@sabaiway/agent-workflow-kit 3.14.0 → 4.0.0

package/bridges/antigravity-cli-bridge/bin/agy.sh

@@ -30,8 +30,8 @@
 #   AGY_HARD_TIMEOUT=8m agy-run "..."        # override the hard wall-clock cap (timeout(1))
 #   AGY_MAX_PROMPT_BYTES=60000 agy-run @big.md    # LOWER the single-argv byte ceiling (default 120000;
 #                                            # the override only tightens it — it can never exceed the OS ~131072 limit)
-#   agy-run "..." -- --add-dir . --dangerously-skip-permissions
-#                                            # passthrough agy flags (future flows)
+#   agy-run "..." -- --add-dir .             # passthrough agy flags (this wrapper stays
+#                                            # flow-agnostic; it never widens agy's own permissions)
 set -euo pipefail
 
 # --- --help / -h (pre-preflight: no agy, no login needed) ----------------------
@@ -94,7 +94,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -117,6 +117,7 @@ aw_settings_valid() {
     CODEX_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     AGY_HARD_TIMEOUT) [[ "$v" =~ $dur_re && ! "$v" =~ $zero_re ]] ;;
     AGY_REVIEW_ALLOW_ADDDIR) [[ "$v" == "0" || "$v" == "1" ]] ;;
+    AGY_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     *) return 1 ;;
   esac
 }

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -83,6 +83,15 @@ const RECORDING_STUB = [
   '',
 ].join('\n');
 
+// Records the full argv it was invoked with, one token per line.
+const ARGV_STUB = [
+  '#!/usr/bin/env bash',
+  'if [[ -n "${AGY_STUB_ARGV:-}" ]]; then { for a in "$@"; do printf "%s\\n" "$a"; done; } > "$AGY_STUB_ARGV"; fi',
+  'echo "OK reply"',
+  'exit 0',
+  '',
+].join('\n');
+
 // Run the wrapper with an explicit argv (so a `@file` / `-` prompt form can be passed)
 // and optional stdin. AGY_MODEL='' drops --model so the stub argv stays clean.
 const runArgs = (home, { args, env = {}, input } = {}) =>
@@ -217,6 +226,20 @@ describe('agy.sh — --help (pre-preflight, candidate C)', () => {
     }
   });
 
+  // D3b: what Phase 4 retires is the AUTOMATICALLY-CONSTRUCTED --add-dir inside `agy-review code`.
+  // The PUBLIC passthrough contract is deliberately preserved: agy-run is a thin, flow-agnostic
+  // wrapper and an operator who asks for --add-dir explicitly still gets it.
+  it('agy-run keeps the direct --add-dir passthrough (the retirement is scoped to the review offload)', () => {
+    const home = makeSandbox(ARGV_STUB);
+    const argvFile = join(home, 'argv');
+    const r = runArgs(home, { args: ['prompt', '--', '--add-dir', '.'], env: { AGY_STUB_ARGV: argvFile } });
+    const argv = existsSync(argvFile) ? readFileSync(argvFile, 'utf8') : '';
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(argv, /(^|\n)--add-dir(\n|$)/, 'an operator-supplied --add-dir still reaches agy');
+    assert.match(argv, /(^|\n)\.(\n|$)/, 'with its argument intact');
+  });
+
   it('--help after the -- separator is passthrough payload, never intercepted', () => {
     const home = makeSandbox(RECORDING_STUB);
     const sentinel = join(home, 'sentinel');

