@sabaiway/agent-workflow-kit 5.2.0 → 5.4.0

package/CHANGELOG.md

@@ -4,6 +4,116 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 5.4.0 — a check that certifies nothing now says so, and the render stops promising what no host guarantees (AD-089)
+
+**A gate matrix could run green while verifying nothing, and the kit itself was what built it.**
+Neither declaration path ever wired a coverage PRODUCER, yet both declared the coverage CHECKER — so
+a fresh `gates-init` and an `upgrade` alike could leave a project whose `--final` prints three
+`PASS`, `lcov-sha256=none`, `attested=yes`, `status=ok`, exit 0. The honest signal existed on one
+inner line; it reached no surface a consumer keys on. This release stops both kit-owned declaration
+paths from ever ADDING a producer-less pair, makes the withheld verdict travel, and stops the
+autonomy render asserting host behaviour it cannot know. A pair you declare by hand stays yours —
+the kit reports it, it never removes it. Nothing gains a state: exit codes, the `status=` token, the
+receipt `status` enum, `--final` acceptance and the commit-guard disposition are untouched, so an
+optional-coverage project never goes red by surprise.
+
+- **Neither kit-owned declaration path ADDS a coverage checker without a producer.**
+  `gates-init` wires the lcov reporter flags onto the one allowlist suite body that produces
+  coverage unaided, WITHHOLDS the `coverage-check` candidate with a named reason when neither the
+  offer nor the existing declaration carries a producer, and — this path alone — refuses at WRITE
+  time on the MERGED declaration, because an offer-level check alone still let
+  `--apply --only coverage-check` write a dead checker, still let a producer land after an
+  already-last checker, and still let a SECOND canonical checker in under a different id. The
+  ordering refusal names ORDERING as the cause, so you reorder instead of concluding the producer
+  was rejected. `migrate-gates` stops adding the checker into a producer-less declaration and
+  reports an already-declared one as INERT — loudly, with the remedy, and removing nothing for you.
+- **One CLOSED producer predicate, shared by every consumer.** Recognition covers the full command
+  forms the kit itself emits — never a substring probe, because `echo "$AW_GIT_DIR/…"` or a
+  half-written flag set would pass one. The tail rule is a POSITIVE path-shaped grammar rather than
+  an operator blocklist: `node --test <flags> && rm -f <lcov>` runs the suite and then deletes the
+  file, so an open-ended tail would certify a producer that leaves nothing behind. The residual is
+  stated in the source rather than papered over — the screen judges source bytes, so the claim is
+  "configured with the reporters", never "the lcov survives the command"; a run that produces none
+  is still caught honestly at runtime as `skipped-no-lcov`.
+- **`attested=` binds to the BYTES consumed.** A run that read nothing never certifies, however
+  valid its final-run context. The field states that a VERDICT WAS ISSUED — not that coverage
+  passed — so a valid handshake over uncovered lines still reads `yes` and still exits 1.
+- **The summary line carries a new closed `coverage=` field** — `certified` / `not-run` / `none` /
+  `unknown`, one value defined for every run outcome — and the checker's table row names a withheld
+  verdict. Both are derived by CROSS-READING the checker's two anchored machine lines, so a missing,
+  duplicated or self-contradicting pair reads `unknown` rather than `certified`. The `--final`
+  receipt records the run's own token, and `core-evidence summary` renders the qualifier FROM it
+  instead of guessing from `lcovSha256` — which says what a receipt binds and never whether a
+  verdict was issued. A pre-5.4.0 receipt is named as a legacy receipt, never as a claim about what
+  it read.
+- **New advisor item `gates-inert`** for a declaration that runs green and certifies nothing, with
+  two causes and two remedies. Cause A — a canonical `coverage-check` with no producer BEFORE it
+  (none at all, or one declared after it, which writes the lcov too late and lets stale bytes be
+  certified) — is HAND-APPLY, since the append-only fill cannot reorder an existing declaration.
+  Cause B — every declared gate is one of the kit's own checkers — renders the consent-gated
+  `gates-init` preview. Cause A decides through the SAME producer-before-checker rule the
+  `gates-init` fill enforces at write time — one home, so the advisor and the fill cannot drift
+  apart; cause B is advisor-only, with no refusal path behind it. `--final` acceptance is unchanged
+  either way: it still requires exactly one canonical coverage checker declared last, and it never
