@sabaiway/agent-workflow-kit 5.2.0 → 5.3.0

package/CHANGELOG.md

@@ -4,6 +4,46 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 5.3.0 — a check must speak where it is built to speak: the two silent checks (AD-088)
+
+**Two shipped checks stayed SILENT at exactly the point they exist to speak** — one a GATE that
+refuses and blocks a commit, one a WARNING that never changes an exit status. They were one
+sentence, so they ship together.
+
+- **The `flow-check` gate stops demanding the receipt its own run will write.** A red final on the
+  current base was cleared only through a LATER completed retry — but `run-gates` appends the final
+  receipt only after every gate has run, so the in-matrix `flow-check` could never see the receipt
+  its OWN run would write, and each `--final` on an unchanged base minted red N+1. No number of
+  rerun-causes converged; the only exit was a hook bypass. The `#65` rung is now consumer-aware, the
+  same lane split the flow→final comparison already applies one arm away: on the `gate` lane a
+  current-base red is
+  ALSO answered by a provable IN-PROGRESS retry — an authoritative `rerun-cause` naming its attempt
+  and binding the current fingerprint, a `final-start` at that fingerprint ordered strictly after
+  that red whose attempt has no completed final, and that fingerprint correlating to exactly ONE
+  base, the current one. Inside a real final run the conjunction holds by construction; a standalone
+  check on a quiet tree still refuses.
+- **`commit-guard` is unchanged.** It keeps the strict completed-retry demand, so the commit
+  boundary still sees a real receipt. The rung's own `consumer` defaults to that strict lane, the
+  relaxation is opt-in by EXACT match, and a tree whose fingerprint is unresolvable or ambiguously
+  base-correlated never relaxes.
+- **The interrupted-run residual is stated, not papered over.** An interrupted final run leaves the
+  same record shape with no live run behind it, so a standalone `flow-check --check` reads PASS in
+  that window. It authorizes nothing — the commit boundary refuses that shape twice over,
+  independently — and the rung's own source comment says so, pinned end to end by a fixture that
+  asserts all three conditions at once.
+- **The bundled `codex-cli-bridge` mirror moves to 3.4.0** — its nested-sandbox scan now runs on
+  every completed run, not only a failed one, so a delegated run that SURVIVES the failure and exits
+  0 is no longer silent about it. On a successful run, it warns when the scanner recognises the
+  expected per-item shape — both tokens inside the `aggregated_output` of ONE `command_execution`
+  with a proven failure. The heuristic is biased toward under-firing on ambiguous or schema-drifted
+  input: field reordering stops the match, and only the first matching item on a line is judged.
+  The exit status deliberately stays 0 there — a heuristic scan must never gain the power to refuse
+  real work.
+
+Evidence: an end-to-end fixture drives a caused red at the current tree through ONE real
+`run-gates --final` to a GREEN newest-authoritative final and a passing `commit-guard --check` — the
+test that would have failed before this release.
+
 ## 5.2.0 — the flow machinery ships whole: recorded subset budgets, flow-bound finals, the round arms, and the dogfooded pipeline (AD-086)
 
 **Everything the flow series built after 5.1.0 lands as one wave** — the record vocabulary, the

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '5.2.0'
+  version: '5.3.0'
 ---
 
 # agent-workflow-kit

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.3.0'
+  version: '3.4.0'
 ---
 
 # codex-cli-bridge
@@ -110,8 +110,15 @@ receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
 
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's
-**final message** (`-o`; the JSON event stream + reasoning go to a discarded trace), so output is
-clean; a successful **non-resume** `codex-exec` also records the session id to a sidecar
+**final message** (`-o`), so output is clean; the JSON event stream + reasoning go to a run trace
+that is **read before it is discarded**. Fresh and resumed runs share **ONE** capture posture
+(`-o` + `--json` + `--color never`, everything redirected into the trace), so both modes have the
+same evidence surface — and the wrapper scans that surface on **every completed run**: a run that
+SURVIVES a nested-sandbox failure exits 0 with an ungrounded answer, so on `rc == 0` it prints the
+answer first and then warns loudly on stderr when one `command_execution` item with a **proven**
+failure carries both a sandbox-mechanism and a permission/read-only token in its `aggregated_output`.
+The exit status stays 0 there (warning, not gate) — read the stderr line. A successful **non-resume**
+`codex-exec` also records the session id to a sidecar
 (`${CODEX_SESSION_FILE:-./.codex-last-session}`) so `--resume-last` can find it. Extra `codex` flags
 go after a literal `--`; the wrapper rejects any that would defeat the policy or the pinned model (see
 [§ Environment knobs](#environment-knobs) and the flag tiers in

