@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/models/provider-policy.js

@@ -9,6 +9,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { z } from 'zod';
+import { integer, dateTime, url, number } from '../schema/zod-validation.mjs';
 import { createRequire } from 'node:module';
 import { compileWorkerVersionPattern, workerVersionRangeMismatch } from './worker-installation.mjs';
 import { normalizeProviderDefinitionId } from '../providers/provider-definitions.js';
@@ -63,7 +64,7 @@ export const WorkerAdapterSchema = z.custom().superRefine((value, context) => {
             message: `Invalid worker adapter: ${error instanceof Error ? error.message : String(error)}` });
     }
 });
-const CapabilityEntrySchema = z.object({
+const CapabilityEntrySchema = z.strictObject({
     sessionEnvAllowlist: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)).optional(),
     agent: OutcomeSchema,
     skill: OutcomeSchema,
@@ -75,31 +76,31 @@ const CapabilityEntrySchema = z.object({
     configTarget: z.string().min(1),
     artifactFormat: z.string().min(1),
     verification: z.string().min(1),
-    sourceUrl: z.string().url(),
+    sourceUrl: url(),
     verifiedAt: z.string().date(),
     workerAdapter: WorkerAdapterSchema.optional(),
     // Descriptive health coverage is not an installed executable registration.
     workerHealthAdapter: WorkerAdapterSchema.optional(),
-    workerHealthCoverage: z.object({
+    workerHealthCoverage: z.strictObject({
         scope: z.literal('out'), coverage: z.literal('unobserved'), handshake: z.literal('unobserved'),
         evidenceGrades: z.array(z.enum(['H', 'R', 'D'])).max(3),
         qualificationOwner: z.string().regex(/^B-OG-[0-9]{2}$/),
         provenance: z.array(z.string().min(1).max(4096)).min(1).max(16), reason: z.string().min(1).max(4096),
-    }).strict().optional(),
-}).strict();
-const CapabilityRegistrySchema = z.object({
+    }).optional(),
+});
+const CapabilityRegistrySchema = z.strictObject({
     $schema: z.enum([
         '../../../schemas/models/provider-model-capabilities.v1.schema.json',
         'https://aiwg.io/schemas/models/provider-model-capabilities.v1.schema.json',
     ]).optional(),
     version: z.literal('1.0.0'),
     verifiedAt: z.string().date(),
-    providers: z.record(ProviderSchema, CapabilityEntrySchema),
+    providers: z.partialRecord(ProviderSchema, CapabilityEntrySchema),
     workerAdapters: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerAdapterSchema)
         .refine(value => Object.keys(value).length <= 128, 'At most 128 worker adapters').optional(),
     workerHealthAdapters: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerAdapterSchema)
         .refine(value => Object.keys(value).length <= 128, 'At most 128 worker health descriptors').optional(),
-}).strict();
+});
 const CatalogModelSchema = z.object({
     id: z.string().min(1),
     status: z.enum(['active', 'deprecated', 'unverified']),
@@ -112,7 +113,7 @@ const CatalogProviderSchema = z.object({
         coding: CatalogModelSchema,
         efficiency: CatalogModelSchema,
     }),
-    sourceUrl: z.string().url(),
+    sourceUrl: url(),
     verifiedAt: z.string().date(),
 });
 let catalogValidators;
@@ -134,10 +135,10 @@ export function validateWorkerModelObservation(input) {
     return validate(input) ? [] : (validate.errors ?? []).map(error => `${error.instancePath}: ${error.message}`);
 }
 const WorkerObservationSchema = z.custom(input => validateWorkerModelObservation(input).length === 0);
-const DiscoveredWorkerModelSchema = z.object({
+const DiscoveredWorkerModelSchema = z.looseObject({
     id: z.string().min(1), apiModelId: z.string().optional(), llmProvider: z.string().optional(),
