@sabaiway/agent-workflow-kit 5.1.0 → 5.2.0

package/CHANGELOG.md

@@ -4,6 +4,61 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 5.2.0 — the flow machinery ships whole: recorded subset budgets, flow-bound finals, the round arms, and the dogfooded pipeline (AD-086)
+
+**Everything the flow series built after 5.1.0 lands as one wave** — the record vocabulary, the
+fd-custody store, chain identity + `flow-check`, `set-flow` arming, receipt-deadline + wrapper
+finding manifests, and this release's closing moves. The flow schema (`schema: 1`) was never
+published before, so every schema move below arrives migration-free.
+
+- **`--pre-review` under an ARMED flow is a RECORDED lane** (new store-global `subset-attempt`
+  kind): every subset run appends an attempt with a lock-computed monotone `attemptIndex`; the
+  run producing the SECOND red at a key completes, records it, and exits red printing the
+  diagnosis rule; a third attempt requires a recorded, byte-distinct `--diagnosis`; past three
+  reds only a recorded fresh-eyes consult verdict reopens the key — every stop is self-servable,
+  never a wait-for-a-human. A `pregateExclude` change opens a fresh counting context (new
+  `subsetDigest`), and an unarmed repo's `--pre-review` stays byte-unchanged (characterized).
+- **`run-gates --final` binds the flow store to the release decision** (AD-086 D10): the minted
+  `final` carries an OPTIONAL `evidenceHashes.flow` — the owner-scoped projection hash — with
+  projection movement under the run an `integrityFailure`; `commit-guard` (its lane only, after
+  the dead-green selection) refuses a green final whose hash no longer matches the live
+  projection, and an armed flow whose latest green final LACKS the field fails closed naming the
+  fresh-`--final` remedy. No `EVIDENCE_SCHEMA_VERSION` bump: the released 5.1.0 validator accepts
+  a flow-bearing final (proven against `4b08ace` worktree bytes, both directions).
+- **The writer's round machinery arms**: `round-open` (pre-dispatch mint — per-backend watermark
+  + fresh nonce, printed as pasteable dispatch + `receipt-deadline` lines) · `round-land`
+  (arrival binding — receipt/manifest digests computed FROM the files; foreign, ambiguous,
+  malformed, or symlinked artifacts refuse) · per-finding `--dispose` ledgers ·
+  `freeze`/`unfreeze`/`converged` with completeness walks · `internal-attestation` refusing
+  while any in-flight plan lacks an adopted chain. Caps (3 rounds/cycle, 1 unfreeze, the
+  redesign valve) enforce at the arms; an over-cap mint requires a recorded `--justification`.
+- **SECURITY — the receipts reader no longer follows symlinks** (new `fs-read-nofollow` leaf): a
+  symlinked/FIFO/directory receipts path surfaces as a loud `readError` through all four
+  consumers (review-state, core-evidence summary, flow-writer, flow-check) instead of content or
+  an empty success. The 5.1.0 reader read straight through a symlink — this is the one behavior
+  change for a conceivable existing loop, and the documented `AW_REVIEW_RECEIPTS` regular-file
+  lane is untouched (suite-pinned), so it ships as a flagged security fix, not an API break.
+- **Bridge bumps ride the kit mirrors** — codex-cli-bridge **3.3.0** · antigravity-cli-bridge
+  **5.1.0**: an additive `--nonce <n>` flag on both review wrappers — the plain-argument lane
+  onto the existing `AW_REVIEW_NONCE` seam for hosts whose dispatch policy has no env-prefix
+  form (one seam: a disagreeing flag+env pair refuses pre-spend; a nonce-less run adds no nonce
+  field and mints no manifest — the `wrapperVersion` field every receipt carries moves with the
+  release), and a manifest-mint FAILURE whose temp unlink also fails now names the orphan
+  path on both failure codes.
+- **Smaller rungs**: the veteran-store arming fence (#65 — arming a store with pre-flow red
+  finals no longer bricks `flow-check`; reds scope to the earliest own adoption instant,
+  fail-closed edges) · mixed declared+undeclared delta forks name the undeclared path ·
+  `velocity-profile` credential floor null-guards an unparseable harness version (was
+  fail-open via `null >= 0`) · `set-flow` empty/duplicate `pregateExclude` ids exit 2 at parse
+  time · the read surface's import closure is pinned write-free and acyclic
+  (`read-graph-purity.test.mjs`) · suite file-URL paths go through `fileURLToPath` (Windows).
+- **The pipeline is dogfooded end to end**: a permanent hermetic tracked-`docs/ai` fixture
+  (`flow-dogfood.integration.test.mjs`) drives the REAL CLIs through set-flow → adoption →
+  subset-attempts → two nonce-bound rounds → bookkeeping-delta + refresh → freeze/converged →
+  `--final` with `evidenceHashes.flow` → guard PASS → the D10 post-final-append refusal — plus
+  the second-red stop pair and the foreign-worktree advisory lane. This repo itself released
+  under the armed flow.
+
 ## 5.1.0 — the config learns to carry the flow block before anything writes one (AD-085)
 
