@sabaiway/agent-workflow-kit 3.0.0 → 3.2.0

package/CHANGELOG.md

@@ -4,6 +4,87 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 3.2.0 — plain language + posture as code: the friction cluster shipped as mechanism (AD-061)
+
+Carrier release for a friction cluster (kit 3.2.0 bundles the bridges + shared contract + the
+plain-language template bar; memory 3.1.0, codex bridge 3.1.0, agy bridge 4.1.0 ride alongside;
+engine unbumped). The packaged fixes below ship as MECHANISM for every user, never as one agent's
+discipline.
+
+- **Shared command-shapes contract.** New `references/shared/command-shapes.md` states the
+  promptless bar for improvised reads/probes — the host's file-read tool, else ONE plain
+  undecorated command (no compounds, redirects, pipes, or command substitution; improvised writes
+  use the host's file-edit tools). Bound via the existing `Requires:` mechanism to exactly the
+  probe-instructing modes (bootstrap / upgrade / velocity, closed-world pinned) + a one-sentence
+  inline bar on the SKILL.md router stamp-read. The honest residual is stated (a decorated form is
+  host/config-dependent) — never a false "always prompts" guarantee.
+- **Plain-language §2.5 Communication bar** in BOTH deployed `agent_rules` templates,
+  byte-identically (the kit fallback deploy path communicates under the same bar): user-facing
+  narration is short and plain in the dialogue language; transliterated jargon is banned; an
+  English term survives only as the NAME of a thing (flag / command / file / test), glossed.
+  `lens-region.mjs` now reconciles a SECOND region (Communication, canon from the kit's own bundled
+  template) so EXISTING deployments gain the bar on `upgrade`, not only new bootstraps.
+- **Posture as code on the codex-exec dispatch and both review dispatches** (bridges bundled here).
+  `codex-exec` gains a D5 exec posture banner (fresh + resume, resolved post-validation values, a
+  validated resume-id grammar + raw-byte NUL screen, control-byte refusal on every field). Both
+  review banners gain a BANNER-ONLY `timeout` field — outside D5 banner↔receipt parity — from ONE
+  shared effective-timeout resolver (byte-identical across the four wrappers) that closes the old
+  env-validation bypass and resolves the timeout binary shadow-proof; no capping binary →
+  `timeout=uncapped`, never fabricated. (The raw `agy-run` probe lane keeps no posture banner —
+  out of scope this release.) The quote-the-banner-verbatim duty rides both bridges' driving
+  contracts, capability notes, and the kit registry mirror, drift-guarded by a new cross-file test;
+  the threat-model boundary is stated on the codex execute capability and `codex-exec --help`
+  surfaces, including the kit mirror. The read-only `bridge-settings` advisor mirrors the wrapper's
+  control-byte refusal semantics with escaped output.
+
+## 3.1.0 — parallel feature worktrees v1: provision · list · land --prepare · cleanup (AD-060)
+
+New `worktrees` mode + `tools/worktrees.mjs` — several features implemented simultaneously in
+DIFFERENT agent sessions on one machine/repo, zero interference on working-tree files (the ONE
+exception: the default `node_modules` symlink is a shared MUTABLE dependency cache — the printed
+isolated install is the isolation lane), unambiguous ownership. One thin dependency-free tool over git: every verification datum is recomputed live
