@aiwg/cli 2026.10.9 → 2026.10.10

package/agentic/code/providers/model-capabilities.v1.json

@@ -510,7 +510,7 @@
             "approval_policy=\"${approval}\"",
             "--skip-git-repo-check",
             "-o",
-            "${final}",
+            "${final}.last-message",
             "--json",
             "-"
           ],
@@ -575,7 +575,7 @@
               },
               "finalOutput": {
                 "support": "unqualified",
-                "mapping": "[-o/--output-last-message F] last-message file; --json carries the JSONL thread/turn/item/error event stream on stdout",
+                "mapping": "[-o/--output-last-message F.last-message] launcher-owned last-message capture, separate from worker-written workerClaims JSON at F (brief output.resultPath / --final-output); --json carries the JSONL thread/turn/item/error event stream on stdout",
                 "evidence": "H: codex-cli 0.161.0 exec --help documents -o/--output-last-message and --json; unqualified until live evidence"
               },
               "stdin": {
@@ -1606,7 +1606,7 @@
               "Unknown model, effort, permission or required step mappings block dispatch.",
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "There is NO `oz` symlink on the evidenced host: the real executable is `warp-terminal`, with `agent run` etc. as its subcommands; `runtimeDriver`/`executable` are pinned to that, not to a bare `oz`.",
-              "BRIEF TRANSPORT IS BLOCKED PENDING A SHARED CHANGE: `--prompt` places the brief on argv (never emitted by this profile); `-f/--file` is NOT a member of the required `<--prompt|--saved-prompt|--task-id|--skill>` group (live probe, 2026-10-11) and its own config-file schema is undocumented, so it cannot be assumed to carry the brief; `--skill` is the only remaining required-group member that can carry free text (`agent run --help`: 'Use a skill as the base prompt for the agent' when given without `--prompt`), but its search root relative to `--cwd` and behavior when the skill is missing are UNVERIFIED behind the login gate. The pure adapter derives a distinct `aiwg-brief-<invocationId>` path without writes and refuses unsafe IDs. `buildWarpBriefSkillFile()` (tools/ralph-external/lib/warp-adapter.mjs) exports the exact path/content an execution-time file-generation primitive would need to write before this argv runs; that primitive does not exist in the shared session-launcher today (the same class of gap as #2998 for Antigravity's stdin frame). Needed shared change: an execution-time generated-artifact primitive the session-launcher can call with the adapter-exported `{ relativePath, content }` immediately before spawning the worker process, with invocation identity supplied to the adapter, refusal to overwrite an existing path, cleanup afterward, and no commits of generated skills (pending #3002). Brief transport is NOT available today.",
+              "Brief delivery is wired through buildWorkerArtifacts and the shared session launcher: one bounded workspace-relative .agents/skills/aiwg-brief-<invocationId>/SKILL.md file, exclusive creation, no symlink components, collision preservation and cleanup on failure, completion or stop. The same invocation ID binds --skill and the artifact path; brief text never rides argv. Real skill search relative to --cwd and missing-skill behavior remain UNVERIFIED behind authentication; synthetic file-delivery tests do not qualify the profile.",
               "`--environment`/`-e` (cloud environment/runner) and `--harness claude|codex` (third-party harness mode) are documented but NEVER emitted by this profile; the cloud subcommand is also never emitted. Execution location is unverified until an authenticated run.",
               "`--no-snapshot` is always emitted: `agent run --help` documents it as disabling the end-of-run workspace snapshot upload. This flag does not establish execution location or absence of other uploads.",
               "No live success/error output was observed (no login on the evidenced host): `finalOutput`/`structuredOutput` support is grade H/R only, never upgraded past `unqualified`."
@@ -3326,6 +3326,200 @@
       }
     }
   },
+  "workerAdapters": {
+    "local-http": {
+      "version": 1,
+      "id": "local-http",
+      "provider": "ollama",
+      "adapterVersion": "1",
+      "supportedVersions": "8.18.0",
+      "runtimeDriver": "installed:local-http",
+      "catalogAdapter": {
+        "kind": "http",
+        "locator": "/api/tags",
+        "parser": "ollama-model-list-v1",
+        "timeoutSeconds": 10,
+        "maxBytes": 65536
+      },
+      "invocation": {
+        "kind": "process",
+        "executable": "curl",
+        "argv": [
+          "-q",
+          "-sS",
+          "--max-redirs",
+          "0",
+          "--proto",
+          "=http",
+          "--noproxy",
+          "*",
+          "--connect-timeout",
+          "10",
+          "--max-time",
+          "300",
+          "--max-filesize",
+          "10485760",
+          "--fail-with-body",
+          "-H",
+          "Content-Type: application/json",
+          "-X",
+          "POST",
+          "http://${endpoint}/api/generate",
+          "--data-binary",
+          "@-"
+        ],
+        "stdin": "adapter-frame",
+        "cwd": "${workspace}",
+        "envAllowlist": [
+          "OLLAMA_HOST"
+        ],
+        "versionArgv": [
+          "--version"
+        ],
+        "versionPattern": "^curl ([0-9A-Za-z.+-]{1,128}) [\\s\\S]{1,4096}$",
+        "maxOutputBytes": 10485760
