@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/config/aiwg-config.js

@@ -1,3 +1,4 @@
+import { validateDecisionConfig } from './decision-config.js';
 /**
  * Project-Level AIWG Config
  *
@@ -8,6 +9,18 @@
  *
  * @implements #621
  */
+import { validateImportExclusions } from '../sessions/import-exclusions.js';
+import { resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
+export { DEFAULT_DISPATCH_HOST_THRESHOLDS, resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
+import { validateIndexGraphOverrides } from './index-graph-overrides.js';
+import { DEFAULT_RULES_INLINE_BUDGET_TOKENS } from '../rules/inline-budget.mjs';
+export { validateRulesConfig, resolveRulesInlineBudget } from '../rules/inline-budget.mjs';
+import { loadRulePinConfigs, installedRuleCapabilities, validateRulePinCapabilities } from '../rules/pins.mjs';
+import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { isCanonicalWorkerModelKey, loadProviderModelCapabilities, resolveWorkerInstallation } from '../models/provider-policy.js';
 import { readFile, writeFile, mkdir, access, readdir, rename, unlink } from 'fs/promises';
 import { createHash, randomBytes } from 'crypto';
 import { resolve, join, dirname, isAbsolute } from 'path';
@@ -162,6 +175,166 @@ export function resolveDelivery(delivery) {
         issue_comment_on_cycle: delivery?.issue_comment_on_cycle ?? true,
     };
 }
+let parallelismValidator;
+/** Offline shape and declaration validation. Qualification is checked at use time. */
+export function validateParallelismConfig(value) {
+    if (value === undefined)
+        return [];
+    if (!parallelismValidator) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const candidates = [resolve(here, '../../vscode-extension/schemas/aiwg.config.v1.json'), resolve(here, '../../../vscode-extension/schemas/aiwg.config.v1.json')];
+        const file = candidates.find(existsSync);
+        if (!file)
+            throw new Error('Parallelism schema is unavailable');
+        const schema = JSON.parse(readFileSync(file, 'utf8'));
+        const ajv = addFormats(new Ajv({ strict: true, allErrors: true }));
+        parallelismValidator = ajv.compile({ ...schema.properties.parallelism, definitions: schema.definitions });
+    }
+    if (!parallelismValidator(value))
+        return (parallelismValidator.errors ?? []).map(error => `OG_CONFIG_REFERENCE /parallelism${error.instancePath}: ${error.message}`);
+    const policy = value;
+    const errors = [];
+    const error = (pointer, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/${pointer}: ${message}`); };
+    const builtinIds = new Set(PROVIDER_IDS.filter(id => id !== 'generic'));
+    for (const [id, installation] of Object.entries(policy.clis ?? {})) {
+        if (installation.adapter.startsWith('providers:') && !builtinIds.has(installation.adapter.slice(10)))
+            error(`clis/${id}/adapter`, 'Unknown provider binding');
+    }
+    for (const [id, group] of Object.entries(policy.groups ?? {})) {
+        const ids = new Set();
+        for (const member of group.members) {
+            if (ids.has(member.id))
+                error(`groups/${id}/members`, 'Duplicate member ID');
+            ids.add(member.id);
+            if (!policy.clis?.[member.cli] && !builtinIds.has(member.cli))
+                error(`groups/${id}/members/${member.id}/cli`, 'Unknown installation');
+        }
+        for (const member of group.fallback ?? [])
+            if (!ids.has(member))
+                error(`groups/${id}/fallback`, 'Unknown fallback member');
+        for (const role of group.requiredRoles ?? []) {
+            if (!group.members.some(m => m.enabled !== false && policy.clis?.[m.cli]?.enabled !== false && m.roles.includes(role)))
+                error(`groups/${id}/requiredRoles`, `No enabled member covers ${role}`);
+        }
+    }
+    const admission = policy.admission;
+    for (const group of Object.keys(admission?.groupCaps ?? {}))
+        if (!policy.groups?.[group])
+            error('admission/groupCaps', 'Unknown group');
+    for (const cli of Object.keys(admission?.cliCaps ?? {}))
+        if (!policy.clis?.[cli] && !builtinIds.has(cli))