+  inspects producers. `flow optimal` no longer renders over either cause.
+- **Every settings-derived RUNTIME claim in the autonomy render is now host-conditional.** Not only
+  the bridge-tier exclusion: `allowWrite`, `allowedDomains` and foreign exclusions are all claims
+  about what a HOST does with a settings key, and whether a host honours them is runtime-unknowable
+  — this kit's own mode doc has recorded that from live observation, while three separate surfaces
+  went on promising the bridge wrappers run outside the sandbox. The classification is unchanged;
+  only the unconditional promise is gone. The `allowWrite` degrade now resolves its entries
+  (tilde, relative and absolute, on segment-aware containment shared with the advisor's
+  worktrees-dir lane) and NAMES the external survivors instead of counting them — an entry pointing
+  inside the repo or `$TMPDIR` is no longer reported as an `fs_outside_repo` weakening at all, and
+  an unreadable value is its own UNVERIFIABLE class that asserts no weakening.
+- **The bundled `codex-cli-bridge` mirror moves to 3.4.1** — a bundled-only bump carrying the fixed
+  `codex exec resume` argv, so the changed bridge bytes in this tarball ship under a version of
+  their own instead of silently.
+
+Upgrading an existing project: nothing breaks and nothing is rewritten for you. If your declaration
+already carries the dead pair, `status`/`upgrade` now say so and hand you the remedy — the reorder
+case deliberately stays hand-applied.
+
+## 5.3.0 — a check must speak where it is built to speak: the two silent checks (AD-088)
+
+**Two shipped checks stayed SILENT at exactly the point they exist to speak** — one a GATE that
+refuses and blocks a commit, one a WARNING that never changes an exit status. They were one
+sentence, so they ship together.
+
+- **The `flow-check` gate stops demanding the receipt its own run will write.** A red final on the
+  current base was cleared only through a LATER completed retry — but `run-gates` appends the final
+  receipt only after every gate has run, so the in-matrix `flow-check` could never see the receipt
+  its OWN run would write, and each `--final` on an unchanged base minted red N+1. No number of
+  rerun-causes converged; the only exit was a hook bypass. The `#65` rung is now consumer-aware, the
+  same lane split the flow→final comparison already applies one arm away: on the `gate` lane a
+  current-base red is
+  ALSO answered by a provable IN-PROGRESS retry — an authoritative `rerun-cause` naming its attempt
+  and binding the current fingerprint, a `final-start` at that fingerprint ordered strictly after
+  that red whose attempt has no completed final, and that fingerprint correlating to exactly ONE
+  base, the current one. Inside a real final run the conjunction holds by construction; a standalone
+  check on a quiet tree still refuses.
+- **`commit-guard` is unchanged.** It keeps the strict completed-retry demand, so the commit
+  boundary still sees a real receipt. The rung's own `consumer` defaults to that strict lane, the
+  relaxation is opt-in by EXACT match, and a tree whose fingerprint is unresolvable or ambiguously
+  base-correlated never relaxes.
+- **The interrupted-run residual is stated, not papered over.** An interrupted final run leaves the
+  same record shape with no live run behind it, so a standalone `flow-check --check` reads PASS in
+  that window. It authorizes nothing — the commit boundary refuses that shape twice over,
+  independently — and the rung's own source comment says so, pinned end to end by a fixture that
+  asserts all three conditions at once.
+- **The bundled `codex-cli-bridge` mirror moves to 3.4.0** — its nested-sandbox scan now runs on
+  every completed run, not only a failed one, so a delegated run that SURVIVES the failure and exits
+  0 is no longer silent about it. On a successful run, it warns when the scanner recognises the
+  expected per-item shape — both tokens inside the `aggregated_output` of ONE `command_execution`
+  with a proven failure. The heuristic is biased toward under-firing on ambiguous or schema-drifted
+  input: field reordering stops the match, and only the first matching item on a line is judged.
+  The exit status deliberately stays 0 there — a heuristic scan must never gain the power to refuse
+  real work.
+
+Evidence: an end-to-end fixture drives a caused red at the current tree through ONE real
+`run-gates --final` to a GREEN newest-authoritative final and a passing `commit-guard --check` — the
+test that would have failed before this release.
+
 ## 5.2.0 — the flow machinery ships whole: recorded subset budgets, flow-bound finals, the round arms, and the dogfooded pipeline (AD-086)
 