 **Upgrade this before any flow feature arrives — that ordering IS the release.** The shared

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '5.1.0'
+  version: '5.2.0'
 ---
 
 # agent-workflow-kit
@@ -131,6 +131,14 @@ writer — read `${CLAUDE_SKILL_DIR}/references/modes/set-recipe.md` before acti
 
 writer — read `${CLAUDE_SKILL_DIR}/references/modes/set-autonomy.md` before acting.
 
+### Mode: set-flow
+
+writer — read `${CLAUDE_SKILL_DIR}/references/modes/set-flow.md` before acting.
+
+### Mode: flow-writer
+
+writer — read `${CLAUDE_SKILL_DIR}/references/modes/flow-writer.md` before acting.
+
 ### Mode: autonomy-doctor
 
 guarded — read `${CLAUDE_SKILL_DIR}/references/modes/autonomy-doctor.md` before acting.
@@ -171,6 +179,10 @@ guarded — read `${CLAUDE_SKILL_DIR}/references/modes/bridge-settings.md` befor
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/review-state.md` before acting.
 
+### Mode: receipt-deadline
+
+read-only — read `${CLAUDE_SKILL_DIR}/references/modes/receipt-deadline.md` before acting.
+
 ### Mode: grounding
 
 writer — read `${CLAUDE_SKILL_DIR}/references/modes/grounding.md` before acting.

package/bridges/antigravity-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: antigravity-cli-bridge
 description: Delegate work to Google's Antigravity CLI (`agy`) — the successor to Gemini CLI — to reach Gemini, Claude, and GPT-OSS models under a Google AI Pro/Ultra subscription from the terminal. Use when the user wants to run a headless `agy` prompt, hand a focused task or second-opinion review to `agy`, install or authenticate Antigravity CLI, check or economise its quota/models, bridge project context into `agy`, set up a second delegated-execution backend beside Codex, or troubleshoot `agy` flags, models, auth, conversations, or its no-JSON headless behaviour.
 metadata:
-  version: '5.0.0'
+  version: '5.1.0'
 ---
 
 # antigravity-cli-bridge
@@ -140,8 +140,19 @@ session error. One stderr banner states the actual posture (`review posture: mod
 and the receipt records the same `posture {model}`; an attesting review with `AGY_MODEL` explicitly
 emptied refuses pre-spend (`AGY_PROBE=1` exempt), and control bytes in a model string refuse
 pre-spend in every mode. The `timeout=` field is **banner-only** (exactly the duration `agy-run`
-hands to `timeout(1)`, or `uncapped`) — informational, never a receipt field. **Quote the posture
-banner verbatim** when labeling a dispatch.
+hands to `timeout(1)`; without a capping binary `agy-review` fails CLOSED pre-spend) —
+informational, never a receipt field. **Quote the posture banner verbatim** when labeling a
+dispatch.
+
+**Flow dispatch nonce (`AW_REVIEW_NONCE`, unset by default):** under the safe grammar
+`[A-Za-z0-9._-]{1,64}` (anything else refuses pre-spend), a successful review first mints the
+finding MANIFEST `agent-workflow-finding-manifest-agy-<nonce>.json` beside the receipts file —
+atomic, no-clobber, ORDERED before the receipt append; a failed mint EXCLUDES the receipt, so a
+nonce-supplied dispatch never lands a receipt without its readable manifest. Nonce-less runs add
+no nonce field and mint nothing (the `wrapperVersion` field every receipt carries moves with each
+release). `agy-review … --nonce <n>` is the plain-argument equivalent
+(one seam; flag and a non-empty env must agree, a disagreeing pair refuses pre-spend) — the lane
+for hosts whose dispatch policy has no env-prefix form.
 
