@sabaiway/agent-workflow-kit 3.1.0 → 3.3.0

package/CHANGELOG.md

@@ -4,6 +4,77 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 3.3.0 — version-pin honesty: the profile stops claiming a limit it never observed (AD-062)
+
+`velocity --autonomy` told every user their credentials could not be protected by the sandbox —
+naming a harness version frozen in the source, 30 patch releases stale, while a comment three lines
+above recorded when the capability had actually arrived. A user who declared
+`redlines.credentials=deny` got no `sandbox.credentials` key and a confident explanation that the
+platform could not enforce it. Not a silent failure: a false claim about a security control.
+
+Nobody can guarantee a vendor's version format, install layout or settings schema stays put, so the
+fix is not "read the right version" — it is **never state what was not observed**. A pin goes stale
+silently; a probe goes stale loudly, and that direction is the whole point.
+
+- **`probeHarnessVersion`** reads the INSTALLED harness at render time — read-only PATH resolution,
+  never a spawn. Two layouts matched exactly (`claude/versions/<version>` and the
+  `@anthropic-ai/claude-code` package.json); a third-party wrapper whose name merely contains
+  "claude", a decorated version segment, and a prerelease all resolve to a STATED unknown. A
+  programming defect inside the walk is rethrown rather than reported as an unknown layout, and an
+  unreadable package.json surfaces instead of folding into "not found".
+- **A supported build now gets the protection.** `sandbox.credentials` is rendered, MERGED into
+  settings (hand-declared `files` and foreign entries survive), drift-checked and local-mask-checked
+  — the render owns exactly the entries for the env vars it protects, nothing more.
+- **Every honest limit is a loud degrade, not a note.** Coverage is stated PARTIAL (env vars only;
+  file credentials are NOT rendered, because that entry shape was never verified against an
+  installed build). `credentials=ask` degrades rather than being quietly upgraded to deny. An older
+  build, or one whose version cannot be RESOLVED from a recognised layout, degrades naming what was
+  observed or stating that nothing was — and a PASSING `--check` prints the degrades too, because
+  "in sync" only means the file matches the render. An UNREADABLE install (a permission error) or a
+  defect inside the probe is a different outcome on purpose: it throws loudly rather than degrading,
+  because "cannot confirm" must never read as "confirmed absent".
+- **New `version-pin` rung in `release-scan`.** A harness version literal under `tools/` fails the
+  scan unless a runtime probe sits beside it in the same JS file. The harness series is discovered
+  from the scanned file, never hardcoded — a scanner carrying its own pin would be an instance of the
+  class it catches, and a self-refusal test enforces that. Prose earns nothing: a `#` comment in a
+  shell script or a line of Markdown cannot hold a probe, so those files stay scanned.
+  **Stated residual, argued in the source:** the rung proves a probe is PRESENT, not that its result
+  is compared with the literal. Proving the latter is JS lexing; an approximation of it was tried and
+  withdrawn, because each increment of precision opened a new hole without buying the guarantee.
+
+## 3.2.0 — plain language + posture as code: the friction cluster shipped as mechanism (AD-061)
+
+Carrier release for a friction cluster (kit 3.2.0 bundles the bridges + shared contract + the
+plain-language template bar; memory 3.1.0, codex bridge 3.1.0, agy bridge 4.1.0 ride alongside;
+engine unbumped). The packaged fixes below ship as MECHANISM for every user, never as one agent's
+discipline.
+
+- **Shared command-shapes contract.** New `references/shared/command-shapes.md` states the
+  promptless bar for improvised reads/probes — the host's file-read tool, else ONE plain
+  undecorated command (no compounds, redirects, pipes, or command substitution; improvised writes
+  use the host's file-edit tools). Bound via the existing `Requires:` mechanism to exactly the
+  probe-instructing modes (bootstrap / upgrade / velocity, closed-world pinned) + a one-sentence
+  inline bar on the SKILL.md router stamp-read. The honest residual is stated (a decorated form is
+  host/config-dependent) — never a false "always prompts" guarantee.
+- **Plain-language §2.5 Communication bar** in BOTH deployed `agent_rules` templates,
+  byte-identically (the kit fallback deploy path communicates under the same bar): user-facing
+  narration is short and plain in the dialogue language; transliterated jargon is banned; an
+  English term survives only as the NAME of a thing (flag / command / file / test), glossed.
+  `lens-region.mjs` now reconciles a SECOND region (Communication, canon from the kit's own bundled
+  template) so EXISTING deployments gain the bar on `upgrade`, not only new bootstraps.
+- **Posture as code on the codex-exec dispatch and both review dispatches** (bridges bundled here).
+  `codex-exec` gains a D5 exec posture banner (fresh + resume, resolved post-validation values, a
+  validated resume-id grammar + raw-byte NUL screen, control-byte refusal on every field). Both
+  review banners gain a BANNER-ONLY `timeout` field — outside D5 banner↔receipt parity — from ONE
+  shared effective-timeout resolver (byte-identical across the four wrappers) that closes the old
+  env-validation bypass and resolves the timeout binary shadow-proof; no capping binary →
+  `timeout=uncapped`, never fabricated. (The raw `agy-run` probe lane keeps no posture banner —
+  out of scope this release.) The quote-the-banner-verbatim duty rides both bridges' driving
+  contracts, capability notes, and the kit registry mirror, drift-guarded by a new cross-file test;
+  the threat-model boundary is stated on the codex execute capability and `codex-exec --help`
+  surfaces, including the kit mirror. The read-only `bridge-settings` advisor mirrors the wrapper's
+  control-byte refusal semantics with escaped output.
+
 ## 3.1.0 — parallel feature worktrees v1: provision · list · land --prepare · cleanup (AD-060)
 