+      },
+      "capabilities": {
+        "output": "validated-file",
+        "modelPin": "requested",
+        "effort": "not-applicable",
+        "cancel": "process-group",
+        "resume": false,
+        "sandboxModes": [
+          "external"
+        ],
+        "nestedAgentsControllable": true,
+        "nativeFallbackControllable": true,
+        "hardBudget": []
+      },
+      "qualification": {
+        "status": "unqualified"
+      },
+      "invocationProfiles": {
+        "direct-http": {
+          "transport": "shell",
+          "supportedVersions": "8.18.0",
+          "controls": {
+            "model": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "effort": {
+              "support": "not-applicable",
+              "mapping": "unavailable: explicit effort is refused; null effort and empty effort lists only",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "sandbox": {
+              "support": "external",
+              "mapping": "unavailable natively: requires a host OS/executor boundary; local endpoint does not prove local inference",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "approval": {
+              "support": "external",
+              "mapping": "unavailable natively: curl has no approval or permission system; the host authorizes the single text-only POST",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "workdir": {
+              "support": "external",
+              "mapping": "host spawns curl in the resolved absolute workspace; no server-side workspace control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "finalOutput": {
+              "support": "external",
+              "mapping": "host captures stdout and validates the original envelope and extracted worker claims; no server output-file control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stdin": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "structuredOutput": {
+              "support": "external",
+              "mapping": "unavailable server schema control; host strict claims parser validates the extracted response",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stepCap": {
+              "support": "unqualified",
+              "mapping": "unavailable: no model step cap; curl time and size bounds are not a step cap",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "trust": {
+              "support": "native",
+              "mapping": "-q",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "children": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "fallback": {
+              "support": "native",
+              "mapping": "[\"--max-redirs\",\"0\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            }
+          },
+          "envAllowlist": [
+            "OLLAMA_HOST"
+          ],
+          "pitfalls": [
+            "One text-only POST /api/generate, stream:false, explicit model and no tools, child-agent API or fallback request. Coding and explicit effort are refused.",
+            "The model control binds the resolved model in the adapter-frame JSON body; argv contains no model or brief.",
+            "No Ollama CLI, server start or weight-download command is invoked, including for disabled members. Server-side downloads, inference locality and backend identity remain unqualified.",
+            "curl 8.18.0 is the executable version; Ollama 0.33.3 response fields and done_reason=stop remain provisional pending the conductor smoke.",
+            "No native sandbox or approval system exists; external workspace/capture/validation controls require an enforcing host boundary.",
+            "No streaming health grammar, progress, session log, server cancellation, resume or model step cap is available. Owned curl exit is not proof of remote server stop."
+          ],
+          "health": {
+            "version": 1,
+            "handshake": "process-only",
+            "outputFraming": "final-json",
+            "signalParser": "unavailable",
+            "sessionLogLocator": null,
+            "progressEvidence": [],
+            "stopEvidence": "owned curl process identity and observed exit only; remote server cancellation unavailable",
+            "fixtureRef": "test/fixtures/providers/local-http/health/manifest.json",
+            "qualifiedAt": null,
+            "statusOperation": null,
+            "cancelOperation": null,
+            "coverage": "degraded",
+            "qualificationTarget": "unobserved",
+            "evidenceGrades": [
+              "H",
+              "R"
+            ],
+            "provenance": [
+              {
+                "kind": "help",
+                "ref": "docs/providers/ollama-direct.md",
+                "observedAt": "2026-10-09T00:00:00Z",
+                "cliVersion": "8.18.0"
+              },
+              {
+                "kind": "repository",
+                "ref": "tools/ralph-external/lib/ollama-adapter.mjs",
+                "observedAt": "2026-10-26T00:00:00Z",
+                "cliVersion": null
+              }
+            ],
+            "qualificationOwner": "B-OG-09",
+            "qualification": {
+              "status": "unqualified",
+              "scopeDigest": null,
+              "cliVersion": null,
+              "accountScope": null,
+              "profileRef": null,
+              "modelKey": null,
+              "effort": null,
+              "authorizedLive": false
+            }
+          }
+        }
+      }
+    }
+  },
   "workerHealthAdapters": {
     "local-http": {
       "version": 1,

