@aiwg/cli 2026.10.10 → 2026.10.12

package/dist/src/policy/authorization.js

@@ -9,6 +9,7 @@
 import { access, copyFile, mkdir, readFile, rename } from 'node:fs/promises';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { load as loadYaml } from 'js-yaml';
+export { resolveHitlAuthorization } from './hitl.js';
 import { projectAiwgPath, projectControlPath } from '../config/project-artifacts.js';
 /**
  * Export provider mappings without inventing provider grants. Stable IDs,
@@ -170,13 +171,41 @@ const LEGACY_MANIFESTS = [
     '.aiwg/ops/security/repo-access.manifest.yaml',
     '.aiwg/security/repo-access.manifest.yaml',
 ];
+/**
+ * Factory delivery defaults written by `aiwg init`/`aiwg use`
+ * (emptyConfig in src/config/aiwg-config.ts). Kept as a literal here —
+ * rather than importing the config module — because aiwg-config already
+ * imports this module for authorization validation, so a value import
+ * would be a cycle. A unit test pins this literal against
+ * emptyConfig().delivery (#3635).
+ */
+const DEFAULT_DELIVERY_POLICY = {
+    mode: 'pr-required',
+    default_branch: 'main',
+    require_ci_green: true,
+    auto_close_issues: true,
+    issue_comment_on_cycle: true,
+    force_push_policy: 'never',
+};
+/** True when the delivery block is exactly what the tool writes for a fresh project. */
+export function isDefaultDeliveryPolicy(delivery) {
+    if (!delivery || typeof delivery !== 'object')
+        return false;
+    const actual = delivery;
+    const actualKeys = Object.keys(actual);
+    return actualKeys.length === Object.keys(DEFAULT_DELIVERY_POLICY).length
+        && actualKeys.every((key) => actual[key] === DEFAULT_DELIVERY_POLICY[key]);
+}
 export async function auditLegacyPermissions(projectDir, config) {
     const out = validateAuthorization(config?.authorization);
     if (!config?.authorization && config?.repos?.some(repo => repo.allowed?.length))
         out.push({ severity: 'warning', code: 'legacy-repos-allowed', source: '.aiwg/aiwg.config', message: 'repos[].allowed should be normalized into authorization roles and assignments.' });
     if (!config?.authorization && Object.keys(config?.repo_maintainer?.tiers ?? {}).length)
         out.push({ severity: 'warning', code: 'legacy-maintainer-tiers', source: '.aiwg/aiwg.config', message: 'repo_maintainer.tiers should be represented by normalized role assignments.' });
-    if (!config?.authorization && config?.delivery)
+    // Tool-written delivery defaults are not operator legacy input: a fresh
+    // `aiwg use` must not produce something that needs migration (#3635).
+    // Operator-edited delivery (any key added, removed, or changed) still flags.
+    if (!config?.authorization && config?.delivery && !isDefaultDeliveryPolicy(config.delivery))
         out.push({ severity: 'warning', code: 'legacy-delivery-policy', source: '.aiwg/aiwg.config', message: 'delivery and signing operations should be normalized into scoped role assignments.' });
     for (const path of LEGACY_MANIFESTS) {
         try {

package/dist/src/policy/hitl-config.js

@@ -0,0 +1,63 @@
+// Loads governing workspace/member policies without merging or broadening their grants.
+import { realpath } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
+import { getConfigPath, readAiwgConfigCandidate } from '../config/aiwg-config.js';
+export function ensureAuthorization(config) {
+    return config.authorization ??= { version: '1', default_effect: 'deny', resources: {}, permissions: {}, roles: {}, assignments: [] };
+}
+const inside = (child, root) => {
+    const path = relative(root, child);
+    return path === '' || (path !== '..' && !path.startsWith('../') && !isAbsolute(path));
+};
+async function canonicalDirectory(path) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        const parent = dirname(path);
+        if (parent === path)
+            throw error;
+        return resolve(await canonicalDirectory(parent), basename(path));
+    }
+}
+/** Each config boundary narrows grants. A member without HITL policy cannot inherit approval. */
+export async function loadHitlLayers(start) {
+    const layers = [];
+    const seen = new Set();
+    let current = await canonicalDirectory(resolve(start));
+    let projectDir;
+    let child;
+    while (true) {
+        if (seen.has(current))
+            throw new Error('Cyclic HITL workspace membership');
+        seen.add(current);
+        const config = await readAiwgConfigCandidate(current);
+        if (config) {
+            projectDir ??= current;
+            if (child && config.repos) {
+                const root = await canonicalDirectory(resolve(current, config.workspace?.root ?? '.'));
+                const members = await Promise.all(config.repos.map(repo => canonicalDirectory(resolve(root, repo.path))));
+                if (!members.some(member => inside(child, member))) {
+                    throw new Error('HITL workspace does not declare this member');
+                }
+            }
+            layers.unshift({ source: getConfigPath(current), policy: config.authorization?.hitl });
+            child = current;
+            if (config.workspace?.member_of) {
+                current = await canonicalDirectory(resolve(current, config.workspace.member_of));
+                const parent = await readAiwgConfigCandidate(current);
+                if (!parent?.repos)
+                    throw new Error('HITL workspace.member_of must name a workspace manifest');
+                continue;
+            }
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return { projectDir: projectDir ?? resolve(start), layers };
+}
+//# sourceMappingURL=hitl-config.js.map

