@sabaiway/agent-workflow-kit 5.8.0 → 5.10.0

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.7 Flash (High)" },
   "roles": {
@@ -33,6 +33,7 @@
         ],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         "notes": [
+          "transport: every review dispatch drives the CLI in --output-format json (plus --disable-slash-commands) and the returned envelope is parsed in node (bin/agy-envelope.mjs) — the operator-facing invocations and flags above do NOT change, and on a ZERO exit the wrapper still PRINTS the review text, never JSON. A missing or unreadable envelope on a zero exit is a loud failure with NO receipt, never a downgraded verdict and never a fallback to raw-stdout parsing; a non-zero CLI exit keeps its own code and message, and publishes the captured stdout unchanged from the SINGLE dispatch or the FINAL fed turn (which may therefore be a JSON or partial payload — the envelope is parsed only on a zero exit); an INTERMEDIATE feed turn is the exception, its output stays private (Invariant E) and its failure prints only a named error. Enforced by a PRE-SPEND capability probe, not a version floor: agy --help must advertise --output-format and --disable-slash-commands, node must be >= 22, and bin/agy-envelope.mjs must be present — otherwise the review refuses before any run is spent and names the missing capability",
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
           "the review posture banner appends a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
@@ -229,7 +230,7 @@
       "max": 100000000,
       "default": "240000",
       "appliesTo": ["agy-review"],
-      "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every envelope, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
+      "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every feed-turn framing block, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
   "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -6,13 +6,25 @@ were captured from **v1.1.13**; if the binary disagrees, the binary wins. The wr
 
 ## Headless behaviour
 
-Use `-p`, `--print`, or `--prompt` to run one non-interactive prompt and print the text response. The
-wrapper always uses headless `-p`. v1.1.13 adds `--output-format text|json|stream-json` and
-`--json-schema` (structured output); **text stays the wrapper default** — raw passthrough
-(`agy-run "…" -- --output-format json`) is possible but rides with NO first-class parsing or schema
-validation (first-class adoption is a separate backlog item). When the caller needs structure
-through the wrapper, ask for Markdown, bullets, tables, or fenced blocks, then validate the text
-yourself.
+Use `-p`, `--print`, or `--prompt` to run one non-interactive prompt and print the text response.
+Both wrappers run headless `-p`, and they differ in **transport**:
+
+- **`agy-run` stays text.** It prints the CLI's text response unchanged. JSON can ride passthrough
+  (`agy-run "…" -- --output-format json`) with NO parsing or validation — if you need structure here,
+  ask for Markdown, bullets, tables or fenced blocks and validate the text yourself.
+- **`agy-review` drives every dispatch in `--output-format json`** and reads the returned envelope
+  (`bin/agy-envelope.mjs`), so the answer TEXT and the conversation id come from **named fields**
+  instead of a guess at raw stdout. The **review contract stays prose-shaped**: the verdict is still
+  parsed out of that text's `### Verdict` section, exactly as before. It also passes
+  `--disable-slash-commands`, so a delivered change-set line that begins with a slash command stays
+  BODY rather than being expanded by the CLI. **On a zero exit** what it PRINTS is the review text,
+  never JSON — the envelope is wire format, not output format. When the **single dispatch or the
+  FINAL fed turn** exits non-zero the captured stdout is published as-is (the CLI's own failure wins,
+  and the envelope is parsed only on a zero exit), so a failing run may print a JSON or partial
+  payload. An **intermediate** feed turn is the exception: its output stays private and its failure
+  prints only a named error.
+
+`--json-schema` is **not** adopted and was measured and rejected; see the flags table below.
 
 ## Wrapper contract
 
@@ -70,6 +82,15 @@ agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   #
 passthrough (it owns the posture). The service can still **stall on large/substantive prompts**
 (Issue-001), so keep reviews **focused**; the hard timeout is the guard.
 
+**Host requirements, enforced BEFORE any run is spent.** Because the review reads agy's JSON
+envelope in node, `agy-review` needs **Node ≥ 22** on `PATH`; and because it passes flags the CLI
+must honour, it probes `agy --help` for **`--output-format`** and **`--disable-slash-commands`**
+first. A missing flag, an unreadable `agy --help`, a missing or too-old node, or a missing
+`bin/agy-envelope.mjs` each refuse with a named cause and spend nothing. This is a **capability
+probe, not a version floor** — the release that introduced `--output-format` is not measurable from
+one installed build, so a guessed floor would refuse working installs. A failed probe is never read
+as "capability present".
+
 ## Models
 