 New `worktrees` mode + `tools/worktrees.mjs` — several features implemented simultaneously in

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '3.1.0'
+  version: '3.3.0'
 ---
 
 # agent-workflow-kit
@@ -68,7 +68,7 @@ Pick the mode from the user's invocation — the mapping is pinned by `tools/com
 
 **Safe-routing rule (which mode did the user invoke?).** Map the invocation token with `tools/commands.mjs` `routeInvocation`: a **known** subcommand → its mode; the **bare/empty** invocation → `bootstrap` — the one writer reachable without a token, and only on an undeployed project (if `docs/ai/` already exists, **ask upgrade-vs-bootstrap**, never overwrite); **any unrecognized/ambiguous** token → `help`, which is **read-only**. The invariant: **no unrecognized/garbage invocation ever triggers a write** (only an explicit known token or the acknowledged bare-bootstrap exception can).
 
-Before acting, read `docs/ai/.workflow-version` (the project's stamp) to decide the route — an **internal** routing decision, **not** a line you print (version display: *Version disclosure* in `${CLAUDE_SKILL_DIR}/references/shared/report-footer.md`). Route:
+Before acting, read `docs/ai/.workflow-version` (the project's stamp) — via the host's file-read tool, else ONE plain undecorated command (no compounds/redirects/pipes) — to decide the route — an **internal** routing decision, **not** a line you print (version display: *Version disclosure* in `${CLAUDE_SKILL_DIR}/references/shared/report-footer.md`). Route:
 
 - **absent** → bootstrap (a fresh deployment).
 - **stamp < `3.0.0`** (the deployment-lineage head) → `upgrade`.
@@ -195,7 +195,7 @@ writer — read `${CLAUDE_SKILL_DIR}/references/modes/worktrees.md` before actin
 
 ## References
 
-- [`references/modes/`](${CLAUDE_SKILL_DIR}/references/modes/) — one file per mode; [`references/shared/`](${CLAUDE_SKILL_DIR}/references/shared/) — the shared point-of-use contracts (report footer · composition hand-off · deploy tail).
+- [`references/modes/`](${CLAUDE_SKILL_DIR}/references/modes/) — one file per mode; [`references/shared/`](${CLAUDE_SKILL_DIR}/references/shared/) — the shared point-of-use contracts (report footer · composition hand-off · deploy tail · command shapes).
 - [`references/contracts.md`](${CLAUDE_SKILL_DIR}/references/contracts.md) — the three setup contracts.
 - [`references/templates/`](${CLAUDE_SKILL_DIR}/references/templates/) — the `AGENTS.md` + `docs/ai/` templates + seeded configs; [`references/scripts/`](${CLAUDE_SKILL_DIR}/references/scripts/) — the Node enforcement scripts; [`migrations/`](${CLAUDE_SKILL_DIR}/migrations/) — per-version upgrade steps; [`launchers/`](${CLAUDE_SKILL_DIR}/launchers/) — non-Claude agent launchers.
 - [`tools/`](${CLAUDE_SKILL_DIR}/tools/) — the family-wide tooling; each tool's contract lives with its mode file and its own header; bridge mirrors under [`bridges/`](${CLAUDE_SKILL_DIR}/bridges/).

