catherd-cli 1.2.0 → 1.3.0

package/src/domain/cost.ts

@@ -13,6 +13,7 @@ export const DEFAULT_BILLING: Record<BillingKey, BillingMode> = {
   opencode: "metered",
   cursor: "metered",
   grok: "metered",
+  antigravity: "metered",
 };
 
 /**

package/src/domain/errors.ts

@@ -5,6 +5,7 @@ export type ErrorCode =
   | "E_BACKEND_MISSING"
   | "E_BACKEND_TOO_OLD"
   | "E_BACKEND_NOT_LOGGED_IN"
+  | "E_BACKEND_CANNOT_RUN"
   | "E_BACKEND_MODEL_UNKNOWN"
   | "E_RUN_NOT_FOUND"
   | "E_RUN_CORRUPT"

package/src/domain/failover.ts

@@ -113,7 +113,8 @@ function effortGap(a: string, b: string): number {
 const BACKEND_OF_KEY: Record<string, string> = { "opencode-go": "opencode" };
 
 /**
- * Every rung the catalog knows how to name: each shipped family's model on each backend at each effort,
+ * Every rung the catalog knows how to name: each shipped family's model on each backend at each effort (at
+ * `#default` when it has none),
  * each listed model at each effort, and each treat-like whose model is an opencode id (`opencode-go/…`,
  * `opencode/…`), such as the shipped Kimi K3 stand-in. Sorted, without duplicates.
  */
@@ -122,7 +123,9 @@ export function catalogRungs(c: Catalog): string[] {
   for (const f of c.families)
     for (const [key, m] of Object.entries(f.on)) {
       if (!m) continue;
-      for (const e of m.efforts) out.add(`${BACKEND_OF_KEY[key] ?? key}:${m.id}#${e}`);
+      // a model with no effort has one rung, #default (Claude Code's Haiku, Cursor's Composer; spec 1.3 §7.1)
+      for (const e of m.efforts.length ? m.efforts : ["default"])
+        out.add(`${BACKEND_OF_KEY[key] ?? key}:${m.id}#${e}`);
     }
   for (const [backend, l] of Object.entries(c.listed))
     for (const m of l.models) for (const e of m.efforts) out.add(`${backend}:${m.id}#${e}`);

package/src/domain/ids.ts

@@ -11,8 +11,8 @@ export function assertId(kind: string, value: string): string {
   return value;
 }
 
-/** The backends that run as a process through a `BackendAdapter` (cursor and grok: plan 8). */
-export const ADAPTER_IDS = ["codex", "claude-code", "opencode", "cursor", "grok"] as const;
+/** The backends that run as a process through a `BackendAdapter` (spec 1.3: cursor, grok and antigravity). */
+export const ADAPTER_IDS = ["codex", "claude-code", "opencode", "cursor", "grok", "antigravity"] as const;
 
 /** `claude` is the native Claude Code subagent path (no process); the rest are adapters. */
 const RUNG_BACKENDS = [...ADAPTER_IDS, "claude"] as const;

package/src/domain/profile.ts

@@ -169,6 +169,63 @@ export const DEFAULT_FAILOVER: Record<string, string> = {
   [SOL("medium")]: "opencode:opencode-go/kimi-k3#max",
 };
 
