feat(kits): add Codex and Antigravity gateway kits

.github/codex-antigravity-pr-draft.md

@@ -0,0 +1,71 @@
+## Summary
+
+Add independently installable experimental Codex and Google Antigravity (`agy`)
+agent kits consuming acq's neutral configured Chat Completions provider input.
+No USAi-specific endpoints, model catalogs or credential values are embedded.
+
+- Codex 0.166.0: per-invocation authenticated Responses facade, exact-ID native catalog.
+- Antigravity 1.4.12: per-invocation authenticated Gemini facade, custom-model settings.
+- Standard-library runtime; no new third-party runtime dependencies.
+- Six-kit CI matrix, Python 3.12 coverage and repeatable credential-free real-CLI verifier.
+- No changes to existing kits' runtime behavior or Paseo's configuration/catalog.
+
+## Context and plan
+
+Existing provider kits publish Chat Completions-compatible facts/catalogs.
+Neither agent's native wire API matches that contract. Keep adaptation in each
+agent kit, preserve exact IDs, scope translation to text/function tools and
+reject unsupported behavior. Design records live with each kit.
+
+This branch is based on main and reuses the merged Claude kit's shared validation
+and executable-index guard. The PR adds only the two new kits and their shared
+test/CI wiring.
+
+## Verification transcript
+
+- `make check PATTERNS=<pinned-checkout> GITLEAKS=<pinned-binary>`: PASS.
+  Includes Ruff, formatting, ShellCheck, all six contracts, all offline suites,
+  28 shared tests, dependency audits, unsafe-shell and secret scanning.
+- Codex: 14 tests, PASS on Python 3.12 and 3.14.
+- Antigravity: 9 tests, PASS on Python 3.12 and 3.14.
+- `python3 scripts/verify-native-cli.py codex --binary <pinned-arm64-binary>`: PASS.
+- Equivalent Antigravity command: PASS.
+  Both execute real CLI file tools and verify exact IDs, tool results and final replies.
+- Separate Paseo 0.12.0 daemon, isolated HOME/port and local HTTPS synthetic provider:
+  both catalogs contain only `exact.test_model`; both real sessions complete with
+  `PASEO_KIT_OK`. Final code rerun PASS. Active user daemon was untouched.
+- Independent adversarial reviews: concrete findings fixed and regressions added;
+  final review reports no blockers within experimental text/function scope.
+
+These are real CLI/protocol/Paseo tests against synthetic model output, not live
+gateway/model-quality verification. Remote CI, native x64 and interactive PTY
+remain unverified. Terminal suspension/job control is unsupported.
+
+## Security impact
+
+New installation hosts and private loopback services. No published model ports,
+persisted keys, disabled TLS verification or global provider config writes.
+Upstream redirects are denied; installer redirects checked before following.
+Local auth token is separate from outbound correlation metadata. Tool/field
+translation uses a limited allowlist. Same-UID guest processes are not isolated.
+Paseo's Antigravity plugin uses full access; the kit's terminal wrapper does not
+enable that flag. The synthetic file fixture explicitly opts into it.
+
+## Limitations
+
+Buffered responses, text/function tools only, no media/native search/encrypted
+reasoning/server-side Responses state. Antigravity's fixed automatic thought
+envelope is explicitly ignored by the text/function policy; effort flags reject.
+CLI state uses kit-owned persistent directories; normal user-global config is
+not inherited. Generic Codex catalog instructions may affect model performance.
+
+## Rollback
+
+Revert this PR's commits. Remove the two kit references from future sandbox
+creation. Existing sandboxes are not modified automatically; do not delete
+conversation directories without operator consent.
+
+## AI assistance and review
+
+Implementation and verification were AI-assisted. Human review is required;
+this is not production approval or a compliance assertion.

.github/workflows/ci.yml

@@ -15,11 +15,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kit: [opencode-go-provider, pi-coding-agent, first-mate-skill, claude-code]
+        kit: [opencode-go-provider, pi-coding-agent, first-mate-skill, claude-code, codex, antigravity]
         python: ["3.14"]
         include:
           - kit: claude-code
             python: "3.12"
+          - kit: codex
+            python: "3.12"
+          - kit: antigravity
+            python: "3.12"
     steps:
       - name: Check out repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Makefile

@@ -3,6 +3,7 @@ VENV ?= .tmp/ci-venv
 PY := $(VENV)/bin/python
 PATTERNS ?= .patterns
 LINT_PATHS := scripts/validate-kits.py scripts/run-kit-tests.py scripts/tests claude-code/files claude-code/tests claude-code/scripts/test claude-code/scripts/verify
+LINT_PATHS += codex/files codex/tests codex/scripts antigravity/files antigravity/tests antigravity/scripts scripts/verify-native-cli.py
 GITLEAKS ?= gitleaks
 