package/bin/aiwg.mjs

@@ -27,6 +27,14 @@ import { existsSync, readFileSync } from 'fs';
 import os from 'os';
 import { randomUUID } from 'crypto';
 
+// Every exit path calls process.exit() right after writing. On a pipe, Node
+// queues writes the reader has not consumed yet and process.exit() drops them,
+// so a slow reader saw JSON reports cut off at the 64 KiB pipe buffer. Blocking
+// pipe writes finish before the next statement runs, so nothing is lost.
+for (const stream of [process.stdout, process.stderr]) {
+  if (!stream.isTTY) stream._handle?.setBlocking?.(true);
+}
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = path.resolve(__dirname, '..');

package/dist/src/cli/handlers/mc-admission.js

@@ -0,0 +1,39 @@
+// Builds the existing MC admission owner with a live worker-activation gate.
+import { join } from 'node:path';
+import { assertWorkerActivationCurrent } from '../../config/worker-activation-gate.js';
+import * as ui from '../ui.js';
+const MC_ROOT = '.aiwg/ralph-external/mc';
+/** Shared binding used by MC and the managed Mission/Flow/Ralph caller paths. */
+export async function createMcAdmissionScheduler(projectRoot, cfg, hostRegistry) {
+    const { resolveParallelism, workerActivationDigests, workerConfigDigest } = await import('../../config/aiwg-config.js');
+    const { FileAdmissionStore, SharedHostScheduler } = await import('../../serve/shared-host-scheduler.js');
+    const provider = cfg?.providers[0] ?? 'unknown';
+    const parallelism = resolveParallelism(cfg?.parallelism, provider);
+    if (parallelism.worker_mode === 'managed') {
+        const { managedProjectAdmissionPolicy, projectAdmissionAuthority } = await import('../../serve/shared-host-scheduler.js');
+        const activation = parallelism.activation;
+        if (!cfg || !activation || activation.configDigest !== workerActivationDigests(cfg).configDigest) {
+            throw new Error('managed admission requires a current activated policy');
+        }
+        const authority = projectAdmissionAuthority(projectRoot);
+        const authorityRef = parallelism.admission?.authorityRef ?? 'project';
+        if (authorityRef.startsWith('host:') && process.env['AIWG_EXECUTOR_IDENTITY_STORE']) {
+            ui.warn('AIWG_EXECUTOR_IDENTITY_STORE is ignored for host admission authority lookup.');
+        }
+        const policy = managedProjectAdmissionPolicy(projectRoot, { ...parallelism,
+            admission: { ...parallelism.admission, authorityRef: 'project' },
+        }, workerConfigDigest(activation), parallelism.max_parallel_subagents);
+        const binding = authorityRef === 'project' ? { store: new FileAdmissionStore(authority.path), policy }
+            : (hostRegistry ?? (await import('../../serve/executor-registry.js')).executorRegistry).resolveHostAdmissionAuthority(authorityRef, policy);
+        const check = () => assertWorkerActivationCurrent(projectRoot, activation);
+        check();
+        const scheduler = new SharedHostScheduler(binding.store, binding.policy, Date.now, check);
+        scheduler.reconcileNow();
+        return scheduler;
+    }
+    const maxConcurrent = parallelism.max_parallel_mc_missions;
+    return new SharedHostScheduler(new FileAdmissionStore(join(projectRoot, MC_ROOT, 'admission.json')), {
+        maxConcurrent, leaseTtlMs: 5 * 60_000, agingIntervalMs: 30_000, allowPreemption: false, defaultHostQuota: maxConcurrent,
+    });
+}
+//# sourceMappingURL=mc-admission.js.map