     hidden: z.boolean().optional(), reasoningEfforts: z.array(z.string()).optional(), worker: WorkerObservationSchema.optional(),
-}).passthrough().superRefine((model, context) => {
+}).superRefine((model, context) => {
     if (!model.worker)
         return;
     if (model.hidden !== undefined && model.worker.visibility !== (model.hidden ? 'hidden' : 'listed'))
@@ -147,17 +148,17 @@ const DiscoveredWorkerModelSchema = z.object({
     if (efforts.length !== observed.length || new Set(observed).size !== observed.length || efforts.some(e => !observed.includes(e)))
         context.addIssue({ code: 'custom', path: ['worker', 'efforts'], message: 'Conflicting effort evidence' });
 });
-const ProviderDiscoverySchema = z.object({
-    provider: z.string(), source: z.enum(['native', 'cache', 'remote', 'static']), observedAt: z.string().datetime({ offset: true }),
+const ProviderDiscoverySchema = z.looseObject({
+    provider: z.string(), source: z.enum(['native', 'cache', 'remote', 'static']), observedAt: dateTime({ offset: true }),
     runtimeVersion: z.string().optional(), accountScope: z.enum(['local-account', 'local-runtime', 'public-feed', 'static']),
     accountBinding: z.string().min(1).optional(), models: z.array(DiscoveredWorkerModelSchema),
-}).passthrough();
-const DiscoverySchema = z.object({
+});
+const DiscoverySchema = z.strictObject({
     source: z.enum(['native', 'cache', 'remote', 'static']), upstreamSource: z.enum(['native', 'remote', 'static']).optional(),
-    fetchedAt: z.string().datetime({ offset: true }), remoteUrl: z.string().url().optional(), remoteError: z.string().optional(),
+    fetchedAt: dateTime({ offset: true }), remoteUrl: url().optional(), remoteError: z.string().optional(),
     inventorySignature: z.string().optional(), providers: z.record(z.string(), ProviderDiscoverySchema),
     instances: z.record(z.string(), ProviderDiscoverySchema).optional(),
-}).strict();
+});
 /** Optional enrichment is checked without tightening legacy catalog rows. */
 export function validateWorkerCatalogDiscovery(input) {
     if (input === undefined)
@@ -168,40 +169,40 @@ export function validateWorkerCatalogDiscovery(input) {
     const parsed = DiscoverySchema.safeParse(input);
     return parsed.success ? [] : parsed.error.issues.map(issue => `${issue.path.join('/')}: ${issue.message}`);
 }
-const CatalogSchema = z.object({
+const CatalogSchema = z.strictObject({
     version: z.literal('1.0.0'),
     $schema: z.literal('../../../schemas/models/model-catalog.v1.schema.json').optional(),
     discovery: DiscoverySchema.optional(),
     refreshedAt: z.string().date(),
-    staleAfterDays: z.number().int().positive(),
-    providers: z.record(ProviderSchema, CatalogProviderSchema),
-}).strict();
-const PolicySchema = z.object({
+    staleAfterDays: integer().positive(),
+    providers: z.partialRecord(ProviderSchema, CatalogProviderSchema),
+});
+const PolicySchema = z.strictObject({
     role: z.enum(['reasoning', 'coding', 'efficiency']),
     tier: z.enum(['economy', 'standard', 'premium']),
     effort: z.enum(['minimal', 'low', 'medium', 'high', 'xhigh']).optional(),
     override: z.string().min(1).optional(),
-}).strict();
+});
 const uniqueStrings = z.array(z.string().min(1)).refine(values => new Set(values).size === values.length, 'Duplicate entries');
-const WorkerDataPolicySchema = z.object({
+const WorkerDataPolicySchema = z.strictObject({
     allowedProcessing: z.array(z.enum(['local', 'remote'])).refine(values => new Set(values).size === values.length).optional(),
     allowProductImprovement: z.boolean().optional(),
     allowUnknown: z.boolean().optional(),
-    maxRetentionDays: z.number().int().nonnegative().optional(),
-}).strict();
-const WorkerRoleSchema = z.object({