+/**
+ * Cursor's live slug and efforts for a paired family (`cursor-agent models`, 2026-10-01). Empty efforts means the
+ * bare slug.
+ */
+const CURSOR_PAIR: Record<string, { id: string; efforts: readonly string[] }> = {
+  "grok-4.7": { id: "grok-4.7", efforts: ["low", "medium", "high", "xhigh"] },
+  "grok-4.6": { id: "cursor-grok-4.6", efforts: ["low", "medium", "high", "xhigh"] },
+  "grok-4.5": { id: "cursor-grok-4.5", efforts: ["low", "medium", "high"] },
+  "gemini-3.8-flash": { id: "gemini-3.8-flash", efforts: ["low", "medium", "high"] },
+  "gemini-3.7-flash": { id: "gemini-3.7-flash", efforts: ["low", "medium", "high"] },
+  "gemini-3.6-flash": { id: "gemini-3.6-flash", efforts: ["minimal", "low", "medium", "high"] },
+  "gemini-3.1-pro": { id: "gemini-3.1-pro", efforts: [] },
+};
+
+/** The Cursor effort a paired rung can actually run: the same one when listed, else `high`, else the bare slug. */
+function cursorPairEffort(model: string, effort: string): string {
+  const list = CURSOR_PAIR[model]?.efforts ?? [];
+  if (list.length === 0) return "default";
+  if (effort !== "default" && list.includes(effort)) return effort;
+  return list.includes("high") ? "high" : (list[0] as string);
+}
+
+/**
+ * Spec 1.3 §7.3: the same model through two backends bills two pools, so each stands in for the other on a
+ * limit, at the same effort where both list it. Otherwise the stand-in runs at `high`: Grok 4.5 `xhigh` at Cursor
+ * `high`, Cursor's Gemini 3.6 `minimal` at agy `high`; Gemini 3.1 Pro's bare Cursor slug pairs with agy `high`.
+ * Grok and Gemini are paired with Cursor. Consulted after the profile's own failover and never written into a
+ * profile, where a pair whose rung is on no ladder would warn "never runs"; never a stand-in for a shipped Codex,
+ * Claude or opencode rung.
+ */
+export const PAIRED_FAILOVER: Record<string, string> = Object.fromEntries(
+  (
+    [
+      ["grok", ["grok-4.7", "grok-4.6", "grok-4.5"], ["low", "medium", "high", "xhigh"]],
+      [
+        "antigravity",
+        ["gemini-3.8-flash", "gemini-3.7-flash", "gemini-3.6-flash"],
+        ["low", "medium", "high"],
+      ],
+      ["antigravity", ["gemini-3.1-pro"], ["low", "high"]],
+    ] as const
+  ).flatMap(([backend, models, efforts]) =>
+    models.flatMap((m) => {
+      const cursor = CURSOR_PAIR[m] as { id: string; efforts: readonly string[] };
+      const back = ["default", ...efforts].map(
+        (e) => [`${backend}:${m}#${e}`, `cursor:${cursor.id}#${cursorPairEffort(m, e)}`] as const,
+      );
+      // `#default` too, as on the other side: a Cursor rung with no effort flag fails over the same way
+      const fore = [...new Set(["default", ...cursor.efforts])].map((e) => {
+        const there = e !== "default" && (efforts as readonly string[]).includes(e) ? e : "high";
+        return [`cursor:${cursor.id}#${e}`, `${backend}:${m}#${there}`] as const;
+      });
+      return [...back, ...fore];
+    }),
+  ),
+);
+
 /** The five billing keys spec §7.1 writes out; cursor and grok arrive with their backends. */
 const WRITTEN_BILLING: BillingKey[] = ["codex", "claude", "claude-code", "opencode-go", "opencode"];
 

package/src/domain/record.ts

@@ -68,6 +68,8 @@ export const RunRecordSchema = z.looseObject({
   threadHeavy: z.boolean(),
   access: z.enum(ACCESS),
   isolated: z.boolean(),
+  /** the role's network grant (1.1 §5) it ran under, copied from admit.json; absent before 1.3 */
+  network: z.boolean().optional(),
   images: z.array(z.string()),
   error: z.object({ code: z.string(), message: z.string() }).nullable(),
   replyPath: z.string(),

package/src/domain/util.ts

@@ -5,6 +5,9 @@ export const slug = (s: string): string =>
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-|-$/g, "");
 
+/** One table cell or one line of text: `|` and newlines become `/`, whitespace runs one space, trimmed. */
+export const cell = (s: string): string => s.replace(/[|\n]/g, "/").replace(/\s+/g, " ").trim();
+
 /** The middle value, or the mean of the two middle values for an even count; null when there are none. */
 export function median(xs: readonly number[]): number | null {
   if (xs.length === 0) return null;

