@aiwg/cli 2026.10.1 → 2026.10.4

package/agentic/code/providers/model-capabilities.v1.json

@@ -7,21 +7,229 @@
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
-      "identifierSyntax": "model identifier accepted by Antigravity CLI 1.1.26 --model",
+      "identifierSyntax": "model identifier accepted by Antigravity CLI 1.3.3 --model",
       "effortValues": [
         "low",
         "medium",
-        "high"
+        "high",
+        "xhigh",
+        "max"
       ],
       "inheritance": "Omitted model and effort inherit the invoking Antigravity session",
       "invalidPinFallback": "Provider validation/error; never assume fallback",
       "configTarget": "agy launch arguments; custom-agent model tiers are not projected from generic AIWG model ids",
       "artifactFormat": "YAML frontmatter plus Markdown; runtime --model and --effort flags",
-      "verification": "Pinned offline contract; authenticated model selection was not executed",
+      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed",
       "sourceUrl": "https://antigravity.google/docs/cli/subagents/",
-      "verifiedAt": "2026-09-04"
+      "verifiedAt": "2026-09-04",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "antigravity",
+        "provider": "antigravity",
+        "adapterVersion": "1",
+        "supportedVersions": "1.3.3",
+        "runtimeDriver": "installed:antigravity",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "agy",
+          "argv": [
+            "--input-format",
+            "stream-json",
+            "--output-format",
+            "stream-json",
+            "--model",
+            "${model}",
+            "--effort",
+            "${effort}",
+            "--sandbox",
+            "--disable-slash-commands"
+          ],
+          "stdin": "adapter-frame",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "GEMINI_API_KEY",
+            "HOME"
+          ],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "read-only"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "1.3.3",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[--model MODEL] exact observed model id, never 'auto'/'default' or a generic Ralph-loop alias",
+                "evidence": "H: agy 1.3.3 --help documents --model <MODEL> with no enum; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "[--effort low|medium|high|xhigh|max], always explicit",
+                "evidence": "H: agy 1.3.3 --help documents --effort (low|medium|high|xhigh|max); D (strings): changelog fixes confirm both --model and --effort were previously silently ignored and now apply; unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "[--sandbox] always emitted (bare boolean, no mode argument documented); only the read-only contract is accepted — write is unavailable because no verified non-blanket write-approval flag is evidenced (--mode accept-edits scope is unconfirmed; --dangerously-skip-permissions is a blanket bypass and is never emitted)",
+                "evidence": "H: agy 1.3.3 --help documents --sandbox ('Run in a sandbox with terminal restrictions enabled'), --mode (accept-edits, plan) and --dangerously-skip-permissions ('Auto-approve all tool permission requests'); unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable as a non-bypass flag: a bare headless run (neither --mode nor --dangerously-skip-permissions) soft-denies a tool permission request and prints a stderr notice rather than hanging or silently approving",
+                "evidence": "D: strings-read changelog v1.1.3: \"Fixed headless (-p) runs hanging or silently auto-approving tools that require a permission confirmation, so the CLI now soft-denies such tools and prints a stderr notice naming the allow-rule needed to permit them.\"; this quote establishes NEITHER exit code 0 NOR a SUCCESS terminal by itself; exact notice text not evidenced, see pitfalls; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "no --cwd/--workspace flag is documented; the conductor process cwd is the implicit workspace (agy's own default), optionally extended by --add-dir (never emitted by this profile)",
+                "evidence": "H: agy 1.3.3 --help documents --add-dir ('Add a directory to the workspace (repeatable)') but no primary-workspace-path flag; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable as a file target: no output-file flag is documented; the final is the terminal event.result.response of the captured --output-format stream-json stdout stream",
+                "evidence": "H: agy 1.3.3 --help documents --output-format <text|json|stream-json> with no file-path argument; D (strings, changelog v1.1.8): \"typed init, step_update, and terminal result events\"; live fix-round-1 conductor probe C (2026-10-11): `echo probe | agy --print= --output-format stream-json` returned the stdout line `{\"event\":\"result\",\"result\":{\"conversation_id\":\"\",\"status\":\"ERROR\",\"response\":\"\",\"error\":\"Error: empty prompt. Usage: agy --print \\\"your prompt here\\\"\"}}`, confirming event/result.status/result.response/result.error field names on a real ERROR terminal (no model reached; proves grammar only, not a SUCCESS shape or exit code 0); SUCCESS/init/step_update field shapes remain carried forward from tools/providers/antigravity-transport.mjs and worker-health.mjs observeProviderHealthEvent('antigravity', ...), not independently re-confirmed against 1.3.3 by a live SUCCESS run; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "adapter-frame: the installed adapter supplies exact bounded stdin bytes: one NDJSON line {\"event\":\"user\",\"message\":<brief>} on stdin, then EOF; no --print flag and no prompt value are ever emitted (--print requires a value, swallows the next argv token when omitted, and still hard-errors on an explicit empty value)",
+                "evidence": "R: live, fix round 1, conductor probes A/B/C/D/E, 2026-10-11, no login reached. (A) `agy --print --output-format bogus-format </dev/null` -> \"Error: --print took \\\"--output-format\\\" as its prompt...\"; (B) `agy --output-format bogus-format --print </dev/null` -> \"flag needs an argument: -print\"; (C) `--print=` -> \"Error: empty prompt...\"; (D)/(E) `--input-format stream-json --output-format stream-json` with or without `--print` omitted entirely both pass argument validation and reach the same auth stop. D (strings, extraction: ssh noodle 'strings -n 8 ~/.local/bin/agy | grep -n \"stream input\"'): \"stream input message is missing the \\\"event\\\" field\", \"stream input message event %q is not supported yet\", \"stream input \\\"user\\\" message is missing the \\\"message\\\" field\" fix the NDJSON input envelope field names; unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "--json-schema exists but is never emitted by this profile (no fixed schema is defined for the direct worker contract)",
+                "evidence": "H: agy 1.3.3 --help documents --json-schema ('enforce structured output ... for stream-json, only applicable to the final result'); unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step/turn cap flag is evidenced; --print-timeout bounds wall time only (always emitted as 0, i.e. wait for completion)",
+                "evidence": "H: agy 1.3.3 --help documents --print-timeout ('0 waits until the turn completes (default 0s)') and no step-cap flag; unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unavailable: no workspace-trust flag is documented for this CLI",
+                "evidence": "H: agy 1.3.3 --help advertises no trust flag; unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: --agent (custom agent/subagent selection) is never emitted by this profile; no fan-out flag for --print is documented",
+                "evidence": "H: agy 1.3.3 --help documents --agent ('Agent for the current CLI session') but this profile never selects one; unqualified until live evidence"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no fallback-model flag is documented",
+                "evidence": "H: agy 1.3.3 --help advertises no fallback-model flag; unknown controls block tasks requiring them"
+              }
+            },
+            "envAllowlist": [
+              "GEMINI_API_KEY",
+              "HOME"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "--dangerously-skip-permissions and --remote-control are never part of the direct profile; neither was ever shipped as a new argv-prompt path.",
+              "A soft-denied tool permission request (exit 0, stderr notice naming the allow-rule needed) is NOT the same as success; its exact stderr wording is not evidenced from help or changelog, so this is an open, honestly-marked detection gap rather than an invented check (tools/ralph-external/lib/antigravity-adapter.mjs ANTIGRAVITY_SOFT_DENY_RISK_NOTE).",
+              "GEMINI_API_KEY in envAllowlist is a strings-sourced GUESS, not confirmed to authenticate this CLI. Live fix-round-1 probes (D/E, no login present) show a bare run stops at \"Error: authentication required. Run 'agy' to log in, then retry.\" — this is an interactive Google-account login, not a documented env-key or OpenRouter-style flag. The manual smoke run is BLOCKED until an operator completes an interactive `agy` login on the target host.",
+              "The 1.3.3 --effort enum (low|medium|high|xhigh|max) supersedes the stale 1.1.26-pinned three-value set in tools/providers/antigravity-transport.mjs (a separate, unedited legacy transport used by the MCP/doctor bridge, not this direct-shell profile).",
+              "Flag validation happens BEFORE auth: live probe F, `agy --print=x --input-format bogus --output-format stream-json`, returned \"Error: unknown --input-format \\\"bogus\\\" (want text or stream-json)\" without reaching the auth stop, confirming --input-format is validated against exactly {text, stream-json} independent of login state.",
+              "The brief reaches agy through adapter-frame: the installed buildWorkerStdinFrame hook supplies exactly one NDJSON user message and EOF. The stdin control stays unqualified pending one authenticated smoke run."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-antigravity-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct step_update DONE"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/antigravity/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "R",
+                "D"
+              ],
+              "provenance": [
+                {
+                  "kind": "repository",
+                  "ref": "agentic/code/providers/antigravity/provider-contract.v1.json",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                },
+                {
+                  "kind": "documentation",
+                  "ref": "03-software-architecture.md §10 antigravity",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-43",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "claude": {
+      "sessionEnvAllowlist": [
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_AUTH_TOKEN",
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_MODEL",
+        "CLAUDE_CONFIG_DIR",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "CLAUDE_CODE_DISABLE_1M_CONTEXT",
+        "CLAUDE_CODE_USE_BEDROCK",
+        "CLAUDE_CODE_USE_VERTEX",
+        "AWS_PROFILE",
+        "AWS_REGION",
+        "AWS_DEFAULT_REGION",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "AWS_CONFIG_FILE",
+        "AWS_SHARED_CREDENTIALS_FILE",
+        "GOOGLE_APPLICATION_CREDENTIALS",
+        "ANTHROPIC_VERTEX_PROJECT_ID",
+        "CLOUD_ML_REGION"
+      ],
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
@@ -37,9 +245,220 @@
       "artifactFormat": "YAML frontmatter plus Markdown",
       "verification": "Inspect deployed frontmatter and bounded invocation metadata",
       "sourceUrl": "https://code.claude.com/docs/en/sub-agents",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "claude-direct",
+        "provider": "claude",
+        "adapterVersion": "1",
+        "supportedVersions": "2.1.295",
+        "runtimeDriver": "installed:claude",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "claude",
+          "argv": [
+            "--print",
+            "--input-format",
+            "text",
+            "--output-format",
+            "stream-json",
+            "--verbose",
+            "--model",
+            "${model}",
+            "--effort",
+            "${effort}",
+            "--permission-mode",
+            "dontAsk",
+            "--permission-prompts",
+            "none",
+            "--restricted",
+            "--safe-mode",
+            "--strict-mcp-config",
+            "--mcp-config",
+            "{\"mcpServers\":{}}",
+            "--tools",
+            "Read,Glob,Grep,Edit,Write",
+            "--allowedTools",
+            "Read,Glob,Grep,Edit,Write",
+            "--disallowedTools",
+            "Agent,Task,Bash,PowerShell,REPL,WebFetch",
+            "--disable-slash-commands",
+            "--no-chrome",
+            "--no-session-persistence"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "HOME",
+            "PATH",
+            "ANTHROPIC_API_KEY"
+          ],
+          "versionPattern": "^([0-9A-Za-z.+-]{1,128}) \\(Claude Code\\)$",
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "requested",
+          "effort": "explicit",
+          "cancel": "process-group",
+          "resume": false,
+          "sandboxModes": [
+            "read-only",
+            "workspace-write"
+          ],
+          "nestedAgentsControllable": true,
+          "nativeFallbackControllable": true,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "2.1.295",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--model ${model}; moving aliases denied",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --model <model>                       Model for the current session. Provide; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--effort ${effort}; explicit low/medium/high/xhigh/max",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --effort <level>                      Effort level for the current session (low, medium, high, xhigh, max); full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "partial: --restricted confines whitelisted file tools, scoped by --tools/--allowedTools (workspace-write: Read,Glob,Grep,Edit,Write; read-only: Read,Glob,Grep); OS sandbox unavailable in CLI, external boundary required",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --restricted                          Restricted mode: removes the built-in tools that run commands or code; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--permission-mode dontAsk --permission-prompts none; prompting and bypass modes denied",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --permission-prompts <target>         Who answers permission prompts with --print: \"host\" (the SDK host or --permission-prompt-tool) or \"none\" (nobody: anything that would prompt is denied automatically; the permission mode still decides everything else); full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "spawn cwd from conductor; no invented --cwd flag",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); Usage: claude [options] [command] [prompt]; no workspace switch is emitted; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "parse exactly one success result envelope from stdout; result JSON text or structured_output; exit-zero error fails",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --output-format <format>              Output format (only works with --print): \"text\" (default), \"json\" (single result), or \"stream-json\" (realtime streaming); full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "--input-format text; brief-text on stdin through EOF; never prompt argv",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --input-format <format>               Input format (only works with --print): \"text\" (default), or \"stream-json\"; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable in current renderer: CLI --json-schema exists but schema input is not passed to this driver",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --json-schema <schema>                JSON Schema for structured output validation.; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: --max-turns is not listed by installed help; never emitted",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); No --max-turns line appears in claude 2.1.295 --help; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "--print --safe-mode --restricted --setting-sources \"\" --strict-mcp-config --mcp-config {\"mcpServers\":{}}; inherited customization disabled",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --safe-mode                           Start with all customizations (CLAUDE.md, skills, installed plugins, hooks, MCP servers, custom commands and agents, output styles, workflows, custom themes, keybindings, and more) disabled; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "--tools/--allowedTools Read,Glob,Grep,Edit,Write (workspace-write) or Read,Glob,Grep (read-only) --disallowedTools Agent,Task,Bash,PowerShell,REPL,WebFetch; no child/command tool or external MCP",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --tools <tools...>                    Specify the list of available tools from the built-in set.; full verbatim excerpts: docs/providers/claude-direct.md"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "exact model; --safe-mode; never emit --fallback-model; model substitutions do not qualify the profile",