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "4.1.0",
+  "version": "5.0.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.1 Pro (High)" },
   "roles": {
@@ -30,7 +30,7 @@
           "agy-review --continue [--decided @f] [--focus \"…\"]",
           "agy-review --conversation <id> [--decided @f] [--focus \"…\"]"
         ],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
         "notes": [
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
           "the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity",
@@ -66,7 +66,7 @@
         { "value": "an ungrounded review guesses — stale-model and partial-diff false positives", "enforcement": "advisory", "source": "bin/agy-review.sh" },
         { "value": "without a non-empty --facts payload the run refuses BEFORE the spend (exit 2) — the only escapes are --ungrounded and AGY_PROBE=1", "enforcement": "enforced", "source": "bin/agy-review.sh" },
         { "value": "an ungrounded run records grounded:false and the review-state gate rejects it", "enforcement": "enforced", "source": "capability.json roles.review.contract.receipt" },
-        { "value": "an oversized prompt refuses rather than truncate", "enforcement": "enforced", "condition": "unless AGY_REVIEW_ALLOW_ADDDIR=1 offloads it to a private --add-dir staging dir", "source": "capability.json settings.AGY_REVIEW_ALLOW_ADDDIR" }
+        { "value": "an oversized prompt is never truncated", "enforcement": "enforced", "condition": "code mode DELIVERS it as a chunked feed whose per-part delivery proof must verify (a missing or wrong echo exits 4 with no receipt); plan/diff refuse over the cap", "source": "bin/agy-review.sh plan_fed_review + verify_delivery_proof" }
       ],
       "customHooks": ["AGY_PROBE"]
     },
@@ -213,7 +213,17 @@
       "kind": "boolean",
       "default": "0",
       "appliesTo": ["agy-review"],
-      "effect": "1 ⇒ an oversized code review offloads the change set to a private --add-dir staging dir (re-enables the Issue-001 stall risk; the hard timeout bounds it). Default 0: an oversized prompt refuses instead."
+      "retired": "the --add-dir offload is retired: headless agy AUTO-DENIES its own read_file tool, so an offloaded change set could return a confident fabrication with no way to tell. An oversized code review is now DELIVERED as a chunked feed with a per-part delivery proof. The key stays recognized so an existing settings line never warns as unknown, but it arms nothing; clear it with --unset.",
+      "effect": "RETIRED — recognized so an existing settings line never warns as unknown, but it arms NOTHING. A set value prints the retirement notice naming the chunked-feed lane that replaced it."
+    },
+    {
+      "key": "AGY_REVIEW_MAX_TOTAL_BYTES",
+      "kind": "integer",
+      "min": 1,
+      "max": 100000000,
+      "default": "240000",
+      "appliesTo": ["agy-review"],
+      "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every envelope, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
   "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],

package/bridges/antigravity-cli-bridge/references/driving-agy.md

@@ -82,10 +82,18 @@ What it does for you, and what YOU must supply:
   @round1-decisions.md --focus "only the still-open items"`. The continuation sends a small DELTA
   (restated posture + new focus + the output shape + the decided list) and never re-sends the artifact
   — `agy` holds it in the conversation.
-- **Oversized `code` review:** the byte ceiling (`AGY_MAX_PROMPT_BYTES`, default 120000) trips with
-  trim/split guidance. `AGY_REVIEW_ALLOW_ADDDIR=1` offloads ONLY the change set to a private staging
-  dir and passes it via `--add-dir` (the grounding stays inline) — this re-enables the Issue-001 stall
-  risk, bounded by the hard timeout; prefer splitting into focused per-area reviews.
+- **Oversized `code` review — a CHUNKED FEED, not a refusal.** Past the byte ceiling
+  (`AGY_MAX_PROMPT_BYTES`, default 120000) the assembled change set is cut into under-cap parts at
+  line boundaries, fed over continuation turns (each turn: reply `OK` only), and reviewed in a final
+  turn. **Delivery is proven, not assumed:** the wrapper picks an interior line from each part AFTER
+  assembly and asks for it BY ADDRESS in a `### Delivery proof` section that comes FIRST in the
+  output; a missing or non-matching echo is a FAILED review — `exit 4`, **no receipt**. The cost is
+  stated before it is spent (N parts = N+1 subscription turns) and `AGY_REVIEW_MAX_TOTAL_BYTES`
+  (default 240000) refuses an over-large feed BEFORE turn 1. `plan`/`diff` keep refusing over the cap
+  — their artifact is an operator-supplied file the operator can split.
+  `AGY_REVIEW_ALLOW_ADDDIR` is **RETIRED** (recognized, arms nothing): headless `agy` auto-denies its
+  own `read_file`, so the offload it armed could return a confident fabrication with no way to tell.
+  The kit never grants that permission — the feed exists so none is needed.
 - **Model:** frontier default `Gemini 3.1 Pro (High)`; any model is allowed (a sub-frontier one earns a
   silenceable `AGY_PROBE=1` advisory). The service can still **stall on large/substantive prompts**
   (Issue-001) — keep reviews **focused**; the hard timeout is the guard.

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -57,13 +57,14 @@ agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   #
 |---|---|---|
 | `AGY_MODEL` | `Gemini 3.1 Pro (High)` | frontier default; **any** model is allowed — a sub-frontier one earns a silenceable advisory (quality-first, not a gate) |
 | `AGY_PROBE` | `0` | `1` silences the off-frontier model advisory AND lets `code` run without `--facts` (an ungrounded probe never attests — its receipt is probe-marked) |
-| `AGY_REVIEW_ALLOW_ADDDIR` | `0` | `1` lets an oversized `code` review offload ONLY the change set to a private staging dir via `--add-dir` (the grounding stays inline; re-enables the Issue-001 stall risk — prefer splitting into focused reviews) |
+| `AGY_REVIEW_MAX_TOTAL_BYTES` | `240000` | the ceiling on the SUM of all outgoing prompt bytes an oversized `code` review's chunked feed may send; checked BEFORE the first turn is spent |
+| `AGY_REVIEW_ALLOW_ADDDIR` | `0` | **RETIRED** — recognized so an existing settings line never warns as unknown, but it arms nothing. An oversized `code` review is a chunked feed with a per-part delivery proof; the `--add-dir` offload it armed could not be verified (headless `agy` auto-denies `read_file`) |
 | `AGY_HARD_TIMEOUT` | `30m` | the review's hard cap (longer default than a probe — reviews are slower) |
-| `AGY_MAX_PROMPT_BYTES` | `120000` | the same single-argv byte ceiling; oversized → trim/split (or the `--add-dir` escape above) |
+| `AGY_MAX_PROMPT_BYTES` | `120000` | the same single-argv byte ceiling; oversized `code` is DELIVERED as a chunked feed (see above), oversized `plan`/`diff` refuses with trim/split guidance |
 