package/src/entry/knowledge-command.ts

@@ -0,0 +1,50 @@
+import { resolve } from "node:path";
+import { defineCommand } from "citty";
+import { addKnowledge, knowledgeLines, knowledgePath, readKnowledge } from "../services/run-service.ts";
+import { JSON_ARG, printJson } from "./cli-kit.ts";
+
+/** `--repo`, else the repository the command runs in, as run_start and read_knowledge resolve it. */
+const REPO_ARG = {
+  repo: { type: "string", description: "any path inside the git repo (default: the one you are in)" },
+} as const;
+const repoOf = (repo: string | undefined): string => resolve(repo ?? process.cwd());
+
+const show = defineCommand({
+  meta: { name: "show", description: "Print what catherd knows about the repo (its knowledge.md)" },
+  args: { ...REPO_ARG, ...JSON_ARG },
+  async run({ args }) {
+    if (args.json) return printJson(await knowledgeLines(repoOf(args.repo)));
+    const text = await readKnowledge(repoOf(args.repo));
+    process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+  },
+});
+
+const add = defineCommand({
+  meta: {
+    name: "add",
+    description: 'Append one fact to the repo\'s knowledge.md, marked "by hand"',
+  },
+  args: {
+    line: { type: "positional", required: true, description: "the fact, on one line" },
+    ...REPO_ARG,
+  },
+  async run({ args }) {
+    console.log(await addKnowledge(repoOf(args.repo), args.line));
+  },
+});
+
+const path = defineCommand({
+  meta: { name: "path", description: "Print the path of the repo's knowledge.md (it may not exist yet)" },
+  args: { ...REPO_ARG, ...JSON_ARG },
+  async run({ args }) {
+    const at = await knowledgePath(repoOf(args.repo));
+    if (args.json) return printJson(at);
+    console.log(at.path);
+  },
+});
+
+/** What past runs of a repo learned, which the read_knowledge tool gives every new run (spec §4.7). */
+export const knowledgeCommand = defineCommand({
+  meta: { name: "knowledge", description: "What catherd knows about a repo: show, add or path" },
+  subCommands: { show, add, path },
+});

package/src/entry/tui/effects.ts

@@ -4,7 +4,7 @@ import "../../adapters/all.ts";
 import { agentFiles } from "../../domain/agents.ts";
 import { type Catalog, rungInfo } from "../../domain/catalog.ts";
 import { HARNESS_KEYS, type Profile, type ProfileDoc, type ProfilePatch } from "../../domain/profile.ts";
-import { type Validation, validateProfile } from "../../domain/profile-rules.ts";
+import type { Validation } from "../../domain/profile-rules.ts";
 import type { Access } from "../../domain/record.ts";
 import { VERSION } from "../../infra/version.ts";
 import {
@@ -39,7 +39,7 @@ import {
   projectsFile,
   readProfileDoc,
   readProjects,
-  runnableBackends,
+  validateHere,
 } from "../../services/profile-store.ts";
 import { listRuns, type Run, runPaths } from "../../services/run-store.ts";
 import {
@@ -121,6 +121,8 @@ export interface Effects {
   enforcement(rung: string, access: Access): "enforced" | "advisory";
   /** the harnesses a profile can isolate */
   harnesses: readonly string[];
+  /** spec 1.3 §8: what a harness's native mode loads, and the API key its isolation needs, when it says */
+  isolation(harness: string): { note?: string; key?: string };
   /** the native agents a profile links, by name */
   agents(p: Profile): string[];
   /**
@@ -341,9 +343,16 @@ export function liveEffects(repo: string | null = null): Effects {
         models: catalogQuery({ scoredOnly: false, limit: Number.MAX_SAFE_INTEGER }, billing).models,
       };
     },
-    validate: (p, c) => validateProfile(p, c, runnableBackends()),
+    validate: (p, c) => validateHere(p, c),
     enforcement: enforcementOf,
     harnesses,
+    isolation(h) {
+      const a = adapterFor(h);
+      return {
+        ...(a?.isolationNote ? { note: a.isolationNote } : {}),
+        ...(a?.isolationKey ? { key: a.isolationKey } : {}),
+      };
+    },
     agents: (p) => agentFiles(p, VERSION).map((f) => f.name),
     async save(name, patch, treatLikes, shown) {
       for (const [rung, like] of Object.entries(treatLikes)) await saveTreatLike(rung, like);