+                "evidence": "H: claude 2.1.295 --help (2026-10-09); --fallback-model <model>              Enable automatic fallback to specified model(s) when the default model is overloaded or not available.; full verbatim excerpts: docs/providers/claude-direct.md"
+              }
+            },
+            "envAllowlist": [
+              "HOME",
+              "PATH",
+              "ANTHROPIC_API_KEY"
+            ],
+            "pitfalls": [
+              "Help syntax and fake mechanics are not live qualification; this registry entry stays unqualified.",
+              "CLI file-tool restrictions do not supply an OS sandbox. The current shared Claude policy requires an external enforcing boundary.",
+              "Final output is the captured .stdout JSONL stream, not a CLI-created finalPath file. Normalize with ClaudeAdapter.parseWorkerFinal before verification.",
+              "Unavailable: renderer schema input, help-evidenced turn cap, native MCP reasoning worker. claude mcp serve exposes only debug/help/verbose and is a code-tools server.",
+              "Commands, Agent/Task, inherited MCP, hooks, plugins and skills are disabled in this restricted file-tools profile.",
+              "Bare mode is not used: installed help states it changes auth to API-key-only. No account or credential files were inspected."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-claude-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct completed tool_result"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/claude/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "docs/providers/claude-direct.md",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "2.1.295"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "test/fixtures/providers/claude/health/manifest.json",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-28",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "codex": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "CODEX_API_KEY",
+        "OPENAI_BASE_URL",
+        "OPENAI_ORG_ID",
+        "OPENAI_PROJECT_ID",
+        "CODEX_HOME"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -57,9 +476,206 @@
       "artifactFormat": "Standalone TOML custom-agent configuration",
       "verification": "Parse TOML and load in Codex custom-agent registry",
       "sourceUrl": "https://learn.chatgpt.com/docs/agent-configuration/subagents",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "codex",
+        "provider": "codex",
+        "adapterVersion": "1",
+        "supportedVersions": ">=0.161.0 <0.200.0",
+        "runtimeDriver": "installed:codex",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "codex",
+          "argv": [
+            "--no-daemon",
+            "exec",
+            "--ignore-user-config",
+            "-m",
+            "${model}",
+            "-c",
+            "model_reasoning_effort=\"${effort}\"",
+            "-s",
+            "${sandbox}",
+            "-C",
+            "${workspace}",
+            "-c",
+            "approval_policy=\"${approval}\"",
+            "--skip-git-repo-check",
+            "-o",
+            "${final}",
+            "--json",
+            "-"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "CODEX_HOME",
+            "HOME"
+          ],
+          "versionPattern": "^codex-cli ([0-9A-Za-z.+-]{1,128})$",
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": ">=0.161.0 <0.200.0",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[-m/--model MODEL] global flag; exact observed API model, never an alias or CLI default",
+                "evidence": "H: codex-cli 0.161.0 exec --help documents -m/--model; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "[-c model_reasoning_effort=\"E\"] config override with E in [minimal, low, medium, high, xhigh]; no --effort flag exists; one argv token, TOML \"E\" quoting, no shell layer",
+                "evidence": "H: codex-cli 0.161.0 exec --help has no effort flag; effort travels only as the model_reasoning_effort config override; unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "[-s/--sandbox read-only|workspace-write]; danger-full-access and bypass flags are never emitted by the direct profile",
+                "evidence": "H: codex-cli 0.161.0 --help documents -s/--sandbox read-only|workspace-write|danger-full-access; unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "[-c approval_policy=\"never\"]; on-request is refused: the direct profile never prompts, and -a/--ask-for-approval is root-only (absent from exec --help)",
+                "evidence": "H: codex-cli 0.161.0 exec --help carries no approval flag, so approval travels as the -c approval_policy override; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "[-C/--cd W] conductor working root, plus the conductor process cwd",
+                "evidence": "H: codex-cli 0.161.0 --help documents -C/--cd; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "[-o/--output-last-message F] last-message file; --json carries the JSONL thread/turn/item/error event stream on stdout",
+                "evidence": "H: codex-cli 0.161.0 exec --help documents -o/--output-last-message and --json; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text: '-' is the prompt argument and the brief is piped on stdin (< briefPath); brief text never enters argv, rendered commands or serialized plans",
+                "evidence": "H: codex-cli 0.161.0 exec --help (instructions are read from stdin when '-' is used or no prompt argument is given); unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "deferred: --output-schema exists on 0.161.0 exec --help, but WorkerCommandRequest/parseWorkerCommandArgs (src/serve/worker-invocation.ts) carries no schema path, so the shared renderer cannot supply one; no native schema output is claimed",
+                "evidence": "H: codex-cli 0.161.0 exec --help documents --output-schema; renderer input gap recorded, not implemented here; unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step or turn cap flag is evidenced on 0.161.0; deadline and output-byte bounds come from the invoking shell",
+                "evidence": "H: codex-cli 0.161.0 exec --help advertises no step-cap flag; unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unknown: workspace trust behaviour is not evidenced on 0.161.0; --ignore-user-config skips only $CODEX_HOME/config.toml while auth still resolves via CODEX_HOME, so user config is scoped out but trust is not established",
+                "evidence": "H: codex-cli 0.161.0 --help (--ignore-user-config skips config.toml; auth still uses CODEX_HOME; --ignore-rules exists but neither evidences trust); live qualification required"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: no per-call subagent disable is evidenced on 0.161.0",
+                "evidence": "H: codex-cli 0.161.0 exec --help shows no subagent control; tasks requiring child limits are blocked"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unknown: provider/model fallback behaviour is not evidenced",
+                "evidence": "H: codex-cli 0.161.0 --help; live qualification required"
+              }
+            },
+            "envAllowlist": [
+              "CODEX_HOME",
+              "HOME"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "Effort travels only as -c model_reasoning_effort; no --effort flag exists on 0.161.0 and none is invented.",
+              "--dangerously-bypass-approvals-and-sandbox is Ralph-loop legacy and never part of the direct profile.",
+              "Native `mcp-server` is not advertised by installed 0.160.1/0.161.0 help (`codex mcp-server --help` prints root help); native MCP stays version-blocked.",
+              "Auth resolves via CODEX_HOME (or HOME for its default location): the env allowlist carries exactly those two names and nothing else."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-codex-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct item.completed"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/codex/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/codex-adapter.mjs",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "0.161.0"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/codex-adapter.mjs",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-07",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "copilot": {
+      "sessionEnvAllowlist": [
+        "COPILOT_GITHUB_TOKEN",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "COPILOT_HOME"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -70,7 +686,179 @@
       "artifactFormat": "YAML frontmatter plus Markdown",
       "verification": "Schema fixture and entitled Copilot invocation",
       "sourceUrl": "https://docs.github.com/en/copilot/reference/custom-agents-configuration",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "copilot",
+        "provider": "copilot",
+        "adapterVersion": "1",
+        "supportedVersions": "1.0.95",
+        "runtimeDriver": "installed:copilot",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "copilot",
+          "argv": [
+            "-p",
+            "Follow the instructions in the attached file exactly.",
+            "--attachment",
+            "${brief}",
+            "--model",
+            "${model}",
+            "--reasoning-effort",
+            "${effort}",
+            "-C",
+            "${workspace}",
+            "--output-format",
+            "json",
+            "--no-ask-user",
+            "--no-custom-instructions",
+            "--disable-builtin-mcps"
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "1.0.95",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--model <model> (exact model id only; 'auto' and generic Ralph-loop aliases are refused; captured help lists only the long flag, no '-m' alias)",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--model <model> Set the AI model to use (use 'auto' to let Copilot pick automatically)')"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--reasoning-effort <level> (none|minimal|low|medium|high|xhigh|max), always explicit",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--reasoning-effort <level> Set the reasoning effort level [possible values: none, minimal, low, medium, high, xhigh, max]')"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --sandbox flag is listed in the root --help Options (only documented in `copilot help sandbox` prose, gated on host MXC/bwrap/slirp4netns prerequisites not probed here); this profile relies on the CLI default path restriction (cwd + PATH dirs + temp dir + user profile) and never emits --allow-all-paths",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) plus `copilot help sandbox`"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--no-ask-user (disables the ask_user tool) plus scoped --allow-tool/--deny-tool tokens from the resolved permission tuple; --allow-all-tools/--allow-all/--yolo are never emitted",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--allow-all-tools ... required for non-interactive mode'; '--allow-tool [<tools>...] ... will not prompt for permission'; '--no-ask-user Disable the ask_user tool'); unqualified whether a tool outside the allow-tool scope fails closed or blocks without a live run"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "-C <directory> (change working directory before doing anything else)",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('-C <directory> Change working directory before doing anything else')"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "stdout --output-format json (JSONL, one JSON object per line); no output-file flag carries the agent's final answer (--usage-output-file is usage statistics only and is not wired here)",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--output-format <format> Output format: ... 'json' (JSONL, one JSON object per line)'; '--usage-output-file <file> Write final usage statistics as JSON')"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "unavailable for the brief: -p/--prompt <text> only accepts inline argv text; the brief instead rides on --attachment <path> as a file, with -p fixed to a content-free instruction",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('-p, --prompt <text> Execute a prompt in non-interactive mode'; '--attachment <path> Attach a file (image or native document) to the initial prompt; only valid in non-interactive mode')"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no output-schema flag is evidenced, and the --output-format json JSONL event vocabulary itself is not documented in --help; no event field name is invented",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification)"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step/turn cap flag is evidenced; --max-autopilot-continues only bounds --autopilot mode, which this profile never enables",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--max-autopilot-continues <count> Maximum number of continuation messages in autopilot mode [default: 5]')"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "--no-custom-instructions (stops loading AGENTS.md/related files) and --disable-builtin-mcps (disables the built-in github-mcp-server/githubiq MCP servers); other untrusted-workspace surfaces (plugins, skills, extensions) stay unqualified",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--no-custom-instructions Disable loading of custom instructions from AGENTS.md and related files'; '--disable-builtin-mcps Disable all built-in MCP servers (currently: github-mcp-server, githubiq)')"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: --fleet enables parallel subagent orchestration and is never emitted by this profile; whether the agent can still spawn /tasks subagents with --fleet absent is not evidenced from --help",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--fleet Run the prompt in fleet mode (parallel subagent orchestration)')"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: --auto-tier only applies when the model is 'auto', which this profile never selects; no other fallback control is evidenced",
+                "evidence": "H: copilot 1.0.95 --help / `copilot help <topic>`, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt; never live qualification) ('--auto-tier <preference> Set the Auto routing profile')"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "The --output-format json JSONL event-type vocabulary is not documented in --help, and the installed binary is a compiled per-architecture native package with no readable bundled source (unlike e.g. Pi's JS bundle); no event-level health signal is evidenced, so observeHealthEvent always returns null and completion is exit-code gated only, EXCEPT one conservative guard: a line with a top-level 'type: \"error\"' or non-null 'error' field always fails the final, even at exit 0 (defensive synthetic-shape check, not an observed Copilot event).",
+              "--allow-all-tools/--allow-all/--yolo are never emitted; a tool outside the resolved --allow-tool scope may still require interactive confirmation a non-interactive run cannot answer, and whether that fails closed or hangs is unqualified without a live run.",
+              "--sandbox's OS-level command sandbox depends on host prerequisites (bwrap/slirp4netns/iptables on Linux) not probed here; this profile never emits it and relies on the CLI's default path restriction instead.",