 `agy-review` is **read-only** and **advisory**: it never edits, commits, or passes a stray `--`
 passthrough (it owns the posture). The service can still **stall on large/substantive prompts**
-(Issue-001) regardless of `--add-dir`, so keep reviews **focused**; the hard timeout is the guard.
+(Issue-001), so keep reviews **focused**; the hard timeout is the guard.
 
 ## Models
 

package/bridges/antigravity-cli-bridge/references/review-prompt.md

@@ -32,8 +32,8 @@ GUARD    Do NOT comment on AI model names/versions or your own knowledge cutoff
 {{FOCUS}}            # from --focus "…" + any trailing focus words, merged in parse order (optional)
 
 ## The change set / plan / diff under review
-{{ARTIFACT}}         # code: the assembled, repo-complete working-tree change set (or, when oversized
-                     #   with AGY_REVIEW_ALLOW_ADDDIR=1, a private --add-dir staging file)
+{{ARTIFACT}}         # code: the assembled, repo-complete working-tree change set (when oversized it
+                     #   is not inlined at all — see the chunked feed below)
                      # plan/diff: the supplied file, inlined
 
 ## Output — Markdown, this exact shape, nothing else
@@ -47,6 +47,69 @@ Numbered. Simplifications, reuse, naming, missing tests. Cite file:line. Empty?
 Anything ambiguous that would change your verdict if answered.
 ```
 
+## Over-cap `code`: the change set is DELIVERED, and delivery is PROVEN
+
+`agy` takes its prompt as ONE argv value, and headless `agy` **auto-denies its own `read_file` tool**
+(probed twice, including for a file inside the working tree). So an over-cap change set can never be
+**fetched** by the model. Past `AGY_MAX_PROMPT_BYTES` a `code` review is therefore **delivered**:
+the assembled change set is cut into under-cap parts, fed over continuation turns, and reviewed in a
+final turn. `plan` / `diff` keep refusing over the cap — their artifact is an operator-supplied file
+the operator can split.
+
+- **Envelope and body are formally separate.** Each fed turn = an ENVELOPE the wrapper authors
+  (framing, part index, the acknowledge-only instruction) plus a **pristine BODY**, a verbatim slice
+  of the change set. Only BODIES concatenate, and they concatenate **byte-for-byte**: nothing the
+  wrapper adds ever enters the reviewed artifact, and the receipt's fingerprint domain is untouched.
+- **Delivery is proven, never assumed.** After assembly the wrapper picks, per part, an interior line
+  the model cannot anticipate, and asks for it **by address only**. The mandated shape gains
+  `### Delivery proof` as its **FIRST** section, so output truncation cannot silently drop it:
+
+```text
+### Delivery proof
+part <K> line <L>: <the text of line L of part K, VERBATIM>
+Requested addresses, one per line:
+part 1 line 743
+part 2 line 512
+### Verdict
+…
+```
+
+The addresses ride **one per line, each shorter than the minimum length a proof candidate may have**.
+That is not formatting: it makes a collision **constructively impossible**. A candidate is a single
+line of at least that minimum, and a single line can never match across a newline — so the request
+itself can never reveal the very text it asks for, and the wrapper needs no second selection pass.
+
+- **Any missing or non-matching echo is a FAILED review** — `exit 4`, **NO receipt**, and a message
+  naming the cause. Never a downgraded verdict, never a warning beside a kept receipt.
+- **Cost is stated before it is spent** (D5): N parts cost N+1 subscription turns, announced on
+  stderr before the first dispatch. `AGY_REVIEW_MAX_TOTAL_BYTES` (default 240000) bounds the SUM of
+  all outgoing prompt bytes and refuses **before** turn 1 — an economy guard, not the correctness
+  guard.
+- **The receipt self-declares delivery**: `inline` (the whole change set rode one prompt — proven by
+  construction) or `fed` (proven by echo). The kit's review-state gate requires the field present and
+  well-formed, never a particular value, so a receipt minted before this lane existed no longer
+  attests. The recovery is stated: re-run the review.
+
+### Honest residuals (recorded, not engineered away)
+
+- A model that genuinely received every part but **mis-transcribes** one echo produces a FALSE
+  refusal and its analysis is lost. Placing the proof FIRST bounds the truncation case, and the
+  comparison tolerates surrounding whitespace only — never content. The rest is the accepted price of
+  failing closed: **re-run the review**, do not distrust the lane.
+- A change set whose parts carry **no unique interior line** in the 24..200-byte window (a single