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -86,6 +86,18 @@ Notes:
   INFORMATIONAL only: it is never persisted in a receipt or session sidecar
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
+  every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on
+  EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure
+  exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose
+  whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires
+  ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only
+  failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN
+  (a nonzero exit_code, or the serialized status "failed"); a null exit_code is never failure by
+  itself, tokens split across two items never fire, and a successful command's output never fires.
+  The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit
+  status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY
+  polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit
+  status alone can still bank an ungrounded answer — the stderr warning is the signal
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -412,9 +424,9 @@ fi
 
 # --- Resume detection (must be the FIRST argument) ---------------------------
 # A dedicated entrypoint for iterating on a session without re-sending context.
-# `codex exec resume` RESETS posture and rejects the -s/--add-dir/-C posture flags
-# (it DOES accept -o/--json on 0.142.3, but we capture stdout directly), so we
-# restate the FULL policy via -c.
+# `codex exec resume` RESETS posture and rejects the -s/--add-dir/-C posture flags,
+# so we restate the FULL policy via -c. It DOES accept -o/--json/--color, and it now
+# carries the same capture posture as a fresh run (one evidence surface, both modes).
 resume_mode=""
 resume_id=""
 case "${1:-}" in
@@ -608,8 +620,10 @@ chmod 755 "$shim_dir/git"
 # --- Build the codex invocation + the prompt ---------------------------------
 if [[ -n "$resume_mode" ]]; then
   # Resume RESETS posture and rejects the -s/--add-dir/-C posture flags, so restate
-  # the entire policy via -c. We deliberately pass no -o/--json (resume DOES accept
-  # them) — codex prints the final message to stdout, which we capture into $out.
+  # the entire policy via -c. It DOES accept -o/--json/--color, and it now carries the
+  # SAME capture posture as a fresh run: the mode asymmetry was a convenience, and it
+  # left resume — the lane the survived-nested-sandbox incident fired on — with no
+  # evidence surface at all (its event stream went nowhere).
   codex_cmd=(codex exec resume "$resume_id"
     --ignore-user-config
     -m "$CODEX_MODEL"
@@ -620,6 +634,9 @@ if [[ -n "$resume_mode" ]]; then
     -c hide_agent_reasoning=true
     -c model_reasoning_summary=none
     "${tier_flags[@]+"${tier_flags[@]}"}"
+    --color never
+    -o "$out"
+    --json
     -)
   full_prompt="$RESUME_REMINDER"$'\n\n'"$task"
 else
@@ -672,25 +689,136 @@ aw_session_label="fresh"
 [[ -n "$resume_mode" ]] && aw_session_label="resume:$resume_id"
 echo "exec posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} sandbox=workspace-write session=$aw_session_label timeout=$aw_timeout_banner" >&2
 
