@aiwg/cli 2026.10.10 → 2026.10.12

package/schemas/mission-v1.schema.json

@@ -462,9 +462,120 @@
       ]
     },
     "workerBrief": {
+      "$defs": {
+        "regressionCheck": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "enum": [
+                "command",
+                "path"
+              ]
+            },
+            "target": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "expectedStatus": {
+              "enum": [
+                "passed",
+                "failed",
+                "present",
+                "absent"
+              ]
+            }
+          },
+          "required": [
+            "kind",
+            "target",
+            "expectedStatus"
+          ],
+          "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "kind": {
+                    "const": "command"
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "expectedStatus": {
+                    "enum": [
+                      "passed",
+                      "failed"
+                    ]
+                  }
+                }
+              },
+              "else": {
+                "properties": {
+                  "expectedStatus": {
+                    "enum": [
+                      "present",
+                      "absent"
+                    ]
+                  }
+                }
+              }
+            }
+          ]
+        },
+        "oracleCommand": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "command": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "expectedExitCode": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 255
+            }
+          },
+          "required": [
+            "command",
+            "expectedExitCode"
+          ]
+        }
+      },
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "uncertaintyPolicy": {
+          "description": "Omitted or default follows the conductor policy; stop-and-report pauses uncertain work and reports the uncertainty.",
+          "enum": [
+            "default",
+            "stop-and-report"
+          ]
+        },
+        "mustNotRegress": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerBrief/$defs/regressionCheck"
+          }
+        },
+        "verificationOracle": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerBrief/$defs/oracleCommand"
+          },
+          "minItems": 1
+        },
+        "designReviewRequired": {
+          "type": "boolean"
+        },
+        "designReviewArtifact": {
+          "$ref": "#/$defs/workerArtifact"
+        },
         "version": {
           "const": 1
         },
@@ -1015,9 +1126,173 @@
       ]
     },
     "workerVerification": {
+      "$defs": {
+        "oracleResult": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "command": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "exitCode": {
+              "type": [
+                "integer",
+                "null"
+              ],
+              "minimum": 0,
+              "maximum": 255
+            },
+            "evidence": {
+              "$ref": "#/$defs/workerArtifact"
+            }
+          },
+          "required": [
+            "command",
+            "exitCode",
+            "evidence"
+          ]
+        },
+        "reviewRound": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "round": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 64
+            },
+            "headSha": {
+              "type": "string",
+              "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+            },
+            "reviewerObservationRef": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "artifact": {
+              "$ref": "#/$defs/workerArtifact"
+            }
+          },
+          "required": [
+            "round",
+            "headSha",
+            "reviewerObservationRef",
+            "artifact"
+          ]
+        },
+        "finding": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "id": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "class": {
+              "enum": [
+                "A",
+                "B",
+                "C"
+              ]
+            },
+            "severity": {
+              "enum": [
+                "blocker",
+                "major",
+                "minor",
+                "info"
+              ]
+            },
+            "round": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 64
+            },
+            "status": {
+              "enum": [
+                "open",
+                "resolved",
+                "follow-up",
+                "out-of-scope"
+              ]
+            },
+            "summary": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 1024
+            },
+            "followUp": {
+              "$ref": "#/$defs/workerArtifact"
+            }
+          },
+          "required": [
+            "id",
+            "class",
+            "severity",
+            "round",
+            "status",
+            "summary"
+          ],
+          "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "class": {
+                    "const": "A"
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "status": {
+                    "enum": [
+                      "open",
+                      "resolved"
+                    ]
+                  }
+                }
+              }
+            }
+          ]
+        }
+      },
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "headSha": {
+          "type": "string",
+          "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+        },
+        "reviewRounds": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/reviewRound"
+          }
+        },
+        "findingsLedger": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/finding"
+          }
+        },
+        "roundsToClean": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 64
+        },
+        "oracleResults": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/oracleResult"
+          }
+        },
         "status": {
           "enum": [
             "pending",
@@ -1104,6 +1379,7 @@
                 "pattern": "^sha256:[a-f0-9]{64}$"
               },
               "evidence": {
+                "type": "array",
                 "minItems": 1
               }
             }
@@ -1538,6 +1814,34 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "uncertaintyPolicy": {
+          "description": "Omitted or default follows the conductor policy; stop-and-report pauses uncertain work and reports the uncertainty.",
+          "enum": [
+            "default",
+            "stop-and-report"
+          ]
+        },
+        "mustNotRegress": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerBrief/$defs/regressionCheck"
+          }
+        },
+        "verificationOracle": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerBrief/$defs/oracleCommand"
+          },
+          "minItems": 1
+        },
+        "designReviewRequired": {
+          "type": "boolean"
+        },
+        "designReviewArtifact": {
+          "$ref": "#/$defs/workerArtifact"
+        },
         "version": {
           "const": 1
         },
@@ -1951,6 +2255,36 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "headSha": {
+          "type": "string",
+          "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+        },
+        "reviewRounds": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/reviewRound"
+          }
+        },
+        "findingsLedger": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/finding"
+          }
+        },
+        "roundsToClean": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 64
+        },
+        "oracleResults": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/workerVerification/$defs/oracleResult"
+          }
+        },
         "status": {
           "enum": [
             "pending",
@@ -2046,6 +2380,7 @@
                 "maxLength": 1024
               },
               "findings": {
+                "type": "array",
                 "minItems": 1
               }
             }