 .PHONY: setup check lint test validate security
@@ -18,6 +19,7 @@ lint:
 	$(PY) -m ruff check $(LINT_PATHS)
 	$(PY) -m ruff format --check $(LINT_PATHS)
 	shellcheck claude-code/files/home/.local/bin/claude
+	shellcheck codex/files/home/.local/bin/codex antigravity/files/home/.local/bin/agy
 
 validate:
 	$(PY) scripts/validate-kits.py --patterns $(PATTERNS)
@@ -32,4 +34,7 @@ security:
 	$(PY) $(PATTERNS)/scripts/scan_unsafe_shell.py claude-code
 	$(GITLEAKS) dir --redact --no-banner --log-level warn claude-code
 	$(GITLEAKS) dir --redact --no-banner --log-level warn scripts
+	$(PY) $(PATTERNS)/scripts/scan_unsafe_shell.py codex antigravity
+	$(GITLEAKS) dir --redact --no-banner --log-level warn codex
+	$(GITLEAKS) dir --redact --no-banner --log-level warn antigravity
 	$(GITLEAKS) git --redact --no-banner --log-level warn .

README.md

@@ -61,6 +61,8 @@ An agent kit is a `hybrid/v1` mixin that:
 | Kit | Kind | Provides | Status |
 | --- | --- | --- | --- |
 | [`claude-code/`](claude-code/) | Agent | Pinned Claude Code + private Messages-to-Chat-Completions proxy for a configured OpenAI-shaped model provider | **Experimental** — operator-verified on ARM64 MSB; x64 execution pending; browser model picker overstates availability |
+| [`codex/`](codex/) | Agent | Pinned Codex + private Responses-to-Chat-Completions bridge | **Experimental** — real ARM64 CLI and isolated Paseo verified against synthetic provider; live gateway and x64 pending |
+| [`antigravity/`](antigravity/) | Agent | Pinned Google agy + private Gemini-to-Chat-Completions bridge | **Experimental** — real ARM64 CLI and isolated Paseo verified against synthetic provider; live gateway and x64 pending |
 | [`opencode-go-provider/`](opencode-go-provider/) | Provider | OpenCode Go (`openai-compatible`) facts and a 19-model neutral catalog | **Preview** — blocked on the acq credential-binding addition |
 | [`pi-coding-agent/`](pi-coding-agent/) | Agent | Pinned pi CLI + `~/.pi/agent/models.json` renderer | **Preview** — live verification pending acq PR 611 |
 | [`first-mate-skill/`](first-mate-skill/) | Skill | The `paseo-first-mate` Agent Skill and two helper scripts, dropped into `~/.agents/skills` | Offline-verified; no live sandbox run |
@@ -87,6 +89,21 @@ models in the Go docs endpoint table plus one active free/experimental alias
 Each kit directory has its own README with specific details and a
 TROUBLESHOOTING guide.
 