 Pass the **exact display string** from `agy models`, or set `AGY_MODEL`.
@@ -112,19 +133,31 @@ AGY_MODEL="Claude Sonnet 4.6 (Thinking)" AGY_TIMEOUT=10m agy-run @review-prompt.
 | `--dangerously-skip-permissions` | auto-approve all tool permissions | avoid by default; use only with explicit user approval |
 | `--sandbox` | run with terminal restrictions enabled | prefer when delegating a prompt that might trigger tool/terminal work |
 | `--log-file <path>` | override the CLI log-file path | keep logs secret-free and out of committed artifacts |
-| `--output-format <fmt>` | print-mode output: `text` (default), `json`, `stream-json` | NEW in 1.1.x; not wrapper-adopted (backlog) |
-| `--json-schema <s\|path>` | enforce structured output (stream-json final result) | NEW in 1.1.x; not wrapper-adopted (backlog) |
+| `--output-format <fmt>` | print-mode output: `text` (default), `json`, `stream-json` | **ADOPTED by `agy-review`** — every dispatch runs `json` and the envelope is parsed (`bin/agy-envelope.mjs`). `agy-run` stays `text`; JSON there rides passthrough, unparsed. `stream-json` is adopted by neither (see below) |
+| `--json-schema <s\|path>` | enforce structured output (stream-json final result) | **REJECTED, and the reason is a measurement.** It is not a constrained decode: the model answers in prose and the CLI then spends a **second turn** asking it to restate that answer in schema shape (`num_turns: 2`). Matched control — same prompt, same model, schema off vs on: **16,585 vs 33,446 total tokens**. So a schema does not remove prose parsing; it replaces a free, deterministic, anchored regex with a billed non-deterministic re-read (the structured `reason` came back reworded, not quoted) and adds a failure mode — a run dying between the two turns has prose but no `structured_output` |
 | `--effort <low\|medium\|high>` | reasoning effort for the session | NEW in 1.1.x; the display strings already carry an effort tier — the wrapper keeps model selection in ONE place (`AGY_MODEL`) |
 | `--mode <m>` | agent execution mode (`accept-edits`, `plan`) | NEW in 1.1.x; not used by the wrapper |
 | `--agent` / `--project <id>` / `--new-project` | agent + project selection for the session | NEW in 1.1.x; not used by the wrapper |
-| `--disable-slash-commands` | disable slash command/skill expansion in print mode | NEW in 1.1.x; not used by the wrapper |
+| `--disable-slash-commands` | disable slash command/skill expansion in print mode | **ADOPTED by `agy-review`** on every dispatch — a delivered change-set line beginning with a slash command stays BODY instead of being expanded, so the model reviews the delivered bytes. Not used by `agy-run` |
 
 ## Subcommands (v1.1.13)
 
 `agent` / `agents`, `changelog`, `help`, `install`, `models`, `plugin` / `plugins`, `update`.
 
-**Still not available in v1.1.13:** any `agy inspect`. Wrapper output stays plain text (the
-`--output-format` lane is not adopted here — see the backlog row).
+**Still not available in v1.1.13:** any `agy inspect`. On output format the two wrappers differ:
+`agy-run` is a **text-by-default passthrough** — it hands back the CLI's stdout unchanged, so
+`agy-run "…" -- --output-format json` really does print JSON; `agy-review` prints the review text it
+read out of the JSON envelope on a **successful** run. (When its single dispatch or FINAL fed turn
+exits non-zero, `agy-review` publishes that captured stdout unchanged — never an intermediate feed
+turn's; see the transport bullet above.)
+
+**`--output-format stream-json` is deliberately NOT adopted.** Its two measured gains are queued as
+follow-ups rather than built: its `init` event names the **resolved** model (neither the plain `json`
+envelope nor the stream's own `result` event carries one), which would let the receipt record what
+actually ran; and its live `step_update` events would make a stalled run visible (Issue-001). The
+seam built here makes the FLAG easy to switch, but neither gain is free: `bin/agy-envelope.mjs`
+parses ONE JSON object and refuses anything else, so NDJSON needs a stream-aware reader, and live
+progress needs an event relay rather than a captured file.
 
 ## Project-context flags
 

package/bridges/antigravity-cli-bridge/references/review-prompt.md

@@ -89,6 +89,12 @@ itself can never reveal the very text it asks for, and the wrapper needs no seco
   construction) or `fed` (proven by echo). The kit's review-state gate requires the field present and
   well-formed, never a particular value, so a receipt minted before this lane existed no longer
   attests. The recovery is stated: re-run the review.
+- **Later turns are routed by a NAMED field.** Turn 1's `--output-format json` envelope carries
+  `conversation_id`; the wrapper validates it against the UUID grammar and dispatches every later
+  turn with `--conversation <id>`. There is no `--continue` fallback in this lane: an id that is
+  absent, wrong-typed or malformed stops the run **before turn 2 is spent**, with NO receipt. (It was
+  formerly scraped from `agy`'s own run log — a format that is `agy`'s to change, so the pin could
+  rot silently; a named field fails loudly instead.)
 
 ### Honest residuals (recorded, not engineered away)
 
@@ -99,9 +105,6 @@ itself can never reveal the very text it asks for, and the wrapper needs no seco
 - A change set whose parts carry **no unique interior line** in the 24..200-byte window (a single
   huge minified line, for instance) cannot be proven delivered, so the wrapper **refuses** rather
   than reviewing unprovably. Split the review, or exclude the blob.
-- The conversation id is parsed from `agy`'s own run log, whose format is `agy`'s to change. An
-  unparseable log **degrades loudly** to `--continue`; correctness still rests on the echo proof,
-  which fails closed when the wrong conversation answers.
 