+            error('admission/cliCaps', 'Unknown installation');
+    for (const key of Object.keys(admission?.memberCaps ?? {})) {
+        const [group, member, extra] = key.split('/');
+        if (extra !== undefined || !policy.groups?.[group]?.members.some(m => m.id === member))
+            error('admission/memberCaps', 'Unknown group/member');
+    }
+    for (const key of Object.keys(admission?.modelCaps ?? {}))
+        if (!isCanonicalWorkerModelKey(key))
+            error('admission/modelCaps', 'Noncanonical inference model key');
+    if (admission?.hostResources !== undefined) {
+        try {
+            resolveDispatchHostThresholds(undefined, admission.hostResources);
+        }
+        catch (validation) {
+            error('admission/hostResources', validation instanceof Error ? validation.message : String(validation));
+        }
+    }
+    errors.push(...validateWorkerHealthConfig(policy.health));
+    return errors;
+}
+/** Cross-field health preferences are validated offline; controls are qualified at dispatch. */
+export function validateWorkerHealthConfig(health) {
+    if (health === undefined)
+        return [];
+    const errors = [];
+    const error = (field, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/health/${field}: ${message}`); };
+    const checkSeconds = health.checkSeconds ?? 15;
+    if (checkSeconds > (health.startupSeconds ?? 60))
+        error('checkSeconds', 'Must not exceed startupSeconds');
+    if ((health.quietSeconds ?? 90) >= (health.stallSeconds ?? 300))
+        error('quietSeconds', 'Must be less than stallSeconds');
+    if ((health.cooldownSeconds ?? 120) > (health.maxCooldownSeconds ?? 900))
+        error('cooldownSeconds', 'Must not exceed maxCooldownSeconds');
+    for (const role of Object.keys(health.roleScale ?? {})) {
+        if (!['efficiency', 'coding', 'reasoning'].includes(role))
+            error('roleScale', `Unknown role ${role}`);
+    }
+    for (const field of ['modelScale', 'modelStartupSeconds']) {
+        for (const [key, value] of Object.entries(health[field] ?? {})) {
+            if (!isCanonicalWorkerModelKey(key))
+                error(field, 'Noncanonical inference model key');
+            if (field === 'modelStartupSeconds' && checkSeconds > value)
+                error(field, 'Model startup must cover checkSeconds');
+        }
+    }
+    return errors;
+}
+/** Resolve one enabled installation through trusted metadata, without probes.
+ * Implicit canonical IDs inherit current-account auth; no account/quota identity
+ * is invented. Profile qualification remains the invocation owner's obligation.
+ */
+export function resolveWorkerGroupInstallation(parallelism, installationId, registry = loadProviderModelCapabilities()) {
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (!parallelism.worker_dispatch)
+        throw new Error('OG_CONFIG_REFERENCE /parallelism/worker_dispatch: Worker dispatch is disabled');
+    const explicit = parallelism.clis?.[installationId];
+    const installation = explicit
+        ? structuredClone(explicit)
+        : { adapter: `providers:${installationId}`, enabled: true };
+    if (!explicit && (!PROVIDER_IDS.includes(installationId) || installationId === 'generic')) {
+        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Unknown canonical installation`);
+    }
+    if (installation.enabled === false)
+        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Installation is disabled`);
+    try {
+        return { installation: { ...installation, enabled: true }, ...resolveWorkerInstallation(registry, installation) };
+    }
+    catch (error) {
+        throw new Error(`OG_ADAPTER_UNQUALIFIED /parallelism/clis/${installationId}: ${error}`);
+    }
+}
+/** Validate current model restrictions and group references before any write.
+ * Disabled/unbound projects retain their existing config-only edit behavior.
+ * This is shared validation, not Tier 1 coherent activation.
+ *
+ * `options.aiwgHome`, when provided, is passed through to `ConfigLoader`
+ * unchanged — it never reads or writes `process.env.AIWG_HOME`. Omitting it
+ * keeps `ConfigLoader`'s own default precedence (`AIWG_HOME` env, else the
+ * running package root).