 Frontier default `Gemini 3.1 Pro (High)`; **any** model is allowed (a sub-frontier one earns a
 silenceable `AGY_PROBE=1` advisory). An oversized `code` review is **DELIVERED, not refused**: the

package/bridges/antigravity-cli-bridge/bin/agy-review.sh

@@ -46,6 +46,10 @@
 #                            arms nothing; an oversized CODE review is delivered as a chunked feed
 #   AW_REVIEW_RECEIPTS       override the review-receipt file (default: <git dir>/
 #                            agent-workflow-review-receipts.jsonl — see the --help Receipt block)
+#   AW_REVIEW_NONCE          the dispatch nonce (safe grammar [A-Za-z0-9._-]{1,64}) — when supplied,
+#                            a successful review first mints the finding manifest beside the receipt;
+#                            the --nonce <n> flag is its plain-argument equivalent (one seam — a
+#                            disagreeing flag+env pair refuses pre-spend)
 set -euo pipefail
 
 # --- --help / -h (pre-preflight: no agy, no login, no git tree needed) ---------
@@ -57,15 +61,16 @@ case "${1:-}" in
 agy-review — grounded read-only ADVISORY review by Google's Antigravity CLI (agy; subscription-only).
 
 Usage:
-  agy-review code [--facts @f] [--ungrounded] [--decided @f] [--focus "…"] [extra focus…]
-  agy-review plan <plan-file> [--facts @f] [--decided @f] [--focus "…"]
-  agy-review diff <diff-file> [--facts @f] [--decided @f] [--focus "…"]
+  agy-review code [--facts @f] [--ungrounded] [--decided @f] [--focus "…"] [--nonce <n>] [extra focus…]
+  agy-review plan <plan-file> [--facts @f] [--decided @f] [--focus "…"] [--nonce <n>]
+  agy-review diff <diff-file> [--facts @f] [--decided @f] [--focus "…"] [--nonce <n>]
 
 Flags:
   --facts @f — verified facts the review runs AGAINST (code mode REQUIRES a non-empty payload; plan/diff warn loudly when omitted)
   --ungrounded — deliberately ungrounded CODE review, a throwaway opinion (code mode only, contradicts --facts; the receipt records grounded:false and never attests)
   --decided @f — already-decided / already-addressed list; do NOT re-raise (anti-circling; the round-2 payload)
   --focus "…" — extra focus (repeatable; code mode also takes trailing focus words)
+  --nonce <n> — the flow dispatch nonce, the plain-argument lane onto the AW_REVIEW_NONCE seam (one seam: flag and a non-empty env must agree; a disagreeing pair refuses pre-spend)
 
 Grounding:
   grounded review — agy reads NOTHING by default, an ungrounded review GUESSES:
@@ -78,15 +83,16 @@ Notes:
   pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts
   against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE
   dispatching, never fired into a known prompt
-  the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
-  duration agy-run hands to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
-  INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity
+  the review posture banner appends a banner-only timeout=<duration> field — exactly the duration
+  agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout
+  binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no
+  longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
 
 Round-2 / resume:
-  agy-review --continue [--decided @f] [--focus "…"]
-  agy-review --conversation <id> [--decided @f] [--focus "…"]
+  agy-review --continue [--decided @f] [--focus "…"] [--nonce <n>]
+  agy-review --conversation <id> [--decided @f] [--focus "…"] [--nonce <n>]
   (a continuation sends a small delta — agy holds the artifact server-side; --facts is invalid on a continuation)
 
 Receipt:
@@ -116,7 +122,17 @@ Receipt:
   particular value; absent by construction on plan/diff/continuation receipts, which carry no change
   set; a run whose output carries NO recognized '### Verdict' section — empty
   output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session
-  error); a write failure warns, never fails the review
+  error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or
+  its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value;
+  supplying both with different values refuses pre-spend) — under the safe grammar
+  [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding
+  MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file
+  (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical
+  rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt
+  append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can
+  never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field
+  and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge
+  release); a write failure warns, never fails the review
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -257,8 +273,9 @@ aw_apply_settings
 