package/dist/src/cli/handlers/mc.js

@@ -36,37 +36,8 @@ async function readAdmissionConfig(projectRoot) {
         return null;
     }
 }
-/** Shared binding used by MC and the managed Mission/Flow/Ralph caller paths. */
-export async function createMcAdmissionScheduler(projectRoot, cfg, hostRegistry) {
-    const { resolveParallelism, workerActivationDigests, workerConfigDigest } = await import('../../config/aiwg-config.js');
-    const { FileAdmissionStore, SharedHostScheduler } = await import('../../serve/shared-host-scheduler.js');
-    const provider = cfg?.providers[0] ?? 'unknown';
-    const parallelism = resolveParallelism(cfg?.parallelism, provider);
-    if (parallelism.worker_mode === 'managed') {
-        const { managedProjectAdmissionPolicy, projectAdmissionAuthority } = await import('../../serve/shared-host-scheduler.js');
-        const activation = parallelism.activation;
-        if (!cfg || !activation || activation.configDigest !== workerActivationDigests(cfg).configDigest) {
-            throw new Error('managed admission requires a current activated policy');
-        }
-        const authority = projectAdmissionAuthority(projectRoot);
-        const authorityRef = parallelism.admission?.authorityRef ?? 'project';
-        if (authorityRef.startsWith('host:') && process.env['AIWG_EXECUTOR_IDENTITY_STORE']) {
-            ui.warn('AIWG_EXECUTOR_IDENTITY_STORE is ignored for host admission authority lookup.');
-        }
-        const policy = managedProjectAdmissionPolicy(projectRoot, { ...parallelism,
-            admission: { ...parallelism.admission, authorityRef: 'project' },
-        }, workerConfigDigest(activation), parallelism.max_parallel_subagents);
-        const binding = authorityRef === 'project' ? { store: new FileAdmissionStore(authority.path), policy }
-            : (hostRegistry ?? (await import('../../serve/executor-registry.js')).executorRegistry).resolveHostAdmissionAuthority(authorityRef, policy);
-        const scheduler = new SharedHostScheduler(binding.store, binding.policy);
-        scheduler.reconcileNow();
-        return scheduler;
-    }
-    const maxConcurrent = parallelism.max_parallel_mc_missions;
-    return new SharedHostScheduler(new FileAdmissionStore(join(projectRoot, MC_ROOT, 'admission.json')), {
-        maxConcurrent, leaseTtlMs: 5 * 60_000, agingIntervalMs: 30_000, allowPreemption: false, defaultHostQuota: maxConcurrent,
-    });
-}
+import { createMcAdmissionScheduler } from './mc-admission.js';
+export { createMcAdmissionScheduler } from './mc-admission.js';
 const mcWorkerSupport = () => workerConsumerSupport([...WORKER_BASELINE_FEATURES, 'worker-health.v1']);
 function workerDispatch(mission) {
     const bindings = new Set();

package/dist/src/cli/handlers/models-help.js

@@ -0,0 +1,52 @@
+// Documents the existing model maintenance and resolution commands.
+export const MODELS_HELP = `Usage: aiwg models <subcommand> [options]
+
+Subcommands:
+  list                         List discovered agent and skill model policies
+  audit                        Compile selected policies and report diagnostics
+  resolve                      Resolve artifact policies, or a direct worker invocation
+  validate                     Validate selected artifact policies (not worker configuration)
+  sources                      Show the effective model catalog without network refresh
+  refresh                      Refresh model discovery (may access the network)
+  set-default <TIER>           Write defaults.tier to models.json
+  set --tier <TIER>            Update selected agent/skill frontmatter; requires a selector or --all
+  migrate                      Add canonical role/tier hints to legacy skills
+
+Artifact selectors and options:
+  --agent <name>  --skill <name>  --glob <pattern>  --role <role>
+  --tier <tier>  --framework <name>  --all
+  --provider <provider>         Provider for artifact compilation (default: claude)
+  --model <id>                  Explicit Grok Build model for artifact resolve
+  --target <directory>         Artifact/project root (default: current directory)
+  --propose <file>             Review pair edits (--parallelism/--worker-selection JSON files)
+  --apply <file>               Apply with --authorize DIGEST or --standing-authorization FILE
+  --recover                    Restore retained pair with the original authorization
+  --scope project|user         set-default destination (default: project)
+  --dry-run                    Preview mutations without writing
+  --json                       Emit JSON
+  --drift                      Include catalog drift for sources/refresh
+  --url <url>                  Remote catalog URL for refresh
+  --help, -h                   Show this reference
+  TIER: economy | standard | premium | max-quality
+
+Direct worker resolution (plans an invocation; does not launch it):
+  aiwg models resolve --role <role> --task <class> --group <group>
+    --brief <file> --workdir <tree> --final-output <file>
+    [--transport shell|mcp] [--format json|shell] [--authorize-premium]
+  --role                       efficiency | coding | reasoning | configured project alias
+  --task                       Task class from defaults.workerSelection.taskClasses
+                               Built-ins: inventory, implementation, architecture, review
+  --group                      Group from parallelism.groups and the role's guidance
+  --brief                      Absolute path to the task brief
+  --workdir                    Absolute path to the worker tree
+  --final-output               Absolute path for the final result
+  --transport                  Must match group execution transport (default: shell)
+  --format                     JSON plan or POSIX shell command (default: json)
+  --json                       Alias for --format json
+  --authorize-premium          Authorize premium for this resolution only
+                               Agents require explicit human confirmation of escalation
+
+Worker groups live in .aiwg/aiwg.config; role guidance lives in project-root models.json.
+Configure both, then run aiwg doctor --probe-workers --qualify.
+See docs/getting-started/worker-dispatch.md for a complete example.`;
+//# sourceMappingURL=models-help.js.map

