@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/models/model-capabilities.v1.json

@@ -510,7 +510,7 @@
             "approval_policy=\"${approval}\"",
             "--skip-git-repo-check",
             "-o",
-            "${final}",
+            "${final}.last-message",
             "--json",
             "-"
           ],
@@ -575,7 +575,7 @@
               },
               "finalOutput": {
                 "support": "unqualified",
-                "mapping": "[-o/--output-last-message F] last-message file; --json carries the JSONL thread/turn/item/error event stream on stdout",
+                "mapping": "[-o/--output-last-message F.last-message] launcher-owned last-message capture, separate from worker-written workerClaims JSON at F (brief output.resultPath / --final-output); --json carries the JSONL thread/turn/item/error event stream on stdout",
                 "evidence": "H: codex-cli 0.161.0 exec --help documents -o/--output-last-message and --json; unqualified until live evidence"
               },
               "stdin": {
@@ -1606,7 +1606,7 @@
               "Unknown model, effort, permission or required step mappings block dispatch.",
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "There is NO `oz` symlink on the evidenced host: the real executable is `warp-terminal`, with `agent run` etc. as its subcommands; `runtimeDriver`/`executable` are pinned to that, not to a bare `oz`.",
-              "BRIEF TRANSPORT IS BLOCKED PENDING A SHARED CHANGE: `--prompt` places the brief on argv (never emitted by this profile); `-f/--file` is NOT a member of the required `<--prompt|--saved-prompt|--task-id|--skill>` group (live probe, 2026-10-11) and its own config-file schema is undocumented, so it cannot be assumed to carry the brief; `--skill` is the only remaining required-group member that can carry free text (`agent run --help`: 'Use a skill as the base prompt for the agent' when given without `--prompt`), but its search root relative to `--cwd` and behavior when the skill is missing are UNVERIFIED behind the login gate. The pure adapter derives a distinct `aiwg-brief-<invocationId>` path without writes and refuses unsafe IDs. `buildWarpBriefSkillFile()` (tools/ralph-external/lib/warp-adapter.mjs) exports the exact path/content an execution-time file-generation primitive would need to write before this argv runs; that primitive does not exist in the shared session-launcher today (the same class of gap as #2998 for Antigravity's stdin frame). Needed shared change: an execution-time generated-artifact primitive the session-launcher can call with the adapter-exported `{ relativePath, content }` immediately before spawning the worker process, with invocation identity supplied to the adapter, refusal to overwrite an existing path, cleanup afterward, and no commits of generated skills (pending #3002). Brief transport is NOT available today.",
+              "Brief delivery is wired through buildWorkerArtifacts and the shared session launcher: one bounded workspace-relative .agents/skills/aiwg-brief-<invocationId>/SKILL.md file, exclusive creation, no symlink components, collision preservation and cleanup on failure, completion or stop. The same invocation ID binds --skill and the artifact path; brief text never rides argv. Real skill search relative to --cwd and missing-skill behavior remain UNVERIFIED behind authentication; synthetic file-delivery tests do not qualify the profile.",
               "`--environment`/`-e` (cloud environment/runner) and `--harness claude|codex` (third-party harness mode) are documented but NEVER emitted by this profile; the cloud subcommand is also never emitted. Execution location is unverified until an authenticated run.",
               "`--no-snapshot` is always emitted: `agent run --help` documents it as disabling the end-of-run workspace snapshot upload. This flag does not establish execution location or absence of other uploads.",
               "No live success/error output was observed (no login on the evidenced host): `finalOutput`/`structuredOutput` support is grade H/R only, never upgraded past `unqualified`."
