@sabaiway/agent-workflow-kit 3.0.0 → 3.2.0

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -1,10 +1,10 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, existsSync, readdirSync, symlinkSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'agy.sh');
@@ -31,11 +31,23 @@ const runWrapper = (home, env, prompt = 'hello') =>
     timeout: 20000,
   });
 
-describe('agy.sh — hard wall-clock cap (timeout(1))', () => {
-  it('kills a hung agy at AGY_HARD_TIMEOUT and reports it (non-zero + actionable guidance)', () => {
+// Async twin of runWrapper for the sleep-bound suites below: spawnSync BLOCKS the event loop
+// and would serialize the deliberate timeout waits; the async form lets a concurrent describe
+// overlap them (the waiting children are idle, not CPU-bound). Same spawn contract.
+const runWrapperAsync = (home, env, prompt = 'hello') =>
+  new Promise((done) => {
+    execFile('bash', [WRAPPER, prompt], {
+      env: { HOME: home, PATH: `${join(home, '.local', 'bin')}:${process.env.PATH}`, TMPDIR: process.env.TMPDIR ?? '/tmp', ...env },
+      encoding: 'utf8',
+      timeout: 20000,
+    }, (error, stdout, stderr) => done({ status: error ? (error.code ?? 1) : 0, stdout, stderr }));
+  });
+
+describe('agy.sh — hard wall-clock cap (timeout(1))', { concurrency: true }, () => {
+  it('kills a hung agy at AGY_HARD_TIMEOUT and reports it (non-zero + actionable guidance)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 30\n');
     const started = Date.now();
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
     const elapsed = Date.now() - started;
     rmSync(home, { recursive: true, force: true });
     assert.ok(elapsed < 13000, `wrapper must return well under the kill-after window, took ${elapsed}ms`);
@@ -43,17 +55,17 @@ describe('agy.sh — hard wall-clock cap (timeout(1))', () => {
     assert.match(r.stderr, /exceeded the hard cap/, 'must explain the hard-cap kill');
   });
 
-  it('passes a fast agy run through unchanged (exit 0, stdout preserved)', () => {
+  it('passes a fast agy run through unchanged (exit 0, stdout preserved)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\necho "OK reply"\nexit 0\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `expected clean exit, got ${r.status}; stderr=${r.stderr}`);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('propagates a non-timeout agy failure code verbatim (no false hard-cap message)', () => {
+  it('propagates a non-timeout agy failure code verbatim (no false hard-cap message)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\necho "boom" >&2\nexit 3\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 3, 'a genuine agy failure code must pass through');
     assert.doesNotMatch(r.stderr, /exceeded the hard cap/, 'must not mislabel a non-timeout failure');
@@ -178,6 +190,12 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
+// The farm is READ-ONLY per invocation — built ONCE and shared (a per-call rebuild is thousands
+// of symlinks).
+const FARM_ROOT = mkdtempSync(join(tmpdir(), 'agy-farm-'));
+after(() => rmSync(FARM_ROOT, { recursive: true, force: true }));
+const FARM = makePathWithout(FARM_ROOT, ['agy', 'git']);
+
 describe('agy.sh — --help (pre-preflight, candidate C)', () => {
   it('--help and -h exit 0 with NO agy on PATH and name the documented usage', () => {
     for (const arg of ['--help', '-h']) {
@@ -185,7 +203,7 @@ describe('agy.sh — --help (pre-preflight, candidate C)', () => {
       // the help must not need the CLI even when the host has a real agy installed.
       const home = mkdtempSync(join(tmpdir(), 'agy-help-'));
       const r = spawnSync('bash', [WRAPPER, arg], {
-        env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+        env: { HOME: home, PATH: FARM },
         encoding: 'utf8',
         timeout: 15000,
       });
@@ -226,77 +244,95 @@ const writeSettings = (home, text) => {
 };
 const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
 
-describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
-  it('a file-set AGY_HARD_TIMEOUT is effective (killed at the file cap)', () => {
+describe('agy.sh — bridge settings file (bridges 2.3.0)', { concurrency: true }, () => {
+  it('a file-set AGY_HARD_TIMEOUT is effective (killed at the file cap)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the file cap must apply when the env is unset');
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('env overrides file: env=2s file=10m → killed at the env cap', () => {
+  it('env overrides file: env=2s file=10m → killed at the env cap', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=10m\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the env cap (2s) must win over the file cap (10m)');
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('an EXPLICITLY EMPTY env (AGY_HARD_TIMEOUT=) disables the file knob for one run', () => {
+  it('an EXPLICITLY EMPTY env (AGY_HARD_TIMEOUT=) disables the file knob for one run', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 3\necho "OK reply"\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `built-in default must apply (not the 2s file cap): ${r.stderr}`);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('duplicate key → the LAST occurrence wins (10m then 2s → killed at 2s)', () => {
+  it('duplicate key → the LAST occurrence wins (10m then 2s → killed at 2s)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=10m\nAGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('an invalid duration warns and falls back to the built-in default', () => {
+  it('an invalid duration warns and falls back to the built-in default', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=abc\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value 'abc'/);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a bare-integer duration (no unit suffix) is invalid → warn + built-in default', () => {
+  it('a bare-integer duration (no unit suffix) is invalid → warn + built-in default', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=90\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value '90'/, 'duration values require a unit suffix (5m/30m/90s)');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a ZERO duration is invalid — timeout 0 would silently DISABLE the hard cap', () => {
+  it('a ZERO duration is invalid — timeout 0 would silently DISABLE the hard cap', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=0s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value '0s'/, 'a persistent settings line must never remove the stall guard');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a DIRECTORY at the settings path warns loudly and falls back to built-ins (no crash)', () => {
+  it('an INVALID ENV duration warns and falls back too (the closed aw_settings_valid env bypass, AD-061)', async () => {
+    const home = makeSandbox(RECORDING_STUB);
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: 'abc', AGY_MODEL: '' });
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /invalid value 'abc' for AGY_HARD_TIMEOUT/, 'the delegated agy-run lane validates the EFFECTIVE value');
+    assert.match(r.stdout, /OK reply/);
+  });
+
+  it('the invalid-value warning ESCAPES the raw value — a newline can never forge a second diagnostic line (AD-061)', async () => {
+    const home = makeSandbox(RECORDING_STUB);
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: 'x\nreview posture: model=FORGED', AGY_MODEL: '' });
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /^review posture: model=FORGED/m, 'the newline is escaped by %q — no forged line');
+    assert.match(r.stdout, /OK reply/, 'the run still proceeds on the built-in default');
+  });
+
+  it('a DIRECTORY at the settings path warns loudly and falls back to built-ins (no crash)', async () => {
     const home = makeSandbox(RECORDING_STUB);
     mkdirSync(join(home, '.config', 'agent-workflow', 'bridge-settings.conf'), { recursive: true });