+from git, never read from stored metadata (the ONE exception: the PREPARED OID in the handoff,
+read back only for recovery). Git >= 2.36 floor (NUL-terminated worktree porcelain); typed STOPs,
+never a guess.
+
+- **`provision <slug> --plan <path>`** — visible sibling worktree + `aw/<slug>` branch: the
+  registry-derived footprint copy-if-missing (a tracked file is NEVER overwritten), exactly one
+  seeded feature plan, the `handoff-<slug>.md` stub, shared-`node_modules` symlink advice
+  (`--install` only PRINTS the isolated install — zero spawn, zero write). `--resume` completes a
+  half-done provision behind fail-closed identity: at most one handoff, slug AND branch must
+  match, the section-required `## Provision record` (a duplicated field or section is a STOP,
+  never last-wins), user content preserved byte-exact.
+- **`list`** — read-only and honest: any read failure renders `handoff: (unreadable)` — a silent
+  "no" never appears.
+- **`land <slug> --prepare`** — the transient common-git-dir lock (shared with cleanup),
+  dirty-main / graph-divergence / docs-ai-drift / red-review-state refusals, the satellite
+  working-tree diff versus its base — staged AND unstaged inspected, every unstaged or
+  untracked-not-ignored leftover listed and refused (ignored content is outside observation by
+  design) — binary-safe transfer excluding exactly `docs/ai` + `docs/plans`, the optional
+  porcelain-visible sync adapter, the main gate matrix, and an OID report (main HEAD · TRANSFER ·
+  PREPARED · sync delta). The commit is NEVER run by the tool — it stays a dialogue ask. A second
+  prepare is reset-only against the recorded PREPARED OID; transfer-apply and post-launch sync
+  failures attempt a byte-clean rollback (rollback failures are composed without losing the
+  primary error), while a red gate matrix that leaves the snapshot unchanged intentionally KEEPS
+  the prepared tree and names both recovery lanes.
+- **`cleanup <slug>`** — live landed-verification against main HEAD (exact land-exclusion
+  parity), typed-EXACT ownership of ignored content (file/glob roots own only files), literal
+  pathspecs, branch `-d`, prune; foreign content stops it. `--abandon` is the ONE destructive arm
+  (`-D`; requires the handoff identity).
+- **Hardening:** every content read and regular-file copy goes through two no-follow descriptor
+  doors (identity-bound source · exclusive destination · descriptor-mode update), pinned as the
+  only paths by tripwire tests; strict parsers everywhere (NUL porcelain fields,
+  scan-before-parse JSON with any-depth duplicate-key refusal, atomic section surgery).
+- **release-scan:** the reviewer-round-identity rung — an `agy` or `codex` name followed by an
+  R-number reference is refused; shippable finding IDs use neutral
+  `review-<scope>-rNN-<severity>-NN` IDs; the clean line now reads "no AI attribution or
+  reviewer-round identity found".
+- **recommendations:** the worktrees parent-dir item — write access stays "not confirmed" without
+  a trusted host-capability signal; HAND-APPLY lines are host-qualified.
+- **Docs:** the `references/modes/worktrees.md` contract — the MAIN/SATELLITE ownership matrix
+  (shared git state included), satellite forbidden verbs (the v1 docs-only bar), the
+  host-specific consent lane, and the other-harnesses PROVEN/ASSUMED split.
+
 ## 3.0.0 — strip-the-kit: the hardened computed core replaces the ledger machinery (AD-059)
 
