@aiwg/cli 2026.10.4 → 2026.10.6

package/tools/ralph-external/session-launcher.mjs

@@ -34,9 +34,9 @@
 import { StringDecoder } from 'node:string_decoder';
 import { spawn } from 'child_process';
 import { createWriteStream, mkdirSync, existsSync, readFileSync, copyFileSync, constants } from 'fs';
-import { open, mkdir, rename, unlink, lstat, readdir, realpath, link } from 'node:fs/promises';
+import { open, mkdir, rename, unlink, lstat, readdir, realpath, link, access } from 'node:fs/promises';
 import { randomUUID, createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { basename, dirname, join, relative, isAbsolute } from 'path';
 import { EventEmitter } from 'events';
 import { homedir, constants as osConstants } from 'os';
@@ -49,7 +49,7 @@ import { ScopedFailureBreaker, attributeFailureScope } from './lib/consecutive-f
 import { buildSessionEnvironment } from './lib/session-environment.mjs';
 import { launcherRecoveryEvidence, observeLauncherRecoveryOutcome, recordLauncherRecoveryHint } from './lib/launcher-recovery-evidence.mjs';
 export { observeLauncherRecoveryOutcome } from './lib/launcher-recovery-evidence.mjs';
-import { checkWorkerDispatch, detectWorkerIsolation, launchIsolatedWorker, getWorkerIsolationStatus, stopWorkerUnit, readUnitControlGroup } from './lib/worker-isolation.mjs';
+import { workerNeedsNativeNamespaces, probeWorkerNativeSandbox, nativeSandboxFailure, nativeSandboxProbeMessage, NATIVE_SANDBOX_UNAVAILABLE, checkWorkerDispatch, detectWorkerIsolation, launchIsolatedWorker, getWorkerIsolationStatus, stopWorkerUnit, readUnitControlGroup } from './lib/worker-isolation.mjs';
 const { signalChild } = await importImpl(import.meta.url, 'process/signal-child.mjs');
 
 // Resolve the same installation owner as CLI/MCP inputs in source and packaged layouts.
@@ -413,6 +413,80 @@ function subscribeWorkerRecovery(owner, breaker) {
   _workerRecoverySubscriptions.set(owner, () => reporter.owners.delete(owner));
 }
 
+/** Reuse the MC authority and its registered one-shot identity at every spawn boundary. */
+export async function assertManagedWorkerLaunch(options, invocation, inputs, projectRoot = process.cwd()) {
+  if (!options.managedAdmission || invocation.mode !== 'managed'
+    || inputs.snapshot.config.parallelism?.worker_mode !== 'managed') throw new Error('Managed worker admission is required');
+  const { createMcAdmissionScheduler } = await importImpl(import.meta.url, 'cli/handlers/mc.js');
+  const { loadLauncherRegistry } = await importImpl(import.meta.url, 'cli/handlers/ralph-launcher.js');
+  const { workerModelKey } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const scheduler = await createMcAdmissionScheduler(projectRoot, inputs.snapshot.config);
+  const { requestId, generation } = options.managedAdmission;
+  const snapshot = scheduler.snapshot();
+  const record = snapshot.records[requestId];
+  const deadlineAtMs = Math.min(...[record?.accounting?.runKey, record?.accounting?.taskKey]
+    .map(key => snapshot.allowances?.[key]?.deadlineAt).filter(Boolean).map(Date.parse));
+  const registered = loadLauncherRegistry(projectRoot).loops[process.env.RALPH_LOOP_ID];
+  const worker = record?.managed;
+  const reservation = record?.accounting?.reservation;
+  if (!record || record.state !== 'admitted' || record.leaseGeneration !== generation
+    || !record.launchClaimedAt || !record.metadata?.invocationId || Date.parse(record.leaseExpiresAt ?? '') <= Date.now()
+    || deadlineAtMs <= Date.now()
+    || worker?.kind !== 'external' || worker.group !== invocation.selected.group
+    || worker.member !== invocation.selected.member || worker.cli !== invocation.selected.cli
+    || worker.model !== workerModelKey(invocation.selected.inferenceProvider, invocation.selected.model)
+    || reservation?.tokens != null && !(invocation.limits.tokens <= reservation.tokens)
+    || reservation?.costUsd != null && !(invocation.limits.costUsd !== null && invocation.limits.costUsd <= reservation.costUsd)
+    || registered?.managedAdmission?.requestId !== requestId || registered.managedAdmission.generation !== generation
+    || registered.managedWorker?.invocationPath !== options.invocationPath
+    || registered.managedWorker?.runDir !== options.runDir) {
+    throw new Error('Managed worker launch differs from the current claimed admission');
+  }
+  if (record.execution) {
+    const identity = sampleWorkerIdentity(process.pid);
+    if (record.execution.pid !== process.pid || !identity?.bootId || !identity.startTicks
+      || record.execution.startedAt !== `${identity.bootId}:${identity.startTicks}:${identity.uid}`) {
+      throw new Error('Managed worker supervisor identity differs');
+    }
+  }
+  return { ...record, deadlineAtMs };
+}
+
+async function workerDispatchPath(filename) {
+  let candidate = filename;
+  while (dirname(candidate) !== candidate) {
+    try {
+      if (!(await lstat(candidate)).isDirectory()) return filename;
+      await access(candidate, constants.R_OK | constants.X_OK);
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'ENOENT') return filename;
+      candidate = dirname(candidate);
+    }
+  }
+  // Keep an unusable path for fail-closed sampling rather than falling back to /.