@@ -3326,6 +3326,200 @@
       }
     }
   },
+  "workerAdapters": {
+    "local-http": {
+      "version": 1,
+      "id": "local-http",
+      "provider": "ollama",
+      "adapterVersion": "1",
+      "supportedVersions": "8.18.0",
+      "runtimeDriver": "installed:local-http",
+      "catalogAdapter": {
+        "kind": "http",
+        "locator": "/api/tags",
+        "parser": "ollama-model-list-v1",
+        "timeoutSeconds": 10,
+        "maxBytes": 65536
+      },
+      "invocation": {
+        "kind": "process",
+        "executable": "curl",
+        "argv": [
+          "-q",
+          "-sS",
+          "--max-redirs",
+          "0",
+          "--proto",
+          "=http",
+          "--noproxy",
+          "*",
+          "--connect-timeout",
+          "10",
+          "--max-time",
+          "300",
+          "--max-filesize",
+          "10485760",
+          "--fail-with-body",
+          "-H",
+          "Content-Type: application/json",
+          "-X",
+          "POST",
+          "http://${endpoint}/api/generate",
+          "--data-binary",
+          "@-"
+        ],
+        "stdin": "adapter-frame",
+        "cwd": "${workspace}",
+        "envAllowlist": [
+          "OLLAMA_HOST"
+        ],
+        "versionArgv": [
+          "--version"
+        ],
+        "versionPattern": "^curl ([0-9A-Za-z.+-]{1,128}) [\\s\\S]{1,4096}$",
+        "maxOutputBytes": 10485760
+      },
+      "capabilities": {
+        "output": "validated-file",
+        "modelPin": "requested",
+        "effort": "not-applicable",
+        "cancel": "process-group",
+        "resume": false,
+        "sandboxModes": [
+          "external"
+        ],
+        "nestedAgentsControllable": true,
+        "nativeFallbackControllable": true,
+        "hardBudget": []
+      },
+      "qualification": {
+        "status": "unqualified"
+      },
+      "invocationProfiles": {
+        "direct-http": {
+          "transport": "shell",
+          "supportedVersions": "8.18.0",
+          "controls": {
+            "model": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "effort": {
+              "support": "not-applicable",
+              "mapping": "unavailable: explicit effort is refused; null effort and empty effort lists only",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "sandbox": {
+              "support": "external",
+              "mapping": "unavailable natively: requires a host OS/executor boundary; local endpoint does not prove local inference",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "approval": {
+              "support": "external",
+              "mapping": "unavailable natively: curl has no approval or permission system; the host authorizes the single text-only POST",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "workdir": {
+              "support": "external",
+              "mapping": "host spawns curl in the resolved absolute workspace; no server-side workspace control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "finalOutput": {
+              "support": "external",
+              "mapping": "host captures stdout and validates the original envelope and extracted worker claims; no server output-file control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stdin": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "structuredOutput": {
+              "support": "external",
+              "mapping": "unavailable server schema control; host strict claims parser validates the extracted response",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stepCap": {
+              "support": "unqualified",
+              "mapping": "unavailable: no model step cap; curl time and size bounds are not a step cap",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "trust": {
+              "support": "native",
+              "mapping": "-q",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "children": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "fallback": {
+              "support": "native",
+              "mapping": "[\"--max-redirs\",\"0\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            }
+          },
+          "envAllowlist": [
+            "OLLAMA_HOST"
+          ],
+          "pitfalls": [
+            "One text-only POST /api/generate, stream:false, explicit model and no tools, child-agent API or fallback request. Coding and explicit effort are refused.",
+            "The model control binds the resolved model in the adapter-frame JSON body; argv contains no model or brief.",
+            "No Ollama CLI, server start or weight-download command is invoked, including for disabled members. Server-side downloads, inference locality and backend identity remain unqualified.",
+            "curl 8.18.0 is the executable version; Ollama 0.33.3 response fields and done_reason=stop remain provisional pending the conductor smoke.",
+            "No native sandbox or approval system exists; external workspace/capture/validation controls require an enforcing host boundary.",
+            "No streaming health grammar, progress, session log, server cancellation, resume or model step cap is available. Owned curl exit is not proof of remote server stop."