 ## agy's own permission ask — surfaced, never applied
 

package/bridges/antigravity-cli-bridge/setup/README.md

@@ -9,11 +9,18 @@ works in any project.
 ```bash
 curl -fsSL https://antigravity.google/cli/install.sh | bash
 export PATH="$HOME/.local/bin:$PATH"   # add to ~/.bashrc / ~/.zshrc to persist
-agy --version                          # expect 1.1.13 or newer
+agy --version                          # captured here from 1.1.13 — see the capability note below
 ```
 
 - The binary is **`agy`** (not `antigravity`); it installs to `~/.local/bin/agy`.
 - Keep `$HOME/.local/bin` on `PATH` (the wrapper also prepends it defensively).
+- **There is no version floor.** The docs in this skill were captured from **v1.1.13**, but the
+  release that introduced each flag is not measurable from one installed build, so a guessed floor
+  would refuse working installs. What actually gates a review is a **capability probe** —
+  `agy-review` reads `agy --help` and refuses BEFORE spending a run unless the install advertises
+  both **`--output-format`** and **`--disable-slash-commands`**, plus **Node ≥ 22** on `PATH` (the
+  review parses agy's JSON envelope in node) and the skill's own `bin/agy-envelope.mjs`. Each
+  refusal names the missing capability and the recovery. `agy-run` needs none of these.
 
