@aiwg/cli 2026.10.10 → 2026.10.12

package/dist/src/models/resolver.js

@@ -5,6 +5,8 @@
  * @implements @.aiwg/architecture/ADR-015-enhanced-model-selection.md
  * @architecture @.aiwg/architecture/enhanced-model-selection-design.md
  */
+import { normalizeModelTier, TIER_ORDER, flagshipElected, isFlagshipModel } from './tiers.js';
+import { compileModelPolicy } from './provider-policy.js';
 import { ConfigLoader } from './config-loader.js';
 import { resolveWorkerPlan } from './worker-plan.js';
 export * from './worker-plan.js';
@@ -39,23 +41,39 @@ export class ModelResolver {
         const config = await this.getConfig();
         // Determine effective tier and role
         const { tier, role, source } = this.determineEffectiveTierAndRole(agentName, agentRole, agentTier, config);
+        if (normalizeModelTier(tier) === 'flagship' && !flagshipElected({ ...this.options, agentName })) {
+            throw new Error('Flagship models are user-elected only');
+        }
         // Check for direct model override (bypasses tier system)
         const override = config.agentOverrides[agentName];
         if (override?.['model-override']) {
+            if (isFlagshipModel(override['model-override']) && !flagshipElected({ ...this.options, agentName }))
+                throw new Error('Flagship models are user-elected only');
             return {
                 modelId: override['model-override'],
                 provider: this.options.provider || config.defaults.provider,
-                tier,
+                tier: normalizeModelTier(tier),
                 role,
                 source: 'agent',
             };
         }
-        // Resolve tier + role to concrete model
-        const modelId = this.resolveModelId(tier, role, config);
+        const provider = this.options.provider || config.defaults.provider;
+        const modelId = normalizeModelTier(tier) === 'flagship'
+            ? compileModelPolicy({
+                provider: provider === 'openai' ? 'codex' : provider,
+                artifact: 'agent', policy: { tier: 'flagship', role },
+                election: this.options.election, flagshipAllowlist: this.options.flagshipAllowlist, agentName,
+            }).effectiveModel
+            : this.resolveModelId(tier, role, config);
+        if (!modelId)
+            throw new Error(`No supported model binding for ${provider}/${tier}`);
+        if (isFlagshipModel(modelId) && !flagshipElected({ ...this.options, agentName })) {
+            throw new Error('Flagship models are user-elected only');
+        }
         return {
             modelId,
             provider: this.options.provider || config.defaults.provider,
-            tier,
+            tier: normalizeModelTier(tier),
             role,
             source,
         };
@@ -132,9 +150,9 @@ export class ModelResolver {
      * Return the higher of two tiers
      */
     maxTier(tier1, tier2) {
-        const tierOrder = ['economy', 'standard', 'premium', 'max-quality'];
-        const index1 = tierOrder.indexOf(tier1);
-        const index2 = tierOrder.indexOf(tier2);
+        const tierOrder = TIER_ORDER;
+        const index1 = tierOrder.indexOf(normalizeModelTier(tier1));
+        const index2 = tierOrder.indexOf(normalizeModelTier(tier2));
         return tierOrder[Math.max(index1, index2)];
     }
     /**
@@ -227,7 +245,7 @@ export class ModelResolver {
     async listTiers() {
         const config = await this.getConfig();
         return Object.entries(config.tiers).map(([tierName, tierDef]) => ({
-            tier: tierName,
+            tier: normalizeModelTier(tierName),
             description: tierDef.description,
             costMultiplier: tierDef.costMultiplier,
         }));

package/dist/src/models/router.js

@@ -8,14 +8,16 @@
  *
  * @implements #1185
  */
+import { flagshipElected, normalizeModelTier } from './tiers.js';
 const RUNTIME_TO_MODEL_TIER = {
     0: null,
     1: 'economy',
     2: 'standard',
     3: 'premium',
+    4: 'flagship',
 };
 function clampRuntimeTier(tier, fallback) {
-    return tier === 0 || tier === 1 || tier === 2 || tier === 3 ? tier : fallback;
+    return tier === 0 || tier === 1 || tier === 2 || tier === 3 || tier === 4 ? tier : fallback;
 }
 export function routeModelTier(request = {}) {
     const defaultTier = clampRuntimeTier(request.defaultTier, 1);
@@ -28,6 +30,11 @@ export function routeModelTier(request = {}) {
         source = 'deterministic';
         rationale.push('deterministic tool/cache/existing answer is sufficient');
     }
+    else if (request.requestedTier) {
+        tier = { economy: 1, standard: 2, premium: 3, flagship: 4 }[normalizeModelTier(request.requestedTier)];
+        source = 'request';
+        rationale.push('explicit tier request');
+    }
     else if (request.requestedPremium) {
         tier = 3;
         source = 'request';
@@ -51,7 +58,13 @@ export function routeModelTier(request = {}) {
     else {
         rationale.push('no escalation signal present');
     }
-    const requiresConfirmation = (tier === 3 && !request.premiumAuthorized) || tier > maxAutoTier;
+    const elected = flagshipElected(request);
+    if (tier === 4 && !elected) {
+        tier = 3;
+        source = 'policy';
+        rationale.push('flagship is user-elected only; capped at premium');
+    }
+    const requiresConfirmation = tier === 4 ? false : (tier === 3 && !request.premiumAuthorized) || tier > maxAutoTier;
     if (requiresConfirmation) {
         rationale.push(tier === 3
             ? 'Tier 3 requires explicit human confirmation'