package/src/entry/tui/fixtures.ts

@@ -523,6 +523,7 @@ export function fixtureEffects(o: FixtureOptions = {}): Effects & {
     validate: (p, c) => validateProfile(p, c, BACKENDS),
     enforcement: (rung) => (rung.startsWith("codex:") ? "enforced" : "advisory"),
     harnesses: ["codex", "claude-code", "opencode"],
+    isolation: () => ({}),
     agents: (p) =>
       (["architect", "verifier"] as const)
         .filter((r) => p.roles[r].enabled)

package/src/entry/tui/profile-tree.ts

@@ -75,7 +75,16 @@ export function withStaged(c: Catalog, staged: Record<string, string>): Catalog
   return { ...c, treatLike };
 }
 
-const GROUP_ORDER = ["claude", "claude-code", "codex", "opencode-go", "opencode", "cursor", "grok"];
+const GROUP_ORDER = [
+  "claude",
+  "claude-code",
+  "codex",
+  "opencode-go",
+  "opencode",
+  "cursor",
+  "grok",
+  "antigravity",
+];
 const GROUP_NOTE: Record<string, string> = { claude: "native subagent", "claude-code": "headless" };
 
 interface ModelEntry {

package/src/entry/tui/views/profiles.tsx

@@ -41,6 +41,10 @@ const ABOUT: Partial<Record<RowAction["type"], string>> = {
   notify: "space turns this notification on or off",
 };
 
+/** Spec 1.3 §8: a harness row's line: what isolating it needs, and what its native mode loads. */
+export const isolationAbout = (i: { note?: string; key?: string }): string =>
+  [`${ABOUT.isolated}${i.key ? ` (it needs ${i.key})` : ""}`, i.note].filter(Boolean).join("; ");
+
 /**
  * The profiles poll failed after a good read (its error is newer than the value it keeps): one error line
  * and, when the failure says, its fix; none once a read succeeds again.
@@ -411,7 +415,16 @@ export function ProfilesView(props: { width: number; height: number }) {
         },
         ...(row.issue.fix ? [{ text: ` fix: ${row.issue.fix}`, tone: "muted" as const }] : []),
       ]
-    : [{ text: ` ${(row && ABOUT[row.action.type]) ?? ""}`, tone: "muted" as const }];
+    : [
+        {
+          text: ` ${
+            row?.action.type === "isolated"
+              ? isolationAbout(app.effects.isolation(row.action.harness))
+              : ((row && ABOUT[row.action.type]) ?? "")
+          }`,
+          tone: "muted" as const,
+        },
+      ];
   const aboutLines = about
     .flatMap((p) => wrap(p.text, props.width).map((text) => ({ ...p, text })))
     .slice(0, 2);

package/src/infra/paths.ts

@@ -2,8 +2,10 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 
 function root(kind: "config" | "data"): string {
-  // set for an isolated worker whose XDG_CONFIG_HOME points elsewhere, so its `catherd lock` reads this config
+  // set for an isolated worker whose XDG_CONFIG_HOME or HOME points elsewhere, so its `catherd lock` reads
+  // this config and takes this lock dir
   if (kind === "config" && process.env.CATHERD_CONFIG_DIR) return process.env.CATHERD_CONFIG_DIR;
+  if (kind === "data" && process.env.CATHERD_DATA_DIR) return process.env.CATHERD_DATA_DIR;
   const home = process.env.CATHERD_HOME;
   if (home) return join(home, kind);
   if (kind === "config") return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "catherd");