package/dist/src/policy/hitl-receipt.js

@@ -0,0 +1,57 @@
+// Records a credential-free decision artifact through existing effect intent/reconcile receipts.
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { projectAiwgWritePath, resolveProjectAiwgDirForWrite } from '../config/project-artifacts.js';
+import { recordIntent, reconcileEffect } from '../effects/ledger.js';
+import { payloadDigest } from '../effects/identity.js';
+import { assertDigestOnly } from '../effects/redaction.js';
+import { fileDigestVerifier } from '../effects/verifiers/file.js';
+import { createVerifierRegistry } from '../effects/verifiers/registry.js';
+import { hitlDigest, resolveHitlAuthorization, validHitlAction } from './hitl.js';
+import { HITL_CATEGORIES, HITL_ENVIRONMENTS } from './hitl-types.js';
+/** Resolve again at receipt time. A preview result supplied by an agent is never trusted. */
+export async function recordHitlAuthorization(ledger, action, context) {
+    const resolution = resolveHitlAuthorization(action, context);
+    const receipt = {
+        kind: 'hitl-authorization', evaluatedAtDigest: hitlDigest(context.now),
+        sessionGrantDigest: hitlDigest(context.sessionAuthorization ?? null), ...resolution,
+        // Arbitrary user strings become digests, including paths, repo identity and profile names.
+        matchedProfile: resolution.matchedProfile ? hitlDigest(resolution.matchedProfile) : null,
+        action: validHitlAction(action) ? {
+            category: HITL_CATEGORIES.find(category => category === action.category) ?? 'restricted',
+            descriptorDigest: hitlDigest(action), categoryDigest: hitlDigest(action.category),
+            reversible: action.reversible, impact: action.impact,
+        } : { descriptorDigest: hitlDigest(action) },
+        scope: validHitlAction(action) ? {
+            environmentClass: HITL_ENVIRONMENTS.find(environment => environment === action.environment) ?? 'restricted',
+            repoDigest: hitlDigest(action.repo), environmentDigest: hitlDigest(action.environment),
+            resourceDigests: action.resources.map(hitlDigest),
+        } : null,
+        origins: context.layers.map(layer => ({ sourceDigest: hitlDigest(layer.source), policyDigest: hitlDigest(layer.policy ?? null) })),
+    };
+    assertDigestOnly(receipt);
+    const bytes = JSON.stringify(receipt) + '\n';
+    const digest = payloadDigest(bytes);
+    const root = resolveProjectAiwgDirForWrite(ledger.projectDir);
+    const relativePath = join('effects', 'authorization', `${digest.slice(7)}.json`);
+    const file = projectAiwgWritePath(ledger.projectDir, relativePath);
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    try {
+        await writeFile(file, bytes, { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        if (await readFile(file, 'utf8') !== bytes)
+            throw new Error('HITL receipt identity conflict');
+    }
+    const intent = await recordIntent(ledger, {
+        kind: 'file.digest', target: `file:${file}@${digest}`, payloadDigest: digest,
+        context: { policyVersion: resolution.policyVersion, decision: resolution.decision, provenance: resolution.provenance, receiptDigest: digest },
+    });
+    const reconciled = await reconcileEffect(ledger, intent.effectId, {
+        verifiers: createVerifierRegistry([fileDigestVerifier({ root })]),
+    });
+    return { resolution, file, intent, reconciled };
+}
+//# sourceMappingURL=hitl-receipt.js.map

package/dist/src/policy/hitl-types.js

@@ -0,0 +1,4 @@
+// Defines bounded HITL grants and trusted resolver inputs, separate from RBAC.
+export const HITL_CATEGORIES = ['repo.read', 'repo.edit', 'docs.edit', 'test.run', 'testnet.configure'];
+export const HITL_ENVIRONMENTS = ['local', 'development', 'test', 'testnet'];
+//# sourceMappingURL=hitl-types.js.map