+    maxRetentionDays: integer().nonnegative().optional(),
+});
+const WorkerRoleSchema = z.strictObject({
     groups: uniqueStrings.refine(values => values.length > 0),
     tier: z.enum(['economy', 'standard', 'premium', 'max-quality']),
     initialEffort: z.string().min(1).nullable(),
     effortLadder: uniqueStrings,
-    escalateAfter: z.number().int().positive().optional(),
-    maxEscalations: z.number().int().nonnegative().optional(),
-    deescalateAfter: z.number().int().positive().optional(),
+    escalateAfter: integer().positive().optional(),
+    maxEscalations: integer().nonnegative().optional(),
+    deescalateAfter: integer().positive().optional(),
     allowNotApplicableEffort: z.boolean().optional(),
-}).strict();
-export const WorkerSelectionPolicySchema = z.object({
+});
+export const WorkerSelectionPolicySchema = z.strictObject({
     roleGuidance: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerRoleSchema).optional(),
-    guards: z.object({
+    guards: z.strictObject({
         deniedEfforts: uniqueStrings.optional(),
         deniedModels: uniqueStrings.optional(),
         denySelfDelegation: z.boolean().optional(),
@@ -209,16 +210,16 @@ export const WorkerSelectionPolicySchema = z.object({
         allowedVisibility: z.array(z.enum(['listed', 'hidden'])).refine(v => new Set(v).size === v.length).optional(),
         allowedLifecycle: z.array(z.enum(['active', 'deprecated'])).refine(v => new Set(v).size === v.length).optional(),
         minimumIdentityEvidence: z.enum(['runtime-configured', 'backend-attested']).optional(),
-    }).strict().optional(),
+    }).optional(),
     dataPolicy: WorkerDataPolicySchema.optional(),
     dataClasses: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerDataPolicySchema).optional(),
-    freshness: z.object({
-        warnHours: z.number().int().positive().optional(),
-        blockHours: z.number().int().positive().optional(),
-        policyDays: z.number().int().positive().optional(),
-    }).strict().optional(),
+    freshness: z.strictObject({
+        warnHours: integer().positive().optional(),
+        blockHours: integer().positive().optional(),
+        policyDays: integer().positive().optional(),
+    }).optional(),
     taskClasses: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), z.string().min(1)).optional(),
-}).strict().superRefine((policy, context) => {
+}).superRefine((policy, context) => {
     for (const [role, guidance] of Object.entries(policy.roleGuidance ?? {})) {
         if (!['efficiency', 'coding', 'reasoning'].includes(role))
             context.addIssue({ code: 'custom', path: ['roleGuidance', role], message: 'Unknown worker role' });
@@ -332,28 +333,28 @@ export function mergeWorkerSelection(layers) {
     }
     return { policy, origins, diagnostics };
 }
-const UserProjectModelConfigSchema = z.object({
-    defaults: z.object({
+const UserProjectModelConfigSchema = z.looseObject({
+    defaults: z.strictObject({
         tier: z.enum(['economy', 'standard', 'premium', 'max-quality']).optional(),
         provider: ProviderSchema.optional(),
         workerSelection: WorkerSelectionPolicySchema.optional(),
-    }).strict().optional(),
-    agentOverrides: z.record(z.string(), z.object({
+    }).optional(),
+    agentOverrides: z.record(z.string(), z.strictObject({
         'model-tier': z.enum(['economy', 'standard', 'premium', 'max-quality']).optional(),
         'model-override': z.string().min(1).optional(),
         rationale: z.string().min(1).optional(),
-    }).strict()).optional(),
-    customTiers: z.record(z.string(), z.object({
+    })).optional(),
+    customTiers: z.record(z.string(), z.strictObject({
         description: z.string().min(1),