-# Normal mode: -o writes $out, the JSON stream + logs go to $trace. Resume mode: the
-# final message is codex's stdout → $out, logs → $trace. Either way the final lands
-# in $out and diagnostics in $trace, so the post-processing below is shared.
-set +e
-if [[ -n "$resume_mode" ]]; then
-  if [[ -n "$timeout_bin" ]]; then
-    printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$out" 2>"$trace"
+# --- Nested-sandbox evidence scan: ONE entry point, TWO policies ---------------
+# The class: codex ships its OWN OS sandbox (bwrap); run nested inside a harness sandbox the FS is
+# read-only and codex's sandbox setup fails. The scan runs on EVERY completed run, not only a failed
+# one — when the backend SURVIVES the failure (degrades to "I cannot check" and exits 0) a paid run
+# is spent on an ungrounded answer, and nothing said so.
+#
+# The two arms have DIFFERENT rules, deliberately:
+#   FAILED run (rc != 0) — the loose whole-trace COMBINATION rule, unchanged: a sandbox MECHANISM
+#   token AND a permission/read-only FAILURE token anywhere in the trace. The run already failed and
+#   the operator is already reading the tail, so an extra hint costs nothing. grep is line-oriented,
+#   so a plain alternation stays within a line — hence two `-q` passes rather than one pattern.
+#   SUCCESSFUL run (rc == 0) — per-item evidence ONLY: both tokens inside the aggregated_output of
+#   ONE command_execution item whose FAILURE is proven. Here a false positive would libel a good
+#   answer, so nothing loose is allowed near it.
+# The successful-run scan is LINE-ORIENTED and TOLERANT: after the unified 2>&1 the trace
+# legitimately mixes plain log lines with JSONL, so every line is judged alone, a line that is not a
+# well-formed command_execution item is simply not evidence (never a parse error, never a stop), and
+# no line can mask a later one.
+AW_NS_MECHANISM='bwrap|landlock|user namespace|pivot_root|unshare|seccomp'
+AW_NS_FAILURE='read-only file system|erofs|operation not permitted|permission denied|eperm'
+
+# BOTH token classes present in one piece of text. Fed by here-string rather than `printf | grep`:
+# with `pipefail` on, a producer that takes EPIPE when `grep -q` exits early on a match would make
+# the pipeline non-zero and silently DROP a real signature — an under-fire invisible by
+# construction. Not reproduced on this host, folded as portability hardening: with no explicit
+# pipeline there is no producer left to fail.
+aw_ns_both_tokens() {
+  grep -qiE "$AW_NS_MECHANISM" <<<"$1" || return 1
+  grep -qiE "$AW_NS_FAILURE" <<<"$1" || return 1
+  return 0
+}
+
+# Valid JSON string CONTENT — no UNESCAPED quote. This is what proves a delimiter slice stayed
+# inside ONE string instead of crossing an object boundary: without it, a decoy object carrying the
+# anchor lets the walk leave its own string and land in another item's fields.
+# The predicate is the parity rule — a quote is escaped iff an ODD number of backslashes precedes
+# it — expressed as an ERE and evaluated by grep: `(^|[^\])` then an EVEN run `(\\)*` then the
+# quote. It is measured, not assumed: the obvious bash spelling (delete the `\\` and `\"` pairs,
+# then look for a survivor) is the SAME predicate but bash's `${var//…}` is quadratic, and it hung
+# the wrapper outright on a 200KB aggregated_output — a real tool call's output reaches that size.
+aw_ns_is_string_content() {
+  if grep -qE '(^|[^\\])(\\\\)*"' <<<"$1"; then return 1; fi
+  return 0
+}
+
+# One trace line → 0 only when THAT line is a command_execution item with a PROVEN failure whose
+# aggregated_output carries both token classes. The wrapper stays dependency-free, so this is not a
+# JSON parse — it is ONE anchored walk over the CLI's observed serialization in which every SKIPPED
+# gap is PROVEN to be a single JSON string's content (aw_ns_is_string_content). Both halves are
+# load-bearing: testing the fields as independent substrings lets a decoy object supply the anchor
+# while the failure fields belong to another item, and skipping a gap without validating it lets the
+# walk leave its own string and land in that other item anyway.
+# The observed shape (codex-cli 0.147.0, live-probed):
+#   {"id":…,"type":"command_execution","command":"…","aggregated_output":"…","exit_code":2,"status":"failed"}
+# Failure proofs: A = a nonzero exit_code, B = the status "failed" immediately after it. A null
+# exit_code is never failure by itself (an in-flight item carries "exit_code":null,"status":"in_progress").
+# Two stated consequences, both deliberate:
+#   - a future CLI that REORDERS these fields makes the scan stop firing rather than misfire.
+#     Under-firing is the right direction here: over-firing would libel a correct answer.
+#   - only the FIRST matching item on a line is judged; a second item's evidence is missed.
+# A hand-crafted trace line is outside the threat model (the same boundary the wrapper declares for
+# a hostile parent environment): the trace's only non-CLI content is plain stderr, which does not
+# start with `{`, and a tool call's own output is JSON-escaped into a string and cannot inject
+# structure. Anything not matching the walk is "not evidence" — never an error, never a stop.
+# Every slice is taken by a SHORT-pattern `#*` cut plus length arithmetic. That is not a style
+# choice: `${var%%<long>*}` and a prefix removal whose PATTERN is a huge variable are both
+# quadratic in bash, and either one hangs the wrapper outright on a 200KB aggregated_output
+# (measured, not assumed — a real tool call's output reaches that size).
+aw_ns_item_evidence() {
+  local line="$1" d1='","aggregated_output":"' d2='","exit_code":' rest tail cmd agg code after
+  case "$line" in '{'*) ;; *) return 1 ;; esac
+  rest="${line#*'"type":"command_execution","command":"'}"
+  if [[ "$rest" == "$line" ]]; then return 1; fi
+  tail="${rest#*"$d1"}"
+  if [[ "$tail" == "$rest" ]]; then return 1; fi
+  cmd="${rest:0:$(( ${#rest} - ${#tail} - ${#d1} ))}"
+  aw_ns_is_string_content "$cmd" || return 1
+  after="${tail#*"$d2"}"
+  if [[ "$after" == "$tail" ]]; then return 1; fi
+  agg="${tail:0:$(( ${#tail} - ${#after} - ${#d2} ))}"
+  aw_ns_is_string_content "$agg" || return 1
+  code="${after%%,*}"
+  if [[ "$code" =~ ^-?[0-9]+$ && "$code" != "0" ]]; then
+    :
+  elif [[ "${after#"$code",}" == '"status":"failed"'* ]]; then
+    :
   else
-    printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$out" 2>"$trace"
+    return 1
   fi
-  rc=$?
-else
-  if [[ -n "$timeout_bin" ]]; then
-    printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$trace" 2>&1
-  else
-    printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$trace" 2>&1
+  aw_ns_both_tokens "$agg"
+}
+
+aw_scan_nested_sandbox() {   # $1 = rc, $2 = trace path
+  [[ -r "$2" ]] || return 0
+  if [[ "$1" -ne 0 ]]; then
+    if grep -qiE "$AW_NS_MECHANISM" "$2" 2>/dev/null && grep -qiE "$AW_NS_FAILURE" "$2" 2>/dev/null; then
+      echo "hint: this looks like a NESTED-SANDBOX failure — codex-exec ships its own OS sandbox (bwrap)," >&2
+      echo "      which cannot run nested inside a harness sandbox (the FS is read-only). Route codex-exec" >&2
+      echo "      OUTSIDE the harness sandbox: add it to the harness sandbox excludedCommands, or dispatch" >&2
+      echo "      this one run via a per-run consented bypass. Do NOT blanket-disable the sandbox." >&2
+    fi
+    return 0
   fi
-  rc=$?
+  local line
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if aw_ns_item_evidence "$line"; then
+      echo "warning: NESTED-SANDBOX — this run COMPLETED, but a tool call inside it FAILED with a sandbox-setup" >&2
+      echo "         signature. codex-exec ships its own OS sandbox (bwrap), which cannot run nested inside a" >&2
+      echo "         harness sandbox (the FS turns read-only), so the backend most likely could not read what" >&2
+      echo "         it was asked to check: the answer above may be UNGROUNDED — treat it as such rather than" >&2
+      echo "         banking it. Re-dispatch OUTSIDE the harness sandbox: add codex-exec to the harness" >&2
+      echo "         sandbox excludedCommands, or use a per-run consented bypass. Do NOT blanket-disable the" >&2
+      echo "         sandbox. The exit status stays 0 on purpose — this is a warning, never a gate." >&2
+      return 0
+    fi
+  done <"$2"
+  return 0
+}
+
+# ONE capture posture for BOTH modes: -o writes the final message to $out, the JSON
+# event stream and every log line go to $trace (stderr merged in). The final always
+# lands in $out and the diagnostics always in $trace, so the post-processing below —
+# including the evidence scan — is genuinely shared instead of mode-dependent.
+set +e
+if [[ -n "$timeout_bin" ]]; then
+  printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$trace" 2>&1
+else
+  printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$trace" 2>&1
 fi
+rc=$?
 set -e
 