+  huge minified line, for instance) cannot be proven delivered, so the wrapper **refuses** rather
+  than reviewing unprovably. Split the review, or exclude the blob.
+- The conversation id is parsed from `agy`'s own run log, whose format is `agy`'s to change. An
+  unparseable log **degrades loudly** to `--continue`; correctness still rests on the echo proof,
+  which fails closed when the wrong conversation answers.
+
+## agy's own permission ask — surfaced, never applied
+
+When `agy` denies `read_file` it names the permission rule it wants. The kit **never writes it**:
+granting it would widen a boundary for ALL `agy` use on the machine, and it would buy nothing this
+design needs — the fed lane delivers content inline and reads no file. `--dangerously-skip-permissions`
+is strictly worse (it auto-approves writes during a read-only review) and is not offered.
+
 ## Why no "read the repo's AGENTS.md" instruction
 
 Earlier versions told `agy` to *read the repo's root `AGENTS.md` (your cwd)*. That was the documented

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.1.0'
+  version: '3.2.0'
 ---
 
 # codex-cli-bridge

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -121,7 +121,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -144,6 +144,7 @@ aw_settings_valid() {
     CODEX_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     AGY_HARD_TIMEOUT) [[ "$v" =~ $dur_re && ! "$v" =~ $zero_re ]] ;;
     AGY_REVIEW_ALLOW_ADDDIR) [[ "$v" == "0" || "$v" == "1" ]] ;;
+    AGY_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     *) return 1 ;;
   esac
 }

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -124,7 +124,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -147,6 +147,7 @@ aw_settings_valid() {
     CODEX_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     AGY_HARD_TIMEOUT) [[ "$v" =~ $dur_re && ! "$v" =~ $zero_re ]] ;;
     AGY_REVIEW_ALLOW_ADDDIR) [[ "$v" == "0" || "$v" == "1" ]] ;;
+    AGY_REVIEW_MAX_TOTAL_BYTES) [[ "$v" =~ $int_re ]] && aw_int_in_range "$v" 1 100000000 ;;
     *) return 1 ;;
   esac
 }
@@ -265,7 +266,7 @@ DEFAULT_CODEX_EFFORT="xhigh"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.1.0"
+AW_BRIDGE_VERSION="3.2.0"
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
 # Generous hard cap for a slow xhigh review (subscription latency varies).
@@ -273,6 +274,12 @@ CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-1800}"
 # Above this assembled-payload size (bytes), the diff goes via a git-dir-local temp
 # file instead of inline — never truncated.
 CODEX_REVIEW_MAX_TOTAL_BYTES="${CODEX_REVIEW_MAX_TOTAL_BYTES:-1500000}"
+# The repo file map's share of the assembled payload (see emit_repo_file_map). A PINNED constant,
+# not a knob: a plain assignment, so an inherited environment value can never move it. codex has no
+# single-argv ceiling (the payload rides stdin, and past CODEX_REVIEW_MAX_TOTAL_BYTES a git-dir temp
+# file), so the budget is pinned at the DEFAULT inline-payload cap — the map can never outgrow the
+# whole payload, and every realistic repo's map assembles byte-unchanged.
+AW_REVIEW_MAP_BUDGET_BYTES=1500000
 # Codex service tier (quality-neutral speed knob; live-probed 2026-07-05): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
@@ -544,7 +551,7 @@ posture_json() {
 # itself instead of inferring it from this wrapper's version (which bumps in a different release
 # phase). Silence is not a declaration — an unmarked receipt is untrustworthy and the gate rejects it.
 write_review_receipt() {
-  local artifact="$1" fresh="$2" fingerprint="$3" verdict="$4" grounded="$5" facts_hash="$6" probe="${7:-false}"
+  local artifact="$1" fresh="$2" fingerprint="$3" verdict="$4" grounded="$5" facts_hash="$6" probe="${7:-false}" delivery="${8:-}"
   local receipts="${AW_REVIEW_RECEIPTS:-}"
   if [[ -z "$receipts" ]]; then
     local receipt_git_dir
@@ -554,27 +561,70 @@ write_review_receipt() {
     fi
     receipts="$receipt_git_dir/agent-workflow-review-receipts.jsonl"
   fi
-  local line probe_field=',"probe":false'
+  local line probe_field=',"probe":false' delivery_field=""
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s}' \
+  if [[ -n "$delivery" ]]; then delivery_field=",\"delivery\":\"$delivery\""; fi
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)" "$delivery_field")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
   fi
 }
 
-# Emit the full review surface to stdout: repo map, status (never-committable untracked records
-# filtered), staged + unstaged diffs, and the CONTENTS of every untracked REGULAR file (NUL-safe