+          ],
+          "health": {
+            "version": 1,
+            "handshake": "process-only",
+            "outputFraming": "final-json",
+            "signalParser": "unavailable",
+            "sessionLogLocator": null,
+            "progressEvidence": [],
+            "stopEvidence": "owned curl process identity and observed exit only; remote server cancellation unavailable",
+            "fixtureRef": "test/fixtures/providers/local-http/health/manifest.json",
+            "qualifiedAt": null,
+            "statusOperation": null,
+            "cancelOperation": null,
+            "coverage": "degraded",
+            "qualificationTarget": "unobserved",
+            "evidenceGrades": [
+              "H",
+              "R"
+            ],
+            "provenance": [
+              {
+                "kind": "help",
+                "ref": "docs/providers/ollama-direct.md",
+                "observedAt": "2026-10-09T00:00:00Z",
+                "cliVersion": "8.18.0"
+              },
+              {
+                "kind": "repository",
+                "ref": "tools/ralph-external/lib/ollama-adapter.mjs",
+                "observedAt": "2026-10-26T00:00:00Z",
+                "cliVersion": null
+              }
+            ],
+            "qualificationOwner": "B-OG-09",
+            "qualification": {
+              "status": "unqualified",
+              "scopeDigest": null,
+              "cliVersion": null,
+              "accountScope": null,
+              "profileRef": null,
+              "modelKey": null,
+              "effort": null,
+              "authorizedLive": false
+            }
+          }
+        }
+      }
+    }
+  },
   "workerHealthAdapters": {
     "local-http": {
       "version": 1,

package/dist/src/models/provider-policy.js

@@ -14,6 +14,8 @@ import { createRequire } from 'node:module';
 import { compileWorkerVersionPattern, workerVersionRangeMismatch } from './worker-installation.mjs';
 import { normalizeProviderDefinitionId } from '../providers/provider-definitions.js';
 import { qualificationDigest } from './qualification-digest.mjs';
+import { DEFAULT_WORKER_SELECTION, WorkerSelectionPolicySchema, workerModelKey, ownWorkerRoleGuidance } from './worker-selection-policy.js';
+export { DEFAULT_WORKER_SELECTION, WorkerSelectionPolicySchema, mergeWorkerSelection, workerModelKey, isCanonicalWorkerModelKey } from './worker-selection-policy.js';
 const require = createRequire(import.meta.url);
 function requireModelResource(filename) {
     const candidates = [
@@ -183,156 +185,6 @@ const PolicySchema = z.strictObject({
     effort: z.enum(['minimal', 'low', 'medium', 'high', 'xhigh']).optional(),
     override: z.string().min(1).optional(),
 });
-const uniqueStrings = z.array(z.string().min(1)).refine(values => new Set(values).size === values.length, 'Duplicate entries');
-const WorkerDataPolicySchema = z.strictObject({
-    allowedProcessing: z.array(z.enum(['local', 'remote'])).refine(values => new Set(values).size === values.length).optional(),
-    allowProductImprovement: z.boolean().optional(),
-    allowUnknown: z.boolean().optional(),
-    maxRetentionDays: integer().nonnegative().optional(),
-});
-const WorkerRoleSchema = z.strictObject({
-    groups: uniqueStrings.refine(values => values.length > 0),
-    tier: z.enum(['economy', 'standard', 'premium', 'max-quality']),
-    initialEffort: z.string().min(1).nullable(),
-    effortLadder: uniqueStrings,
-    escalateAfter: integer().positive().optional(),
-    maxEscalations: integer().nonnegative().optional(),
-    deescalateAfter: integer().positive().optional(),
-    allowNotApplicableEffort: z.boolean().optional(),
-});
-export const WorkerSelectionPolicySchema = z.strictObject({
-    roleGuidance: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerRoleSchema).optional(),
-    guards: z.strictObject({
-        deniedEfforts: uniqueStrings.optional(),
-        deniedModels: uniqueStrings.optional(),
-        denySelfDelegation: z.boolean().optional(),
-        requireExactModel: z.boolean().optional(),
-        allowedVisibility: z.array(z.enum(['listed', 'hidden'])).refine(v => new Set(v).size === v.length).optional(),
-        allowedLifecycle: z.array(z.enum(['active', 'deprecated'])).refine(v => new Set(v).size === v.length).optional(),
-        minimumIdentityEvidence: z.enum(['runtime-configured', 'backend-attested']).optional(),
-    }).optional(),
-    dataPolicy: WorkerDataPolicySchema.optional(),
-    dataClasses: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), WorkerDataPolicySchema).optional(),
-    freshness: z.strictObject({
-        warnHours: integer().positive().optional(),
-        blockHours: integer().positive().optional(),
-        policyDays: integer().positive().optional(),
-    }).optional(),
-    taskClasses: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), z.string().min(1)).optional(),
-}).superRefine((policy, context) => {
-    for (const [role, guidance] of Object.entries(policy.roleGuidance ?? {})) {
-        if (!['efficiency', 'coding', 'reasoning'].includes(role))
-            context.addIssue({ code: 'custom', path: ['roleGuidance', role], message: 'Unknown worker role' });
-        if (guidance.effortLadder.includes('none') || (guidance.initialEffort === 'none' ? guidance.effortLadder.length !== 0 : guidance.initialEffort !== null && !guidance.effortLadder.includes(guidance.initialEffort))) {
-            context.addIssue({ code: 'custom', path: ['roleGuidance', role], message: 'Initial effort must belong to the ladder; real none requires an empty ladder' });
-        }
-        if (guidance.initialEffort === null && (guidance.allowNotApplicableEffort !== true || guidance.effortLadder.length !== 0)) {
