@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/rules/pins.mjs

@@ -0,0 +1,112 @@
+/** Operator-local activation overrides. Canonical rule sources are never mutated. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { userConfigFile } from '../config/user-config-dir.mjs';
+import { validateRulesConfig } from './inline-budget.mjs';
+
+export const RULE_PIN_TIERS = ['critical', 'high', 'medium', 'low'];
+const read = file => fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};
+export function rulePinConfigPath(cwd, source = 'project', userConfigDir) {
+  return source === 'user' ? userConfigFile('aiwg.config', { configDir: userConfigDir }) : path.join(cwd, '.aiwg', 'aiwg.config');
+}
+export function loadRulePinConfigs(cwd, project, userConfigDir) {
+  return { project: project ?? read(rulePinConfigPath(cwd)), user: read(rulePinConfigPath(cwd, 'user', userConfigDir)) };
+}
+export const capabilityId = id => id?.replace(/^(framework|addon|extension|plugin):/, '');
+let bundledCapabilities;
+function packageCapabilities() {
+  if (bundledCapabilities) return bundledCapabilities;
+  let root = path.dirname(fileURLToPath(import.meta.url));
+  while (!fs.existsSync(path.join(root, 'package.json')) && path.dirname(root) !== root) root = path.dirname(root);
+  const legacy = { 'sdlc-complete': ['sdlc'], 'media-marketing-kit': ['marketing', 'mmk'] };
+  bundledCapabilities = [];
+  for (const kind of ['frameworks', 'addons', 'extensions', 'plugins']) {
+    const dir = path.join(root, 'agentic/code', kind);
+    if (!fs.existsSync(dir)) continue;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).filter(entry => entry.isDirectory())) {
+      let manifest;
+      try { manifest = read(path.join(dir, entry.name, 'manifest.json')); } catch { manifest = {}; }
+      if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) manifest = {};
+      bundledCapabilities.push({ id: entry.name,
+        aliases: [...(Array.isArray(manifest.modeAliases) ? manifest.modeAliases : []), ...(Array.isArray(manifest.aliases) ? manifest.aliases : []), ...(legacy[entry.name] || [])],
+        bulk: kind !== 'plugins' && entry.name !== 'aiwg-dev' && !manifest.devOnly && !manifest.explicitInstall });
+    }
+  }
+  return bundledCapabilities;
+}
+export function installedRuleCapabilities(configs) {
+  const registry = read(process.env.AIWG_USER_REGISTRY_PATH || userConfigFile('installed.json'));
+  const entries = { ...registry.installed, ...configs.user?.installed, ...configs.project?.installed };
+  if (!Object.keys(entries).length) return [];
+  const bundled = Object.values(entries).some(entry => entry?.source !== 'project-local') ? packageCapabilities() : [];
+  return [...new Set(Object.entries(entries).flatMap(([id, entry]) => {
+    if (entry?.source === 'project-local') return [id];
+    if (id === 'all') return bundled.filter(capability => capability.bulk).map(capability => capability.id);
+    return [bundled.find(capability => capability.id === id || capability.aliases.includes(id))?.id || id];
+  }))].sort();
+}
+export function validateRulePinCapabilities(rules, installed, groups = {}) {
+  const errors = validateRulesConfig(rules);
+  if (errors.length || !rules) return errors;
+  const available = new Set(installed);
+  const check = (ids, label) => {
+    for (const id of ids || []) if (!available.has(id)) errors.push(`${label}: unknown or uninstalled capability '${id}'. Installed ids: ${installed.join(', ') || '(none)'}`);
+  };
+  for (const [group, ids] of Object.entries(rules.pin_groups || {})) check(ids, `rules.pin_groups.${group}`);
+  for (const selector of rules.always_load || []) {
+    check(selector.capabilities, 'rules.always_load');