+              "Live qualification is an open S1 blocker: this profile has been exercised only against --help/--version/subcommand --help; the smoke command in docs/providers/copilot-direct.md is the first live check. Live attempt evidence (host noodle, 2026-10-10): COPILOT_GITHUB_TOKEN set to a classic ghp_ PAT exits 1 with 'Classic Personal Access Tokens (ghp_) are not supported by Copilot' on stderr and EMPTY stdout; a fine-grained PAT or prior copilot/gh login is required and the smoke run remains blocked on that."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-copilot-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit; the JSONL stream carries no evidenced error-event vocabulary, so completion is exit-code gated only, except a conservative guard that fails any line shaped 'type: \"error\"' or carrying a non-null top-level 'error' field even at exit 0",
+              "fixtureRef": "test/fixtures/providers/copilot/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "process-only",
+              "evidenceGrades": [
+                "H"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": ".aiwg/working/s1-scratch/cli-help/copilot-1.0.95.txt",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "1.0.95"
+                }
+              ],
+              "qualificationOwner": "B-OG-36",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "cursor": {
       "agent": "native",
@@ -83,9 +871,199 @@
       "artifactFormat": "YAML frontmatter plus Markdown",
       "verification": "Schema fixture and entitled Cursor invocation",
       "sourceUrl": "https://cursor.com/docs/subagents",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "cursor-direct",
+        "provider": "cursor",
+        "adapterVersion": "1",
+        "supportedVersions": "2026.10.1-e373342",
+        "runtimeDriver": "installed:cursor",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "cursor-agent",
+          "argv": [
+            "-p",
+            "--output-format",
+            "stream-json",
+            "--trust",
+            "--sandbox",
+            "enabled",
+            "${mode}",
+            "--workspace",
+            "${workspace}",
+            "--model",
+            "${model}"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "CURSOR_API_KEY",
+            "HOME"
+          ],
+          "versionPattern": "^([0-9A-Za-z.+-]{1,128})$",
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "2026.10.1-e373342",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[--model MODEL[effort=E]]; exact catalog model ID with the embedded bracket effort override, never a generic alias, never the CLI's own auto-selection ('auto'/'default'); the captured --help documents only --model, no -m short alias",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents --model <model> (no -m alias) and its bracket-override syntax; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "embedded in --model as MODEL[effort=E]; valid levels are account/backend-scoped (parameterizedModels is fetched from the Cursor backend), never a CLI default",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents the bracket-override example 'claude-opus-4-8[context=1m,effort=high,fast=false]'; D: installed-module bundle read on noodle (~/.local/share/cursor-agent/versions/2026.10.01-e373342/7000.index.js), never executed shows parameterizedModels is fetched remotely; unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "both contracts emit [--sandbox enabled] (never --sandbox disabled); read-only additionally emits [--mode ask] (the CLI's own documented read-only mode) on top of --sandbox enabled; -f/--force, --yolo, --auto-review and --approve-mcps are out of this contract's scope and are never emitted (--approve-mcps is a bypass, not a non-approval convenience; see pitfalls)",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents --sandbox <enabled|disabled>, --mode <plan|ask> ('ask: ... (read-only)') and -f/--force/--yolo/--auto-review/--approve-mcps; D: installed-module bundle read on noodle (~/.local/share/cursor-agent/versions/2026.10.01-e373342/7000.index.js and 8192.index.js), never executed, shows sandboxMode:\"enabled\" pairs with approvalMode:\"allowlist\" and --approve-mcps sets ignoreApprovals:true on the MCP approval source; unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable as a separate flag: --sandbox/--mode are the only non-bypass permission gates; the direct profile never emits -f/--force, --yolo, --auto-review or --approve-mcps",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents no non-bypass approval-policy flag; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "[--workspace W] conductor working root, plus the conductor process cwd",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents --workspace <path-or-name>; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable as a file target: no output-file flag is documented; the final is the last type:\"result\" line of the captured --output-format stream-json stdout stream",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents --output-format <text|json|stream-json> with no file-path argument; D: installed-module bundle read on noodle (~/.local/share/cursor-agent/versions/2026.10.01-e373342/7000.index.js), never executed shows the single terminal result object shape; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text: omitting the prompt argument makes the CLI read the prompt from stdin to EOF; brief text never enters argv, rendered commands or serialized plans",
+                "evidence": "D: installed-module bundle read on noodle (~/.local/share/cursor-agent/versions/2026.10.01-e373342/7000.index.js), never executed shows the prompt-building function reads stdin to EOF only when no positional prompt argument is supplied; unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no output-schema flag is documented",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help advertises no output-schema flag; unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step or turn cap flag is evidenced; deadline and output-byte bounds come from the invoking shell",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help advertises no step-cap flag; unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "always emitted: [--trust] removes the only documented workspace-trust prompt so the non-interactive run cannot block on it",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents --trust ('Trust the current workspace without prompting'); unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unknown: no subagent/child-process fan-out flag is documented for -p",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help documents no child-process flag for -p; unqualified until live evidence"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no fallback-model flag is documented",
+                "evidence": "H: cursor-agent 2026.10.01-e373342 --help advertises no fallback-model flag; unknown controls block tasks requiring them"
+              }
+            },
+            "envAllowlist": [
+              "CURSOR_API_KEY",
+              "HOME"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "-f/--force, --yolo and --auto-review are never part of the direct profile; none was ever shipped as a new argv-prompt path.",
+              "--approve-mcps is a BYPASS, not a harmless convenience: it sets ignoreApprovals:true on the MCP approval source (installed-module bundle read, 8192.index.js), which is folded with --force/--yolo into one upstream bypass flag. Without it, an MCP server not already recorded as approved fails its load() call and is skipped; the run continues without that server's tools. It is never emitted by this profile.",
+              "This version's non-interactive path has no type:\"error\" terminal event: a thrown error writes plain text and exits non-zero with no JSON result line at all; a missing terminal plus a non-zero exit is the failure signal here. Defensively, ANY type:\"error\" event or non-null top-level error field fails the stream regardless of position, including after an earlier success.",
+              "A type:\"interaction_query\" line means the CLI is waiting for an approval answer this profile cannot supply; treated as fatal regardless of position (before or after a success line), never as a pending success.",
+              "The template placeholder ${mode} documents the conditional --mode ask that read-only additionally emits on top of --sandbox enabled; it is omitted entirely for workspace-write, never rendered as an empty token.",
+              "CURSOR_API_KEY must be present for auth (there is no login on the evidenced host); HOME locates ~/.cursor for persistent settings.",
+              "SE4: the raw `cursor-agent --version` banner is `2026.10.01-e373342` (leading-zero day-of-month), which is not valid semver; supportedVersions here is the semver-normalized `2026.10.1-e373342` and a caller must apply the same normalization to the live version string before qualification, or a correct installation is unconditionally refused."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-cursor-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct tool_call completed"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/cursor/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "D"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/cursor-adapter.mjs",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "2026.10.1-e373342"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/cursor-adapter.mjs",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-38",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "factory": {
+      "sessionEnvAllowlist": [
+        "FACTORY_API_KEY"
+      ],
       "agent": "native",
       "skill": "informational",
       "globalChild": "native",
@@ -101,9 +1079,203 @@
       "artifactFormat": "YAML frontmatter plus Markdown",
       "verification": "Fixture validation and Factory CLI model report",
       "sourceUrl": "https://docs.factory.ai/cli/configuration/custom-droids",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "factory-direct",
+        "provider": "factory",
+        "adapterVersion": "1",
+        "supportedVersions": "0.238.0",
+        "runtimeDriver": "installed:factory",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "droid",
+          "argv": [
+            "exec",
+            "--auto",
+            "${sandbox}",
+            "-m",
+            "${model}",
+            "-r",
+            "${effort}",
+            "--cwd",
+            "${workspace}",
+            "--output-format",
+            "stream-json"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": ["FACTORY_API_KEY", "HOME"],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "0.238.0",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[-m/--model MODEL]; exact catalog model ID, never the CLI default (gpt-6-sol) or a generic alias",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents -m/--model <id> (default: \"gpt-6-sol\"); unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "[-r/--reasoning-effort LEVEL]; valid levels are model-dependent (exec --help 'Model details'); never the per-model default",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents -r/--reasoning-effort <level> (defaults per model); unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "workspace-write -> [--auto low]; read-only -> no --auto flag (the CLI's own documented read-only default); --skip-permissions-unsafe and the medium/high --auto tiers are out of this contract's scope and are never emitted",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents --auto <level> (low|medium|high), its 'Autonomy Levels' default read-only mode, and --skip-permissions-unsafe ('Bypass all checks - DANGEROUS!'); unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable as a separate flag: exec is non-interactive by construction and --auto (the sandbox control) is the only permission gate",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents exec as 'Run non-interactively (for scripts/automation)' with no approval-prompt flag; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "[--cwd W] conductor working root, plus the conductor process cwd",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents --cwd <path>; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable as a file target: no -o/output-file flag is documented for exec (-o/--output-format selects stream shape, not a destination); the final is the last type:\"result\" line of the captured --output-format stream-json stdout stream",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents -o/--output-format <text|json|stream-json|stream-jsonrpc|acp> with no file-path argument; D: https://docs.factory.com/droid-exec/overview documents the terminal result object shape; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text: omitting the prompt argument makes exec read the prompt from stdin to EOF; brief text never enters argv, rendered commands or serialized plans",
+                "evidence": "H: droid-cli 0.238.0 exec --help's own Examples ('echo \"analyze code\" | droid exec', 'cat prompt.txt | droid exec --auto low'); unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --output-schema-equivalent flag is documented for exec",
+                "evidence": "H: droid-cli 0.238.0 exec --help advertises no output-schema flag; unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step or turn cap flag is evidenced on 0.238.0; deadline and output-byte bounds come from the invoking shell",
+                "evidence": "H: droid-cli 0.238.0 exec --help advertises no step-cap flag; unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unknown: workspace-trust behaviour is not evidenced for non-interactive exec on 0.238.0",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents no trust-prompt flag for exec; unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "controllable: --mission spawns worker sessions via factoryd (never emitted by this profile, which keeps every run single-agent)",
+                "evidence": "H: droid-cli 0.238.0 exec --help documents --mission/--worker-model/--validator-model as mission-mode only; the direct profile never emits them; unqualified until live evidence"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no non-mission fallback-model flag is documented for exec (--spec-model/--worker-model/--validator-model are mission-mode only)",
+                "evidence": "H: droid-cli 0.238.0 exec --help scopes --spec-model/--worker-model/--validator-model to --mission/--use-spec; unknown controls block tasks requiring them"
+              }
+            },
+            "envAllowlist": ["FACTORY_API_KEY", "HOME"],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "--skip-permissions-unsafe is Ralph-loop legacy and never part of the direct profile.",
+              "The stream-json/json event vocabulary (assistant/user/tool_call/tool_result/hook/error/result) is doc-sourced (docs.factory.com), not help-verified; it never promotes qualification status beyond unqualified.",
+              "There is no -o/output-file flag on exec: the final is read from the captured stdout stream, never a separate file.",
+              "FACTORY_API_KEY must be present for auth; HOME locates ~/.factory/settings.json for persistent settings."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-factory-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct tool_result"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/factory/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "D"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/factory-adapter.mjs",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "0.238.0"
+                },
+                {
+                  "kind": "documentation",
+                  "ref": "https://docs.factory.com/droid-exec/overview; https://docs.factory.com/sdk/typescript",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-37",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "opencode": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "OPENCODE_API_KEY",
+        "OPENCODE_CONFIG",
+        "OPENCODE_CONFIG_DIR",
+        "OPENCODE_CONFIG_CONTENT",
+        "OPENCODE_SERVER_USERNAME",
+        "OPENCODE_SERVER_PASSWORD"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -114,22 +1286,385 @@
       "artifactFormat": "YAML frontmatter plus Markdown",
       "verification": "Inspect artifact and OpenCode model registry",
       "sourceUrl": "https://opencode.ai/docs/agents",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "opencode-direct",
+        "provider": "opencode",
+        "adapterVersion": "1",
+        "supportedVersions": "2.0.26",
+        "runtimeDriver": "installed:opencode",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "opencode",
+          "argv": [
+            "run",
+            "--format",
+            "json",
+            "-m",
+            "${model}",
+            "-f",
+            "${briefFile}",
+            "Follow the instructions in the attached file exactly."