+ */
+export async function validateWorkerConfigCandidate(projectDir, config, options) {
+    const errors = validateParallelismConfig(config.parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (!config.parallelism?.worker_dispatch)
+        return;
+    const { ConfigLoader } = await import('../models/config-loader.js');
+    await new ConfigLoader(projectDir, options).load(config.parallelism);
+}
+/** Hash canonical JSON, treating absent optional model files as null. */
+export function workerConfigDigest(value) {
+    const canonical = (node) => {
+        if (Array.isArray(node))
+            return node.map(canonical);
+        if (node !== null && typeof node === 'object')
+            return Object.fromEntries(Object.keys(node).sort().filter(key => node[key] !== undefined).map(key => [key, canonical(node[key])]));
+        return node ?? null;
+    };
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex')}`;
+}
+export function workerActivationDigests(config, projectModels, userModels, builtinModels) {
+    const candidate = structuredClone(config);
+    if (candidate.parallelism)
+        delete candidate.parallelism.activation;
+    return { configDigest: workerConfigDigest(candidate), projectModelsDigest: workerConfigDigest(projectModels), userModelsDigest: workerConfigDigest(userModels), builtinModelsDigest: workerConfigDigest(builtinModels) };
+}
+/** Pure inventory only: this does not activate, lock, synchronize, or admit work. */
+export function workerActivationCopyInventory(projectDir, compatibilityConfig, userModels, builtinModels) {
+    return [...new Set([getConfigPath(projectDir), join(projectDir, 'models.json'), compatibilityConfig, userModels, builtinModels].map(file => resolve(file)))];
+}
 /**
  * Per-provider parallelism defaults. Conservative numbers for Anthropic-backed
  * providers reflect Pro/Team-plan rate limits — operators on Enterprise tiers
@@ -235,6 +408,30 @@ export function resolveParallelism(parallelism, primaryProvider) {
     };
     if (parallelism?.rationale !== undefined)
         resolved.rationale = parallelism.rationale;
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (parallelism?.worker_dispatch) {
+        Object.assign(resolved, Object.fromEntries(Object.entries(structuredClone(parallelism)).filter(([, value]) => value !== undefined)));
+        resolved.worker_mode ??= 'direct';
+        for (const group of Object.values(resolved.groups ?? {})) {
+            group.fallback ??= [];
+            group.requiredRoles ??= [];
+            group.execution = { isolation: 'worktree', sandbox: 'workspace-write', approval: 'never', network: 'deny', transport: 'shell', receipts: 'optional', ...group.execution };
+            for (const member of group.members) {
+                member.enabled ??= true;
+                member.priority ??= 50;
+            }
+        }
+        for (const cli of Object.values(resolved.clis ?? {}))
+            cli.enabled ??= true;
+        if (resolved.admission)
+            resolved.admission = { maxQueued: 128, queueTimeoutSeconds: 300, leaseSeconds: 60, authorityRef: 'project', ...resolved.admission };
+        if (resolved.budgets)
+            resolved.budgets = { enforcement: 'observed', unknownCost: 'deny', ...resolved.budgets };
+        if (resolved.retry)
+            resolved.retry = { maxAttempts: 3, on: ['rate-limit', 'unavailable', 'timeout'], baseDelaySeconds: 2, maxDelaySeconds: 60, ...resolved.retry };
+    }
     return resolved;
 }
 const GRAPH_BACKENDS = ['json', 'graphology', 'sqlite'];
@@ -265,37 +462,7 @@ export function validateIndexConfig(index) {
         errors.push(`index.graphBackend: must be one of ${GRAPH_BACKENDS.join(' | ')}`);
     }
     const isStringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string');
-    const graphOverrides = indexObject.graphOverrides;
-    if (graphOverrides !== undefined) {
-        if (typeof graphOverrides !== 'object' || graphOverrides === null || Array.isArray(graphOverrides)) {
-            errors.push('index.graphOverrides: must be an object mapping supported built-in graph names to overrides');
-        }
-        else {
-            for (const [name, rawOverride] of Object.entries(graphOverrides)) {
-                const where = `index.graphOverrides.${name}`;
-                if (name !== 'codebase') {