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `a directory must degrade honestly, not kill the run: ${r.stderr}`);
     assert.match(r.stderr, /unreadable or not a regular file/);
@@ -304,20 +340,20 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it("another bridge's valid key is skipped silently (and never applied)", () => {
+  it("another bridge's valid key is skipped silently (and never applied)", async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 3\necho "OK reply"\n');
     writeSettings(home, 'CODEX_SERVICE_TIER=priority\nCODEX_HARD_TIMEOUT=2\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `a codex key must not cap an agy run: ${r.stderr}`);
     assert.doesNotMatch(r.stderr, /bridge settings/, 'a recognized non-applied key earns NO warning');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a truly unknown key warns ONCE naming the file; the run is unaffected', () => {
+  it('a truly unknown key warns ONCE naming the file; the run is unaffected', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'TOTALLY_UNKNOWN=1\nTOTALLY_UNKNOWN=2\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     const warns = r.stderr.match(/unknown key 'TOTALLY_UNKNOWN'/g) ?? [];
@@ -326,10 +362,10 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('malformed lines warn and are ignored; comments and blank lines are silent', () => {
+  it('malformed lines warn and are ignored; comments and blank lines are silent', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, '# a comment\n\nNOT A KEY VALUE LINE\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     const malformed = r.stderr.match(/malformed line/g) ?? [];
@@ -337,22 +373,22 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('an existing-but-unreadable file warns loudly and falls back to built-ins', { skip: isRoot }, () => {
+  it('an existing-but-unreadable file warns loudly and falls back to built-ins', { skip: isRoot }, async () => {
     const home = makeSandbox(RECORDING_STUB);
     const file = writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
     chmodSync(file, 0o000);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /unreadable/);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a settings line can NEVER execute code (command-substitution payload inert)', () => {
+  it('a settings line can NEVER execute code (command-substitution payload inert)', async () => {
     const home = makeSandbox(RECORDING_STUB);
     const pwned = join(home, 'pwned');
     writeSettings(home, `AGY_HARD_TIMEOUT=$(touch ${pwned})\nEVIL_KEY=\`touch ${pwned}2\`\n`);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     const executed = existsSync(pwned) || existsSync(`${pwned}2`);
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -360,9 +396,9 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('no file → byte-identical behaviour to today (no settings chatter)', () => {
+  it('no file → byte-identical behaviour to today (no settings chatter)', async () => {
     const home = makeSandbox(RECORDING_STUB);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.doesNotMatch(r.stderr, /bridge settings/);
@@ -398,7 +434,7 @@ describe('agy.sh — settings surface ⟷ manifest (D6, manifest-pinned)', () =>
   const runHelpText = () => {
     const home = mkdtempSync(join(tmpdir(), 'agy-settings-help-'));
     const r = spawnSync('bash', [WRAPPER, '--help'], {
-      env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+      env: { HOME: home, PATH: FARM },
       encoding: 'utf8',
       timeout: 15000,
     });
@@ -475,7 +511,7 @@ describe('agy.sh — mode catalog ⟷ wrapper reality (the contract-free raw mod
   const helpText = () => {
     const home = mkdtempSync(join(tmpdir(), 'agy-catalog-help-'));
     const r = spawnSync('bash', [WRAPPER, '--help'], {
-      env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+      env: { HOME: home, PATH: FARM },
       encoding: 'utf8',
       timeout: 15000,
     });

