fix(orchestrate): report agy as prompt_only, because it is not sandboxed

agents/agy-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: agy-reviewer
-description: Cross-family review by Gemini via the agy CLI, for a genuinely different-provider perspective on a diff, design or finding. Use to satisfy the cross-family leg of the review ladder, or whenever a second opinion should not come from another Claude. Returns the verdict and findings plus a path to the full review.
+description: Cross-family review by Gemini via the agy CLI, for a genuinely different-provider perspective on a diff, design or finding. Use to obtain the cross-family leg of the review ladder, or whenever a second opinion should not come from another Claude. Agy reviews are independent opinions, not sandboxed certification. Returns the verdict and findings plus a path to the full review.
 tools: Bash, Read, Write, Glob, Grep
 model: haiku
 effort: low
@@ -34,8 +34,10 @@ read of the same diff.
 
 Agy holds its own `agy` Agent Fabric seat, so a Gemini finding is recorded against the Google
 family rather than borrowing another provider's identity. Fabric carries the coordination and
-the record; this dispatch is the call itself. You do not need to bootstrap, request or verify
-the seat before reviewing, and a missing seat does not block a review.
+the record; this dispatch is the call itself. The dispatcher records this route as `prompt_only`,
+because agy is not sandboxed against writes. It remains a genuine independent opinion, but is not
+certification eligible. You do not need to bootstrap, request or verify the seat before reviewing,
+and a missing seat does not block a review.
 
 ## Procedure
 
@@ -61,9 +63,15 @@ including work already completed. That makes the prompt load-bearing. Tell
 Gemini plainly what it may and may not do:
 
 > You MAY read files under `<dir>`. You MUST NOT run shell commands or write
-> any file. Those are auto-denied, and one denied call discards your entire
-> answer including work already done. If you cannot answer without one, say so
-> in prose instead of attempting it.
+> any file. If you cannot answer without one, say so in prose instead of
+> attempting it.
+
+Both halves of that matter, and they are separate facts. A tool the local agy
+permissions do **not** grant is auto-denied, and one denied call discards the
+entire turn including work already completed, so attempting one is expensive.
+A tool the permissions **do** grant simply runs: the instruction is a request,
+not a sandbox, so never treat a review's silence about writing as proof that
+it did not write.
 
 Also ask it to state at the top whether its reads succeeded. That is cheap, and
 it catches a review written blind that no status field would reveal.

skills/orchestrate/evals/test_cf_dispatch.py

@@ -422,8 +422,8 @@ def test_agy_direct_route_dispatches_json_sandbox_and_file_prompt():
         assert record["provider_family"] == "google"
         assert record["endpoint_provider"] == "agy"
         assert record["effort"] == "medium"
-        assert record["read_only_guarantee"] == "enforced"
-        assert record["certification_eligible"] is True
+        assert record["read_only_guarantee"] == "prompt_only"
+        assert record["certification_eligible"] is False
         assert out.read_text(encoding="utf-8") == "AGY OK"
         args = args_file.read_text(encoding="utf-8").splitlines()
         assert args[args.index("--output-format") + 1] == "json"

skills/orchestrate/references/cli-headless.md

@@ -1,6 +1,6 @@
 # CLI headless reference (dated layer)
 
-Verified locally on macOS, 2026-06-07. Model IDs, flags, auth, and safety modes drift. Always run
+Verified locally on macOS, 2026-08-05. Model IDs, flags, auth, and safety modes drift. Always run
 `<tool> --help` / model discovery before depending on a chain.
 
 ## Contents
@@ -18,8 +18,9 @@ Verified locally on macOS, 2026-06-07. Model IDs, flags, auth, and safety modes
 
 Headless CLIs are how external work reaches another provider. Fabric carries
 the request, the reply and the activity record around that call; it does not
-run the provider itself. A verifier that is not certifying must enforce
-read-only or planning mode; advisory claims require independent verification.
+run the provider itself. Certification requires an enforced read-only
+boundary. A prompt-only review can still provide a genuine independent
+opinion, but it is not certification eligible.
 
 ## Harness-conditioned rule
 
@@ -81,8 +82,12 @@ or `oauth_safe_mode`.
 - `agy`: `--sandbox --output-format json --disable-slash-commands`, with
   `--model`/`--effort` as separate flags and repeatable `--add-dir` for read
   material (also settable as a colon-separated `CF_DISPATCH_AGY_ADD_DIR`).
-  stdout and stderr stay separate so a permission denial cannot masquerade as
-  an empty success. `--dangerously-skip-permissions` is refused.
+  These flags do not enforce read-only access, so the dispatcher reports
+  `prompt_only`: the prompt asks agy not to mutate, but local permissions can
+  still allow writes. A write probe under agy 1.1.10's dispatcher flags
+  succeeded and created the file, and `--mode plan` did the same. stdout and
+  stderr stay separate so a permission denial cannot masquerade as an empty
+  success. `--dangerously-skip-permissions` is refused.
 - `cursor`: `--mode ask --sandbox enabled`; current help documents ask as
   read-only, while current headless plan mode can exit without an answer.
 - `kiro`: disabled by default in the dispatcher. Enable only with `CF_DISPATCH_ENABLE_KIRO=1`; no hard
@@ -91,8 +96,9 @@ or `oauth_safe_mode`.
   disabled (`--available-tools=''`); repo inspection cannot currently be guaranteed read-only from local
   help.
 
-If any adapter cannot enforce the promised safety level, log the failure and fail over. Do not silently
-downgrade certification. For large prompts, prefer `--prompt-file`; enforced adapters use
+If any adapter cannot enforce the promised safety level, record its actual guarantee and keep
+certification ineligible. Do not silently upgrade `prompt_only` to `enforced`. For large
+prompts, prefer `--prompt-file`; enforced adapters use
 stdin/file-backed input where supported to avoid shell argument limits.
 Orchestrated runs always pass `--out <run-dir>/<classified-artifact>` and list it
 in the manifest. Omitting `--out` creates one declared ephemeral output for a
@@ -212,8 +218,8 @@ every implementation leg, check `git -C <worktree> log --oneline <base>..HEAD`,
 A worker has no conversation context, so the brief carries everything: absolute path and
 branch, what has already been verified so it is not redone, ordered parts, out-of-scope
 paths, how to verify, and that it must not push, open a pull request or merge. Always
-include the scepticism clause — *verify every claim in this brief before relying on it; if
-something here is wrong, saying so is more valuable than following it* — which has
+include the scepticism clause: *verify every claim in this brief before relying on it; if
+something here is wrong, saying so is more valuable than following it*, which has
 repeatedly produced the most valuable output of a run.
 
 ## Runtime routing

skills/orchestrate/scripts/cf_dispatch.sh

@@ -440,7 +440,11 @@ run_one() {  # $1 tool $2 model $3 effort -> writes clean answer to OUT, echoes
               ${model:+--model "$model"} "$(cat "$PROMPT_TMP")" </dev/null >"$raw" 2>"$diag"; rc=$?
           fi ;;
         agy)
-          guarantee="enforced"
+          # agy --sandbox does not enforce read-only writes. On agy 1.1.10 a
+          # write probe under these dispatcher flags returned SUCCESS and
+          # created the file; --mode plan did the same, so only the prompt
+          # discourages mutation.
+          guarantee="prompt_only"
           if ! require_cmd agy "$diag"; then
             status="tool_not_found"
             rc=127