package/dist/src/models/tiers.js

@@ -0,0 +1,13 @@
+export const MODEL_TIERS = ['economy', 'standard', 'premium', 'flagship', 'max-quality'];
+export const TIER_ORDER = ['economy', 'standard', 'premium', 'flagship'];
+export function normalizeModelTier(tier) {
+    return tier === 'max-quality' ? 'flagship' : tier;
+}
+export function flagshipElected(request) {
+    return request.election === 'user'
+        || Boolean(request.agentName && request.flagshipAllowlist?.includes(request.agentName));
+}
+export function isFlagshipModel(id) {
+    return /(?:^|[/:._-])(?:fable|astra)(?:$|[/:._-]|\d)/i.test(id);
+}
+//# sourceMappingURL=tiers.js.map

package/dist/src/models/types.js

@@ -1,8 +1,2 @@
-/**
- * TypeScript types for Enhanced Model Selection System (Phase 1)
- *
- * @implements @.aiwg/architecture/ADR-015-enhanced-model-selection.md
- * @architecture @.aiwg/architecture/enhanced-model-selection-design.md
- */
 export {};
 //# sourceMappingURL=types.js.map

package/dist/src/models/worker-ceilings.js

@@ -0,0 +1,59 @@
+import { workerConfigDigest } from '../config/worker-config-digest.js';
+export const WORKER_CEILING_KEYS = ['tokens', 'costUsd', 'wallSeconds', 'maxAttempts'];
+/** Parent/brief restrictions intersect; they never replace a stricter restriction. */
+export function intersectWorkerCeilings(...layers) {
+    const result = {};
+    for (const key of WORKER_CEILING_KEYS) {
+        const values = layers.map(layer => layer?.[key]).filter((value) => value !== undefined);
+        if (values.length)
+            result[key] = Math.min(...values);
+    }
+    return result;
+}
+export function resolveWorkerCeilings(parallelism, constraints, request, defaults = {}) {
+    const layers = [
+        { values: defaults, pointer: 'defaults/invocation', source: 'builtin', authority: 'builtin' },
+        { values: parallelism.budgets?.perRun ?? {}, pointer: '/parallelism/budgets/perRun', source: 'config', authority: 'project' },
+        { values: parallelism.budgets?.perTask ?? {}, pointer: '/parallelism/budgets/perTask', source: 'config', authority: 'project' },
+        { values: { maxAttempts: parallelism.retry?.maxAttempts ?? 3 },
+            pointer: parallelism.retry?.maxAttempts === undefined ? 'defaults/parallelism/retry' : '/parallelism/retry',
+            source: parallelism.retry?.maxAttempts === undefined ? 'builtin' : 'config',
+            authority: parallelism.retry?.maxAttempts === undefined ? 'builtin' : 'project' },
+        { values: constraints ?? {}, pointer: '/constraints/ceilings', source: 'constraints', authority: 'project' },
+    ];
+    const ceilings = {};
+    const origins = {};
+    const diagnostics = [];
+    for (const key of WORKER_CEILING_KEYS) {
+        const entries = layers.map(layer => ({ ...layer, value: layer.values[key], pointer: `${layer.pointer}/${key}` }));
+        if (key === 'wallSeconds' && parallelism.health?.hardTimeoutSeconds !== undefined)
+            entries.push({
+                values: { wallSeconds: parallelism.health.hardTimeoutSeconds }, value: parallelism.health.hardTimeoutSeconds,
+                pointer: '/parallelism/health/hardTimeoutSeconds', source: 'config', authority: 'project',
+            });
+        const caller = request?.[key];
+        const values = [...entries.map(entry => entry.value), caller].filter((value) => value !== undefined);
+        const pointer = `/request/ceilings/${key}`;
+        if (values.some(value => !Number.isFinite(value) || value < 0 || key !== 'costUsd' && !Number.isSafeInteger(value))) {
+            diagnostics.push({ code: 'OG_CONFIG_REFERENCE', pointer,
+                message: 'Ceilings must be finite nonnegative values; counts and seconds must be integers' });
+            continue;
+        }
+        const resolved = Math.min(...entries.map(entry => entry.value ?? Infinity));
+        if (caller !== undefined && caller > resolved)
+            diagnostics.push({ code: 'OG_POLICY_RELAXATION', pointer,
+                message: `Requested ${key} ceiling ${caller} exceeds resolved policy ceiling ${resolved}.` });
+        if (!values.length)
+            continue;
+        ceilings[key] = Math.min(...values);
+        if (caller !== undefined)
+            entries.push({ values: request, value: caller, pointer,
+                source: 'request', authority: 'project' });
+        origins[`/ceilings/${key}`] = entries.filter(entry => entry.value === ceilings[key]).map(entry => ({
+            source: entry.source, authority: entry.authority, pointer: entry.pointer,
+            digest: workerConfigDigest(entry.values), contribution: entry.value,
+        }));
+    }
+    return { ceilings, origins, diagnostics };
+}
+//# sourceMappingURL=worker-ceilings.js.map