+    if (selector.group) {
+      const merged = { ...groups, ...rules.pin_groups };
+      if (!Object.hasOwn(merged, selector.group)) errors.push(`rules.always_load: unknown pin group '${selector.group}'`);
+      else check(merged[selector.group], `rules.always_load.group.${selector.group}`);
+    }
+  }
+  return errors;
+}
+export function selectorKey(selector) {
+  return JSON.stringify(Object.fromEntries(Object.entries(selector).sort(([a], [b]) => a.localeCompare(b))
+    .map(([key, value]) => [key, Array.isArray(value) ? [...new Set(value)].sort() : value])));
+}
+
+/** OR across selectors, AND within each selector; one result per rule identity.
+ * A RelationsReader narrows capability/tier candidates without the full index. */
+export function resolveRulePins({ rules, configs, installed = installedRuleCapabilities(configs), relations = null }) {
+  const warnings = [];
+  const groups = { ...configs.user?.rules?.pin_groups, ...configs.project?.rules?.pin_groups };
+  const pins = new Map();
+  const available = new Set(installed);
+  const indexedPaths = new Set(Object.values(relations?.index.rules || {}).map(rule => rule.path));
+  for (const source of ['user', 'project']) {
+    const config = configs[source]?.rules;
+    const errors = validateRulesConfig(config);
+    if (errors.length) throw new Error(errors.join('\n'));
+    for (const error of validateRulePinCapabilities(config, installed, groups)) warnings.push(`${source}: ${error}; inactive capability pins ignored`);
+    for (const selector of config?.always_load || []) {
+      for (const id of selector.rules || []) if (!rules.some(rule => available.has(capabilityId(rule.capability)) && [rule.id, rule.name, rule.path, rule.file].includes(id))) warnings.push(`${source}: pinned rule '${id}' is absent from installed capabilities; ignored`);
+      const capabilities = selector.group ? groups[selector.group] || [] : selector.capabilities || installed;
+      const selectedCaps = capabilities.filter(id => available.has(id));
+      let candidates;
+      if (relations && (selector.enforcement || selector.capabilities || selector.group)) {
+        candidates = new Set(selectedCaps.flatMap(id => {
+          const keys = Object.keys(relations.index.capabilities).filter(key => capabilityId(key) === id);
+          return keys.flatMap(key => relations.rulesForCapability(key, selector.enforcement));
+        }).map(id => relations.index.rules[id]?.path));
+      }
+      for (const rule of rules) {
+        if (rule.type === 'behavior' || rule.behavior) continue;
+        const cap = capabilityId(rule.capability);
+        if (!available.has(cap)) continue;
+        if (!selectedCaps.includes(cap)) continue;
+        if (selector.rules && !selector.rules.some(id => [rule.id, rule.name, rule.path, rule.file].includes(id))) continue;
+        if (selector.enforcement && !selector.enforcement.includes(rule.enforcement?.toLowerCase())) continue;
+        if (candidates && selector.enforcement && indexedPaths.has(rule.indexedPath || rule.path) && !candidates.has(rule.path) && !candidates.has(rule.indexedPath)) continue;
+        const id = rule.id || rule.path || rule.file || rule.name;
+        const pin = pins.get(id) || { ...rule, id, canonical_activation: rule.activation, activation: 'kernel', matches: [] };
+        if (!pin.matches.some(match => match.source === source && selectorKey(match.selector) === selectorKey(selector))) pin.matches.push({ source, selector });
+        pins.set(id, pin);
+      }
+    }
+  }
+  return { rules: [...pins.values()].sort((a, b) => a.id.localeCompare(b.id)), warnings: [...new Set(warnings)] };
+}