-        costMultiplier: z.number().nonnegative(),
-        roleMapping: z.object({
+        costMultiplier: number().check(z.gte(0)).meta({ type: 'number', minimum: 0 }),
+        roleMapping: z.strictObject({
             reasoning: z.enum(['reasoning', 'coding', 'efficiency']),
             coding: z.enum(['reasoning', 'coding', 'efficiency']),
             efficiency: z.enum(['reasoning', 'coding', 'efficiency']),
-        }).strict(),
-    }).strict()).optional(),
+        }),
+    })).optional(),
     rationale: z.string().optional(),
-}).passthrough();
+});
 let registryCache = null;
 let catalogCache = null;
 export function loadProviderModelCapabilities() {
@@ -415,12 +416,29 @@ export function resolveWorkerInstallation(registry, installation) {
 /** Typed policy failures let public surfaces retain the cause without exposing internal details. */
 export class WorkerPolicyError extends Error {
     code;
-    constructor(code, message) {
+    details;
+    constructor(code, message, details) {
         super(message);
         this.code = code;
+        this.details = details;
         this.name = 'WorkerPolicyError';
     }
 }
+export class WorkerRoleEffortError extends WorkerPolicyError {
+    pointer;
+    constructor(role) {
+        const pointer = `/defaults/workerSelection/roleGuidance/${role.replace(/~/g, '~0').replace(/\//g, '~1')}/initialEffort`;
+        super('OG_CONFIG_REFERENCE', `Missing role guidance or explicit initial effort for role ${role}; configure models.json ${pointer}.`);
+        this.pointer = pointer;
+    }
+}
+/** Validate policy input before entering the sanitized adapter boundary. Null
+ * remains valid for models whose effort is explicitly not applicable. */
+export function assertWorkerRoleEffort(policy, role, requiresExplicit = false) {
+    const effort = policy?.roleGuidance?.[role]?.initialEffort;
+    if (effort === undefined || requiresExplicit && (effort === null || !effort.trim()))
+        throw new WorkerRoleEffortError(role);
+}
 /**
  * Dispatch-time safety checks belong here, alongside transport qualification.
  * Like route validation, rendering requires observation evidence; a default
@@ -498,7 +516,8 @@ export function requiredWorkerControls(context) {
 }
 /** The same sandbox requirement governs inspection, resolution and rendering. */
 export function requiresWorkerExternalBoundary(adapter, selection) {
-    if (hasOperatorWorkerNativeRenderer(adapter) && selection.permissions?.sandbox !== 'external')
+    if (hasOperatorWorkerNativeRenderer(adapter)
+        && (selection.permissions?.sandbox !== 'external' || selection.transport === 'shell'))
         return false;
     const providers = [adapter.id, adapter.provider].map(normalizeProviderDefinitionId);
     return requiredWorkerControls(selection).includes('sandbox')
@@ -513,11 +532,23 @@ export function isOperatorQualifiedWorkerAdapter(adapter) {
     return adapter.qualification.status === 'qualified'
         && adapter.qualification.evidenceRef === WORKER_OPERATOR_APPROVAL;
 }
-/** Only this bundled renderer has an independently checked native direct baseline. */
+/** Bundled renderers with an independently checked native direct baseline. */
 export function hasOperatorWorkerNativeRenderer(adapter) {
-    return isOperatorQualifiedWorkerAdapter(adapter) && adapter.provider === 'codex'
+    return isOperatorQualifiedWorkerAdapter(adapter) && ['codex', 'muse'].includes(adapter.provider)
         && adapter.invocation.kind === 'process';
 }
+/** The process-group launch boundary requires the independently verified native renderer. */
+export function assertWorkerLaunchMode(adapter, permissions = {}) {
+    const mode = permissions.launchMode ?? 'systemd-unit';
+    if (!['systemd-unit', 'native-sandbox'].includes(mode)) {