package/dist/src/models/worker-invocation-policy.js

@@ -0,0 +1,243 @@
+// Checks invocation controls, native sandbox rendering and scoped worker health.
+import { WorkerAdapterSchema, WorkerPolicyError } from './provider-policy.js';
+import { normalizeProviderDefinitionId } from '../providers/provider-definitions.js';
+import { workerVersionRangeMismatch } from './worker-installation.mjs';
+import { workerModelKey } from './worker-selection-policy.js';
+import { qualificationDigest } from './qualification-digest.mjs';
+const WORKER_CONTROLS = ['model', 'effort', 'sandbox', 'approval', 'workdir',
+    'finalOutput', 'stdin', 'structuredOutput', 'stepCap', 'trust', 'children', 'fallback'];
+/** Caller controls only add restrictions. Absent resolved authority, require all controls. */
+export function requiredWorkerControls(context) {
+    if (context.requiredControls !== undefined && (!Array.isArray(context.requiredControls)
+        || context.requiredControls.some(name => typeof name !== 'string' || !name))) {
+        throw new Error('Worker required controls must be an array of control names');
+    }
+    const controls = new Set(WORKER_CONTROLS);
+    if (context.policy && context.permissions) {
+        if (context.effort === null)
+            controls.delete('effort');
+        // Step limits are observed unless explicitly required by the trusted route.
+        controls.delete('stepCap');
+        if (context.policy.guards?.denySelfDelegation === false)
+            controls.delete('children');
+    }
+    for (const name of context.requiredControls ?? [])
+        controls.add(name);
+    return [...controls];
+}
+/** The same sandbox requirement governs inspection, resolution and rendering. */
+export function requiresWorkerExternalBoundary(adapter, selection) {
+    if (hasOperatorWorkerNativeRenderer(adapter)
+        && (selection.permissions?.sandbox !== 'external' || selection.transport === 'shell'))
+        return false;
+    const providers = [adapter.id, adapter.provider].map(normalizeProviderDefinitionId);
+    return requiredWorkerControls(selection).includes('sandbox')
+        && (providers.some(provider => provider && ['claude', 'muse', 'hermes'].includes(provider))
+            || adapter.invocationProfiles?.[selection.profile]?.controls.sandbox?.support === 'external'
+            || selection.permissions?.sandbox === 'external');
+}
+/** Explicit local operator approval for the direct CLI baseline (decision 17).
+ * This is not backend attestation or a live negative-fixture result. */
+export const WORKER_OPERATOR_APPROVAL = 'aiwg doctor --probe-workers --qualify';
+export function isOperatorQualifiedWorkerAdapter(adapter) {
+    return adapter.qualification.status === 'qualified'
+        && adapter.qualification.evidenceRef === WORKER_OPERATOR_APPROVAL;
+}
+/** Bundled renderers with an independently checked native direct baseline. */
+export function hasOperatorWorkerNativeRenderer(adapter) {
+    return isOperatorQualifiedWorkerAdapter(adapter) && ['codex', 'muse'].includes(adapter.provider)
+        && adapter.invocation.kind === 'process';
+}
+/** The process-group launch boundary requires the independently verified native renderer. */
+export function assertWorkerLaunchMode(adapter, permissions = {}) {
+    const mode = permissions.launchMode ?? 'systemd-unit';
+    if (!['systemd-unit', 'native-sandbox'].includes(mode)) {
+        throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Unknown worker launch mode');
+    }
+    if (mode === 'native-sandbox' && (!hasOperatorWorkerNativeRenderer(adapter)
+        || !['read-only', 'workspace-write'].includes(permissions.sandbox ?? '')
+        || (permissions.transport ?? 'shell') !== 'shell')) {
+        throw new WorkerPolicyError('OG_POLICY_RELAXATION', 'native-sandbox requires a verified native read-only or workspace-write shell renderer');
+    }
+}
+/** Check the actual argv before granting the direct renderer exception. */
+export function assertOperatorWorkerNativeArgv(adapter, argv, selected, permissions) {
+    if (!hasOperatorWorkerNativeRenderer(adapter))
+        return;
+    const args = argv.slice(1);
+    const requirePair = (flag, value) => {
+        if (args.filter(token => token === flag).length !== 1 || args[args.indexOf(flag) + 1] !== value) {
+            throw new Error(`Requested native worker control is absent or ambiguous: ${flag}`);
+        }
+    };
+    const sandbox = permissions?.sandbox ?? 'workspace-write';
+    if (!['read-only', 'workspace-write', 'external'].includes(sandbox))
+        throw new Error('Requested sandbox has no verified native renderer');
+    if (adapter.provider === 'muse') {
+        requirePair('--provider', 'meta');
+        requirePair('--model', selected.model);
+        if (selected.effort.value === null)
+            throw new Error('Muse requires explicit effort');
+        requirePair('--reasoning-effort', selected.effort.value);