 ## 2. Sign in once (subscription only)
 
@@ -59,13 +66,19 @@ agy --version
 echo "say OK" | agy-run -
 ```
 
-Expected: the version prints (`1.1.13` or newer), then a short reply containing `OK`. If `agy-run`
-reports `'agy' not found`, fix your `PATH` (step 1). If it asks you to sign in, complete step 2.
+Expected: a version prints (any — `agy-review` probes its required capabilities, not a version
+floor; `agy-run` probes nothing), then a short reply containing `OK`. If `agy-run` reports
+`'agy' not found`, fix your `PATH` (step 1). If it asks you to sign in, complete step 2. If
+`agy-review` later refuses naming a missing flag or Node, that is the capability probe from step 1,
+not a broken install — follow the recovery it prints.
 
 ## Notes
 
-- `agy-run` is headless and text by default; the CLI's 1.1.x `--output-format json` can ride
-  passthrough (`-- --output-format json`) but the wrapper adds no parsing/validation.
+- `agy-run` is headless and text: `--output-format json` can ride passthrough
+  (`-- --output-format json`) but that wrapper adds no parsing/validation. `agy-review` is the one
+  that drives `--output-format json` first-class and reads the envelope (a successful run still
+  prints text; when its single dispatch or FINAL fed turn exits non-zero it publishes that captured
+  stdout unchanged, never an intermediate feed turn's).
 - `AGY_MODEL` selects the exact model display string; `AGY_TIMEOUT` controls `--print-timeout`.
 - Extra `agy` flags go after `--`, e.g. `agy-run @prompt.md -- --add-dir .`.
 - Re-run interactive `agy` only when the OAuth token expires or the account changes.

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -1198,7 +1198,7 @@ describe('codex-review.sh — review receipts (AD-038)', () => {
       // The grammar ENUMERATES the ASCII set (no ranges): a locale-collated [A-Za-z] could admit a
       // non-ASCII letter the kit's JS reader then refuses, breaking correlation after a paid run.
       const utf8 = makeSandbox();
-      const r2 = run(utf8, { env: { AW_REVIEW_NONCE: 'ré1', LC_ALL: 'en_US.UTF-8', LANG: 'en_US.UTF-8' } });
+      const r2 = run(utf8, { env: { AW_REVIEW_NONCE: 'r\u00e91', LC_ALL: 'en_US.UTF-8', LANG: 'en_US.UTF-8' } });
       rmSync(utf8.root, { recursive: true, force: true });
       assert.equal(r2.status, 2, 'a non-ASCII nonce letter refuses whatever the locale collation says');
       assert.match(r2.stderr, /safe nonce grammar/);

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "5.8.0",
+  "version": "5.10.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "5.8.0",
+  "version": "5.10.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/hooks/state-block-guard.mjs

@@ -7,9 +7,9 @@
 //
 // At Stop time the turn is ENDING. That single fact turns two closing shapes from "discouraged" into
 // FALSE, so they can be judged mechanically:
-//   • the «what I need from you» slot answering "nothing" — a stopped turn always needs a resume, so
+//   * the "what I need from you" slot answering "nothing" — a stopped turn always needs a resume, so
 //     the slot must NAME it. "Nothing needed" is honest only while work is actually running;
-//   • a first-person promise of imminent work in the closing block — the turn is over, so the work
+//   * a first-person promise of imminent work in the closing block — the turn is over, so the work
 //     is not starting. This is the announce-and-stop shape.
 // A promise GATED on something named (after your yes, when CI finishes) is honest and passes.
 //
@@ -19,6 +19,12 @@
 // required a second classifier to decide what counts as a real ask, the rule was DELETED and its
 // residual written down instead — twice. The mode contract lists every residual by name.
 //
+// ONE VOCABULARY, ENGLISH. The kit ships English markers and enumerates no other language: a
+// language list would be a shipped guess about somebody else's dialogue, and it never stops growing.
+// A deployment whose dialogue language is not English extends the arrays in ITS OWN placed copy —
+// this file is copied into the project and self-contained, so that edit is local and survives an
+// uninstalled kit. Until then such a deployment gets no detection, which the mode contract states.
+//
 // HONEST LIMIT, stated because it bounds what this can claim: a Stop hook cannot un-send the turn it
 // judges. This is DETECTION — it converts a silent recurrence into a loud one. It never blocks, and
 // every anomaly path exits 0: a hook that fires on every turn must not become the blocker or the
@@ -39,18 +45,17 @@ const EXIT_OK = 0;
 // The three slots, matched on their LABEL and ANCHORED TO A LINE START. The anchor is not cosmetic:
 // a message that DISCUSSES this contract — which the sessions this guard was built for do constantly
 // — mentions the labels inline, and an unanchored match would judge that prose instead of the real
-// closing block. Russian is the dialogue language this contract was written for; the English twins
-// keep the guard usable in an English-dialogue deployment.
+// closing block.
 const LINE_LEAD = '^[ \\t\\-•]*';
 const SLOT_PATTERNS = Object.freeze({
-  now: new RegExp(`${LINE_LEAD}(?:что сейчас|where we are|state now)\\s*[:：]`, 'gim'),
-  fromYou: new RegExp(`${LINE_LEAD}(?:что нужно от вас|что от вас|what i need from you|from you)\\s*[:：]`, 'gim'),
-  next: new RegExp(`${LINE_LEAD}(?:что дальше|what(?:'s| is)? next|next)\\s*[:：]`, 'gim'),
+  now: new RegExp(`${LINE_LEAD}(?:now|where we are|state now)\\s*[:：]`, 'gim'),
+  fromYou: new RegExp(`${LINE_LEAD}(?:what i need from you|from you)\\s*[:：]`, 'gim'),
+  next: new RegExp(`${LINE_LEAD}(?:what(?:'s| is)? next|next)\\s*[:：]`, 'gim'),