package/dist/src/rules/rule-frontmatter.schema.json

@@ -0,0 +1,197 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/rules/rule-frontmatter.v1.schema.json",
+  "title": "Rule activation frontmatter",
+  "description": "ADR rule activation contract. Other existing discovery metadata is preserved. Missing activation is permitted only by the migration parser, which warns and infers tier delivery.",
+  "type": "object",
+  "required": [
+    "activation"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "activation": {
+      "type": "string",
+      "enum": [
+        "kernel",
+        "summary",
+        "bound",
+        "paths",
+        "on-demand"
+      ]
+    },
+    "summary": {
+      "type": "string",
+      "pattern": "^[^\\r\\n\\u0085\\u2028\\u2029]*\\S[^\\r\\n\\u0085\\u2028\\u2029]*$",
+      "description": "A nonempty single-line imperative, <=240 Unicode code points after trimming. Imperative mood is reviewed by authors.",
+      "allOf": [
+        {
+          "pattern": "^\\s*\\S(?:[^\\r\\n\\u0085\\u2028\\u2029]{0,238}\\S)?\\s*$"
+        }
+      ]
+    },
+    "bound_to": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "skills": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:^|/)\\.\\.?(/|$))[A-Za-z0-9_][A-Za-z0-9_.:-]*(?:/[A-Za-z0-9_][A-Za-z0-9_.:-]*)*$"
+          }
+        },
+        "agents": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:^|/)\\.\\.?(/|$))[A-Za-z0-9_][A-Za-z0-9_.:-]*(?:/[A-Za-z0-9_][A-Za-z0-9_.:-]*)*$"
+          }
+        },
+        "flows": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:^|/)\\.\\.?(/|$))[A-Za-z0-9_][A-Za-z0-9_.:-]*(?:/[A-Za-z0-9_][A-Za-z0-9_.:-]*)*$"
+          }
+        }
+      }
+    },
+    "paths": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "pattern": "^(?![A-Za-z]:)(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.(?:/|$))(?=.*\\S)[^\\r\\n]+$"
+      }
+    },
+    "enforcedBy": {
+      "description": "Opaque reserved metadata for #2839. Has no activation or runtime enforcement effect."
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "activation": {
+            "enum": [
+              "summary",
+              "bound",
+              "paths"
+            ]
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "summary"
+        ],
+        "properties": {
+          "summary": {}
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "activation": {
+            "enum": [
+              "kernel",
+              "on-demand"
+            ]
+          }
+        }
+      },
+      "then": {
+        "not": {
+          "required": [
+            "bound_to"
+          ],
+          "properties": {
+            "bound_to": {}
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "activation": {
+            "const": "paths"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "paths"
+        ],
+        "properties": {
+          "paths": {}
+        }
+      },
+      "else": {
+        "not": {
+          "required": [
+            "paths"
+          ],
+          "properties": {
+            "paths": {}
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "activation": {
+            "const": "bound"
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "bound_to"
+        ],
+        "properties": {
+          "bound_to": {
+            "type": "object",
+            "anyOf": [
+              {
+                "required": [
+                  "skills"
+                ],
+                "properties": {
+                  "skills": {
+                    "type": "array",
+                    "minItems": 1
+                  }
+                }
+              },
+              {
+                "required": [
+                  "agents"
+                ],
+                "properties": {
+                  "agents": {
+                    "type": "array",
+                    "minItems": 1
+                  }
+                }
+              },
+              {
+                "required": [
+                  "flows"
+                ],
+                "properties": {
+                  "flows": {
+                    "type": "array",
+                    "minItems": 1
+                  }
+                }
+              }
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/dist/src/serve/executor-registry.js

@@ -646,37 +646,29 @@ export class ExecutorRegistry extends EventEmitter {
     pickByFilter(filter, longRunning = false) {
         const candidates = [...this.executors.values()].filter((e) => e.connected);
         const rejected = [];
-        // If executor_id is pinned, target it directly
+        // A pin selects an identity; it cannot waive the same controls used by automatic routing.
+        const rejection = (executor) => {
+            if (longRunning && !executor.capabilities.includes('resumable')) {
+                return 'long_running requires resumable capability';
+            }
+            const missing = (filter.capabilities ?? []).filter(capability => !executor.capabilities.includes(capability));
+            if (missing.length > 0)
+                return `missing capabilities: ${missing.join(', ')}`;
+            return undefined;
+        };
         if (filter.executor_id) {
             const pinned = this.executors.get(filter.executor_id);
-            if (!pinned) {
-                return null;
-            }
-            if (!pinned.connected) {
-                return null;
-            }
-            if (longRunning && !pinned.capabilities.includes('resumable')) {
+            if (!pinned?.connected || rejection(pinned))
                 return null;
-            }
             return { executor: pinned, reason: 'pinned by executor_id', rejected: [] };
         }
-        // Filter by required capabilities
         const filtered = [];
         for (const executor of candidates) {
-            // Long-running requires resumable
-            if (longRunning && !executor.capabilities.includes('resumable')) {
-                rejected.push({ executorId: executor.executorId, reason: 'long_running requires resumable capability' });
-                continue;
-            }
-            // All requested capabilities must be present
-            if (filter.capabilities && filter.capabilities.length > 0) {
-                const missing = filter.capabilities.filter((c) => !executor.capabilities.includes(c));
-                if (missing.length > 0) {
-                    rejected.push({ executorId: executor.executorId, reason: `missing capabilities: ${missing.join(', ')}` });
-                    continue;
-                }
-            }
-            filtered.push(executor);
+            const reason = rejection(executor);
+            if (reason)
+                rejected.push({ executorId: executor.executorId, reason });
+            else
+                filtered.push(executor);
         }
         if (filtered.length === 0)
             return null;