-            context.addIssue({ code: 'custom', path: ['roleGuidance', role], message: 'Null effort requires an empty ladder and allowNotApplicableEffort=true' });
-        }
-    }
-    for (const key of policy.guards?.deniedModels ?? []) {
-        if (!isCanonicalWorkerModelKey(key))
-            context.addIssue({ code: 'custom', path: ['guards', 'deniedModels'], message: 'Noncanonical inference model key' });
-    }
-    if (policy.freshness?.warnHours !== undefined && policy.freshness.blockHours !== undefined && policy.freshness.warnHours > policy.freshness.blockHours) {
-        context.addIssue({ code: 'custom', path: ['freshness'], message: 'warnHours must not exceed blockHours' });
-    }
-    for (const role of Object.values(policy.taskClasses ?? {})) {
-        if (!['coding', 'reasoning', 'efficiency'].includes(role))
-            context.addIssue({ code: 'custom', path: ['taskClasses'], message: 'Unknown worker role' });
-    }
-});
-/** Canonical RFC3986 identity; installation and account never enter the key. */
-export function workerModelKey(inferenceProvider, apiModelId) {
-    if (!/^[a-z][a-z0-9-]{0,62}$/.test(inferenceProvider) || !apiModelId)
-        throw new Error('OG_CONFIG_REFERENCE: invalid inference model identity');
-    return `${inferenceProvider}/${encodeURIComponent(apiModelId).replace(/[!'()*]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)}`;
-}
-export function isCanonicalWorkerModelKey(key) {
-    const slash = key.indexOf('/');
-    try {
-        return slash > 0 && workerModelKey(key.slice(0, slash), decodeURIComponent(key.slice(slash + 1))) === key;
-    }
-    catch {
-        return false;
-    }
-}
-export const DEFAULT_WORKER_SELECTION = {
-    guards: { deniedEfforts: ['ultra'], deniedModels: [], denySelfDelegation: true, requireExactModel: true, allowedVisibility: ['listed'], allowedLifecycle: ['active'], minimumIdentityEvidence: 'runtime-configured' },
-    dataPolicy: { allowedProcessing: ['local', 'remote'], allowProductImprovement: false, allowUnknown: false },
-    freshness: { warnHours: 24, blockHours: 168, policyDays: 30 },
-    taskClasses: { inventory: 'efficiency', implementation: 'coding', architecture: 'reasoning', review: 'reasoning' },
-};
-/** Merge leaves, preserving pre-merge explicit origins and attempted relaxations. */
-export function mergeWorkerSelection(layers) {
-    const policy = {};
-    const origins = {};
-    const diagnostics = [];
-    const visit = (target, input, parts, layer) => {
-        for (const [key, value] of Object.entries(input)) {
-            const path = [...parts, key];
-            const pointer = `/defaults/workerSelection/${path.map(p => p.replace(/~/g, '~0').replace(/\//g, '~1')).join('/')}`;
-            if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
-                target[key] ??= {};
-                visit(target[key], value, path, layer);
-                continue;
-            }
-            const origin = { source: layer.source, authority: layer.authority, digest: layer.digest, pointer, contribution: structuredClone(value) };
-            const prior = origins[pointer] ?? [];
-            const explicit = prior.filter(o => o.authority !== 'builtin');
-            let effective = structuredClone(value);
-            let relaxation = false;
-            if (layer.authority !== 'builtin' && explicit.length > 0) {
-                const previous = target[key];
-                if (['deniedEfforts', 'deniedModels'].includes(key))
-                    effective = [...new Set([...previous, ...value])];
-                else if (['allowedVisibility', 'allowedLifecycle', 'allowedProcessing'].includes(key)) {
-                    relaxation = value.some((v) => !previous.includes(v));
-                    effective = previous.filter((v) => value.includes(v));
-                }
-                else if (['denySelfDelegation', 'requireExactModel'].includes(key)) {
-                    relaxation = previous === true && value === false;
-                    effective = previous || value;
-                }
-                else if (['allowUnknown', 'allowProductImprovement'].includes(key)) {
-                    relaxation = previous === false && value === true;
-                    effective = previous && value;
-                }
-                else if (['maxRetentionDays', 'warnHours', 'blockHours', 'policyDays'].includes(key)) {
-                    relaxation = value > previous;
-                    effective = Math.min(previous, value);
-                }
-                else if (key === 'minimumIdentityEvidence') {
-                    relaxation = previous === 'backend-attested' && value !== previous;
-                    effective = previous === 'backend-attested' ? previous : value;
-                }
-            }
-            if (relaxation)
-                diagnostics.push({ code: 'OG_POLICY_RELAXATION', pointer, message: 'Explicit restriction cannot relax an inherited restriction', origins: [...explicit, origin] });
-            target[key] = effective;
-            origins[pointer] = [...prior, origin];
-        }
-    };
-    for (const layer of layers)
-        if (layer.policy)
-            visit(policy, layer.policy, [], layer);
-    const validation = WorkerSelectionPolicySchema.safeParse(policy);
-    if (!validation.success)
-        for (const issue of validation.error.issues)
-            diagnostics.push({ code: 'OG_CONFIG_REFERENCE', pointer: `/defaults/workerSelection/${issue.path.join('/')}`, message: issue.message });
-    // Data classes are applied as further restrictions to the base path.
-    for (const dataClass of Object.values(policy.dataClasses ?? {})) {
-        const base = policy.dataPolicy ?? {};
-        if (dataClass.allowedProcessing)
-            dataClass.allowedProcessing = dataClass.allowedProcessing.filter(p => !base.allowedProcessing || base.allowedProcessing.includes(p));
-        for (const key of ['allowUnknown', 'allowProductImprovement'])
-            if (base[key] === false)
-                dataClass[key] = false;
-        if (base.maxRetentionDays !== undefined)
-            dataClass.maxRetentionDays = Math.min(dataClass.maxRetentionDays ?? base.maxRetentionDays, base.maxRetentionDays);
-    }
-    return { policy, origins, diagnostics };
-}
 const UserProjectModelConfigSchema = z.looseObject({
     defaults: z.strictObject({
         tier: z.enum(['economy', 'standard', 'premium', 'max-quality']).optional(),
@@ -435,7 +287,7 @@ export class WorkerRoleEffortError extends WorkerPolicyError {
 /** Validate policy input before entering the sanitized adapter boundary. Null
  * remains valid for models whose effort is explicitly not applicable. */
 export function assertWorkerRoleEffort(policy, role, requiresExplicit = false) {
-    const effort = policy?.roleGuidance?.[role]?.initialEffort;
+    const effort = ownWorkerRoleGuidance(policy, role)?.initialEffort;
     if (effort === undefined || requiresExplicit && (effort === null || !effort.trim()))
         throw new WorkerRoleEffortError(role);
 }
@@ -459,7 +311,7 @@ export function assertWorkerSelectionAllowed(selected, context) {
     const observation = context.modelObservation ?? context.defaultObservation;
     if (!observation)
         throw new WorkerPolicyError('OG_MODEL_UNAPPROVED', 'Worker invocation requires model or default observation evidence');
-    const guidance = context.role ? policy.roleGuidance?.[context.role] : undefined;
+    const guidance = context.role ? ownWorkerRoleGuidance(policy, context.role) : undefined;
     if (isWorkerNullEffortDenied(selected.effort.value, observation, guidance)) {
         throw new WorkerPolicyError('OG_EFFORT_DENIED', 'Worker invocation denied effort: null effort requires qualified absence of an effort control');
     }
@@ -907,7 +759,7 @@ function isWorkerNullEffortDenied(effort, observation, guidance) {
 }
 function workerRouteDataPolicy(policy, dataClass) {
     const data = { ...DEFAULT_WORKER_SELECTION.dataPolicy, ...policy.dataPolicy };
-    const narrowed = dataClass ? policy.dataClasses?.[dataClass] : undefined;
+    const narrowed = dataClass && policy.dataClasses && Object.hasOwn(policy.dataClasses, dataClass) ? policy.dataClasses[dataClass] : undefined;
     if (narrowed) {
         if (narrowed.allowedProcessing)
             data.allowedProcessing = data.allowedProcessing?.filter(p => narrowed.allowedProcessing.includes(p));
@@ -956,8 +808,8 @@ export function validateWorkerPolicyRoute(input) {
             message: `Conflicting optional model evidence remains unknown: ${observation.conflicts.map(conflict => conflict.field).join(', ')}`,
         });
     const guards = input.policy.guards ?? DEFAULT_WORKER_SELECTION.guards;
-    const guidance = input.policy.roleGuidance?.[input.role];
-    if (observation.qualification.status !== 'qualified' || !observation.qualification.roles.includes(input.role))
+    const guidance = ownWorkerRoleGuidance(input.policy, input.role);
+    if (observation.qualification.status !== 'qualified' || !observation.qualification.roles.includes(guidance?.baseRole ?? input.role))
         deny('OG_ADAPTER_UNQUALIFIED', '/worker/qualification', 'Role lacks qualified evidence. Run aiwg doctor --probe-workers --qualify.');
     if (!guidance)
         deny('OG_CONFIG_REFERENCE', `/defaults/workerSelection/roleGuidance/${input.role}`, 'Role guidance is unavailable');