+        if ((permissions?.approval ?? 'never') !== 'never')
+            throw new Error('Muse direct worker approval requires never');
+        requirePair('--approval-mode', 'never');
+        requirePair('--approval-judge', 'off');
+        // #3685: Tier 0 Muse workers run in conductor-prepared worker trees, so
+        // project context must load. An argv without exactly one
+        // --trust-workspace would run with project_sources=0 (no project
+        // rules/skills/hooks) and is refused rather than silently degraded.
+        if (args.filter(token => token === '--trust-workspace').length !== 1) {
+            throw new Error('Requested native worker control is absent or ambiguous: --trust-workspace');
+        }
+        if (args.includes('--disable-sandbox') !== (sandbox === 'external')) {
+            throw new Error('Requested native worker sandbox control does not match');
+        }
+        if (sandbox === 'read-only' && (!args.includes('--disable-write') || !args.includes('--disable-shell'))) {
+            throw new Error('Requested native worker read-only control is absent');
+        }
+        if (args[0] !== 'exec')
+            throw new Error('Native worker controls could be overridden');
+        const seen = new Set();
+        for (let index = 1; index < args.length; index++) {
+            const flag = args[index];
+            if (seen.has(flag))
+                throw new Error('Native worker controls could be overridden');
+            seen.add(flag);
+            if (['--json', '--trust-workspace', '--disable-write', '--disable-shell', '--disable-sandbox'].includes(flag))
+                continue;
+            if (!['--provider', '--model', '--reasoning-effort', '--workspace', '--approval-mode', '--approval-judge',
+                '--max-model-steps', '--output-schema', '--prompt-file'].includes(flag) || index + 1 >= args.length) {
+                throw new Error('Native worker controls could be overridden');
+            }
+            index++;
+        }
+        return;
+    }
+    requirePair('-m', selected.model);
+    requirePair('-s', sandbox === 'external' ? 'danger-full-access' : sandbox);
+    if ((permissions?.approval ?? 'never') !== 'never')
+        throw new Error('Codex direct worker approval requires never');
+    for (const [name, value] of [['model_reasoning_effort', selected.effort.value], ['approval_policy', permissions?.approval ?? 'never']]) {
+        const overrides = args.flatMap((token, index) => token === '-c' ? [args[index + 1]] : [])
+            .filter(token => token?.split('=')[0] === name);
+        if (value === null || overrides.length !== 1 || overrides[0] !== `${name}=${JSON.stringify(value)}`) {
+            throw new Error(`Requested native worker control is absent or ambiguous: ${name}`);
+        }
+    }
+    // Permit only the bounded native command grammar. Alternate/combined flags,
+    // profiles and additional config overrides must not undo the checked pairs.
+    if (args[0] !== '--no-daemon' || args[1] !== 'exec' || !args.includes('--ignore-user-config')) {
+        throw new Error('Native worker controls could be overridden');
+    }
+    for (let index = 2; index < args.length; index++) {
+        const flag = args[index];
+        if (['--ignore-user-config', '--skip-git-repo-check', '--json'].includes(flag))
+            continue;
+        if (flag === '-' && index === args.length - 1)
+            continue;
+        if (!['-m', '-s', '-c', '-C', '-o'].includes(flag) || index + 1 >= args.length) {
+            throw new Error('Native worker controls could be overridden');
+        }
+        const value = args[++index];
+        if (flag === '-c' && !['model_reasoning_effort', 'approval_policy'].includes(value.split('=')[0])) {
+            throw new Error('Native worker controls could be overridden');
+        }
+    }
+}
+/** Inspect declared controls before installation evidence can be produced. This
+ * does not authorize invocation; consumers must use qualifyWorkerInvocationProfile. */
+export function inspectWorkerInvocationProfile(adapter, selection) {
+    WorkerAdapterSchema.parse(adapter);
+    const profile = adapter.invocationProfiles?.[selection.profile];
+    if (adapter.qualification.status !== 'qualified' || !profile || profile.transport !== selection.transport) {
+        throw new Error('Worker transport/profile is unqualified');
+    }
+    // Shared range predicate (worker-installation.mjs): read-only surfaces
+    // (worker-direct-readiness.ts) reuse the same helper instead of
+    // re-deriving this inspector's range logic.
+    if (workerVersionRangeMismatch(selection.cliVersion, [adapter.supportedVersions, profile.supportedVersions]) !== null) {
+        throw new Error('Worker CLI version is outside qualified profile');
+    }
+    // The direct CLI baseline trusts the installed driver's bounded renderer.