+  return filename;
+}
+
+function workerDispatchRefusal(gate) {
+  const bounded = value => String(value ?? '').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 256);
+  const reasons = (gate.failures ?? []).slice(0, 8)
+    .map(failure => `${bounded(failure.signal)}: ${bounded(failure.reason)}`).join('; ').slice(0, 1024);
+  return new Error(`Worker dispatch resource gate refused launch${reasons ? `: ${reasons}` : ''}`);
+}
+
+function workerLaunchRefusal(outcome) {
+  const bounded = value => String(value ?? '').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 256);
+  const reasons = (outcome?.failures ?? []).slice(0, 8)
+    .map(failure => `${bounded(failure.signal)}: ${bounded(failure.reason)}`);
+  for (const detail of [outcome?.diagnostic, outcome?.error]) {
+    if (detail) reasons.push(bounded(detail));
+  }
+  return new Error(reasons.length
+    ? `Worker launch refused: ${reasons.join('; ').slice(0, 1024)}`
+    : 'Worker launch did not return an attached child');
+}
+
 async function launchOneWorker(owner, options) {
   const { inspectWorkerPath: inspect, revalidateWorkerInvocationPlan: validate } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
   const { qualificationDigest } = await importImpl(import.meta.url, 'models/qualification-digest.mjs');
@@ -425,6 +499,11 @@ async function launchOneWorker(owner, options) {
   const clock = () => typeof options.now === 'function' ? options.now() : options.now ?? new Date().toISOString();
   const now = clock();
   const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now);
+  if (invocation.mode === 'managed' || options.managedAdmission) {
+    const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+    options = { ...options, scopedBreaker: null, managedInvocationId: admitted.metadata.invocationId,
+      managedDeadlineAtMs: admitted.deadlineAtMs };
+  }
   if (invocation.transport !== 'shell') throw new Error('One-shot capture requires shell transport; use the qualified MCP descriptor directly');
   if (process.platform !== 'linux') throw new Error('One-shot worker capture requires qualified Linux process identity');
   const runDir = options.runDir;
@@ -475,9 +554,24 @@ async function launchOneWorker(owner, options) {
   // document on the stdin pipe, never brief text in argv (#2911).
   const { workerStdinBytes } = await importImpl(import.meta.url, 'serve/worker-stdin-frame.mjs');
   const stdinBytes = workerStdinBytes(invocation, brief, inputs.drivers[invocation.selected.cli]);
-  let gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-  if (!gate.ok) throw new Error('Worker dispatch resource gate refused launch');
-  const isolation = options.isolation ?? detectWorkerIsolation();
+  let gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+    paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+  if (!gate.ok) throw workerDispatchRefusal(gate);
+  const { WorkerPolicyError, assertWorkerLaunchMode } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const permissions = inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution ?? {};
+  const adapter = inputs.drivers[invocation.selected.cli].qualification.adapter;
+  assertWorkerLaunchMode(adapter, permissions);
+  if (options.isolation?.mode === 'native-sandbox' && invocation.isolation !== 'native-sandbox') {
+    throw new WorkerPolicyError('OG_POLICY_RELAXATION', 'native-sandbox requires the pinned project execution policy');
+  }
+  const isolation = invocation.isolation === 'native-sandbox' ? { mode: 'native-sandbox' }
+    : options.isolation ?? detectWorkerIsolation();
+  if (isolation.mode === 'systemd-unit' && workerNeedsNativeNamespaces(adapter, permissions)) {
+    const probe = await (options.probeNativeSandbox ?? probeWorkerNativeSandbox)({ cwd: invocation.cwd,
+      envNames: invocation.envNames, env: Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
+        .map(name => [name, process.env[name]])) });
+    if (!probe.ok) throw new WorkerPolicyError(NATIVE_SANDBOX_UNAVAILABLE, nativeSandboxProbeMessage(probe));
+  }
   if (isolation.mode === 'degraded' && !options.allowDegraded) {
     throw new Error('Worker isolation unavailable; explicitly select --allow-degraded-worker or use manual observation');
   }
@@ -692,7 +786,7 @@ async function launchOneWorker(owner, options) {
       prompt: { path: invocation.briefPath, digest: invocation.briefDigest }, cwd: invocation.cwd,
       worktree: { path: invocation.cwd, baseRevision: null }, paths, captures, outputFraming: profile.health?.outputFraming ?? 'opaque',
       health: invocation.health ?? null, transport: invocation.transport,
-      isolation: { mode: isolation.mode, memoryMaxGb: options.memoryMaxGb ?? 4 },
+      isolation: { mode: isolation.mode, memoryMaxGb: isolation.mode === 'native-sandbox' ? null : options.memoryMaxGb ?? 4 },
       limits: invocation.limits, maxOutputBytes: Math.min(invocation.maxOutputBytes ?? 10485760, 10485760) });
     await publish('process.json', { invocationId, origin: 'launcher', supervisor, worker: null,
       launchTime, monotonicStart, ownership: 'unknown', isolation: isolation.mode });
@@ -704,8 +798,9 @@ async function launchOneWorker(owner, options) {