+        throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Unknown worker launch mode');
+    }
+    if (mode === 'native-sandbox' && (!hasOperatorWorkerNativeRenderer(adapter)
+        || !['read-only', 'workspace-write'].includes(permissions.sandbox ?? '')
+        || (permissions.transport ?? 'shell') !== 'shell')) {
+        throw new WorkerPolicyError('OG_POLICY_RELAXATION', 'native-sandbox requires a verified native read-only or workspace-write shell renderer');
+    }
+}
 /** Check the actual argv before granting the direct renderer exception. */
 export function assertOperatorWorkerNativeArgv(adapter, argv, selected, permissions) {
     if (!hasOperatorWorkerNativeRenderer(adapter))
@@ -529,10 +560,46 @@ export function assertOperatorWorkerNativeArgv(adapter, argv, selected, permissi
         }
     };
     const sandbox = permissions?.sandbox ?? 'workspace-write';
-    if (!['read-only', 'workspace-write'].includes(sandbox))
+    if (!['read-only', 'workspace-write', 'external'].includes(sandbox))
         throw new Error('Requested sandbox has no verified native renderer');
+    if (adapter.provider === 'muse') {
+        requirePair('--provider', 'meta');
+        requirePair('--model', selected.model);
+        if (selected.effort.value === null)
+            throw new Error('Muse requires explicit effort');
+        requirePair('--reasoning-effort', selected.effort.value);
+        if ((permissions?.approval ?? 'never') !== 'never')
+            throw new Error('Muse direct worker approval requires never');
+        requirePair('--approval-mode', 'never');
+        requirePair('--approval-judge', 'off');
+        if (args.includes('--disable-sandbox') !== (sandbox === 'external')) {
+            throw new Error('Requested native worker sandbox control does not match');
+        }
+        if (sandbox === 'read-only' && (!args.includes('--disable-write') || !args.includes('--disable-shell'))) {
+            throw new Error('Requested native worker read-only control is absent');
+        }
+        if (args[0] !== 'exec')
+            throw new Error('Native worker controls could be overridden');
+        const seen = new Set();
+        for (let index = 1; index < args.length; index++) {
+            const flag = args[index];
+            if (seen.has(flag))
+                throw new Error('Native worker controls could be overridden');
+            seen.add(flag);
+            if (['--json', '--trust-workspace', '--disable-write', '--disable-shell', '--disable-sandbox'].includes(flag))
+                continue;
+            if (!['--provider', '--model', '--reasoning-effort', '--workspace', '--approval-mode', '--approval-judge',
+                '--max-model-steps', '--output-schema', '--prompt-file'].includes(flag) || index + 1 >= args.length) {
+                throw new Error('Native worker controls could be overridden');
+            }
+            index++;
+        }
+        return;
+    }
     requirePair('-m', selected.model);
-    requirePair('-s', sandbox);
+    requirePair('-s', sandbox === 'external' ? 'danger-full-access' : sandbox);
+    if ((permissions?.approval ?? 'never') !== 'never')
+        throw new Error('Codex direct worker approval requires never');
     for (const [name, value] of [['model_reasoning_effort', selected.effort.value], ['approval_policy', permissions?.approval ?? 'never']]) {
         const overrides = args.flatMap((token, index) => token === '-c' ? [args[index + 1]] : [])
             .filter(token => token?.split('=')[0] === name);
@@ -577,13 +644,9 @@ export function inspectWorkerInvocationProfile(adapter, selection) {
     // The direct CLI baseline trusts the installed driver's bounded renderer.