package/dist/src/policy/hitl-validation.js

@@ -0,0 +1,39 @@
+// Validates HITL with the existing config schema definitions, shared by loader and resolver.
+import { createRequire } from 'node:module';
+import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
+function compiled() {
+    const require = createRequire(import.meta.url);
+    let schema;
+    // Source and compiled modules share the shipped config schema; no cwd or home lookup.
+    for (const relative of ['../../vscode-extension/schemas/aiwg.config.v1.json',
+        '../../../vscode-extension/schemas/aiwg.config.v1.json']) {
+        try {
+            schema = require(relative);
+            break;
+        }
+        catch (error) {
+            if (error?.code !== 'MODULE_NOT_FOUND')
+                throw error;
+        }
+    }
+    if (!schema)
+        throw new Error('HITL config schema unavailable');
+    const ajv = new Ajv({ strict: true, allErrors: true });
+    addFormats(ajv);
+    return ajv.compile({
+        $ref: '#/definitions/HitlPolicy',
+        definitions: Object.fromEntries(['HitlPolicy', 'HitlProfile', 'HitlSelector'].map(key => [key, schema.definitions[key]])),
+    });
+}
+// Compile at module initialization; resolving an action performs no filesystem I/O.
+const validator = compiled();
+export function validateHitlPolicy(value) {
+    if (value === undefined)
+        return [];
+    if (validator(value))
+        return [];
+    // Never echo supplied values, which may contain credentials or injected text.
+    return ['authorization.hitl: invalid bounded policy (scope, categories, expiry or unknown fields)'];
+}
+//# sourceMappingURL=hitl-validation.js.map