 # --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
 # ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
-# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
-# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim; without a
+# capping binary the EXEC wrappers print `timeout=uncapped` and run, while the REVIEW wrappers
+# refuse pre-spend (fail-closed preflight) — never a fabricated number.
 # The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
 # the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
 # invalid value warns + falls back to the built-in default — a typo never silently masquerades
@@ -309,7 +326,7 @@ DEFAULT_AGY_REVIEW_MODEL="Gemini 3.1 Pro (High)"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by agy-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="agy"
-AW_BRIDGE_VERSION="5.0.0"
+AW_BRIDGE_VERSION="5.1.0"
 # `-` not `:-` so an EXPLICIT empty AGY_MODEL= survives (drop --model, use settings.json — agy.sh:52).
 AGY_MODEL="${AGY_MODEL-$DEFAULT_AGY_REVIEW_MODEL}"
 # D5 control-byte screen — IMMEDIATELY after resolution, BEFORE the off-frontier advisory (or any
@@ -343,6 +360,14 @@ AGY_PROBE="${AGY_PROBE:-0}"
 # review-state gate rejects it — a guards-relaxed review must never attest a tree.
 REVIEW_PROBE=false
 if [[ "$AGY_PROBE" == "1" ]]; then REVIEW_PROBE=true; fi
+# The dispatch nonce seam (flow-orchestration Decision 2/P5): validated pre-spend under the SAFE
+# grammar — a nonce that would escape the derived manifest name refuses before any CLI run. The
+# bracket expression ENUMERATES the ASCII set (no ranges): a range like A-Z is locale-collation-
+# dependent and could admit a non-ASCII nonce the kit's JS reader then refuses.
+if [[ -n "${AW_REVIEW_NONCE:-}" && ! "${AW_REVIEW_NONCE}" =~ ^[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-]{1,64}$ ]]; then
+  echo "error: AW_REVIEW_NONCE fails the safe nonce grammar ([A-Za-z0-9._-]{1,64}) — the derived manifest name would be unsafe; fix the nonce and re-run." >&2
+  exit 2
+fi
 # RETIRED (D3), not removed: the key stays RECOGNIZED by the shared settings registry so an existing
 # settings line never starts warning as unknown — but it arms NOTHING. The `--add-dir` offload told
 # agy to read a staging file; headless agy AUTO-DENIES its own read_file tool, so that lane could
@@ -442,6 +467,19 @@ if ! command -v agy >/dev/null 2>&1; then
   echo "error: 'agy' (Antigravity CLI) not found on PATH. See this skill's setup/README.md." >&2
   exit 127
 fi
+# The hard-timeout cap is a TWO-STAGE guarantee (flow-orchestration #26): (1) THIS parent
+# preflight fails CLOSED without a capping binary — an uncapped review run is refused before any
+# CLI spend; (2) the agy-run child re-resolves the binary at dispatch time, so the exported seam
+# below makes ITS missing-binary lane refuse too — a delete-between race can never silently void
+# the cap. The banner uses the parent-resolved path; the child's mandatory recheck is the seam's.
+aw_review_timeout_bin="$(aw_resolve_timeout_bin)"
+if [[ -z "$aw_review_timeout_bin" ]]; then
+  echo "error: no 'timeout'/'gtimeout' binary on PATH — the hard-timeout preflight fails CLOSED:" >&2
+  echo "       an uncapped review run is refused before any CLI spend. Install coreutils (timeout;" >&2
+  echo "       on macOS: brew install coreutils for gtimeout), then re-run." >&2
+  exit 127
+fi
+export AGY_REQUIRE_TIMEOUT_BIN=1
 # Delegate execution to agy-run (the single home of the timeout + subscription + byte-ceiling guards);
 # fall back to the sibling agy.sh on a fresh checkout / hermetic test where agy-run is not yet linked.
 if command -v agy-run >/dev/null 2>&1; then
@@ -449,6 +487,16 @@ if command -v agy-run >/dev/null 2>&1; then
 else
   AGY_RUN="$HERE/agy.sh"
 fi
+# The seam is a guarantee only when the RESOLVED child honors it: a stale installed agy-run that
+# never reads AGY_REQUIRE_TIMEOUT_BIN would keep its uncapped lane past the parent preflight —
+# refuse loudly and name the refresh recovery instead of dispatching on a hope.
+aw_child_path="$(command -v "$AGY_RUN" 2>/dev/null || printf '%s' "$AGY_RUN")"
+if ! grep -q "AGY_REQUIRE_TIMEOUT_BIN" "$aw_child_path" 2>/dev/null; then
+  echo "error: the resolved agy-run child ($aw_child_path) does not honor the AGY_REQUIRE_TIMEOUT_BIN seam —" >&2
+  echo "       a stale bridge install could run uncapped past the parent preflight. Refresh the placed" >&2
+  echo "       bridges (/agent-workflow-kit setup --refresh-placed), then re-run." >&2
+  exit 127
+fi
 