-# iteration over the SAME filtered walk as the fingerprint — the payload is byte-identical with
-# and without a device mask). Symlinks are shown as their target (never followed — no out-of-repo
-# leak); directories/vanished paths are noted, never read (a `cat` on a FIFO would hang BEFORE the
-# hard timeout applies — that class never reaches this loop).
+# The repo file map is a FIXED cost that scales with REPO SIZE, not change size (measured 28,735
+# bytes in the home repo — 24% of agy's 120000-byte single-argv ceiling), so an unbounded map taxes
+# the change budget of every review. AW_REVIEW_MAP_BUDGET_BYTES bounds it; the value is set by each
+# wrapper so THIS BODY stays byte-identical across both (review-fingerprint-parity.test.mjs
+# lockstep). Unset/0 = unbounded. Past the budget the map degrades to the CHANGED-path subset — cut
+# at the SAME budget, so a change touching very many long paths cannot re-breach the bound — plus a
+# stated omitted count; a truncation-with-count, never a silent cut. The map was never part of the
+# fingerprint domain (emit_fingerprint_payload does not contain it), so bounding it moves no receipt.
+emit_repo_file_map() {
+  local budget="${AW_REVIEW_MAP_BUDGET_BYTES:-0}" total shown omitted subset tracked
+  # ONE deduplicated tracked-path SNAPSHOT, captured once and reused for all four uses — the
+  # byte-budget predicate, the printed map, `total`, and the index intersection. Re-running the query
+  # per use let a concurrent index change make the budget decision, the map and the counts describe
+  # DIFFERENT snapshots. Dedupe: an UNMERGED index lists a path once per stage, so a predicate
+  # counting duplicates against a map printing unique paths would push a map that fits into the
+  # truncated arm. `ls-files` output is sorted by path, so one path's stages are adjacent and `uniq`
+  # is exact — no git version floor needed.
+  tracked="$(git ls-files | LC_ALL=C uniq)"
+  if (( budget <= 0 )) || (( $(printf '%s\n' "$tracked" | wc -c) <= budget )); then
+    if [[ -n "$tracked" ]]; then printf '%s\n' "$tracked"; fi
+    return 0
+  fi
+  total=$(( $(printf '%s\n' "$tracked" | wc -l) ))
+  # The subset is INTERSECTED with the index before budgeting, so `shown` and `total` live in ONE
+  # domain and `shown + omitted == total` holds exactly: a STAGED DELETION is a changed path that is
+  # no longer in `git ls-files`, and counting it as shown would make the stated arithmetic a lie.
+  # (The NR==FNR reader is safe here: an empty index returns through the in-budget arm above.)
+  # awk never `exit`s early: a closed pipe would SIGPIPE `sort` and pipefail would abort the run.
+  subset="$(LC_ALL=C awk 'NR == FNR { known[$0] = 1; next } ($0 in known)' <(printf '%s\n' "$tracked") <(git diff --name-only --no-ext-diff; git diff --cached --name-only --no-ext-diff) |
+    LC_ALL=C sort -u |
+    LC_ALL=C awk -v cap="$budget" '{ n = length($0) + 1; if (!over && used + n <= cap) { used += n; print } else over = 1 }')"
+  shown=0
+  if [[ -n "$subset" ]]; then
+    printf '%s\n' "$subset"
+    shown=$(( $(printf '%s\n' "$subset" | wc -l) ))
+  fi
+  omitted=$(( total - shown ))
+  if (( omitted < 0 )); then omitted=0; fi
+  printf '=== repo file map TRUNCATED to the changed-path subset: %s of %s tracked paths shown, %s omitted (map budget %s bytes) ===\n' \
+    "$shown" "$total" "$omitted" "$budget"
+}
+
+# Emit the full review surface to stdout: repo map (bounded, see emit_repo_file_map), status
+# (never-committable untracked records filtered), staged + unstaged diffs, and the CONTENTS of every
+# untracked REGULAR file (NUL-safe iteration over the SAME filtered walk as the fingerprint — the
+# payload is byte-identical with and without a device mask). Symlinks are shown as their target
+# (never followed — no out-of-repo leak); directories/vanished paths are noted, never read (a `cat`
+# on a FIFO would hang BEFORE the hard timeout applies — that class never reaches this loop).
 assemble_code_diff() {
   echo "=== repo file map (git ls-files) ==="
-  git ls-files
+  emit_repo_file_map
   echo
   echo "=== git status (porcelain) ==="
   emit_status_porcelain_filtered

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -765,6 +765,44 @@ describe('codex-review.sh — source-level reverse guard (parser arms ⟷ manife
   });
 });
 
+// ── the repo file map budget (Phase 2) ────────────────────────────────────────────
+// The shared emit_repo_file_map bounds the map in BOTH wrappers (byte-identical, kit parity test).