-                    errors.push(`${where}: unsupported built-in graph override (supported: codebase)`);
-                    continue;
-                }
-                if (typeof rawOverride !== 'object' || rawOverride === null || Array.isArray(rawOverride)) {
-                    errors.push(`${where}: must be an object`);
-                    continue;
-                }
-                const override = rawOverride;
-                for (const field of Object.keys(override)) {
-                    if (field !== 'scanDirs' && field !== 'extensions') {
-                        errors.push(`${where}.${field}: unknown field (supported: scanDirs, extensions)`);
-                    }
-                }
-                if (override.scanDirs !== undefined && (!isStringArray(override.scanDirs) || override.scanDirs.length === 0)) {
-                    errors.push(`${where}.scanDirs: must be a non-empty array of strings`);
-                }
-                if (override.extensions !== undefined && (!isStringArray(override.extensions) || override.extensions.length === 0)) {
-                    errors.push(`${where}.extensions: must be a non-empty array of strings`);
-                }
-            }
-        }
-    }
+    errors.push(...validateIndexGraphOverrides(indexObject.graphOverrides));
     const graphs = indexObject.graphs;
     if (graphs === undefined)
         return errors; // index with no graphs is permissible
@@ -782,6 +949,7 @@ export function emptyConfig(providers = ['claude']) {
             threatAssessment: defaultThreatAssessmentConfig(),
         },
         artifact_outputs: defaultArtifactOutputs(),
+        rules: { inline_budget_tokens: DEFAULT_RULES_INLINE_BUDGET_TOKENS },
         delivery: {
             mode: 'pr-required',
             default_branch: 'main',
@@ -826,24 +994,35 @@ export function getProjectDir(ctx, args = []) {
     return targetValue || ctx?.cwd || process.cwd();
 }
 /**
- * Read .aiwg/aiwg.config.
+ * Read and independently validate .aiwg/aiwg.config EXCEPT for the
+ * worker-model defaults step (`validateWorkerConfigCandidate`), which needs
+ * its own `aiwgHome` resolution and can fail solely because the bundled
+ * model defaults are unreachable. Callers that want to degrade gracefully
+ * on that one failure mode (e.g. generated-context rendering) read the
+ * candidate here, then call `validateWorkerConfigCandidate` themselves and
+ * handle its failure explicitly. `readAiwgConfig` below is the composition
+ * of both steps for callers that want the original all-or-nothing contract.
  * Returns null if the file does not exist.
  */
-export async function readAiwgConfig(projectDir) {
+export async function readAiwgConfigCandidate(projectDir) {
     const localPath = getConfigPath(projectDir);
     const artifactPath = projectAiwgPath(projectDir, CONFIG_FILENAME);
     let filePath = localPath;
     try {
         await access(localPath);
     }
-    catch {
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
         if (artifactPath === localPath)
             return null;
         try {
             await access(artifactPath);
             filePath = artifactPath;
         }
-        catch {
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
             return null;
         }
     }
@@ -856,6 +1035,30 @@ export async function readAiwgConfig(projectDir) {
         parsed.installed = {};
     if (!parsed.scripts)
         parsed.scripts = {};
+    if (parsed.sessions !== undefined && (parsed.sessions === null || typeof parsed.sessions !== 'object' || Array.isArray(parsed.sessions)
+        || (parsed.sessions.codex_roots !== undefined && (!Array.isArray(parsed.sessions.codex_roots)
+            || !parsed.sessions.codex_roots.every((root) => typeof root === 'string' && root.trim().length > 0))))) {
+        throw new Error('sessions.codex_roots must be an array of non-empty paths');
+    }
+    if (parsed.sessions?.discovery_manifests !== undefined && (!Array.isArray(parsed.sessions.discovery_manifests)
+        || !parsed.sessions.discovery_manifests.every((file) => typeof file === 'string' && file.trim().length > 0))) {
+        throw new Error('sessions.discovery_manifests must be an array of non-empty paths');
+    }
+    if (parsed.sessions?.import !== undefined) {
+        const limits = parsed.sessions.import;