+Codex and Antigravity consume the same neutral provider contract as the other
+agent kits. Their native APIs differ, so each owns a text/function compatibility
+bridge. They do not claim that Chat Completions, Responses and Gemini APIs are
+interchangeable. Neither writes a second Paseo model catalog.
+
+For repeatable real-CLI protocol/tool tests without credentials:
+
+```bash
+python3 scripts/verify-native-cli.py codex --binary /path/to/pinned/codex
+python3 scripts/verify-native-cli.py antigravity --binary /path/to/pinned/agy
+```
+
+These tests use isolated synthetic transports and actually execute a fixture
+file tool. They do not prove remote model quality or acq sandbox creation.
+
 ## Layout
 
 ```text

antigravity/README.md

@@ -0,0 +1,63 @@
+---
+title: Antigravity gateway kit
+description: Google agy CLI over a configured Chat Completions provider
+status: draft
+tier: 3
+---
+
+# Antigravity gateway kit
+
+**Experimental; not ready for deployment.** Installs Google's `agy` CLI 1.4.12
+on Linux ARM64 or x64—not the Antigravity editor launcher. Paseo supports it via
+its Antigravity provider plugin. Each invocation translates Gemini requests to
+the configured OpenAI-shaped model provider's **Chat Completions** endpoint.
+
+## Use
+
+```bash
+export ACQ_EXTRA_KIT_SOURCES="github.com/mogul/"
+acq run antigravity /path/to/project --kit '<provider-kit>' --kit 'git+https://github.com/mogul/agentic-coding-kits.git#ref=<sha>&dir=antigravity'
+```
+
+Provider facts and credentials must be materialized by acq. With multiple
+providers set `ACQ_ANTIGRAVITY_PROVIDER`. `ACQ_ANTIGRAVITY_MODEL` and
+`ACQ_ANTIGRAVITY_SMALL_MODEL` select exact configured IDs. The wrapper's
+`agy models` reports those IDs for Paseo discovery. No global Paseo configuration
+or Google login is written. CA trust is supplied separately.
+
+## Limitations
+
+- The native terminal picker may show more models than the configured
+  OpenAI-shaped model provider supports. Choose an exact configured ID;
+  unsupported selections fail rather than route to a similarly named model.
+- `customModelsConfig` selects exact IDs, but the CLI still speaks Gemini.
+  Internal `gemini-3.1-flash-lite-preview` housekeeping requests with no tools
+  explicitly route to the configured small/default model. This is separate
+  from user model selection.
+- Text and ordinary function tools only; media, native Gemini search and
+  thinking features are not supported. Upstream responses are buffered.
+  agy 1.4.12 always requests automatic thought output for custom models; the
+  kit explicitly ignores that automatic envelope in its text/function mode.
+  No thought output or reasoning-effort guarantee is provided. Explicit effort
+  flags and non-default thinking settings are rejected.
+- **Paseo's plugin launches agy with full access and no permission prompts.**
+  The kit does not add that flag for terminal use. An acq microVM remains the
+  external boundary; do not assume a CLI plan mode is a filesystem sandbox.
+- Persistent conversations use `~/.local/state/acq/antigravity` as their HOME.
+  Terminal suspension/job control (Ctrl-Z, shell `fg`/`bg`) is not supported
+  by the wrapper; use interruption or exit instead.
+  This intentionally separates Google credentials and state from other agents,
+  but user-global skills/configuration outside that HOME are not inherited.
+- No credentials are persisted. The wrapper holds the upstream key; agy gets
+  only a random per-invocation loopback token. Same-UID processes are not isolated.
+
+## Verification and license
+
+Run `python3 scripts/test`. See [verification](docs/verification.md) and
+[design](docs/decisions/0001-session-bridge.md). Real ARM64 CLI custom-ID file-tool
+turns and isolated Paseo sessions passed against a synthetic provider. Live
+gateway, interactive PTY and x64 execution remain unverified.
+
+Kit code is MIT. Antigravity is a separately downloaded proprietary Google
+product; installation does not grant rights beyond its upstream terms.
+Official product: <https://antigravity.google>.

antigravity/docs/decisions/0001-session-bridge.md

@@ -0,0 +1,29 @@
+---
+title: Use an invocation-owned Gemini bridge
+description: Route agy custom models to acq Chat Completions providers
+status: draft
+tier: 2
+date: 2026-10-31
+---
+
+# Use an invocation-owned Gemini bridge
+
+## Context and options
+
+agy 1.4.12 rejects modelProvider=openai, but accepts session-only Gemini
+settings and customModelsConfig.customModels. Considered native OpenAI routing
+(not supported in the live probe), global Google settings (collides with other
+agents), and an invocation-owned bridge with a dedicated persistent HOME.
+
+## Decision
+
+Prototype the bridge. Keep exact custom deployment IDs and expose those through
+the wrapper's model discovery. Explicitly route internal lightweight housekeeping
+to the configured small model. Use standard-library HTTPS with redirects denied.
+
+## Consequences
+
+No runtime dependency install, Google login or global Paseo writer. This loses
+global CLI configuration/skill inheritance and requires a limited Gemini mapping.
+Media/reasoning/native search are unsupported. Paseo's upstream plugin uses full
+access; external workspace isolation and human review remain essential.

antigravity/docs/verification.md

@@ -0,0 +1,33 @@
+---
+title: Antigravity verification
+description: Observed native routing and remaining release gates
+status: draft
+tier: 3
+---
+
+# Verification
+
+The official 1.4.12 ARM64 archive matched the versioned Google manifest's
+SHA-512. `agy --help` ran. A synthetic HTTP probe observed a request to
+`/v1beta/models/test-model:streamGenerateContent` for an exact custom ID,
+plus a separate lightweight housekeeping request.
+
+The real CLI subsequently completed a text turn and a file-tool turn against a
+synthetic transport. `python3 scripts/verify-native-cli.py antigravity --binary
+<pinned-binary>` repeats the exact-ID/function/file/result path without credentials.
+The native default headless mode denied a write; explicit full access in the
+isolated fixture allowed it. Kit terminal defaults were not weakened.
+
+A separate Paseo 0.12.0 daemon, isolated HOME and ephemeral loopback port
+discovered only `exact.test_model` and completed a real Antigravity session
+returning `PASEO_KIT_OK` through the staged wrapper and a local HTTPS synthetic
+provider. Offline checks and all six repository contracts passed.
+
+Final `make check` passed: lint/format, ShellCheck, all six contracts and all
+kit/shared tests, dependency audits and secret scans. The nine Antigravity
+tests passed on Python 3.12 and 3.14. Final adversarial review found no blockers
+within the experimental text/function scope. The native verifier and isolated
+Paseo session were rerun with final code and passed.
+
+Remaining gates: remote GitHub CI, interactive PTY, x64 and live gateway.
+These synthetic tests prove wiring, not remote model behavior or quality.

antigravity/files/home/.local/bin/agy

@@ -0,0 +1,3 @@
+#!/bin/sh
+set -eu
+exec python3 "$HOME/antigravity-kit/launch.py" "$@"