+// codex has no single-argv ceiling — its payload rides stdin, and past CODEX_REVIEW_MAX_TOTAL_BYTES
+// a git-dir temp file — so its budget is set at the default inline cap: the map can never outgrow
+// the whole payload, and every realistic repo's map assembles byte-UNCHANGED. Behaviour alone
+// cannot tell "a huge budget" from "no budget at all", so the pinned value is asserted at source.
+describe('codex-review.sh — repo file map budget (Phase 2)', () => {
+  const MAP_DIR = 'deeply/nested/fixture/directory/for/the/repo/file/map/budget';
+
+  it("codex-review's assembled payload is byte-unchanged by the map budget", () => {
+    const sb = makeSandbox();
+    const g = (...a) => spawnSync('git', a, { cwd: sb.repo, encoding: 'utf8' });
+    mkdirSync(join(sb.repo, MAP_DIR), { recursive: true });
+    for (let i = 0; i < 100; i += 1) {
+      writeFileSync(join(sb.repo, `${MAP_DIR}/aa-untouched-file-${String(i).padStart(3, '0')}.txt`), `untouched ${i}\n`);
+      writeFileSync(join(sb.repo, `${MAP_DIR}/zz-modified-file-${String(i).padStart(3, '0')}.txt`), `body ${i} v1\n`);
+    }
+    g('add', '-A');
+    g('commit', '-qm', 'map fixture');
+    for (let i = 0; i < 100; i += 1) writeFileSync(join(sb.repo, `${MAP_DIR}/zz-modified-file-${String(i).padStart(3, '0')}.txt`), `body ${i} v2 — changed\n`);
+    const r = run(sb, { args: ['code'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.capStdin, /TRUNCATED/, 'a 17 KB map is far inside the budget — no degradation');
+    assert.ok(r.capStdin.includes(`${MAP_DIR}/aa-untouched-file-000.txt`), 'the whole map is still listed');
+    assert.ok(r.capStdin.includes(`${MAP_DIR}/aa-untouched-file-099.txt`), 'including its last entry');
+  });
+
+  it('the wrapper pins a map budget no smaller than its default inline-payload cap', () => {
+    const source = readFileSync(WRAPPER, 'utf8');
+    const pinned = source.match(/^AW_REVIEW_MAP_BUDGET_BYTES=(\d+)$/m);
+    assert.ok(pinned, 'codex-review.sh must PIN AW_REVIEW_MAP_BUDGET_BYTES (a plain assignment, never an env knob)');
+    const inlineCap = source.match(/^CODEX_REVIEW_MAX_TOTAL_BYTES="\$\{CODEX_REVIEW_MAX_TOTAL_BYTES:-(\d+)\}"$/m);
+    assert.ok(inlineCap, 'the default inline-payload cap is readable at source');
+    assert.ok(Number(pinned[1]) >= Number(inlineCap[1]), `map budget ${pinned[1]} must not be smaller than the inline cap ${inlineCap[1]}`);
+  });
+});
+
 // ── mode catalog ⟷ wrapper reality (BRIDGE-MODES-CATALOG) ─────────────────────────
 // The kit validator owns the catalog's INTERNAL shape; these arms pin what only the wrapper source
 // can settle — the catalog documents THIS wrapper's real modes and real escape hatches, and every

package/bridges/codex-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "posture": { "model": "gpt-5.6-sol", "effort": "xhigh", "tier": null },
   "provides": ["execute", "review"],
   "roles": {

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "3.14.0",
+  "version": "4.0.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "3.14.0",
+  "version": "4.0.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/agents/review-lens.md

@@ -0,0 +1,39 @@
+---
+name: review-lens
+description: Read-only ADDITIONAL review lens — an extra independent opinion on code the orchestrator already has, when the configured review backends have run and you want another angle. Grants no shell, so it can never turn a review into a wave of approval prompts. Never for writing code, running gates, or replacing the configured review recipe.
+model: sonnet
+effort: high
+tools: Read, Grep, Glob
+---
+
+You are an ADDITIONAL, INDEPENDENT review lens. Something has already been reviewed by the project's
+configured backends; your job is to find what they MISSED, not to restate what they found.
+
+You have `Read`, `Grep` and `Glob` and **no `Bash`**. That is deliberate and it is the whole point of
+this vehicle: a read-only fan-out that can reach for a shell turns one review into a wave of approval
+prompts for the maintainer, so this lens structurally cannot.
+If a harness omits `Grep`/`Glob`, fall back to the `Read` tool (whole-file reads) — never a
+shelled-out command. Should a harness
+nonetheless route your reads through `Bash`, keep each one a **plain single read-only command**
+(`grep …`, `ls …`, `cat …`) — never a `;`/`&&`/`|` chain, never `node -e`; where the maintainer
+enabled the opt-in **read-lane** (`docs/ai/lanes.json`), the gate hook keeps those seeded-read-only
+Bash reads promptless (subagent Bash included, where the host fires hooks on subagent Bash).
+
+How to review:
+