package/dist/src/policy/hitl.js

@@ -0,0 +1,117 @@
+// Resolves bounded HITL authorization without I/O, clocks, or prompt-text authority.
+import { createHash } from 'node:crypto';
+import { HITL_CATEGORIES, HITL_ENVIRONMENTS } from './hitl-types.js';
+import { validateHitlPolicy } from './hitl-validation.js';
+export function hitlDigest(value) {
+    const canonical = (v) => Array.isArray(v) ? v.map(canonical)
+        : v && typeof v === 'object' ? Object.fromEntries(Object.entries(v).filter(([, x]) => x !== undefined)
+            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, x]) => [k, canonical(x)])) : v;
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex')}`;
+}
+export const hitlPolicyVersion = (layers) => hitlDigest(layers);
+const identifier = /^[A-Za-z0-9][A-Za-z0-9_.:/@-]{0,255}$/;
+const pathValid = (path) => path.length > 0 && path.length <= 512 && !path.startsWith('/') && !path.includes(':')
+    && !/[\\\x00-\x20*?\[\]{}!]/.test(path) && path.split('/').every(p => p !== '.' && p !== '..' && p !== '');
+export function validHitlAction(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    return actionFieldsValid(value);
+}
+function actionFieldsValid(a) {
+    const keys = ['category', 'repo', 'environment', 'resources', 'reversible', 'impact'];
+    return Object.keys(a).length === keys.length && keys.every(k => Object.hasOwn(a, k))
+        && [a.category, a.repo, a.environment].every(x => typeof x === 'string' && identifier.test(x))
+        && Array.isArray(a.resources) && a.resources.length > 0 && a.resources.every(p => typeof p === 'string' && pathValid(p))
+        && typeof a.reversible === 'boolean' && ['low', 'medium', 'high'].includes(a.impact);
+}
+/** Deliberately small glob language: * within a segment; ** crosses directories; ? one character. */
+function glob(pattern, path) {
+    // Memoized matching bounds work by pattern length × path length, without regex backtracking.
+    const memo = new Map();
+    const match = (i, j) => {
+        const key = `${i}:${j}`;
+        if (memo.has(key))
+            return memo.get(key);
+        let result;
+        if (i === pattern.length)
+            result = j === path.length;
+        else if (pattern[i] === '*' && pattern[i + 1] === '*') {
+            if (pattern[i + 2] === '/') {
+                const slash = path.indexOf('/', j);
+                result = match(i + 3, j) || (slash >= 0 && match(i, slash + 1));
+            }
+            else
+                result = match(i + 2, j) || (j < path.length && match(i, j + 1));
+        }
+        else if (pattern[i] === '*')
+            result = match(i + 1, j)
+                || (j < path.length && path[j] !== '/' && match(i, j + 1));
+        else
+            result = j < path.length && (pattern[i] === path[j] || (pattern[i] === '?' && path[j] !== '/'))
+                && match(i + 1, j + 1);
+        memo.set(key, result);
+        return result;
+    };
+    return match(0, 0);
+}
+function selected(s, a) {
+    return (!s.categories || s.categories.includes(a.category)) && (!s.repos || s.repos.includes(a.repo))
+        && (!s.environments || s.environments.includes(a.environment))
+        && (!s.resources || a.resources.some(p => s.resources.some(g => glob(g, p))));
+}
+function grant(p, a, now) {
+    return now < Date.parse(p.expiresAt) && p.reversible === true && a.reversible
+        && p.categories.some(c => c === a.category) && p.repos.includes(a.repo)
+        && p.environments.some(e => e === a.environment)
+        && a.resources.every(path => p.resources.some(g => glob(g, path)))
+        && (a.impact === 'low' || (a.impact === 'medium' && p.maxImpact === 'medium'));
+}
+export function resolveHitlAuthorization(action, context) {
+    const policyVersion = hitlPolicyVersion(context.layers);
+    const result = (decision, reason, provenance, matchedProfile = null) => ({ decision, reason, policyVersion, matchedProfile, provenance });
+    if (context.platform)
+        return result(context.platform === 'deny' ? 'deny' : 'escalate', 'platform-constraint', 'platform');
+    if (!validHitlAction(action))
+        return result('escalate', 'invalid-action-descriptor', 'default');
+    if (!HITL_CATEGORIES.some(c => c === action.category) || !HITL_ENVIRONMENTS.some(e => e === action.environment)
+        || !action.reversible || action.impact === 'high')
+        return result('escalate', 'safety-category-requires-explicit-review', 'platform');
+    // Revalidate even when invoked directly with objects that bypassed the config loader.
+    if (context.layers.some(l => validateHitlPolicy(l.policy).length))
+        return result('escalate', 'invalid-policy', 'default');
+    if (context.layers.some(l => l.policy?.deny.some(s => selected(s, action))))
+        return result('deny', 'explicit-deny', 'explicit-deny');
+    const now = Date.parse(context.now);
+    if (!Number.isFinite(now))
+        return result('escalate', 'invalid-clock', 'default');
+    const session = context.sessionAuthorization;
+    if (session?.source === 'session-user') {
+        const probe = { version: '1', enabled: true, reviewedAt: context.now, maxAgeSeconds: 1,
+            expiresAt: session.profile.expiresAt, profiles: { session: session.profile }, deny: [], requireReview: [] };
+        if (!validateHitlPolicy(probe).length && grant(session.profile, action, now))
+            return result('auto-authorized', 'session-user-authorization', 'session-user', 'session');
+    }
+    if (context.expectedPolicyVersion && policyVersion !== context.expectedPolicyVersion)
+        return result('escalate', 'stale-policy-version', 'project-policy');
+    if (!context.layers.length)
+        return result('escalate', 'no-project-policy', 'default');
+    let matched = null;
+    for (const layer of context.layers) {
+        const p = layer.policy;
+        if (!p?.enabled)
+            return result('escalate', p ? 'policy-revoked' : 'missing-member-policy', 'project-policy');
+        const reviewed = Date.parse(p.reviewedAt);
+        if (now >= Date.parse(p.expiresAt))
+            return result('escalate', 'policy-expired', 'project-policy');
+        if (reviewed > now || now - reviewed >= p.maxAgeSeconds * 1000)
+            return result('escalate', 'stale-policy-review', 'project-policy');
+        if (p.requireReview.some(s => selected(s, action)))
+            return result('escalate', 'policy-requires-review', 'project-policy');
+        const entry = Object.entries(p.profiles).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).find(([, profile]) => grant(profile, action, now));
+        if (!entry)
+            return result('escalate', 'outside-profile-or-expired', 'project-policy');
+        matched = entry[0];
+    }
+    return result('auto-authorized', 'bounded-project-policy', 'project-policy', matched);
+}
+//# sourceMappingURL=hitl.js.map

package/dist/src/process/aiwg-probe-command.d.mts

@@ -0,0 +1,15 @@
+export interface AiwgProbeCommand {
+  file: string;
+  prefix: string[];
+  via: 'aiwg-bin' | 'entrypoint' | 'package' | 'path';
+}
+
+export function resolveAiwgProbeCommand(options?: {
+  env?: NodeJS.ProcessEnv;
+  argv1?: string | undefined;
+  execPath?: string;
+  cwd?: string;
+  packageRoot?: string | null;
+}): AiwgProbeCommand;
+
+export function probeNotOnPathDetail(): string;