+        if (limits === null || typeof limits !== 'object' || Array.isArray(limits)) {
+            throw new Error('sessions.import must be an object');
+        }
+        if (limits.exclude !== undefined)
+            validateImportExclusions(limits.exclude);
+        for (const key of ['max_record_bytes', 'max_source_bytes']) {
+            const value = limits[key];
+            const minimum = key === 'max_source_bytes' ? 0 : 1;
+            if (value !== undefined && (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum)) {
+                throw new Error(`sessions.import.${key} must be a ${minimum ? 'positive' : 'non-negative'} integer`);
+            }
+        }
+    }
     const externalLinkErrors = validateExternalLinks(parsed.externalLinks);
     if (externalLinkErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${externalLinkErrors.join('\n')}`);
@@ -873,6 +1076,9 @@ export async function readAiwgConfig(projectDir) {
     const threatAssessmentErrors = [
         ...validateThreatAssessmentConfig(parsed.security?.threatAssessment),
         ...validateProjectConfig(parsed.project),
+        ...validateParallelismConfig(parsed.parallelism),
+        ...validateDecisionConfig(parsed.decision),
+        ...validateRulePinCapabilities(parsed.rules, installedRuleCapabilities(loadRulePinConfigs(projectDir, parsed)), loadRulePinConfigs(projectDir, parsed).user.rules?.pin_groups),
     ];
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
@@ -894,15 +1100,68 @@ export async function readAiwgConfig(projectDir) {
     }
     return parsed;
 }
+/**
+ * Read .aiwg/aiwg.config, including worker-model default validation.
+ * Returns null if the file does not exist.
+ *
+ * `aiwgHome` (optional) resolves the bundled AIWG model-defaults location
+ * passed through to `validateWorkerConfigCandidate` / `ConfigLoader`,
+ * without ever reading or writing `process.env.AIWG_HOME`. Omit it to keep
+ * the default precedence (`AIWG_HOME` env, else the user-home install).
+ */
+export async function readAiwgConfig(projectDir, options) {
+    const parsed = await readAiwgConfigCandidate(projectDir);
+    if (!parsed)
+        return null;
+    await validateWorkerConfigCandidate(projectDir, parsed, options);
+    return parsed;
+}
 /**
  * Write aiwg.config to the repository-local control plane. When a reachable
  * external corpus also carries the compatibility control copy, keep it in
  * sync so split-root health remains deterministic.
  */
 export async function writeAiwgConfig(projectDir, config) {
+    // Uninstall is an explicit capability change. Retire project selectors for
+    // removed capabilities before strict validation, and tell the operator.
+    const previousFile = getConfigPath(projectDir);
+    let previous = null;
+    if (existsSync(previousFile)) {
+        try {
+            previous = JSON.parse(readFileSync(previousFile, 'utf8'));
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+        }
+    }
+    const pinConfigs = loadRulePinConfigs(projectDir, config);
+    const currentCapabilities = new Set(installedRuleCapabilities(pinConfigs));
+    const removed = previous ? installedRuleCapabilities({ ...pinConfigs, project: previous }).filter(id => !currentCapabilities.has(id)) : [];
+    if (removed.length && (config.rules?.always_load?.length || Object.keys(config.rules?.pin_groups ?? {}).length)) {
+        const removedSet = new Set(removed);
+        const rules = config.rules;
+        const userGroups = loadRulePinConfigs(projectDir, config).user.rules?.pin_groups ?? {};
+        const pinGroups = Object.fromEntries(Object.entries(rules.pin_groups ?? {})
+            .map(([name, ids]) => [name, ids.filter(id => !removedSet.has(id))]).filter(([, ids]) => ids.length));
+        const selectors = (rules.always_load ?? []).flatMap(selector => {
+            if (selector.group && ((!Object.hasOwn(pinGroups, selector.group) && Object.hasOwn(rules.pin_groups ?? {}, selector.group))
+                || (!Object.hasOwn(pinGroups, selector.group) && userGroups[selector.group]?.some(id => removedSet.has(id)))))
+                return [];
+            if (!selector.capabilities)
+                return [selector];
+            const capabilities = selector.capabilities.filter(id => !removedSet.has(id));
+            return capabilities.length ? [{ ...selector, capabilities }] : [];