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "2.0.26",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "-m/--model (opencode run --help: '--model, -m string  Model to use in the format provider/model#variant')",
+                "evidence": "H: opencode 2.0.26 `opencode run --help` (captured 2026-10-10, .aiwg/working/s1-scratch/cli-help/opencode-2.0.26.txt)"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "explicit effort maps to a #<variant> suffix on --model (provider/model#variant); binary disassembly of the installed CLI (the variant-builder, minified as qU(model, manual)) shows variant ids are drawn directly from each model's own capabilities.supports.reasoning_effort list (e.g. low/medium/high), or fixed ids \"max\"/\"high\" for extended-thinking models exposing max_thinking_budget instead; the valid id set is model-specific and not enumerated here, so this adapter appends a syntactically valid id and the real CLI refuses one a given model does not expose",
+                "evidence": "R: conductor binary disassembly of the installed opencode 2.0.26 CLI (variant-builder function, host 'noodle', 2026-10-09), confirming H: opencode 2.0.26 `opencode run --help` ('--model, -m string  Model to use in the format provider/model#variant')"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no scoped sandbox flag on 'run'; the only permission-adjacent flag is --auto, a blanket approval bypass this profile never emits",
+                "evidence": "H: opencode 2.0.26 `opencode run --help` ('--auto  Auto-approve permissions that are not explicitly denied')"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--auto ('Auto-approve permissions that are not explicitly denied') is a blanket bypass and is refused by policy; what a permission request does without --auto in non-interactive `run` is not independently confirmed: binary disassembly shows a shared permission.asked/permission.replied protocol where an unanswered request resolves to a \"reject\" outcome (`_===\"once\"||_===\"always\"?_:\"reject\"`, with requestPermission(...).catch(()=>{return}) on no responder), but that path is traced through the ACP/session-protocol layer, not reproduced against plain `run`, so this stays unavailable rather than asserted",
+                "evidence": "R: conductor binary disassembly of the installed opencode 2.0.26 CLI (permission.asked/permission.replied reject-on-no-answer pattern, host 'noodle', 2026-10-09), confirming H: opencode 2.0.26 `opencode run --help`"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "no --dir/--cwd flag on 'run' (the root 'opencode <subcommand> [flags] [<directory>]' positional is not evidenced on 'run --help'); the shared renderer's 'cd ${workspace}' sets the process working directory opencode executes in",
+                "evidence": "H: opencode 2.0.26 `opencode run --help` and `opencode --help`"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "no --output/-o flag and no positive whole-run terminal event (binary disassembly: the run loop returns silently on session.execution.succeeded, in any mode); the final answer is the captured stdout --format json JSONL stream, accepted only when every line parses, no error event occurs, any present step_finish says \"stop\", and at least one text part has a recorded part.time.end (or a stop step_finish substitutes for that) -- a live 2.0.26 run confirmed a clean single-text-event stream with no step_start/step_finish at all",
+                "evidence": "H: opencode 2.0.26 `opencode run --help` ('--format choice  Output format (choices: default, json)')"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "confirmed unsupported: disassembly of the installed opencode 2.0.26 binary found no stdin/isTTY handling in the compiled 'run' chunk; the brief rides on -f/--file as a path instead, and the positional argument carries only a fixed, content-free instruction",
+                "evidence": "R: conductor binary disassembly of the installed opencode 2.0.26 CLI (no stdin/isTTY handling in the compiled 'run' chunk, host 'noodle', 2026-10-09), confirming H: opencode 2.0.26 `opencode run --help`"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --output-schema or equivalent flag is documented for 'run'",
+                "evidence": "H: opencode 2.0.26 `opencode run --help`"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --max-steps/--max-turns flag is documented for 'run'",
+                "evidence": "H: opencode 2.0.26 `opencode run --help`"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unavailable: no workspace-trust flag is documented; --auto would approve pending trust prompts and is never emitted by this profile",
+                "evidence": "H: opencode 2.0.26 `opencode run --help`"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: no subagent/nested-delegation control is documented for 'run'",
+                "evidence": "H: opencode 2.0.26 `opencode run --help`"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no model-fallback flag is documented; fallback selection stays policy-owned outside the CLI",
+                "evidence": "H: opencode 2.0.26 `opencode run --help`"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "Stdin is confirmed unsupported (conductor disassembly of the installed opencode 2.0.26 binary: no stdin/isTTY handling in the compiled 'run' chunk, host 'noodle', 2026-10-09). The brief travels as an attached file via -f/--file; the positional argv message is a fixed, content-free instruction and never carries brief text.",
+              "There is no positive session-terminal JSON event in any compatibility mode: binary disassembly shows the run loop returns silently on session.execution.succeeded. A live 2.0.26 smoke run (one complete `text` event, nothing else) confirms this is a genuine success shape, not truncation; parseOutput accepts a complete text part OR a step_finish reason \"stop\" as the positive signal, never exit code alone.",
+              "--auto is a blanket permission/approval bypass ('Auto-approve permissions that are not explicitly denied') and is never part of the direct profile.",
+              "'opencode serve' is an HTTP API, not MCP, and 'opencode mcp' manages MCP *clients* the agent can call out to, not a worker-serving endpoint; the AIWG worker-invoke bridge remains the MCP route.",
+              "Documentation/help and synthetic observations are not authenticated live qualification."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-opencode-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit, plus parseOutput's strict rule: a complete text part (part.time.end present) or a step_finish reason \"stop\"; there is no whole-run terminal event (binary: the run loop returns silently on session.execution.succeeded), so exit code alone is never sufficient",
+              "fixtureRef": "test/fixtures/providers/opencode/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "opencode run --help / opencode --help (captured .aiwg/working/s1-scratch/cli-help/opencode-2.0.26.txt)",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "2.0.26"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/opencode-adapter.mjs; conductor live smoke run + binary disassembly of installed opencode 2.0.26 (host 'noodle', 2026-10-10; .aiwg/working/s1-scratch/smoke-opencode.jsonl) redefining parseOutput final-output validity",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "2.0.26"
+                }
+              ],
+              "qualificationOwner": "B-OG-39",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "warp": {
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
-      "identifierSyntax": "Warp saved-profile or run model identifier",
+      "identifierSyntax": "Warp model identifier accepted by `warp-terminal agent run --model`",
       "inheritance": "All delegated work uses run/profile selection",
       "invalidPinFallback": "Profile availability dependent",
       "configTarget": "Warp agent profile or run configuration",
       "artifactFormat": "Saved profile / run control plane",
       "verification": "Inspect active profile and run metadata",
       "sourceUrl": "https://docs.warp.dev/agent-platform/capabilities/agent-profiles-permissions",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "warp",
+        "provider": "warp",
+        "adapterVersion": "1",
+        "supportedVersions": "0.2026.10.07.08.29.stable_00",
+        "runtimeDriver": "installed:warp",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "warp-terminal",
+          "argv": [
+            "agent",
+            "run",
+            "--output-format",
+            "json",
+            "--model",
+            "${model}",
+            "--cwd",
+            "${workspace}",
+            "--skill",
+            "aiwg-brief-${invocationId}",
+            "--no-snapshot"
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "WARP_API_KEY"
+          ],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "0.2026.10.07.08.29.stable_00",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[--model MODEL_ID] exact observed model id, never 'auto'/'default'",
+                "evidence": "H: warp-terminal 0.2026.10.07.08.29.stable_00 `agent run --help` documents `--model <MODEL_ID>` ('Override the base model used by this command ... For the default Oz harness, use `oz model list` to see available model IDs') with no enum; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "unavailable: no reasoning-effort flag is documented anywhere in the full captured `agent`/`agent run --help`",
+                "evidence": "H: full `agent run --help` capture (.aiwg/working/s1-scratch/cli-help/warp-0.2026.10.07.txt) names no effort/reasoning flag; unknown controls block tasks requiring them"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable as a CLI flag: no sandbox/permission-mode flag is documented for a local run; only an external boundary is reportable",
+                "evidence": "H: `agent run --help` lists no sandbox/permission-mode flag; unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable: no approval/auto-approve flag is documented for this CLI",
+                "evidence": "H: `agent run --help` lists no approval flag; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "[-C/--cwd CWD] ('Working directory for the agent'), always the absolute resolved workspace, never a cloud `--environment`",
+                "evidence": "H: `agent run --help` documents `-C, --cwd <CWD>`; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "[--output-format json], always emitted; no vendor success/error envelope is evidenced (help names the format but not its shape, and binary `strings` hits were too generic to establish grammar), so candidate extraction always returns null and the claims hook refuses all output until an authenticated Oz terminal envelope is observed",
+                "evidence": "H: `agent run --help` documents `--output-format <OUTPUT_FORMAT>` (json|ndjson|pretty|text); R: live no-model probe on noodle 2026-10-11 confirmed the full template reaches the auth stop with no argument error, but the host has no login so no real output was observed; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "unavailable: no stdin-mode flag is documented; this profile never sends stdin content",
+                "evidence": "H: `agent run --help` lists no stdin-input flag; unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no JSON-schema-enforcement flag is documented",
+                "evidence": "H: `agent run --help` lists no schema flag; unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step/turn cap flag is evidenced",
+                "evidence": "H: `agent run --help` lists no step-cap flag; unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unavailable: no workspace-trust flag is documented",
+                "evidence": "H: `agent run --help` advertises no trust flag; unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: `--harness claude|codex` (third-party harness mode) is documented but never emitted by this profile (conductor notes, #2905: out of scope); no other fan-out/subagent flag is evidenced for a local run",
+                "evidence": "H: `agent run --help` documents `--model` noting harness-specific behavior under `--harness`, which this profile never passes; unqualified until live evidence"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no fallback-model flag is documented",
+                "evidence": "H: `agent run --help` advertises no fallback-model flag; unknown controls block tasks requiring them"
+              }
+            },
+            "envAllowlist": [
+              "WARP_API_KEY"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification; the host used for probes (noodle) has no `warp-terminal login`/`WARP_API_KEY`, so every probe stopped at the auth check and never reached a model.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "There is NO `oz` symlink on the evidenced host: the real executable is `warp-terminal`, with `agent run` etc. as its subcommands; `runtimeDriver`/`executable` are pinned to that, not to a bare `oz`.",
+              "BRIEF TRANSPORT IS BLOCKED PENDING A SHARED CHANGE: `--prompt` places the brief on argv (never emitted by this profile); `-f/--file` is NOT a member of the required `<--prompt|--saved-prompt|--task-id|--skill>` group (live probe, 2026-10-11) and its own config-file schema is undocumented, so it cannot be assumed to carry the brief; `--skill` is the only remaining required-group member that can carry free text (`agent run --help`: 'Use a skill as the base prompt for the agent' when given without `--prompt`), but its search root relative to `--cwd` and behavior when the skill is missing are UNVERIFIED behind the login gate. The pure adapter derives a distinct `aiwg-brief-<invocationId>` path without writes and refuses unsafe IDs. `buildWarpBriefSkillFile()` (tools/ralph-external/lib/warp-adapter.mjs) exports the exact path/content an execution-time file-generation primitive would need to write before this argv runs; that primitive does not exist in the shared session-launcher today (the same class of gap as #2998 for Antigravity's stdin frame). Needed shared change: an execution-time generated-artifact primitive the session-launcher can call with the adapter-exported `{ relativePath, content }` immediately before spawning the worker process, with invocation identity supplied to the adapter, refusal to overwrite an existing path, cleanup afterward, and no commits of generated skills (pending #3002). Brief transport is NOT available today.",
+              "`--environment`/`-e` (cloud environment/runner) and `--harness claude|codex` (third-party harness mode) are documented but NEVER emitted by this profile; the cloud subcommand is also never emitted. Execution location is unverified until an authenticated run.",
+              "`--no-snapshot` is always emitted: `agent run --help` documents it as disabling the end-of-run workspace snapshot upload. This flag does not establish execution location or absence of other uploads.",
+              "No live success/error output was observed (no login on the evidenced host): `finalOutput`/`structuredOutput` support is grade H/R only, never upgraded past `unqualified`."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "plain",
+              "signalParser": "provider-warp-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/warp/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "process-only",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "documentation",
+                  "ref": "03-software-architecture.md §10 warp",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                },
+                {
+                  "kind": "help",
+                  "ref": ".aiwg/working/s1-scratch/cli-help/warp-0.2026.10.07.txt",
+                  "observedAt": "2026-10-11T00:00:00Z",
+                  "cliVersion": "0.2026.10.07.08.29.stable_00"
+                }
+              ],
+              "qualificationOwner": "B-OG-40",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "omp": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "PI_CONFIG_DIR",
+        "PI_CODING_AGENT_DIR"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -147,9 +1682,204 @@
       "artifactFormat": "model and thinkingLevel frontmatter; --model and --thinking runtime flags",
       "verification": "Pinned OMP 18.1.10 source and live OpenRouter smoke; individual role defaults remain operator configured",
       "sourceUrl": "https://github.com/can1357/oh-my-pi/tree/5964a0f7649275bcde818f20073193fd032451f2/packages/coding-agent",
-      "verifiedAt": "2026-09-04"
+      "verifiedAt": "2026-09-04",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "omp-direct",
+        "provider": "omp",
+        "adapterVersion": "1",
+        "supportedVersions": "18.8.7",
+        "runtimeDriver": "installed:omp",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "omp",
+          "argv": [
+            "--mode",
+            "json",
+            "--print",
+            "--no-extensions",
+            "--no-skills",
+            "--no-rules",
+            "--model",
+            "${model}",
+            "--thinking",
+            "${effort}",
+            "--cwd",
+            "${workspace}",
+            "--approval-mode",
+            "${approval}"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "18.8.7",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--model=<value>; exact observed API model, never an alias or CLI default",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--model=<value> Model to use (fuzzy match: ...)'"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--thinking=<value>; one of minimal/low/medium/high/xhigh",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--thinking=<value> Set thinking level: off, minimal, low, medium, high, xhigh, max, auto'"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no process/filesystem sandbox flag is documented; the direct profile relies entirely on the host worker-isolation boundary",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) documents no sandbox flag"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--approval-mode=write (never omitted: the installed binary's compiled-in default is yolo, a full bypass); write auto-approves read/write-tier tools only, the least-prompting non-bypass value, but an exec-tier tool (bash) still resolves to a required-approval decision with no confirmed headless resolution -- an open gap, not a qualified non-prompting guarantee; yolo is never used",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--approval-mode=<value> Override tools.approvalMode for this session (always-ask|write|yolo)'; R: ~/.local/bin/omp 18.8.7 (noodle, static read 2026-10-10): default `approvalMode: Uxa(s) ? s : \"yolo\"`; tier gate `Kxa={\"always-ask\":\"read\",write:\"write\",yolo:\"exec\"}`, `PS={read:0,write:1,exec:2}`, `Xxa(mode,tier)=PS[tier]<=PS[Kxa[mode]]`; no auto-deny found for an unresolved prompt in headless/print mode"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "--cwd=<value>",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--cwd=<value> Directory to start in (overrides the launch cwd)'"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "bounded stdout event-stream capture; the final answer is extracted from agent_end (willContinue=false) via summarizeOmpEvents/parseOutput, never a -o/--output file",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) documents no output-file flag; R: tools/ralph-external/lib/omp-adapter.mjs parseOutput()/summarizeOmpEvents()"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text; CONFIRMED by static read of the installed omp binary (not merely inherited from Pi's lineage): OMP's own readPipedInput reads non-TTY stdin to EOF whenever mode is not rpc/rpc-ui/acp (--mode json included) and passes it as stdinContent into OMP's own buildInitialMessage, which prefixes it onto the initial message; unlike Pi, OMP does not trim the returned text",