package/schemas/models/model-catalog.v1.schema.json

@@ -24,6 +24,23 @@
               "efficiency": { "$ref": "#/$defs/model" }
             }
           },
+          "tiers": {
+            "type": "object", "additionalProperties": false,
+            "required": ["flagship", "premium", "standard", "economy"],
+            "properties": {
+              "flagship": {
+                "allOf": [
+                  { "$ref": "#/$defs/model" },
+                  { "type": "object", "required": ["selection"], "properties": { "selection": { "const": "user-elected" } } }
+                ]
+              },
+              "premium": { "$ref": "#/$defs/model" },
+              "standard": { "$ref": "#/$defs/model" },
+              "economy": { "$ref": "#/$defs/model" }
+            }
+          },
+          "verified_at": { "type": "string", "format": "date" },
+          "evidence": { "type": "string", "minLength": 1 },
           "sourceUrl": { "type": "string", "format": "uri" },
           "verifiedAt": { "type": "string", "format": "date" }
         }
@@ -61,7 +78,8 @@
         "id": { "type": "string", "minLength": 1 },
         "status": { "enum": ["active", "deprecated", "unverified"] },
         "fallback": { "type": "string", "minLength": 1 },
-        "observed": { "type": "boolean" }
+        "observed": { "type": "boolean" },
+        "selection": { "const": "user-elected" }
       }
     },
     "workerObservation": {

package/schemas/models/model-config-compatibility.v1.schema.json

@@ -137,7 +137,7 @@
             }
           }
         },
-        "tier": { "enum": ["economy", "standard", "premium", "max-quality"] },
+        "tier": { "enum": ["economy", "standard", "premium", "flagship", "max-quality"] },
         "provider": {
           "enum": ["claude", "codex", "copilot", "cursor", "factory", "grokbot", "hermes", "muse", "opencode", "openclaw", "openhuman", "warp", "windsurf"]
         }
@@ -149,7 +149,7 @@
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "model-tier": { "enum": ["economy", "standard", "premium", "max-quality"] },
+          "model-tier": { "enum": ["economy", "standard", "premium", "flagship", "max-quality"] },
           "model-override": { "type": "string", "minLength": 1 },
           "rationale": { "type": "string", "minLength": 1 }
         }
@@ -205,6 +205,7 @@
             "economy",
             "standard",
             "premium",
+            "flagship",
             "max-quality"
           ]
         },

package/schemas/models/model-policy.v1.schema.json

@@ -7,7 +7,7 @@
   "required": ["role", "tier"],
   "properties": {
     "role": { "enum": ["efficiency", "coding", "reasoning"] },
-    "tier": { "enum": ["economy", "standard", "premium"] },
+    "tier": { "enum": ["economy", "standard", "premium", "flagship", "max-quality"] },
     "effort": { "enum": ["minimal", "low", "medium", "high", "xhigh"] },
     "override": { "type": "string", "minLength": 1 }
   }

package/tools/agents/providers/provider-paths-staging.mjs

@@ -0,0 +1,35 @@
+/** Stage and restore provider path overrides without writing through getter-only accessors. */
+export function captureProviderPathDescriptors(provider) {
+  return Object.getOwnPropertyDescriptors(provider.paths);
+}
+
+export function setStagedProviderPath(provider, key, value) {
+  try {
+    Object.defineProperty(provider.paths, key, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+    return;
+  } catch {
+    const descriptor = Object.getOwnPropertyDescriptor(provider.paths, key);
+    if (descriptor?.set || descriptor?.writable) provider.paths[key] = value;
+    else throw new Error(`Cannot stage provider path '${key}': accessor has no setter and cannot be redefined`);
+  }
+}
+
+export function restoreProviderPaths(provider, descriptors) {
+  for (const key of Object.keys(provider.paths)) {
+    if (!(key in descriptors)) {
+      try { delete provider.paths[key]; } catch { /* keep operator-owned key */ }
+    }
+  }
+  for (const [key, descriptor] of Object.entries(descriptors)) {
+    try {
+      Object.defineProperty(provider.paths, key, descriptor);
+    } catch {
+      if (descriptor.set || descriptor.writable) provider.paths[key] = descriptor.value;
+    }
+  }
+}