+    // Explicit extra controls still require the existing qualified mappings.
+    if (hasOperatorWorkerNativeRenderer(adapter) && profile.transport === 'shell') {
+        if (selection.permissions?.sandbox && !['read-only', 'workspace-write', 'external'].includes(selection.permissions.sandbox)) {
+            throw new Error('Requested sandbox has no verified native renderer');
+        }
+        for (const name of selection.requiredControls ?? []) {
+            if (!['native', 'external'].includes(profile.controls[name]?.support)) {
+                throw new Error(`Required worker control is unqualified: ${name}`);
+            }
+        }
+        return profile;
+    }
+    const requiredControls = requiredWorkerControls(selection);
+    if (requiresWorkerExternalBoundary(adapter, selection)
+        && (!selection.boundary || !['os', 'executor'].includes(selection.boundary.kind)
+            || !selection.boundary.identity || !/^sha256:[a-f0-9]{64}$/.test(selection.boundary.digest)
+            || !selection.boundary.controls?.includes('sandbox'))) {
+        throw new Error('Required worker control sandbox needs a qualified external enforcing boundary');
+    }
+    for (const name of requiredControls) {
+        if ((name === 'children' && !adapter.capabilities.nestedAgentsControllable)
+            || (name === 'fallback' && !adapter.capabilities.nativeFallbackControllable)) {
+            throw new Error(`Required worker control is unqualified: ${name}`);
+        }
+        const control = profile.controls[name];
+        if (!control || !['native', 'external'].includes(control.support) || !control.mapping || !control.evidence) {
+            throw new Error(`Required worker control is unqualified: ${name}`);
+        }
+    }
+    if (selection.transport === 'mcp' && (!selection.mcp || !profile.mcp
+        || Object.keys(profile.mcp).some(key => profile.mcp[key]
+            !== selection.mcp[key]))) {
+        throw new Error('MCP server/tool/schema/session qualification changed');
+    }
+    return profile;
+}
+/** Qualification is transport/version scoped; declaration or boundary claims
+ * alone cannot qualify an external sandbox. The invocation owner rechecks the
+ * installation scope, including this boundary, against the recorded digest. */
+export function qualifyWorkerInvocationProfile(adapter, selection) {
+    const profile = inspectWorkerInvocationProfile(adapter, selection);
+    if (isOperatorQualifiedWorkerAdapter(adapter) && selection.policy?.guards?.denySelfDelegation !== false
+        && !adapter.capabilities.nestedAgentsControllable) {
+        throw new Error('Required worker control is unqualified: children');
+    }
+    if (requiresWorkerExternalBoundary(adapter, selection) && !profile.installationQualification) {
+        throw new Error('Required worker control sandbox needs matching installation qualification for its external boundary');
+    }
+    return profile;
+}
+/** Health timing evidence belongs to the exact execution profile and tuple.
+ * Fixture qualification does not become authenticated/live qualification. */
+export function workerHealthScopeDigest(profile, scope) {
+    const { installationQualification: _installation, health, ...executionProfile } = profile;
+    const { qualification: _qualification, ...signals } = health ?? {};
+    return qualificationDigest({ profile: executionProfile, health: signals,
+        profileRef: scope.profileRef, cliVersion: scope.cliVersion, accountScope: scope.accountScope,
+        modelKey: workerModelKey(scope.inferenceProvider, scope.model), effort: scope.effort });
+}
+/** Reused by observation and invocation owners before using qualified health.
+ * Older profiles have no qualification record and retain degraded observation. */
+export function assertWorkerHealthQualification(profile, scope) {
+    const evidence = profile.health?.qualification;
+    if (!evidence)
+        return;
+    if (evidence.status === 'unqualified') {
+        if (profile.health?.coverage === 'full' || profile.health?.handshake === 'semantic') {
+            throw new Error('Unqualified worker health cannot assert full or semantic coverage');
+        }
+        return;
+    }
+    const modelKey = workerModelKey(scope.inferenceProvider, scope.model);
+    if (evidence.cliVersion !== scope.cliVersion || evidence.accountScope !== scope.accountScope
+        || evidence.profileRef !== scope.profileRef || evidence.modelKey !== modelKey || evidence.effort !== scope.effort
+        || !profile.health?.qualifiedAt || !Number.isFinite(Date.parse(profile.health.qualifiedAt))
+        || evidence.scopeDigest !== workerHealthScopeDigest(profile, scope)
+        || (evidence.status === 'live-qualified' && evidence.authorizedLive !== true)) {
+        throw new Error('Worker health qualification scope changed or lacks live authorization');
+    }
+}
+//# sourceMappingURL=worker-invocation-policy.js.map