 # --- Model policy (advisory, NOT a gate) -------------------------------------
 is_frontier=0
@@ -689,7 +737,104 @@ posture_json() {
   fi
 }
 
-# write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false]
+# write_finding_manifest <receipts-path> <fingerprint|""> <findings-file> — the wrapper-minted
+# finding MANIFEST (flow-orchestration Decision 2 / P5 / P24-25), minted ONLY when the dispatch
+# nonce seam AW_REVIEW_NONCE is supplied: {schema, backend, nonce, fingerprint, findings} lands
+# beside the receipts file under the {backend, nonce}-derived name. The write is ATOMIC (temp +
+# hard-link publish) and NO-CLOBBER: a byte-identical re-write is an idempotent no-op, different
+# bytes refuse loudly. Returns non-zero on ANY failure — the caller then EXCLUDES the receipt
+# append, so a nonce-supplied dispatch can never land a receipt without its readable manifest.
+# A nonce-less invocation returns 0 untouched (no nonce field, no manifest — the receipt
+# otherwise proceeds unchanged).
+write_finding_manifest() {
+  local receipts="$1" fingerprint="$2" findings_file="$3" nonce="${AW_REVIEW_NONCE:-}"
+  [[ -n "$nonce" ]] || return 0
+  if [[ ! "$nonce" =~ ^[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-]{1,64}$ ]]; then
+    echo "error: AW_REVIEW_NONCE fails the safe nonce grammar ([A-Za-z0-9._-]{1,64}) — the derived manifest name would be unsafe; NO manifest was written." >&2
+    return 1
+  fi
+  if [[ -z "$findings_file" || ! -f "$findings_file" ]]; then
+    echo "error: no captured findings file to mint the manifest from — NO manifest was written." >&2
+    return 1
+  fi
+  local manifest mint_rc
+  manifest="$(dirname -- "$receipts")/agent-workflow-finding-manifest-${AW_RECEIPT_BACKEND}-${nonce}.json"
+  # The WHOLE mint core rides ONE node script (a family floor; the verdict parse already leans on
+  # it): FATAL UTF-8 compose (BOM kept — invalid bytes refuse rather than silently mutate the
+  # digest domain), an UNPREDICTABLE sibling temp opened with "wx" (O_CREAT|O_EXCL — a planted
+  # node at the name refuses, and ONLY a temp we provably created is ever unlinked), a hard-link
+  # publish (atomic no-clobber), and an EEXIST loser judged through ONE O_NOFOLLOW|O_NONBLOCK
+  # descriptor whose fstat must say REGULAR before the same-fd byte compare — no TOCTOU window,
+  # no symlink read-through, no FIFO hang. Exit: 0 minted or byte-identical no-op; 3 different
+  # bytes or a non-regular/symlink manifest; 5 minted-but-temp-left (SUCCESS with the orphan path
+  # on stdout — the caller warns loudly, never silently); 1 unreadable/non-UTF-8 findings or an
+  # fs failure.
+  local mint_out
+  mint_out="$( umask 077; node -e '
+const fs = require("node:fs");
+const { join, dirname, basename } = require("node:path");
+const { randomBytes } = require("node:crypto");
+const [file, backend, nonce, fingerprint, manifest] = process.argv.slice(1);
+let code = 1;
+let tmp = null;
+try {
+  const findings = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(fs.readFileSync(file));
+  const bytes = Buffer.from(`${JSON.stringify({ schema: 1, backend, nonce, fingerprint: fingerprint || null, findings })}\n`);
+  const candidate = join(dirname(manifest), `.${basename(manifest)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+  const fd = fs.openSync(candidate, "wx", 0o600);
+  tmp = candidate;
+  try {
+    fs.writeFileSync(fd, bytes);
+  } finally {
+    fs.closeSync(fd);
+  }
+  try {
+    fs.linkSync(tmp, manifest);
+    code = 0;
+  } catch (err) {
+    if (err && err.code === "EEXIST") {
+      try {
+        const mfd = fs.openSync(manifest, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+        try {
+          code = !fs.fstatSync(mfd).isFile() ? 3 : fs.readFileSync(mfd).equals(bytes) ? 0 : 3;
+        } finally {
+          fs.closeSync(mfd);
+        }
+      } catch {
+        code = 3;
+      }
+    }
+  }
+} catch {
+  code = 1;
+}
+if (tmp !== null) { try { fs.unlinkSync(tmp); } catch { if (code === 0) code = 5; process.stdout.write(tmp); } }
+process.exit(code);
+' "$findings_file" "$AW_RECEIPT_BACKEND" "$nonce" "$fingerprint" "$manifest" 2>/dev/null )"
+  mint_rc=$?
+  if [[ $mint_rc -eq 5 ]]; then
+    echo "warning: the finding manifest was minted, but its temporary sibling could not be removed —" >&2
+    echo "         orphan left at: ${mint_out} — remove it by hand (the manifest and the receipt are intact)." >&2