 if [[ $rc -eq 124 || $rc -eq 137 ]]; then
@@ -701,20 +829,7 @@ fi
 if [[ $rc -ne 0 ]]; then
   echo "error: codex exec failed (exit $rc). Last lines of the run trace:" >&2
   tail -n 40 "$trace" >&2
-  # Nested-sandbox detection: codex ships its OWN OS sandbox (bwrap); run nested inside a harness
-  # sandbox the FS is read-only and codex's own sandbox setup fails. Fire the STATED recovery hint
-  # only on a COMBINATION — a sandbox MECHANISM token AND a permission/read-only FAILURE token in the
-  # trace — so a lone 'bwrap' banner, or a lone 'permission denied' from unrelated code, is NOT enough
-  # (never a preemptive blanket). grep is line-oriented, so a plain alternation stays within a line —
-  # the old `[^\n]*` between the two halves was wrong twice over (it excluded the letter 'n', and grep
-  # never spans lines anyway), so the split into two `-q` passes both fixes it and states the intent.
-  if grep -qiE 'bwrap|landlock|user namespace|pivot_root|unshare|seccomp' "$trace" 2>/dev/null \
-     && grep -qiE 'read-only file system|erofs|operation not permitted|permission denied|eperm' "$trace" 2>/dev/null; then
-    echo "hint: this looks like a NESTED-SANDBOX failure — codex-exec ships its own OS sandbox (bwrap)," >&2
-    echo "      which cannot run nested inside a harness sandbox (the FS is read-only). Route codex-exec" >&2
-    echo "      OUTSIDE the harness sandbox: add it to the harness sandbox excludedCommands, or dispatch" >&2
-    echo "      this one run via a per-run consented bypass. Do NOT blanket-disable the sandbox." >&2
-  fi
+  aw_scan_nested_sandbox "$rc" "$trace"
   exit $rc
 fi
 