+                "evidence": "R: ~/.local/bin/omp 18.8.7 (noodle, static read 2026-10-10): `async function wUt(){ if(process.stdin.isTTY===true) return; ...const t=await Bun.stdin.text(); if(t.trim().length===0) return; return t; }`; call site `const p=r===\"rpc\"||r===\"rpc-ui\"||r===\"acp\"; const c=p?undefined:await readPipedInput();`; `function aso({parsed,fileText,stdinContent}){...}` (buildInitialMessage) consumes `stdinContent: c`"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --output-schema or equivalent structured-output flag is documented",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) documents no output-schema flag"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: --max-time bounds wall-clock duration only, not a step/turn count",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--max-time=<value> Stop the session after this duration'"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "[\"--no-extensions\",\"--no-skills\",\"--no-rules\"]; OMP has no --approve/--no-approve trust flag like Pi, so the direct profile always disables workspace-local extension/skill/rule discovery instead",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10): '--no-extensions ...', '--no-skills ...', '--no-rules Disable rules discovery and loading'"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: no native child-denial flag; the built-in task tool enables sub-agent delegation and can only be excluded via a --tools allowlist, not applied by default",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) built-in tool list includes 'task - Launch sub-agents for parallel tasks'"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no implicit model-fallback flag is documented; an invalid/omitted --model is a resolution error, never a silent substitution",
+                "evidence": "H: omp/18.8.7 --help (noodle, 2026-10-10) documents a single --model flag with no fallback list"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "--approval-mode is never omitted: the installed binary's compiled-in default is yolo (a full bypass), so an omitted flag is the most dangerous outcome, not a safe one.",
+              "--approval-mode is fixed to write; always-ask (prompts for write AND exec) and yolo (bypasses everything) are never rendered. write only auto-approves read/write-tier tools; an exec-tier tool (bash) still resolves to a required-approval decision with no confirmed headless resolution -- an open S1 gap.",
+              "--no-extensions/--no-skills/--no-rules are fixed; OMP has no single approve-style trust flag like Pi.",
+              "Stdin-as-initial-message is CONFIRMED by a static read of the installed omp binary's own readPipedInput/buildInitialMessage, not merely inherited from Pi's lineage.",
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort or required control mappings block dispatch."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-omp-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct tool_execution_end",
+                "agent_end willContinue=false"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/omp/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/omp-adapter.mjs",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "18.8.7"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/omp-adapter.mjs; static read of noodle ~/.local/bin/omp 18.8.7 (approval tier gate Kxa/PS/Xxa; readPipedInput/buildInitialMessage)",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "18.8.7"
+                }
+              ],
+              "qualificationOwner": "B-OG-45",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "pi": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "PI_CODING_AGENT_DIR",
+        "PI_CODING_AGENT_SESSION_DIR",
+        "AIWG_PI_STUB_SCENARIO",
+        "AIWG_PI_STUB_RECEIPT"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -167,9 +1897,189 @@
       "artifactFormat": "Runtime --model and --thinking flags",
       "verification": "Inspect strict JSONL state and the selected provider/model",
       "sourceUrl": "https://github.com/earendil-works/pi/tree/main/packages/coding-agent#cli-reference",
-      "verifiedAt": "2026-09-04"
+      "verifiedAt": "2026-09-04",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "pi-direct",
+        "provider": "pi",
+        "adapterVersion": "1",
+        "supportedVersions": "1.1.0",
+        "runtimeDriver": "installed:pi",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "pi",
+          "argv": [
+            "--mode",
+            "json",
+            "--no-approve",
+            "--no-context-files",
+            "--no-extensions",
+            "--no-skills",
+            "--no-mcp",
+            "--model",
+            "${model}",
+            "--thinking",
+            "${effort}"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "1.1.0",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--model <pattern>; exact observed API model, never an alias or CLI default",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09): '--model <pattern> Model pattern or ID (supports provider/id and optional :<thinking>)'"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--thinking <level>; one of minimal/low/medium/high/xhigh",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09): '--thinking <level> Set thinking level: off, minimal, low, medium, high, xhigh, max'"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no process/filesystem sandbox flag is documented; the direct profile relies entirely on the host worker-isolation boundary",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents no sandbox flag"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable: no tool-execution approval-prompt flag is documented; --mode json forces non-interactive execution so no prompt can occur",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) lists no approval flag; R: installed pi 1.1.0 bundle chunk-OIM2DMFI.js resolveAppMode() (static read, 2026-10-09)"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "unavailable: no -C/--cwd flag is documented; the launcher's shell cd to the workspace is the only binding",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents no working-directory flag"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "bounded stdout JSONL capture; the final answer is extracted from agent_end/agent_settled messages (parseOutput), never a -o/--output file",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents no output-file flag; R: tools/ralph-external/lib/pi-adapter.mjs parseDirectFinal() (the direct-profile strict contract; the legacy parseOutput() settlement-only shape is a separate contract used only by the Ralph loop)"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text (piped, non-TTY stdin is trimmed and becomes the sole initial-message part when no positional message/file argument is given)",
+                "evidence": "R: installed pi 1.1.0 bundle chunk-OIM2DMFI.js readPipedStdin()/buildInitialMessage() (static read, 2026-10-09)"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no --output-schema or equivalent structured-output flag is documented",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents no output-schema flag"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step/turn cap flag is documented",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents no step-cap flag"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "[\"--no-approve\",\"--no-context-files\",\"--no-extensions\",\"--no-skills\",\"--no-mcp\"]; --no-approve alone does not stop context loading (R: installed pi 1.1.0 bundle chunk-OIM2DMFI.js loads ancestor AGENTS.md/CLAUDE.md -- `agentsFiles=this.noContextFiles?[]:loadProjectContextFiles(...)` -- independently of trust), so the direct profile also disables context-file, extension, skill and built-in-MCP discovery; it never emits --approve",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09): '--approve, -a Trust project-local files for this run' / '--no-approve, -na Ignore project-local files for this run' / '--no-context-files, -nc Disable AGENTS.md and CLAUDE.md discovery and loading' / '--no-extensions, -ne' / '--no-skills, -ns' / '--no-mcp Disable built-in MCP support: no servers connect and no MCP tools'; R: installed pi 1.1.0 bundle chunk-OIM2DMFI.js (static read, 2026-10-09)"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: no sub-agent/task tool or child-denial flag is documented for Pi (unlike OMP's task tool)",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) built-in tool list has no task/sub-agent tool"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no implicit model-fallback flag is documented; an invalid/omitted --model is a resolution error, never a silent substitution",
+                "evidence": "H: pi 1.1.0 --help (titan, 2026-10-09) documents a single --model flag with no fallback list"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "--no-approve alone does not stop context loading: ancestor AGENTS.md/CLAUDE.md load independently of trust unless --no-context-files is also set (R: installed bundle chunk-OIM2DMFI.js). --no-context-files, --no-extensions, --no-skills and --no-mcp (1.1.0 adds built-in MCP support, on by default) are always rendered alongside it.",
+              "--approve is never rendered, which would trust arbitrary project-local extension/config files.",
+              "Pi's own stdin reader trims the brief; an all-whitespace brief resolves to no initial message and must never be sent.",
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort or required control mappings block dispatch."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-pi-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct agent_end",
+                "agent_settled"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/pi/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/pi-adapter.mjs",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "1.1.0"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/pi-adapter.mjs",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-45",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "deepseek-harness": {
+      "sessionEnvAllowlist": [
+        "DEEPSEEK_API_KEY",
+        "DSH_HOME"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -187,7 +2097,181 @@
       "artifactFormat": "agent-default-model config; JSON-RPC initialize params",
       "verification": "Pinned source contract plus opt-in headless OpenRouter smoke",
       "sourceUrl": "https://github.com/deepseek-ai/deepseek-harness",
-      "verifiedAt": "2026-09-05"
+      "verifiedAt": "2026-09-05",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "deepseek-harness-direct",
+        "provider": "deepseek-harness",
+        "adapterVersion": "1",
+        "supportedVersions": "0.2.0-rc.2",
+        "runtimeDriver": "installed:deepseek-harness-direct",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "dsh",
+          "argv": [
+            "--profile",
+            "headless",
+            "--patch",
+            "${artifact:dsh-patch}",
+            "--json",
+            "-"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "DEEPSEEK_API_KEY"
+          ],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "0.2.0-rc.2",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--patch YAML overlay would set the agent-default-model plugin entry {provider: \"deepseek-official\", model}; no --model flag exists on `--profile headless --help`. The launcher writes the declared patch exclusively into its private run directory and cleans it up; the override is unverified for enforcement, only for parse-before-model-call.",
+                "evidence": "R: dsh 0.2.0-rc.2 --profile headless --dump-config-schema/--dump-default-config (agent-default-model config9, required provider+model); no-model probe on noodle 2026-10-11 confirmed a --patch file is read and parsed before any model call (MISSING_CREDENTIAL still names provider route deepseek-official), never that the override is enforced; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "Same --patch agent-default-model entry would set reasoningEffort (off|low|high|max); unverified for the same reason as model",
+                "evidence": "R: dsh 0.2.0-rc.2 --profile headless --dump-config-schema (deepseek-official provider reasoningEffort enum off|low|high|max); unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "--patch YAML overlay would set the sandbox-policy plugin entry {mode: read-only|workspace-write}; danger-full-access (full bypass) is never emitted. Reaching MISSING_CREDENTIAL proves the patch parses, not that sandbox-policy.mode actually confines file/exec access -- no probe without a real model call can exercise a tool call to prove confinement.",
+                "evidence": "R: dsh 0.2.0-rc.2 --dump-default-config sandbox-policy config.mode; no-model probe on noodle 2026-10-11 confirmed the run proceeds past plugin mount to MISSING_CREDENTIAL, which is evidence of parsing only; confinement itself is unverified"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--patch YAML overlay would set the approval plugin entry {policy: never}; ask is refused (no prompt channel in headless). What \"never\" actually permits is unverified: no analogy to another CLI's approval semantics is drawn.",
+                "evidence": "R: dsh 0.2.0-rc.2 --dump-default-config approval config.policy (APPROVAL_POLICIES ask|never, dsh-permission-presets/lib/index.js); no-model probe on noodle 2026-10-11 confirmed the stock permission-presets plugin fails to mount for workspace-write+never (\"did not activate\" diagnostic) -- this means that stock preset-switch plugin is not mounted for this combination, not that sandbox-policy/approval themselves enforce anything; unqualified"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "Spawn cwd option; `dsh --profile headless --help` has no --cwd flag and the headless runner uses process.cwd()",
+                "evidence": "H: dsh 0.2.0-rc.2 --profile headless --help (.aiwg/working/s1-scratch/cli-help/dsh-0.2.0-rc.2.txt); R: installed @deepseek-ai/dsh-headless package lib/index.js `run()`, read on noodle 2026-10-11; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "stdout --json event stream; the last {\"type\":\"final\",\"text\"} line is the answer, required to be the last event with the prior turn_end's reason.kind==\"completed\"",
+                "evidence": "R: installed @deepseek-ai/dsh-headless package lib/json-stream-*.js + lib/index.js, read on noodle 2026-10-11; confirmed live via the no-model probe's exact session/status/final lines; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-text: the \"-\" task argument reads stdin to EOF",
+                "evidence": "H+R: dsh 0.2.0-rc.2 --profile headless --help (\"`-` reads stdin\"); no-model probe on noodle 2026-10-11 confirmed stdin arity (empty stdin -> \"a task is required\"; piped text -> reaches MISSING_CREDENTIAL, never a model call); unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "no --output-schema or structured-final flag documented on `--profile headless --help`",
+                "evidence": "H: dsh 0.2.0-rc.2 --profile headless --help (.aiwg/working/s1-scratch/cli-help/dsh-0.2.0-rc.2.txt); unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "no per-invocation step-cap flag documented on `--profile headless --help`",
+                "evidence": "H: dsh 0.2.0-rc.2 --profile headless --help (.aiwg/working/s1-scratch/cli-help/dsh-0.2.0-rc.2.txt); unknown controls block tasks requiring them"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "no trust-workspace flag documented on `--profile headless --help`",
+                "evidence": "H: dsh 0.2.0-rc.2 --profile headless --help (.aiwg/working/s1-scratch/cli-help/dsh-0.2.0-rc.2.txt); unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "subagent/fork tools (tool-subagent, tool-subagent-fork, subagent-spawn-in-process, subagent-fork-in-process) are bundled by default; a disabling patch is not live-verified",
+                "evidence": "R: installed @deepseek-ai/dsh package default profile config, read on noodle 2026-10-11; needs a verified disabling --patch before this control can be native"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "no CLI-level fallback-model control documented; agent-default-model is the only model source",
+                "evidence": "H: dsh 0.2.0-rc.2 --profile headless --help (.aiwg/working/s1-scratch/cli-help/dsh-0.2.0-rc.2.txt); this profile never emits a fallback"
+              }
+            },
+            "envAllowlist": [
+              "DEEPSEEK_API_KEY"
+            ],
+            "pitfalls": [
+              "buildWorkerArgs emits ${artifact:dsh-patch}; buildWorkerArtifacts declares the pure overlay. The launcher owns exclusive/no-follow private file creation and cleanup. Controls remain unqualified pending an authenticated run.",
+              "Documentation/help, schema-dump and synthetic observations are not authenticated live qualification.",
+              "Reaching MISSING_CREDENTIAL on a no-model probe proves the --patch file is parsed before any model call; it proves neither sandbox confinement nor approval semantics, since no probe without a real model call can exercise a tool call.",
+              "danger-full-access (the only shipped preset pairing approval:never) is a full bypass and is never emitted; this profile would patch sandbox-policy/approval directly instead, with unverified effect.",
+              "The stock dsh-permission-presets plugin fails to mount (\"did not activate\" diagnostic) for the workspace-write+never combination; this means only that the stock preset-switch plugin itself is unmounted, not that sandbox-policy/approval enforce anything.",
+              "With DSH_HOME unset (KNOWN GAP: getEnvOverrides() has no invocation context to synthesize a per-run isolated home without a shared-code change), the operator's own profiles/plugins load and could alter behavior.",
+              "The agent-default-model/sandbox-policy/approval overlay shape comes only from --dump-config-schema/--dump-default-config, never from a live run; treat it as unverified, not confirmed.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-deepseek-harness-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "text",
+                "thinking",
+                "tool_call",
+                "tool_result"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/deepseek-harness/health/manifest-direct.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "process-only",
+              "evidenceGrades": [
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/deepseek-harness-adapter.mjs",
+                  "observedAt": "2026-10-11T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-44",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "windsurf": {
       "agent": "unsupported",
@@ -200,7 +2284,22 @@
       "artifactFormat": "Informational policy only",
       "verification": "Assert unsupported fields are omitted",
       "sourceUrl": "https://docs.devin.ai/desktop/cascade/skills",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthCoverage": {
+        "scope": "out",
+        "coverage": "unobserved",
+        "handshake": "unobserved",
+        "evidenceGrades": [
+          "R",
+          "D"
+        ],
+        "qualificationOwner": "B-OG-47",
+        "provenance": [
+          "src/providers/provider-definitions.ts#windsurf",
+          "https://docs.devin.ai/cli/reference/commands.md"
+        ],
+        "reason": "Desktop/client capability does not establish a headless worker interface."