 **Everything the flow series built after 5.1.0 lands as one wave** — the record vocabulary, the

package/README.md

@@ -239,7 +239,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit sandbox-masks` | any time | **cosmetic exclude lane for sandbox device masks** — an OS sandbox (Claude Code) injects character-device masks into the work tree as untracked `git status` noise; the review domain already ignores them **by construction** (never-committable untracked classes — char/block devices, FIFOs, sockets — are excluded from the fingerprint, the assembled review payload, and the clean checks). This mode hides them from `git status` too: flagless = read-only probe (derives the CURRENT mask set from the unfiltered walk + lstat — never a frozen list — and revalidates fenced entries, loudly flagging one that became a real path); `--apply` = consent-gated FULL-BLOCK replace of its own fenced block in `git rev-parse --git-path info/exclude` (stale masks drop by construction; `--clear` always means REMOVE the block — it takes precedence over the derivation). Writes ONLY its fence — never `.gitignore`, never global config; symlinked/non-regular exclude paths and malformed fences fail closed. Watch note: a real file at an excluded path is silently skipped by bulk staging (`git add -A`/`git add .`) — delete the stale line first; the probe flags exactly this case. |
 | `/agent-workflow-kit grounding` | any time | **grounded-review facts assembler** — mechanizes populating `agy-review --facts @f`: slices your entry-point's **Hard Constraints** section verbatim (exactly one match, else a loud stop) and/or a plan's decision-bearing sections (`## Approach` + `## Verification` required, `## Decisions (locked)` when present; duplicates stop), under the same byte budget the agy wrapper enforces (minus `--reserve-bytes` for the artifact share), with a loud tail-trim on overflow. `--autonomy` (AD-044) appends the COMPUTED effective autonomy policy from the git-top `docs/ai/autonomy.json` (every red-line + per-activity level, stated source line; absent file → the computed defaults ARE the policy, exit 0; a malformed policy fails CLOSED, exit 1). Prints to stdout; `--out` writes **one scratch file only** — system-temp outside the repo ($TMPDIR / /tmp, rewritable) or a **fresh** gitignored in-repo path (create-only, exclusive write; an existing in-repo file, even gitignored, is refused — the `.env` clobber class); tracked, not-ignored-in-repo, other outside-repo, and symlink/non-regular destinations are all refused. Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit core-evidence` | any time | **the ONE loop-evidence writer** (strip-the-kit) — every core evidence record lands in a single append-only JSONL store inside the git dir (never committable; versioned schema, latest-per-key supersession, byte-identical duplicates refused, malformed lines fail every reader closed). `red-proof "<file>#<pattern>"` declares an observed-red **BEFORE a bugfix** (N/N red runs + content custody + base + the pre-fix fingerprint; green/mixed/timeout are DISTINGUISHED refusals — nothing written); `degrade --backend --reason` is the ONLY escape for an unavailable review backend (per-tree, never all backends); `summary` renders the whole loop state statelessly (gate result · per-backend verdicts · red-proofs · degrades) — no ledger, no rounds, nothing remembered. Honest residual: records are forgeable — self-discipline, not a security boundary. Never commits, never runs a subscription CLI. |
-| `/agent-workflow-kit coverage-check` | any time | **the final-run checker** (D3(c)+(d)) — **certifies coverage ONLY inside the `--final` run that owns the lcov** (ownership is exclusive by CONVENTION over the fixed path, not enforced — a concurrent writer to it is a stated residual, queued as LCOV-EXCLUSIVE-OWNERSHIP): an artifact on disk proves nothing about the tree it came from, so a standalone run prints its findings and states `attested=no` / `NO VERDICT` rather than a PASS (an lcov that predates an edit would otherwise certify a line the suite never executed). The runner passes a nonce whose one-way commitment over `{nonce, fingerprint, base}` is the `final-start.attempt` it recorded; a context describing another tree, or matching no recorded attempt, is a REFUSAL, never a verdict. Findings are unchanged — reads the lcov the declared `unit-tests` gate produced at the FIXED git-dir path and fails on any uncovered CHANGED executable Node line (listed `file:line`; a changed file absent from the map is a file-level red; out-of-domain/unsupported files are LISTED — the claim narrowed honestly); VERIFIES every current-base red-proof declaration (bound test exists · custody hash unchanged · green N/N now · pre-fix fingerprint differs); prints `lcov-sha256=<hex|none>` of the exact bytes it consumed — the sha the `--final` receipt binds and re-hashes. An absent lcov is a LOUD `skipped-no-lcov`; a symlinked path is a refusal. `--check` is the gate exit code — declare it as the LAST gate (`run-gates --final` refuses otherwise). Read-only. |
+| `/agent-workflow-kit coverage-check` | any time | **the final-run checker** (D3(c)+(d)) — **certifies coverage ONLY inside the `--final` run that owns the lcov** (ownership is exclusive by CONVENTION over the fixed path, not enforced — a concurrent writer to it is a stated residual, queued as LCOV-EXCLUSIVE-OWNERSHIP): an artifact on disk proves nothing about the tree it came from, so a standalone run prints its findings and states `attested=no` / `NO VERDICT` rather than a PASS (an lcov that predates an edit would otherwise certify a line the suite never executed). `attested=` claims a verdict was ISSUED, pass or fail — a run over uncovered lines still reads `attested=yes` and still exits 1, and a run whose coverage arm never executed (no lcov) reads `attested=no` even inside `--final`, because nothing was read and nothing is certified. The runner passes a nonce whose one-way commitment over `{nonce, fingerprint, base}` is the `final-start.attempt` it recorded; a context describing another tree, or matching no recorded attempt, is a REFUSAL, never a verdict. Findings are unchanged — reads the lcov the declared `unit-tests` gate produced at the FIXED git-dir path and fails on any uncovered CHANGED executable Node line (listed `file:line`; a changed file absent from the map is a file-level red; out-of-domain/unsupported files are LISTED — the claim narrowed honestly); VERIFIES every current-base red-proof declaration (bound test exists · custody hash unchanged · green N/N now · pre-fix fingerprint differs); prints `lcov-sha256=<hex|none>` of the exact bytes it consumed — the sha the `--final` receipt binds and re-hashes. An absent lcov is a LOUD `skipped-no-lcov`; a symlinked path is a refusal. `--check` is the gate exit code — declare it as the LAST gate (`run-gates --final` refuses otherwise). Read-only. |
 | `/agent-workflow-kit commit-guard` | any time | **the read-only pre-commit guard** (D10) — makes the commit capture the whole current working tree, so «verified» and «about to be committed» are the same bytes (the receipt itself has a stated residual — see the mode doc). FIRST it refuses an **INDEX that lags the verified working tree** (the gates and the fingerprint describe the WORKING tree while `git commit` takes the INDEX alone, and the fingerprint cannot tell them apart — so a lagging index used to ship a strict subset of what was verified): unstaged tracked paths or reviewable untracked-not-ignored paths, named up to a bounded cap with the remainder stated, a dirty tracked **submodule** named separately with its own recovery, and fail-closed on an undecidable probe. This deliberately blocks a partial commit. Then it binds the LATEST completed `run-gates --final` receipt to the EXACT current tree: refuses on a missing/red/stale receipt, fingerprint drift under the run, a dangling later attempt, declaration content drift, evidence-hash or lcov drift, or unsatisfied review obligations (the same review-state decision, recomputed over a sanitized env — forged out-of-repo stores never satisfy). Re-runs NO gate or test. Wire it into `.git/hooks/pre-commit` (the installer writes the RESOLVED invocation). `git commit --no-verify` stays the stated residual. |
 | `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, or the agents hidden-mode reconcile follow-up) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit doc-parity` | any time | **read-only doc-parity lint** (AD-049) — kills the doc-drift class where a mode-contract doc silently lags a code constant (a `--check` doc still reading `300` after the diff cap moved to `400`): a **closed, exported registry** binds each live constant (review caps, schema versions, the ledger's own class/scope vocabulary, and the autonomy-doctor EXIT/status/trusted-dir contract) to the exact token its `references/modes/*.md` contract must carry, and asserts the CURRENT value renders into every bound file — a drifted doc, an unreadable file, or an absent token **fails closed**. The values are sourced from the live imports (never re-typed), so the lint can't itself go stale; adding a binding is adding a checked entry (closed-world, edit-safe). `--check` is a gate exit code for `docs/ai/gates.json`. Never writes, never commits, never runs a subscription CLI. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '5.2.0'
+  version: '5.4.0'
 ---
 