+    return 0
+  fi
+  if [[ $mint_rc -eq 3 ]]; then
+    echo "error: the finding manifest $manifest already exists with DIFFERENT bytes or is not a regular file — no-clobber refuses loudly (one dispatch identity, one manifest)." >&2
+    if [[ -n "$mint_out" ]]; then
+      echo "       orphan left at: ${mint_out} — its temporary sibling could not be removed either; remove it by hand." >&2
+    fi
+    return 1
+  fi
+  if [[ $mint_rc -ne 0 ]]; then
+    echo "error: could not compose or write the finding manifest (unreadable or non-UTF-8 findings, or an fs failure) — NO manifest was written." >&2
+    if [[ -n "$mint_out" ]]; then
+      echo "       orphan left at: ${mint_out} — its temporary sibling could not be removed either; remove it by hand." >&2
+    fi
+    return 1
+  fi
+  return 0
+}
+
+# write_review_receipt <artifact|""> <fresh: true|false> <fingerprint|""> <verdict> <grounded: true|false> <factsHash|""> [probe: true|false] [delivery|""] [findings-file]
 # Appends ONE receipt line (the AD-038 fixture shape) as a side effect of a SUCCESSFUL review —
 # to $AW_REVIEW_RECEIPTS when set, else <git dir>/agent-workflow-review-receipts.jsonl (inside the
 # git dir by construction, so it is never committable). Fail-safe: every failure here warns loudly
@@ -699,8 +844,10 @@ posture_json() {
 # marker is written ALWAYS, true or false: the receipt SELF-DECLARES, so the gate reads the fact
 # itself instead of inferring it from this wrapper's version (which bumps in a different release
 # phase). Silence is not a declaration — an unmarked receipt is untrustworthy and the gate rejects it.
+# The 9th argument feeds the finding-manifest mint: on a nonce-supplied dispatch the manifest is
+# minted FIRST (atomic, no-clobber, ORDERED) and a failed mint EXCLUDES the receipt append.
 write_review_receipt() {
-  local artifact="$1" fresh="$2" fingerprint="$3" verdict="$4" grounded="$5" facts_hash="$6" probe="${7:-false}" delivery="${8:-}"
+  local artifact="$1" fresh="$2" fingerprint="$3" verdict="$4" grounded="$5" facts_hash="$6" probe="${7:-false}" delivery="${8:-}" findings_file="${9:-}"
   local receipts="${AW_REVIEW_RECEIPTS:-}"
   if [[ -z "$receipts" ]]; then
     local receipt_git_dir
@@ -710,13 +857,24 @@ write_review_receipt() {
     fi
     receipts="$receipt_git_dir/agent-workflow-review-receipts.jsonl"
   fi
-  local line probe_field=',"probe":false' delivery_field=""
+  if ! write_finding_manifest "$receipts" "$fingerprint" "$findings_file"; then
+    echo "warning: the finding manifest could not be minted — the receipt append is EXCLUDED (a" >&2
+    echo "         nonce-supplied dispatch never lands a receipt without its readable manifest);" >&2
+    echo "         the review itself succeeded — re-run it to mint the pair." >&2
+    return 0
+  fi
+  # A nonce-SUPPLIED dispatch stamps its nonce into the receipt too (the flow round-land matcher
+  # requires exact {backend, nonce} equality — dispatch identity end-to-end); the nonce is
+  # grammar-safe by the pre-spend check, and a nonce-less receipt stays BYTE-EXACT (the frozen
+  # compatibility floor).
+  local line probe_field=',"probe":false' delivery_field="" nonce_field=""
   if [[ "$probe" == "true" ]]; then probe_field=',"probe":true'; fi
   if [[ -n "$delivery" ]]; then delivery_field=",\"delivery\":\"$delivery\""; fi
-  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s%s}' \
+  if [[ -n "${AW_REVIEW_NONCE:-}" ]]; then nonce_field=",\"nonce\":\"${AW_REVIEW_NONCE}\""; fi
+  line="$(printf '{"schema":1,"artifact":%s,"fresh":%s,"fingerprint":%s,"backend":"%s","verdict":"%s","grounded":%s,"factsHash":%s,"wrapperVersion":"%s","timestamp":"%s"%s,"posture":%s%s%s}' \
     "$(receipt_json_scalar "$artifact")" "$fresh" "$(receipt_json_scalar "$fingerprint")" \
     "$AW_RECEIPT_BACKEND" "$verdict" "$grounded" "$(receipt_json_scalar "$facts_hash")" \
-    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)" "$delivery_field")"
+    "$AW_BRIDGE_VERSION" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$probe_field" "$(posture_json)" "$delivery_field" "$nonce_field")"
   if ! printf '%s\n' "$line" >>"$receipts" 2>/dev/null; then
     echo "warning: could not append the review receipt to $receipts — the review itself succeeded;" >&2
     echo "         the review-state gate will read the current tree as un-receipted." >&2
@@ -1158,11 +1316,11 @@ case "${1:-}" in
 esac
 