 });
 
 // Quoted and fenced material is EXAMPLE text, not the turn's own closing block. Stripped before any
 // label search — otherwise pasting the very specimen this guard catches would make the guard judge
-// the paste. Emphasis marks are stripped after, so `**Что сейчас:**` still parses.
+// the paste. Emphasis marks are stripped after, so `**Now:**` still parses.
 // Scanned line by line rather than matched as one regex: an UNCLOSED fence must run to the end of
 // the message. A pattern that only removes CLOSED fences would take an unfinished example's labels
 // for a real block — judging a demonstration as if it were the turn, which is precisely the mistake
@@ -84,9 +89,11 @@ const stripFences = (text) => {
 
 const BLOCKQUOTE_LINE = /^[ \t]*>.*$/gm;
 const EMPHASIS_MARKS = /[*_`]/g;
-// A model writes «What’s next» and «I’ll» with a typographic apostrophe far more often than with the
-// ASCII one, so matching only ASCII made the English half fail silently on ordinary output.
-const APOSTROPHES = /[’‘ʼ‛]/g;
+// A model writes "What's next" and "I'll" with a typographic apostrophe far more often than with the
+// ASCII one, so matching only ASCII made every label and every promise marker fail silently on
+// ordinary output. U+02BC rides as an escape because it is a modifier LETTER, and this family's
+// sources carry no non-ASCII letter; the escaped class matches exactly the same characters.
+const APOSTROPHES = /[’‘\u02bc‛]/g;
 const toProse = (text) => stripFences(text)
   .replace(BLOCKQUOTE_LINE, '')
   .replace(EMPHASIS_MARKS, '')
@@ -103,69 +110,93 @@ const openingAnswer = (slot) => {
   const at = slot.search(CLAUSE_END);
   return at === -1 ? slot : slot.slice(0, at);
 };
-// A rule excusing «…, ничего другого не нужно» was built, tightened twice, and then DELETED. Every
+// A rule excusing "…, nothing else is needed" was built, tightened twice, and then DELETED. Every
 // version let a banned answer through behind some harmless prefix, and the next version would have
 // needed an "is this a real ask" recogniser — a second lexical classifier with its own edge set. The
 // residual is stated instead of coded: a comma-joined qualifier IS flagged, and the writer's fix is
 // a clause break, which the first-clause rule already passes.
 
 const NOTHING_FORMS = Object.freeze([
-  'ничего',
-  'ничем',
-  'не требуется',
-  'не нужно',
-  'не нужен',
-  'нет необходимости',
   'nothing',
   'none',
   'n/a',
   'no action',
+  'no need',
+  'not needed',
+  'not required',
+]);
+
+// -- the "what is happening NOW" slot is not a report of what was DONE ----------------------------
+// The third judgeable shape. The three slots answer three different questions; when the now-slot
+// opens with finished work, the reader's one question — what is running — is buried behind a
+// summary they can already read in the message body above.
+// Judged by TOKEN ORDER, the technique the promise/gate rule uses: a COMPLETION marker standing
+// BEFORE the first CURRENCY marker means the running fact was buried. Two consequences are
+// deliberate — a slot with NO currency marker is never judged here (nothing running is a legitimate
+// state, and whether that is honest is the from-you slot's question), and a slot that LEADS with
+// what is running passes whatever it adds afterwards.
+// Stated residual, in this file's own style: a CURRENT state phrased with a COMPLETION MARKER
+// ("the work is closed, waiting on your call" — `closed` is in the list below) is flagged, and the
+// writer's fix is to phrase the state rather than the transition. Telling that from a real
+// completion report needs a classifier this layer lacks. The specimen is deliberately one the list
+// really carries: a residual written with a word the code does not match would document a false
+// positive that cannot happen, which is worse than no residual at all.
+const COMPLETION_FORMS = Object.freeze([
+  'done', 'completed', 'finished', 'closed', 'landed', 'shipped', 'merged', 'published',
+  'committed', 'fixed', 'added', 'removed', 'updated', 'recorded', 'measured', 'marked',
+  'verified', 'ran', 'wrote',
+  "i've", 'i have',
+]);
+
+// Running STATE only, never a time-deictic. "now" is the slot's own label, so accepting it as a
+// currency marker would put one at position 0 of nearly every slot and every completion after it
+// would read as honest — one word defeating the whole rule. A marker that names WHEN rather than
+// WHAT-IS-HAPPENING cannot carry this judgement.
+const CURRENCY_FORMS = Object.freeze([
+  'running', 'in progress', 'waiting', 'awaiting', 'pending', 'is up', 'under way', 'underway',
+  'in flight', 'blocked on',
 ]);
 
 // First-person promises of imminent work. Present tense counts: at Stop it describes work that is
 // NOT running.
-// Action verbs only. «считаю» and «смотрю» were dropped rather than qualified: they are as often
-// stative («считаю задачу завершённой», «смотрю на вопрос как на закрытый») as they are promises, and
-// a form that cannot tell the two apart buys detection with false flags.
-// The English markers are pronoun+modal rather than action verbs, so they cannot tell «I'll start» from
-// «I'll wait». Waiting is not work: it is what a turn that ENDS actually does, and it needs no gate to
-// be honest. So a modal followed by a waiting verb is excluded rather than the modal being dropped —
-// dropping it would need an open-ended list of every action verb English can put after it.
+// The markers are pronoun+modal or pronoun+verb, so they cannot tell "I'll start" from "I'll wait".