package/src/services/admission.ts

@@ -162,18 +162,40 @@ export async function admit(
     throw new CatherdError("E_ADMIT_THREAD", `"${i.thread}" is not a ${adapter.id} thread id`, {
       fix: "pass the thread from the role's earlier record, or none for a fresh thread",
     });
+  // a resumed thread lives in the home it started in (CODEX_HOME), whatever the profile says now
+  const started = i.thread === null ? undefined : recordsOnThread(run, rung.backend, i.thread).at(-1);
+  const network = rc.network !== false;
+  // spec 1.3 §3.2: a backend that fixes a thread's access when it starts it refuses another on resume
+  if (started && adapter.resume.sameAccessOnly && started.access !== rc.access)
+    throw new CatherdError(
+      "E_ADMIT_THREAD",
+      `${adapter.id} keeps the access a thread started with: ${i.thread} ran ${started.access}, and the ${i.role} role runs ${rc.access}`,
+      { fix: "dispatch a fresh thread (omit `thread`)" },
+    );
+  // and the network grant: grok keeps a session's sandbox profile, agy's isolated homes differ by it.
+  // A record from before 1.3 carries no grant to compare.
+  if (started?.network !== undefined && adapter.resume.sameAccessOnly && started.network !== network)
+    throw new CatherdError(
+      "E_ADMIT_THREAD",
+      `${adapter.id} keeps the network grant a thread started with: ${i.thread} ran ${started.network ? "with" : "without"} the network, and the ${i.role} role runs ${network ? "with" : "without"} it`,
+      { fix: "dispatch a fresh thread (omit `thread`)" },
+    );
   const owns = i.lane === null ? [] : laneOwns(run, i.lane);
   const id = newDispatchId();
   const dir = join(roleDir(run, i.name), id);
   const p = dispatchPaths(dir);
-  // a resumed thread lives in the home it started in (CODEX_HOME), whatever the profile says now
-  const started = i.thread === null ? undefined : recordsOnThread(run, rung.backend, i.thread).at(-1);
   const isolated = started?.isolated ?? profile.isolated[rung.backend] ?? false;
-  await prepared(adapter, { rung, access: rc.access, isolated, repo: run.meta.repo });
+  await prepared(adapter, {
+    rung,
+    access: rc.access,
+    isolated,
+    repo: run.meta.repo,
+    network,
+  });
   const plan = adapter.plan({
     rung,
     access: rc.access,
-    network: rc.network !== false,
+    network,
     thread: i.thread,
     isolated,
     repo: run.meta.repo,
@@ -239,6 +261,7 @@ export async function admit(
       ...(i.failoverOf ? { failoverOf: i.failoverOf } : {}),
       access: rc.access,
       isolated,
+      network,
       cliVersion: probe.version,
       admittedAt: new Date(deps.now()).toISOString(),
       repo: run.meta.repo,

package/src/services/backends.ts

@@ -3,6 +3,7 @@ import { adapterFor } from "../adapters/registry.ts";
 import "../adapters/all.ts";
 import { CatherdError } from "../domain/errors.ts";
 import { formatRung, tryParseRung } from "../domain/ids.ts";
+import { PAIRED_FAILOVER } from "../domain/profile.ts";
 
 const READY_TTL_MS = 10 * 60_000;
 const ready = new Map<string, { at: number; probe: Probe }>();
@@ -10,6 +11,41 @@ const ready = new Map<string, { at: number; probe: Probe }>();
 /** Forget every cached probe (tests, and after the user fixes a backend). */
 export const resetReadiness = (): void => ready.clear();
 
+/** Spec 1.3 §3.3: what Bun's spawn throws for a binary built for another OS (a Linux build on macOS). */
+function execFormatError(e: unknown): string | null {
+  if (!(e instanceof Error)) return null;
+  if ((e as { code?: unknown }).code !== "ENOEXEC" && !/exec format error/i.test(e.message)) return null;
+  // macOS names the path (posix_spawn '/…/grok'), Linux only the command (uv_spawn 'grok')
+  const bin = /spawn '([^']+)'/.exec(e.message)?.[1];
+  return bin ? (Bun.which(bin, { PATH: process.env.PATH ?? "" }) ?? bin) : "exec format error";
+}
+
+/**
+ * The adapter's probe, with a CLI on PATH that the OS cannot execute reported as installed but unable to run
+ * (spec 1.3 §3.3), with the reinstall command; any other failure of the probe is thrown.
+ */
+export async function probeBackend(adapter: BackendAdapter): Promise<Probe> {
+  try {
+    return await adapter.probe();
+  } catch (e) {
+    const why = execFormatError(e);
+    if (why === null) throw e;
+    return {
+      installed: true,
+      version: null,
+      versionOk: false,
+      loggedIn: null,
+      problems: [
+        {
+          code: "E_BACKEND_CANNOT_RUN",
+          message: `${adapter.id} is installed but cannot run on this OS: ${why}`,
+          fix: adapter.install ?? `reinstall ${adapter.id} for this OS`,
+        },
+      ],
+    };
+  }
+}
+
 /**
  * Spec §4.4: the adapter for `backend` once its last probe says it is ready. A ready probe is kept
  * for 10 minutes; a failing one is never kept, so a fixed backend works on the next dispatch.
@@ -23,19 +59,21 @@ export async function readyAdapter(backend: string): Promise<{ adapter: BackendA
     });
   const hit = ready.get(backend);
   if (hit && now - hit.at < READY_TTL_MS) return { adapter, probe: hit.probe };
-  const probe = await adapter.probe();
+  const probe = await probeBackend(adapter);
   const problem = probe.problems[0];
+  // spec 1.3 §3.3: a probe that finds the CLI logged out lists E_BACKEND_NOT_LOGGED_IN, so a dispatch never
+  // reaches it (agy opens a browser and waits); logged out alone is no problem where a CLI runs without a login
   if (problem) throw new CatherdError(problem.code, problem.message, { fix: problem.fix });
   ready.set(backend, { at: now, probe });
   return { adapter, probe };
 }
 