 usage() {
-  echo "usage: $0 code   [--facts @f] [--ungrounded] [--decided @f] [--focus \"…\"] [extra focus…]" >&2
-  echo "       $0 plan   <plan-file> [--facts @f] [--decided @f] [--focus \"…\"]" >&2
-  echo "       $0 diff   <diff-file> [--facts @f] [--decided @f] [--focus \"…\"]" >&2
-  echo "       $0 --continue          [--decided @f] [--focus \"…\"]" >&2
-  echo "       $0 --conversation <id> [--decided @f] [--focus \"…\"]" >&2
+  echo "usage: $0 code   [--facts @f] [--ungrounded] [--decided @f] [--focus \"…\"] [--nonce <n>] [extra focus…]" >&2
+  echo "       $0 plan   <plan-file> [--facts @f] [--decided @f] [--focus \"…\"] [--nonce <n>]" >&2
+  echo "       $0 diff   <diff-file> [--facts @f] [--decided @f] [--focus \"…\"] [--nonce <n>]" >&2
+  echo "       $0 --continue          [--decided @f] [--focus \"…\"] [--nonce <n>]" >&2
+  echo "       $0 --conversation <id> [--decided @f] [--focus \"…\"] [--nonce <n>]" >&2
 }
 
 # --- Mode dispatch (non-resume) ----------------------------------------------
@@ -1203,6 +1361,8 @@ fi
 FACTS_RAW=""
 DECIDED_RAW=""
 UNGROUNDED=0
+NONCE_FLAG=""
+NONCE_FLAG_SET=0
 FOCUS_PARTS=()
 # A value-taking flag must be followed by a real value — never end-of-args and never another flag.
 # Otherwise `agy-review code --facts --focus x` would silently take "--focus" as the facts and spend a
@@ -1231,6 +1391,20 @@ while [[ $# -gt 0 ]]; do
       need_value "$1" "${2:-}"; DECIDED_RAW="$2"; shift 2 ;;
     --focus)
       need_value "$1" "${2:-}"; FOCUS_PARTS+=("$2"); shift 2 ;;
+    --nonce)
+      # Not need_value: the nonce's CLOSED grammar admits leading-dash values and validates
+      # deterministically below — the next argument is taken unconditionally (only end-of-args
+      # refuses here), and presence rides its own flag so an EMPTY value still hits the grammar
+      # screen and a duplicate after it still refuses.
+      if [[ $# -lt 2 ]]; then
+        echo "error: --nonce needs a value; got '<end of args>'." >&2
+        exit 2
+      fi
+      if [[ "$NONCE_FLAG_SET" == "1" ]]; then
+        echo "error: duplicate --nonce — one dispatch carries one nonce." >&2
+        exit 2
+      fi
+      NONCE_FLAG="$2"; NONCE_FLAG_SET=1; shift 2 ;;
     --)
       echo "error: this wrapper OWNS the review posture — no '--' passthrough. The only escapes are" >&2
       echo "       AGY_PROBE=1 (off-frontier model). An oversized code review is a chunked feed, not a flag." >&2
@@ -1252,6 +1426,23 @@ done
 # Merge --focus values and trailing focus words, in parse order, into ONE focus block.
 FOCUS="${FOCUS_PARTS[*]:-}"
 