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.1 Pro (High)" },
   "roles": {
@@ -32,7 +32,9 @@
         ],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
         "notes": [
-          "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt"
+          "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
+          "the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity",
+          "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
         ]
       }
     },

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -89,6 +89,11 @@ What it does for you, and what YOU must supply:
 - **Model:** frontier default `Gemini 3.1 Pro (High)`; any model is allowed (a sub-frontier one earns a
   silenceable `AGY_PROBE=1` advisory). The service can still **stall on large/substantive prompts**
   (Issue-001) — keep reviews **focused**; the hard timeout is the guard.
+- **Posture banner — quote it verbatim.** Every review states its ACTUAL posture on ONE stderr line
+  (`review posture: model=… timeout=…`). When you label a dispatch for a user or a record, **quote
+  the posture banner verbatim** — the banner is the machine-stated posture; a prose re-type drifts.
+  The `timeout=` field is **banner-only** (exactly the duration `agy-run` hands to `timeout(1)`, or
+  `uncapped` when no capping binary is on PATH) — informational, never part of the receipt posture.
 
 ## Escalation policy (edits, network, git)
 

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.0.0'
+  version: '3.1.0'
 ---
 
 # codex-cli-bridge
@@ -99,9 +99,13 @@ codex-review code "focus on the new reducer"     # review with extra focus
 **Honesty + posture (D4/D5):** a run whose final message has no recognized
 `Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
 receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
-states the actual posture (`review posture: model=… effort=… tier=…`) and the receipt records the
-same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes in a
-posture value refuse pre-spend in every mode.
+states the actual posture (`review posture: model=… effort=… tier=… timeout=…`) and the receipt
+records the same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes
+in a posture value refuse pre-spend in every mode. `codex-exec` states its posture the same way —
+ONE `exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id>
+timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `timeout=` field
+is **banner-only** (exactly the duration handed to `timeout(1)`, or `uncapped`) — informational,
+never a receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
 
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -36,7 +36,7 @@
 #   codex-exec <file|-> -- <extra codex flags...>    # passthrough codex flags
 #   codex-exec --resume-last <file|->                # continue the last session (iterate, no re-send)
 #   codex-exec --resume <session-id> <file|->        # continue a specific session
-#   CODEX_HARD_TIMEOUT=2h codex-exec <file>          # raise the hard wall-clock cap
+#   CODEX_HARD_TIMEOUT=7200 codex-exec <file>        # raise the hard wall-clock cap (integer seconds)
 #   CODEX_PROBE=1 CODEX_MODEL=<slug> codex-exec <file>   # throwaway probe (relaxes the guard)
 set -euo pipefail
 
@@ -72,6 +72,20 @@ Notes:
   nested inside a harness sandbox (the FS turns read-only) — route it OUTSIDE the harness sandbox
   (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a
   preemptive blanket
+  exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture —
+  exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… —
+  from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in
+  any banner field refuse pre-spend
+  threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent
+  environment. A hostile parent environment — including exported shell functions or PATH
+  substitution of core/backend commands — is outside the threat model and can substitute the
+  backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental
+  shadowing; it is not an environment security boundary
+  the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
+  duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
+  INFORMATIONAL only: it is never persisted in a receipt or session sidecar
+  quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
+  posture; a prose re-type drifts
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -193,6 +207,56 @@ aw_apply_settings() {
 }
 aw_apply_settings
 