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
     await validate(saved, inputs.snapshot, inputs.drivers, clock());
-    gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-    if (!gate.ok) throw new Error('Worker dispatch resource gate refused launch');
+    gate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+      paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+    if (!gate.ok) throw workerDispatchRefusal(gate);
     if (bytesDigest(await boundedPrivateRead(invocation.briefPath, 262144, inspect)) !== invocation.briefDigest) throw new Error('Worker prompt changed before spawn');
     const environment = Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
       .map(name => [name, process.env[name]]));
@@ -766,12 +861,12 @@ async function launchOneWorker(owner, options) {
     // would in production).
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
-      memoryMaxGb: options.memoryMaxGb ?? 4, gate, config: inputs.snapshot.config, isolation,
+      memoryMaxGb: options.memoryMaxGb ?? 4, gate, config: inputs.snapshot.config, isolation, workerGroup: invocation.selected.group,
       allowDegraded: !!options.allowDegraded, attached: true, ownedGroup: true,
       env: environment, envNames: invocation.envNames, stdin: invocation.stdin, runDir,
       ...(onDispatchCommit ? { onDispatchCommit } : {}) });
     outcome = typeof launchResult?.then === 'function' ? await launchResult : launchResult;
-    if (!outcome.child) throw new Error('Worker launch did not return an attached child');
+    if (!outcome?.child) throw workerLaunchRefusal(outcome);
     // #2915 review 4 (finding 3): when THIS attempt is the admitted canary
     // for one or more covering scopes, execution itself must be clipped to
     // the canary's own deadline (min(task deadline, admission+300s)) — not
@@ -831,7 +926,7 @@ async function launchOneWorker(owner, options) {
       // canary deadline.
       await settleLedger({ kind: 'uncertain', confirmedStop: true });
       await publish('exit.json', { invocationId, exitCode: null, signal: null,
-        endedAt: new Date().toISOString(), termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
+        endedAt: new Date().toISOString(), isolation: isolation.mode, termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
     } else if (admission.gated) {
       // #2915 review 5 (finding 2a, "leaked capacity"), hardened by #2915
       // review 6 (finding 4, "capture-setup exception after spawn"): a
@@ -900,6 +995,38 @@ async function launchOneWorker(owner, options) {
   }
 }
 
+// #3489: process exit/close notification can be observed before the final
+// pipe bytes are delivered as stream 'data' events (the same class as #3488,
+// which waited for IPC disconnect as well as exit). The child 'data'
+// handlers are the ONLY path that feeds the health observer and accumulates
+// the `output` buffer adapter extraction consumes, so settling health on
+// the process-level event alone classifies a completed exit-0 run as
+// `failed` (missing terminal event, FINAL_INVALID) whenever it wins the
+// race under load. Drain any already-buffered stdout/stderr bytes — bounded
+// by the termination grace — before destroying the source streams and
+// snapshotting output/observer state. Streams with no buffered bytes
+// resolve immediately, so never-ending stdio (timer-faked stand-ins, held
+// pipes) never delays settle; the bound only covers genuinely in-flight
+// data. The timer stays referenced so a bounded drain always completes,
+// mirroring the already-referenced exit-grace `later()` timer.
+function drainChildStdio(child, timeoutMs) {
+  const pending = [];
+  for (const stream of [child?.stdout, child?.stderr]) {
+    if (!stream || typeof stream.once !== 'function' || stream.readableEnded || stream.destroyed) continue;
+    if (!(stream.readableLength > 0)) continue;
+    try { stream.resume?.(); } catch { continue; }
+    pending.push(new Promise(resolve => {
+      const done = () => { clearTimeout(timer); resolve(); };
+      const timer = setTimeout(done, Math.max(0, timeoutMs ?? 0));
+      stream.once('end', done);
+      stream.once('close', done);
+      stream.once('error', done);
+    }));
+  }
+  if (!pending.length) return Promise.resolve();
+  return Promise.all(pending);
+}
+
 async function captureOneWorker(owner, ctx) {
   const { child, outcome, invocation, invocationId, supervisor, launchTime, monotonicStart, publish, paths, handles, options,
     canaryDeadlineMs = null, canaryNowMs = () => Date.now(), recoveryGated = false } = ctx;
@@ -968,7 +1095,16 @@ async function captureOneWorker(owner, ctx) {
   };
   const graceMs = (invocation.health?.terminateGraceSeconds ?? 5) * 1000;
   const signal = value => {
-    if (settled || !signalOwnedWorker(identity, value, { supervisor })) return false;
+    if (settled) return false;
+    let delivered = signalOwnedWorker(identity, value, { supervisor });
+    // Startup can consume the whole deadline before the transport spawns
+    // its worker or publishes an owned group. We still own this attached
+    // ChildProcess: stop it before it can launch work after finalization.