package/dist/src/models/worker-plan.js

@@ -1,9 +1,12 @@
+import { workerReviewLineageDiagnostics } from './worker-review-lineage.js';
 // Resolves eligible worker tuples against current config, catalog and installation snapshots.
+import { isFlagshipModel, flagshipElected, normalizeModelTier } from './tiers.js';
 import { ownWorkerRoleGuidance } from './worker-selection-policy.js';
+import { resolveWorkerCeilings } from './worker-ceilings.js';
 import { mergeGroupWorkerPolicy } from '../config/worker-group-templates.js';
 import { WORKER_DISPATCH_ENABLE_COMMAND, WORKER_DISPATCH_READINESS_COMMAND } from './worker-dispatch-offer.js';
 import { resolveWorkerGroupInstallation, resolveParallelism, validateWorkerGroupQualifications, validateWorkerGroupReferences, validateWorkerBudgetEnforcement, workerActivationDigests, workerConfigDigest, } from '../config/aiwg-config.js';
-import { qualifyWorkerInvocationProfile, validateWorkerPolicyRoute, validateWorkerModelObservation, assertWorkerLaunchMode, hasOperatorWorkerNativeRenderer, hasSelectionRelevantConflicts, workerContextHeadroom, workerModelKey, isCanonicalWorkerModelKey, WorkerSelectionPolicySchema, validateWorkerCatalogDiscovery, } from './provider-policy.js';
+import { qualifyWorkerInvocationProfile, validateWorkerPolicyRoute, validateWorkerModelObservation, assertWorkerLaunchMode, hasOperatorWorkerNativeRenderer, workerContextHeadroom, workerModelKey, isCanonicalWorkerModelKey, WorkerSelectionPolicySchema, validateWorkerCatalogDiscovery, } from './provider-policy.js';
 import { MODEL_WRAPPERS } from './provider-models.js';
 import { routeModelTier } from './router.js';
 const matchesChoice = (tuple, choice) => tuple.group === choice.group && tuple.member === choice.member && tuple.model === choice.model && tuple.effort === choice.effort;
@@ -21,7 +24,7 @@ function workerCatalogDigest(catalog) {
 }
 /** Pure S1 resolution. No probing, launch, activation, admission, or writes.
  * Recheck against freshly loaded snapshots before preparing an invocation. */
-export function resolveWorkerPlan(snapshot, request) {
+export function resolveWorkerPlan(snapshot, request, ceilingDefaults = {}) {
     let parallelism = snapshot.config.parallelism ?? {};
     const policy = snapshot.models.defaults.workerSelection;
     const digests = {
@@ -85,16 +88,10 @@ export function resolveWorkerPlan(snapshot, request) {
     if (plan.diagnostics.length)
         return plan;
     parallelism = resolveParallelism(parallelism, snapshot.config.providers?.[0]);
-    const ceilingLayers = [parallelism.budgets?.perRun, parallelism.budgets?.perTask,
-        { maxAttempts: parallelism.retry?.maxAttempts ?? 3 }, snapshot.constraints?.ceilings, request.ceilings];
-    for (const key of ['tokens', 'costUsd', 'wallSeconds', 'maxAttempts']) {
-        const values = ceilingLayers.map(layer => layer?.[key]).filter((value) => value !== undefined);
-        if (values.some(value => !Number.isFinite(value) || value < 0 || key !== 'costUsd' && !Number.isSafeInteger(value))) {
-            block('OG_CONFIG_REFERENCE', `/request/ceilings/${key}`, 'Ceilings must be finite nonnegative values; counts must be integers');
-        }
-        else if (values.length)
-            plan.ceilings[key] = Math.min(...values);
-    }
+    const resolvedCeilings = resolveWorkerCeilings(parallelism, snapshot.constraints?.ceilings, request.ceilings, ceilingDefaults);
+    plan.ceilings = resolvedCeilings.ceilings;
+    plan.origins = { ...plan.origins, ...resolvedCeilings.origins };
+    plan.diagnostics.push(...resolvedCeilings.diagnostics);
     if (plan.ceilings.maxAttempts === 0)
         block('OG_BUDGET_UNMEASURABLE', '/request/ceilings/maxAttempts', 'No task attempts remain');
     const qualifiedRoles = {};
@@ -125,10 +122,7 @@ export function resolveWorkerPlan(snapshot, request) {
         block('OG_CONFIG_REFERENCE', '/request/group', 'Group is outside role guidance');