+      }
     },
     "openclaw": {
       "agent": "native",
@@ -213,7 +2312,188 @@
       "artifactFormat": "JSON/JSONC runtime configuration",
       "verification": "Inspect resolved subagent metadata",
       "sourceUrl": "https://docs.openclaw.ai/tools/subagents",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "openclaw",
+        "provider": "openclaw",
+        "adapterVersion": "1",
+        "supportedVersions": "2026.10.1",
+        "runtimeDriver": "installed:openclaw",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "openclaw",
+          "argv": [
+            "agent",
+            "exec",
+            "--isolated",
+            "--auth-env-only",
+            "--json",
+            "--model",
+            "${model}",
+            "--thinking",
+            "${effort}",
+            "--cwd",
+            "${workspace}",
+            "--message-file",
+            "${briefPath}"
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "OPENROUTER_API_KEY"
+          ],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "2026.10.1",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[--model provider/model] global flag; exact observed provider/model id, never an alias, 'auto' or 'default'",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --model <id> (provider/model or model id); unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "[--thinking T] with T in [off, minimal, low, medium, high, xhigh, max, ultra]; 'adaptive' is excluded and never emitted (OpenClaw choosing its own level is a let-the-tool-pick value)",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --thinking off|minimal|low|medium|high|xhigh|adaptive|max|ultra; unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no sandbox/permission flag is evidenced on `agent exec --help`; an isolated run source-confirms agents.defaults.sandbox.mode=\"off\" with tools.fs.workspaceOnly=true and tools.exec.mode=\"full\" (not flag-controlled)",
+                "evidence": "R: openclaw 2026.10.1 installed package dist/agent-exec-input-C7lx24Ak.mjs buildExecConfigDefaults/resolveExecBaseConfig, read 2026-10-10; unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable: no approval-policy flag on `agent exec --help`; --isolated skips ambient config and plugin/MCP install roots entirely, so there is no pending-approval surface to bypass in a one-shot run",
+                "evidence": "R: openclaw 2026.10.1 installed package dist/agent-exec-4ENgJefG.mjs (pluginInstallContext skipped when opts.isolated), read 2026-10-10; unqualified until live evidence"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "[--cwd W] sets both the agent workspace and tool working directory",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --cwd <dir>; unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "[--json] one envelope object on stdout after completion (final-json): {ok, status, final, payloads, model, provider, sessionId, error?}; no -o/output-file flag is evidenced",
+                "evidence": "H+R: openclaw 2026.10.1 agent exec --help documents --json; envelope shape read from installed package dist/agent-exec-4ENgJefG.mjs writeAgentExecOutput, 2026-10-10; unqualified until live evidence"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "closed: the brief is a host-written file passed as --message-file <briefPath>; brief text never enters argv or stdin",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --message-file <path> (max 4 MiB UTF-8 file); unqualified until live evidence"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no output-schema parameter is evidenced on `agent exec --help`",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help; tasks requiring a schema-bound output are blocked"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step or turn cap flag is evidenced; --timeout <seconds> bounds wall-clock only and is not emitted by this profile",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --timeout <seconds> (deadline only, default 600); no step-cap flag exists"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unknown: workspace trust behaviour is not evidenced beyond tools.fs.workspaceOnly=true under --isolated",
+                "evidence": "R: openclaw 2026.10.1 installed package dist/agent-exec-input-C7lx24Ak.mjs, read 2026-10-10; live qualification required"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unavailable: no per-call subagent/child disable is evidenced on `agent exec --help`",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help shows no subagent control; tasks requiring child limits are blocked"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable by design: --fallback <provider/model> exists (repeatable, requires --model) but is never emitted -- no implicit fallback per the S1 direct-handoff scope",
+                "evidence": "H: openclaw 2026.10.1 agent exec --help documents --fallback; this profile never passes it"
+              }
+            },
+            "envAllowlist": [
+              "OPENROUTER_API_KEY"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "`openclaw agent` (without `exec`) routes through the Gateway and can `--deliver` a reply to a chat channel; this profile only ever uses `agent exec` and never emits `--deliver`/`--to`/`--channel`/`--reply-*`.",
+              "--fallback is help-evidenced but never emitted by this profile: no implicit fallback chain.",
+              "--isolated discards ambient config and plugin/MCP install roots; a task depending on configured skills or MCP servers is out of scope for this profile.",
+              "NO CLI SANDBOX: an isolated run has sandbox.mode=\"off\" and tools.exec.mode=\"full\" (source-confirmed) -- the embedded agent can run arbitrary shell commands; only file TOOLS are bounded to --cwd (tools.fs.workspaceOnly), command execution is not. sandboxModes advertises \"external\" only; this profile requires a conductor-owned external boundary (container/worktree/VM isolation) and refuses any read-only or workspace-write sandbox request before rendering argv."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "final-json",
+              "signalParser": "provider-openclaw-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/openclaw/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "process-only",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/openclaw-adapter.mjs (openclaw 2026.10.1 agent exec --help, captured on noodle)",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "2026.10.1"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/openclaw-adapter.mjs (installed openclaw 2026.10.1 npm package dist/agent-exec-4ENgJefG.mjs + dist/agent-exec-input-C7lx24Ak.mjs, read on noodle)",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "2026.10.1"
+                }
+              ],
+              "qualificationOwner": "B-OG-42",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "grokbot": {
       "agent": "unsupported",
@@ -226,7 +2506,22 @@
       "artifactFormat": "Informational only",
       "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational",
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
-      "verifiedAt": "2026-09-15"
+      "verifiedAt": "2026-09-15",
+      "workerHealthCoverage": {
+        "scope": "out",
+        "coverage": "unobserved",
+        "handshake": "unobserved",
+        "evidenceGrades": [
+          "R",
+          "D"
+        ],
+        "qualificationOwner": "B-OG-47",
+        "provenance": [
+          "src/providers/provider-definitions.ts#grokbot",
+          "https://docs.x.ai/grok-bot/overview.md"
+        ],
+        "reason": "CreateAgent/registered-machine capability does not establish a CLI worker contract."
+      }
     },
     "grok-build": {
       "agent": "inherited",
@@ -239,7 +2534,192 @@
       "artifactFormat": "Grok Build model alias",
       "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers",
       "sourceUrl": "https://docs.x.ai/build/settings",
-      "verifiedAt": "2026-09-21"
+      "verifiedAt": "2026-09-21",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "grok-build",
+        "provider": "grok-build",
+        "adapterVersion": "1",
+        "supportedVersions": "1.0.50",
+        "runtimeDriver": "installed:grok-build",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "grok",
+          "argv": [
+            "--prompt-file",
+            "${brief}",
+            "-m",
+            "${model}",
+            "--reasoning-effort",
+            "${effort}",
+            "--permission-mode",
+            "dontAsk",
+            "--sandbox",
+            "${sandbox}",
+            "--cwd",
+            "${workspace}",
+            "--output-format",
+            "streaming-json",
+            "--no-subagents",
+            "--no-plan",
+            "--no-alt-screen",
+            "--disable-web-search"
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [
+            "XAI_API_KEY",
+            "HOME"
+          ],
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "read-only",
+            "workspace-write"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "1.0.50",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "-m, --model <MODEL> (exact model id only; 'auto'/'default' and generic Ralph-loop aliases are refused; the driver also refuses any option-prefixed or whitespace-containing value)",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('-m, --model <MODEL> Model ID to use'; root --help lists no enum)"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--reasoning-effort <EFFORT> (none|minimal|low|medium|high|xhigh|max), always explicit; alias --effort never emitted",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--reasoning-effort <EFFORT> Reasoning effort for reasoning models [aliases: --effort]'; full value set from the installed binary's own error text: \"invalid reasoning effort: ... (expected one of: none, minimal, low, medium, high, xhigh, max)\")"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "--sandbox <PROFILE>, always explicit for every mode; read-only -> 'read-only', workspace-write -> 'workspace'; 'off'/'devbox'/'strict' never emitted",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--sandbox <PROFILE> Sandbox profile for filesystem and network access [env: GROK_SANDBOX=]'; bundled sandbox doc: built-in profiles 'off, workspace, devbox, read-only, strict; or a custom profile name', default with no flag is 'off'; per-profile semantics table preserved in the evidence file)"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--permission-mode dontAsk (the CLI's only non-prompting, non-bypass mode: \"Only pre-approved tools and built-in read-only handling\" / \"Strict CI allowlists\" / \"denies whatever it would have to prompt for\") plus scoped --allow/--deny rule tokens from the resolved permission tuple; --always-approve and --permission-mode bypassPermissions are never emitted",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--permission-mode <MODE> [possible values: default, acceptEdits, auto, dontAsk, bypassPermissions, plan]'; bundled permission-modes table preserved verbatim in the evidence file; '--allow <RULE> Permission allow rule (compat alias: --allowedTools)'; '--deny <RULE> Permission deny rule (compat alias: --disallowedTools)')"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "--cwd <CWD>",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--cwd <CWD> Working directory')"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "stdout --output-format streaming-json (NDJSON, one ACP session update per line); the final 'end' event's stopReason plus concatenated 'text' chunks form the answer; no separate output-file flag is evidenced. NOTE: the SEPARATE, pre-existing src/providers/grok-build-headless.ts transport and its shared tools/ralph-external/lib/worker-health.mjs generic branch use a different, older message/result event shape and --output-format json (a single JSON object); this direct-shell profile's own observeHealthEvent/parseDirectFinal handle only the streaming-json/ACP shape and never touch that other path.",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--output-format <OUTPUT_FORMAT> ... streaming-json: NDJSON: one ACP session update per line, the agent's native format'; bundled output-format doc gives the full event vocabulary and a worked example, preserved in the evidence file, confirming 'json' is a single object with text/stopReason/sessionId/requestId/usage fields -- NOT the message/result shape -- and 'streaming-json' is the ACP-derived text/thought/tool_call/tool_call_update/usage/plan/available_commands/end/error vocabulary)"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "unavailable for the brief: -p/--single <PROMPT> and --prompt-json <JSON> are argv-only; the brief instead rides on --prompt-file <PATH> ('Single-turn prompt from a file')",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('-p, --single <PROMPT> Single-turn prompt. Prints the response to stdout and exits'; '--prompt-file <PATH> Single-turn prompt from a file'; '--prompt-json <JSON> Single-turn prompt as JSON content blocks')"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "the ACP-derived streaming-json event grammar itself (module doc in grok-build-adapter.mjs); no --json-schema structured-output constraint is used by this profile",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--json-schema <SCHEMA> JSON Schema for structured output ... Implies --output-format json'; never emitted here since this profile pins streaming-json)"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: --max-turns <N> bounds agent turns but no qualified cap value is evidenced; never emitted by this profile",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--max-turns <N> Maximum number of agent turns')"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "--disable-web-search (removes the one evidenced built-in external-network tool so the AIWG worker-invoke bridge remains the one MCP/tool route); no flag to disable configured MCP servers is evidenced (grok has no built-in MCP server, only a user/project mcp.json; unavailable, not invented)",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--disable-web-search Disable web search and web fetch tools')"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "--no-subagents (disables subagent spawning; denies hidden fan-out)",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md) ('--no-subagents Disable subagent spawning')"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unavailable: no model/account fallback-selection flag is evidenced",
+                "evidence": "H: grok 1.0.50 (c58f321264ba, stable) --help, captured 2026-10-10 (.aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt); plus the installed binary's own bundled docs (strings-read, never live qualification; full extracts preserved in docs/providers/grok-build-cli-evidence.md)"
+              }
+            },
+            "envAllowlist": [
+              "XAI_API_KEY",
+              "HOME"
+            ],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "The separate, pre-existing src/providers/grok-build-headless.ts transport and the generic grok-build branch in tools/ralph-external/lib/worker-health.mjs use --output-format json and an older message/result event shape; this profile's streaming-json/ACP grammar is independent and does not change that path or its consumers.",