package/tools/agents/providers/rule-binding-targets.mjs

@@ -0,0 +1,146 @@
+/** Discover and bind rule targets from indexed and currently deployed bundle sources. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { importImpl } from '../../_resolve-impl.mjs';
+import { contentHash } from './base.mjs';
+const { RULE_BINDING_TYPES } = await importImpl(import.meta.url, 'rules/activation.mjs');
+
+function isPackageSource(directory, root) {
+  return path.relative(root, directory).split(path.sep).slice(0, 2).join('/') === 'agentic/code';
+}
+
+function bindingBundleRoot(file, root) {
+  // Packaged contracts retain their established project/user override policy.
+  if (isPackageSource(file, root)) return undefined;
+  let directory = path.dirname(file);
+  while (path.dirname(directory) !== directory) {
+    if (['rules', 'behaviors'].includes(path.basename(directory))) return path.dirname(directory);
+    directory = path.dirname(directory);
+  }
+  return undefined;
+}
+
+export async function resolveDeliveryRuleBindings(opts, rules, configs, root, packageRelations) {
+  const bindings = new Map();
+  const targets = [];
+  const targetKeys = new Set();
+  if (rules.some(rule => Object.values(rule.bound_to).some(ids => ids.length))) {
+    const { loadLocalCapabilityEntries, loadLocalOverrideCapabilityEntries, createRuleBindingTargetResolver } = await importImpl(import.meta.url, 'artifacts/query-engine.js');
+    // Framework graph paths are package-relative; project graph paths belong
+    // to the queried project. Normalize before merging so one source cannot
+    // become two apparently ambiguous targets after a source-index rebuild.
+    const indexEntries = new Map();
+    const entryPaths = new Map();
+    const loadEntries = (cwd, overridesOnly = false) => (overridesOnly
+      ? loadLocalOverrideCapabilityEntries(cwd)
+      : loadLocalCapabilityEntries(cwd, undefined, indexEntries)).map(entry => {
+      const anchor = entry.path.startsWith('agentic/code/') ? root : cwd;
+      const key = `${anchor}\0${entry.path}`;
+      if (!entryPaths.has(key)) entryPaths.set(key, path.resolve(anchor, entry.path));
+      const resolvedPath = entryPaths.get(key);
+      // Canonical IDs hash the indexed package-relative path. Keep it through
+      // resolution; the selected target is anchored to root below.
+      return { ...entry, path: entry.path.startsWith('agentic/code/') ? entry.path
+        : opts.mapInputPath ? opts.mapInputPath(resolvedPath) : resolvedPath };
+    });
+    let rebuilt = false;
+    const cacheDir = process.env.AIWG_RULE_BINDING_INDEX_CACHE;
+    const cacheFile = cacheDir && path.join(cacheDir, `${contentHash(opts.logicalInputPath ? opts.logicalInputPath(root) : root)}.json`);
+    const buildSourceEntries = async (refresh = false) => {
+      if (!refresh && cacheFile) {
+        try { return JSON.parse(fs.readFileSync(cacheFile, 'utf8')).map(entry => ({ ...entry, path: path.isAbsolute(entry.path) && opts.mapInputPath ? opts.mapInputPath(entry.path) : entry.path })); }
+        catch (error) {
+          if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error;
+        }
+      }
+      const { collectRuleBindingEntries } = await importImpl(import.meta.url, 'artifacts/index-builder.js');
+      const sourceEntries = await collectRuleBindingEntries(root,
+        root === opts.srcRoot && !fs.existsSync(path.join(root, 'agentic')) ? '.' : 'agentic/code');
+      rebuilt = true;
+      const entries = sourceEntries.map(entry => ({ ...entry, path: entry.path.startsWith('agentic/code/')
+        ? entry.path : path.resolve(root, entry.path) }));
+      if (cacheFile) {
+        fs.mkdirSync(cacheDir, { recursive: true });
+        // Workers may publish the same immutable source snapshot concurrently.
+        const temporary = `${cacheFile}.${process.pid}.tmp`;
+        fs.writeFileSync(temporary, JSON.stringify(entries.map(entry => ({ ...entry, path: opts.logicalInputPath ? opts.logicalInputPath(entry.path) : entry.path }))));
+        fs.renameSync(temporary, cacheFile);
+      }
+      return entries;
+    };
+    const localEntries = opts.bindingEntries || loadEntries(opts.target, Boolean(packageRelations));