package/dist/src/process/aiwg-probe-command.mjs

@@ -0,0 +1,37 @@
+// Resolves the aiwg invocation for doctor's discovery self-probes so they
+// run the current entrypoint instead of failing when aiwg is not on PATH.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+export function resolveAiwgProbeCommand({
+  env = process.env,
+  argv1 = process.argv[1],
+  execPath = process.execPath,
+  cwd = process.cwd(),
+  packageRoot = null,
+} = {}) {
+  const override = env?.AIWG_BIN;
+  if (typeof override === 'string' && override.length > 0) {
+    return { file: override, prefix: [], via: 'aiwg-bin' };
+  }
+  const entry = typeof argv1 === 'string' && argv1.length > 0
+    ? (path.isAbsolute(argv1) ? argv1 : path.resolve(cwd, argv1))
+    : null;
+  // Only the aiwg launcher itself is a usable entrypoint; doctor also runs as
+  // `node tools/cli/doctor.mjs`, where argv[1] is doctor, not aiwg.
+  const isLauncher = entry && ['aiwg', 'aiwg.mjs'].includes(path.basename(entry));
+  if (entry && isLauncher && existsSync(entry)) {
+    return { file: execPath, prefix: [entry], via: 'entrypoint' };
+  }
+  if (typeof packageRoot === 'string' && packageRoot.length > 0) {
+    const bin = path.join(packageRoot, 'bin', 'aiwg.mjs');
+    if (existsSync(bin)) {
+      return { file: execPath, prefix: [bin], via: 'package' };
+    }
+  }
+  return { file: 'aiwg', prefix: [], via: 'path' };
+}
+
+export function probeNotOnPathDetail() {
+  return 'aiwg not on PATH (spawn ENOENT) — add the npm global bin to PATH or invoke doctor via the install entrypoint';
+}

package/dist/src/rules/activation.d.mts

@@ -7,7 +7,7 @@ export interface RuleFrontmatter extends Record<string, unknown> {
   summary?: string;
   bound_to: RuleBindings;
   paths?: string[];
-  enforcedBy?: unknown;
+  enforcedBy?: string[];
 }
 export interface RuleDiagnostic { severity: 'error' | 'warn' | 'info'; code: string; message: string }
 export type RuleValidationResult =

package/dist/src/rules/activation.mjs

@@ -44,8 +44,6 @@ export function validateRuleFrontmatter(data) {
   }
   if (!tagged) diagnostics.push({ severity: 'warn', code: 'missing-activation',
     message: `Missing activation; inferred ${inferRuleActivation(data.enforcement)} delivery (migration fallback); add explicit activation frontmatter.` });
-  if (Object.hasOwn(data, 'enforcedBy')) diagnostics.push({ severity: 'info', code: 'reserved-enforcedBy',
-    message: 'enforcedBy is opaque reserved metadata (#2839); it has no effect.' });
   const valid = !diagnostics.some(item => item.severity === 'error');
   return {
     valid, diagnostics,