+    // This proves no descendant termination; degraded mode stays uncertain.
+    if (!delivered && !identity && hasTransport && outcome.mode !== 'systemd-unit' && !sawExit) {
+      try { delivered = signalChild(child, value); } catch { /* already exited or no child handle */ }
+    }
+    if (!delivered) return false;
     deliveredSignal = value;
     return true;
   };
@@ -1007,8 +1143,19 @@ async function captureOneWorker(owner, ctx) {
     }
     signal('SIGTERM');
     const remainingGrace = Math.min(graceMs, hardRemaining());
-    if (remainingGrace === 0) { signal('SIGKILL'); later(() => finish(), 100); }
-    else later(() => { signal('SIGKILL'); later(() => finish(), 100); }, remainingGrace);
+    const escalate = () => {
+      signal('SIGKILL');
+      // Startup may have no worker identity yet. Wait for our transport's
+      // exit status before settling: TERM can have killed it even if KILL
+      // was also delivered before Node observes exit (#3532). Use the unused
+      // grace plus the existing 100ms settle tick, keeping the total
+      // termination budget at graceMs + 100 on the tracked launcher timers.
+      const exitWaitMs = !identity && hasTransport && outcome.mode !== 'systemd-unit'
+        ? graceMs - remainingGrace + 100 : 100;
+      later(() => finish(), exitWaitMs);
+    };
+    if (remainingGrace === 0) escalate();
+    else later(escalate, remainingGrace);
   };
   owner.currentProcess = child;
   owner.workerStop = stop;
@@ -1023,9 +1170,15 @@ async function captureOneWorker(owner, ctx) {
     owner.emit('stdout', chunk);
   });
   let stderrBytes = 0;
+  let sandboxStderrTail = '';
   let recoveryReason = null;
   child.stderr.on('data', chunk => {
     observer.feed(chunk, { kind: 'stderr', id: 'stderr', generation: 0, offset: stderrOffset }); stderrOffset += chunk.length;
+    if (workerNeedsNativeNamespaces(driver.qualification.adapter, ctx.inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution)) {
+      const observedStderr = sandboxStderrTail + chunk.toString('utf8');
+      if (nativeSandboxFailure(observedStderr)) errorCode = NATIVE_SANDBOX_UNAVAILABLE;
+      sandboxStderrTail = observedStderr.slice(-1024);
+    }
     const hint = classifyWorkerHealthFailure(chunk.toString('utf8'), { source: { kind: 'stderr' } })?.reasonCode;
     if (['RATE_LIMIT', 'NETWORK'].includes(hint)) recoveryReason = hint;
     const remaining = Math.max(0, 10485760 - stderrBytes);
@@ -1055,6 +1208,10 @@ async function captureOneWorker(owner, ctx) {
     timers.clear();
     process.off('SIGTERM', onSignal); process.off('SIGINT', onSignal);
     owner.currentProcess = null; owner.workerStop = null;
+    // #3489: drain in-flight stdio before destroying the source streams —
+    // destroying first discards bytes never delivered as 'data', settling
+    // health on a partial stream (exit observed before drain).
+    await drainChildStdio(child, graceMs);
     child.stdout.destroy(); child.stderr.destroy(); child.stdin?.destroy(); child.unref();
     for (const stream of streams) await new Promise(resolve => { if (stream.destroyed) resolve(); else stream.end(resolve); });
     const native = outcome.mode === 'systemd-unit' ? readNative() : null;
@@ -1415,12 +1572,15 @@ async function captureOneWorker(owner, ctx) {
 
 // ===========================================================================
 // BASED ON a4085b86a (#2915 round 8, D6).
-// Exception: finish() snapshots timeout classification before cleanup and
-// respects the winning stop cause, matching captureOneWorker's race fix.
+// Shared lifecycle fixes: finish() snapshots timeout classification before
+// cleanup and respects the winning stop cause; stop() can signal the owned
+// transport before worker identity is available, and then uses the unused
+// termination grace to observe its exit before falling back to the last
+// delivered signal (#3532).
 // The test/fixtures frozen reference remains unchanged.
