@aiwg/cli 2026.10.9 → 2026.10.10

package/tools/agents/providers/claude-post-deploy.mjs

@@ -0,0 +1,35 @@
+// Apply project settings and context after provider file deployment.
+import fs from 'node:fs';
+import path from 'node:path';
+import { initializeFrameworkWorkspace, ensureDir } from './base.mjs';
+import { deployHookFile } from './claude.mjs';
+import { deployConductorDataGuard } from './conductor-data-guard.mjs';
+
+export async function postDeploy(targetDir, opts) {
+  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
+  await deployConductorDataGuard(targetDir, 'claude', opts);
+
+  // Claude-specific post-deployment (settings.json, etc.)
+  const claudeDir = path.join(targetDir, '.claude');
+  const settingsPath = path.join(claudeDir, 'settings.json');
+
+  // If settings.json doesn't exist, create a minimal one
+  if (!fs.existsSync(settingsPath) && !opts.dryRun) {
+    ensureDir(claudeDir);
+    const settings = {
+      version: '1.0',
+      created: new Date().toISOString(),
+      aiwg: {
+        enabled: true,
+        mode: opts.mode || 'all'
+      }
+    };
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
+    console.log('Created .claude/settings.json');
+  }
+
+  // Hook file architecture: write AIWG.md and wire @AIWG.md into CLAUDE.md
+  if (opts.srcRoot && opts.contextFiles !== false) {
+    deployHookFile(targetDir, opts);
+  }
+}

package/tools/agents/providers/claude.mjs

@@ -1,3 +1,5 @@
+import { postDeploy } from './claude-post-deploy.mjs';
+export { postDeploy };
 import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Claude Code Provider
@@ -43,7 +45,6 @@ import {
   pruneStaleAiwgSkills,
   computeAllKernelNames,
   parseFrontmatter,
-  initializeFrameworkWorkspace,
   filterAgentFiles,
   getAddonAgentFiles,
   getAddonCommandFiles,
@@ -395,34 +396,6 @@ export function createAgentsMd(target, srcRoot, dryRun) {
 // Post-Deployment
 // ============================================================================
 
-export async function postDeploy(targetDir, opts) {
-  // Initialize framework workspace structure
-  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
-
-  // Claude-specific post-deployment (settings.json, etc.)
-  const claudeDir = path.join(targetDir, '.claude');
-  const settingsPath = path.join(claudeDir, 'settings.json');
-
-  // If settings.json doesn't exist, create a minimal one
-  if (!fs.existsSync(settingsPath) && !opts.dryRun) {
-    ensureDir(claudeDir);
-    const settings = {
-      version: '1.0',
-      created: new Date().toISOString(),
-      aiwg: {
-        enabled: true,
-        mode: opts.mode || 'all'
-      }
-    };
-    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
-    console.log('Created .claude/settings.json');
-  }
-
-  // Hook file architecture: write AIWG.md and wire @AIWG.md into CLAUDE.md
-  if (opts.srcRoot && opts.contextFiles !== false) {
-    deployHookFile(targetDir, opts);
-  }
-}
 
 /**
  * Deploy the AIWG.md hook file and add @AIWG.md directive to CLAUDE.md.
@@ -444,7 +417,7 @@ function interpolateHookTokens(content, counts, targetDir) {
   });
 }
 
-function deployHookFile(targetDir, opts) {
+export function deployHookFile(targetDir, opts) {
   const { srcRoot, dryRun, counts } = opts;
   const templatePath = path.join(srcRoot, 'agentic', 'code', 'frameworks', 'sdlc-complete', 'templates', 'project', 'AIWG.md');
   const hookDest = path.join(targetDir, 'AIWG.md');

package/tools/agents/providers/codex-post-deploy.mjs

@@ -0,0 +1,13 @@
+// Apply project settings and context after provider file deployment.
+import { initializeFrameworkWorkspace } from './base.mjs';
+import { createAgentsMd } from './codex.mjs';
+import { deployConductorDataGuard } from './conductor-data-guard.mjs';
+
+export async function postDeploy(targetDir, opts) {
+  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
+  await deployConductorDataGuard(targetDir, 'codex', opts);
+
+  if (opts.createAgentsMd) {
+    if (opts.contextFiles !== false) createAgentsMd(targetDir, opts.srcRoot, opts.dryRun);
+  }
+}

package/tools/agents/providers/codex.mjs

@@ -1,3 +1,5 @@
+import { postDeploy } from './codex-post-deploy.mjs';
+export { postDeploy };
 import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * OpenAI Codex Provider
@@ -47,7 +49,6 @@ import {
   writeFile,
   deployFiles,
   createAgentsMdFromTemplate,
-  initializeFrameworkWorkspace,
   getAddonAgentFiles,
   getAddonCommandFiles,
   getAddonSkillDirs,
@@ -511,13 +512,6 @@ export function generatePluginBundle(targetDir, opts = {}) {
 // Post-Deployment
 // ============================================================================
 