     // Explicit extra controls still require the existing qualified mappings.
     if (hasOperatorWorkerNativeRenderer(adapter) && profile.transport === 'shell') {
-        if (selection.permissions?.sandbox && !['read-only', 'workspace-write'].includes(selection.permissions.sandbox)) {
+        if (selection.permissions?.sandbox && !['read-only', 'workspace-write', 'external'].includes(selection.permissions.sandbox)) {
             throw new Error('Requested sandbox has no verified native renderer');
         }
-        if (selection.permissions?.sandbox === 'external' && (!selection.boundary
-            || !['os', 'executor'].includes(selection.boundary.kind) || !selection.boundary.controls.includes('sandbox'))) {
-            throw new Error('Requested external sandbox requires an enforcing boundary');
-        }
         for (const name of selection.requiredControls ?? []) {
             if (!['native', 'external'].includes(profile.controls[name]?.support)) {
                 throw new Error(`Required worker control is unqualified: ${name}`);

package/dist/src/models/resolver.js

@@ -8,7 +8,7 @@
 import { ConfigLoader } from './config-loader.js';
 import { WORKER_DISPATCH_ENABLE_COMMAND, WORKER_DISPATCH_READINESS_COMMAND } from './worker-dispatch-offer.js';
 import { resolveWorkerGroupInstallation, resolveParallelism, validateWorkerGroupQualifications, validateWorkerGroupReferences, validateWorkerBudgetEnforcement, workerActivationDigests, workerConfigDigest, } from '../config/aiwg-config.js';
-import { qualifyWorkerInvocationProfile, validateWorkerPolicyRoute, validateWorkerModelObservation, hasOperatorWorkerNativeRenderer, hasSelectionRelevantConflicts, workerContextHeadroom, workerModelKey, isCanonicalWorkerModelKey, WorkerSelectionPolicySchema, validateWorkerCatalogDiscovery, } from './provider-policy.js';
+import { qualifyWorkerInvocationProfile, validateWorkerPolicyRoute, validateWorkerModelObservation, assertWorkerLaunchMode, hasOperatorWorkerNativeRenderer, hasSelectionRelevantConflicts, workerContextHeadroom, workerModelKey, isCanonicalWorkerModelKey, WorkerSelectionPolicySchema, validateWorkerCatalogDiscovery, } from './provider-policy.js';
 import { MODEL_WRAPPERS } from './provider-models.js';
 import { routeModelTier } from './router.js';
 /**
@@ -257,6 +257,14 @@ function findWorkerModelRow(rows, model) {
     const matches = rows?.filter(row => row.id === model || row.apiModelId === model) ?? [];
     return matches.length === 1 ? matches[0] : undefined;
 }
+function workerCatalogDigest(catalog) {
+    if (!catalog.discovery)
+        return workerConfigDigest(catalog);
+    // Offline loads synthesize fetchedAt. Keep catalog facts and persisted
+    // observation/qualification times pinned, independent of the load clock.
+    const { fetchedAt, ...discovery } = catalog.discovery;
+    return workerConfigDigest({ ...catalog, discovery });
+}
 /** Pure S1 resolution. No probing, launch, activation, admission, or writes.
  * Recheck against freshly loaded snapshots before preparing an invocation. */
 export function resolveWorkerPlan(snapshot, request) {
@@ -266,7 +274,7 @@ export function resolveWorkerPlan(snapshot, request) {
         ...snapshot.modelDigests,
         configDigest: workerActivationDigests(snapshot.config).configDigest,
         resolvedModelsDigest: workerConfigDigest(snapshot.models),
-        catalogDigest: workerConfigDigest(snapshot.catalog),
+        catalogDigest: workerCatalogDigest(snapshot.catalog),
         profileDigest: workerConfigDigest([snapshot.registry, snapshot.installations]),
         constraintsDigest: workerConfigDigest(snapshot.constraints),
     };
@@ -305,7 +313,6 @@ export function resolveWorkerPlan(snapshot, request) {
         if (!activation || ['configDigest', 'projectModelsDigest', 'userModelsDigest', 'builtinModelsDigest'].some(key => activation[key] !== digests[key])) {
             block('OG_CONFIG_REFERENCE', '/parallelism/activation', 'Managed activation is missing or stale');
         }
-        block('OG_ADAPTER_UNQUALIFIED', '/parallelism/worker_mode', 'Managed activation/admission runtime is deferred to S2+');
     }
     if (!policy)
         block('OG_CONFIG_REFERENCE', '/defaults/workerSelection', 'Current merged worker policy is required');
@@ -344,9 +351,12 @@ export function resolveWorkerPlan(snapshot, request) {
                 ? observed.qualification.roles.filter(role => policy.roleGuidance?.[role]?.groups.includes(groupId)) : [];
         }
     }
-    plan.diagnostics.push(...validateWorkerGroupQualifications(parallelism, qualifiedRoles).map(diagnostic => ({
+    // Qualification gaps are group-scoped: an unqualified group must not block a
+    // request that never considers it. Gaps are applied once the candidates are known.