 # agent-workflow-kit

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.3.0'
+  version: '3.4.1'
 ---
 
 # codex-cli-bridge
@@ -110,8 +110,16 @@ receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
 
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's
-**final message** (`-o`; the JSON event stream + reasoning go to a discarded trace), so output is
-clean; a successful **non-resume** `codex-exec` also records the session id to a sidecar
+**final message** (`-o`), so output is clean; the JSON event stream + reasoning go to a run trace
+that is **read before it is discarded**. Fresh and resumed runs share **ONE** capture posture
+(`-o` + `--json`, everything redirected into the trace; `--color never` rides the fresh lane only —
+`codex exec resume` does not accept it), so both modes have the
+same evidence surface — and the wrapper scans that surface on **every completed run**: a run that
+SURVIVES a nested-sandbox failure exits 0 with an ungrounded answer, so on `rc == 0` it prints the
+answer first and then warns loudly on stderr when one `command_execution` item with a **proven**
+failure carries both a sandbox-mechanism and a permission/read-only token in its `aggregated_output`.
+The exit status stays 0 there (warning, not gate) — read the stderr line. A successful **non-resume**
+`codex-exec` also records the session id to a sidecar
 (`${CODEX_SESSION_FILE:-./.codex-last-session}`) so `--resume-last` can find it. Extra `codex` flags
 go after a literal `--`; the wrapper rejects any that would defeat the policy or the pinned model (see
 [§ Environment knobs](#environment-knobs) and the flag tiers in

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -86,6 +86,18 @@ Notes:
   INFORMATIONAL only: it is never persisted in a receipt or session sidecar
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
+  every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on
+  EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure
+  exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose
+  whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires
+  ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only
+  failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN
+  (a nonzero exit_code, or the serialized status "failed"); a null exit_code is never failure by
+  itself, tokens split across two items never fire, and a successful command's output never fires.
+  The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit
+  status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY
+  polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit
+  status alone can still bank an ungrounded answer — the stderr warning is the signal
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
@@ -412,9 +424,9 @@ fi
 
 # --- Resume detection (must be the FIRST argument) ---------------------------
 # A dedicated entrypoint for iterating on a session without re-sending context.
-# `codex exec resume` RESETS posture and rejects the -s/--add-dir/-C posture flags
-# (it DOES accept -o/--json on 0.142.3, but we capture stdout directly), so we
-# restate the FULL policy via -c.
+# `codex exec resume` RESETS posture and rejects the -s/--add-dir/-C posture flags,
+# so we restate the FULL policy via -c. It DOES accept -o/--json/--color, and it now
+# carries the same capture posture as a fresh run (one evidence surface, both modes).
 resume_mode=""
 resume_id=""
 case "${1:-}" in
@@ -607,9 +619,12 @@ chmod 755 "$shim_dir/git"
 
