Add controller-mediated Gemini self-verification before Codex review

[cagdasyurekli]

Context

agy-worker currently keeps provider shell tools in a scratch directory and treats worker-reported commands and tests as untrusted claims. Codex runs the real repository checks after receiving a candidate and feeds failures back through the bounded same-conversation repair loop.

Problem

A worker can return a plausible but unverified candidate before seeing real test results. This spends Codex review time on integration failures that Gemini could repair first if it received bounded, trustworthy test feedback without gaining arbitrary repository shell authority.

Proposed improvement

Add a controller-mediated self-verification phase before Codex review:

• Define canonical allowlisted test IDs backed by structured argv manifests.
• Let Gemini request only those test IDs; never execute worker-supplied shell text.
• Run selected checks in a separate Git-less verification copy with a minimal environment, network disabled by default, time/output limits, process-group cleanup, and no access to credentials or Git administration.
• Bind the source candidate, verification-copy digest, test manifest, argv, and results to controller state.
• Return only bounded sanitized results to the same Gemini conversation.
• Let Gemini repair and request another allowed check within the existing cycle/time budget.
• Present the candidate to Codex for independent diff review and driver-owned final verification only after the self-verification phase is green or explicitly exhausted/blocked.

Worker confidence and self-verification remain non-authoritative. Codex’s independent checks and assurance disposition remain mandatory.

Non-goals

• Direct arbitrary shell access for Gemini.
• Executing commands_run or tests_run from a worker envelope.
• Weakening qa-gate, candidate binding, path policy, or final Codex acceptance.
• Implicit network, credential, package-install, model-change, retry, Git, or publication authority.

Acceptance criteria

• Structured test IDs resolve deterministically to reviewed argv; unknown, duplicated, stale, or drifted IDs fail closed.
• Tests run only in a Git-less isolated verification copy and cannot mutate the candidate.
• Environment, network, timeout, output, signal, process-group, symlink, special-file, and path boundaries have positive and negative offline coverage.
• Sanitized feedback contains no prompt, source content, secrets, absolute private paths, raw logs, or unrestricted command text.
• Same-conversation repair preserves the frozen task, model/effort, authority, candidate lineage, and cycle/time budget.
• Codex independently reviews the final diff and reruns the required owning checks; Gemini success alone never produces verified.
• Root wrappers and packaged runtime remain byte-synchronized.
• Update SKILL.md, SECURITY_AND_COMPATIBILITY.md, REPO_MAP, lifecycle schemas, and durable lessons where behavior or trust claims change.
• Run focused suites, git diff --check, ground-truth.sh for AGY-facing behavior, one stable scripts/ci-offline.sh, agents-md-auditor, and an independent final review.