-export async function postDeploy(targetDir, opts) {
-  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
-
-  if (opts.createAgentsMd) {
-    if (opts.contextFiles !== false) createAgentsMd(targetDir, opts.srcRoot, opts.dryRun);
-  }
-}
 
 // ============================================================================
 // File Extension

package/tools/agents/providers/conductor-data-guard.mjs

@@ -0,0 +1,61 @@
+// Compile the existing project data policy into project-local provider refusals.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { importImpl, resolveImpl } from '../../_resolve-impl.mjs';
+
+const quote = value => `'${value.replace(/'/g, `'"'"'`)}'`;
+
+// Local-only paths are declared only in project/user models.json or project
+// parallelism (the built-in defaults declare none). Skip the full model-config
+// load when none of them mention the field, so ordinary deploys never depend
+// on the framework default config (absent from the slim CLI package).
+function declaresLocalOnlyPaths(targetDir) {
+  const userDir = process.env.AIWG_CONFIG || path.join(os.homedir(), '.config/aiwg');
+  return [path.join(targetDir, 'models.json'), path.join(userDir, 'models.json'), path.join(targetDir, '.aiwg/aiwg.config')]
+    .some(file => { try { return fs.readFileSync(file, 'utf8').includes('localOnlyPaths'); } catch { return false; } });
+}
+
+export async function deployConductorDataGuard(targetDir, provider, opts = {}) {
+  if (!declaresLocalOnlyPaths(targetDir)) return [];
+  // Always resolve policy through the existing loader, including inherited restrictions.
+  const { ConfigLoader } = await importImpl(import.meta.url, 'models/config-loader.js');
+  const { readAiwgConfig } = await importImpl(import.meta.url, 'config/aiwg-config.js');
+  const guard = await importImpl(import.meta.url, 'models/conductor-data-policy.mjs');
+  const config = await readAiwgConfig(targetDir);
+  const models = await new ConfigLoader(targetDir).load(config?.parallelism);
+  const paths = guard.collectLocalOnlyPaths(models.defaults.workerSelection, config?.parallelism);
+  if (!paths.length || opts.dryRun) return paths;
+  const root = path.resolve(targetDir);
+  if (provider === 'claude') {
+    const settingsPath = path.join(root, '.claude/settings.json');
+    const settings = fs.existsSync(settingsPath) ? JSON.parse(fs.readFileSync(settingsPath, 'utf8')) : {};
+    const hookPath = path.join(root, '.claude/hooks/aiwg-local-only.mjs');
+    const hookSource = fs.readFileSync(resolveImpl(import.meta.url, 'models/conductor-data-policy.mjs'), 'utf8');
+    fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+    fs.writeFileSync(hookPath, `${hookSource}\nrunConductorDataHook(${JSON.stringify(root)}, ${JSON.stringify(paths)});\n`);
+    settings.permissions ??= {};
+    settings.permissions.deny = [...new Set([...(settings.permissions.deny ?? []), ...paths.flatMap(file => [
+      `Read(//${path.join(root, file).slice(1)})`, `Read(//${path.join(root, file).slice(1)}/**)`,
+    ])])];
+    settings.hooks ??= {};
+    const command = `node ${quote(hookPath)}`;
+    const entries = settings.hooks.PreToolUse ?? [];
+    settings.hooks.PreToolUse = [...entries.filter(entry => !entry.hooks?.some(hook => hook.command === command)),
+      { matcher: '.*', hooks: [{ type: 'command', command }] }];
+    fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+  } else if (provider === 'codex') {
+    const rulesPath = path.join(root, '.codex/rules/aiwg-local-only.rules');
+    const lines = ['# AIWG local-only inputs: explicit command prefixes only; not filesystem isolation.'];
+    for (const file of paths) for (const spelling of [file, `./${file}`, path.join(root, file)]) {
+      for (const command of ['cat', 'head', 'tail', 'less', 'more', 'sed', 'awk', 'grep', 'rg']) {
+        lines.push(`prefix_rule(pattern = ${JSON.stringify([command, spelling])}, decision = "forbidden")`);
+      }
+    }
+    fs.mkdirSync(path.dirname(rulesPath), { recursive: true });
+    fs.writeFileSync(rulesPath, lines.join('\n') + '\n');
+  }
+  console.log(`Local-only conductor guard (${provider}): ${paths.join(', ')}; shell coverage is limited.`);
+  return paths;
+}