 # --- Build the codex invocation + the prompt ---------------------------------
 if [[ -n "$resume_mode" ]]; then
-  # Resume RESETS posture and rejects the -s/--add-dir/-C posture flags, so restate
-  # the entire policy via -c. We deliberately pass no -o/--json (resume DOES accept
-  # them) — codex prints the final message to stdout, which we capture into $out.
+  # Resume RESETS posture and rejects the -s/--add-dir/-C posture flags, so restate the entire
+  # policy via -c. Its accepted flag set is NARROWER than `codex exec`'s and is probed, never
+  # assumed: `codex exec resume --help` (codex-cli 0.147.0) accepts -o and --json but NOT --color,
+  # so the capture posture is shared with a fresh run MINUS that flag. Shipping --color here once
+  # broke every resume invocation with a pre-spend exit 2 — the fake CLI in the suite accepts any
+  # argv, so only the real one can answer this question. See RESUME_ACCEPTED_FLAGS in the test.
   codex_cmd=(codex exec resume "$resume_id"
     --ignore-user-config
     -m "$CODEX_MODEL"
@@ -620,6 +635,8 @@ if [[ -n "$resume_mode" ]]; then
     -c hide_agent_reasoning=true
     -c model_reasoning_summary=none
     "${tier_flags[@]+"${tier_flags[@]}"}"
+    -o "$out"
+    --json
     -)
   full_prompt="$RESUME_REMINDER"$'\n\n'"$task"
 else
@@ -672,25 +689,136 @@ aw_session_label="fresh"
 [[ -n "$resume_mode" ]] && aw_session_label="resume:$resume_id"
 echo "exec posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} sandbox=workspace-write session=$aw_session_label timeout=$aw_timeout_banner" >&2
 