 /**
- * Spec §4.5: a rung's stand-in on a usage limit: the profile's, else its backend's default (for `repo`,
- * when given), else none.
+ * Spec §4.5: a rung's stand-in on a usage limit: the profile's, else the same model on its paired backend
+ * (spec 1.3 §7.3), else its backend's default (for `repo`, when given), else none.
  */
 export function standInFor(failover: Record<string, string>, rung: string, repo?: string): string | null {
-  const own = failover[rung];
+  const own = failover[rung] ?? PAIRED_FAILOVER[rung];
   if (own) return own;
   const r = tryParseRung(rung);
   if (!r) return null;

package/src/services/capture.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import type { BackendAdapter, FinishedRun } from "../adapters/backend.ts";
+import type { BackendAdapter, FinishedRun, Outcome, RunRequest } from "../adapters/backend.ts";
 import { isCatherdError } from "../domain/errors.ts";
 import { parseRung } from "../domain/ids.ts";
 import type { Access } from "../domain/record.ts";
@@ -21,14 +21,26 @@ interface CaptureCase {
   rung: string;
   access: Access;
   brief: string;
+  /** a second brief that resumes the first run's thread in the same repo; the resumed run is captured */
+  resume?: string;
 }
 
 const SAY_HELLO =
   "Reply with the single word hello. The last line of your reply is exactly: STATUS: complete — said hello";
 const TRY_WRITE =
   "Create a file named out.txt containing the word hi. If you cannot, say why. The last line of your reply is: STATUS: complete|blocked — <one line why>";
+const WORK =
+  "Create a file named notes.txt containing hi, read it back, then run the shell command `git status --short`. The last line of your reply is exactly: STATUS: complete — wrote notes.txt";
+const RECALL =
+  "Which single word did you reply with earlier in this chat? Reply with it. The last line of your reply is exactly: STATUS: complete — recalled";
 const HAIKU = "claude-code:claude-haiku-4-5-20251001#default";
+/** spec 1.3 §4.6: `auto` has no family; only the live kit and the capture run it */
+const AUTO = "cursor:auto#default";
 const BUNNY = "opencode:opencode/space-bunny-free#default";
+/** spec 1.3 §5.6: grok 1.0.44's default model (research §3.4) at its cheapest effort */
+const GROK = "grok:grok-4.6#low";
+/** spec 1.3 §6.6: the cheapest Gemini effort; capture runs isolated, on GEMINI_API_KEY */
+const FLASH_LOW = "antigravity:gemini-3.8-flash#low";
 