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its no-JSON headless behaviour.
 metadata:
-  version: '4.0.0'
+  version: '4.1.0'
 ---
 
 # antigravity-cli-bridge
@@ -134,10 +134,12 @@ agy-review --continue --decided @round1.md --focus "still-open items"   # round-
 
 **Honesty + posture (D4/D5):** a run with no recognized `### Verdict` section — empty output
 included — **exits 4 with NO receipt**: treat it as a *failed review to re-run*, never a fatal
-session error. One stderr banner states the actual posture (`review posture: model=…`) and the
-receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
+session error. One stderr banner states the actual posture (`review posture: model=… timeout=…`)
+and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
-pre-spend in every mode.
+pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`
+hands to `timeout(1)`, or `uncapped`) — informational, never a receipt field. **Quote the posture
+banner verbatim** when labeling a dispatch.
 
 Frontier default `Gemini 3.1 Pro (High)`; **any** model is allowed (a sub-frontier one earns a
 silenceable `AGY_PROBE=1` advisory). An oversized `code` review trips the byte ceiling with trim/split

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -77,6 +77,11 @@ Notes:
   pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts
   against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE
   dispatching, never fired into a known prompt
+  the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
+  duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
+  INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity
+  quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
+  posture; a prose re-type drifts
 
 Round-2 / resume:
   agy-review --continue [--decided @f] [--focus "…"]
@@ -115,10 +120,12 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
 Honesty + posture (D4/D5):
   a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4
   with NO receipt: a FAILED review to RE-RUN, never a fatal session error. One stderr banner line
-  states the ACTUAL run posture (review posture: model=…) and the receipt records the same
-  posture {model} (agy has no tier). An ATTESTING review with AGY_MODEL explicitly emptied
-  refuses pre-spend (the actual model would be unknowable; AGY_PROBE=1 is exempt), and a model
-  string carrying control bytes refuses pre-spend in every mode.
+  states the ACTUAL run posture (review posture: model=… timeout=…) and the receipt records the
+  same posture {model} (agy has no tier; the timeout field is banner-only — never a receipt
+  field). Quote the posture banner verbatim when labeling this dispatch. An ATTESTING review with
+  AGY_MODEL explicitly emptied refuses pre-spend (the actual model would be unknowable;
+  AGY_PROBE=1 is exempt), and a model string carrying control bytes refuses pre-spend in every
+  mode.
 
 Closed grammar: unknown flags are rejected; no '--' passthrough (the flag escape is --ungrounded; the env escapes are AGY_PROBE=1 and AGY_REVIEW_ALLOW_ADDDIR=1).
 Requires at run time: the agy CLI on PATH + a Google AI subscription login (--help needs neither).
@@ -235,16 +242,66 @@ aw_apply_settings() {
 }
 aw_apply_settings
 