+// Waiting is not work: it is what a turn that ENDS actually does, and it needs no gate to be honest.
+// So a modal followed by a waiting verb is excluded rather than the modal being dropped — dropping
+// it would need an open-ended list of every action verb English can put after it.
 const WAITING_CONTINUATIONS = Object.freeze([
   "i'll wait", 'i will wait', "i'll be waiting", "i'll stand by", 'i will stand by',
   "i'll hold", 'i will hold', "i'll stay", 'i will stay', "i'll remain", 'i will remain',
 ]);
 
 const PROMISE_FORMS = Object.freeze([
-  'беру', 'начинаю', 'перехожу', 'сажусь', 'продолжаю', 'иду', 'проверяю', 'пишу', 'строю',
-  'планирую', 'разбираюсь',
-  "i'll", 'i will', "i'm going to", 'i am going to', 'i start', 'i begin', 'next i',
+  "i'll", 'i will', "i'm going to", 'i am going to', "i'm starting", "i'm taking",
+  'i start', 'i begin', 'i take', 'i move on', 'next i',
 ]);
 
 // A gate the promise may depend on. What is actually checked is TOKEN ORDER inside one segment: a
 // gate is treated as excusing a promise when it appears in the same segment and earlier in it. That
 // is a lexical approximation of dependency, not dependency itself, and it carries two named
-// residuals — an honest TRAILING gate («беру, когда вы скажете») is flagged, and a gate belonging to
-// an earlier comma-clause («если тест упадёт, сообщу, а сейчас начинаю…») wrongly excuses a promise
-// that follows it. Both are accepted limits of a lexical layer, documented in the mode contract.
+// residuals — an honest TRAILING gate ("I'll take it when you say so") is flagged, and a gate
+// belonging to an earlier comma-clause ("if the test fails I'll report, and now I start the next
+// class") wrongly excuses a promise that follows it. Both are accepted limits of a lexical layer,
+// documented in the mode contract.
 const CONDITIONAL_FORMS = Object.freeze([
-  'после', 'когда', 'если', 'как только',
-  'after', 'when', 'if', 'as soon as', 'once', 'pending',
+  'after', 'when', 'if', 'as soon as', 'once', 'upon', 'pending',
 ]);
 
-// Segment boundaries for the promise/gate rule. Deliberately NOT the comma: «если вы согласны, беру
-// класс» is one honest thought, and splitting it would flag the shape the rule exists to permit.
+// Segment boundaries for the promise/gate rule. Deliberately NOT the comma: "if you agree, I'll take
+// the class" is one honest thought, and splitting it would flag the shape the rule exists to permit.
 const PROMISE_SEGMENT_BREAK = /;|\n|[.!?](?=\s|$)/;
 
-// Word-bounded matching, Unicode-aware. JavaScript's `\b` is ASCII-only and therefore useless here:
-// with raw substring matching «не нужно» hides inside the honest «мне нужно ваше подтверждение»
-// («м|не нужно»), so the most natural way to name a real ask was read as answering "nothing".
-// The trailing exclusion covers the interrogative particle: «не нужно ЛИ добавить тест» asks a
-// question, it does not decline help.
+// Word-bounded matching, Unicode-aware. The markers are English but the TEXT is the project's
+// dialogue language, which need not be ASCII, and JavaScript's `\b` is ASCII-only: under it every
+// non-ASCII letter reads as a word break, so an English marker sitting inside a non-ASCII word would
+// match as if it stood alone. The Unicode class costs nothing and keeps that door shut; on the
+// English side it is what stops `none` matching inside `nonexistent`.
 const WORD_CHAR = '\\p{L}\\p{N}';
 const escapeForRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
 const boundedPattern = (phrase) => new RegExp(
-  `(?<![${WORD_CHAR}])${escapeForRegExp(phrase)}(?![${WORD_CHAR}])(?!\\s+ли(?![${WORD_CHAR}]))`,
+  `(?<![${WORD_CHAR}])${escapeForRegExp(phrase)}(?![${WORD_CHAR}])`,
   'iu',
 );
 const firstMatchAt = (haystack, needles) => needles.reduce((best, needle) => {
@@ -175,6 +206,25 @@ const firstMatchAt = (haystack, needles) => needles.reduce((best, needle) => {
 }, -1);
 const containsAny = (haystack, needles) => firstMatchAt(haystack, needles) !== -1;
 
+// Nearly every English completion marker doubles as an ADJECTIVE, which the Russian verbs this rule
+// was first written against did not: "the updated test suite is running" is an honest now-slot that
+// leads with the running fact, and reading `updated` there as a completion report would flag it. A
+// marker sitting directly after a DETERMINER is attributive — it modifies the noun after it instead
+// of reporting a transition — so it is not counted.
+// Residual, stated: this also loses a completion phrased attributively ("the finished council, the
+// matrix is running" passes). That trade is deliberate. A false flag on a correct slot is noise from
+// a hook that fires on EVERY turn, and noise is the failure this file is most careful to avoid; a
+// missed marginal shape is not.
+const DETERMINERS = Object.freeze(['the', 'a', 'an', 'this', 'that', 'these', 'those', 'its', 'my', 'our', 'your', 'their']);
+const AFTER_DETERMINER = new RegExp(`(?:^|[^${WORD_CHAR}])(?:${DETERMINERS.join('|')})[ \\t]+$`, 'iu');
+const matchesIn = (haystack, needle) => [...haystack.matchAll(new RegExp(boundedPattern(needle).source, 'giu'))]
+  .map((match) => match.index);
+const firstReportedAt = (haystack, needles) => needles.reduce((best, needle) => {
+  const at = matchesIn(haystack, needle).find((index) => !AFTER_DETERMINER.test(haystack.slice(0, index)));
+  if (at === undefined) return best;
+  return best === -1 ? at : Math.min(best, at);
+}, -1);
+
 const normalise = (value) => (typeof value === 'string'
   ? value.replace(EMPHASIS_MARKS, '').replace(APOSTROPHES, "'").toLowerCase()
   : '');
@@ -197,7 +247,7 @@ const groupLabels = (labels) => labels.reduce((state, label) => {