package/dist/src/rules/gate-coverage.js

@@ -0,0 +1,51 @@
+/** Read rule sources and report declared gate coverage without executing gates. */
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { buildGatesRegistry, installedAiwgRoot } from '../gates/driver.js';
+import { parseRuleFrontmatter } from './activation.mjs';
+import { ruleFiles } from './pin-state.js';
+import { ruleGateReferenceErrors } from './gate-references.js';
+function bundleRuleDirs(root) {
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root, { withFileTypes: true }).filter(entry => entry.isDirectory())
+        .map(entry => path.join(root, entry.name, 'rules'));
+}
+export function listRuleGateCoverage(options = {}, ruleId) {
+    const cwd = path.resolve(options.cwd ?? process.cwd());
+    const root = path.resolve(options.aiwgRoot ?? installedAiwgRoot());
+    const dirs = [path.join(cwd, 'rules'), path.join(cwd, '.aiwg/rules')];
+    for (const group of ['frameworks', 'addons', 'extensions']) {
+        dirs.push(...bundleRuleDirs(path.join(root, 'agentic/code', group)), ...bundleRuleDirs(path.join(cwd, '.aiwg', group)));
+    }
+    for (const candidate of options.packDirs ?? []) {
+        const dir = path.resolve(cwd, candidate);
+        if (statSync(dir).isDirectory())
+            dirs.push(path.join(dir, 'rules'));
+    }
+    const files = [...new Set(dirs.flatMap(ruleFiles))].sort().filter(file => !/^(?:README|RULES-INDEX|RULES-ONDEMAND)\.md$/.test(path.basename(file)) && !file.endsWith('.core.md'));
+    const { registry } = buildGatesRegistry(options);
+    const rules = [];
+    for (const file of files) {
+        const name = path.basename(file, '.md');
+        const id = path.relative(file.startsWith(`${root}${path.sep}`) ? root : cwd, file).split(path.sep).join('/');
+        // Match exact names or source identities; suffix guesses can select another rule.
+        if (ruleId && ![name, id, file].includes(ruleId))
+            continue;
+        const parsed = parseRuleFrontmatter(readFileSync(file, 'utf8'));
+        if (!parsed.valid)
+            throw new Error(`${file}: ${parsed.diagnostics.map(item => item.message).join('; ')}`);
+        const enforcedBy = parsed.rule.enforcedBy ?? [];
+        const errors = ruleGateReferenceErrors(enforcedBy, registry);
+        if (errors.length)
+            throw new Error(`${file}: ${errors.join('; ')}`);
+        rules.push({ id, name, file, enforcedBy, status: enforcedBy.length ? 'gate-backed' : 'guidance-only' });
+    }
+    return rules;
+}
+export function formatRuleGateCoverage(rules) {
+    if (!rules.length)
+        return 'No rules found.';
+    return rules.map(rule => `${rule.id}: ${rule.status}${rule.enforcedBy.length ? `\n${rule.enforcedBy.map(gate => `  ${gate}`).join('\n')}` : ''}`).join('\n');
+}
+//# sourceMappingURL=gate-coverage.js.map

package/dist/src/rules/gate-references.js

@@ -0,0 +1,16 @@
+export function ruleGateReferenceErrors(references, registry) {
+    const errors = [];
+    for (const reference of references) {
+        const [packId, gateId] = reference.split('#');
+        try {
+            const pack = registry.resolvePack(packId).resolved;
+            if (!pack.spec.gates.some(gate => gate.id === gateId))
+                throw new Error(`unknown gate '${gateId}' in ${packId}`);
+        }
+        catch (error) {
+            errors.push(`enforcedBy '${reference}': ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=gate-references.js.map

package/dist/src/rules/rule-frontmatter.schema.json

@@ -66,7 +66,13 @@
       }