     if ([request.maxParallel, snapshot.constraints?.maxParallel].some(value => value !== undefined && (!Number.isSafeInteger(value) || value < 0)))
         block('OG_CONFIG_REFERENCE', '/request/maxParallel', 'Capacity ceilings must be nonnegative integers');
-    if (request.requireDifferentFamily && (!request.reviewOf || validateWorkerModelObservation(request.reviewOf).length
-        || hasSelectionRelevantConflicts(request.reviewOf) || !request.reviewOf.family || request.reviewOf.family === 'unknown')) {
-        block('OG_MODEL_UNAPPROVED', '/request/reviewOf', 'Required review needs unambiguous observed source lineage');
-    }
+    plan.diagnostics.push(...workerReviewLineageDiagnostics(request));
     const candidateGroups = request.group ? [request.group] : guidance?.groups ?? [];
     const unqualifiedGroups = new Set(qualificationGaps.map(gapGroup));
     const qualifiedGroups = candidateGroups.filter(groupId => !unqualifiedGroups.has(groupId));
@@ -213,8 +207,7 @@ export function resolveWorkerPlan(snapshot, request) {
                     reasons.push(...validateWorkerPolicyRoute({ policy: groupPolicy, role, inferenceProvider: row.llmProvider, apiModelId: row.apiModelId,
                         selectedModel: member.model, effort, identityEvidence: binding.identityEvidence, observation,
                         wrapperPin, ...(substitution ? { substitution: request.substitution } : {}), dataClass: request.dataClass, now, context: request.context }));
-                    if (request.requireDifferentFamily && (observation.family === 'unknown' || observation.family === request.reviewOf.family))
-                        deny('OG_MODEL_UNAPPROVED', '/worker/family', 'Required review must use a different observed family');
+                    reasons.push(...workerReviewLineageDiagnostics({ ...request, reviewer: observation }));
                     try {
                         const { adapter } = resolveWorkerGroupInstallation(parallelism, member.cli, snapshot.registry);
                         const configuredProfile = parallelism.clis?.[member.cli]?.invocationProfile;
@@ -266,9 +259,12 @@ export function resolveWorkerPlan(snapshot, request) {
                         deny('OG_MODEL_UNAPPROVED', '/constraints/revokedModels', 'Current model revocation');
                     if (snapshot.constraints?.unavailableMembers?.includes(`${groupId}/${member.id}`))
                         deny('OG_ADAPTER_UNQUALIFIED', pointer, 'Member is currently unavailable');
-                    const premium = ['premium', 'max-quality'].includes(guidance.tier) || observation.pricing.costClass === 'premium';
+                    const flagship = normalizeModelTier(guidance.tier) === 'flagship' || isFlagshipModel(row.apiModelId);
+                    if (flagship && !flagshipElected(request.authority ?? {}))
+                        deny('OG_MODEL_UNAPPROVED', '/request/authority', 'Flagship models are user-elected only');
+                    const premium = ['premium', 'flagship', 'max-quality'].includes(guidance.tier) || observation.pricing.costClass === 'premium';
                     // Worker candidates always invoke a model; deterministic/routine hints must not bypass premium authority.
-                    const authority = routeModelTier({ ...request.authority, deterministic: false, routine: false,
+                    const authority = routeModelTier({ ...request.authority, deterministic: false, routine: false, requestedTier: flagship ? 'flagship' : undefined,
                         defaultTier: guidance.tier === 'economy' ? 1 : 2, requestedPremium: premium || request.authority?.requestedPremium });
                     if (authority.requiresConfirmation)
                         deny('OG_MODEL_UNAPPROVED', '/request/authority', `${authority.rationale.join('; ')}; agents may pass --authorize-premium only after the human explicitly confirmed the premium escalation (escalation-discipline rule)`);