@@ -739,3 +854,7 @@ else
   echo "warning: codex produced no final-message file — printing the run-trace tail instead." >&2
   tail -n 40 "$trace"
 fi
+
+# The answer is printed FIRST, then the evidence speaks: a run that COMPLETED can still have been
+# ungrounded, and saying so after the answer keeps stdout byte-identical for every caller.
+aw_scan_nested_sandbox "$rc" "$trace"

package/bridges/codex-cli-bridge/bin/codex-exec.test.mjs

@@ -46,6 +46,13 @@ const FAKE_CODEX = [
   '  cat <<EOF',
   '{"type":"turn.started"}',
   '{"type":"item.completed","item":{"id":"item_0","type":"agent_message","text":"FAKE_FINAL_MESSAGE"}}',
+  'EOF',
+  // The event seam: verbatim extra stream lines (JSONL items, plain noise, or both) between the
+  // opening events and turn.completed — a multi-line value emits multiple lines.
+  '  if [[ -n "${CODEX_FAKE_EVENT:-}" ]]; then echo "$CODEX_FAKE_EVENT"; fi',
+  // A file-borne twin: a payload too large for the environment (E2BIG) still has to be emittable.
+  '  if [[ -n "${CODEX_FAKE_EVENT_FILE:-}" ]]; then cat "$CODEX_FAKE_EVENT_FILE"; fi',
+  '  cat <<EOF',
   '{"type":"turn.completed","usage":{}}',
   'EOF',
   'else',
@@ -365,6 +372,203 @@ describe('codex-exec.sh — clean output + session capture (1.2)', () => {
     assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'a permission failure from unrelated code is not nested-sandbox proof');
   });
 