     : { current: candidate, completed: state.completed };
 }, { current: [], completed: null });
 
-// findStateBlock(text) → { now, fromYou, next } or null. The LAST STARTED candidate decides: if the
+// findStateBlock(text) -> { now, fromYou, next } or null. The LAST STARTED candidate decides: if the
 // message ends mid-block, the turn did not end on a block at all, and falling back to an earlier
 // complete one would judge text the turn already moved past.
 export const findStateBlock = (text) => {
@@ -213,7 +263,7 @@ export const findStateBlock = (text) => {
   return block;
 };
 
-// decideStop({ closingText, requireBlock }) → { ok, reasons }. Never throws: junk input decides
+// decideStop({ closingText, requireBlock }) -> { ok, reasons }. Never throws: junk input decides
 // "no block", which is a reportable state rather than a crash. An ABSENT block is reported only
 // under `requireBlock`: this kit does not mandate the three-part block, so warning about its absence
 // by default would fire on nearly every turn of a project that never adopted it — noise, from a hook
@@ -225,7 +275,7 @@ export const decideStop = (options) => {
     return requireBlock
       ? {
         ok: false,
-        reasons: ['no state block: the closing message must end with «что сейчас · что нужно от вас · что дальше»'],
+        reasons: ['no state block: the closing message must end with "now / what I need from you / what\'s next"'],
       }
       : { ok: true, reasons: [] };
   }
@@ -236,6 +286,11 @@ export const decideStop = (options) => {
       'from-you slot answers "nothing": the turn is ENDING, so a resume from the maintainer IS required — name the real unblocker instead',
     );
   }
+  if (buriesTheRunningFact(normalise(block.now))) {
+    reasons.push(
+      'the now-slot reports finished work before it names what is running — "now" is the state at this instant; move what you completed into the message body above the block',
+    );
+  }
   if (hasUngatedPromise(normalise(block.next))) {
     reasons.push(
       'announce-and-stop: the what-next slot promises imminent first-person work while the turn ends — either do it in this turn, or state what the work waits on',
@@ -244,6 +299,13 @@ export const decideStop = (options) => {
   return { ok: reasons.length === 0, reasons };
 };
 
+const buriesTheRunningFact = (nowSlot) => {
+  const currencyAt = firstMatchAt(nowSlot, CURRENCY_FORMS);
+  if (currencyAt === -1) return false;
+  const completionAt = firstReportedAt(nowSlot, COMPLETION_FORMS);
+  return completionAt !== -1 && completionAt < currencyAt;
+};
+
 const hasUngatedPromise = (nextSlot) => nextSlot.split(PROMISE_SEGMENT_BREAK).some((segment) => {
   const promiseAt = firstMatchAt(segment, PROMISE_FORMS);
   if (promiseAt === -1) return false;
@@ -285,7 +347,7 @@ const parsePayload = (rawInput) => {
 //
 // An EMPTY string is delivered text, not an absent one: a turn that ended with no prose really did
 // end without a closing block, and `--require-block` should be able to say so.
-// runHook(raw, {requireBlock}) → a decision, or null when there is genuinely nothing to judge.
+// runHook(raw, {requireBlock}) -> a decision, or null when there is genuinely nothing to judge.
 // Never throws.
 export const runHook = (rawInput, deps) => {
   const requireBlock = (deps ?? {}).requireBlock === true;

package/references/modes/bootstrap.md

@@ -22,7 +22,7 @@ Requires: ${CLAUDE_SKILL_DIR}/references/shared/report-footer.md · ${CLAUDE_SKI
 4. **Choose agent attribution — answered in the step-2 batch.** May the agent attribute work to itself / to AI — `Co-Authored-By` trailers, "Generated with …" footers, "AI"/agent/model mentions in code, comments, commit messages, PR titles/bodies, or docs? **Default to `off`** (no agent/AI mention anywhere) unless they opt in — people are routinely surprised to find an AI listed as a repo contributor. Carry the answer into the `{{AGENT_ATTRIBUTION}}` slot of the *Attribution* block when `AGENTS.md` is created (step 5). **If `off` and the project uses Claude Code**, also set `"includeCoAuthoredBy": false` in the project's `.claude/settings.json` (create it if absent) — the trailer is added by the harness, so a doc directive alone won't stop it. See [Attribution contract](${CLAUDE_SKILL_DIR}/references/contracts.md#attribution-contract).
 5. **Entry-point doc.** If `AGENTS.md` / `CLAUDE.md` already exist (step-1 recon), do **not** overwrite — show the user and ask whether to merge or replace. Otherwise create `AGENTS.md` (the cross-agent standard — Codex / Cursor / Devin Desktop / Copilot read it natively) from `${CLAUDE_SKILL_DIR}/references/templates/AGENTS.md`, and symlink `CLAUDE.md -> AGENTS.md` (`ln -s AGENTS.md CLAUDE.md`) for Claude Code — single source, no duplication. For nested context, add a subdir `AGENTS.md` (+ a `CLAUDE.md` symlink beside it for Claude Code).
 6. **Deploy `docs/ai/`.** Create every `docs/ai/` file + `pages/` + the seed `adr/` store from `${CLAUDE_SKILL_DIR}/references/templates/` (the template loop deploys each non-`AGENTS.md`, non-`adr-record.md` template — `adr-record.md` is a skill-home ADR authoring reference, never deployed). This deploys the HOT ADR window **`docs/ai/decisions.md`** and the seed navigator **`docs/ai/adr/log.md`** (its `adr/` subdir copies in wholesale), the `.md` docs, **and** the three seeded, user-editable strict-JSON configs: **`docs/ai/orchestration.json`** (the per-project recipe defaults the `procedures` advisor reads), **`docs/ai/gates.json`** (the project's gate declaration — seeded as the no-consent EMPTY list; FILLING it is the consented `gates-init` preview, `${CLAUDE_SKILL_DIR}/references/modes/gates.md`), and **`docs/ai/autonomy.json`** (the per-project autonomy policy — seeded SPARSE with the onboarding note only, so it is exactly the computed defaults until the user declares levels via `/agent-workflow-kit set-autonomy` or by hand). Keep each `.md` file's frontmatter (`type / lastUpdated / scope / staleAfter / owner / maxLines`); the `.json` seeds carry no frontmatter (the docs cap-validator globs `*.md` only, so they are inherently skipped).
