 +325,18 @@ export const main = (argv, ctx = {}) => {
       return { code: 0, stdout: formatProbe(probe), stderr: '' };
     }
     const plan = planApply(probe, { clear: argv.includes('--clear') });
-    // The unrenderable skips stay LOUD on EVERY apply path (codex R4) — the same warning the
+    // The unrenderable skips stay LOUD on EVERY apply path — the same warning the
     // probe prints; the renderable subset still applies (a refusal would block the useful masks).
     const skipWarnings = probe.unrenderable
       .map((rel) => `sandbox-masks: ⚠ mask name carries a newline or ends with a tab and cannot be expressed as ONE exclude rule — NOT written (the review domain already ignores the mask itself): ${JSON.stringify(rel)}`)
       .join('\n');
-    // A refusal carries the unrenderable warnings too (codex R5) — they are never discarded.
+    // A refusal carries the unrenderable warnings too — they are never discarded.
     if (plan.action === 'refuse') throw fail(1, skipWarnings ? `${plan.reason}\n${skipWarnings}` : plan.reason);
     if (plan.action === 'noop') return { code: 0, stdout: `sandbox-masks: ${plan.reason}`, stderr: skipWarnings };
     const writeFile = ctx.deps?.writeFile ?? writeFileSync;
     const mkdir = ctx.deps?.mkdir ?? mkdirSync;
     const lstat = ctx.deps?.lstat ?? lstatSync;
-    // The write never follows a symlink or clobbers a non-regular leaf (codex R2): every component
+    // The write never follows a symlink or clobbers a non-regular leaf: every component
     // from the common git dir down is guarded, and an existing exclude leaf must be a regular file.
     try {
       assertContainedRealPath(probe.gitCommonDir, probe.excludeFile, { lstat });

package/tools/set-recipe.mjs

@@ -210,7 +210,7 @@ export const main = (argv, ctx = {}) => {
     const { writtenPath } = writeConfig(cwd, after, ctx);
     const fileBody = serializeConfig(after);
     // The echoed handover line carries the SAME autonomy levels recipes --active-line renders —
-    // sync facts (no render-check needed for the cells; codex R1, Segment B). A malformed policy
+    // sync facts (no render-check needed for the cells; Segment B). A malformed policy
     // surfaces loudly through the line's own MALFORMED segment.
     const autonomyFacts = (() => {
       try {

package/tools/velocity-profile.mjs

@@ -170,7 +170,7 @@ const RUN_GATES_CWD_FLAG = '--cwd';
 // final council: a blanket exclusion at opt-in contradicts «never a preemptive blanket»), guided by
 // codex-exec.sh's own nested-sandbox detection hint.
 export const BRIDGE_REVIEW_WRAPPERS = Object.freeze(['codex-review', 'agy-review']);
-// Only the `code` review mode is auto-allowed (codex R2, Segment A): a bare `Bash(<wrapper>:*)`
+// Only the `code` review mode is auto-allowed (Segment A): a bare `Bash(<wrapper>:*)`
 // prefix would also cover the plan/diff file-argument modes, whose targets can point OUTSIDE the
 // repo — the tier's stated surface is the unattended council CODE review, so the seeded prefix is
 // `<wrapper> code`. Plan/diff invocations keep their prompt.
@@ -210,7 +210,7 @@ export const deriveBridgeTierAllowlist = ({ findWrapper, groundingAbsPath } = {}
   const allow = placed.map((cmd) => `Bash(${cmd} ${BRIDGE_REVIEW_MODE}:*)`);
   const excludedCommands = [...placed];
   // The grounding pre-step exists FOR agy (its grounded --facts reviews; codex grounds natively via
-  // the AGENTS.md auto-merge) — a codex-only install must not auto-allow an unused writer (codex R9).
+  // the AGENTS.md auto-merge) — a codex-only install must not auto-allow an unused writer.
   if (placed.includes('agy-review')) {
     // groundingAbsPath is a TEST seam only (an unseedable kit path — spaces — is not constructible
     // from a test against the real checkout); production callers never pass it.
@@ -420,7 +420,7 @@ const validateSettingsShape = (data, relPath) => {
   }
   // The bridge tier merges into sandbox.excludedCommands — a malformed (non-array) value is a STOP
   // with ZERO writes (the same fail-closed posture as permissions.allow above), never a silent
-  // treat-as-empty overwrite (codex R1, Segment A).
+  // treat-as-empty overwrite (Segment A).
   if (isJsonObject(data.sandbox) && data.sandbox.excludedCommands !== undefined && !Array.isArray(data.sandbox.excludedCommands)) {
     throw makeVelocityProfileError(VELOCITY_MALFORMED, `${relPath}: sandbox.excludedCommands must be an array`);
   }
@@ -647,8 +647,8 @@ const formatKitTier = (result) =>
       ]
     : [];
 