 > ### ⚠ BREAKING — the review loop is now computed, not recorded
@@ -502,7 +583,7 @@ was blocked on an honest degrade.
 
 Contract surfaces moved in lockstep (the tool header, `--help`, the human render, the `--await`
 comment, `references/modes/review-state.md`). Council-converged both segments (S1 codex + agy SHIP; S2
-codex R1 revise → allPresent fold → R2 both SHIP), the two-gate agreement dogfooded live + pinned by a
+review round 1 revise → allPresent fold → review round 2 both SHIP), the two-gate agreement dogfooded live + pinned by a
 detector-independent `two-gate-agreement.test.mjs` + a 17-case matrix; full suite 2969 green.
 
 ## 1.40.0 — Universal verification profile + session-loop economics (a)–(h) (BUGFREE-3, AD-049)

package/README.md

@@ -243,6 +243,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit commit-guard` | any time | **the read-only pre-commit guard** (D10) — binds the LATEST completed `run-gates --final` receipt to the EXACT current tree: refuses on a missing/red/stale receipt, fingerprint drift under the run, a dangling later attempt, declaration content drift, evidence-hash or lcov drift, or unsatisfied review obligations (the same review-state decision, recomputed over a sanitized env — forged out-of-repo stores never satisfy). Re-runs NO gate or test. Wire it into `.git/hooks/pre-commit` (the installer writes the RESOLVED invocation). `git commit --no-verify` stays the stated residual. |
 | `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (sandbox-lane only) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit doc-parity` | any time | **read-only doc-parity lint** (AD-049) — kills the doc-drift class where a mode-contract doc silently lags a code constant (a `--check` doc still reading `300` after the diff cap moved to `400`): a **closed, exported registry** binds each live constant (review caps, schema versions, the ledger's own class/scope vocabulary, and the autonomy-doctor EXIT/status/trusted-dir contract) to the exact token its `references/modes/*.md` contract must carry, and asserts the CURRENT value renders into every bound file — a drifted doc, an unreadable file, or an absent token **fails closed**. The values are sourced from the live imports (never re-typed), so the lint can't itself go stale; adding a binding is adding a checked entry (closed-world, edit-safe). `--check` is a gate exit code for `docs/ai/gates.json`. Never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |
 | `/agent-workflow-kit uninstall` | opt-in, any time | **guarded teardown** — the inverse of `init` / `setup`. Removes only what's **provably ours** (managed skill dirs + bridge wrappers; in a project, the hidden-mode git-ignore block it added + the pre-commit hook it installed); **never deletes** your `docs/ai` / `AGENTS.md` (prints the exact `rm` to run by hand) or your `.claude/settings.json` (prints an **edit** — remove the attribution key, review any velocity `permissions.*` — never an `rm`). Always `--dry-run` first; preflight-then-mutate; never commits. |
 | `/agent-workflow-kit velocity` | Claude Code · opt-in | **onboarding velocity profile** — seeds a fixed, audited **read-only** allowlist into `.claude/settings.json` so routine read-only commands stop idling on approval prompts while you're away; opt-in `acceptEdits`; plus a **read-only advisory** of likely project gate commands to add by hand. Writes **only** `.claude/settings.json` — **never** allowlists commit/push/publish, never writes `settings.local.json`, never commits. A seeded entry is a **trust posture, not a sandbox** (a runtime residual remains at the settings level — its guard ships as the opt-in `hook` command); a direct commit/push/publish still asks. `--dry-run` first. |
 | `/agent-workflow-kit agents` | Claude Code · opt-in | **cheap-lane subagents** — places bundled subagent definitions (`.claude/agents/`) pinned to a **cheap model** (haiku, low effort, read-only tools) for mechanical work: extraction sweeps, changelog fact-skeletons, gate-failure triage. Judgment, review, and real code stay on your main lane — these vehicles only extract and draft, and their output is verified. Preview by default (`--apply` writes); an existing customized file is **preserved, never overwritten**; never touches `settings*.json`, never commits. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '3.0.0'
+  version: '3.2.0'
 ---
 
 # agent-workflow-kit
@@ -68,7 +68,7 @@ Pick the mode from the user's invocation — the mapping is pinned by `tools/com
 
 **Safe-routing rule (which mode did the user invoke?).** Map the invocation token with `tools/commands.mjs` `routeInvocation`: a **known** subcommand → its mode; the **bare/empty** invocation → `bootstrap` — the one writer reachable without a token, and only on an undeployed project (if `docs/ai/` already exists, **ask upgrade-vs-bootstrap**, never overwrite); **any unrecognized/ambiguous** token → `help`, which is **read-only**. The invariant: **no unrecognized/garbage invocation ever triggers a write** (only an explicit known token or the acknowledged bare-bootstrap exception can).
 
-Before acting, read `docs/ai/.workflow-version` (the project's stamp) to decide the route — an **internal** routing decision, **not** a line you print (version display: *Version disclosure* in `${CLAUDE_SKILL_DIR}/references/shared/report-footer.md`). Route:
+Before acting, read `docs/ai/.workflow-version` (the project's stamp) — via the host's file-read tool, else ONE plain undecorated command (no compounds/redirects/pipes) — to decide the route — an **internal** routing decision, **not** a line you print (version display: *Version disclosure* in `${CLAUDE_SKILL_DIR}/references/shared/report-footer.md`). Route:
 
 - **absent** → bootstrap (a fresh deployment).
 - **stamp < `3.0.0`** (the deployment-lineage head) → `upgrade`.
@@ -187,11 +187,15 @@ read-only — read `${CLAUDE_SKILL_DIR}/references/modes/commit-guard.md` before
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/doc-parity.md` before acting.
 