-# Normal mode: -o writes $out, the JSON stream + logs go to $trace. Resume mode: the
-# final message is codex's stdout → $out, logs → $trace. Either way the final lands
-# in $out and diagnostics in $trace, so the post-processing below is shared.
-set +e
-if [[ -n "$resume_mode" ]]; then
-  if [[ -n "$timeout_bin" ]]; then
-    printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$out" 2>"$trace"
+# --- Nested-sandbox evidence scan: ONE entry point, TWO policies ---------------
+# The class: codex ships its OWN OS sandbox (bwrap); run nested inside a harness sandbox the FS is
+# read-only and codex's sandbox setup fails. The scan runs on EVERY completed run, not only a failed
+# one — when the backend SURVIVES the failure (degrades to "I cannot check" and exits 0) a paid run
+# is spent on an ungrounded answer, and nothing said so.
+#
+# The two arms have DIFFERENT rules, deliberately:
+#   FAILED run (rc != 0) — the loose whole-trace COMBINATION rule, unchanged: a sandbox MECHANISM
+#   token AND a permission/read-only FAILURE token anywhere in the trace. The run already failed and
+#   the operator is already reading the tail, so an extra hint costs nothing. grep is line-oriented,
+#   so a plain alternation stays within a line — hence two `-q` passes rather than one pattern.
+#   SUCCESSFUL run (rc == 0) — per-item evidence ONLY: both tokens inside the aggregated_output of
+#   ONE command_execution item whose FAILURE is proven. Here a false positive would libel a good
+#   answer, so nothing loose is allowed near it.
+# The successful-run scan is LINE-ORIENTED and TOLERANT: after the unified 2>&1 the trace
+# legitimately mixes plain log lines with JSONL, so every line is judged alone, a line that is not a
+# well-formed command_execution item is simply not evidence (never a parse error, never a stop), and
+# no line can mask a later one.
+AW_NS_MECHANISM='bwrap|landlock|user namespace|pivot_root|unshare|seccomp'
+AW_NS_FAILURE='read-only file system|erofs|operation not permitted|permission denied|eperm'
+
+# BOTH token classes present in one piece of text. Fed by here-string rather than `printf | grep`:
+# with `pipefail` on, a producer that takes EPIPE when `grep -q` exits early on a match would make
+# the pipeline non-zero and silently DROP a real signature — an under-fire invisible by
+# construction. Not reproduced on this host, folded as portability hardening: with no explicit
+# pipeline there is no producer left to fail.
+aw_ns_both_tokens() {
+  grep -qiE "$AW_NS_MECHANISM" <<<"$1" || return 1
+  grep -qiE "$AW_NS_FAILURE" <<<"$1" || return 1
+  return 0
+}
+
+# Valid JSON string CONTENT — no UNESCAPED quote. This is what proves a delimiter slice stayed
+# inside ONE string instead of crossing an object boundary: without it, a decoy object carrying the
+# anchor lets the walk leave its own string and land in another item's fields.
+# The predicate is the parity rule — a quote is escaped iff an ODD number of backslashes precedes
+# it — expressed as an ERE and evaluated by grep: `(^|[^\])` then an EVEN run `(\\)*` then the
+# quote. It is measured, not assumed: the obvious bash spelling (delete the `\\` and `\"` pairs,
+# then look for a survivor) is the SAME predicate but bash's `${var//…}` is quadratic, and it hung
+# the wrapper outright on a 200KB aggregated_output — a real tool call's output reaches that size.
+aw_ns_is_string_content() {
+  if grep -qE '(^|[^\\])(\\\\)*"' <<<"$1"; then return 1; fi
+  return 0
+}
+
+# One trace line → 0 only when THAT line is a command_execution item with a PROVEN failure whose
+# aggregated_output carries both token classes. The wrapper stays dependency-free, so this is not a
+# JSON parse — it is ONE anchored walk over the CLI's observed serialization in which every SKIPPED
+# gap is PROVEN to be a single JSON string's content (aw_ns_is_string_content). Both halves are
+# load-bearing: testing the fields as independent substrings lets a decoy object supply the anchor
+# while the failure fields belong to another item, and skipping a gap without validating it lets the
+# walk leave its own string and land in that other item anyway.
+# The observed shape (codex-cli 0.147.0, live-probed):
+#   {"id":…,"type":"command_execution","command":"…","aggregated_output":"…","exit_code":2,"status":"failed"}
+# Failure proofs: A = a nonzero exit_code, B = the status "failed" immediately after it. A null
+# exit_code is never failure by itself (an in-flight item carries "exit_code":null,"status":"in_progress").