+  // ── the rc == 0 arm: the SURVIVED nested-sandbox failure ──
+  // The class the failed-run arm cannot see: the backend hits the nested sandbox, degrades to "I
+  // cannot check", and exits 0 — a paid run spent on an ungrounded answer with nothing saying so.
+  // Both serialized shapes below were observed on the INSTALLED codex-cli 0.147.0: a finished item
+  // carries {"exit_code":2,"status":"failed"}, an in-flight one {"exit_code":null,"status":"in_progress"}.
+  const cmdItem = ({ command = '/bin/bash -lc probe', output = '', exitCode = null, status = 'completed', id = 'item_1' }) =>
+    JSON.stringify({ type: 'item.completed', item: { id, type: 'command_execution', command, aggregated_output: output, exit_code: exitCode, status } });
+  const MECHANISM = 'bwrap: setting up sandbox';
+  const FAILURE = 'mkdir /newroot: Read-only file system';
+  const SIGNATURE = `${MECHANISM}: ${FAILURE}\n`;
+
+  it('an rc == 0 run whose trace carries a command_execution with a NONZERO exit_code and the signature warns loudly and still prints the answer', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: cmdItem({ output: SIGNATURE, exitCode: 1, status: 'completed' }) } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, 'the warning lane never changes the exit status');
+    assert.match(r.stdout, /FAKE_FINAL_MESSAGE/, 'the answer is printed FIRST, on stdout, unchanged');
+    assert.match(r.stderr, /NESTED-SANDBOX/, 'names the class');
+    assert.match(r.stderr, /UNGROUNDED/, 'names the consequence for the answer above');
+    assert.match(r.stderr, /excludedCommands|per-run consented bypass/, 'names the reroute');
+  });
+
+  it('an rc == 0 run whose trace carries a command_execution with a null exit_code and an explicitly FAILED status warns', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: cmdItem({ output: SIGNATURE, exitCode: null, status: 'failed' }) } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0);
+    assert.match(r.stderr, /NESTED-SANDBOX/, 'the serialized failed status is the second failure proof');
+  });
+
+  it('plain non-JSON stderr lines before and after a matching failed command_execution do not suppress the warning', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      env: {
+        CODEX_FAKE_STDERR: 'ERROR codex_core::session: failed to load skill /x/SKILL.md: missing field description',
+        CODEX_FAKE_EVENT: `not json at all\n${cmdItem({ output: SIGNATURE, exitCode: 2, status: 'failed' })}\nstill not json`,
+      },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0);
+    assert.match(r.stderr, /NESTED-SANDBOX/, 'the merged stream is judged line by line — noise is not evidence and never a stop');
+  });
+
+  it('the resume lane warns on an rc == 0 nested-sandbox signature — the lane the incident fired on', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      args: ['--resume', 'sess-nested', '-'], input: 'continue',
+      env: { CODEX_FAKE_EVENT: cmdItem({ output: SIGNATURE, exitCode: 1, status: 'failed' }) },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0);
+    assert.match(r.stdout, /FAKE_FINAL_MESSAGE/);
+    assert.match(r.stderr, /NESTED-SANDBOX/, 'the whole point of unifying the capture');
+  });
+
+  it('an rc == 0 run with a clean trace warns nothing', () => {
+    const sb = makeSandbox();
+    const r = run(sb);
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'a clean run must stay silent');
+  });
+
+  it('a lone mechanism token and a lone failure token each warn nothing on the rc == 0 lane', () => {
+    for (const output of [`${MECHANISM} version 0.11.0\n`, `curl: (7) ${FAILURE}\n`]) {
+      const sb = makeSandbox();
+      const r = run(sb, { env: { CODEX_FAKE_EVENT: cmdItem({ output, exitCode: 1, status: 'failed' }) } });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, `a lone token class is not proof: ${output}`);
+    }
+  });
+
+  it('nested-sandbox text appearing ONLY inside an agent_message item never warns', () => {
+    const sb = makeSandbox();
+    const event = JSON.stringify({ type: 'item.completed', item: { id: 'item_9', type: 'agent_message', text: `I hit ${SIGNATURE}` } });
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: event } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'the model TALKING about a sandbox is not a failed tool call');
+  });
+
+  it('a SUCCESSFUL command_execution whose output merely QUOTES both tokens never warns', () => {
+    const sb = makeSandbox();
+    // The concrete false positive: codex-exec.sh itself carries both token classes, so any
+    // successful grep over it would trip a loose whole-trace rule.
+    const r = run(sb, {
+      env: { CODEX_FAKE_EVENT: cmdItem({ command: '/bin/bash -lc grep -n bwrap codex-exec.sh', output: SIGNATURE, exitCode: 0, status: 'completed' }) },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'a command that SUCCEEDED proves nothing failed');
+  });
+
+  it('a command_execution with a null exit_code and no proven failed status never warns', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: cmdItem({ output: SIGNATURE, exitCode: null, status: 'in_progress' }) } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'a null exit_code is never failure by itself');
+  });
+
+  it('tokens split across two different items never warn', () => {
+    const sb = makeSandbox();
+    const split = [
+      cmdItem({ id: 'item_1', output: `${MECHANISM} version 0.11.0\n`, exitCode: 1, status: 'failed' }),
+      cmdItem({ id: 'item_2', output: `curl: (7) ${FAILURE}\n`, exitCode: 1, status: 'failed' }),
+    ].join('\n');
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: split } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'the combination must sit in ONE item — two failures are not one nested sandbox');
+  });
+
+  // ── object membership, not substring co-occurrence ──
+  // Testing the four fields independently is not enough: position in the line is not membership in
+  // the item. The scan walks ONE contiguous chain of raw delimiters instead, and every gap in that
+  // chain is inside a JSON string, where a quote is escaped and cannot forge the next delimiter.
+  it('a decoy object carrying the type, with the failure fields on a DIFFERENT item, never warns', () => {
+    const sb = makeSandbox();
+    const decoy = '{"type":"item.completed","decoy":{"type":"command_execution"},"item":{"type":"agent_message","aggregated_output":"bwrap: operation not permitted","exit_code":0,"status":"failed"}}';
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: decoy } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'the type belongs to the decoy; the failure fields belong to an agent_message');
+  });
+
+  it('a decoy carrying BOTH the type and a command, with the failure fields on a DIFFERENT item, never warns', () => {