 /** Spec §11.7–8: one cheap run per backend, plus a read-only role trying to write where enforcement is advisory. */
 const CAPTURE_CASES: CaptureCase[] = [
@@ -37,6 +49,26 @@ const CAPTURE_CASES: CaptureCase[] = [
   { backend: "claude-code", name: "read-only-write", rung: HAIKU, access: "read-only", brief: TRY_WRITE },
   { backend: "opencode", name: "ok", rung: BUNNY, access: "read-only", brief: SAY_HELLO },
   { backend: "opencode", name: "read-only-write", rung: BUNNY, access: "read-only", brief: TRY_WRITE },
+  // spec 1.3 §4.7: a read, a write and a shell call; a resumed chat (research §2.5); ask mode trying to write
+  { backend: "cursor", name: "ok", rung: AUTO, access: "workspace-write", brief: WORK },
+  { backend: "cursor", name: "resume", rung: AUTO, access: "read-only", brief: SAY_HELLO, resume: RECALL },
+  { backend: "cursor", name: "read-only-write", rung: AUTO, access: "read-only", brief: TRY_WRITE },
+  // spec 1.3 §5.6: the same three on grok; its read-only is the kernel profile, or the read tools on a Mac
+  // with a symlinked docker socket
+  { backend: "grok", name: "ok", rung: GROK, access: "workspace-write", brief: WORK },
+  { backend: "grok", name: "resume", rung: GROK, access: "read-only", brief: SAY_HELLO, resume: RECALL },
+  { backend: "grok", name: "read-only-write", rung: GROK, access: "read-only", brief: TRY_WRITE },
+  // spec 1.3 §6.6: the same three on agy; read-only runs under catherd's deny rules (research §8 agy 2, 5, 6)
+  { backend: "antigravity", name: "ok", rung: FLASH_LOW, access: "workspace-write", brief: WORK },
+  {
+    backend: "antigravity",
+    name: "resume",
+    rung: FLASH_LOW,
+    access: "read-only",
+    brief: SAY_HELLO,
+    resume: RECALL,
+  },
+  { backend: "antigravity", name: "read-only-write", rung: FLASH_LOW, access: "read-only", brief: TRY_WRITE },
 ];
 export const CAPTURE_BACKENDS = [...new Set(CAPTURE_CASES.map((c) => c.backend))];
 
@@ -79,12 +111,71 @@ function cleanStrings(v: unknown, clean: (s: string) => string): unknown {
   return v;
 }
 