+    let entries = [...localEntries];
+    if (!opts.bindingEntries) {
+      // The validated package table is authoritative for its exact source digest.
+      // Keep the canonical resolver for aliases, local overrides and ambiguity.
+      const sourceEntries = packageRelations
+        ? Object.values(packageRelations.index.artifacts).map(entry => ({ ...entry,
+          indexScope: 'packaged', indexGraph: 'framework' }))
+        : loadEntries(root);
+      // A relocated project graph may also be visible while querying the
+      // package root. Keep its project-anchored instance only.
+      const uniqueSources = sourceEntries.filter(entry => !(opts.sharedProjectGraph &&
+        entry.path.startsWith(path.join(root, '.aiwg') + path.sep) &&
+        localEntries.some(local => local.type === entry.type && local.name === entry.name)));
+      entries.push(...uniqueSources);
+      if (!sourceEntries.length) entries.push(...await buildSourceEntries());
+    }
+    // Include first-time invocations before their installed entry is persisted.
+    // Scan only selected bundle roots; use the existing metadata extractor without
+    // creating a full index or treating a stale project index as authoritative.
+    if (!opts.bindingEntries) {
+      const selectedRoots = new Set([opts.srcRoot, ...(opts.additionalSources || []),
+        ...rules.map(rule => bindingBundleRoot(rule.file, root)).filter(Boolean),
+        ...Object.values(configs.project.installed || {}).filter(entry => entry.localPath)
+          .map(entry => path.resolve(opts.target, entry.localPath))]);
+      const { collectRuleBindingEntries } = await importImpl(import.meta.url, 'artifacts/index-builder.js');
+      for (const localRoot of selectedRoots) {
+        if (localRoot === root || isPackageSource(localRoot, root) || !fs.existsSync(localRoot)) continue;
+        const scoped = (await collectRuleBindingEntries(localRoot, '.'))
+          .map(entry => ({ ...entry, path: path.resolve(localRoot, entry.path) }));
+        localEntries.push(...scoped);
+        entries.push(...scoped);
+      }
+    }
+    // A stored index can predate the source tree (edge/dev checkouts). Rebuild once from source
+    // before reporting a binding target as missing.
+    const resolvedTargets = new Map();
+    const identityOptions = { cwd: opts.target, packageRoot: root, logicalPath: opts.logicalInputPath };
+    let resolveBinding = createRuleBindingTargetResolver(entries, identityOptions);
+    const resolveTarget = async (type, id, bundleRoot) => {
+      const key = `${bundleRoot}:${type}:${id}`;
+      if (resolvedTargets.has(key)) return resolvedTargets.get(key);
+      let target;
+      try { target = resolveBinding(type, id, bundleRoot); }
+      catch (error) {
+        if (packageRelations || rebuilt || opts.bindingEntries || !/^Missing /.test(error.message)) throw error;
+        indexEntries.clear();
+        entryPaths.clear();
+        entries = [...localEntries, ...await buildSourceEntries(true)];
+        rebuilt = true;
+        resolveBinding = createRuleBindingTargetResolver(entries, identityOptions);
+        target = resolveBinding(type, id, bundleRoot);
+        // A rebuild replaces the input set for every lookup.
+        resolvedTargets.clear();
+      }
+      resolvedTargets.set(key, target);
+      return target;
+    };
+    for (const rule of rules.filter(rule => rule.tagged)) {
+      for (const [key, type] of Object.entries(RULE_BINDING_TYPES)) {
+        for (const id of rule.bound_to[key]) {
+          const target = await resolveTarget(type, id, bindingBundleRoot(rule.file, root));
+          const source = path.isAbsolute(target.path) ? target.path : path.resolve(target.path.startsWith('agentic/code/') ? root : opts.target, target.path);
+          if (!fs.existsSync(source)) throw new Error(`${rule.file}: binding target content missing: ${source}`);
+          bindings.set(source, [...(bindings.get(source) || []), rule]);
+          const key = `${target.type}:${source}`;
+          if (!targetKeys.has(key)) {
+            targetKeys.add(key);
+            targets.push({ ...target, source });
+          }
+        }
+      }
+    }
+  }
+  return { bindings, targets };
+}