+    const sb = makeSandbox();
+    // Anchoring on a longer literal is not enough: the skip between fields must itself be PROVEN to
+    // be one JSON string's content, or the walk leaves the decoy's command and lands in the
+    // agent_message's fields.
+    const decoy = '{"type":"item.completed","decoy":{"type":"command_execution","command":"x"},"item":{"type":"agent_message","aggregated_output":"bwrap: setting up sandbox: operation not permitted","exit_code":1,"status":"failed"}}';
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: decoy } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'an unvalidated gap lets the walk cross an object boundary');
+  });
+
+  it('a genuinely failed item with a ~200KB aggregated_output still warns — and the scan does not hang', () => {
+    const sb = makeSandbox();
+    // Two edges at once: the signature sits FIRST, so any early-exit consumer must not lose it, and
+    // the field is far larger than a pipe buffer. It also pins the cost: the quadratic bash string
+    // spellings of this walk hang the wrapper outright at this size.
+    const big = `${SIGNATURE}${'x'.repeat(200000)}`;
+    // The payload rides a FILE: 200KB in the environment is E2BIG on a normal host.
+    const payload = join(sb.repo, 'big-event.jsonl');
+    writeFileSync(payload, `${cmdItem({ output: big, exitCode: 1, status: 'failed' })}\n`);
+    const r = run(sb, { env: { CODEX_FAKE_EVENT_FILE: payload } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /NESTED-SANDBOX/, 'a large output must not silently drop a real signature');
+  });
+
+  it('a plain non-JSON log line carrying the same substrings never warns', () => {
+    const sb = makeSandbox();
+    const lookalike = `ERROR codex_core: replaying "type":"command_execution","command":"x","aggregated_output":"${SIGNATURE.trim()}","exit_code":1,"status":"failed"`;
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: lookalike } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'prose ABOUT an event is not an event — an event line starts with {');
+  });
+
+  it('a FOREIGN "status":"failed" elsewhere on the line never proves a SUCCESSFUL item failed', () => {
+    const sb = makeSandbox();
+    const event = `${cmdItem({ output: SIGNATURE, exitCode: 0, status: 'completed' })}{"type":"turn.failed","status":"failed"}`;
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: event } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'the failed status must sit immediately after THIS item exit_code');
+  });
+
+  it('an escaped delimiter inside aggregated_output never fools the slice', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      env: { CODEX_FAKE_EVENT: cmdItem({ output: `${SIGNATURE}","exit_code":1,"status":"failed"`, exitCode: 0, status: 'completed' }) },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'a quote inside a JSON string is escaped, so the raw delimiter cannot occur there');
+  });
+
+  it('only the FIRST command_execution item of a line is judged — a second item on the same line is missed (a STATED false negative)', () => {
+    const sb = makeSandbox();
+    const glued = `${cmdItem({ id: 'item_1', output: 'all good\n', exitCode: 0, status: 'completed' })}${cmdItem({ id: 'item_2', output: SIGNATURE, exitCode: 1, status: 'failed' })}`;
+    const r = run(sb, { env: { CODEX_FAKE_EVENT: glued } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.doesNotMatch(r.stderr, /NESTED-SANDBOX/, 'under-firing is the deliberate direction on a warning lane; this pins it so it cannot change silently');
+  });
+
+  it('a trace of plain non-JSON lines alone carrying both tokens never warns on the rc == 0 arm — while the FAILED arm warns on exactly those bytes', () => {
+    const bytes = `${MECHANISM}: ${FAILURE}`;
+    const clean = makeSandbox();
+    const ok = run(clean, { env: { CODEX_FAKE_STDERR: bytes } });
+    rmSync(clean.root, { recursive: true, force: true });
+    assert.equal(ok.status, 0, ok.stderr);
+    assert.doesNotMatch(ok.stderr, /NESTED-SANDBOX/, 'on a COMPLETED run only per-item evidence speaks');
+    const failed = makeSandbox();
+    const bad = run(failed, { env: { CODEX_FAKE_STDERR: bytes, CODEX_FAKE_EXIT: '1' } });
+    rmSync(failed.root, { recursive: true, force: true });
+    assert.equal(bad.status, 1);
+    assert.match(bad.stderr, /NESTED-SANDBOX/, 'the failed-run arm keeps its loose whole-trace rule — that is what makes the dual policy visible');
+  });
+
   it('warns (never silently) when the session sidecar cannot be written', () => {
     const sb = makeSandbox();
     const blocker = join(sb.repo, 'blocker');
@@ -447,10 +651,30 @@ describe('codex-exec.sh — resume entrypoint restates every invariant (3.1)', (
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.argv, /(^|\n)sess-xyz(\n|$)/, 'the session id is passed positionally');
     for (const inv of RESUME_INVARIANTS) assert.match(r.argv, inv, `resume argv must include ${inv}`);
-    assert.doesNotMatch(r.argv, /(^|\n)-o(\n|$)/, 'resume rejects -o');
-    assert.doesNotMatch(r.argv, /(^|\n)--json(\n|$)/, 'resume rejects --json');
-    assert.doesNotMatch(r.argv, /(^|\n)--color(\n|$)/, 'resume rejects --color');
-    assert.match(r.stdout, /FAKE_FINAL_MESSAGE/, 'resume prints codex stdout');
+    assert.match(r.stdout, /FAKE_FINAL_MESSAGE/, 'resume prints the final message');
+  });
+
+  // The capture unification: resume used to be the odd mode out — no -o, no --json, its event
+  // stream nowhere — which is precisely why the lane the nested-sandbox incident fired on had no
+  // evidence surface. `codex exec resume` accepts both (live-probed, codex-cli 0.147.0).
+  it('resume composes the unified capture — the same -o/--json/--color posture as a fresh run', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['--resume', 'sess-unified', '-'], input: 'continue please' });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.argv, /(^|\n)-o(\n|$)/, 'resume writes the final message through -o');
+    assert.match(r.argv, /(^|\n)--json(\n|$)/, 'resume streams the structured events');
+    assert.match(r.argv, /(^|\n)--color(\n|$)/, 'resume disables colour like a fresh run');
+    assert.match(r.stdout, /FAKE_FINAL_MESSAGE/, 'resume stdout is still the final message');
+  });
+
+  it('resume falls back to the trace tail when the final-message file is missing', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['--resume', 'sess-noout', '-'], input: 'go', env: { CODEX_FAKE_NO_OUT: '1' } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /no final-message file/, 'the fallback is loud, never silent');
+    assert.match(r.stdout, /turn\.completed/, 'the trace tail carries the event stream resume now captures');
   });
 