+/** One run as an isolated dispatch would start it (plan, the worker env), without the supervisor. */
+async function runOnce(
+  adapter: BackendAdapter,
+  request: RunRequest,
+  timeoutMs: number,
+): Promise<{ run: FinishedRun; events: string; stderr: string; o: Outcome }> {
+  const plan = adapter.plan(request);
+  const startedAtMs = Date.now();
+  const p = Bun.spawn([plan.cmd, ...plan.args], {
+    cwd: plan.cwd,
+    env: workerEnv(process.env, plan.env, plan.cwd),
+    // spec 1.3 §3.3: the brief goes on stdin only to a CLI whose plan reads it there (grok reads a file)
+    stdin: plan.stdinPath ? Bun.file(plan.stdinPath) : "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    // its own group, so a timeout stops whatever the CLI started too, as the supervisor does
+    detached: true,
+  });
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    killGroup(p.pid, "SIGKILL");
+  }, timeoutMs);
+  // as preflight does: a process the CLI left behind (in its own session) may hold the pipes open
+  const out = collect(p.stdout);
+  const err = collect(p.stderr);
+  const code = await p.exited;
+  clearTimeout(timer);
+  const drained = await Promise.race([
+    Promise.all([out.done, err.done]).then(() => true),
+    Bun.sleep(DRAIN_MS).then(() => false),
+  ]);
+  if (!drained) killGroup(p.pid, "SIGKILL"); // leftovers still in the CLI's group
+  out.stop();
+  err.stop();
+  const events = out.text();
+  const stderr = err.text();
+  const run: FinishedRun = {
+    request,
+    eventLines: events.split("\n").filter((l) => l.trim()),
+    reply: "",
+    stderr,
+    exit: {
+      code: p.signalCode ? null : code,
+      signal: p.signalCode ?? null,
+      reason: timedOut ? "wall-timeout" : "exited",
+      endedAt: new Date().toISOString(),
+    },
+    startedAtMs,
+  };
+  // as a dispatch records it: the backend's own totals and limits, on a fresh thread (nothing prior)
+  const o = await settled(adapter, adapter.finalize(run), run, () => ({
+    tokens: { input: 0, cached: 0, output: 0 },
+    costUsd: 0,
+  }));
+  return { run, events, stderr, o };
+}
+
 /**
  * Runs one case the way an isolated dispatch would (prepare, plan, the worker env), without the
  * supervisor. Isolated, so the stream names none of the owner's own hooks, plugins, MCP servers or config:
- * the fixtures are committed.
+ * the fixtures are committed. A case with `resume` runs its brief, then resumes that thread in the same
+ * scratch repo with `resume`, and captures the resumed run.
  */
-async function captureOne(
+export async function captureOne(
   adapter: BackendAdapter,
   version: string,
   c: CaptureCase,
@@ -96,8 +187,8 @@ async function captureOne(
     const briefPath = join(work, "brief.md");
     writeFileSync(briefPath, c.brief);
     const rung = parseRung(c.rung);
-    await adapter.prepare?.({ rung, access: c.access, isolated: true, repo });
-    const request = {
+    await adapter.prepare?.({ rung, access: c.access, isolated: true, repo, network: true });
+    const request: RunRequest = {
       rung,
       access: c.access,
       thread: null,
@@ -107,54 +198,20 @@ async function captureOne(
       replyPath: join(work, "reply.md"),
       dispatchDir: work,
     };
-    const plan = adapter.plan(request);
-    const startedAtMs = Date.now();
-    const p = Bun.spawn([plan.cmd, ...plan.args], {
-      cwd: plan.cwd,
-      env: workerEnv(process.env, plan.env, plan.cwd),
-      stdin: Bun.file(briefPath),
-      stdout: "pipe",
-      stderr: "pipe",
-      // its own group, so a timeout stops whatever the CLI started too, as the supervisor does
-      detached: true,
-    });
-    let timedOut = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      killGroup(p.pid, "SIGKILL");
-    }, timeoutMs);
-    // as preflight does: a process the CLI left behind (in its own session) may hold the pipes open
-    const out = collect(p.stdout);
-    const err = collect(p.stderr);
-    const code = await p.exited;
-    clearTimeout(timer);
-    const drained = await Promise.race([
-      Promise.all([out.done, err.done]).then(() => true),
-      Bun.sleep(DRAIN_MS).then(() => false),
-    ]);
-    if (!drained) killGroup(p.pid, "SIGKILL"); // leftovers still in the CLI's group
-    out.stop();
-    err.stop();
-    const events = out.text();
-    const stderr = err.text();
-    const run: FinishedRun = {
-      request,
-      eventLines: events.split("\n").filter((l) => l.trim()),
-      reply: "",
-      stderr,
-      exit: {
-        code: p.signalCode ? null : code,
-        signal: p.signalCode ?? null,
-        reason: timedOut ? "wall-timeout" : "exited",
-        endedAt: new Date().toISOString(),
-      },
-      startedAtMs,
-    };
-    // as a dispatch records it: the backend's own totals and limits, on a fresh thread (nothing prior)
-    const o = await settled(adapter, adapter.finalize(run), run, () => ({
-      tokens: { input: 0, cached: 0, output: 0 },
-      costUsd: 0,
-    }));
+    let captured = await runOnce(adapter, request, timeoutMs);
+    const resumed = c.resume === undefined ? null : captured.o.thread;
+    if (c.resume !== undefined) {
+      if (!resumed)
+        return {
+          backend: c.backend,
+          name: c.name,
+          status: "skipped",
+          reason: `the first run left no thread to resume (${captured.o.error?.message ?? captured.o.status})`,
+        };
+      writeFileSync(briefPath, c.resume);
+      captured = await runOnce(adapter, { ...request, thread: resumed }, timeoutMs);
+    }
+    const { run, events, stderr, o } = captured;
     const scrub: Scrub = {
       secrets: secretEnvValues(process.env),
       paths: [
@@ -180,7 +237,8 @@ async function captureOne(
           rung: c.rung,
           access: c.access,
           isolated: true,
-          brief: c.brief,
+          brief: c.resume ?? c.brief,
+          ...(resumed ? { resumed } : {}),
           exitCode: run.exit.code,
           reason: run.exit.reason,
           capturedAt: new Date().toISOString(),