+# --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
+# ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
+# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
+# the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
+# invalid value warns + falls back to the built-in default — a typo never silently masquerades
+# as a cap. AGY_TIMEOUT shares AGY_HARD_TIMEOUT's duration rule (it has no settings-file arm).
+aw_effective_timeout() {
+  local key="$1" default="$2" value="${!1:-}" rule="$1" intpart
+  [[ "$rule" == "AGY_TIMEOUT" ]] && rule="AGY_HARD_TIMEOUT"
+  [[ -n "$value" ]] || { printf '%s' "$default"; return 0; }
+  intpart="${value%%[!0-9]*}"
+  if ! aw_settings_valid "$rule" "$value" || (( ${#intpart} > 7 )); then
+    # %q escapes the raw value so a control byte in it can never forge an extra diagnostic line
+    # (the direct agy-run lane has no pre-spend screen — the warning itself must be injection-proof).
+    printf "warning: invalid value '%q' for %s — using the built-in default %s.\n" "$value" "$key" "$default" >&2
+    printf '%s' "$default"
+    return 0
+  fi
+  printf '%s' "$value"
+}
+aw_timeout_label() {
+  local bin="$1" value="$2"
+  [[ -n "$bin" ]] || { printf 'uncapped'; return 0; }
+  case "$value" in
+    *[!0-9]*) printf '%s' "$value" ;;
+    *) printf '%ss' "$value" ;;
+  esac
+}
+aw_resolve_timeout_bin() {
+  local bin dir base
+  bin="$(builtin type -P timeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || bin="$(builtin type -P gtimeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || { printf ''; return 0; }
+  case "$bin" in
+    /*) ;;
+    *)
+      case "$bin" in
+        */*) dir="${bin%/*}"; base="${bin##*/}" ;;
+        *) dir="."; base="$bin" ;;
+      esac
+      dir="$(builtin cd -- "$dir" 2>/dev/null && builtin pwd -P)" || { printf ''; return 0; }
+      bin="$dir/$base"
+      ;;
+  esac
+  [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
+  printf '%s' "$bin"
+}
+
 DEFAULT_AGY_REVIEW_MODEL="Gemini 3.1 Pro (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="4.0.0"
+AW_BRIDGE_VERSION="4.1.0"
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
 # other interpolation) can echo raw newline/ESC bytes into stderr/the terminal (round-2 fold).
-if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f']* ]]; then
+if [[ "$AGY_MODEL" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
   echo "error: AGY_MODEL contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
   exit 2
 fi
@@ -254,7 +311,20 @@ FRONTIER_SET=("Gemini 3.1 Pro (High)" "Claude Opus 4.6 (Thinking)" "Claude Sonne
 # Duration-string timeouts (NOT codex's bare seconds): agy-run forwards a duration to --print-timeout,
 # and the timeout(1) hard cap is a duration too — never numerically compared, so 30m vs 2h is fine.
 AGY_HARD_TIMEOUT="${AGY_HARD_TIMEOUT:-30m}"
+# D5 banner-field control-byte screen (AD-061) — like AGY_MODEL above, BEFORE any interpolation.
+if [[ "$AGY_HARD_TIMEOUT" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+  echo "error: AGY_HARD_TIMEOUT contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
+AGY_HARD_TIMEOUT="$(aw_effective_timeout AGY_HARD_TIMEOUT 30m)"
 AGY_TIMEOUT="${AGY_TIMEOUT:-$AGY_HARD_TIMEOUT}"
+# D5 banner-field control-byte screen for AGY_TIMEOUT (AD-061): agy-review forwards it to the
+# child agy-run's --print-timeout, so a control byte must refuse HERE, pre-spawn — the child's
+# own diagnostic would otherwise echo it. (agy-run screens its own direct-lane env separately.)
+if [[ "$AGY_TIMEOUT" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+  echo "error: AGY_TIMEOUT contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
+  exit 2
+fi
 AGY_PROBE="${AGY_PROBE:-0}"
 # A probe run is RECORDED, not just silently allowed: the receipt carries probe:true so the kit's
 # review-state gate rejects it — a guards-relaxed review must never attest a tree.
@@ -882,7 +952,14 @@ if [[ -z "$AGY_MODEL" && -z "$resume_mode" && "$REVIEW_PROBE" != "true" && "$REV
   echo "       AGY_MODEL (wrapper default), or set the real model display string; AGY_PROBE=1 is exempt." >&2
   exit 2
 fi
-echo "review posture: model=${AGY_MODEL:-<agy settings default>}" >&2
+# The timeout field is BANNER-ONLY (AD-061): it prints exactly the duration agy-run hands to
+# timeout(1), or `uncapped` without a capping binary, and never enters the receipt posture.
+# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
+# `type` itself), normalized to an absolute path fail-closed — the banner can never claim a cap
+# the agy-run child would not have.
+aw_banner_timeout_bin="$(aw_resolve_timeout_bin)"
+aw_timeout_banner="$(aw_timeout_label "$aw_banner_timeout_bin" "$AGY_HARD_TIMEOUT")"
+echo "review posture: model=${AGY_MODEL:-<agy settings default>} timeout=$aw_timeout_banner" >&2
 