+### Mode: worktrees
+
+writer — read `${CLAUDE_SKILL_DIR}/references/modes/worktrees.md` before acting.
+
 ---
 
 ## References
 
-- [`references/modes/`](${CLAUDE_SKILL_DIR}/references/modes/) — one file per mode; [`references/shared/`](${CLAUDE_SKILL_DIR}/references/shared/) — the shared point-of-use contracts (report footer · composition hand-off · deploy tail).
+- [`references/modes/`](${CLAUDE_SKILL_DIR}/references/modes/) — one file per mode; [`references/shared/`](${CLAUDE_SKILL_DIR}/references/shared/) — the shared point-of-use contracts (report footer · composition hand-off · deploy tail · command shapes).
 - [`references/contracts.md`](${CLAUDE_SKILL_DIR}/references/contracts.md) — the three setup contracts.
 - [`references/templates/`](${CLAUDE_SKILL_DIR}/references/templates/) — the `AGENTS.md` + `docs/ai/` templates + seeded configs; [`references/scripts/`](${CLAUDE_SKILL_DIR}/references/scripts/) — the Node enforcement scripts; [`migrations/`](${CLAUDE_SKILL_DIR}/migrations/) — per-version upgrade steps; [`launchers/`](${CLAUDE_SKILL_DIR}/launchers/) — non-Claude agent launchers.
 - [`tools/`](${CLAUDE_SKILL_DIR}/tools/) — the family-wide tooling; each tool's contract lives with its mode file and its own header; bridge mirrors under [`bridges/`](${CLAUDE_SKILL_DIR}/bridges/).

package/bin/install.mjs

@@ -211,7 +211,16 @@ const spawnMember = ({ command, args, options }) => spawnSync(command, args, opt
 // npm/network blip (rate-limit, registry hiccup, momentary DNS) — an immediate retry tends to hit the
 // same blip, so wait briefly first. Atomics.wait is a dependency-free sync sleep (the install flow is
 // already synchronous here). Injected in tests as a 0ms no-op so the suite never actually sleeps.
-const RETRY_DELAY_MS = 1500;
+// AW_INSTALL_RETRY_DELAY_MS is a test seam (the subprocess cascade suite zeroes the wait; the
+// retry POLICY itself stays exercised). Unset, empty, malformed and negative all keep the shipped
+// default — `Number('')` is 0, so the raw value is screened BEFORE coercion (the R1 council bug).
+export const resolveRetryDelayMs = (env) => {
+  const raw = env.AW_INSTALL_RETRY_DELAY_MS;
+  if (typeof raw !== 'string' || raw.trim() === '') return 1500;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : 1500;
+};
+const RETRY_DELAY_MS = resolveRetryDelayMs(process.env);
 const sleepSync = (ms) => {
   if (ms > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 };

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its no-JSON headless behaviour.
 metadata:
-  version: '4.0.0'
+  version: '4.1.0'
 ---
 
 # antigravity-cli-bridge
@@ -134,10 +134,12 @@ agy-review --continue --decided @round1.md --focus "still-open items"   # round-
 
 **Honesty + posture (D4/D5):** a run with no recognized `### Verdict` section — empty output
 included — **exits 4 with NO receipt**: treat it as a *failed review to re-run*, never a fatal
-session error. One stderr banner states the actual posture (`review posture: model=…`) and the
-receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
+session error. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
+and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
-pre-spend in every mode.
+pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`
+hands to `timeout(1)`, or `uncapped`) — informational, never a receipt field. **Quote the posture
+banner verbatim** when labeling a dispatch.
 
 Frontier default `Gemini 3.1 Pro (High)`; **any** model is allowed (a sub-frontier one earns a
 silenceable `AGY_PROBE=1` advisory). An oversized `code` review trips the byte ceiling with trim/split

package/bridges/antigravity-cli-bridge/bin/agy-review-honesty.test.mjs

@@ -5,9 +5,9 @@
 // posture.model null). Colocated separately from agy-review.test.mjs — that file is
 // red-proof-frozen; this one carries its own minimal standalone harness (the family idiom).
 