package/dist/src/serve/fleet-mission-conductor.js

@@ -10,6 +10,7 @@
  */
 import { routeMission } from './agent-router.js';
 import { StackAdapterRegistry } from './stack-adapters.js';
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 const terminalFailures = new Set(['failed', 'cancelled', 'timed-out']);
 const reviewStates = new Set(['unknown', 'operator-review-required']);
 function lifecycleSatisfied(kind, state, health) {
@@ -114,6 +115,14 @@ export class FleetMissionConductor {
         this.ledgerStore = options.ledgerStore;
     }
     async conduct(plan, pool, resumeFrom) {
+        assertMissionWorkerHandoff(plan, 'fleet-conductor');
+        for (const cycle of plan.cycles)
+            assertMissionWorkerHandoff(cycle, 'fleet-conductor');
+        if (resumeFrom) {
+            assertMissionWorkerHandoff(resumeFrom, 'fleet-conductor');
+            for (const cycle of resumeFrom.cycles)
+                assertMissionWorkerHandoff(cycle, 'fleet-conductor');
+        }
         const priorById = new Map((resumeFrom?.cycles ?? []).map((cycle) => [cycle.cycleId, cycle]));
         const ledger = {
             missionId: plan.missionId,

package/dist/src/serve/mission-conductor.js

@@ -24,8 +24,7 @@
  */
 import { routeMission } from './agent-router.js';
 import { StackAdapterRegistry } from './stack-adapters.js';
-const defaultRunWorker = () => ({ output: undefined, cost: 0 });
-const defaultScore = (r) => (r.output ? r.output.length : 0);
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 /**
  * The cross-stack Mission conductor. Decomposes a Mission into worker cycles,
  * dispatches each to an executor of the chosen runtime via `routeMission`, and
@@ -35,10 +34,12 @@ export class MissionConductor {
     adapters;
     runWorker;
     scoreOutput;
+    scorerId;
     constructor(opts = {}) {
         this.adapters = opts.adapters ?? new StackAdapterRegistry();
-        this.runWorker = opts.runWorker ?? defaultRunWorker;
-        this.scoreOutput = opts.scoreOutput ?? defaultScore;
+        this.runWorker = opts.runWorker;
+        this.scoreOutput = opts.scoreOutput;
+        this.scorerId = opts.scoreOutput ? (opts.scorerId ?? 'custom') : null;
     }
     /**
      * Conduct a Mission across the given executor pool. Returns the ledger.
@@ -46,6 +47,14 @@ export class MissionConductor {
      * crash-resilient resume path; their prior results are carried forward.
      */
     async conduct(plan, pool, resumeFrom) {
+        assertMissionWorkerHandoff(plan, 'mission-conductor');
+        for (const cycle of plan.cycles)
+            assertMissionWorkerHandoff(cycle, 'mission-conductor');
+        if (resumeFrom) {
+            assertMissionWorkerHandoff(resumeFrom, 'mission-conductor');
+            for (const cycle of resumeFrom.cycles)
+                assertMissionWorkerHandoff(cycle, 'mission-conductor');
+        }
         if (plan.cycles.some((cycle) => cycle.graph) && !plan.graph) {
             throw new Error('Graph-projected worker cycles require MissionPlan.graph identity.');
         }
@@ -60,6 +69,8 @@ export class MissionConductor {
             missionId: plan.missionId,
             goal: plan.goal,
             completionCriterion: plan.completionCriterion,
+            executionMode: this.runWorker ? 'executed' : 'plan-only',
+            scorerId: this.scorerId,
             activityLog: [],
             cycles: [],
             totalCost: 0,
@@ -68,6 +79,7 @@ export class MissionConductor {
             ...(plan.graph ? { graph: structuredClone(plan.graph) } : {}),
         };
         ledger.activityLog.push(`mission ${plan.missionId} start — goal: ${plan.goal} — ${plan.cycles.length} cycle(s)` +
+            ` — mode: ${ledger.executionMode}, scorer: ${ledger.scorerId ?? '(none)'}` +
             (resumeFrom ? ` (resume: ${carried.size} carried)` : ''));
         for (const cycle of plan.cycles) {
             const graph = plan.graph && cycle.graph ? {