 # --- Execute via agy-run (single home of timeout + subscription + byte ceiling) ---
 # The output is teed into the private staging dir so the mandated '### Verdict' section can be

package/bridges/antigravity-cli-bridge/bin/agy-review.test.mjs

@@ -1412,4 +1412,117 @@ describe('agy-review.sh — dispatch-posture labeling (D5)', () => {
     assert.equal(receipts.length, 0);
     assert.match(r.stderr, /control/i);
   });
+
+  it('the banner appends the RESOLVED hard timeout verbatim — banner-only, never in the receipt (AD-061)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'] });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^review posture: model=Gemini 3\.1 Pro \(High\) timeout=30m$/m);
+    assert.deepEqual(Object.keys(receipts[0].posture), ['model'], 'timeout never enters the receipt posture');
+  });
+
+  it('the banner prints the EFFECTIVE hard cap: an env override and a fractional duration ride verbatim', () => {
+    for (const [envValue, want] of [['90s', '90s'], ['1.5m', '1\\.5m']]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_HARD_TIMEOUT: envValue } });
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, r.stderr);
+      assert.match(r.stderr, new RegExp(`^review posture: .* timeout=${want}$`, 'm'));
+    }
+  });
+
+  it('AGY_TIMEOUT (soft print-timeout) alone never moves the banner — the hard cap governs (precedence pin)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_TIMEOUT: '5m' } });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^review posture: .* timeout=30m$/m, 'the soft print-timeout is not the banner value');
+  });
+
+  it('an INVALID / EMPTY / OVERFLOW effective AGY_HARD_TIMEOUT falls back to the built-in default (loud on invalid)', () => {
+    for (const [bad, wantWarn] of [['10x', true], ['', false], ['99999999m', true]]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_HARD_TIMEOUT: bad } });
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.equal(r.status, 0, r.stderr);
+      assert.match(r.stderr, /^review posture: .* timeout=30m$/m, `default must stand for ${JSON.stringify(bad)}`);
+      if (wantWarn) assert.match(r.stderr, new RegExp(`invalid value '${bad}' for AGY_HARD_TIMEOUT`));
+    }
+  });
+
+  it('a timeout value carrying CONTROL BYTES refuses pre-spend (the banner-field screen)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_HARD_TIMEOUT: `30m${String.fromCharCode(1)}` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false);
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i);
+  });
+
+  it('timeout honesty: no timeout/gtimeout on PATH → timeout=uncapped, never a fabricated number', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      args: ['code', '--facts', 'a tiny fact'],
+      env: { PATH: `${sb.bin}:${farmFor(['agy', 'agy-run', 'timeout', 'gtimeout'])}` },
+    });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^review posture: .* timeout=uncapped$/m);
+  });
+
+  it('an EXPORTED shell function shadowing timeout never fools the banner (type -P discipline)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      args: ['code', '--facts', 'a tiny fact'],
+      env: {
+        PATH: `${sb.bin}:${farmFor(['agy', 'agy-run', 'timeout', 'gtimeout'])}`,
+        'BASH_FUNC_timeout%%': '() { return 0; }',
+      },
+    });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^review posture: .* timeout=uncapped$/m, 'a shell function is not a capping binary');
+  });
+
+  it('an EXPORTED `type` function faking a path never fools the resolver (builtin type discipline)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      args: ['code', '--facts', 'a tiny fact'],
+      env: {
+        PATH: `${sb.bin}:${farmFor(['agy', 'agy-run', 'timeout', 'gtimeout'])}`,
+        'BASH_FUNC_type%%': '() { echo /fake/timeout; }',
+      },
+    });
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^review posture: .* timeout=uncapped$/m, 'builtin type bypasses an exported type function');
+  });
+
+  it('a DEL (0x7f) byte in a banner field refuses pre-spend like the C0 range', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_MODEL: `bad${String.fromCharCode(127)}model` } });
+    const receipts = readReceipts(sb.repo);
+    rmSync(sb.home, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.invoked, false);
+    assert.equal(receipts.length, 0);
+    assert.match(r.stderr, /control/i);
+  });
+
+  it('a control byte in AGY_TIMEOUT refuses pre-spawn — agy-review forwards it to the child agy-run', () => {
+    for (const c of [1, 127]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['code', '--facts', 'a tiny fact'], env: { AGY_TIMEOUT: `30m${String.fromCharCode(c)}` } });
+      const receipts = readReceipts(sb.repo);
+      rmSync(sb.home, { recursive: true, force: true });
+      assert.notEqual(r.status, 0, `must refuse control byte ${c}`);
+      assert.equal(r.invoked, false, 'refused BEFORE spawning agy-run');
+      assert.equal(receipts.length, 0);
+      assert.match(r.stderr, /AGY_TIMEOUT/, 'names the offending knob');
+    }
+  });
 });