     },
     "enforcedBy": {
-      "description": "Opaque reserved metadata for #2839. Has no activation or runtime enforcement effect."
+      "description": "Gate references as <namespaced-pack-id>#<gate-id>. Lint resolves each reference against the gate registry. Declares coverage without changing activation or executing gates.",
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^(?:(?:aiwg|framework|addon|extension):[^/\\s:#]+/[^/\\s:#]+|project:[^/\\s:#]+)#[^\\s#]+$"
+      }
     }
   },
   "allOf": [

package/dist/src/serve/worker-command-request.js

@@ -6,14 +6,18 @@ export class WorkerRequestArgumentError extends WorkerPolicyError {
     constructor(key) {
         super('OG_CONFIG_REFERENCE', key === 'task'
             ? `Missing required --task. Valid task classes: ${Object.keys(DEFAULT_WORKER_SELECTION.taskClasses).join(', ')}, plus classes configured in defaults.workerSelection.taskClasses.`
-            : `--${key.replace('_', '-')} must be an absolute path; relative paths are not resolved against cwd or --workdir.`);
-        this.pointer = `/request/${key}`;
+            : key === 'wallSeconds' ? '--timeout-ms must be a positive safe integer multiple of 1000 (whole seconds).'
+                : key === 'maxAttempts' || key === 'tokens' ? `--${key === 'tokens' ? 'max-output-tokens' : 'max-attempts'} must be a positive safe integer.`
+                    : key === 'costUsd' ? '--max-usd must be a finite nonnegative number.'
+                        : `--${key.replace('_', '-')} must be an absolute path; relative paths are not resolved against cwd or --workdir.`);
+        this.pointer = `/request/${['maxAttempts', 'tokens', 'costUsd', 'wallSeconds'].includes(key) ? 'ceilings/' : ''}${key}`;
     }
 }
 /** Reject unsupported syntax before discovery or any path reads. */
 export function parseWorkerCommandArgs(args) {
     const names = { role: 'role', task: 'task', group: 'group', brief: 'brief',
-        workdir: 'workdir', 'final-output': 'final_output', transport: 'transport', format: 'format' };
+        workdir: 'workdir', 'final-output': 'final_output', transport: 'transport', format: 'format',
+        'max-attempts': 'maxAttempts', 'timeout-ms': 'wallSeconds', 'max-output-tokens': 'tokens', 'max-usd': 'costUsd' };
     const result = {};
     let json = false;
     let premiumAuthorized = false;
@@ -63,6 +67,19 @@ export function parseWorkerCommandArgs(args) {
         throw new Error('Unsupported transport');
     if (result.format && !['shell', 'json'].includes(result.format))
         throw new Error('Unsupported renderer; use POSIX shell or JSON');
-    return { ...result, ...(premiumAuthorized ? { authority: { premiumAuthorized: true, maxAutoTier: 3 } } : {}) };
+    const ceilings = {};
+    for (const key of ['maxAttempts', 'wallSeconds', 'tokens', 'costUsd']) {
+        if (result[key] === undefined)
+            continue;
+        const value = Number(result[key]);
+        if (!result[key].trim() || !Number.isFinite(value) || value < 0
+            || key !== 'costUsd' && (!Number.isSafeInteger(value) || value === 0)
+            || key === 'wallSeconds' && value % 1000 !== 0)
+            throw new WorkerRequestArgumentError(key);
+        ceilings[key] = key === 'wallSeconds' ? value / 1000 : value;
+        delete result[key];
+    }
+    return { ...result, ...(Object.keys(ceilings).length ? { ceilings } : {}),
+        ...(premiumAuthorized ? { authority: { premiumAuthorized: true, maxAutoTier: 3 } } : {}) };
 }
 //# sourceMappingURL=worker-command-request.js.map