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync, cpSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -41,12 +41,17 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
-const makeSandbox = () => {
-  const home = mkdtempSync(join(tmpdir(), 'agy-honesty-'));
+// Farm + sandbox base are READ-ONLY per invocation — built ONCE, shared (a per-run farm rebuild
+// plus a per-test `git init`+commit dominate the wall otherwise).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'agy-honesty-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const FARM = makePathWithout(SHARED_ROOT, ['agy', 'agy-run']);
+
+const TEMPLATE_HOME = (() => {
+  const home = join(SHARED_ROOT, 'template-home');
   const bin = join(home, '.local', 'bin');
   mkdirSync(bin, { recursive: true });
   writeFileSync(join(bin, 'agy'), FAKE_AGY, { mode: 0o755 });
-  chmodSync(join(bin, 'agy'), 0o755);
   const repo = join(home, 'repo');
   mkdirSync(repo);
   const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
@@ -58,7 +63,15 @@ const makeSandbox = () => {
   g('commit', '-qm', 'base');
   writeFileSync(join(repo, 'pending.txt'), 'PENDING\n');
   writeFileSync(join(repo, 'plan.md'), '# a plan artifact\n');
-  return { home, bin, repo };
+  return home;
+})();
+
+const makeSandbox = () => {
+  const home = mkdtempSync(join(tmpdir(), 'agy-honesty-'));
+  cpSync(TEMPLATE_HOME, home, { recursive: true });
+  const bin = join(home, '.local', 'bin');
+  chmodSync(join(bin, 'agy'), 0o755);
+  return { home, bin, repo: join(home, 'repo') };
 };
 
 const run = (sb, { args, env = {} } = {}) => {
@@ -69,7 +82,7 @@ const run = (sb, { args, env = {} } = {}) => {
     timeout: 30000,
     env: {
       HOME: sb.home,
-      PATH: `${sb.bin}:${makePathWithout(sb.home, ['agy', 'agy-run'])}`,
+      PATH: `${sb.bin}:${FARM}`,
       TMPDIR: process.env.TMPDIR ?? '/tmp',
       AGY_FAKE_SENTINEL: sentinel,
       ...env,

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -77,6 +77,11 @@ Notes:
   pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts
   against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE
   dispatching, never fired into a known prompt
+  the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
+  duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
+  INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity
+  quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
+  posture; a prose re-type drifts
 
 Round-2 / resume:
   agy-review --continue [--decided @f] [--focus "…"]
@@ -115,10 +120,12 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
 Honesty + posture (D4/D5):
   a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4
   with NO receipt: a FAILED review to RE-RUN, never a fatal session error. One stderr banner line
-  states the ACTUAL run posture (review posture: model=…) and the receipt records the same
-  posture {model} (agy has no tier). An ATTESTING review with AGY_MODEL explicitly emptied
-  refuses pre-spend (the actual model would be unknowable; AGY_PROBE=1 is exempt), and a model
-  string carrying control bytes refuses pre-spend in every mode.
+  states the ACTUAL run posture (review posture: model=… timeout=…) and the receipt records the
+  same posture {model} (agy has no tier; the timeout field is banner-only — never a receipt
+  field). Quote the posture banner verbatim when labeling this dispatch. An ATTESTING review with
+  AGY_MODEL explicitly emptied refuses pre-spend (the actual model would be unknowable;
+  AGY_PROBE=1 is exempt), and a model string carrying control bytes refuses pre-spend in every
+  mode.
 
 Closed grammar: unknown flags are rejected; no '--' passthrough (the flag escape is --ungrounded; the env escapes are AGY_PROBE=1 and AGY_REVIEW_ALLOW_ADDDIR=1).
 Requires at run time: the agy CLI on PATH + a Google AI subscription login (--help needs neither).
@@ -235,16 +242,66 @@ aw_apply_settings() {
 }
 aw_apply_settings
 