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -180,6 +180,56 @@ aw_apply_settings() {
 }
 aw_apply_settings
 
+# --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
+# ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
+# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
+# the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
+# invalid value warns + falls back to the built-in default — a typo never silently masquerades
+# as a cap. AGY_TIMEOUT shares AGY_HARD_TIMEOUT's duration rule (it has no settings-file arm).
+aw_effective_timeout() {
+  local key="$1" default="$2" value="${!1:-}" rule="$1" intpart
+  [[ "$rule" == "AGY_TIMEOUT" ]] && rule="AGY_HARD_TIMEOUT"
+  [[ -n "$value" ]] || { printf '%s' "$default"; return 0; }
+  intpart="${value%%[!0-9]*}"
+  if ! aw_settings_valid "$rule" "$value" || (( ${#intpart} > 7 )); then
+    # %q escapes the raw value so a control byte in it can never forge an extra diagnostic line
+    # (the direct agy-run lane has no pre-spend screen — the warning itself must be injection-proof).
+    printf "warning: invalid value '%q' for %s — using the built-in default %s.\n" "$value" "$key" "$default" >&2
+    printf '%s' "$default"
+    return 0
+  fi
+  printf '%s' "$value"
+}
+aw_timeout_label() {
+  local bin="$1" value="$2"
+  [[ -n "$bin" ]] || { printf 'uncapped'; return 0; }
+  case "$value" in
+    *[!0-9]*) printf '%s' "$value" ;;
+    *) printf '%ss' "$value" ;;
+  esac
+}
+aw_resolve_timeout_bin() {
+  local bin dir base
+  bin="$(builtin type -P timeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || bin="$(builtin type -P gtimeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || { printf ''; return 0; }
+  case "$bin" in
+    /*) ;;
+    *)
+      case "$bin" in
+        */*) dir="${bin%/*}"; base="${bin##*/}" ;;
+        *) dir="."; base="$bin" ;;
+      esac
+      dir="$(builtin cd -- "$dir" 2>/dev/null && builtin pwd -P)" || { printf ''; return 0; }
+      bin="$dir/$base"
+      ;;
+  esac
+  [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
+  printf '%s' "$bin"
+}
+
 if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. Install it and run 'agy' once to sign in." >&2
   exit 127
@@ -188,11 +238,13 @@ fi
 # `-` (empty) => skip --model and let agy use settings.json; default to Pro.
 AGY_MODEL="${AGY_MODEL-Gemini 3.1 Pro (High)}"
 AGY_TIMEOUT="${AGY_TIMEOUT:-5m}"
+AGY_TIMEOUT="$(aw_effective_timeout AGY_TIMEOUT 5m)"
 # Hard wall-clock cap (defaults to AGY_TIMEOUT). agy's own --print-timeout is NOT a reliable
 # wall-clock kill — a run was observed surviving 32 min past a 10m --print-timeout — so we also wrap
 # agy in timeout(1). A heavy `--add-dir` agentic prompt on the slowest model can otherwise run
 # unbounded, and once a caller backgrounds it nothing kills it. Raise only for a known-healthy run.
 AGY_HARD_TIMEOUT="${AGY_HARD_TIMEOUT:-$AGY_TIMEOUT}"
+AGY_HARD_TIMEOUT="$(aw_effective_timeout AGY_HARD_TIMEOUT "$AGY_TIMEOUT")"
 
 if [[ $# -lt 1 ]]; then
   echo "usage: $0 <prompt | - | @file> [-- extra agy flags...]" >&2
@@ -273,12 +325,9 @@ agy_cmd=(agy "${model_flag[@]}" --print-timeout "$AGY_TIMEOUT" "${passthrough[@]
 