-// The bridge tier's honest posture, printed on EVERY --bridge-tier run (test-pinned — the codex-R2
-// informed-consent resolution): the exfiltration surface is stated, never pretended away.
+// The bridge tier's honest posture, printed on EVERY --bridge-tier run: the informed-consent
+// resolution states the exfiltration surface, never pretends it away.
 export const KIT_BRIDGE_TIER_NOTICE =
   'bridge-wrappers tier: seeds the REVIEW wrappers only, and only their CODE mode (`codex-review code`, `agy-review code` — never codex-exec/agy-run: delegated execution keeps its human prompt; never the plan/diff modes: their file arguments can point outside the repo, so they keep their prompt), each derived ONLY when its bridge is PLACED on PATH, plus the grounding pre-step rule in its rendered quoted byte-form. POSTURE (what this consent covers): an auto-allowed review wrapper runs UNATTENDED — it reads any repo file it is pointed at and sends the assembled payload to its subscription backend, and prefix rules cannot inspect arguments, so a code-mode argument that names a readable file (agy\'s --facts/--decided) rides the same consent — the same documented residual class as the autonomy red-line rules; that is the tier\'s PURPOSE (unattended council review runs) and its residual — tier entries get NO PreToolUse-hook coverage. The grounding entry\'s writer surface is bounded by grounding.mjs\'s OWN scratch-destination guard (a tracked or in-repo-not-ignored --out is refused by the tool). The wrapper names are ALSO seeded into sandbox.excludedCommands IN THE PROJECT settings.json (an exclusion only in settings.local.json was live-observed NOT to route — the wrapper then runs sandboxed and dies on a read-only HOME): the harness runs an excluded command OUTSIDE the sandbox (the wrappers need network), so a plain allowlisted invocation triggers no sandbox-bypass approval. INVOCATION SHAPE: a prefix rule matches only a PLAIN invocation starting with the wrapper name — an env-var prefix or a compound chain never matches (redirects are fine).';
 
@@ -722,7 +722,7 @@ export const screenAllowlistEntry = (pattern) => {
     }
     // Bridge-review-wrapper class (AD-044 Plan 4): EXACTLY `<frozen-tier wrapper> code` + the args
     // wildcard — never codex-exec/agy-run, never the bare or plan/diff spellings (those file-argument
-    // modes can read outside the repo; codex R2).
+    // modes can read outside the repo).
     if (BRIDGE_REVIEW_WRAPPERS.includes(tokens[0])) return tokens.length === 2 && tokens[1] === BRIDGE_REVIEW_MODE;
     return isSingleShellToken(wildcardCmd, tokens) && SHELL_READONLY.includes(wildcardCmd);
   }
@@ -1196,7 +1196,7 @@ const collectRedlineBypass = (sources) =>
 // sub-keys (merge-don't-clobber, never a silent clobber of the user's sandbox tuning), so a pre-existing
 // weakening sub-key is REPORTED loudly (remove it by hand) — never silently carried as security.
 const collectSandboxWeakenings = (sources) => {
-  // Tier-known PROOF (codex R4): an excludedCommands entry is downgraded to a note ONLY when it is
+  // Tier-known PROOF: an excludedCommands entry is downgraded to a note ONLY when it is
   // demonstrably the consented tier's own output — it lives in the PROJECT settings.json (the file
   // the tier writes; a local-file exclusion is never tier output) AND the matching derived
   // code-mode allow rule is present there. A bare name match alone proves nothing.