+# Two stated consequences, both deliberate:
+#   - a future CLI that REORDERS these fields makes the scan stop firing rather than misfire.
+#     Under-firing is the right direction here: over-firing would libel a correct answer.
+#   - only the FIRST matching item on a line is judged; a second item's evidence is missed.
+# A hand-crafted trace line is outside the threat model (the same boundary the wrapper declares for
+# a hostile parent environment): the trace's only non-CLI content is plain stderr, which does not
+# start with `{`, and a tool call's own output is JSON-escaped into a string and cannot inject
+# structure. Anything not matching the walk is "not evidence" — never an error, never a stop.
+# Every slice is taken by a SHORT-pattern `#*` cut plus length arithmetic. That is not a style
+# choice: `${var%%<long>*}` and a prefix removal whose PATTERN is a huge variable are both
+# quadratic in bash, and either one hangs the wrapper outright on a 200KB aggregated_output
+# (measured, not assumed — a real tool call's output reaches that size).
+aw_ns_item_evidence() {
+  local line="$1" d1='","aggregated_output":"' d2='","exit_code":' rest tail cmd agg code after
+  case "$line" in '{'*) ;; *) return 1 ;; esac
+  rest="${line#*'"type":"command_execution","command":"'}"
+  if [[ "$rest" == "$line" ]]; then return 1; fi
+  tail="${rest#*"$d1"}"
+  if [[ "$tail" == "$rest" ]]; then return 1; fi
+  cmd="${rest:0:$(( ${#rest} - ${#tail} - ${#d1} ))}"
+  aw_ns_is_string_content "$cmd" || return 1
+  after="${tail#*"$d2"}"
+  if [[ "$after" == "$tail" ]]; then return 1; fi
+  agg="${tail:0:$(( ${#tail} - ${#after} - ${#d2} ))}"
+  aw_ns_is_string_content "$agg" || return 1
+  code="${after%%,*}"
+  if [[ "$code" =~ ^-?[0-9]+$ && "$code" != "0" ]]; then
+    :
+  elif [[ "${after#"$code",}" == '"status":"failed"'* ]]; then
+    :
   else
-    printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$out" 2>"$trace"
+    return 1
   fi
-  rc=$?
-else
-  if [[ -n "$timeout_bin" ]]; then
-    printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$trace" 2>&1
-  else
-    printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$trace" 2>&1
+  aw_ns_both_tokens "$agg"
+}
+
+aw_scan_nested_sandbox() {   # $1 = rc, $2 = trace path
+  [[ -r "$2" ]] || return 0
+  if [[ "$1" -ne 0 ]]; then
+    if grep -qiE "$AW_NS_MECHANISM" "$2" 2>/dev/null && grep -qiE "$AW_NS_FAILURE" "$2" 2>/dev/null; then
+      echo "hint: this looks like a NESTED-SANDBOX failure — codex-exec ships its own OS sandbox (bwrap)," >&2
+      echo "      which cannot run nested inside a harness sandbox (the FS is read-only). Route codex-exec" >&2
+      echo "      OUTSIDE the harness sandbox: add it to the harness sandbox excludedCommands, or dispatch" >&2
+      echo "      this one run via a per-run consented bypass. Do NOT blanket-disable the sandbox." >&2
+    fi
+    return 0
   fi
-  rc=$?
+  local line
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if aw_ns_item_evidence "$line"; then
+      echo "warning: NESTED-SANDBOX — this run COMPLETED, but a tool call inside it FAILED with a sandbox-setup" >&2
+      echo "         signature. codex-exec ships its own OS sandbox (bwrap), which cannot run nested inside a" >&2
+      echo "         harness sandbox (the FS turns read-only), so the backend most likely could not read what" >&2
+      echo "         it was asked to check: the answer above may be UNGROUNDED — treat it as such rather than" >&2
+      echo "         banking it. Re-dispatch OUTSIDE the harness sandbox: add codex-exec to the harness" >&2
+      echo "         sandbox excludedCommands, or use a per-run consented bypass. Do NOT blanket-disable the" >&2
+      echo "         sandbox. The exit status stays 0 on purpose — this is a warning, never a gate." >&2
+      return 0
+    fi
+  done <"$2"
+  return 0
+}
+
+# ONE capture posture for BOTH modes: -o writes the final message to $out, the JSON
+# event stream and every log line go to $trace (stderr merged in). The final always
+# lands in $out and the diagnostics always in $trace, so the post-processing below —
+# including the evidence scan — is genuinely shared instead of mode-dependent.
+set +e
+if [[ -n "$timeout_bin" ]]; then
+  printf '%s' "$full_prompt" | "${run_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$trace" 2>&1
+else
+  printf '%s' "$full_prompt" | "${run_env[@]}" "${codex_cmd[@]}" >"$trace" 2>&1
 fi
+rc=$?
 set -e
 