-7. **Fill templates** per the table below.
+7. **Fill templates** per the table below. **Then materialize the navigator, as the last `docs/ai` step:** the entry point declares `docs/ai/index.md` always-loaded and it is a GENERATED artifact with no template, so run `node ${CLAUDE_SKILL_DIR}/references/scripts/check-docs-size.mjs --ensure-index --root=<project>` and relay its one outcome line (`ensure-index: regenerated` / `already-current`, or a `write-refused` / `probe-failed` line naming the offending path — either is a STOP: resolve it before reporting the deploy, since the navigator the entry point declares does not exist yet). The generator runs from **this skill's own directory**, so a project with **no Node runtime** is covered too: the agent host runs it, and step 8's copy is not a precondition.
 8. **Install enforcement (Node projects).** Copy `${CLAUDE_SKILL_DIR}/references/scripts/*.mjs` (+ `*.test.mjs`) into the project's `scripts/`. They self-configure (project name from `package.json`, hierarchical/on-demand sections auto-discovered). **If the project has no Node runtime** (step-1 recon), skip this step and the hook in step 9 — follow the cap/archive/index policy manually, or port the scripts to the project's language.
 9. **Wire / hide** per visibility (see [Visibility contract](${CLAUDE_SKILL_DIR}/references/contracts.md#visibility-contract)). Install the pre-commit hook (Node projects): `node scripts/install-git-hooks.mjs`. If the installer reports a pre-existing non-marker hook, stop and ask the user to merge it manually rather than overwriting. Once the gate declaration is final-run-capable, the installer's optional consented `--commit-guard <kit commit-guard.mjs path>` arm binds commits to the green `run-gates --final` receipt (the Recommendations advisor surfaces the exact one-liner).
    - **visible** — wire the `package.json` scripts + add the minimal `.gitignore`. **Do not run the hide tool.**
@@ -32,7 +32,11 @@ Requires: ${CLAUDE_SKILL_DIR}/references/shared/report-footer.md · ${CLAUDE_SKI
      - If it reports a **leftover machine-wide ignore block** from an older deployment, **ask before removing it** — it could affect another of the user's repos that relies on the same machine-wide rules; on a yes, re-run with `--remove-global` (prints a restorable backup). Otherwise it is kept (harmless — the project-local rules win).
      - Report the result plainly (what is now hidden). **No Node on the agent host** → write the one managed block into `.git/info/exclude` by hand from the contract's path list, and report the manual step. **Windows is supported.**
    - **Do not edit `package.json`** in hidden mode — a tracked change leaks the whole system.
-10. **Stamp the deployment lineage.** Write the **deployment-lineage head** into
+10. **Stamp the deployment lineage.** **First re-run the step-7 navigator finalizer**
+    (`--ensure-index`) whenever a later step touched `docs/ai` — the reconciles that follow the
+    template copy do (the agent-rules lens,
+    `${CLAUDE_SKILL_DIR}/references/shared/composition-handoff.md`); it is idempotent, so an
+    untouched tree simply reports `already-current`. Then write the **deployment-lineage head** into
     `docs/ai/.workflow-version` (one semver line). The lineage head is **`3.0.0`** — the shared
     `agent-workflow` deployment lineage, **NOT** this kit's npm package version (see
     `package.json` / `CHANGELOG.md`). The two are

package/references/modes/set-recipe.md

@@ -7,12 +7,15 @@ The **config writer** for `docs/ai/orchestration.json` — the answer to *"set m
 
 **Map the user's plain language → explicit ops** (the kit ships no NL parser; it performs no `all`-magic, so you expand scope explicitly, asking when unclear):
 
-| user says (RU/EN) | op | scope |
+The intents are listed in English; a user speaking any other language expresses the same four, and
+mapping their wording onto them is your job, not a shipped phrase list.
+
+| user means | op | scope |
 |---|---|---|
-| "оба ревьюят" / "both review" | `--set <activity>.review=council` | **disambiguate**: which activity? If both, pass `--set plan-authoring.review=council --set plan-execution.review=council`. |
-| "один ревьюер" / "one reviewer" | `--set <activity>.review=reviewed` | per the named activity, else ask |
-| "делегируй исполнение" / "delegate execution" | `--set plan-execution.execute=delegated` | execution only |
-| "верни как было / сам" / "revert / do it myself" | `--unset <activity>.<slot>` | the named slot → its computed default |
+| "both review" | `--set <activity>.review=council` | **disambiguate**: which activity? If both, pass `--set plan-authoring.review=council --set plan-execution.review=council`. |
+| "one reviewer" | `--set <activity>.review=reviewed` | per the named activity, else ask |
+| "delegate execution" | `--set plan-execution.execute=delegated` | execution only |
+| "revert / do it myself" | `--unset <activity>.<slot>` | the named slot → its computed default |
 
 Run **`node ${CLAUDE_SKILL_DIR}/tools/set-recipe.mjs [--set <activity>.<slot>=<recipe>]… [--unset <activity>.<slot>]… [--write] [--json]`**: