agy-worker

# Delegate repository work and verify the result

Use this skill for useful repository exploration, bounded implementation, or broad
project work through `agy`. The worker discovers ordinary structure and proposes or
makes changes; Codex remains responsible for scope, diff review, driver-owned checks,
repair decisions, and the final assurance label.

Resolve the installed package instead of guessing a checkout path:

```bash
PIPELINE="$(bash "$SKILL_ROOT/scripts/resolve-pipeline.sh")" || exit $?
```

Optionally check offline prerequisites before spending provider quota:

```bash
"$PIPELINE/doctor.sh" --repo /absolute/path/to/target
```

`ready` covers offline prerequisites only. It does not prove authentication, provider
availability, task quality, or future job success. For installation and package
orientation, read [Package README](README.md).

## Before every provider launch

Obtain explicit approval for the exact transmission mode, repository content, and task
being sent unless that exact provider transmission was already approved.

Without `--provider-scope`, treat the entire disposable worktree passed as `--workdir` as worker-readable and potentially transmissible to Google/Gemini, regardless of requested edit paths; `--add-dir`, prompt denylist instructions, `qa-gate --only`, and `--allow` do not narrow that default read boundary.
Optional `--provider-scope FILE --approve-transmission-sha SHA256` instead binds exact reviewed read entries, their selected-content digest, and a write subset, then stages only selected entries in a fresh owner-private mode-`0700` Gitless provider cwd.
The primary `workflow.sh run` facade has no implicit transmission mode: launch requires either `--approve-whole-worktree MANIFEST_SHA256` or the scoped pair above. The deprecated `--approve-preview-sha` spelling cannot launch by itself and remains temporarily available only with `--legacy-preview-approval`.
The controller still locally enumerates and validates worktree paths and the scope policy before staging; scoped mode is not a filesystem, network, `PATH`, `HOME`, or same-UID sandbox and retains the documented local-owner and mutation-race residuals.
Provider-scope approval grants neither provider execution, Git action, driver acceptance, nor publication.
Before each launch, ensure secrets, credentials, private keys, user-denied paths, and unrelated private files are absent from every entry approved for provider transmission; telling the worker not to read an approved entry is not a control.

Keep raw worker logs and local controller state outside the worktree and out of prompts.
Installation does not authorize provider transmission, Git actions, publication, or
acceptance.

Before every provider-launch attempt (initial start/run, resume, continue, and restart), tell the user in one or two concise user-facing sentences what task is being sent to AGY.
Include a short public-safe task label, caller-selected model information, caller-selected effort when separately selectable, and the exact resolved model slug.
For default selection where no model is selected or the default tier is used, state truthfully that the provider default model is used and that model or effort is unresolved, without inventing a resolved slug or thinking level.
For fixed/compound/literal models where effort is not separately selectable, state that accurately without inferring backend reasoning or inventing a thinking level.
The notice must precede every dispatch attempt and remain accurate afterward.
If preflight fails before provider launch, explicitly state that the task was not sent to AGY.
If provider reach is genuinely uncertain, state that it is unverified rather than claiming success.
Direct model and effort selection remain caller-owned; recommendations are advisory.

For the complete transmission, environment, verifier, and compatibility boundaries,
read [Security and compatibility](references/SECURITY_AND_COMPATIBILITY.md).

## Route the request

| User intent | Workflow | Default cycle budget | Driver responsibility |
|---|---|---:|---|
| Explore, understand, review, or plan | `explore` | 2 | Spot-check material claims and state coverage limits. |
| Implement a feature, refactor, tests, or a bounded repair | `task` | 2 | Inspect the diff and run relevant project checks. |
| Build a project or perform broad audit-and-fix work | `project` | 5 | Review repo-wide changes and run build/test/lint as applicable. |

`explore` and `task` accept `1..2` cycles; `project` accepts `1..5`. Personas
are optional prompt specializations, not capability, approval, or quality gates. Do
not route ordinary work through compatibility evidence or data-only profile commands.

For material UX, lifecycle, trust-boundary, security, data-semantics, or other domain plans:
A coordinator and suitable domain expert must co-plan.
Freeze user journeys, acceptance tests, and authority/privacy constraints before implementation.
The final acceptor must be a different agent or fresh context; no planner or implementer may self-accept.
Purely mechanical changes are exempt.
Verification v2 and the controller bind candidate evidence, not agent identity or governance.
The final human-readable handoff must report the planner/reviewer separation.

Explicit delegation-first requires running the `delegation-policy.sh` evaluator before substantive repository work.
The controller records are local: the runtime cannot infer prior work or approval and
must never silently authorize direct-Codex fallback after a missing approval, hard
stop, preflight failure, provider failure, or exhausted budget. Direct-Codex and
second-eye work remain explicit policy choices.

## Use the primary lifecycle

Prefer the portable `workflow.sh` facade for `run --preview`, approved `run`,
read-only `status`, and `verify-finalize`. For ordinary use, supply only an absolute
repository and job ID; optional `--base` overrides the first-call `HEAD` binding. The
facade derives owner-private state