 # Hard wall-clock cap via timeout(1) (GNU `timeout` on Linux, `gtimeout` from coreutils on macOS).
 # This is the real guard — a backgrounded, hung agy survives its own --print-timeout otherwise.
-timeout_bin=""
-if command -v timeout >/dev/null 2>&1; then
-  timeout_bin="timeout"
-elif command -v gtimeout >/dev/null 2>&1; then
-  timeout_bin="gtimeout"
-fi
+# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
+# `type` itself), normalized to an ABSOLUTE path fail-closed — nothing can masquerade as the cap.
+timeout_bin="$(aw_resolve_timeout_bin)"
 
 if [[ -z "$timeout_bin" ]]; then
   echo "warning: no 'timeout'/'gtimeout' on PATH — running agy WITHOUT a hard wall-clock cap" >&2

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -311,6 +311,24 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', { concurrency: true
     assert.match(r.stdout, /OK reply/);
   });
 
+  it('an INVALID ENV duration warns and falls back too (the closed aw_settings_valid env bypass, AD-061)', async () => {
+    const home = makeSandbox(RECORDING_STUB);
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: 'abc', AGY_MODEL: '' });
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /invalid value 'abc' for AGY_HARD_TIMEOUT/, 'the delegated agy-run lane validates the EFFECTIVE value');
+    assert.match(r.stdout, /OK reply/);
+  });
+
+  it('the invalid-value warning ESCAPES the raw value — a newline can never forge a second diagnostic line (AD-061)', async () => {
+    const home = makeSandbox(RECORDING_STUB);
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: 'x\nreview posture: model=FORGED', AGY_MODEL: '' });
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /^review posture: model=FORGED/m, 'the newline is escaped by %q — no forged line');
+    assert.match(r.stdout, /OK reply/, 'the run still proceeds on the built-in default');
+  });
+
   it('a DIRECTORY at the settings path warns loudly and falls back to built-ins (no crash)', async () => {
     const home = makeSandbox(RECORDING_STUB);
     mkdirSync(join(home, '.config', 'agent-workflow', 'bridge-settings.conf'), { recursive: true });

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.1 Pro (High)" },
   "roles": {
@@ -32,7 +32,9 @@
         ],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
         "notes": [
-          "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt"
+          "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
+          "the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity",
+          "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
         ]
       }
     },

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -89,6 +89,11 @@ What it does for you, and what YOU must supply:
 - **Model:** frontier default `Gemini 3.1 Pro (High)`; any model is allowed (a sub-frontier one earns a
   silenceable `AGY_PROBE=1` advisory). The service can still **stall on large/substantive prompts**
   (Issue-001) — keep reviews **focused**; the hard timeout is the guard.
+- **Posture banner — quote it verbatim.** Every review states its ACTUAL posture on ONE stderr line
+  (`review posture: model=… timeout=…`). When you label a dispatch for a user or a record, **quote
+  the posture banner verbatim** — the banner is the machine-stated posture; a prose re-type drifts.
+  The `timeout=` field is **banner-only** (exactly the duration `agy-run` hands to `timeout(1)`, or
+  `uncapped` when no capping binary is on PATH) — informational, never part of the receipt posture.
 
 ## Escalation policy (edits, network, git)
 

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.0.0'
+  version: '3.1.0'
 ---
 
 # codex-cli-bridge
@@ -99,9 +99,13 @@ codex-review code "focus on the new reducer"     # review with extra focus
 **Honesty + posture (D4/D5):** a run whose final message has no recognized
 `Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
 receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
-states the actual posture (`review posture: model=… effort=… tier=…`) and the receipt records the
-same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes in a
-posture value refuse pre-spend in every mode.
+states the actual posture (`review posture: model=… effort=… tier=… timeout=…`) and the receipt
+records the same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes
+in a posture value refuse pre-spend in every mode. `codex-exec` states its posture the same way —
+ONE `exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id>
+timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `timeout=` field
+is **banner-only** (exactly the duration handed to `timeout(1)`, or `uncapped`) — informational,
+never a receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
 
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's