+        });
+        config = { ...config, rules: { ...config.rules, pin_groups: pinGroups, always_load: selectors } };
+        console.warn(`Uninstalled ${removed.join(', ')}: their rules leave the effective pinned set; retired project capability selectors/groups. User pins remain visible as inactive warnings.`);
+    }
     const threatAssessmentErrors = [
         ...validateThreatAssessmentConfig(config.security?.threatAssessment),
         ...validateProjectConfig(config.project),
+        ...validateParallelismConfig(config.parallelism),
+        ...validateDecisionConfig(config.decision),
+        ...validateRulePinCapabilities(config.rules, installedRuleCapabilities(loadRulePinConfigs(projectDir, config)), loadRulePinConfigs(projectDir, config).user.rules?.pin_groups),
     ];
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
@@ -916,6 +1175,7 @@ export async function writeAiwgConfig(projectDir, config) {
     const gatesErrors = validateGatesConfig(config.gates);
     if (gatesErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${gatesErrors.join('\n')}`);
+    await validateWorkerConfigCandidate(projectDir, config);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);
@@ -1134,4 +1394,58 @@ export async function populateDeployedTo(config, projectDir) {
     }
     return config;
 }
+/** Shape validation alone cannot infer process/HTTP metadata or model authority. */
+export function validateWorkerInstallationBindings(parallelism, adapters) {
+    const errors = [];
+    for (const [id, cli] of Object.entries(parallelism.clis ?? {})) {
+        if (cli.enabled === false)
+            continue;
+        const metadata = adapters[cli.adapter];
+        if (!metadata)
+            errors.push(`OG_ADAPTER_UNQUALIFIED /parallelism/clis/${id}/adapter: Unknown trusted binding`);
+        else if (metadata.transport === 'http' ? (!cli.endpoint || cli.executable !== undefined) : (cli.endpoint !== undefined || !(cli.executable ?? metadata.executable)))
+            errors.push(`OG_CONFIG_REFERENCE /parallelism/clis/${id}: Invalid transport binding`);
+    }
+    return errors;
+}
+export function validateWorkerGroupReferences(parallelism, selection, qualifiedRoles) {
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        return errors;
+    for (const [role, guidance] of Object.entries(selection.roleGuidance ?? {})) {
+        for (const group of guidance.groups)
+            if (!parallelism.groups?.[group])
+                errors.push(`OG_CONFIG_REFERENCE /defaults/workerSelection/roleGuidance/${role}/groups: Unknown group ${group}`);
+    }
+    if (qualifiedRoles)
+        errors.push(...validateWorkerGroupQualifications(parallelism, qualifiedRoles)
+            .map(diagnostic => `${diagnostic.code} ${diagnostic.pointer}: ${diagnostic.message}`));
+    return errors;
+}
+/** Structured qualification gaps retain role scope for readiness projections. */
+export function validateWorkerGroupQualifications(parallelism, qualifiedRoles) {
+    const diagnostics = [];
+    for (const [id, group] of Object.entries(parallelism.groups ?? {})) {
+        for (const role of group.requiredRoles ?? []) {
+            if (!group.members.some(m => m.enabled !== false && parallelism.clis?.[m.cli]?.enabled !== false
+                && m.roles.includes(role) && qualifiedRoles[`${id}/${m.id}`]?.includes(role))) {
+                diagnostics.push({ code: 'OG_ADAPTER_UNQUALIFIED', pointer: `/parallelism/groups/${id}/requiredRoles`,
+                    message: `No qualified route covers ${role}`, roles: [role] });
+            }
+        }
+    }
+    return diagnostics;
+}
+/** A configured hard ceiling is eligible only where a qualified control enforces it. */
+export function validateWorkerBudgetEnforcement(budgets, enforceable) {
+    if (budgets?.enforcement !== 'hard')
+        return [];
+    const errors = [];
+    for (const scope of ['perRun', 'perTask'])
+        for (const dimension of ['tokens', 'costUsd', 'wallSeconds']) {
+            if (budgets[scope]?.[dimension] !== undefined && !enforceable.includes(dimension))
+                errors.push(`OG_BUDGET_UNMEASURABLE /parallelism/budgets/${scope}/${dimension}: No qualified enforcing control`);
+        }
+    return errors;
+}
 //# sourceMappingURL=aiwg-config.js.map