package/tools/agents/providers/rule-delivery.mjs

@@ -20,6 +20,8 @@ const { guardRulesInlineBudget } = await importImpl(import.meta.url, 'rules/inli
 const { userConfigFile } = await importImpl(import.meta.url, 'config/user-config-dir.mjs');
 const { resolveProjectAiwgDir } = await importImpl(import.meta.url, 'config/project-artifacts-runtime.mjs');
 import { writeContextFileSync, CONTEXT_STAGE_ENV } from './context-write.mjs';
+import { projectOnDemandReferences, renderRuleKernelIndex } from './rule-presentation.mjs';
+export { renderRuleKernelIndex } from './rule-presentation.mjs';
 const PREPARATION_HOOK = Symbol.for('aiwg.provider-preparation-hook.v1');
 
 export function installRuleDeploymentPreparationHook(hook) {
@@ -298,21 +300,6 @@ export async function prepareRuleDelivery(opts) {
   return { rules, bindings, targets, pins: pinned.rules, pinWarnings: pinned.warnings };
 }
 
-export function renderRuleKernelIndex(rules, nativePaths = false) {
-  const summary = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'summary');
-  const paths = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'paths');
-  const kernels = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'kernel');
-  if (!summary.length && !paths.length && !kernels.length) return '';
-  const lines = ['# Rule kernel index', ''];
-  for (const rule of kernels) lines.push(`- ${rule.name} — ${rule.summary || 'Fetch and follow the full rule before governed work.'} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
-  for (const rule of summary) lines.push(`- ${rule.name} — ${rule.summary} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
-  if (paths.length) {
-    lines.push(nativePaths ? '## Path rules (native)' : '## Path rules (prompt emulation)', '',
-      nativePaths ? 'The provider loads these rules for matching paths; full contracts remain available through the commands below.' : 'Before reading or changing files, compare intended project-relative paths with the globs below and fetch matching rules before their first read/write. If paths are initially unknown, check when they become known. An agent-only task has no path match. This is prompt emulation, not a filesystem hook.', '');
-    for (const rule of paths) lines.push(`- ${rule.name} | ${rule.paths.map(glob => `\`${glob}\``).join(', ')} | ${rule.summary} | \`aiwg show rule ${rule.name} --body\``, '');
-  }
-  return lines.join('\n');
-}
 
 function managed(content, opts) {
   return addManagedMarker(content, opts.deployVersion, opts.deploySource || 'bundled');
@@ -334,7 +321,7 @@ function putStartup(file, body) {
 
 /** Tagged rules bypass legacy aggregate writers. Untagged projections retain their tier policy. */
 function projectRules(opts, provider) {
-  const { rules } = opts.ruleDelivery;
+  const rules = projectOnDemandReferences(opts.ruleDelivery.rules, ['claude', 'cursor'].includes(provider.name));
   if (opts.contextFiles !== false && provider.name === 'hermes') {
     // The old context generator carries hardcoded corpus directives. Only the
     // selected contracts below may activate policy; preserve operator prose.

package/tools/agents/providers/rule-presentation.mjs

@@ -0,0 +1,38 @@
+/** Render deployed rule references without links to catalog-only siblings. */
+import path from 'node:path';
+
+export function projectOnDemandReferences(rules, nativePaths = false) {
+  const byFile = new Map(rules.map(rule => [path.resolve(rule.file), rule]));
+  return rules.map(rule => {
+    const rewrite = content => content?.replace(
+      /\[[^\]\n]+\]\((?:\.\/)?([\w-]+)\.md\)[ \t]*\(`aiwg show rule \1(?: --body)?`, on-demand\)/g,
+      (reference, name) => {
+        const sibling = byFile.get(path.resolve(path.dirname(rule.file), `${name}.md`));
+        // Only known catalog rules can replace a relative file reference. Keep
+        // unknown/broken links and links to files selected for native delivery.
+        if (!sibling?.tagged || sibling.name !== name || sibling.activation === 'kernel' ||
+            (nativePaths && sibling.activation === 'paths')) return reference;
+        return `\`aiwg show rule ${name} --body\` (on-demand)`;
+      },
+    );
+    return { ...rule, content: rewrite(rule.content), body: rewrite(rule.body),
+      ...(rule.coreBody === undefined ? {} : { coreBody: rewrite(rule.coreBody) }) };
+  });
+}
+
+export function renderRuleKernelIndex(rules, nativePaths = false) {
+  const summary = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'summary');
+  const paths = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'paths');
+  const kernels = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'kernel');
+  if (!summary.length && !paths.length && !kernels.length) return '';
+  const lines = ['# Rule kernel index', ''];
+  for (const rule of kernels) lines.push(`- ${rule.name} — ${rule.summary || 'Fetch and follow the full rule before governed work.'} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
+  for (const rule of summary) lines.push(`- ${rule.name} — ${rule.summary} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
+  if (paths.length) {
+    lines.push(nativePaths ? '## Path rules (native)' : '## Path rules (prompt emulation)', '',
+      nativePaths ? 'The provider loads these rules for matching paths; full contracts remain available through the commands below.' : 'Before reading or changing files, compare intended project-relative paths with the globs below and fetch matching rules before their first read/write. If paths are initially unknown, check when they become known. An agent-only task has no path match. This is prompt emulation, not a filesystem hook.', '');
+    for (const rule of paths) lines.push(`- ${rule.name} | ${rule.paths.map(glob => `\`${glob}\``).join(', ')} | ${rule.summary} | \`aiwg show rule ${rule.name} --body\``, '');
+  }
+  return lines.join('\n');
+}
+