+    const qualificationGaps = validateWorkerGroupQualifications(parallelism, qualifiedRoles).map(diagnostic => ({
         ...diagnostic, message: `${diagnostic.message}. Run aiwg doctor --probe-workers --qualify.`,
-    })));
+    }));
+    const gapGroup = (diagnostic) => diagnostic.pointer.split('/')[3] ?? '';
     const taskRole = request.taskClass ? policy.taskClasses?.[request.taskClass] : undefined;
     const role = request.role ?? taskRole;
     plan.role = role ?? null;
@@ -365,10 +375,25 @@ export function resolveWorkerPlan(snapshot, request) {
         || hasSelectionRelevantConflicts(request.reviewOf) || !request.reviewOf.family || request.reviewOf.family === 'unknown')) {
         block('OG_MODEL_UNAPPROVED', '/request/reviewOf', 'Required review needs unambiguous observed source lineage');
     }
+    const candidateGroups = request.group ? [request.group] : guidance?.groups ?? [];
+    const unqualifiedGroups = new Set(qualificationGaps.map(gapGroup));
+    const qualifiedGroups = candidateGroups.filter(groupId => !unqualifiedGroups.has(groupId));
+    if (!qualifiedGroups.length) {
+        plan.diagnostics.push(...qualificationGaps.filter(gap => candidateGroups.includes(gapGroup(gap))));
+    }
+    else {
+        // Unpinned requests skip an unqualified guidance group visibly instead of failing the role.
+        for (const groupId of candidateGroups.filter(groupId => unqualifiedGroups.has(groupId))) {
+            const gaps = qualificationGaps.filter(gap => gapGroup(gap) === groupId);
+            for (const member of parallelism.groups?.[groupId]?.members ?? []) {
+                plan.exclusions.push({ group: groupId, member: member.id, model: member.model, effort: null, diagnostics: gaps });
+            }
+        }
+    }
     if (plan.diagnostics.length || !role || !guidance)
         return plan;
     const wrapperPin = snapshot.models.agentOverrides[MODEL_WRAPPERS[role]]?.['model-override'];
-    const groups = request.group ? [request.group] : guidance.groups;
+    const groups = qualifiedGroups;
     for (const groupId of groups) {
         const group = parallelism.groups[groupId];
         const permissions = { ...group.execution, transport: group.execution?.transport ?? 'shell' };
@@ -420,8 +445,13 @@ export function resolveWorkerPlan(snapshot, request) {
                     try {
                         const { adapter } = resolveWorkerGroupInstallation(parallelism, member.cli, snapshot.registry);
                         const configuredProfile = parallelism.clis?.[member.cli]?.invocationProfile;
-                        if (configuredProfile && configuredProfile !== binding.profile)
-                            throw new Error('Configured invocation profile changed');
+                        const profilePointer = `/parallelism/clis/${member.cli}/invocationProfile`;
+                        if (configuredProfile && !Object.hasOwn(adapter.invocationProfiles ?? {}, configuredProfile)) {
+                            deny('OG_CONFIG_REFERENCE', profilePointer, 'Configured invocation profile is not registered for this adapter; select a registered profile.');
+                        }
+                        else if (configuredProfile && configuredProfile !== binding.profile) {
+                            deny('OG_PIN_MISMATCH', profilePointer, 'Configured invocation profile differs from installation qualification; qualify the selected profile again.');
+                        }
                         const configuredServer = parallelism.clis?.[member.cli]?.mcpServerRef;
                         if (transport === 'mcp' && configuredServer && configuredServer !== binding.mcp?.serverRef)
