@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/models/worker-installation.mjs

@@ -1,7 +1,7 @@
 /** Shared installed-worker qualification owner, also used by the Ralph compatibility facade. */
 import { spawn } from 'node:child_process';
 import { constants } from 'node:fs';
-import { open, realpath, lstat, mkdir, rename, writeFile } from 'node:fs/promises';
+import { open, realpath, lstat, mkdir, rename, writeFile, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { homedir } from 'node:os';
 import { pathToFileURL } from 'node:url';
@@ -163,7 +163,7 @@ export async function qualifyWorkerInstallation(instance, options) {
 }
 
 export async function prepareInstalledWorkerInvocation(instance, invocation, qualification) {
-  const { prepareWorkerInvocation, WorkerPathScopeError } = await import('../serve/worker-invocation.js');
+  const { prepareWorkerInvocation, WorkerPathScopeError, WorkerInvocationCheckError } = await import('../serve/worker-invocation.js');
   const { requiredWorkerControls, WorkerPolicyError, isOperatorQualifiedWorkerAdapter } = await import('./provider-policy.js');
   if (!isOperatorQualifiedWorkerAdapter(qualification.adapter)) qualification = { ...qualification, requiredControls: requiredWorkerControls({
     ...qualification, effort: invocation.selected.effort.value }) };
@@ -187,7 +187,7 @@ export async function prepareInstalledWorkerInvocation(instance, invocation, qua
       throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker installation qualification changed');
     }
     if (await realpath(result.cwd) !== scope.cwd) {
-      throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker cwd differs from the qualified workspace');
+      throw new WorkerInvocationCheckError('OG_CONFIG_REFERENCE', 'qualified_workspace_mismatch');
     }
     for (const key of ['briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
       const target = await canonicalFuturePath(result[key]);
@@ -443,6 +443,19 @@ export function boundedVersionProbe(executable, argv, environment, cwd, timeoutM
     || !Array.isArray(argv) || argv.some(arg => typeof arg !== 'string' || arg.includes('\0'))) {
     throw new Error('Invalid probe bounds');
   }
+  // ETXTBSY: the executable still has a writer somewhere, typically a sibling
+  // process forked while the file was being written or a CLI mid-update. It
+  // clears in milliseconds, so retry the spawn within the same overall bound.
+  const deadline = Date.now() + timeoutMs;
+  const attempt = delayMs => runBoundedVersionProbe(executable, argv, environment, cwd, timeoutMs, maxBytes, versionPattern)
+    .catch(error => {
+      if (error?.code !== 'ETXTBSY' || Date.now() + delayMs >= deadline) throw error;
+      return new Promise(resolveDelay => setTimeout(resolveDelay, delayMs)).then(() => attempt(Math.min(delayMs * 2, 200)));
+    });
+  return attempt(10);
+}
+
+function runBoundedVersionProbe(executable, argv, environment, cwd, timeoutMs, maxBytes, versionPattern) {
   return new Promise((resolve, reject) => {
     const child = spawn(executable, argv, { cwd, env: environment, stdio: 'pipe', detached: true, shell: false });
     let output = Buffer.alloc(0);
@@ -663,7 +676,9 @@ async function loadQualifiedModules({ registry, modules, workerWritableRoots, pl
     for (const id of entry.adapterIds) {
       const builtinConflict = canonicalIds.has(id) ? false : providerRegistry.has(id);
       if (ids.has(id) || ((builtinConflict || installedModules.has(inspectedModule.key))
-        && installedModules.get(id) !== inspectedModule.key)) throw new Error(`Duplicate worker adapter ID: ${id}`);
+        && installedModules.get(id) !== inspectedModule.key)) {
+        throw Object.assign(new Error(`Duplicate worker adapter ID: ${id}`), { code: 'WORKER_ADAPTER_CONFLICT' });
+      }
       ids.add(id);
     }
     inspected.push(inspectedModule);
@@ -809,6 +824,40 @@ export async function prepareWorkerInstallationStore({ workerWritableRoots, appl
   return assertTrustedStore(installationStorePath(), workerWritableRoots, true, apply);
 }
 
+// Use the existing delivery ledger's host-selected keyring, never public keys
+// supplied by a registration. PAE separates this authority from effect records.