package/dist/src/cli/handlers/models.js

@@ -1,3 +1,8 @@
+import { MODELS_HELP } from './models-help.js';
+import { updateJson } from '../../models/config-writer.js';
+import { atomicConfigWrite as atomicWrite } from '../../config/worker-write.js';
+import { handleWorkerAdoptionArgs } from '../../config/worker-adoption-cli.js';
+import { resolveParallelism } from '../../config/aiwg-config.js';
 /**
  * Safe model-policy audit, resolution, and mutation commands.
  * @implements #1804
@@ -8,7 +13,7 @@ import { isDeepStrictEqual } from 'node:util';
 import path from 'node:path';
 import { glob } from 'glob';
 import { load as loadYaml } from 'js-yaml';
-import { compileModelPolicy, validateCanonicalModelPolicy, validateUserProjectModelConfig, loadProviderModelCapabilities, WorkerPolicyError, assertWorkerRoleEffort, } from '../../models/provider-policy.js';
+import { compileModelPolicy, validateCanonicalModelPolicy, loadProviderModelCapabilities, WorkerPolicyError, assertWorkerRoleEffort, } from '../../models/provider-policy.js';
 import { resolveGrokBuildRoleModel } from '../../models/grok-build-models.js';
 import { readAiwgConfig, emptyConfig } from '../../config/aiwg-config.js';
 import { ConfigLoader } from '../../models/config-loader.js';
@@ -34,22 +39,21 @@ export async function loadWorkerInputs(ctx) {
     const models = await loader.load(config.parallelism);
     const catalog = await effectiveCatalog(ctx, ctx.cwd, false, parseArgs(['resolve']));
     const registry = loadProviderModelCapabilities();
-    // Let the resolver explain the dispatch gate before requiring host qualification (#3070).
     if (!config.parallelism?.worker_dispatch) {
         return { snapshot: { config, models, modelDigests: loader.getInputDigests(), catalog,
                 registry, installations: {} }, drivers: {} };
     }
     // Explain missing policy before a recorded approval's digest check can
     // mask it. The host owner first preserves its missing-installation errors.
-    const parallelism = config.parallelism;
+    const parallelism = resolveParallelism(config.parallelism, config.providers[0]);
     const precheckPolicy = () => {
         if (!ctx.args.some(arg => arg === '--role' || arg.startsWith('--role=')))
             return;
         const request = parseWorkerCommandArgs(ctx.args.slice(1));
         const members = Object.entries(parallelism.groups ?? {})
             .filter(([id]) => !request.group || request.group === id)
-            .flatMap(([, group]) => group.members).filter(member => member.enabled !== false
-            && parallelism.clis?.[member.cli]?.enabled !== false && member.roles.includes(request.role));
+            .flatMap(([, group]) => group.members ?? []).filter(member => member.enabled !== false
+            && parallelism.clis?.[member.cli]?.enabled !== false && member.roles.includes((models.defaults.workerSelection?.roleGuidance?.[request.role]?.baseRole ?? request.role)));
         const requiresExplicit = members.length > 0 && members.every(member => {
             // Health metadata can identify the provider before an operator has
             // qualified its dispatch adapter. It grants no dispatch authority.
@@ -269,35 +273,6 @@ function print(value, json) {
     else
         console.log(JSON.stringify(value, null, 2));
 }
-async function atomicWrite(file, content) {
-    await fs.mkdir(path.dirname(file), { recursive: true });
-    const temporary = `${file}.tmp-${process.pid}`;
-    let mode = 0o600;
-    try {
-        mode = (await fs.stat(file)).mode;
-    }
-    catch { /* new file */ }
-    await fs.writeFile(temporary, content, { encoding: 'utf8', mode });
-    await fs.rename(temporary, file);
-}
-async function updateJson(file, mutate, dryRun) {
-    let value = {};
-    try {
-        value = JSON.parse(await fs.readFile(file, 'utf8'));
-    }
-    catch (error) {
-        if (error?.code !== 'ENOENT')
-            throw error;
-    }
-    mutate(value);
-    const validation = validateUserProjectModelConfig(value);
-    if (!validation.valid)
-        throw new Error(validation.diagnostics.map(item => item.message).join('; '));
-    const content = `${JSON.stringify(value, null, 2)}\n`;
-    if (!dryRun)
-        await atomicWrite(file, content);
-    return { file, beforeWrite: value, dryRun };
-}