+# --nonce rides the EXISTING AW_REVIEW_NONCE seam (flow FLOW-NONCE-DISPATCH-LANE): the
+# plain-argument lane for hosts whose dispatch policy has no env-prefix form. The flag and a
+# non-empty env value must AGREE — two disagreeing sources would mint an ambiguous dispatch
+# identity (fail closed). Grammar screen identical to the env screen above (enumerated ASCII —
+# locale-independent), pre-spend.
+if [[ "$NONCE_FLAG_SET" == "1" ]]; then
+  if [[ ! "$NONCE_FLAG" =~ ^[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-]{1,64}$ ]]; then
+    echo "error: --nonce fails the safe nonce grammar ([A-Za-z0-9._-]{1,64}) — the derived manifest name would be unsafe; fix the nonce and re-run." >&2
+    exit 2
+  fi
+  if [[ -n "${AW_REVIEW_NONCE:-}" && "${AW_REVIEW_NONCE}" != "$NONCE_FLAG" ]]; then
+    echo "error: --nonce disagrees with the AW_REVIEW_NONCE environment value — one dispatch carries one nonce; drop one source and re-run." >&2
+    exit 2
+  fi
+  AW_REVIEW_NONCE="$NONCE_FLAG"
+fi
+
 # --ungrounded closed grammar (D4): code-mode only, and an explicit contradiction with --facts refuses.
 if [[ "$UNGROUNDED" == "1" ]]; then
   if [[ -n "$FACTS_RAW" ]]; then
@@ -1607,12 +1798,11 @@ if [[ -z "$AGY_MODEL" && -z "$resume_mode" && "$REVIEW_PROBE" != "true" && "$REV
   exit 2
 fi
 # The timeout field is BANNER-ONLY (AD-061): it prints exactly the duration agy-run hands to
-# timeout(1), or `uncapped` without a capping binary, and never enters the receipt posture.
-# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
-# `type` itself), normalized to an absolute path fail-closed — the banner can never claim a cap
-# the agy-run child would not have.
-aw_banner_timeout_bin="$(aw_resolve_timeout_bin)"
-aw_timeout_banner="$(aw_timeout_label "$aw_banner_timeout_bin" "$AGY_HARD_TIMEOUT")"
+# timeout(1) and never enters the receipt posture. The banner uses the PARENT-preflight-resolved
+# path (builtin type -P, absolute); the child re-resolves at dispatch under the exported
+# AGY_REQUIRE_TIMEOUT_BIN seam, whose missing-binary lane refuses — so an uncapped review
+# dispatch cannot exist on either stage.
+aw_timeout_banner="$(aw_timeout_label "$aw_review_timeout_bin" "$AGY_HARD_TIMEOUT")"
 echo "review posture: model=${AGY_MODEL:-<agy settings default>} timeout=$aw_timeout_banner" >&2
 
 # --- Execute via agy-run (single home of timeout + subscription + byte ceiling) ---
@@ -1673,7 +1863,7 @@ if [[ $rc -eq 0 ]]; then
     # A continuation never re-embeds the current artifact (agy holds the ORIGINAL round server-side;
     # --facts is rejected above), so it cannot attest the folded tree: fresh:false, artifact /
     # fingerprint / factsHash null, grounded false — informational-only, ignored by the state gate.
-    write_review_receipt "" false "" "$verdict" false "" "$REVIEW_PROBE"
+    write_review_receipt "" false "" "$verdict" false "" "$REVIEW_PROBE" "" "$review_out_file"
     echo "notice: a continuation receipt is fresh:false (informational-only) — only a fresh grounded run" >&2
     echo "        (agy-review code --facts @f) mints a receipt that satisfies the review-state gate." >&2
   else
@@ -1683,7 +1873,7 @@ if [[ $rc -eq 0 ]]; then
       grounded=true
       facts_hash="$(printf '%s' "$FACTS_CONTENT" | sha256_stdin || true)"
     fi
-    write_review_receipt "$REVIEW_ARTIFACT" true "$REVIEW_FINGERPRINT" "$verdict" "$grounded" "$facts_hash" "$REVIEW_PROBE" "$REVIEW_DELIVERY"
+    write_review_receipt "$REVIEW_ARTIFACT" true "$REVIEW_FINGERPRINT" "$verdict" "$grounded" "$facts_hash" "$REVIEW_PROBE" "$REVIEW_DELIVERY" "$review_out_file"
   fi
 fi
 exit $rc