+const qualificationPayloadType = 'application/vnd.aiwg.worker-installation-qualification+json';
+const requalifyMessage = 'Re-run aiwg doctor --probe-workers --qualify. Existing unsigned approvals require deliberate one-time requalification.';
+const keyRecoveryMessage = 'Worker qualification signing trust is unavailable. Check effects.keyProvider in aiwg.config, unlock or restore the existing effect-ledger key, and run aiwg effect keys init if its keyring is not initialized; then re-run aiwg doctor --probe-workers --qualify.';
+
+async function qualificationTrust(cwd, scope) {
+  const { effectSession, openLedger } = await import('../effects/host.js');
+  const { openEffectLedger, readLedgerKeyring } = await import('../effects/ledger.js');
+  const ledger = scope ? openEffectLedger({ projectDir: cwd, scope, writer: 'cli' }) : openLedger(await effectSession(cwd));
+  const keyring = await readLedgerKeyring(ledger);
+  if (!keyring) throw new Error(keyRecoveryMessage);
+  return { ledger, keyring };
+}
+
+async function qualificationPayload(record, signedAt, projectDir, scope) {
+  const { canonicalJson } = await import('../security/artifact-trust.js');
+  const { signature: _signature, ...body } = record;
+  return Buffer.from(canonicalJson({ record: JSON.parse(JSON.stringify(body)), signedAt, projectDir, scope }), 'utf8');
+}
+
+async function qualificationSignatureFailure(record, trust) {
+  if (!record.signature) return 'signature-missing';
+  const { keyid, sig, signedAt, projectDir, scope } = record.signature;
+  if (typeof keyid !== 'string' || typeof sig !== 'string' || typeof signedAt !== 'string'
+    || typeof projectDir !== 'string' || !path.isAbsolute(projectDir) || !scope) return 'signature-invalid';
+  let keyring;
+  try { ({ keyring } = await trust(projectDir, scope)); } catch { return 'signature-trust-unavailable'; }
+  const { checkSignature } = await import('../effects/keyring.js');
+  const result = checkSignature(keyring, keyid, sig, qualificationPayloadType,
+    await qualificationPayload(record, signedAt, projectDir, scope), signedAt);
+  return result === 'ok' ? null : result === 'signature-invalid' ? result : `signature-${result}`;
+}
+
 async function readInstallationStore(filename, expectedDigest) {
   try {
     const bytes = await readInstalledFile(filename);
@@ -825,6 +874,38 @@ async function readInstallationStore(filename, expectedDigest) {
   }
 }
 
+/** Offline projection of recorded approvals only. Never imports drivers, reads auth, or probes CLIs.
+ * This is historical evidence, not current launch authority; loadRecordedWorkerInstallations
+ * performs binary/version/scope checks when dispatch actually requests a binding.