 async function effectiveCatalog(ctx, target, allowNetwork, parsed, provider) {
     const { collectProviderInventory } = await import('../../providers/provider-inventory.js');
     const { resolveDynamicModelCatalog } = await import('../../models/model-discovery.js');
@@ -350,53 +325,6 @@ function replaceFrontmatter(raw, item, tier) {
     }
     return `---\n${frontmatter}\n---\n${match[2]}`;
 }
-const MODELS_HELP = `Usage: aiwg models <subcommand> [options]
-
-Subcommands:
-  list                         List discovered agent and skill model policies
-  audit                        Compile selected policies and report diagnostics
-  resolve                      Resolve artifact policies, or a direct worker invocation
-  validate                     Validate selected artifact policies (not worker configuration)
-  sources                      Show the effective model catalog without network refresh
-  refresh                      Refresh model discovery (may access the network)
-  set-default <TIER>           Write defaults.tier to models.json
-  set --tier <TIER>            Update selected agent/skill frontmatter; requires a selector or --all
-  migrate                      Add canonical role/tier hints to legacy skills
-
-Artifact selectors and options:
-  --agent <name>  --skill <name>  --glob <pattern>  --role <role>
-  --tier <tier>  --framework <name>  --all
-  --provider <provider>         Provider for artifact compilation (default: claude)
-  --model <id>                  Explicit Grok Build model for artifact resolve
-  --target <directory>         Artifact/project root (default: current directory)
-  --scope project|user         set-default destination (default: project)
-  --dry-run                    Preview mutations without writing
-  --json                       Emit JSON
-  --drift                      Include catalog drift for sources/refresh
-  --url <url>                  Remote catalog URL for refresh
-  --help, -h                   Show this reference
-  TIER: economy | standard | premium | max-quality
-
-Direct worker resolution (plans an invocation; does not launch it):
-  aiwg models resolve --role <role> --task <class> --group <group>
-    --brief <file> --workdir <tree> --final-output <file>
-    [--transport shell|mcp] [--format json|shell] [--authorize-premium]
-  --role                       efficiency | coding | reasoning
-  --task                       Task class from defaults.workerSelection.taskClasses
-                               Built-ins: inventory, implementation, architecture, review
-  --group                      Group from parallelism.groups and the role's guidance
-  --brief                      Absolute path to the task brief
-  --workdir                    Absolute path to the worker tree
-  --final-output               Absolute path for the final result
-  --transport                  Must match group execution transport (default: shell)
-  --format                     JSON plan or POSIX shell command (default: json)
-  --json                       Alias for --format json
-  --authorize-premium          Authorize premium for this resolution only
-                               Agents require explicit human confirmation of escalation
-
-Worker groups live in .aiwg/aiwg.config; role guidance lives in project-root models.json.
-Configure both, then run aiwg doctor --probe-workers --qualify.
-See docs/getting-started/worker-dispatch.md for a complete example.`;
 async function execute(ctx, services = { load: loadWorkerInputs }) {
     if (ctx.args.length === 0 || ctx.args[0] === 'help' || ctx.args.includes('--help') || ctx.args.includes('-h')) {
         print(MODELS_HELP, false);
@@ -406,6 +334,8 @@ async function execute(ctx, services = { load: loadWorkerInputs }) {
     if (ctx.args[0] === 'resolve' && ctx.args.slice(1).some(arg => /^--(?:task|group|brief|workdir|final-output|transport|format|authorize-premium)(?:=|$)/.test(arg))) {
         return resolveDirect(ctx, services);
     }
+    if (await handleWorkerAdoptionArgs(ctx.args, ctx.cwd, 'models', ctx.signal, ctx.dryRun))
+        return { exitCode: 0 };
     const parsed = parseArgs(ctx.args);
     if (parsed.subcommand === 'resolve') {
         const supported = new Set(['agent', 'skill', 'glob', 'role', 'tier', 'framework', 'all', 'target', 'provider', 'model', 'json', 'help', 'dry-run']);

package/dist/src/cli/handlers/use-addon-profile.js

@@ -0,0 +1,72 @@
+// Select and persist an optional bundled addon memory profile.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as ui from '../ui.js';
+export async function selectAddonProfile(options) {
+    const { addonSource, framework, target, args, dryRunAddon, bulkIntent, signal } = options;
+    try {
+        const profileManifestPath = path.join(addonSource, 'manifest.json');
+        const profileManifestContent = await fs.readFile(profileManifestPath, 'utf-8');
+        const profileManifest = JSON.parse(profileManifestContent);
+        const topology = profileManifest.memory?.topology;
+        const templates = profileManifest.templates;
+        if (topology && templates && templates.length > 1) {
+            const profileIdx = args.findIndex(a => a === '--profile');
+            let selectedProfile;
+            if (profileIdx >= 0 && args[profileIdx + 1]) {
+                // Explicit --profile flag
+                selectedProfile = args[profileIdx + 1];
+                const templateFile = templates.find((t) => t.replace('.md', '') === selectedProfile || t === selectedProfile);
+                if (!templateFile) {
+                    ui.warn(`Unknown profile "${selectedProfile}". Available: ${templates.map((t) => t.replace('.md', '')).join(', ')}`);
+                    selectedProfile = undefined;
+                }
+            }
+            else if (bulkIntent || !process.stdin.isTTY) {
+                // Bulk/automation or non-TTY: silently pick 'generic' default.
+                // The profile picker is annoying during `aiwg use all`.
+                selectedProfile = 'generic';
+            }
+            else if (process.stdin.isTTY) {
+                // Interactive profile selection via the shared `listSelect` helper
+                // (POC for spike #926). One call renders the option list, handles
+                // number-or-name matching, threads `signal` for Ctrl-C
+                // cancellation, and resolves to the fallback on timeout or empty
+                // input. The hand-rolled parse-and-branch that used to live here
+                // is now a one-liner.
+                const { createPromptInterface, listSelect } = await import('../prompt-utils.js');
+                ui.blank();
+                ui.header('  Select a topology profile:');
+                const templateNames = templates.map((t) => t.replace('.md', ''));
+                const options = templateNames.map((name) => ({
+                    label: name === 'generic' ? `${name} (default)` : name,
+                    value: name,
+                }));
+                const rl = createPromptInterface();
+                try {
+                    selectedProfile = await listSelect(rl, '  Enter number or name [generic]: ', options, 'generic', signal);
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            // Write profile config to project namespace
+            if (selectedProfile && !dryRunAddon) {
+                const namespace = topology.namespace || `.aiwg/${framework}`;
+                const configDir = path.join(target, namespace);
+                await fs.mkdir(configDir, { recursive: true });
+                const profileConfig = {
+                    profile: selectedProfile,
+                    pageTemplate: `templates/${selectedProfile}.md`,
+                    selectedAt: new Date().toISOString(),
+                };
+                await fs.writeFile(path.join(configDir, 'config.json'), JSON.stringify(profileConfig, null, 2) + '\n');
+                ui.success(`Profile "${selectedProfile}" selected → ${namespace}/config.json`);
+            }
+        }
+    }
+    catch {
+        // Profile selection is optional — don't fail deployment
+    }
+}
+//# sourceMappingURL=use-addon-profile.js.map