agy-native

# AGY Native Run a supplied packet in AGY (Antigravity) only when the caller explicitly selects that runtime. Scope the run to the supplied workspace and packet, return runtime evidence, and stop. ## Before launch 1. **Read the live surface.** Run `agy --help` for flags and defaults and `agy models` for the current model set. The CLI changes faster than skill text. **Wrapper drift** is a run built from remembered syntax that silently changed: it looks scoped and is not. 2. **Absent means stop.** If `agy` is missing or its help cannot be read, report the absence and stop. Never fall back silently to Codex, Claude or any other runtime; a substitute needs a new caller selection. Nothing routes work to AGY on its own either. The repository reviewer library rates AGY a routine-tier, degraded-fallback reviewer; that rating applies only when a caller opts in, and it is not an automatic route. 3. **Set an explicit bound.** Print mode (`agy -p` / `--print`) is the headless path, and it has no built-in limit: `--print-timeout` defaults to `0`, which waits until the turn completes (AGY 1.2.14). Pass `--print-timeout` from the caller's remaining deadline and hold the same bound outside the process. A run stopped at the bound is a timeout, not a result. 4. **Name the posture** (below) and confirm the packet's declared effects and the caller's authorization cover it. 5. **Keep author and validator apart.** A validator is a new run in a new conversation, never `-c`/`--continue` or `--conversation <author-id>`. A session that reviews its own work forfeits the fresh judgment that makes a validator's evidence usable. Validators stay read-only and hand judgment to Validate; they never write the core verdict. ## Permission posture (disclose it; never assume it) Flags choose the posture. Name the one used: - No posture flag: AGY prompts for each tool permission. A headless run has no one to answer, so a prompt can stall it until the bound. - `--dangerously-skip-permissions`: auto-approves every tool call. Use it only when the declared effects and the caller's authorization cover that blast radius. - `--sandbox`: restricts the session's terminal access. - `--mode` (`plan`, `accept-edits`): changes the execution mode; confirm its current meaning in `agy --help`. ## Return ```text command: exact argv (prompt by reference) posture: permission, sandbox and mode flags used model: requested model; observed model if AGY reported one, else unknown conversation: id AGY reported, else unknown bound: --print-timeout value and the outer deadline outcome: exit status | timed out | not run (reason) artifacts: captured output and changed-file paths ``` AGY plugin, memory, permission, retry and session state are runtime facts; they never become AgentOps phase, queue or completion state. Installation, plugin mutation and recurring scheduling need separate explicit authorization.