+ */
+export async function inspectRecordedWorkerQualifications({ cwd, policy, parallelism }) {
+  const filename = installationStorePath();
+  await assertTrustedStore(filename, [cwd]);
+  const { stored } = await readInstallationStore(filename);
+  const workspace = await realpath(cwd);
+  const results = [];
+  const { qualificationDigest } = await import('./qualification-digest.mjs');
+  for (const record of stored.registrations) {
+    try {
+      const { cli, installation, adapter, binding } = record;
+      const configured = parallelism?.clis?.[cli];
+      if (!configured || configured.enabled === false || !/^[a-z][a-z0-9-]{0,62}$/.test(cli)
+        || await realpath(installation.cwd) !== workspace
+        || qualificationDigest(policy) !== installation.effectiveConfigDigest
+        || configured.adapter !== `providers:${adapter.provider}` && configured.adapter !== adapter.id
+        || configured.accountScope !== binding.accountScope
+        || binding.profile !== installation.profile || binding.cliVersion !== installation.cliVersion
+        || (configured.executable && await realpath(configured.executable) !== await realpath(installation.executable))) continue;
+      const proof = adapter.invocationProfiles?.[binding.profile]?.installationQualification;
+      if (!proof || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => proof[key] !== installation.evidence?.[key])) continue;
+      if (await qualificationSignatureFailure(record, () => qualificationTrust(cwd))) continue;
+      await assertWorkerInstallationEvidence({ ...installation, adapter, now: Date.now(), policy }, proof.scopeDigest);
+      results.push({ cli, provider: adapter.provider });
+    } catch { /* Malformed, expired or unbound evidence is not qualification. */ }
+  }
+  return results.filter(row => results.filter(other => row.cli === other.cli).length === 1);
+}
+
 /** Explicit host operation: successful bounded qualification is required before
  * recording; credentials are reduced to names and are never written to disk. */
 export async function recordWorkerInstallation(instance, options) {
@@ -833,6 +914,15 @@ export async function recordWorkerInstallation(instance, options) {
   const installation = structuredClone(options.installation);
   const result = await qualifyWorkerInstallation(instance, { ...installation, now: Date.now() });
   if (result.status !== 'ENABLED') return result;
+  let signingKey, keyring, signingProjectDir;
+  try {
+    signingProjectDir = await realpath(options.projectDir ?? installation.cwd);
+    const trust = await qualificationTrust(signingProjectDir);
+    keyring = trust.keyring;
+    signingKey = await trust.ledger.signingKey();
+    const { activeKey } = await import('../effects/keyring.js');
+    if (activeKey(keyring).keyid !== signingKey.keyid) throw new Error('inactive key');
+  } catch { return { status: 'DISABLED', reason: keyRecoveryMessage }; }
   const adapter = structuredClone(installation.adapter);
   adapter.invocationProfiles[installation.profile].installationQualification = {
     scopeDigest: result.scopeDigest, fixtureDigest: result.fixtureDigest,
@@ -842,79 +932,169 @@ export async function recordWorkerInstallation(instance, options) {
     || binding.accountScope !== installation.accountScope) throw new Error('Installation binding differs from qualification');
   const filename = installationStorePath();
   await assertTrustedStore(filename, installation.workerWritableRoots);
-  const { stored } = await readInstallationStore(filename);
-  const environmentNames = Object.keys(installation.environment ?? {});
-  delete installation.environment;
-  delete installation.adapter;
-  delete installation.now;
-  const record = { cli, ...(options.modelObservations ? { modelObservations: structuredClone(options.modelObservations) } : {}), binding: { ...structuredClone(binding), boundary: installation.boundary }, adapter,
-    installation: { ...installation, environmentNames, versionProbe: { rawBanner: result.rawVersionBanner, version: result.cliVersion } },
-    ...(options.mcpSchemas ? { mcpSchemas: structuredClone(options.mcpSchemas) } : {}),
-    ...(options.mcpProfile ? { mcpProfile: structuredClone(options.mcpProfile) } : {}) };
-  stored.registrations = stored.registrations.filter(entry => entry.cli !== cli);
-  stored.registrations.push(record);
+  // Canonical workspace identity is an exact approval key, never a prefix.
+  installation.cwd = await realpath(installation.cwd);
   await mkdir(path.dirname(filename), { recursive: true, mode: 0o700 });
-  await assertTrustedStore(filename, installation.workerWritableRoots);
-  const temporary = `${filename}.${process.pid}.${createHash('sha256').update(String(Math.random())).digest('hex')}.tmp`;
-  await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
-  await rename(temporary, filename);
-  return result;
+  // Serialize read/modify/rename across qualifying CLI processes. A stale lock
+  // fails closed; qualification never steals another process's lock.
+  const lockPath = `${filename}.lock`;
+  let lock;
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { lock = await open(lockPath, 'wx', 0o600); break; }
+    catch (error) {
+      if (error.code !== 'EEXIST' || attempt === 99) throw error;
+      await new Promise(resolve => setTimeout(resolve, 20));
+    }
+  }
+  try {
+    await assertTrustedStore(filename, installation.workerWritableRoots);
+    const { stored } = await readInstallationStore(filename);
+    const environmentNames = Object.keys(installation.environment ?? {});
+    delete installation.environment;
+    delete installation.adapter;
+    delete installation.now;
+    const record = { cli, ...(options.modelObservations ? { modelObservations: structuredClone(options.modelObservations) } : {}), binding: { ...structuredClone(binding), boundary: installation.boundary }, adapter,
+      installation: { ...installation, environmentNames, versionProbe: { rawBanner: result.rawVersionBanner, version: result.cliVersion } },
+      ...(options.mcpSchemas ? { mcpSchemas: structuredClone(options.mcpSchemas) } : {}),
+      ...(options.mcpProfile ? { mcpProfile: structuredClone(options.mcpProfile) } : {}) };
+    const signedAt = new Date().toISOString();
+    try {
+      const payload = await qualificationPayload(record, signedAt, signingProjectDir, keyring.scope);
+      const sig = signingKey.signPae(qualificationPayloadType, payload);
+      const { checkSignature } = await import('../effects/keyring.js');
+      if (checkSignature(keyring, signingKey.keyid, sig, qualificationPayloadType, payload, signedAt) !== 'ok') throw new Error('invalid signature');
+      record.signature = { keyid: signingKey.keyid, sig, signedAt, projectDir: signingProjectDir, scope: keyring.scope };
+    } catch { return { status: 'DISABLED', reason: keyRecoveryMessage }; }
+    const retained = [];
+    for (const entry of stored.registrations) {
+      const workspace = typeof entry.installation?.cwd === 'string'
+        ? await realpath(entry.installation.cwd).catch(() => entry.installation.cwd) : null;
+      if (entry.cli !== cli || workspace !== installation.cwd) retained.push(entry);
+    }
+    // Bound host authority without silently evicting another workspace approval.
+    if (retained.length >= 128) throw new Error('Worker installation store is full (128 workspace approvals); remove an obsolete approval before qualifying another workspace');
+    stored.registrations = retained;
+    stored.registrations.push(record);
+    await mkdir(path.dirname(filename), { recursive: true, mode: 0o700 });
+    await assertTrustedStore(filename, installation.workerWritableRoots);
+    const temporary = `${filename}.${process.pid}.${createHash('sha256').update(String(Math.random())).digest('hex')}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    await rename(temporary, filename);
+    return result;
+  } finally {
+    await lock.close();
+    await unlink(lockPath);
+  }
 }
 
 /** Read recorded host authority, validate installation bytes and the current CLI
  * version, then load the same approved factory used by Ralph. */
-export async function loadRecordedWorkerInstallations({ registry, cwd, policy, parallelism, storePath, storeDigest }) {
+export async function loadRecordedWorkerInstallations({ registry, cwd, policy, parallelism, storePath, storeDigest, precheckPolicy }) {
   const { WorkerPolicyError, parseProviderModelCapabilities } = await import('./provider-policy.js');
   const { qualificationDigest } = await import('./qualification-digest.mjs');
-  const fail = () => new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Trusted installation qualification is required');
-  const filename = storePath ?? installationStorePath();
+  // Only fixed stage codes and bounded record indexes may leave this boundary.
+  // Underlying errors can contain probe output, environment values or paths.
+  const rejections = [];
+  const fail = () => new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED',
+    `Trusted installation qualification is required (${[...new Set(rejections.map(row => row.reason))].join(', ')})${rejections.some(row => row.reason.startsWith('signature-'))
+      ? `. ${rejections.some(row => row.reason === 'signature-trust-unavailable') ? keyRecoveryMessage : requalifyMessage}` : ''}`,
+    { rejections });
+  let reason = 'store-binding';
+  let filename;
   let stored, digest;
   try {
+    filename = storePath ?? installationStorePath();
     if (!path.isAbsolute(filename) || (storePath !== undefined && !/^sha256:[a-f0-9]{64}$/.test(storeDigest ?? ''))) throw fail();
+    reason = 'store-untrusted';
     await assertTrustedStore(filename, [cwd]);
+    reason = 'store-record';
     ({ stored, digest } = await readInstallationStore(filename, storeDigest));
   }
-  catch { throw fail(); }
+  catch { rejections.push({ registration: null, reason }); throw fail(); }
+  if (!stored.registrations.length) {
+    rejections.push({ registration: null, reason: 'no-records' });
+    throw fail();
+  }
+  // Request policy errors remain actionable before digest/adapter checks,
+  // while an absent approval retains the qualification contract (#3070).
+  precheckPolicy?.();
   const installations = {};
   const drivers = {};
   const observations = {};
+  const qualificationFailures = Object.create(null);
   const resolvedRegistry = structuredClone(registry);
+  const requestedWorkspace = await realpath(cwd);
+  const workspaces = await Promise.all(stored.registrations.map(async record => {
+    try { return await realpath(record?.installation?.cwd); } catch { return null; }
+  }));
   const counts = new Map();
-  for (const record of stored.registrations) counts.set(record?.cli, (counts.get(record?.cli) ?? 0) + 1);
-  for (const record of stored.registrations) {
+  const selected = new Map();
+  for (const [index, record] of stored.registrations.entries()) {
+    const key = JSON.stringify([record?.cli, workspaces[index]]);
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+    // Prefer an exact approval. Retain the latest other-workspace record only
+    // to preserve the typed workspace-mismatch diagnostic for unapproved dirs.
+    const prior = selected.get(record?.cli);
+    if (prior === undefined || workspaces[prior] !== requestedWorkspace) selected.set(record?.cli, index);
+  }
+  for (const [registration, record] of stored.registrations.entries()) {
+    reason = 'record-identity';
     try {
       const { cli, binding, adapter } = record;
-      if (!/^[a-z][a-z0-9-]{0,62}$/.test(cli) || counts.get(cli) !== 1) throw fail();
+      if (!/^[a-z][a-z0-9-]{0,62}$/.test(cli)) throw fail();
+      if (counts.get(JSON.stringify([cli, workspaces[registration]])) !== 1) throw fail();
+      if (selected.get(cli) !== registration) continue;
+      // A conductor-pinned store digest also binds the original config source.
+      // Framing from a worker cwd must never read that cwd's configuration.
+      reason = await qualificationSignatureFailure(record, (projectDir, scope) => storePath === undefined
+        ? qualificationTrust(cwd) : qualificationTrust(projectDir, scope));
+      if (reason) throw fail();
       const installation = { ...record.installation, adapter, now: Date.now(), environment: {} };
+      reason = 'environment-name';
       if (record.installation.environment && Object.keys(record.installation.environment).length) throw fail();
       for (const name of installation.environmentNames ?? []) {
         if (typeof name !== 'string' || process.env[name] === undefined) throw fail();
         installation.environment[name] = process.env[name];
       }
+      reason = 'binding-mismatch';
       if (binding.profile !== installation.profile || binding.cliVersion !== installation.cliVersion
         || binding.accountScope !== installation.accountScope
-        || qualificationDigest(binding.boundary) !== qualificationDigest(installation.boundary)
-        || qualificationDigest(policy) !== installation.effectiveConfigDigest) throw fail();
+        || qualificationDigest(binding.boundary) !== qualificationDigest(installation.boundary)) throw fail();
+      reason = 'effective-config-digest';
+      if (qualificationDigest(policy) !== installation.effectiveConfigDigest) throw fail();
+      reason = 'evidence';
       const proof = adapter.invocationProfiles?.[binding.profile]?.installationQualification;
       if (!proof || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => proof[key] !== installation.evidence?.[key])) throw fail();
       // Reject expired/unbound negative observations before any factory import.
       const { requiredWorkerControls, isOperatorQualifiedWorkerAdapter } = await import('./provider-policy.js');
       if (!isOperatorQualifiedWorkerAdapter(adapter)) installation.requiredControls = requiredWorkerControls(installation);
       await assertWorkerInstallationEvidence(installation, proof.scopeDigest);
+      reason = 'store-untrusted';
       await assertTrustedStore(filename, installation.workerWritableRoots);
+      reason = 'adapter-metadata';
       const candidateRegistry = structuredClone(resolvedRegistry);
       if (candidateRegistry.providers[adapter.id]) candidateRegistry.providers[adapter.id].workerAdapter = adapter;
       else { candidateRegistry.workerAdapters ??= {}; candidateRegistry.workerAdapters[adapter.id] = adapter; }
       parseProviderModelCapabilities(candidateRegistry);
       // The loader validates package identity, bytes and static exports BEFORE import.