+              "No --no-ask-user-equivalent flag is listed in the captured root --help for this version (an internal no-ask-user arg name exists in the compiled binary's own strings but is not printed help text), so it is never emitted; whether an ask_user_question tool call blocks indefinitely under dontAsk in a non-interactive run is unqualified, not invented away.",
+              "--always-approve and --permission-mode bypassPermissions are never emitted; a scoped --allow/--deny rule value, or the model/effort value, starting with '-' or containing whitespace/control characters is refused by the driver before argv is built.",
+              "Permission-mode and sandbox-profile semantics are quoted directly from the installed binary's own bundled documentation (see docs/providers/grok-build-cli-evidence.md for the full extracts, strings command and binary version/hash); where that documentation does not settle a question (e.g. ask_user_question behavior under dontAsk), the control stays unqualified rather than assumed safe.",
+              "Live qualification is an open S1 blocker: this profile has been exercised only against --help/--version/subcommand --help plus strings-read bundled docs, never a live prompted run. The smoke command in docs/providers/grok-build-direct.md is the first live check and needs an XAI_API_KEY (or cached grok login) from the operator."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-grok-build-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [
+                "distinct tool_call/tool_call_update toolCallId"
+              ],
+              "stopEvidence": "owned process identity and observed exit; the documented terminal 'end' event's stopReason === 'end_turn' plus a standalone 'error' event or a failed tool_call/tool_call_update anywhere always defeats a clean-looking exit; any event observed after 'end' is itself a contract violation and fails the parse",
+              "fixtureRef": "test/fixtures/providers/grok-build/direct-health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": ".aiwg/working/s1-scratch/cli-help/grok-1.0.50.txt",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "1.0.50"
+                }
+              ],
+              "qualificationOwner": "B-OG-41",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "hermes": {
       "agent": "global-only",
@@ -252,7 +2732,185 @@
       "artifactFormat": "Global CLI/config setting",
       "verification": "Inspect Hermes delegation configuration",
       "sourceUrl": "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "hermes",
+        "provider": "hermes",
+        "adapterVersion": "1",
+        "supportedVersions": "0.21.6",
+        "runtimeDriver": "installed:hermes",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "hermes",
+          "argv": [
+            "chat",
+            "--query-file",
+            "-",
+            "--oneshot",
+            "--quiet",
+            "--ignore-user-config",
+            "--ignore-rules",
+            "--source",
+            "tool",
+            "--provider",
+            "${provider}",
+            "-m",
+            "${model}",
+            "--reasoning",
+            "${effort}"
+          ],
+          "stdin": "brief-text",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionPattern": "^Hermes Agent v([0-9A-Za-z.+-]{1,128}) [^\\r\\n]{1,128}$",
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "text",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "0.21.6",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[-m/--model MODEL] declared directly on the chat subparser (_parser.py:248-249), same semantics as the top-level flag",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "[--reasoning LEVEL] declared on the chat subparser (_parser.py:251-254); LEVEL in [none, minimal, low, medium, high, xhigh, max]; ultra is denied by the shared resolver guard, never emitted",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "no sandbox flag exists for chat; this control routes through the shared resolver's external-boundary requirement for hermes (requiresWorkerExternalBoundary), not a CLI flag",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "--ignore-user-config always emitted: falls back to the safe built-in defaults (approvals.mode: \"smart\", approvals.single_query_mode: \"deny\"; config_defaults.py:1679,1682) regardless of the host's config.yaml, defeating single_query_mode: approve/off/allow/yes (approval_context.py:298-304,313-315) and approvals.mode: off (approval.py:967). HERMES_YOLO_MODE is a process env var frozen at import (approval.py:46); defeated structurally by the empty envAllowlist and env -i renderer, not by a flag, and proven by an explicit assertion (HD10). Re-verified against hermes 0.21.6 (~/.hermes/hermes-agent): same semantics, refactored into tools/approval_context.py's _binary_approval_mode helper.",
+                "evidence": "D: hermes 0.21.6 installed source (~/.hermes/hermes-agent: tools/approval.py:46,967; tools/approval_context.py:298-304,313-315; hermes_cli/config_defaults.py:1679,1682); never live-qualified"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "conductor process cwd only; chat also accepts --in DIR but this profile relies on the renderer's own `cd <workdir> &&` prefix instead",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "chat --quiet routes through _run_quiet_single_query (cli_single_query.py:199-343), which calls cli.agent.run_conversation() directly and prints stdout via `elif response: print(response)` only (cli_single_query.py:314-315); on failure stdout is empty and the error/session_id go to stderr (cli_single_query.py:310-313,341). No usage-file/JSON-report equivalent exists for chat (oneshot.py:215-324, -z only). On hermes 0.21.6, _single_query_exit_code (cli_single_query.py:152-194) now returns exit 1 whenever failed/partial/completed-is-False is set, which FIXES the 0.20.6 case where reasoning-budget exhaustion (then: agent/conversation_loop.py:3902; now: agent/turn_truncation.py:95-180's partial_result()) exited 0 with free text. parseWorkerFinal still also requires the final text to parse as a strict workerClaims JSON document (#2890) as defense in depth: a genuinely completed turn's model output is not guaranteed to be valid JSON regardless of exit code.",
+                "evidence": "D: hermes 0.21.6 installed source (~/.hermes/hermes-agent: hermes_cli/cli_single_query.py:152-194,199-343,310-315,341; agent/turn_truncation.py:95-180; hermes_cli/oneshot.py:215-324); never live-qualified"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "[--query-file -] reads the single query from stdin to EOF, nothing shell-interpreted (_parser.py:235-242); dispatched at main.py:1711-1712 (args.query = sys.stdin.read()); the brief never enters argv",
+                "evidence": "D: hermes 0.21.6 installed source (~/.hermes/hermes-agent: hermes_cli/main.py, hermes_cli/_parser.py, hermes_cli/cli_single_query.py, tools/approval.py); never live-qualified"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: hermes chat --help documents no structured/JSON output flag",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: hermes chat --help documents --max-turns for the seeded-interactive path only, not for the --oneshot single-query exit; not relied on by this profile",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unavailable: hermes chat --help documents no workspace-trust flag distinct from the deny-by-default single_query_mode approval gate",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "-t/--toolsets restricts enabled toolsets for the call; no nested-agent-specific control is documented",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation; supersedes the stale root /usr/local/lib/hermes-agent 0.20.6 copy); unqualified until live evidence"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "--provider PROVIDER pins the inference provider for this call; always emitted by this profile (never omitted) because --ignore-user-config removes the config.yaml provider fallback and the empty envAllowlist removes the HERMES_INFERENCE_PROVIDER fallback, so an omitted --provider resolves to the literal \"auto\" (resolve_requested_provider, runtime_provider.py:490-499) and silently picks whatever ambient credential Hermes finds; hermes fallback/moa subcommands configure persistent chains, not a per-call override",
+                "evidence": "H: hermes 0.21.6+387.gdce1e9b `hermes chat --help` (installed per-user, ~/.hermes/hermes-agent, titan, 2026-10-10 observation); confirmed by TWO live conductor smoke runs: 0.20.6 on 2026-10-09 (omitted --provider failed with \"No inference provider configured\" under --ignore-user-config) and 0.21.6 on 2026-10-10 (`--provider openrouter -m anthropic/claude-sonnet-4.6 --reasoning low` exited 0 with the exact instructed stdout) — still unqualified pending a repeatable, authorized live-qualification pass"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "Documentation/help and installed-source reading are not authenticated live qualification.",
+              "This profile deliberately does NOT use the top-level -z/--oneshot PROMPT path: that dest is argv-only (no stdin/file option) and oneshot.py unconditionally sets HERMES_YOLO_MODE=1 with no override, and its exit code can be 0 even when its own usage-file failed flag is true.",
+              "Exit code 0 alone is still not treated as completion evidence by this profile, even though hermes 0.21.6 fixed the specific 0.20.6 bug this guarded against: on 0.20.6, reasoning-budget exhaustion (then agent/conversation_loop.py:3902) returned completed:false/partial:true with no \"failed\" key and still exited 0; on 0.21.6 the same case (now agent/turn_truncation.py:95-180's partial_result()) correctly exits 1 via _single_query_exit_code (cli_single_query.py:152-194). parseWorkerFinal keeps requiring a strict workerClaims JSON parse in addition to the exit-derived status, now as defense in depth against a completed turn whose model output simply isn't valid JSON.",
+              "Approval policy is host config (approvals.mode, approvals.single_query_mode in config.yaml), not an argv flag; --ignore-user-config pins it to the safe built-in defaults, but this is read from source, not live-qualified, so the approval control stays unqualified.",
+              "HERMES_YOLO_MODE (and any HERMES_* override) must never reach the worker process; this relies on the empty envAllowlist and the renderer's env -i, not on a CLI flag.",
+              "chat --query-file - --oneshot --quiet has no --usage-file/JSON-report equivalent; final-output extraction is stdout-text-on-exit-0 PLUS a strict workerClaims parse, never exit code or stdout non-emptiness alone.",
+              "A partial response can still print to stdout before a failed turn; only the exit code (not stdout non-emptiness) distinguishes that case from success, and even exit 0 is not sufficient (see above).",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "--provider defaults to \"auto\" (hermes_cli/runtime_provider.py:490-499) when omitted; under --ignore-user-config and the empty envAllowlist both of its fallbacks (config.yaml model.provider, HERMES_INFERENCE_PROVIDER) are unreachable, so this profile always emits an explicit --provider from the resolved selection and refuses a missing value or the literal \"auto\". Confirmed by live smoke runs on both 0.20.6 (failure) and 0.21.6 (success with --provider openrouter).",
+              "On hermes 0.20.6, --quiet --oneshot could still print a startup diagnostic to stdout before the final response (that build's _ensure_tirith_security, the tirith-scanner-unavailable warning). On hermes 0.21.6 the tirith scanner was removed entirely (hermes_cli/config_migrations.py:686-702, \"the bundled tirith scanner left Hermes\") and a 2026-10-10 conductor smoke run on 0.21.6 confirmed the line no longer appears; a broader source grep across ~/.hermes/hermes-agent found no other bare-\"⚠\" _cprint site reachable from this profile's --quiet dispatch. parseWorkerFinal still strips that exact leading diagnostic shape as defensive, forward-compatible tolerance (harmless no-op on 0.21.6), and still fails on unrecognized preamble or a diagnostic appearing after the real final."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "plain",
+              "signalParser": "provider-hermes-health-v1",
+              "sessionLogLocator": "hermes-session-correlated-v1",
+              "progressEvidence": [
+                "session/turn-correlated completed tool marker"
+              ],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/hermes/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/hermes-adapter.mjs",
+                  "observedAt": "2026-10-10T00:00:00Z",
+                  "cliVersion": "0.21.6"
+                }
+              ],
+              "qualificationOwner": "B-OG-48",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "openhuman": {
       "agent": "compiled",
@@ -265,9 +2923,176 @@
       "artifactFormat": "Standalone TOML agent definition",
       "verification": "Parse against OpenHuman definition schema",
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-07-20",
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "openhuman",
+        "provider": "openhuman",
+        "adapterVersion": "1",
+        "supportedVersions": "0.64.14",
+        "runtimeDriver": "installed:openhuman",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "openhuman-core",
+          "argv": [
+            "--model",
+            "${model}",
+            "call",
+            "--method",
+            "openhuman.agent_chat",
+            "--params-stdin"
+          ],
+          "stdin": "brief-json",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionArgv": [
+            "--help"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "validated-file",
+          "modelPin": "unsupported",
+          "effort": "unsupported",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": "0.64.14",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "[\"--model\"] global flag before `call`, mirrored as params.model_override",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 core/cli.rs parse_launch_options and agent/schemas.rs agent.chat model_override; unqualified until live model-pin evidence"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "unavailable: agent.chat exposes no effort or reasoning parameter",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 agent/schemas.rs; tasks requiring effort are blocked"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "unavailable: no per-call sandbox flag; external boundary required",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32; SecurityPolicy autonomy is config-owned and unqualified"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "unavailable: no per-call approval flag; external boundary required",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32; SecurityPolicy autonomy is config-owned and unqualified"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "conductor process cwd, mirrored as params.cwd (must be an existing directory)",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 agent/schemas.rs agent.chat cwd"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "pretty-printed JSON result on stdout after completion (final-json), captured to the stdout path",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 core/cli.rs:486 (to_string_pretty result on stdout)"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "brief-json: conductor-framed params JSON (message, model_override, cwd) piped on stdin and closed at EOF; brief text never enters argv",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 core/cli.rs:445-468 (--params-stdin reads stdin to EOF)"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "unavailable: no output-schema parameter evidenced",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 agent/schemas.rs"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "unavailable: no step or turn cap evidenced",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 agent/schemas.rs"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "unknown: workspace trust behaviour not evidenced",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32; live qualification required"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "unknown: orchestrator may spawn subagents bounded only by MAX_SPAWN_DEPTH; no per-call disable evidenced",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32 mcp/server/subagent_depth.rs"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "unknown: provider/model fallback behaviour not evidenced",