 if [[ $rc -eq 124 || $rc -eq 137 ]]; then
@@ -701,20 +829,7 @@ fi
 if [[ $rc -ne 0 ]]; then
   echo "error: codex exec failed (exit $rc). Last lines of the run trace:" >&2
   tail -n 40 "$trace" >&2
-  # Nested-sandbox detection: codex ships its OWN OS sandbox (bwrap); run nested inside a harness
-  # sandbox the FS is read-only and codex's own sandbox setup fails. Fire the STATED recovery hint
-  # only on a COMBINATION — a sandbox MECHANISM token AND a permission/read-only FAILURE token in the
-  # trace — so a lone 'bwrap' banner, or a lone 'permission denied' from unrelated code, is NOT enough
-  # (never a preemptive blanket). grep is line-oriented, so a plain alternation stays within a line —
-  # the old `[^\n]*` between the two halves was wrong twice over (it excluded the letter 'n', and grep
-  # never spans lines anyway), so the split into two `-q` passes both fixes it and states the intent.
-  if grep -qiE 'bwrap|landlock|user namespace|pivot_root|unshare|seccomp' "$trace" 2>/dev/null \
-     && grep -qiE 'read-only file system|erofs|operation not permitted|permission denied|eperm' "$trace" 2>/dev/null; then
-    echo "hint: this looks like a NESTED-SANDBOX failure — codex-exec ships its own OS sandbox (bwrap)," >&2
-    echo "      which cannot run nested inside a harness sandbox (the FS is read-only). Route codex-exec" >&2
-    echo "      OUTSIDE the harness sandbox: add it to the harness sandbox excludedCommands, or dispatch" >&2
-    echo "      this one run via a per-run consented bypass. Do NOT blanket-disable the sandbox." >&2
-  fi
+  aw_scan_nested_sandbox "$rc" "$trace"
   exit $rc
 fi
 
@@ -739,3 +854,7 @@ else
   echo "warning: codex produced no final-message file — printing the run-trace tail instead." >&2
   tail -n 40 "$trace"
 fi
+
+# The answer is printed FIRST, then the evidence speaks: a run that COMPLETED can still have been
+# ungrounded, and saying so after the answer keeps stdout byte-identical for every caller.
+aw_scan_nested_sandbox "$rc" "$trace"