       // Only this installation's metadata is needed; unrelated absent modules do not block it.
-      const loadingRegistry = structuredClone(registry);
-      for (const provider of Object.values(loadingRegistry.providers)) delete provider.workerAdapter;
-      loadingRegistry.workerAdapters = { [adapter.id]: adapter };
+      // Preserve the canonical provider slot used to distinguish upgrades from ID conflicts.
+      const loadingRegistry = structuredClone(candidateRegistry);
+      const canonical = loadingRegistry.providers[adapter.id]?.workerAdapter?.id === adapter.id;
+      for (const [name, provider] of Object.entries(loadingRegistry.providers)) {
+        if (canonical && name === adapter.id) provider.workerAdapter = adapter;
+        else delete provider.workerAdapter;
+      }
+      loadingRegistry.workerAdapters = canonical ? {} : { [adapter.id]: adapter };
+      reason = 'module-registration';
       await loadInstalledWorkerAdapters({ registry: loadingRegistry, modules: installation.modules,
         workerWritableRoots: installation.workerWritableRoots, platform: process.platform });
+      reason = 'binary-identity';
       const instance = createProvider(adapter.id);
-      const { scope } = await recheckWorkerInstallation(instance, installation);
+      const scope = await inspectWorkerInstallation(instance, installation);
+      reason = 'scope-digest';
+      await assertWorkerInstallationEvidence(installation, scope.scopeDigest);
+      reason = 'binary-identity';
       if (parallelism && isOperatorQualifiedWorkerAdapter(adapter)) {
         const { resolveWorkerGroupInstallation } = await import('../config/aiwg-config.js');
         const configured = resolveWorkerGroupInstallation(parallelism, cli, candidateRegistry);
@@ -931,15 +1111,19 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
         }
         if (!executable || await realpath(executable) !== scope.binary.realpath) throw fail();
       }
+      reason = 'scope-digest';
       if (scope.scopeDigest !== proof.scopeDigest) throw fail();
       // A launcher can keep the same bytes while its CLI payload is updated.
       // Reuse the bounded, credential-free doctor probe before granting authority.
+      reason = 'version';
       const { version } = await boundedVersionProbe(scope.binary.realpath,
         adapter.invocation.versionArgv, workerVersionProbeEnvironment(), cwd,
         workerVersionProbeDefaults.timeoutMs, workerVersionProbeDefaults.maxBytes,
         adapter.invocation.versionPattern);
-      if (version !== binding.cliVersion
-        || (await inspectWorkerInstallation(instance, installation)).scopeDigest !== scope.scopeDigest) throw fail();
+      if (version !== binding.cliVersion) throw fail();
+      reason = 'scope-digest';
+      if ((await inspectWorkerInstallation(instance, installation)).scopeDigest !== scope.scopeDigest) throw fail();
+      reason = 'driver';
       const profile = adapter.invocationProfiles[binding.profile];
       let mcpRegistry;
       if (profile.transport === 'mcp') {
@@ -979,8 +1163,17 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
       installations[cli] = structuredClone(binding);
       if (record.modelObservations) observations[cli] = structuredClone(record.modelObservations);
       Object.assign(resolvedRegistry, candidateRegistry);
-    } catch { /* One missing/changed installation cannot grant authority or hide qualified peers. */ }
+    } catch (error) {
+      // One rejected installation cannot grant authority or hide qualified peers.