   it('--resume-last reads the session id from the sidecar', () => {

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -278,7 +278,7 @@ DEFAULT_CODEX_EFFORT="xhigh"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.3.0"
+AW_BRIDGE_VERSION="3.4.0"
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
 # Generous hard cap for a slow xhigh review (subscription latency varies).

package/bridges/codex-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "posture": { "model": "gpt-5.6-sol", "effort": "xhigh", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
@@ -31,7 +31,8 @@
           "exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend",
           "threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent environment. A hostile parent environment — including exported shell functions or PATH substitution of core/backend commands — is outside the threat model and can substitute the backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental shadowing; it is not an environment security boundary",
           "the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it is never persisted in a receipt or session sidecar",
-          "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
+          "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts",
+          "every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN (a nonzero exit_code, or the serialized status \"failed\"); a null exit_code is never failure by itself, tokens split across two items never fire, and a successful command's output never fires. The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit status alone can still bank an ungrounded answer — the stderr warning is the signal"
         ]
       }
     },

package/bridges/codex-cli-bridge/references/driving-codex.md

@@ -75,9 +75,11 @@ codex-review code "focus on the reducer and its tests"
 `codex-exec` prepends an **orchestrator execution contract**: work in the current tree, never
 git-write, *obey* the already-merged `AGENTS.md` (Hard Constraints + declared gates), self-review the
 diff (incl. untracked files), run the project's declared gates (STOP if none are declared), don't
-commit, report blockers. It captures only codex's **final message** (`-o`; the JSON event stream +
-reasoning are discarded to a trace) and, on a **non-resume** run, records the session id to
-`${CODEX_SESSION_FILE:-./.codex-last-session}`.
+commit, report blockers. It captures only codex's **final message** (`-o`) and, on a **non-resume**
+run, records the session id to `${CODEX_SESSION_FILE:-./.codex-last-session}`. The JSON event stream
++ reasoning go to a run trace that is **read before it is discarded** — fresh runs and resumes share
+ONE capture posture, and the wrapper scans that trace on every completed run for a nested-sandbox
+failure the run SURVIVED (see [`sandbox-and-flags.md`](sandbox-and-flags.md#clean-output-capture)).
 
 ## Resume — iterate without re-sending context