 //
 // `launchOneWorkerBaseline` and `captureOneWorkerBaseline` reproduce
-// `launchOneWorker`/`captureOneWorker`, apart from the timeout race fix above,
+// `launchOneWorker`/`captureOneWorker`, apart from the lifecycle fixes above,
 // as they existed at base commit `a4085b86a` (`git show
 // a4085b86a:tools/ralph-external/session-launcher.mjs`) — before any
 // #2915 direct-recovery code existed in this file. `launchOneWorker`
@@ -1472,7 +1632,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
   if (runStat.uid !== process.getuid()) throw new Error('Worker run directory must be conductor-owned');
   await withWorkerPath(runDir, async target => { const handle = await open(target, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
     try { await handle.chmod(0o700); } finally { await handle.close(); } });
-  const invocationId = randomUUID();
+  const invocationId = options.managedAdmission ? options.managedInvocationId : randomUUID();
   const reservation = await withWorkerPath(join(runDir, '.launch-owner'), target => open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600));
   try { await reservation.writeFile(invocationId); await reservation.sync(); } finally { await reservation.close(); }
   const supervisor = sampleWorkerIdentity(process.pid);
@@ -1492,11 +1652,12 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
   const handles = [];
   let outcome;
   let artifacts;
+  let managedSpawnAttempted = false;
   try {
     artifacts = await materializeWorkerArtifacts(invocation, runDir);
     const displayArgv = artifacts.argv.map((token, i) => i === 0 ? token : `<argument:${bytesDigest(token)}>`);
     await publish('invocation.json', { version: 1, origin: 'launcher', invocationId, attemptId: invocationId,
-      previousAttemptId: verifiedPreviousAttemptId ?? null, requestId: invocationId, taskDigest: qualificationDigest(saved.request), role: saved.request.role,
+      previousAttemptId: verifiedPreviousAttemptId ?? null, requestId: options.managedAdmission?.requestId ?? invocationId, taskDigest: qualificationDigest(saved.request), role: saved.request.role,
       selected: invocation.selected, planDigest: qualificationDigest(saved), invocationDigest: qualificationDigest(invocation),
       policyDigest: invocation.policyDigest, catalogDigest: invocation.catalogDigest, profileDigest: invocation.profileDigest,
       expiresAt: invocation.expiresAt, argv: displayArgv, commandDisplay: displayArgv.map(token => JSON.stringify(token)).join(' '),
@@ -1509,7 +1670,7 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
       prompt: { path: invocation.briefPath, digest: invocation.briefDigest }, cwd: invocation.cwd,
       worktree: { path: invocation.cwd, baseRevision: null }, paths, captures, outputFraming: profile.health?.outputFraming ?? 'opaque',
       health: invocation.health ?? null, transport: invocation.transport,
-      isolation: { mode: isolation.mode, memoryMaxGb: options.memoryMaxGb ?? 4 },
+      isolation: { mode: isolation.mode, memoryMaxGb: isolation.mode === 'native-sandbox' ? null : options.memoryMaxGb ?? 4 },
       limits: invocation.limits, maxOutputBytes: Math.min(invocation.maxOutputBytes ?? 10485760, 10485760) });
     await publish('process.json', { invocationId, origin: 'launcher', supervisor, worker: null,
       launchTime, monotonicStart, ownership: 'unknown', isolation: isolation.mode });
@@ -1521,8 +1682,9 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     // Recheck policy, prompt, installation and exact bindings after file preparation.