                             throw new Error('Configured MCP server changed');
@@ -433,9 +463,15 @@ export function resolveWorkerPlan(snapshot, request) {
                             throw new Error('Requested-only mapping cannot attest backend identity');
                         if (!hasOperatorWorkerNativeRenderer(adapter) && group.execution?.sandbox && !adapter.capabilities.sandboxModes.includes(group.execution.sandbox))
                             throw new Error('Requested sandbox mode is unqualified');
+                        assertWorkerLaunchMode(adapter, permissions);
                         qualifyWorkerInvocationProfile(adapter, { profile: binding.profile, transport, cliVersion: binding.cliVersion,
                             policy, permissions, effort, boundary: binding.boundary,
                             requiredControls: request.requiredControls, mcp: binding.mcp });
+                        if (hasOperatorWorkerNativeRenderer(adapter) && transport === 'shell' && permissions.sandbox === 'external') {
+                            reasons.push({ code: 'OG_SANDBOX_EXTERNAL', blocking: false,
+                                pointer: `/parallelism/groups/${groupId}/execution/sandbox`,
+                                message: `${adapter.provider} CLI's own sandbox is disabled by explicit external policy; isolation relies on the per-task worktree and launcher resource scope.` });
+                        }
                         const { maxAttempts: _maxAttempts, ...budgetLimits } = plan.ceilings;
                         const budgetDimensions = { tokens: 'tokens', cost: 'costUsd', 'wall-time': 'wallSeconds' };
                         const enforceable = adapter.capabilities.hardBudget.map(key => budgetDimensions[key]);
@@ -497,6 +533,7 @@ export function resolveWorkerPlan(snapshot, request) {
         plan.selected = null;
     if (plan.selected) {
         plan.status = 'eligible';
+        plan.diagnostics.push(...plan.selected.diagnostics.filter(item => item.code === 'OG_SANDBOX_EXTERNAL'));
         plan.choice = { source: request.choice ? 'conductor' : 'default', rationale: request.choice?.rationale ?? 'Role group order, member priority/declaration order, then qualified effort ladder',
             ...(request.substitution && matchesChoice(plan.selected, request.substitution) ? { substitution: structuredClone(request.substitution) } : {}) };
     }

package/dist/src/models/worker-installation.d.mts

@@ -9,7 +9,9 @@ export function loadRecordedWorkerInstallations(input: {
   parallelism?: import('../config/aiwg-config.js').ParallelismConfig;
   storePath?: string;
   storeDigest?: string;
-}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery> }>;
+  /** Request validation after store presence, before recorded policy/adapter checks. */
+  precheckPolicy?: () => void;
+}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery>; qualificationFailures?: Record<string, string> }>;
 
 export function hasProvider(name: string): boolean;
 
@@ -37,3 +39,8 @@ export function registerWorkerRecoveryCapabilities<T extends object>(driver: T,
 export function getWorkerRecoveryCapabilities(driver: object | undefined | null): Readonly<WorkerRecoveryCapabilities> | null;
 
 export function prepareWorkerInstallationStore(input: { workerWritableRoots: string[]; apply?: boolean }): Promise<{ path: string; action: string }[]>;
+
+/** Historical approvals only; no driver import, probe, auth read, or launch authority. */
+export function inspectRecordedWorkerQualifications(input: {
+  cwd: string; policy: WorkerSelectionPolicy; parallelism: import('../config/aiwg-config.js').ParallelismConfig;
+}): Promise<Array<{ cli: string; provider: string }>>;