+# --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
+# ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
+# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
+# the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
+# invalid value warns + falls back to the built-in default — a typo never silently masquerades
+# as a cap. AGY_TIMEOUT shares AGY_HARD_TIMEOUT's duration rule (it has no settings-file arm).
+aw_effective_timeout() {
+  local key="$1" default="$2" value="${!1:-}" rule="$1" intpart
+  [[ "$rule" == "AGY_TIMEOUT" ]] && rule="AGY_HARD_TIMEOUT"
+  [[ -n "$value" ]] || { printf '%s' "$default"; return 0; }
+  intpart="${value%%[!0-9]*}"
+  if ! aw_settings_valid "$rule" "$value" || (( ${#intpart} > 7 )); then
+    # %q escapes the raw value so a control byte in it can never forge an extra diagnostic line
+    # (the direct agy-run lane has no pre-spend screen — the warning itself must be injection-proof).
+    printf "warning: invalid value '%q' for %s — using the built-in default %s.\n" "$value" "$key" "$default" >&2
+    printf '%s' "$default"
+    return 0
+  fi
+  printf '%s' "$value"
+}
+aw_timeout_label() {
+  local bin="$1" value="$2"
+  [[ -n "$bin" ]] || { printf 'uncapped'; return 0; }
+  case "$value" in
+    *[!0-9]*) printf '%s' "$value" ;;
+    *) printf '%ss' "$value" ;;
+  esac
+}
+aw_resolve_timeout_bin() {
+  local bin dir base
+  bin="$(builtin type -P timeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || bin="$(builtin type -P gtimeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || { printf ''; return 0; }
+  case "$bin" in
+    /*) ;;
+    *)
+      case "$bin" in
+        */*) dir="${bin%/*}"; base="${bin##*/}" ;;
+        *) dir="."; base="$bin" ;;
+      esac
+      dir="$(builtin cd -- "$dir" 2>/dev/null && builtin pwd -P)" || { printf ''; return 0; }
+      bin="$dir/$base"
+      ;;
+  esac
+  [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
+  printf '%s' "$bin"
+}
+
 DEFAULT_AGY_REVIEW_MODEL="Gemini 3.1 Pro (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="4.0.0"
+AW_BRIDGE_VERSION="4.1.0"
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
 # other interpolation) can echo raw newline/ESC bytes into stderr/the terminal (round-2 fold).
-if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f']* ]]; then
+if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
   echo "error: AGY_MODEL contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
   exit 2
 fi
@@ -254,7 +311,20 @@ FRONTIER_SET=("Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonne
 # Duration-string timeouts (NOT codex's bare seconds): agy-run forwards a duration to --print-timeout,
 # and the timeout(1) hard cap is a duration too — never numerically compared, so 30m vs 2h is fine.
 AGY_HARD_TIMEOUT="${AGY_HARD_TIMEOUT:-30m}"
+# D5 banner-field control-byte screen (AD-061) — like AGY_MODEL above, BEFORE any interpolation.
+if [[ "$AGY_HARD_TIMEOUT" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+  echo "error: AGY_HARD_TIMEOUT contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
+AGY_HARD_TIMEOUT="$(aw_effective_timeout AGY_HARD_TIMEOUT 30m)"
 AGY_TIMEOUT="${AGY_TIMEOUT:-$AGY_HARD_TIMEOUT}"
+# D5 banner-field control-byte screen for AGY_TIMEOUT (AD-061): agy-review forwards it to the
+# child agy-run's --print-timeout, so a control byte must refuse HERE, pre-spawn — the child's
+# own diagnostic would otherwise echo it. (agy-run screens its own direct-lane env separately.)
+if [[ "$AGY_TIMEOUT" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+  echo "error: AGY_TIMEOUT contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
 AGY_PROBE="${AGY_PROBE:-0}"
 # A probe run is RECORDED, not just silently allowed: the receipt carries probe:true so the kit's
 # review-state gate rejects it — a guards-relaxed review must never attest a tree.
@@ -882,7 +952,14 @@ if [[ -z "$AGY_MODEL" && -z "$resume_mode" && "$REVIEW_PROBE" != "true" && "$REV
   echo "       AGY_MODEL (wrapper default), or set the real model display string; AGY_PROBE=1 is exempt." >&2
   exit 2
 fi
-echo "review posture: model=${AGY_MODEL:-<agy settings default>}" >&2
+# The timeout field is BANNER-ONLY (AD-061): it prints exactly the duration agy-run hands to
+# timeout(1), or `uncapped` without a capping binary, and never enters the receipt posture.
+# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
+# `type` itself), normalized to an absolute path fail-closed — the banner can never claim a cap
+# the agy-run child would not have.
+aw_banner_timeout_bin="$(aw_resolve_timeout_bin)"
+aw_timeout_banner="$(aw_timeout_label "$aw_banner_timeout_bin" "$AGY_HARD_TIMEOUT")"
+echo "review posture: model=${AGY_MODEL:-<agy settings default>} timeout=$aw_timeout_banner" >&2
 
 # --- Execute via agy-run (single home of timeout + subscription + byte ceiling) ---
 # The output is teed into the private staging dir so the mandated '### Verdict' section can be