     inputs = await loadInputs();
     await validate(saved, inputs.snapshot, inputs.drivers, clock());
-    localGate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config });
-    if (!localGate.ok) throw new Error('Worker dispatch resource gate refused launch');
+    localGate = (options.checkDispatch ?? checkWorkerDispatch)({ config: inputs.snapshot.config,
+      paths: await Promise.all([invocation.cwd, runDir].map(workerDispatchPath)) });
+    if (!localGate.ok) throw workerDispatchRefusal(localGate);
     if (bytesDigest(await boundedPrivateRead(invocation.briefPath, 262144, inspect)) !== invocation.briefDigest) throw new Error('Worker prompt changed before spawn');
     const environment = Object.fromEntries(invocation.envNames.filter(name => process.env[name] !== undefined)
       .map(name => [name, process.env[name]]));
@@ -1539,16 +1701,24 @@ async function launchOneWorkerBaseline(owner, options, ctx) {
     const launchResult = (options.launchIsolated ?? launchIsolatedWorker)({ name: invocationId,
       command: artifacts.argv[0], args: artifacts.argv.slice(1), cwd: invocation.cwd,
       memoryMaxGb: options.memoryMaxGb ?? 4, gate: localGate, config: inputs.snapshot.config, isolation,
+      workerGroup: invocation.selected.group,
       allowDegraded: !!options.allowDegraded, attached: true, ownedGroup: true,
+      ...(options.managedAdmission ? { onDispatchCommit: async () => {
+        const admitted = await assertManagedWorkerLaunch(options, invocation, inputs);
+        options.managedDeadlineAtMs = Math.min(options.managedDeadlineAtMs, admitted.deadlineAtMs);
+      } } : {}),
+      ...(options.managedAdmission ? { onSpawnAttempt: () => { managedSpawnAttempted = true; } } : {}),
       env: environment, envNames: invocation.envNames, stdin: invocation.stdin, runDir });
     outcome = typeof launchResult?.then === 'function' ? await launchResult : launchResult;
-    if (!outcome.child) throw new Error('Worker launch did not return an attached child');
+    if (!outcome?.child) throw workerLaunchRefusal(outcome);
     return await captureOneWorkerBaseline(owner, { child: outcome.child, outcome, invocation, invocationId, supervisor,
       launchTime, monotonicStart, publish, publishFailures, paths, handles, inspect, inputs, profile, baselineContent, options,
       brief: ctx.brief, stdinBytes: ctx.stdinBytes, runDir });
   } catch (error) {
     if (!outcome?.child) await publish('exit.json', { invocationId, exitCode: null, signal: null,
-      endedAt: new Date().toISOString(), termination: 'confirmed', descendants: 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
+      ...(options.managedAdmission ? { managedAdmission: options.managedAdmission } : {}),
+      endedAt: new Date().toISOString(), isolation: isolation.mode, termination: managedSpawnAttempted ? 'uncertain' : 'confirmed',
+      descendants: managedSpawnAttempted ? 'unknown' : 'not-started', errorCode: error.code ?? 'LAUNCH_REFUSED' });
     throw error;
   } finally {
     try { await artifacts?.cleanup(); } finally {
@@ -1588,9 +1758,13 @@ async function captureOneWorkerBaseline(owner, ctx) {
   let sawClose = false;
   const driver = ctx.inputs.drivers[invocation.selected.cli];
   const observationOptions = { provider: driver.qualification.adapter.provider, profile: ctx.profile,
-    effectiveHealth: invocation.health, invocationId, startedAt: Number(BigInt(monotonicStart)) / 1e6,
+    effectiveHealth: options.managedAdmission ? { ...invocation.health,
+      hardTimeoutSeconds: Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds,
+        (options.managedDeadlineAtMs - Date.parse(launchTime)) / 1000) } : invocation.health,
+    invocationId, startedAt: Number(BigInt(monotonicStart)) / 1e6,
     launchTime, contentDigest: ctx.baselineContent, sessionId: options.healthSessionLog?.sessionId ?? null,
-    runId: options.healthSessionLog?.runId ?? null, maxOutputBytes: invocation.maxOutputBytes };
+    runId: options.healthSessionLog?.runId ?? null, maxOutputBytes: invocation.maxOutputBytes,
+    ...(options.managedAdmission ? { observerGeneration: options.managedAdmission.generation, requestId: options.managedAdmission.requestId } : {}) };
   const observer = driver.createHealthObserver?.(observationOptions) ?? createWorkerHealthObserver(observationOptions);
   const tickRate = qualifyWorkerCpuTickRate();
   let previousCpu = null;
@@ -1611,7 +1785,16 @@ async function captureOneWorkerBaseline(owner, ctx) {
   };
   const graceMs = (invocation.health?.terminateGraceSeconds ?? 5) * 1000;
   const signal = value => {
-    if (settled || !signalOwnedWorker(identity, value, { supervisor })) return false;
+    if (settled) return false;
+    let delivered = signalOwnedWorker(identity, value, { supervisor });
+    // Startup can consume the whole deadline before the transport spawns
+    // its worker or publishes an owned group. We still own this attached
+    // ChildProcess: stop it before it can launch work after finalization.
+    // This proves no descendant termination; degraded mode stays uncertain.
+    if (!delivered && !identity && hasTransport && outcome.mode !== 'systemd-unit' && !sawExit) {
+      try { delivered = signalChild(child, value); } catch { /* already exited or no child handle */ }
+    }
+    if (!delivered) return false;
     deliveredSignal = value;
     return true;
   };
@@ -1640,8 +1823,19 @@ async function captureOneWorkerBaseline(owner, ctx) {
     }
     signal('SIGTERM');
     const remainingGrace = Math.min(graceMs, hardRemaining());
-    if (remainingGrace === 0) { signal('SIGKILL'); later(() => finish(), 100); }
-    else later(() => { signal('SIGKILL'); later(() => finish(), 100); }, remainingGrace);
+    const escalate = () => {
+      signal('SIGKILL');
+      // Startup may have no worker identity yet. Wait for our transport's
+      // exit status before settling: TERM can have killed it even if KILL
+      // was also delivered before Node observes exit (#3532). Use the unused
+      // grace plus the existing 100ms settle tick, keeping the total
+      // termination budget at graceMs + 100 on the tracked launcher timers.
