git:20260911.c655850 to git:20261005.4fda294

50 added, 41 removed. Audit A to A.

---

name: agy-native

- description: 'Run a supplied task in AGY Antigravity and collect its result. Use when: the caller selects AGY; never a fallback for native coding.'

+ description: 'Run a supplied task in headless AGY (Antigravity, Gemini) and collect its result. Use when: AGY, Antigravity or Gemini is requested by name; never a fallback.'

practices: [team-topologies, design-by-contract]

hexagonal_role: driving-adapter

consumes: [explicit-packet]

produces: [agy-run-evidence]

context_rel:

- kind: separate-ways

with: codex-exec

skill_api_version: 1

user-invocable: true

metadata:

tier: cross-vendor

dependencies: []

capabilities: [dispatch_explicit_packet, provide_fresh_context]

effects: [start_agy_session]

canonical_status: canonical

disposition: keep_optional_adapter

output_contract: AGY runtime evidence

---

# AGY Native

- Use AGY only when the caller explicitly selects that runtime. Discover its live

- command surface with `agy --help` (and `agy models` for the current model set)

- before acting, and scope every session to the supplied workspace and packet.

- Discovering the live command surface before acting works because AGY's CLI

- changes faster than any skill text: a remembered flag is a guess, while a

- freshly listed one is evidence.

- ## Permission posture (disclose it; never assume it)

- The posture a run gets is chosen by flags, so name it explicitly:

+ Run a supplied packet in AGY (Antigravity) only when the caller explicitly

+ selects that runtime. Scope the run to the supplied workspace and packet,

+ return runtime evidence, and stop.

- - Default `agy` runs interactively and prompts for each tool permission.

- - `--dangerously-skip-permissions` auto-approves every tool call — use it only

- when the packet's declared effects and the caller's authorization cover that

- blast radius.

- - `--sandbox` restricts the session's terminal access.

- - Print mode (`agy -p` / `--print`) is the sanctioned headless path and carries

- a built-in `--print-timeout` (default 5m); a run that exceeds it is killed and

- reported as timed out, not as a result.

+ ## Before launch

- A reader who sets none of these gets AGY's interactive default, not a scoped

- run. Match the posture to the declared effects and disclose which one was used.

+ 1. **Read the live surface.** Run `agy --help` for flags and defaults and

+ `agy models` for the current model set. The CLI changes faster than skill

+ text. **Wrapper drift** is a run built from remembered syntax that silently

+ changed: it looks scoped and is not.

+ 2. **Absent means stop.** If `agy` is missing or its help cannot be read,

+ report the absence and stop. Never fall back silently to Codex, Claude or

+ any other runtime; a substitute needs a new caller selection. Nothing routes

+ work to AGY on its own either. The repository reviewer library rates AGY a

+ routine-tier, degraded-fallback reviewer; that rating applies only when a

+ caller opts in, and it is not an automatic route.

+ 3. **Set an explicit bound.** Print mode (`agy -p` / `--print`) is the headless

+ path, and it has no built-in limit: `--print-timeout` defaults to `0`, which

+ waits until the turn completes (AGY 1.2.14). Pass `--print-timeout` from the

+ caller's remaining deadline and hold the same bound outside the process. A

+ run stopped at the bound is a timeout, not a result.

+ 4. **Name the posture** (below) and confirm the packet's declared effects and

+ the caller's authorization cover it.

+ 5. **Keep author and validator apart.** A validator is a new run in a new

+ conversation, never `-c`/`--continue` or `--conversation <author-id>`. A

+ session that reviews its own work forfeits the fresh judgment that makes a

+ validator's evidence usable. Validators stay read-only and hand judgment to

+ Validate; they never write the core verdict.

- ## When AGY is unavailable

+ ## Permission posture (disclose it; never assume it)

- If `agy` is not installed or its command surface cannot be discovered, report the

- absence as a disclosed fact and stop. Do not fall back to another runtime, do not

- guess a command surface, and never route through `claude -p`.

+ Flags choose the posture. Name the one used:

- Named failure mode — **wrapper drift**: invoking AGY through remembered

- syntax that silently changed, producing runs that look scoped but are not.

+ - No posture flag: AGY prompts for each tool permission. A headless run has no

+ one to answer, so a prompt can stall it until the bound.

+ - `--dangerously-skip-permissions`: auto-approves every tool call. Use it only

+ when the declared effects and the caller's authorization cover that blast

+ radius.

+ - `--sandbox`: restricts the session's terminal access.

+ - `--mode` (`plan`, `accept-edits`): changes the execution mode; confirm its

+ current meaning in `agy --help`.

- Anti-pattern: reusing one AGY session for both author and validator roles

- because starting a second session is slower. Corrective: keep the identities

- distinct; a shared session forfeits the fresh-judgment guarantee that makes

- the validator's evidence usable.

+ ## Return

- - Keep author and validator sessions distinct when AGY supplies both roles.

- - Persist the runtime conversation/context identity and artifact references.

- - Validators remain read-only and hand judgment to Validate; they do not write

- the core verdict directly.

- - AGY plugin, memory, permission, retry, and session state remain substrate facts

- and never become AgentOps phase, queue, or completion state.

- - Never invoke `claude -p` through an AGY wrapper.

+ ```text

+ command: exact argv (prompt by reference)

+ posture: permission, sandbox and mode flags used

+ model: requested model; observed model if AGY reported one, else unknown

+ conversation: id AGY reported, else unknown

+ bound: --print-timeout value and the outer deadline

+ outcome: exit status | timed out | not run (reason)

+ artifacts: captured output and changed-file paths

+ ```

- Return evidence to the caller and stop. Installation, plugin mutation, and

- recurring scheduling require separate explicit authorization.

+ AGY plugin, memory, permission, retry and session state are runtime facts; they

+ never become AgentOps phase, queue or completion state. Installation, plugin

+ mutation and recurring scheduling need separate explicit authorization.