Module canary 

The delivery canary (D-13): the guard that notices when the undocumented CLI behaviour this whole arc rests on has gone away.

Why a planted token rather than a version check

Claude Code’s task-notification delivery — the CLI waking a live session back up after a background task finishes — is undocumented behaviour, observed only on claude_code_version 2.1.220. A CLI update can withdraw it without any announcement, and if it is withdrawn then every multi-plan wave silently orphans its dispatched work: exactly the 999.64 shape this phase exists to close. Reading the version string would guard a proxy for the behaviour, not the behaviour, and would go on reporting healthy the moment the same version number stopped meaning the same thing. So the guard plants a value only DevFlow knows and confirms it comes back.

What a Confirmed outcome does and does not mean

It means the notification path is alive. It NEVER means the dispatched work happened. The agent can read the token out of its own prompt and emit it without doing anything at all — that is 999.67’s shape, accepted here deliberately (threat T-31-11) rather than mitigated, because mitigating it needs per-child tokens and D-14 defers those on size. Summaries and merges remain the evidence of work (D-16/D-18). Nothing in this module may be rephrased to imply otherwise.

Where the trust decision is made

Not here. The CLI echoes the operator’s prompt back into the same stdout as a user event, so the planted token will appear in the capture whether or not anything was delivered — that echo is what produced the checkpoint false positive 30-05 had to fix. The question “did this token come back from somewhere trustworthy?” is therefore answered by exactly one function in this codebase, crate::agent_result::token_reported_in_capture, which confines the match to events that are both type: "result" and orchestrator-authored. This module delegates to it and holds no notion of its own about which lines are trustworthy — a second such notion would be free to drift away from the first, and the drift would be invisible.

Structs

AntigravityCanaryLauncher

The Antigravity delivery canary (round-3 B2/D-07): one throwaway agy turn over the SAME bidirectional stream-json transport a production Antigravity stage uses, with the agent-aware first turn (monitor::user_turn_line_for) and close rule (CloseRule::for_agent). The trust decision stays in run_delivery_canary, which now resolves it agent-aware via agent_result::token_reported_in_capture_for.

ClaudeCanaryLauncher

The real launcher: runs one throwaway claude turn over the same bidirectional stream-json transport a production stage uses.

Enums

CanaryOutcome

What one canary run established.

Constants

TOKEN_PREFIX

The fixed, greppable prefix every declared canary token carries.

Traits

CanaryLauncher

How the canary gets a child to talk to.

Functions

antigravity_cli_version

The agy --version string, for the run’s provenance — the Antigravity counterpart of claude_cli_version. agy --version reports the CLI version WITHOUT invoking the model, so the -p --help hazard (a Go-flag string flag that swallows the next token) does not apply to --version.

canary_capture_path

Where one canary run’s throwaway capture lands.

canary_prompt

The throwaway prompt: dispatch one trivial background task, wait for its completion notification, and only then report.

claude_cli_version

The claude --version string, for the run’s provenance.

declare_token

Declare a fresh success token for one canary run.

run_delivery_canary

Run one delivery canary and report what it established.