+      const exitWaitMs = !identity && hasTransport && outcome.mode !== 'systemd-unit'
+        ? graceMs - remainingGrace + 100 : 100;
+      later(() => finish(), exitWaitMs);
+    };
+    if (remainingGrace === 0) escalate();
+    else later(escalate, remainingGrace);
   };
   owner.currentProcess = child;
   owner.workerStop = stop;
@@ -1656,8 +1850,14 @@ async function captureOneWorkerBaseline(owner, ctx) {
     owner.emit('stdout', chunk);
   });
   let stderrBytes = 0;
+  let sandboxStderrTail = '';
   child.stderr.on('data', chunk => {
     observer.feed(chunk, { kind: 'stderr', id: 'stderr', generation: 0, offset: stderrOffset }); stderrOffset += chunk.length;
+    if (workerNeedsNativeNamespaces(driver.qualification.adapter, ctx.inputs.snapshot.config.parallelism?.groups?.[invocation.selected.group]?.execution)) {
+      const observedStderr = sandboxStderrTail + chunk.toString('utf8');
+      if (nativeSandboxFailure(observedStderr)) errorCode = NATIVE_SANDBOX_UNAVAILABLE;
+      sandboxStderrTail = observedStderr.slice(-1024);
+    }
     const remaining = Math.max(0, 10485760 - stderrBytes);
     streams[1].write(chunk.subarray(0, remaining)); streams[3].write(chunk.subarray(0, remaining)); stderrBytes += chunk.length;
     if (stderrBytes > 10485760) { errorCode = 'OUTPUT_LIMIT'; stop(); }
@@ -1685,6 +1885,11 @@ async function captureOneWorkerBaseline(owner, ctx) {
     timers.clear();
     process.off('SIGTERM', onSignal); process.off('SIGINT', onSignal);
     owner.currentProcess = null; owner.workerStop = null;
+    // #3489: drain in-flight stdio before destroying the source streams —
+    // destroying first discards bytes never delivered as 'data', settling
+    // health on a partial stream (exit observed before drain). Ordering-only;
+    // recovery semantics in this frozen baseline are unchanged.
+    await drainChildStdio(child, graceMs);
     child.stdout.destroy(); child.stderr.destroy(); child.stdin?.destroy(); child.unref();
     for (const stream of streams) await new Promise(resolve => { if (stream.destroyed) resolve(); else stream.end(resolve); });
     const native = outcome.mode === 'systemd-unit' ? readNative() : null;
@@ -1707,6 +1912,7 @@ async function captureOneWorkerBaseline(owner, ctx) {
     const exitCode = resultSignal ? null
       : outcome.mode === 'systemd-unit' && native?.execMainCode === 1 ? native.execMainStatus : waitCode;
     const result = { invocationId, exitCode, signal: resultSignal,
+      ...(options.managedAdmission ? { managedAdmission: options.managedAdmission } : {}),
       endedAt: new Date().toISOString(), termination: confirmed ? 'confirmed' : 'uncertain',
       descendants: confirmed ? 'stopped' : 'unknown', timedOut: resultTimedOut,
       cancelled: stopReason === 'CANCELLED', stopReason, errorCode: errorCode ?? null, capturedBytes: Math.min(total, output.length),
@@ -1772,8 +1978,11 @@ async function captureOneWorkerBaseline(owner, ctx) {
     sawExit = true; waitCode = code; waitSignal = sig; later(() => finish(), graceMs);
   });
   child.once('close', () => { sawClose = true; finish(); });
-  const hardRemaining = () => Math.max(0, Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds,
-    invocation.limits.wallSeconds) * 1000 - (Number(process.hrtime.bigint() - BigInt(monotonicStart)) / 1e6));
+  const hardRemaining = () => Math.max(0, Math.min(
+    Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds, invocation.limits.wallSeconds,
+      options.managedAdmission ? (options.managedDeadlineAtMs - Date.parse(launchTime)) / 1000 : Infinity) * 1000
+      - (Number(process.hrtime.bigint() - BigInt(monotonicStart)) / 1e6),
+    options.managedAdmission ? options.managedDeadlineAtMs - Date.now() : Infinity));
   later(() => {
     observer.check();
     reportHealth(); stop('HARD_DEADLINE');
@@ -5055,3 +5264,42 @@ export function planDirectWorkerLaunch({
 }
 
 export default SessionLauncher;
+
+/** The packaged session owner accepts only the parent-bound managed one-shot contract. */
+export function parseManagedWorkerLaunchArgs(args) {
+  const result = {};
+  const seen = new Set();
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index];
+    if (seen.has(flag)) throw new Error(`Duplicate managed worker option: ${flag}`);
+    seen.add(flag);
+    if (flag === '--launch-worker') continue;
+    const key = { '--invocation': 'invocationPath', '--run-dir': 'runDir',
+      '--managed-request': 'requestId', '--managed-generation': 'generation' }[flag];
+    if (!key) throw new Error(`Unsupported managed worker option: ${flag}`);
+    const value = args[++index];
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires a value`);
