Agy Worker

Delegate repository work and verify the result

Use this skill when agy can usefully explore a repository, implement bounded work, or help with broader project changes. In normal use, delegate substantial exploration and implementation to agy before Codex duplicates it. Codex reads only scope and authority necessities, then spot-checks material findings and reviews the actual diff. Codex retains responsibility for scope, diff review, driver-owned checks, repair decisions, and final independent acceptance.

Resolve the installed package instead of guessing a checkout path:

PIPELINE="$(bash "$SKILL_ROOT/scripts/resolve-pipeline.sh")" || exit $?

"$PIPELINE/doctor.sh" --repo /absolute/path/to/target can check offline prerequisites before provider use. ready does not prove authentication, provider availability, task quality, or future job success. For package orientation, read the Package README.

Authorize provider work

Before a provider launch, obtain explicit human approval for the exact provider-readable content, transmission and isolation mode, task, caller-selected model, and budget. One exact upfront approval may cover predictable same-scope repairs and mechanical digest/state refresh; provider-launch notices are status, not repeated permission requests. Use initial --allow-scoped-repair for approved multi-turn scoped work. Approval is a human decision. Preview, transmission, state, candidate, and dispatch SHA values are mechanical bindings to that decision; refreshing a still-applicable binding is not another approval request. New scope, content exposure, destination, isolation, permissions or budget still require authority. Preserve required current raw-help/semantic version preflight on each launch; add no cache or alternate controller. Ordinary jobs require neither hand-authored JSON nor Goal as a prerequisite (Goal remains an ordinary-use opt-in).

Prefer --provider-scope FILE --approve-transmission-sha SHA256 for bounded jobs. It binds exact reviewed read entries, their selected-content digest, and a write subset, then stages only selected entries in a fresh owner-private mode-0700 Gitless provider cwd. Whole-worktree dispatch remains an explicit exception. New approvals bind content, kinds, permissions, symlink targets, and execution mode; the controller rechecks this binding before provider start. Legacy records keep their original contracts. Treat the entire disposable worktree passed as --workdir as worker-readable and potentially transmissible to Google/Gemini, regardless of requested edit paths; --add-dir, prompt denylist instructions, qa-gate --only, and --allow do not narrow that read boundary. Neither workflow.sh run nor the advanced agy-worker.sh initial dispatch has an implicit transmission mode: launch requires either --approve-whole-worktree LAUNCH_APPROVAL_SHA256 or the scoped pair above. The deprecated facade-only --approve-preview-sha spelling cannot launch by itself and remains temporarily available only with --legacy-preview-approval. New jobs default to --provider-isolation session, which uses the existing AGY session without AGY sandbox or native host containment. AGY has normal user filesystem/network authority; selected-file staging and reconciliation are not host isolation. Include this execution mode in the initial approval alongside task/content, then reuse that approval while its scope remains unchanged. Explicit --provider-isolation native retains supported macOS scoped containment with private HOME/TMP and reviewed network/Keychain access; it never falls back to session mode. The native /usr/bin/security exception allows broader same-user Keychain operations, and its listener rule permits wildcard binds. Read Security and compatibility for those limits. Preserve the job's selected mode across continuation and repair. Provider-scope approval grants neither provider execution, Git action, driver acceptance, nor publication. Before each launch, ensure secrets, credentials, private keys, user-denied paths, and unrelated private files are absent from every entry approved for provider transmission; telling the worker not to read an approved entry is not a control.

Keep raw worker logs and local controller state outside the worktree and out of prompts. Installation does not authorize provider transmission, Git actions, publication, or acceptance.

For the required user-facing provider-launch notice, including defaults, preflight failures, resumes, and continuation, read Project lifecycle and verification. Direct model and effort selection remain caller-owned; recommendations are advisory.