+      const failureReason = reason === 'module-registration' && error?.code === 'WORKER_ADAPTER_CONFLICT'
+        ? 'adapter-conflict' : reason;
+      rejections.push({ registration, reason: failureReason });
+      if (typeof record?.cli === 'string' && /^[a-z][a-z0-9-]{0,62}$/.test(record.cli)) qualificationFailures[record.cli] = failureReason;
+    }
+  }
+  if (!Object.keys(installations).length) {
+    if (!rejections.length) rejections.push({ registration: null, reason: 'no-records' });
+    throw fail();
   }
-  if (!Object.keys(installations).length) throw fail();
-  return { registry: resolvedRegistry, installations, drivers, observations };
+  return { registry: resolvedRegistry, installations, drivers, observations, qualificationFailures };
 }

package/dist/src/models/wrapper-route.js

@@ -47,7 +47,7 @@ export function buildWrapperRouteEnvelope(request) {
         ? [
             `Run this assignment through ${wrapper}.`,
             `Selected capability: ${request.capability.type} ${request.capability.name} (${request.capability.id}).`,
-            `Load it with aiwg show ${request.capability.type === 'workflow' ? 'metadata' : request.capability.type} ${request.capability.id} after discover-first validation.`,
+            `Load it with aiwg show ${request.capability.type === 'workflow' ? 'metadata' : request.capability.type} ${request.capability.id}${request.capability.type === 'workflow' ? '' : ' --body'} after discover-first validation.`,
             `Assignment: ${request.assignment.trim()}`,
             'Return capability evidence, changed artifacts, validation results, and remaining risks.',
         ].join('\n')

package/dist/src/output-modes/registry.js

@@ -5,6 +5,7 @@ import { createHash } from 'node:crypto';
 import { dirname, extname, join, resolve } from 'node:path';
 import { parse, stringify } from 'yaml';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { getWritingChannelPack } from '../writing/channel-packs.js';
 import { WriterProfileStore } from '../writing/writer-profile-store.js';
 import { compileWriterProfile } from '../writing/writer-profile.js';
@@ -14,28 +15,28 @@ const PROTECTED = ['code', 'commands', 'citations', 'quoted-text', 'identifiers'
 const STAGE_ORDER = ['semantic', 'voice', 'controlled-language', 'structure', 'presentation'];
 const modeIdSchema = z.string().regex(MODE_ID_PATTERN, 'must start with a lowercase letter or number and contain only lowercase letters, numbers, dots, or hyphens');
 const uniqueModeIds = z.array(modeIdSchema).refine(values => new Set(values).size === values.length, 'must not contain duplicates');
-const outputModeProfileSchema = z.object({
+const outputModeProfileSchema = z.strictObject({
     id: modeIdSchema,
     version: z.string().min(1),
     description: z.string().min(1),
     kind: z.enum(['voice', 'controlled-language', 'structure', 'presentation']),
     stage: z.enum(STAGE_ORDER),
-    order: z.number().int().optional(),
+    order: integer().optional(),
     instructions: z.string(),
-    provenance: z.object({ source: z.string().min(1), license: z.string().min(1) }).strict(),
-    validation: z.object({
+    provenance: z.strictObject({ source: z.string().min(1), license: z.string().min(1) }),
+    validation: z.strictObject({
         level: z.enum(['advisory', 'validated', 'conformance']),
         hook: z.string().min(1).optional(),
         standardVersion: z.string().min(1).optional(),
-    }).strict(),
+    }),
     compatible: uniqueModeIds.optional(),
     conflicts: uniqueModeIds.optional(),
     requires: uniqueModeIds.optional(),
     supersedes: uniqueModeIds.optional(),
     protectedContent: z.array(z.enum(PROTECTED)).refine(values => new Set(values).size === values.length, 'must not contain duplicates').optional(),
-    contextCost: z.number().int().nonnegative().optional(),
+    contextCost: integer().nonnegative().optional(),
     mergeStrategy: z.literal('weighted-voice').optional(),
-}).strict().superRefine((profile, ctx) => {
+}).superRefine((profile, ctx) => {
     if (profile.validation.level !== 'advisory' && !profile.validation.hook) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['validation', 'hook'], message: `${profile.validation.level} modes require a validator hook` });
     }