+    result[key] = value;
+  }
+  if (!seen.has('--launch-worker') || !result.invocationPath || !result.runDir || !result.requestId || !result.generation) {
+    throw new Error('Managed worker launch requires invocation, run directory and fenced admission');
+  }
+  const generation = Number(result.generation);
+  if (!Number.isSafeInteger(generation) || generation < 1) throw new Error('Invalid managed admission generation');
+  return { invocationPath: result.invocationPath, runDir: result.runDir,
+    managedAdmission: { requestId: result.requestId, generation } };
+}
+
+async function runManagedWorkerEntry() {
+  const result = await new SessionLauncher().launchWorker(parseManagedWorkerLaunchArgs(process.argv.slice(2)));
+  console.log(JSON.stringify(result));
+  process.exitCode = result.termination !== 'confirmed' ? 2
+    : result.errorCode || result.timedOut || result.exitCode !== 0 ? 1 : 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runManagedWorkerEntry().catch(error => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}

package/tools/skills/deploy-skills-codex.mjs

@@ -36,10 +36,10 @@ const _require = createRequire(import.meta.url);
 let fs;
 try { const gfs = _require('graceful-fs'); gfs.gracefulify(realFs); fs = realFs; } catch { fs = realFs; }
 import path from 'path';
+import { fileURLToPath } from 'node:url';
 import os from 'os';
 import { contentHash, writeSidecarManifest, getFrameworksForMode, normalizeDeploymentMode, skillMatchesProvider, isKernelSkill } from '../agents/providers/base.mjs';
 
-const CODEX_SKILLS_DIR = path.join(os.homedir(), '.codex', 'skills');
 const MAX_NAME_LENGTH = 100;
 const MAX_DESCRIPTION_LENGTH = 500;
 const LEGACY_RENAMED_SKILLS = new Set(['aiwg-mcp']);
@@ -104,11 +104,10 @@ export function planCodexListingBudget(planned, kernelDir, cap) {
   return { demoted, before, after: projected, cap };
 }
 
-function parseArgs() {
-  const args = process.argv.slice(2);
+function parseArgs(args, homeDir) {
   const cfg = {
     source: null,
-    target: CODEX_SKILLS_DIR,
+    target: path.join(homeDir, '.codex', 'skills'),
     mode: 'all',
     dryRun: false,
     force: false,
@@ -483,8 +482,8 @@ function isFullAiwgSourceRoot(srcRoot) {
     fs.existsSync(path.join(srcRoot, 'agentic', 'code', 'extensions'));
 }
 
-(async function main() {
-  const cfg = parseArgs();
+export async function main(args = process.argv.slice(2), internal = {}) {
+  const cfg = parseArgs(args, internal.homeDir || os.homedir());
   const { source, target, mode, dryRun, force } = cfg;
 
   // Resolve source directory
@@ -699,4 +698,9 @@ function isFullAiwgSourceRoot(srcRoot) {
   if (!dryRun && totalDeployed > 0) {
     console.log(`\nRestart Codex to load new skills.`);
   }
-})();
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { await main(); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/vscode-extension/schemas/aiwg.config.v1.json

@@ -21,7 +21,12 @@
               "type": "object", "additionalProperties": false,
               "properties": {
                 "llm_per_mtok": { "type": "number", "minimum": 0, "maximum": 1000000, "default": 15, "description": "Planning USD per million frontier tokens, blended input/output rate." },
-                "jev_per_mtok": { "type": "number", "minimum": 0, "maximum": 1000000, "default": 0.2, "description": "Planning USD per million Jev tokens, blended input/output rate." }
+                "jev_per_mtok": { "type": "number", "minimum": 0, "maximum": 1000000, "default": 0.2, "description": "Planning USD per million Jev tokens. Complete split rates with known usage take precedence." },
+                "jev_input_per_mtok": { "type": "number", "minimum": 0, "maximum": 1000000 },
+                "jev_output_per_mtok": { "type": "number", "minimum": 0, "maximum": 1000000 },
+                "source": { "type": "string", "enum": ["typesafe-docs", "manual", "typesafe-snapshot"] },
+                "checked_at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$", "description": "ISO calendar date YYYY-MM-DD; calendar validity checked by the loader." },
+                "jev_model": { "type": "string", "pattern": "^jev-\\d+\\.\\d+\\.\\d+$" }
               }
             },
             "savings": {
@@ -1497,6 +1502,11 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "launchMode": {
+          "enum": ["systemd-unit", "native-sandbox"],
+          "default": "systemd-unit",
+          "description": "Policy-selected worker launch boundary. native-sandbox requires a verified enforcing CLI sandbox and has no cgroup resource limit."
+        },
         "isolation": {
           "enum": [
             "worktree",