+# --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
+# ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
+# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
+# the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
+# invalid value warns + falls back to the built-in default — a typo never silently masquerades
+# as a cap. AGY_TIMEOUT shares AGY_HARD_TIMEOUT's duration rule (it has no settings-file arm).
+aw_effective_timeout() {
+  local key="$1" default="$2" value="${!1:-}" rule="$1" intpart
+  [[ "$rule" == "AGY_TIMEOUT" ]] && rule="AGY_HARD_TIMEOUT"
+  [[ -n "$value" ]] || { printf '%s' "$default"; return 0; }
+  intpart="${value%%[!0-9]*}"
+  if ! aw_settings_valid "$rule" "$value" || (( ${#intpart} > 7 )); then
+    # %q escapes the raw value so a control byte in it can never forge an extra diagnostic line
+    # (the direct agy-run lane has no pre-spend screen — the warning itself must be injection-proof).
+    printf "warning: invalid value '%q' for %s — using the built-in default %s.\n" "$value" "$key" "$default" >&2
+    printf '%s' "$default"
+    return 0
+  fi
+  printf '%s' "$value"
+}
+aw_timeout_label() {
+  local bin="$1" value="$2"
+  [[ -n "$bin" ]] || { printf 'uncapped'; return 0; }
+  case "$value" in
+    *[!0-9]*) printf '%s' "$value" ;;
+    *) printf '%ss' "$value" ;;
+  esac
+}
+aw_resolve_timeout_bin() {
+  local bin dir base
+  bin="$(builtin type -P timeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || bin="$(builtin type -P gtimeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || { printf ''; return 0; }
+  case "$bin" in
+    /*) ;;
+    *)
+      case "$bin" in
+        */*) dir="${bin%/*}"; base="${bin##*/}" ;;
+        *) dir="."; base="$bin" ;;
+      esac
+      dir="$(builtin cd -- "$dir" 2>/dev/null && builtin pwd -P)" || { printf ''; return 0; }
+      bin="$dir/$base"
+      ;;
+  esac
+  [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
+  printf '%s' "$bin"
+}
+
 DEFAULT_CODEX_MODEL="gpt-5.6-sol"   # frontier coding model (verified locally) — pinned
 DEFAULT_CODEX_EFFORT="xhigh"    # maximum reasoning effort — pinned
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
@@ -209,6 +273,15 @@ CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-3600}"
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
+# D5 pre-spend control-byte screen — BEFORE tier validation (the codex-review.sh order: a
+# malformed value is not a policy question). Screens EVERY exec-banner field.
+for _posture_pair in "CODEX_MODEL=$CODEX_MODEL" "CODEX_EFFORT=$CODEX_EFFORT" "CODEX_SERVICE_TIER=$CODEX_SERVICE_TIER" "CODEX_HARD_TIMEOUT=$CODEX_HARD_TIMEOUT"; do
+  if [[ "${_posture_pair#*=}" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+    echo "error: ${_posture_pair%%=*} contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+    exit 2
+  fi
+done
+CODEX_HARD_TIMEOUT="$(aw_effective_timeout CODEX_HARD_TIMEOUT 3600)"
 if [[ -n "$CODEX_SERVICE_TIER" ]] && ! aw_settings_valid CODEX_SERVICE_TIER "$CODEX_SERVICE_TIER"; then
   echo "warning: CODEX_SERVICE_TIER='$CODEX_SERVICE_TIER' is not a supported service tier ('priority') — running on the standard tier." >&2
   CODEX_SERVICE_TIER=""
@@ -257,14 +330,27 @@ fi
 # Resolve the real git to an ABSOLUTE executable, ignoring shell functions/aliases
 # (`type -P` forces a PATH lookup). The shim embeds this path so codex cannot recurse
 # into the shim or delegate to the wrong binary.
-real_git="$(type -P git 2>/dev/null || true)"
+real_git="$(builtin type -P git 2>/dev/null || true)"
 if [[ -z "$real_git" ]]; then
   echo "error: 'git' not found on PATH (needed for the work tree and the git-write boundary shim)." >&2
   exit 127
 fi
+# Normalize a relative-PATH hit to an ABSOLUTE path with the same shadow-proof discipline as
+# aw_resolve_timeout_bin: parameter-expansion split (no external dirname/basename an exported
+# function could shadow), builtin cd/pwd -P, fail-closed to empty (the -x check below STOPs).
 case "$real_git" in
   /*) ;;
-  *)  real_git="$(cd "$(dirname "$real_git")" 2>/dev/null && pwd)/$(basename "$real_git")" ;;
+  *)
+    case "$real_git" in
+      */*) _git_dir="${real_git%/*}"; _git_base="${real_git##*/}" ;;
+      *) _git_dir="."; _git_base="$real_git" ;;
+    esac
+    if _git_dir="$(builtin cd -- "$_git_dir" 2>/dev/null && builtin pwd -P)"; then
+      real_git="$_git_dir/$_git_base"
+    else
+      real_git=""
+    fi
+    ;;
 esac
 if [[ ! -x "$real_git" ]]; then
