@aiwg/cli 2026.10.5 → 2026.10.7

package/tools/agents/providers/warp.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Warp Terminal Provider
  *
@@ -48,6 +49,8 @@ import {
   collectFrameworkArtifacts
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 // ============================================================================
 // Provider Configuration
 // ============================================================================
@@ -206,7 +209,7 @@ export async function deployWarp(targetDir, srcRoot, opts) {
   // Preserve operator sections even for a forced artifact refresh.
   const output = mergeWarpMd(existing, content, false);
   ensureDir(targetDir, opts.dryRun);
-  if (!opts.dryRun) fs.writeFileSync(dest, output);
+  if (!opts.dryRun) writeContextFileSync(dest, output);
 
 }
 

package/tools/agents/providers/windsurf.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Devin Desktop Provider (Windsurf compatibility adapter)
  *
@@ -30,6 +31,7 @@ let fs;
 try { const gfs = _require('graceful-fs'); gfs.gracefulify(realFs); fs = realFs; } catch { fs = realFs; }
 import path from 'path';
 import {
+  withRuleDeployment,
   ensureDir,
   listMdFiles,
   listMdFilesRecursive,
@@ -54,6 +56,8 @@ import {
   deploySoulCompanions
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 // ============================================================================
 // Provider Configuration
 // ============================================================================
@@ -234,6 +238,7 @@ export function mapModel(shorthand, modelCfg, modelsConfig) {
  * Generate AGENTS.md for Windsurf with all agents aggregated
  */
 export function generateAgentsMd(files, destPath, opts) {
+  if (opts.contextFiles === false) return;
   const { dryRun } = opts;
 
   const lines = [];
@@ -283,7 +288,7 @@ export function generateAgentsMd(files, destPath, opts) {
   if (dryRun) {
     console.log(`[dry-run] Would write AGENTS.md with ${agents.length} agents`);
   } else {
-    fs.writeFileSync(destPath, output, 'utf8');
+    writeContextFileSync(destPath, output, 'utf8');
     console.log(`Created AGENTS.md with ${agents.length} agents at ${path.relative(process.cwd(), destPath)}`);
   }
 
@@ -407,7 +412,7 @@ export function generateWindsurfRules(srcRoot, target, opts) {
     console.log(`[dry-run] Would write .windsurf/rules/aiwg-orchestration.md (trigger: always_on)`);
   } else {
     ensureDir(rulesDir);
-    fs.writeFileSync(orchestrationPath, output, 'utf8');
+    writeContextFileSync(orchestrationPath, output, 'utf8');
     console.log(`Created .windsurf/rules/aiwg-orchestration.md (trigger: always_on)`);
   }
 
@@ -428,7 +433,7 @@ export function generateWindsurfRules(srcRoot, target, opts) {
   if (dryRun) {
     console.log(`[dry-run] Would write .windsurfrules (deprecated stub)`);
   } else {
-    fs.writeFileSync(stubPath, stubLines.join('\n'), 'utf8');
+    writeContextFileSync(stubPath, stubLines.join('\n'), 'utf8');
     console.log(`Created .windsurfrules (deprecated stub → .windsurf/rules/aiwg-orchestration.md)`);
   }
 }
@@ -507,6 +512,7 @@ export function deploySkills(skillDirs, targetDir, opts) {
  * Deploy rules as discrete files with trigger: always_on frontmatter injected
  */
 export function deployRules(ruleFiles, targetDir, opts) {
+  if (opts.ruleDelivery) return [];
   const destDir = path.join(targetDir, paths.rules);
   ensureDir(destDir, opts.dryRun);
   cleanupOldRuleFiles(destDir, opts);
@@ -534,6 +540,10 @@ export function getFileExtension(type) {
 // ============================================================================
 
 export async function deploy(opts) {
+  return withRuleDeployment(opts, { name, paths, kernelSkillsPath }, deploySelected);
+}
+
+async function deploySelected(opts) {
   const {
     srcRoot,
     target,

package/tools/cli/workspace-status.mjs

@@ -32,6 +32,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = path.resolve(__dirname, '../..');
 const runtimeRoot = existsSync(path.join(packageRoot, 'src')) ? 'src' : 'dist/src';
+const { readNativeSandboxWarnings } = await importImpl(import.meta.url, 'config/native-sandbox-warnings.js');
 const [{ resolveProjectAiwgDir }, { auditProjectArtifactHealth }] = await Promise.all([
   import(pathToFileURL(path.join(packageRoot, runtimeRoot, 'config/project-artifacts-runtime.mjs')).href),
   import(pathToFileURL(path.join(packageRoot, runtimeRoot, 'config/project-artifacts-health.mjs')).href),
@@ -356,6 +357,7 @@ async function buildWorkspaceStatus(projectRoot) {
   const { rulePinState } = await importImpl(import.meta.url, 'rules/pin-state.js');
   const pins = rulePinState(projectRoot, packageRoot);
   const result = {
+    nativeSandboxWarnings: await readNativeSandboxWarnings(projectRoot).catch(() => []),
     rule_pins: { rules: pins.rules, warnings: pins.warnings },
     decisionOffload: await collectDecisionOffloadReport(projectRoot),
     workspace: {
@@ -545,6 +547,7 @@ async function buildVerificationProbe(projectRoot) {
 
   return {
     schema: 'aiwg.status.probe.v1',
+    nativeSandboxWarnings: workspace.nativeSandboxWarnings,
     rule_pins: workspace.rule_pins,
     generated_at: new Date().toISOString(),
     project_root: path.resolve(projectRoot),
@@ -725,6 +728,7 @@ async function workspaceStatus(args) {
         console.log('='.repeat(60));
         console.log('');
         console.log('No .aiwg/ workspace found in this project.');
+        for (const warning of result.nativeSandboxWarnings) console.log(`Warning: ${warning.message}`);
         console.log('');
         console.log('To create a workspace:');
         console.log('  aiwg use sdlc        # Install SDLC framework');
@@ -741,6 +745,7 @@ async function workspaceStatus(args) {
     }
 
     // Text output
+    for (const warning of result.nativeSandboxWarnings) console.log(`Warning: ${warning.message}`);
     console.log('\nAIWG - Workspace Status');
     console.log('='.repeat(60));
     console.log('');

package/tools/commands/deploy-prompts-codex.mjs

@@ -27,16 +27,14 @@ const _require = createRequire(import.meta.url);
 let fs;
 try { const gfs = _require('graceful-fs'); gfs.gracefulify(realFs); fs = realFs; } catch { fs = realFs; }
 import path from 'path';
+import { fileURLToPath } from 'node:url';
 import os from 'os';
 import { getFrameworksForMode, normalizeDeploymentMode, getAddonSkillDirs, listSkillDirs, collectFrameworkArtifacts } from '../agents/providers/base.mjs';
 
-const CODEX_PROMPTS_DIR = path.join(os.homedir(), '.codex', 'prompts');
-
-function parseArgs() {
-  const args = process.argv.slice(2);
+function parseArgs(args, homeDir) {
   const cfg = {
     source: null,
-    target: CODEX_PROMPTS_DIR,
+    target: path.join(homeDir, '.codex', 'prompts'),
     mode: 'all',
     dryRun: false,
     force: false,
@@ -265,8 +263,8 @@ function getCommandDirectories(srcRoot, mode) {
   return dirs;
 }
 
-(async function main() {
-  const cfg = parseArgs();
+export async function main(args = process.argv.slice(2), internal = {}) {
+  const cfg = parseArgs(args, internal.homeDir || os.homedir());
   const { source, target, mode, dryRun, force, prefix } = cfg;
 
   // Resolve source directory
@@ -333,4 +331,9 @@ function getCommandDirectories(srcRoot, mode) {
     console.log(`\nRestart Codex to load new prompts.`);
     console.log(`Use prompts with: /prompts:${prefix}-<command-name>`);
   }
-})();
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { await main(); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/tools/ralph-external/lib/codex-adapter.mjs

@@ -75,7 +75,7 @@ const MODEL_MAP = {
  */
 export const CODEX_SUPPORTED_VERSIONS = Object.freeze(['0.161.0']);
 export const CODEX_DIRECT_EFFORT_VALUES = Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh']);
-export const CODEX_DIRECT_SANDBOX_MODES = Object.freeze(['read-only', 'workspace-write']);
+export const CODEX_DIRECT_SANDBOX_MODES = Object.freeze(['read-only', 'workspace-write', 'external']);
 /** Non-prompting execution only: a requested `on-request` is refused. */
 export const CODEX_DIRECT_APPROVAL_POLICIES = Object.freeze(['never']);
 /** Brief transport for the direct profile: piped stdin, never argv. */
@@ -195,6 +195,10 @@ export class CodexAdapter extends ProviderAdapter {
     };
   }
 
+  // Worker envNames come from the recorded installation environment, filtered
+  // through both registry allowlists. PATH must survive env -i so Codex can
+  // find the host's AppArmor-approved bwrap and system shell tools.
+
   /**
    * Driver-owned argv after the binary for the version-bound direct-shell
    * profile. Every control is explicit: `--ignore-user-config` (user
@@ -252,7 +256,7 @@ export class CodexAdapter extends ProviderAdapter {
       '--ignore-user-config',
       '-m', model,
       '-c', `model_reasoning_effort=${JSON.stringify(effort)}`,
-      '-s', sandbox,
+      '-s', sandbox === 'external' ? 'danger-full-access' : sandbox,
       '-C', cwd,
       '-c', `approval_policy=${JSON.stringify(approval)}`,
       '--skip-git-repo-check',

package/tools/ralph-external/lib/consecutive-failure-circuit-breaker.mjs

@@ -308,6 +308,9 @@ const HOST_CODES = new Set(['RESOURCE', 'NOT_FOUND', 'SANDBOX']);
 const PROVIDER_CODES = new Set(['NETWORK']);
 const INSTALLATION_CODES = new Set(['AUTH']);
 const MODEL_CODES = new Set(['MODEL']);
+const STATUS_REASON_CODES = new Set(['NOT_FOUND', 'SPAWN_REFUSED', 'RATE_LIMIT', 'RESOURCE', 'SANDBOX',
+  'NETWORK', 'AUTH', 'MODEL', 'UNKNOWN']);
+export const RECOVERY_STATUS_LIMIT = 32;
 
 export const scopeKeyFor = Object.freeze({
   invocation: (id) => `invocation:${id ?? 'unknown'}`,
@@ -511,6 +514,7 @@ export class ScopedFailureBreaker extends EventEmitter {
     this._scopes = new Map();
     this._outstanding = new Map();
     this._hostFailureFacts = [];
+    this._transitions = [];
     this._canarySeq = 0;
     this._observedInvocations = new Set();
     this.canariesObserved = 0;
@@ -1022,6 +1026,10 @@ export class ScopedFailureBreaker extends EventEmitter {
     const from = rec.status;
     if (from === to) return;
     rec.status = to;
+    if (rec.scopeKey.length <= 256) this._transitions.push({ scopeKey: rec.scopeKey, scope: rec.scope, from, to,
+      reasons: [...rec.evidence.keys()].filter(code => STATUS_REASON_CODES.has(code)).slice(0, 8),
+      atMs: this.nowMs(), nextEligibleAtMs: to === 'closed' ? null : rec.nextProbeAtMs });
+    if (this._transitions.length > RECOVERY_STATUS_LIMIT) this._transitions.shift();
     this.emit('transition', { scopeKey: rec.scopeKey, from, to, action,
       distinctFailures: new Set(rec.failures.map(failure => failure.invocationId)).size, reasons: [...rec.evidence.keys()],
       nextEligibleAtMs: rec.nextProbeAtMs, resetAtMs: rec.resetAtMs,
@@ -1454,6 +1462,23 @@ export class ScopedFailureBreaker extends EventEmitter {
     };
   }
 
+  /** Pure status projection: never sweep reservations, probe, or advance state. */
+  recoveryStatus() {
+    const recentKeys = [...new Set(this._transitions.map(event => event.scopeKey).reverse())];
+    const active = [...this._scopes.values()].filter(rec => rec.status !== 'closed');
+    const keys = [...new Set([...active.map(rec => rec.scopeKey), ...recentKeys])];
+    const scopes = keys.filter(key => key.length <= 256).slice(0, RECOVERY_STATUS_LIMIT).map(scopeKey => {
+      const rec = this._scopes.get(scopeKey);
+      const last = this._transitions.findLast(event => event.scopeKey === scopeKey);
+      return { scopeKey, scope: rec?.scope ?? last.scope, state: rec?.status ?? last.to,
+        reasons: rec ? [...rec.evidence.keys()].filter(code => STATUS_REASON_CODES.has(code)).slice(0, 8) : [...last.reasons],
+        nextEligibleAtMs: !rec || rec.status === 'closed' ? null : rec.nextProbeAtMs,
+        canaryInFlight: rec?.activeCanary != null };
+    });
+    return { observedAtMs: this.nowMs(), scopes, omittedScopeCount: Math.max(0, keys.length - scopes.length),
+      transitions: this._transitions.map(event => ({ ...event, reasons: [...event.reasons] })) };
+  }
+
   /** Correlate launcher-observed host faults across resolved inference backends.
    * Replay the first fault once corroborated, preserving the three-distinct
    * threshold even when the first backend alone could not establish scope.
@@ -1550,6 +1575,7 @@ export class ScopedFailureBreaker extends EventEmitter {
 
   destroy() {
     this._hostFailureFacts = [];
+    this._transitions = [];
     for (const rec of this._scopes.values()) rec.breaker.destroy();
     this._scopes.clear();
     this._outstanding.clear();

package/tools/ralph-external/lib/launcher-recovery-evidence.mjs

@@ -3,6 +3,7 @@ import { runRecoveryProbe } from './recovery-probe.mjs';
 /** Recovery evidence observed outside worker output by the launch owner. */
 const observations = new WeakMap();
 const failureHints = new WeakMap();
+const assessed = new WeakSet();
 
 export function recordLauncherRecoveryHint(result, reasonCode) {
   failureHints.set(result, reasonCode);
@@ -23,9 +24,10 @@ export function launcherRecoveryEvidence(result) {
  */
 export async function observeLauncherRecoveryOutcome({ invocation, result, installation, breaker,
   failureHint = '', beforeRequest, onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now, timeoutMs = 10_000 } = {}) {
-  if (!result || result.attemptOutcome !== 'failed' || result.cancelled) return;
+  if (!result || result.attemptOutcome !== 'failed' || result.cancelled || assessed.has(result)) return;
   const backend = invocation?.selected?.inferenceProvider;
   if (HOST_ERRORS.has(result.errorCode) || HOST_RESULTS.has(result.nativeResult)) {
+    assessed.add(result);
     const corroboratedBackends = breaker?.observeHostFailure({ invocationId: result.invocationId,
       inferenceProvider: backend, reasonCode: 'RESOURCE' }) ?? [];
     if (corroboratedBackends.length >= 2) observations.set(result, {
@@ -43,6 +45,10 @@ export async function observeLauncherRecoveryOutcome({ invocation, result, insta
     if (!await beforeRequest()) return;
     const requestTimeoutMs = remaining();
     if (!Number.isFinite(requestTimeoutMs) || requestTimeoutMs <= 0) return;
+    // One diagnostic request per attempt, including unsuccessful diagnostics.
+    // Re-reading a result cannot consume allowance or create fresh evidence.
+    if (assessed.has(result)) return;
+    assessed.add(result);
     const observed = await runRecoveryProbe({ driver: { qualification: { installation } }, invocation: invocation ?? { transport: 'shell' },
       timeoutMs: Math.min(10_000, requestTimeoutMs), maxOutputBytes: 65_536, onDispatch, fetchImpl, wallNowMs });
     if (observed.reason === 'probe-rate-limited') {

package/tools/ralph-external/lib/muse-adapter.mjs

@@ -162,12 +162,15 @@ export class MuseAdapter extends ProviderAdapter {
     }
     let schema;
     try { schema = JSON.parse(profile.controls.structuredOutput.mapping); } catch { /* unavailable mapping blocks */ }
-    if (!Array.isArray(schema) || schema.length !== 2 || schema[0] !== '--output-schema'
-      || typeof schema[1] !== 'string' || !path.isAbsolute(schema[1]) || schema[1].includes('\0') || schema[1].split(path.sep).includes('..')) {
+    const directText = profile.controls.structuredOutput.mapping === '[]'
+      && profile.controls.structuredOutput.support === 'unqualified';
+    if (!directText && (!Array.isArray(schema) || schema.length !== 2 || schema[0] !== '--output-schema'
+      || typeof schema[1] !== 'string' || !path.isAbsolute(schema[1]) || schema[1].includes('\0') || schema[1].split(path.sep).includes('..'))) {
       throw new Error('Muse requires a host-bound output-schema control mapping');
     }
     if (!permissions || !['read-only', 'workspace-write', 'external'].includes(permissions.sandbox)
       || !Number.isSafeInteger(health?.maxSteps) || health.maxSteps < 1) throw new Error('Muse requires bounded steps and sandbox authority');
+    if ((permissions.approval ?? 'never') !== 'never') throw new Error('Muse direct worker approval requires never');
     // Trust is a host-owned, qualification-bound control, like the schema.
     // Brief contents and CLI defaults cannot opt into workspace instructions.
     let trust;
@@ -179,6 +182,7 @@ export class MuseAdapter extends ProviderAdapter {
       '--workspace', cwd, ...trust, '--approval-mode', 'never', '--approval-judge', 'off', '--max-model-steps', String(health.maxSteps),
       ...schema, '--prompt-file', briefPath];
     if (permissions.sandbox === 'read-only') args.push('--disable-write', '--disable-shell');
+    if (permissions.sandbox === 'external') args.push('--disable-sandbox');
     return args;
   }
 
@@ -361,4 +365,10 @@ export class MuseAdapter extends ProviderAdapter {
 
 registerProvider('muse', () => new MuseAdapter());
 
+/** Installed worker module contract; legacy registration above remains supported. */
+export const interfaceVersion = 1;
+export function register(factory) {
+  factory('muse', () => new MuseAdapter());
+}
+
 export default MuseAdapter;

package/tools/ralph-external/lib/recovery-probe.mjs

@@ -1,6 +1,8 @@
+import { RecoveryPolicy } from './consecutive-failure-circuit-breaker.mjs';
+
 /** A recovery probe is a conductor-owned request, never an uncontained worker. */
 export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000, maxOutputBytes = 65_536,
-  onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now }) {
+  onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now, nowMs = () => performance.now() }) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 10_000
     || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1 || maxOutputBytes > 65_536) {
     throw new RangeError('Recovery probe exceeds the 10s/64KiB bounds');
@@ -19,6 +21,7 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
     return failed('probe-endpoint-unavailable', { operatorIntervention: true });
   }
   const controller = new AbortController();
+  const deadlineMs = nowMs() + timeoutMs;
   const timer = setTimeout(() => controller.abort(), Math.max(1, Math.floor(timeoutMs)));
   let aborted;
   const timeout = new Promise((_, reject) => {
@@ -30,14 +33,19 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
   timeout.catch(() => {});
   try {
     await onDispatch?.();
+    if (nowMs() >= deadlineMs) controller.abort();
     if (controller.signal.aborted) return failed('probe-timeout');
     try {
       // HEAD has no task, credentials, inference body or worker filesystem.
       // A successful endpoint check permits only one subsequent task canary.
       const response = await Promise.race([fetchImpl(endpoint, { method: 'HEAD', redirect: 'error', signal: controller.signal }), timeout]);
       let headerBytes = 16 + Buffer.byteLength(response.statusText ?? '');
-      for (const [name, value] of response.headers) headerBytes += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
       try {
+        if (nowMs() >= deadlineMs) { controller.abort(); return failed('probe-timeout'); }
+        for (const [name, value] of response.headers) {
+          headerBytes += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
+          if (headerBytes > maxOutputBytes) return failed('probe-output-limit');
+        }
         if (headerBytes > maxOutputBytes) return failed('probe-output-limit');
         if (response.body) return failed('probe-body-unexpected');
         const success = response.status >= 200 && response.status <= 299;
@@ -45,7 +53,8 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
         if (response.status === 429) {
           const after = response.headers.get('retry-after');
           const seconds = after != null && /^\d+(?:\.\d+)?$/.test(after.trim()) ? Number(after) : null;
-          const date = seconds === null && after ? Date.parse(after) : NaN;
+          const date = seconds === null && /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(after ?? '')
+            ? Date.parse(after) : NaN;
           const reset = response.headers.get('x-ratelimit-reset');
           const resetEpoch = reset != null && /^\d+(?:\.\d+)?$/.test(reset.trim()) ? Number(reset) * 1000 : NaN;
           const resetDelay = response.headers.get('ratelimit-reset');
@@ -53,7 +62,8 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
             Number.isFinite(resetEpoch) ? (resetEpoch - wallNowMs()) / 1000 : null,
             resetDelay != null && /^\d+(?:\.\d+)?$/.test(resetDelay.trim()) ? Number(resetDelay) : null]
             .filter(value => Number.isFinite(value) && value >= 0);
-          return failed('probe-rate-limited', { retryAfterSeconds: delays.length ? Math.max(...delays) : null });
+          return failed('probe-rate-limited', { retryAfterSeconds: delays.length
+            ? Math.min(RecoveryPolicy.maxRetryAfterSeconds, Math.max(...delays)) : null });
         }
         return failed('probe-failed', { status: response.status });
       } finally {

package/tools/ralph-external/lib/worker-health.mjs

@@ -123,7 +123,7 @@ export function createWorkerHealthObserver(options = {}) {
   const replayedKeys = new Set();
   const events = [];
   const gaps = [];
-  let sequence = 0, generation = 0, steps = null, total = 0, lastCheck = started, maxGap = 0;
+  let sequence = 0, generation = options.observerGeneration ?? 0, steps = null, total = 0, lastCheck = started, maxGap = 0;
   let observed = null, activity = null, progress = null, heartbeat = null, handshakeAt = null, stalledAt = null;
   let state = 'launching', handshake = 'unobserved', confidence = 'unobserved', reasonCode = 'AWAITING_HANDSHAKE';
   let termination = 'running', transitionCount = 0, live = null, disconnected = false, finalized = false;

package/tools/ralph-external/lib/worker-isolation.mjs

@@ -1,8 +1,10 @@
 /**
  * Worker process isolation for Tier 0 direct dispatch (FR-OG-108, #2954).
  *
- * Direct workers must never share the conductor's cgroup: on the titan host
- * an oomd kill of one shared cgroup took the conductor session with it.
+ * Direct workers default to a separate cgroup: on the titan host an oomd
+ * kill of one shared cgroup took the conductor session with it. Explicit
+ * native-sandbox policy instead uses an owned process group and the CLI's
+ * sandbox, without a cgroup memory limit or descendant kill scope.
  * This module builds `systemd-run --user` launch arguments (own unit or
  * scope with `MemoryMax` and `MemorySwapMax=0`, PATH/HOME passthrough,
  * stdin `/dev/null`) and, where no systemd user manager exists, returns an
@@ -40,6 +42,50 @@ import { buildSystemdClientEnv, resolveSystemdClient, resolveSystemdRun, CONNECT
 
 const UNIT_SAFE = /[^A-Za-z0-9:_.@-]/g;
 const transportBootstrapVariables = ['NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'LD_LIBRARY_PATH', 'LD_AUDIT', 'LD_DEBUG', 'LD_DEBUG_OUTPUT'];
+const nativeSandboxProbes = new Map();
+let nativeSandboxProbeSequence = 0;
+export const NATIVE_SANDBOX_UNAVAILABLE = 'OG_NATIVE_SANDBOX_UNAVAILABLE';
+
+export function workerNeedsNativeNamespaces(adapter, permissions = {}, platform = process.platform) {
+  return platform === 'linux' && adapter?.provider === 'codex'
+    && (permissions.transport ?? 'shell') === 'shell'
+    && ['read-only', 'workspace-write'].includes(permissions.sandbox ?? 'workspace-write');
+}
+
+export function nativeSandboxFailure(text) {
+  return /loopback: Failed RTM_NEWADDR: Operation not permitted|uid_map[^\n]*Operation not permitted/i.test(text);
+}
+
+export function nativeSandboxProbeMessage(result) {
+  return `${NATIVE_SANDBOX_UNAVAILABLE}: Native sandbox unavailable: restricted unprivileged user namespaces inside systemd user units (host AppArmor policy may restrict userns). Probe: ${String(result.detail ?? 'failed').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512)}. Select parallelism.groups.<group>.execution.launchMode="native-sandbox" with a verified enforcing CLI sandbox, or configure a host AppArmor allowance for the systemd worker launch path.`;
+}
+
+/** No inference: exercise user/network namespaces through the worker's unit and client environment path. */
+export function probeWorkerNativeSandbox({ spawn = spawnSync, env = process.env, envNames = ['PATH', 'HOME'], cwd,
+  cache = spawn === spawnSync ? nativeSandboxProbes : undefined } = {}) {
+  const key = JSON.stringify([cwd, [...envNames].sort()]);
+  if (cache?.has(key)) return cache.get(key);
+  let result;
+  try {
+    const managerEnvNames = resolveManagerEnvNames({ spawn });
+    const command = process.execPath;
+    const args = [fileURLToPath(import.meta.url), '--worker-environment', JSON.stringify(unitEnvironmentNames(envNames)),
+      '--', '/usr/bin/unshare', '--user', '--map-root-user', '--net', '/usr/bin/true'];
+    const argv = buildWorkerIsolationArgs({ unit: proposeWorkerUnitName(`sandbox-probe-${process.pid}-${++nativeSandboxProbeSequence}`),
+      command, args, cwd, env, envNames, managerEnvNames, memoryMaxGb: 0.25, attached: true,
+      extraProperties: ['RuntimeMaxSec=5s', 'TimeoutStopSec=1s'] });
+    const observed = spawn(resolveSystemdRun(), ['--collect', ...argv.slice(1)], {
+      encoding: 'utf8', timeout: 8000, maxBuffer: 4096, env: buildSystemdClientEnv({ env, envNames }) });
+    result = observed.status === 0 && !observed.error ? { ok: true, mode: 'systemd-unit' }
+      : { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
+        detail: String(observed.error?.message ?? (String(observed.stderr ?? '').trim() || `exit ${observed.status}`)).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
+  } catch (error) {
+    result = { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
+      detail: String(error.message).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
+  }
+  cache?.set(key, result);
+  return result;
+}
 
 /** Derive a unit-safe `aiwg-worker-<name>-<epoch>` unit name. */
 export function proposeWorkerUnitName(name, nowSeconds = Math.floor(Date.now() / 1000)) {
@@ -340,6 +386,7 @@ export function launchIsolatedWorker({
   config,
   allowDegraded = false,
   isolation,
+  workerGroup,
   kind = 'unit',
   attached = false,
   spawn = spawnSync,
@@ -368,6 +415,15 @@ export function launchIsolatedWorker({
     return { launched: false, blocked: true, failures: resolvedGate.failures ?? [], gate: resolvedGate };
   }
   const detected = isolation ?? detectWorkerIsolation({ spawn });
+  const nativeSandbox = detected.mode === 'native-sandbox';
+  if (nativeSandbox) {
+    const execution = config?.parallelism?.groups?.[workerGroup]?.execution;
+    if (execution?.launchMode !== 'native-sandbox' || !['read-only', 'workspace-write'].includes(execution.sandbox)
+      || (execution.transport ?? 'shell') !== 'shell' || !attached || !ownedGroup) {
+      throw Object.assign(new Error('native-sandbox requires policy opt-in and an owned attached process group with an enforcing native sandbox'),
+        { code: 'OG_POLICY_RELAXATION' });
+    }
+  }
   if (detected.mode === 'degraded' && !allowDegraded) {
     return {
       launched: false,
@@ -376,7 +432,7 @@ export function launchIsolatedWorker({
       gate: resolvedGate,
     };
   }
-  if (detected.mode === 'degraded') {
+  if (detected.mode === 'degraded' || nativeSandbox) {
     assertAbsolute('worker binary', command);
     if (cwd !== undefined) assertAbsolute('working directory', cwd);
     if (stdinPath !== undefined) assertAbsolute('stdin brief', stdinPath);
@@ -385,7 +441,7 @@ export function launchIsolatedWorker({
     if (!Array.isArray(args) || args.some(token => typeof token !== 'string' || token.includes('\0'))) {
       throw new Error('Worker isolation argv must be NUL-free strings');
     }
-    // Degraded mode has no systemd unit to confine the environment, so this
+    // Process-group modes have no systemd unit to confine the environment, so this
     // module builds the allowlisted environment itself and passes it as the
     // child's *entire* environment (the `env` option replaces, never merges
     // with, the current process environment) — the functional equivalent of
@@ -441,12 +497,12 @@ export function launchIsolatedWorker({
       }
       const result = _runDispatchCommit(onDispatchCommit, () => {
         const child = spawnAsync(launchCommand, launchArgs, launchOptions);
-        onSpawnAttempt?.({ mode: 'degraded', child, pid: child.pid });
+        onSpawnAttempt?.({ mode: detected.mode, child, pid: child.pid });
         const outcome = {
           launched: Number.isInteger(child.pid) && child.pid > 0,
-          mode: 'degraded', child, pid: child.pid,
+          mode: detected.mode, child, pid: child.pid,
           ...(attached ? { transportSupervisor: true } : {}),
-          diagnostic: `launched without resource confinement: ${detected.reason}`,
+          diagnostic: nativeSandbox ? 'Native CLI sandbox boundary; no cgroup resource confinement' : `launched without resource confinement: ${detected.reason}`,
           gate: resolvedGate,
         };
         // Preserve launch errors even when callers attach listeners later.
@@ -661,8 +717,8 @@ export function runWorkerTransport({ command, args, environment, record,
 }
 
 // Private attached transport entry, never a public CLI or legacy Ralph route.
-// The systemd unit owns this supervisor and its worker; cgroup exit evidence
-// includes descendants. Only the actual worker receives the allowed values.
+// The unit or launcher-owned process group owns this supervisor and worker.
+// Only unit cgroup exit evidence covers descendants. The worker receives only allowed values.
 if (process.argv[1] === fileURLToPath(import.meta.url) && process.argv[2] === '--worker-environment') {
   process.umask(0o077);
   const names = JSON.parse(process.argv[3]);