+                "evidence": "D: openhuman-core 0.64.14 source @216ea32; live qualification required"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "Documentation/help and synthetic observations are not authenticated live qualification.",
+              "Unknown model, effort, permission or required step mappings block dispatch.",
+              "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
+              "No version flag is evidenced in source; versionArgv runs the documented general help only, so installed-version identity stays unavailable until live qualification pins it.",
+              "The brief travels only on stdin, inside the conductor-framed --params-stdin JSON (message, model_override, cwd); effort, step-cap, approval/sandbox and child-agent controls are unknown and block tasks requiring them.",
+              "Native `openhuman-core mcp` agent.run_subagent accepts only agent_id and prompt and may nest subagents; it cannot stand in for a model-pinned worker call.",
+              "Live qualification is an open S1 blocker: openhuman-core is not installed on an authorized host and its probe budget is only proposed."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "final-json",
+              "signalParser": "provider-openhuman-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/openhuman/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "process-only",
+              "evidenceGrades": [
+                "D"
+              ],
+              "provenance": [
+                {
+                  "kind": "documentation",
+                  "ref": "https://github.com/tinyhumansai/openhuman/blob/216ea322a3c1269dada70751ac5c08eac7dc7596/crates/openhuman-core/src/core/cli.rs",
+                  "observedAt": "2026-10-08T00:00:00Z",
+                  "cliVersion": "0.64.14"
+                }
+              ],
+              "qualificationOwner": "B-OG-47",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
     },
     "muse": {
+      "sessionEnvAllowlist": [
+        "AIWG_MUSE_STUB_SCENARIO",
+        "AIWG_MUSE_STUB_RECEIPT"
+      ],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "informational",
@@ -276,17 +3101,351 @@
       "invalidPinFallback": "muse exits 1 with run.terminal.failed (\"model `<id>` does not exist or you lack access\"); never falls back to another model",
       "configTarget": "$XDG_CONFIG_HOME/muse/settings.json `model` (read-only; AIWG never writes it)",
       "artifactFormat": "Meta provider model id (session-level only)",
-      "verification": "muse exec --json --model <id> emits run.model.configured with model_id; observed muse-spark-1.3 and muse-spark-1.3-contributor in native session logs on Muse Code 1.4.0",
+      "verification": "run.model.configured is runtime-configured-only evidence, never backend identity; authenticated direct profile remains unqualified",
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-muse-provider-target.md",
       "verifiedAt": "2026-09-25",
       "effortValues": [
+        "none",
         "minimal",
         "low",
         "medium",
         "high",
         "xhigh",
-        "max"
-      ]
+        "max",
+        "ultra"
+      ],
+      "workerHealthAdapter": {
+        "version": 1,
+        "id": "muse",
+        "provider": "muse",
+        "adapterVersion": "1",
+        "supportedVersions": ">=1.4.4-R5419.1 <2.0.0",
+        "runtimeDriver": "tools/ralph-external/lib/muse-adapter.mjs",
+        "catalogAdapter": {
+          "kind": "file",
+          "locator": "agentic/code/providers/model-catalog.v1.json",
+          "parser": "existing-provider-catalog"
+        },
+        "invocation": {
+          "kind": "process",
+          "executable": "muse",
+          "argv": [
+            "exec",
+            "--json",
+            "--provider",
+            "meta",
+            "--model",
+            "${model}",
+            "--reasoning-effort",
+            "${effort}",
+            "--workspace",
+            "${workspace}",
+            "--approval-mode",
+            "never",
+            "--approval-judge",
+            "off",
+            "--max-model-steps",
+            "${maxSteps}",
+            "--output-schema",
+            "${schema}",
+            "--prompt-file",
+            "${briefFile}"
+          ],
+          "stdin": "closed",
+          "cwd": "${workspace}",
+          "envAllowlist": [],
+          "versionPattern": "^Muse Code ([0-9A-Za-z.+-]{1,128}) \\([0-9A-Za-z.+-]{1,128}\\)$",
+          "versionArgv": [
+            "--version"
+          ],
+          "maxOutputBytes": 10485760
+        },
+        "capabilities": {
+          "output": "native-schema",
+          "modelPin": "requested",
+          "effort": "explicit",
+          "cancel": "none",
+          "resume": false,
+          "sandboxModes": [
+            "external"
+          ],
+          "nestedAgentsControllable": false,
+          "nativeFallbackControllable": false,
+          "hardBudget": []
+        },
+        "qualification": {
+          "status": "unqualified"
+        },
+        "invocationProfiles": {
+          "direct-shell": {
+            "transport": "shell",
+            "supportedVersions": ">=1.4.4-R5419.1 <2.0.0",
+            "controls": {
+              "model": {
+                "support": "unqualified",
+                "mapping": "--model",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "effort": {
+                "support": "unqualified",
+                "mapping": "--reasoning-effort",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "sandbox": {
+                "support": "unqualified",
+                "mapping": "qualified external boundary; native sandbox remains enabled",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "approval": {
+                "support": "unqualified",
+                "mapping": "[\"--approval-mode\",\"never\",\"--approval-judge\",\"off\"]",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "workdir": {
+                "support": "unqualified",
+                "mapping": "--workspace",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "finalOutput": {
+                "support": "unqualified",
+                "mapping": "bounded stdout capture; strict Muse terminal normalization pending shared owner",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "stdin": {
+                "support": "unqualified",
+                "mapping": "closed EOF",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "structuredOutput": {
+                "support": "unqualified",
+                "mapping": "--output-schema",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "stepCap": {
+                "support": "unqualified",
+                "mapping": "--max-model-steps",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "trust": {
+                "support": "unqualified",
+                "mapping": "[]",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "children": {
+                "support": "unqualified",
+                "mapping": "qualified external boundary; no native child-denial flag assumed",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              },
+              "fallback": {
+                "support": "unqualified",
+                "mapping": "qualified external boundary; no implicit model fallback",
+                "evidence": "H/R: Muse Code 1.4.4-R5419.1 help (2026-10-09) and muse-direct synthetic fixtures; needs authorized version/account qualification"
+              }
+            },
+            "envAllowlist": [],
+            "pitfalls": [
+              "Live qualification is an open S1 blocker; installed help and synthetic/echo mechanics are not paid inference qualification.",
+              "Configured-model events provide runtime-configured identity only, never backend attestation.",
+              "Contributor data policy is explicit; shared policy denies contributor models and never silently selects the CLI default.",
+              "Workspace trust defaults off; only a host-qualified trust mapping may load rules/skills. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
+              "Host qualification must bind an absolute output-schema mapping and include that schema in runtimeFiles.",
+              "Muse JSONL strict normalization needs the shared strict-parser hook; the MCP bridge must consume the selected provider parser. MSP is not MCP.",
+              "Semantic step/tool completion grammar and native session-log layout remain unavailable; unrelated logs, deltas and CPU cannot establish progress.",
+              "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions."
+            ],
+            "health": {
+              "version": 1,
+              "handshake": "process-only",
+              "outputFraming": "jsonl",
+              "signalParser": "provider-muse-health-v1",
+              "sessionLogLocator": null,
+              "progressEvidence": [],
+              "stopEvidence": "owned process identity and observed exit; terminal text alone is insufficient",
+              "fixtureRef": "test/fixtures/providers/muse/health/manifest.json",
+              "qualifiedAt": null,
+              "statusOperation": null,
+              "cancelOperation": null,
+              "coverage": "degraded",
+              "qualificationTarget": "semantic",
+              "evidenceGrades": [
+                "H",
+                "R"
+              ],
+              "provenance": [
+                {
+                  "kind": "help",
+                  "ref": "tools/ralph-external/lib/muse-adapter.mjs",
+                  "observedAt": "2026-10-09T00:00:00Z",
+                  "cliVersion": "1.4.4-R5419.1"
+                },
+                {
+                  "kind": "repository",
+                  "ref": "tools/ralph-external/lib/muse-adapter.mjs",
+                  "observedAt": "2026-10-07T00:00:00Z",
+                  "cliVersion": null
+                }
+              ],
+              "qualificationOwner": "B-OG-08",
+              "qualification": {
+                "status": "unqualified",
+                "scopeDigest": null,
+                "cliVersion": null,
+                "accountScope": null,
+                "profileRef": null,
+                "modelKey": null,
+                "effort": null,
+                "authorizedLive": false
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "workerHealthAdapters": {
+    "local-http": {
+      "version": 1,
+      "id": "local-http",
+      "provider": "ollama",
+      "adapterVersion": "1",
+      "supportedVersions": "*",
+      "runtimeDriver": "unavailable",
+      "catalogAdapter": {
+        "kind": "http",
+        "locator": "/api/tags",
+        "parser": "ollama-model-list-v1",
+        "timeoutSeconds": 10,
+        "maxBytes": 65536
+      },
+      "invocation": {
+        "kind": "http",
+        "protocol": "ollama",
+        "healthPath": "/api/version",
+        "modelsPath": "/api/tags",
+        "generatePath": "/api/generate",
+        "timeoutSeconds": 1800,
+        "maxOutputBytes": 10485760
+      },
+      "capabilities": {
+        "output": "validated-file",
+        "modelPin": "unsupported",
+        "effort": "not-applicable",
+        "cancel": "none",
+        "resume": false,
+        "sandboxModes": [
+          "external"
+        ],
+        "nestedAgentsControllable": false,
+        "nativeFallbackControllable": false,
+        "hardBudget": []
+      },
+      "qualification": {
+        "status": "unqualified"
+      },
+      "invocationProfiles": {
+        "direct-http": {
+          "transport": "shell",
+          "supportedVersions": "*",
+          "controls": {
+            "model": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "effort": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "sandbox": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "approval": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "workdir": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "finalOutput": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "stdin": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "structuredOutput": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "stepCap": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "trust": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "children": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            },
+            "fallback": {
+              "support": "unqualified",
+              "mapping": "unavailable pending installed profile qualification",
+              "evidence": "synthetic health fixtures do not qualify invocation controls"
+            }
+          },
+          "envAllowlist": [],
+          "pitfalls": [
+            "Documentation/help and synthetic observations are not authenticated live qualification.",
+            "Unknown model, effort, permission or required step mappings block dispatch.",
+            "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority."
+          ],
+          "health": {
+            "version": 1,
+            "handshake": "unobserved",
+            "outputFraming": "http-stream",
+            "signalParser": "provider-local-http-health-v1",
+            "sessionLogLocator": null,
+            "progressEvidence": [
+              "distinct request-bound response content"
+            ],
+            "stopEvidence": "request-bound completion; cancellation uncertain",
+            "fixtureRef": "test/fixtures/providers/local-http/health/manifest.json",
+            "qualifiedAt": null,
+            "statusOperation": null,
+            "cancelOperation": null,
+            "coverage": "degraded",
+            "qualificationTarget": "unobserved",
+            "evidenceGrades": [],
+            "provenance": [],
+            "qualificationOwner": "B-OG-09",
+            "qualification": {
+              "status": "unqualified",
+              "scopeDigest": null,
+              "cliVersion": null,
+              "accountScope": null,
+              "profileRef": null,
+              "modelKey": null,
+              "effort": null,
+              "authorizedLive": false
+            }
+          }
+        }
+      }
     }
   }
 }