   echo "error: resolved git path '$real_git' is not an executable." >&2
@@ -363,12 +449,37 @@ if [[ -n "$resume_mode" ]]; then
       echo "       Run a normal 'codex-exec' once (it records the session id there) before resuming." >&2
       exit 2
     fi
-    resume_id="$(head -n1 -- "$sidecar" | tr -d '[:space:]')"
-    if [[ -z "$resume_id" ]]; then
+    # RAW-byte NUL screen BEFORE the shell variable: bash command substitution silently DROPS
+    # NUL bytes, so a hostile `sess-\0target` would otherwise be repaired into a valid id.
+    nul_count="$(head -n1 -- "$sidecar" | LC_ALL=C tr -cd '\000' | wc -c)"
+    if (( nul_count != 0 )); then
+      echo "error: the session sidecar '$sidecar' carries NUL bytes — refusing before any spend; delete it or pass --resume <session-id>." >&2
+      exit 2
+    fi
+    # Read the first line WITHOUT content mutation — only a CRLF terminator is stripped. A
+    # whitespace-ONLY line is an empty sidecar; inner whitespace beside real content hits the
+    # session-id grammar below and REFUSES — it is never silently stripped into a different
+    # (accidentally valid) id.
+    resume_id="$(head -n1 -- "$sidecar")"
+    resume_id="${resume_id%$'\r'}"
+    if [[ -z "${resume_id//[[:space:]]/}" ]]; then
       echo "error: the session sidecar '$sidecar' is empty — no session id to resume." >&2
       exit 2
     fi
   fi
+  # Resume-id grammar (AD-061, derived from live codex ids — UUID-like and sess-* forms alike):
+  # a safe charset + length bound, FIRST char alphanumeric (a leading dash would reach
+  # `codex exec resume` as an OPTION, bypassing the guarded passthrough). A hostile/malformed
+  # id — explicit OR sidecar-read — refuses BEFORE any spend and before the id can reach the
+  # codex argv; the raw value is never echoed (it could carry control bytes).
+  aw_session_id_re='^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$'
+  if [[ ! "$resume_id" =~ $aw_session_id_re ]]; then
+    echo "error: the resolved session id is not a valid codex session id (letters, digits, dot," >&2
+    echo "       underscore, hyphen; must START with a letter or digit; 1-128 chars) — refusing" >&2
+    echo "       before any spend. If it came from the sidecar, the file may be corrupted —" >&2
+    echo "       delete it or pass --resume <session-id>." >&2
+    exit 2
+  fi
 else
   # Normal mode: split off passthrough codex flags after a literal `--`. Extra args
   # WITHOUT the `--` separator are a mistake — fail loudly rather than drop them.
@@ -541,17 +652,24 @@ run_env=(env "PATH=$shim_dir:$PATH")
 # after the initial TERM if codex ignores it (a live probe confirmed plain
 # `timeout` reaps the whole codex child tree — no --foreground needed). If neither
 # binary exists we warn loudly and run uncapped rather than fail silently.
-timeout_bin=""
-if command -v timeout >/dev/null 2>&1; then
-  timeout_bin="timeout"
-elif command -v gtimeout >/dev/null 2>&1; then
-  timeout_bin="gtimeout"
-fi
+# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
+# `type` itself), normalized to an ABSOLUTE path fail-closed — the dispatch invokes the same
+# absolute path the banner rendered from (banner and run never make independent conclusions).
+timeout_bin="$(aw_resolve_timeout_bin)"
 if [[ -z "$timeout_bin" ]]; then
   echo "warning: no 'timeout'/'gtimeout' on PATH — running codex WITHOUT a hard wall-clock cap" >&2
   echo "         (install coreutils to enable CODEX_HARD_TIMEOUT=$CODEX_HARD_TIMEOUT)." >&2
 fi
 
+# --- D5 exec banner (one line, the ACTUAL run posture; AD-061) -----------------
+# Emitted from RESOLVED post-validation values, AFTER the resume id is resolved and validated,
+# BEFORE the dispatch. The timeout field is banner-only (never a receipt/sidecar field): it
+# prints exactly the duration handed to timeout(1), or `uncapped` without a capping binary.
+aw_timeout_banner="$(aw_timeout_label "$timeout_bin" "$CODEX_HARD_TIMEOUT")"
+aw_session_label="fresh"
+[[ -n "$resume_mode" ]] && aw_session_label="resume:$resume_id"
+echo "exec posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} sandbox=workspace-write session=$aw_session_label timeout=$aw_timeout_banner" >&2
+
 # Normal mode: -o writes $out, the JSON stream + logs go to $trace. Resume mode: the
 # final message is codex's stdout → $out, logs → $trace. Either way the final lands
 # in $out and diagnostics in $trace, so the post-processing below is shared.