package/dist/src/models/worker-review-lineage.js

@@ -0,0 +1,55 @@
+// Shared observed-lineage validation for worker resolution and final review.
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+let catalogValidators;
+export function getCatalogValidators() {
+    if (!catalogValidators) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const file = [resolve(here, '../../schemas/models/model-catalog.v1.schema.json'), resolve(here, '../../../schemas/models/model-catalog.v1.schema.json')].find(existsSync);
+        if (!file)
+            throw new Error('Model catalog schema is unavailable');
+        const schema = JSON.parse(readFileSync(file, 'utf8'));
+        const ajv = addFormats(new Ajv2020({ strict: false, allErrors: true }));
+        ajv.addSchema(schema);
+        catalogValidators = { catalog: ajv.getSchema(schema.$id), observation: ajv.compile({ $ref: `${schema.$id}#/$defs/workerObservation` }), discovery: ajv.compile({ $ref: `${schema.$id}#/properties/discovery` }) };
+    }
+    return catalogValidators;
+}
+export function validateWorkerModelObservation(input) {
+    const validate = getCatalogValidators().observation;
+    return validate(input) ? [] : (validate.errors ?? []).map(error => `${error.instancePath}: ${error.message}`);
+}
+/** Optional catalog facts do not veto otherwise qualified selection. */
+export function hasSelectionRelevantConflicts(observation) {
+    const relevant = /^\/(?:lifecycle|availability|visibility|hidden|efforts|effortSupport|reasoningEfforts|sunsetAt|retiredAt|replacementModelId|supersededBy|dataUse|id|apiModelId|llmProvider|cliId|family|runtimeVersion|accountScope|endpointFingerprint|identityEvidence|contextTokens|maxOutputTokens|qualification)(?:\/|$)/;
+    return observation.conflicts?.some(conflict => relevant.test(conflict.field)) ?? false;
+}
+/** Same lineage rule for resolve and acceptance; CLI names never prove diversity. */
+export function workerReviewLineageDiagnostics(input) {
+    if (!input.requireDifferentFamily)
+        return [];
+    const diagnostics = [];
+    const deny = (pointer, message) => {
+        diagnostics.push({ code: 'OG_MODEL_UNAPPROVED', pointer, message });
+    };
+    const unambiguous = (observation) => !!observation && validateWorkerModelObservation(observation).length === 0
+        && !hasSelectionRelevantConflicts(observation) && !!observation.family && observation.family !== 'unknown';
+    if (!unambiguous(input.reviewOf)) {
+        deny('/request/reviewOf', 'Required review needs unambiguous observed source lineage');
+    }
+    // Omission here is intentional during resolver preflight. Acceptance explicitly
+    // requires a reviewer before calling this shared predicate.
+    if (input.reviewer !== undefined) {
+        if (!unambiguous(input.reviewer)) {
+            deny('/worker/family', 'Required review needs unambiguous observed reviewer lineage');
+        }
+        else if (input.reviewer.family === input.reviewOf?.family) {
+            deny('/worker/family', 'Required review must use a different observed family');
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=worker-review-lineage.js.map

package/dist/src/models/worker-selection-policy.js

@@ -14,7 +14,7 @@ const baseRoles = ['efficiency', 'coding', 'reasoning'];
 const WorkerRoleSchema = z.strictObject({
     baseRole: z.enum(baseRoles).optional(),
     groups: uniqueStrings.refine(values => values.length > 0),
-    tier: z.enum(['economy', 'standard', 'premium', 'max-quality']),
+    tier: z.enum(['economy', 'standard', 'premium', 'flagship', 'max-quality']),
     initialEffort: z.string().min(1).nullable(),
     effortLadder: uniqueStrings,
     escalateAfter: integer().positive().optional(),

package/dist/src/models/wrapper-route.js

@@ -5,7 +5,7 @@ import { resolveWorkerPlan } from './resolver.js';
 function roleForTier(tier) {
     if (tier === 'economy')
         return 'efficiency';
-    if (tier === 'premium' || tier === 'max-quality')
+    if (tier === 'premium' || tier === 'flagship' || tier === 'max-quality')
         return 'reasoning';
     if (tier === 'standard')
         return 'coding';
@@ -14,7 +14,7 @@ function roleForTier(tier) {
 export function buildWrapperRouteEnvelope(request) {
     if (!request.assignment.trim())
         throw new Error('Wrapper routing requires a bounded assignment.');
-    const decision = routeModelTier(request);
+    const decision = routeModelTier({ ...request, agentName: request.agentName ?? request.capability.name });
     if (request.worker?.snapshot.config.parallelism?.worker_dispatch && !request.deterministic) {
         const worker = resolveWorkerPlan(request.worker.snapshot, {
             ...request.worker.request,
@@ -39,7 +39,10 @@ export function buildWrapperRouteEnvelope(request) {
         ? compileModelPolicy({
             provider: request.provider,
             artifact: 'agent',
-            policy: { role, tier: tier === 'max-quality' ? 'premium' : tier },
+            policy: { role, tier },
+            election: request.election,
+            flagshipAllowlist: request.flagshipAllowlist,
+            agentName: request.agentName ?? request.capability.name,
             ...(request.catalog ? { catalog: request.catalog } : {}),
         })
         : null;