[MarkusNeusinger]

Summary

• Google's Antigravity FAQ ("Wrapping agy inside third-party coding agents or applications … is not supported under consumer plans") and a staff reply on 2026-10-16 (forum topic 189905: "No under consumer plans", even for the unmodified binary as a local subprocess) rule out the read-only agy -p second opinions docs(agents): delegation lanes and Gemini tasks through issues #12223 introduced. Claude stopped running agy on 2026-10-21.
• Second opinions and first PR reviews go through the new zweitmeinung project skill: .claude/skills/zweitmeinung/gemini_review.py calls Gemini through Vertex AI in project anyplot, location global (the site's agents stay on eu), with read-only tools over tracked repository files, prefetched data, and the public API; no shell, no credentials. The owner's split (2026-10-21/22): Gemini 3.8 Flash on Flex PayGo (half price) for routine first reviews, on probation against Copilot's findings; Gemini 4 Argon, thinking high, for plans and second opinions.
• Cost work after a comparison run on three merged PRs (feat(review): ordered colours, no redundant labels, readable titles #12203, feat(agent-chat): the data box shows what it waits for #12221, fix(deploy): one deploy per service at a time, oldest build first #12222): every tool turn re-sends the conversation, so --diff-base inlines the diff and changed files and read_files reads several files per call. Two loop bugs found there are fixed and pinned by tests: a text part beside the last function responses made Vertex answer 400, and a last turn without tools lost the implicit cache while Flash kept calling tools. The budget is now enforced through the tool responses with one tool configuration for all turns. Measured: Flash $0.07–0.28 per review, Argon $0.57–1.16.
• Flex gets 5 minutes per run (and per request); after that, or after a timeout or a 429/5xx, the run goes online (flex_fallback, per_turn_seconds). The SDK retries timeouts too: the first Flash review of this PR waited over an hour on 15-minute attempts, and with a 5-minute cap per request the next one still ran for over 25 minutes.
• Hardening after Copilot's reviews: a symlink is visible only when its target is itself a visible entry (a tracked review.txt -> .env exposed the untracked .env before), secret-name patterns apply to every path component of --data files, lock files stay out of the inlined diff and the diff is capped at 120,000 characters, a backtracking search pattern is stopped after 10 seconds, a line longer than the tool limit is cut instead of looping, and an unencoded URL is refused instead of crashing the run.
• gemini-task: Gemini pushes its gemini/* branch and opens a draft PR labelled gemini. CI runs on drafts, Copilot does not (review_draft_pull_requests: false in the ruleset), and Claude marks the draft ready after its own review. The owner may let Gemini run tests and builds unattended in his own agy session; only he starts agy.
• CLAUDE.md and .claude/guardrails.md describe the lanes and costs; the guardrail test anchors pin the obligations (Flash/Argon split, draft PRs only, Claude never runs agy).

Plan

N/A. The owner chose the Vertex route on 2026-10-21 after reading a research report on the policy, then the Flash/Argon split, the draft-PR hand-over, and moving the skill into the repository on 2026-10-22.

Test plan

• uv run pytest tests/unit tests/integration -n 8 (new tests/unit/test_gemini_review.py: confinement, http_get refusals, inlining caps, and the tool loop against a fake Vertex client)
• uv run ruff check . && uv run ruff format --check .
• uv run python -m tools.changelog check --base origin/main
• Flash smoke run with --max-turns 1 on Vertex: forced last turn answers (exit 0), traffic_type ON_DEMAND_FLEX
• Gemini 3.8 Flash first review of this PR through the repository script: 3 of 5 findings applied (owner-only PR comments for Gemini, git diff -z, *api_key*); 2 skipped (callers already resolve check_attachment's root, and the SDK returns finish_reason as an enum). Flex gave no answer on the first turn, so the run went online: 9 turns, $0.86.
• Copilot: three rounds on the rework, 9 findings, all applied

🤖 Generated with Claude Code

https://claude.ai/code/session_01GdMSqLR5ww4ji74EUSmk9M

[Copilot]

🟢 Approval recommended

The documentation and test anchors consistently implement the intended policy change, with no unresolved findings.

No open issues 🎉

What changed in this PR

Updates agent delegation guidance to use the Gemini API for second opinions, replacing the read-only agy route introduced in #12223.

Changes:

• Routes first reviews and second opinions through the Gemini API.
• Restricts agy use to owner-operated sessions.
• Updates instruction-test anchors and adds a changelog fragment.

File	Description
tests/​unit/​test_agent_instructions.py	Anchors the API route and prohibition on Claude running agy.
CLAUDE.md	Updates the delegation rule.
changelog.d/​gemini-api-second-opinion.md	Records the policy change.
.claude/​skills/​gemini-task/​SKILL.md	Clarifies owner-only agy use.
.claude/​guardrails.md	Updates delegation guidance and explains the policy rationale.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🟢 Approval recommended

The documentation and matching test-anchor changes are consistent, with no blocking issues identified.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Symlink aliases can expose excluded files, and review completion, prompt budgeting, and repeated hand-overs have unresolved failure cases.

5 open issues

• Validate resolved symlink targets against file allowlists · New
• Add migration for existing clone push URLs · New
• Restore refresh procedure for subsequent hand-overs · New
• Include patches in the inlining budget · New
• Reject final responses with pending function calls · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Model-supplied regular expressions can block synchronous searches and prevent the review’s turn and token safeguards from taking effect.

1 open issue

• Enforce timeouts for model-supplied regular expressions · New

5 resolved since last review

• Validate resolved symlink targets against file allowlists
• Reject final responses with pending function calls
• Include patches in the inlining budget
• Restore refresh procedure for subsequent hand-overs
• Add migration for existing clone push URLs

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The review script still has data-filtering and tool-error handling defects that need correction before approval.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Apply secret-name checks to every path component

.claude/​skills/​zweitmeinung/​gemini_review.py:120

[P2] Apply the secret-name patterns to directory components too. credentials/service-account.json and secrets/payload.json both pass this check, so files under those paths in --data become visible to Gemini; check_attachment accepts them as well. This bypasses the filename safeguard when sensitive material is accidentally included in a clearly named directory. Match every relative path component and add regression cases for nested directories.

Prevent non-advancing continuation on oversized lines

.claude/​skills/​zweitmeinung/​gemini_review.py:201

[P2] Avoid returning a continuation that cannot advance. If a line exceeds MAX_TOOL_CHARS, such as a single-line JSON file in prefetched data, this branch returns none of that line and tells Gemini to retry at the same start_line. Retrying produces the identical response and can waste the remaining tool budget; search also skips these lines. Return a clearly marked truncated excerpt and advance past that line, or support character-offset pagination. Add a regression case for an oversized first line followed by a normal line.

Handle malformed HTTP URLs as tool errors

.claude/​skills/​zweitmeinung/​gemini_review.py:280

[P2] Return a tool error for malformed HTTP URLs instead of aborting the review. A call with https://api.anyplot.ai/specs?search=bar plot passes the host/path checks but raises http.client.InvalidURL before connecting. Neither this handler nor run_tool catches it, so the paid review exits without writing its output file or usage summary. Catch HTTPException and add a regression case for an unescaped query.

1 resolved since last review

• Enforce timeouts for model-supplied regular expressions

_{Review effort: Balanced}