+- **Read the code before judging it.** Every finding cites `file:line` and names the concrete input
+  or state that triggers it. A finding you cannot anchor in the code does not go in the output.
+- **Say what BREAKS, not what could be nicer.** For each finding: the defect in one sentence, then
+  the failure scenario — the input, the resulting wrong behaviour. No style preferences, no
+  restatement of design intent back to the orchestrator.
+- **Respect what is already decided.** The prompt will name findings already folded and decisions
+  already locked. Re-raising them is churn; checking whether the FIX is correct is real work.
+- **Accuracy over volume.** A wrong finding costs the orchestrator more than a missed one — it
+  spends a verification cycle and erodes trust in the whole list. If an angle turns up nothing, say
+  so in one line and move on. Never pad.
+- **You are advisory.** You never edit files, never run gates, never propose a commit. The
+  orchestrator verifies every finding and owns every change.
+
+Output: a numbered list of findings, most severe first, each as
+`[severity] — file:line — the defect — the failure scenario — the fix direction`.
+Then one line: `no further findings` or the angles you deliberately did not cover.

package/references/hooks/gate-approve.mjs

@@ -42,6 +42,21 @@
 //   (d) everything else → NO decision: exit 0, no output — the normal permission flow proceeds
 //       unchanged. The hook NEVER emits `deny`.
 //
+// WHY THERE IS NO DENY RUNG (kit 4.0.0, three council rounds, AD-078). One was built and REMOVED
+// before release. It refused only a seeded read-only command that provably DISCARDS its output
+// (`2>/dev/null`), on the argument that such a refusal cannot destroy anything the caller wanted.
+// The argument was sound; the byte-level PROOF of "this command discards" was not, and could not be
+// made so here. Five constructs defeated it in three rounds — `1<&2` (an fd dup routes stdout back
+// out of /dev/null AFTER the approved `>`), a quoted literal `>/dev/null ` in an argument, a
+// leading-token-only segment match (`… && npm test`), a bare `&` (backgrounds the read, runs the
+// rest), and a `#` comment (bash never executes the redirect at all). Each was a FALSE REFUSAL.
+// The lesson, which any future deny rung must start from: on an ASK rung an incomplete scan merely
+// over-asks, which is safe; on a DENY rung the SAME incompleteness refuses real work. Deciding
+// whether a `>` is an operator or text requires lexing the shell, which this dependency-free hook
+// deliberately does not do. A deny rung therefore needs a justification that does not rest on
+// parsing command bytes. Design record + all five counterexamples: docs/plans/queue.md,
+// BARE-LANE-DENY-RUNG.
+//
 // Fail-safe invariant, decoupled per function: a DECLARATION anomaly (missing / unreadable /
 // malformed / schema-invalid gates.json) disables ONLY exact-gate approval (a) — the residual
 // guard (b) needs no declaration and keeps running (a broken gates.json must not silently

package/references/modes/agents.md

@@ -1,6 +1,15 @@
 ### Mode: agents
 
-The opt-in **cheap-lane subagent writer** — the family's second `.claude/` writer, on the velocity discipline. It places the bundled cheap-lane subagent definitions (`references/agents/*.md`) into the project's `.claude/agents/` so mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage — runs on a **cheap model** (`model: haiku`, `effort: low`, bounded read-only tools) instead of the frontier main lane. **Claude-Code-specific** (like velocity): other agent hosts ignore `.claude/agents/`. Judgment, review, real code, and user-facing copy never move to these vehicles — they are extraction/drafting only, and the orchestrator verifies their output.
+<!-- opt-in-capability: agents -->
+
+The opt-in **read-only subagent writer** — the family's second `.claude/` writer, on the velocity discipline. It places the bundled subagent definitions (`references/agents/*.md`) into the project's `.claude/agents/`. **Claude-Code-specific** (like velocity): other agent hosts ignore `.claude/agents/`.
+
+**Every vehicle grants READ-ONLY tools and NO `Bash`** — that is the load-bearing property, not a detail. A read-only fan-out on a full-tool vehicle shells out for facts it could have read, and each shelled command is an approval prompt the maintainer never needed to see; a vehicle with no shell structurally cannot do that. Two lanes ride on it:
+
+- **cheap lane** (`model: haiku`, `effort: low`) — `mechanical-sweep`, `changelog-skeleton`, `gate-triage`: extraction sweeps, changelog fact-skeletons, gate-failure triage. Extraction/drafting only; the orchestrator applies judgment and verifies the output.