package/dist/src/serve/worker-invocation-preparation.js

@@ -104,7 +104,9 @@ export async function prepareWorkerInvocation(invocation, qualification) {
         // The frozen 'closed' value means empty stdin (immediate EOF). 'brief-json'
         // pipes a conductor-built params document framed from the brief file
         // (worker-stdin-frame.mjs), so brief text never enters any argv.
-        const worker = `env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
+        const deadline = qualification.ceilings?.wallSeconds === undefined ? ''
+            : `timeout --signal=KILL ${quote(`${Math.min(result.health?.hardTimeoutSeconds ?? Infinity, result.limits.wallSeconds)}s`)} `;
+        const worker = `${deadline}env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
         const outputs = `> ${quote(result.stdoutPath)} 2> ${quote(result.stderrPath)}`;
         if (result.stdin === 'brief-json') {
             const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));

package/dist/src/serve/worker-invocation.js

@@ -7,6 +7,7 @@ export { inspectWorkerPath } from './worker-invocation-paths.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { resolveWorkerPlan } from '../models/resolver.js';
 import { workerConfigDigest, validateWorkerHealthConfig } from '../config/aiwg-config.js';
+import { intersectWorkerCeilings } from '../models/worker-ceilings.js';
 import { assertValidWorkerPayload } from '../mission-protocol/codecs.js';
 import { qualificationDigest } from '../models/qualification-digest.mjs';
 import { prepareWorkerInvocation } from './worker-invocation-preparation.js';
@@ -180,19 +181,19 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
                 throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Brief role/task/group/workspace/output differs from request');
             }
         }
+        // Brief and parent authority restrict caller ceilings; neither can overwrite them.
+        const intent = managedIntent ?? brief?.intent;
+        if (intent)
+            snapshot.constraints = { ...snapshot.constraints, ceilings: intersectWorkerCeilings(snapshot.constraints?.ceilings, { ...intent.limits, costUsd: intent.limits.costUsd ?? undefined }) };
         plan = resolveWorkerPlan(snapshot, { role: request.role, taskClass: request.task, group: request.group,
             transport: request.transport, authority: request.authority, now, expectedDigests: expected?.digests,
-            ...(brief ? { dataClass: brief.intent.dataClass, member: brief.intent.pins.member,
-                model: brief.intent.pins.model, effort: brief.intent.pins.effort?.value, ceilings: {
-                    ...brief.intent.limits, costUsd: brief.intent.limits.costUsd ?? undefined
-                } } : {}),
-            ...(managedIntent ? { dataClass: managedIntent.dataClass, member: managedIntent.pins.member,
-                model: managedIntent.pins.model, effort: managedIntent.pins.effort?.value,
-                ceilings: { ...managedIntent.limits, costUsd: managedIntent.limits.costUsd ?? undefined } } : {}),
+            ceilings: request.ceilings,
+            ...(intent ? { dataClass: intent.dataClass, member: intent.pins.member,
+                model: intent.pins.model, effort: intent.pins.effort?.value } : {}),
             context: { estimator: 'utf8-byte-upper-bound-v1', briefTokens: bytes?.length ?? 0,
                 inputTokens: 0, toolOutputAllowance: 1024, reservedOutput: 1024 },
             requiredControls: snapshot.config.parallelism?.health?.requireStepCap ? ['stepCap'] : [],
-        });
+        }, { tokens: 50000, wallSeconds: 900 });
         plan.request = structuredClone(request);
         if (!plan.selected)
             return plan;
@@ -246,8 +247,8 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             if (!await inspectPath(path.dirname(output), 'directory'))
                 outputParentsExist = false;
         }
-        const limits = { tokens: Math.min(50000, plan.ceilings.tokens ?? 50000), costUsd: plan.ceilings.costUsd ?? null,
-            wallSeconds: Math.min(900, plan.ceilings.wallSeconds ?? 900), maxAttempts: plan.ceilings.maxAttempts ?? 3 };
+        const limits = { tokens: plan.ceilings.tokens, costUsd: plan.ceilings.costUsd ?? null,
+            wallSeconds: plan.ceilings.wallSeconds, maxAttempts: plan.ceilings.maxAttempts };
         const observation = snapshot.catalog.discovery.instances[tuple.cli].models.find(row => row.id === tuple.model || row.apiModelId === tuple.model).worker;
         const profile = adapter.invocationProfiles[tuple.profile];
         const expiresAt = new Date(Math.min(Date.parse(now) + 300000, Date.parse(tuple.observedAt) + (plan.policy?.freshness?.blockHours ?? DEFAULT_WORKER_SELECTION.freshness.blockHours) * 3600000, Math.min(Date.parse(tuple.verifiedAt), Date.parse(adapter.qualification.verifiedAt), profile.installationQualification ? Date.parse(profile.installationQualification.verifiedAt) : Infinity)
@@ -290,6 +291,15 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             throw new Error('Installed adapter stdin framer is required');
         if (transport.mcp?.timeoutSeconds !== undefined)
             effectiveHealth = resolveWorkerEffectiveHealth(healthConfig, { ...healthInput, transportSeconds: Math.min(healthInput.transportSeconds ?? Infinity, transport.mcp.timeoutSeconds) });
+        if (request.ceilings?.wallSeconds !== undefined && request.ceilings.wallSeconds > effectiveHealth.hardTimeoutSeconds) {
+            plan.status = 'blocked';
+            plan.selected = null;
+            plan.diagnostics.push({ code: 'OG_POLICY_RELAXATION', pointer: '/request/ceilings/wallSeconds',
+                message: `Requested wallSeconds ceiling ${request.ceilings.wallSeconds} exceeds resolved policy ceiling ${effectiveHealth.hardTimeoutSeconds}.` });
+            return plan;
+        }
+        if (effectiveHealth.hardTimeoutSeconds === limits.wallSeconds)
+            effectiveHealth.origins?.hardTimeoutSeconds.push(...(plan.origins?.['/ceilings/wallSeconds'] ?? []).map(origin => origin.pointer));
         if (workerConfigDigest(driver.qualification) !== qualificationDigest)
             throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Installation profile digest changed during resolution');
         const invocation = { version: 1, mode: managedIntent ? 'managed' : 'direct', transport: tuple.transport, selected,
@@ -306,6 +316,7 @@ export async function resolveWorkerInvocation(snapshot, request, drivers, now =
             controlEvidence: isOperatorQualifiedWorkerAdapter(adapter) ? [adapter.qualification.evidenceRef, ...controls.map(name => profile.controls[name].evidence)] : controls.map(name => profile.controls[name].evidence),
             health: effectiveHealth, };
         const invocationQualification = { ...qualification, now: Date.parse(now),
+            ceilings: request.ceilings,
             policy: plan.policy, permissions: tuple.permissions, role: request.role, modelObservation: observation,
             expectedDigests: { policyDigest, catalogDigest: plan.digests.catalogDigest, profileDigest: plan.digests.profileDigest, briefDigest },
             requiredControls: controls };

package/dist/src/sessions/adapters/deepseek-harness.js

@@ -25,6 +25,7 @@ export class DeepSeekHarnessSessionAdapter {
     limits;
     maxFiles;
     provider = 'deepseek-harness';
+    sourceSchemaMajor = 2;
     adapterVersion = DEEPSEEK_HARNESS_ADAPTER_VERSION;
     disposition = 'implemented';
     supportedOperations = ['discover', 'inspect', 'stream'];