@@ -125,6 +137,20 @@ export class MissionConductor {
             const executor = routing.selected.executor;
             const invocation = adapter.invoke(cycle.prompt, graph);
             ledger.activityLog.push(`cycle ${cycle.id} → executor ${executor.name} (${executor.executorId}) on ${cycle.runtime}: ${invocation.describe}`);
+            if (!this.runWorker) {
+                ledger.cycles.push({
+                    cycleId: cycle.id,
+                    runtime: cycle.runtime,
+                    primitive: adapter.primitive,
+                    executorId: executor.executorId,
+                    routed: true,
+                    reason: 'plan-only: worker not configured; execution pending',
+                    cost: 0,
+                    ...(graph ? { graph } : {}),
+                });
+                ledger.activityLog.push(`cycle ${cycle.id} PLANNED on ${cycle.runtime} — execution pending`);
+                continue;
+            }
             let output;
             let cost = 0;
             try {
@@ -164,23 +190,32 @@ export class MissionConductor {
             ledger.totalCost += cost;
             ledger.activityLog.push(`cycle ${cycle.id} done on ${cycle.runtime} (cost ${cost})`);
         }
-        // Pending = cycles neither completed nor failed (none, here — full pass).
+        // Planned cycles remain pending until a worker executes them.
         const accounted = new Set([...ledger.checkpoint.completed, ...ledger.checkpoint.failed]);
         ledger.checkpoint.pending = plan.cycles.map((c) => c.id).filter((id) => !accounted.has(id));
         // Cross-stack aggregation: distinct runtimes that actually ran a worker.
         ledger.runtimesUsed = [
-            ...new Set(ledger.cycles.filter((c) => c.routed).map((c) => c.runtime)),
+            ...new Set(ledger.cycles.filter((c) => c.routed && accounted.has(c.cycleId)).map((c) => c.runtime)),
         ];
         // Best-output selection (REF-015) — conductor-side, across stacks.
         let best;
-        for (const c of ledger.cycles) {
-            if (!c.output)
-                continue;
-            const score = this.scoreOutput(c);
-            if (!best || score > best.score) {
-                best = { cycleId: c.cycleId, runtime: c.runtime, output: c.output, score };
+        if (this.scoreOutput) {
+            for (const c of ledger.cycles) {
+                if (c.output === undefined)
+                    continue;
+                const score = this.scoreOutput(c);
+                if (!Number.isFinite(score)) {
+                    ledger.activityLog.push(`cycle ${c.cycleId} UNSCORED — scorer ${this.scorerId} returned a non-finite score`);
+                    continue;
+                }
+                if (!best || score > best.score) {
+                    best = { cycleId: c.cycleId, runtime: c.runtime, output: c.output, score };
+                }
             }
         }
+        else {
+            ledger.activityLog.push('best-output unavailable: no scorer configured');
+        }
         ledger.bestOutput = best;
         ledger.activityLog.push(`mission ${plan.missionId} end — completed ${ledger.checkpoint.completed.length}, ` +
             `failed ${ledger.checkpoint.failed.length}, runtimes [${ledger.runtimesUsed.join(', ')}], ` +

package/dist/src/serve/shared-host-scheduler.js

@@ -10,6 +10,7 @@
  */
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname } from 'node:path';
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 export class InMemoryAdmissionStore {
     snapshot = { revision: 0, records: {} };
     transact(mutate) {
@@ -88,6 +89,7 @@ export class SharedHostScheduler {
         }
     }
     submit(request) {
+        assertMissionWorkerHandoff(request, 'managed-admission');
         this.validateRequest(request);
         return this.store.transact(snapshot => {
             const existing = snapshot.records[request.requestId];