+- **review lens** (`review-lens`, review-capable model) — an ADDITIONAL independent read-only opinion on code the configured review backends have already seen. It exists because a third lens otherwise has **no vehicle at all**: the cheap vehicles are scoped away from judgment, and a review-capable full-tool subagent is the prompt-flood shape. It never replaces the configured review recipe, and it is advisory like every other review.
+
+Writing code, running gates, and user-facing copy never move to these vehicles.
 
 Run `node ${CLAUDE_SKILL_DIR}/tools/cheap-agents.mjs [--dry-run | --apply] [--cwd <dir>]`:
 
@@ -8,4 +17,4 @@ Run `node ${CLAUDE_SKILL_DIR}/tools/cheap-agents.mjs [--dry-run | --apply] [--cw
 2. **Only on an explicit yes**, re-run with `--apply`. It writes **only** under `.claude/agents/` — never `settings.json` / `settings.local.json`, never a commit. `--apply` is deployment-gated (the stamp must be at the lineage head) and symlink-safe (a symlinked `.claude` / `.claude/agents` / target file is a STOP).
 3. **Hidden-mode deployments:** after apply, run the hide-footprint reconcile (`node ${CLAUDE_SKILL_DIR}/tools/hide-footprint.mjs --dir <project> --reconcile`) so the placed files stay invisible to `git status` — `/.claude/agents/` is in the known-footprint registry; the apply report reminds you.
 
-**Invariants:** writer (writes only `.claude/agents/`) · preview by default · a diverged existing file is reported and preserved, never clobbered · never touches settings · never commits · vehicles are pinned to `model: haiku` + `effort: low` + read-only tools (content-tested).
+**Invariants:** writer (writes only `.claude/agents/`) · preview by default · a diverged existing file is reported and preserved, never clobbered · never touches settings · never commits · **no vehicle grants `Bash`** · the cheap-lane vehicles are pinned to `model: haiku` + `effort: low`, and the review lens is pinned OFF the cheap model (all content-tested).

package/references/modes/autonomy-doctor.md

@@ -1,5 +1,7 @@
 ### Mode: autonomy-doctor
 
+<!-- opt-in-capability: sandbox-provision -->
+
 The **sandbox provisioner "doctor"** — the answer to *"can this machine run the Claude sandbox, and can you fix it?"* (AD-044: macOS Seatbelt built-in / Linux+WSL2 `bwrap`+`socat` / native Windows → WSL2). **Division of labor:** YOU narrate the diagnosis and relay the consent question; the KIT does the deterministic detect → consent-gated install → verify. It is **guarded**: the privileged lane runs ONLY with the per-run consent tuple, always faces the harness permission prompt (the mode sits outside every velocity auto-approve tier), **never auto-runs, never writes repo files, and never commits**.
 
 Run **`node ${CLAUDE_SKILL_DIR}/tools/autonomy-doctor.mjs [--verify | --apply <pm>:<pkg[,pkg...]>]`**:

package/references/modes/backends.md

@@ -1,5 +1,7 @@
 ### Mode: backends
 
+<!-- opt-in-capability: none — an inspection surface that configures nothing -->
+
 Read-only. Answers *"which optional execution-backends are set up vs missing, and what's the next step?"* — for the family's subscription-CLI bridges (`codex-cli-bridge` → `codex`, `antigravity-cli-bridge` → `agy`). It **never writes, never commits, and never runs a subscription CLI**.
 
 1. Run `node ${CLAUDE_SKILL_DIR}/tools/detect-backends.mjs` and present its table verbatim. Each row reports two **decoupled** axes: `manifestState` (health of the bridge *skill* — `not-installed | unsupported-schema | invalid-manifest | foreign | stub | ok`) and the readiness signals `cli` / `credentials` / `wrappers`, probed independently — so a CLI that is installed and signed in but whose bridge *skill* is absent reads `needs-skill`, not "missing".

package/references/modes/bootstrap.md

@@ -1,5 +1,7 @@
 ### Mode: bootstrap
 
+<!-- opt-in-capability: none — the deployment action itself; the advisor only renders inside an existing deployment -->
+
 Requires: ${CLAUDE_SKILL_DIR}/references/shared/report-footer.md · ${CLAUDE_SKILL_DIR}/references/shared/composition-handoff.md · ${CLAUDE_SKILL_DIR}/references/shared/deploy-tail.md · ${CLAUDE_SKILL_DIR}/references/shared/command-shapes.md
 
 > Bundled sources below (templates, scripts) live in **this skill's own directory** — `${CLAUDE_SKILL_DIR}/` in Claude Code, or the folder containing this `SKILL.md` in Codex / other agents. Use that as the copy/read source; the working directory is the **target project**, not the skill.