package/tools/plugin/package-plugins.mjs

@@ -41,7 +41,7 @@ const PLUGIN_CONFIGS = {
       skills: 'agentic/code/frameworks/sdlc-complete/skills'
     },
     extraCopy: [
-      { from: 'tools/security/threat-assessment.mjs', to: 'tools/security/threat-assessment.mjs' },
+      ...['threat-assessment.mjs', 'threat-assessment'].map(name => ({ from: `tools/security/${name}`, to: `tools/security/${name}` })),
       { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-architecture-evolution.playbook.yaml', to: 'flows/flow-architecture-evolution.playbook.yaml' },
       { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-release.playbook.yaml', to: 'flows/flow-release.playbook.yaml' }
     ],

package/tools/ralph-external/lib/claude-adapter.mjs

@@ -212,8 +212,8 @@ export class ClaudeAdapter extends ProviderAdapter {
     ];
 
     // Session tracking
-    if (options.sessionId) {
-      args.push('--session-id', options.sessionId);
+    if (options.resumeSession || options.sessionId) {
+      args.push(options.resumeSession ? '--resume' : '--session-id', options.resumeSession || options.sessionId);
     }
 
     // Model selection (Claude passes through directly)

package/tools/ralph-external/lib/codex-adapter.mjs

@@ -44,7 +44,7 @@ const MODEL_MAP = {
  *
  *   codex --no-daemon exec --ignore-user-config -m M \
  *     -c model_reasoning_effort="E" -s S -C W -c approval_policy="never" \
- *     --skip-git-repo-check -o F --json - < briefPath
+ *     --skip-git-repo-check -o F.last-message --json - < briefPath
  *
  * `--no-daemon` is a root-level flag and `--ignore-user-config` is an
  * `exec`-level flag (root `--help` lists no `--ignore-user-config`;
@@ -206,7 +206,7 @@ export class CodexAdapter extends ProviderAdapter {
    * model, explicit effort as one `-c model_reasoning_effort="E"` token
    * (TOML `"E"` quoting via `JSON.stringify`; there is no shell in argv),
    * explicit sandbox/approval (`never` only), the conductor workdir as
-   * `-C`, the final file as `-o`, the JSONL event stream as `--json` and
+   * `-C`, a separate last-message capture as `-o`, the JSONL stream as `--json` and
    * `-` as the prompt argument so the brief arrives on stdin
    * (`stdin: 'brief-text'`). Permission flags from the legacy Ralph loop
    * (`--dangerously-bypass-approvals-and-sandbox`), guessed step caps and
@@ -260,7 +260,7 @@ export class CodexAdapter extends ProviderAdapter {
       '-C', cwd,
       '-c', `approval_policy=${JSON.stringify(approval)}`,
       '--skip-git-repo-check',
-      '-o', finalPath,
+      '-o', `${finalPath}.last-message`,
       '--json',
       '-',
     ];

package/tools/ralph-external/lib/managed-worker-attempt.mjs

@@ -0,0 +1,86 @@
+// Validate the parent reservation and disclose one-shot attempt bindings.
+import { importImpl } from '../../_resolve-impl.mjs';
+import { sampleWorkerIdentity } from '../process-monitor.mjs';
+import { changedBindings } from './session-attempt.mjs';
+const { qualificationDigest } = await importImpl(import.meta.url, 'models/qualification-digest.mjs');
+
+export function managedAttemptBindings(plan) {
+  const invocation = plan.invocation;
+  const digests = plan.digests ?? {};
+  const selected = invocation?.selected ?? plan.selected;
+  return { policyDigest: invocation?.policyDigest ?? (digests.configDigest && digests.resolvedModelsDigest
+    ? qualificationDigest([digests.configDigest, digests.resolvedModelsDigest]) : null),
+  catalogDigest: invocation?.catalogDigest ?? digests.catalogDigest ?? null,
+  profileDigest: invocation?.profileDigest ?? digests.profileDigest ?? null,
+  selected: selected ? { group: selected.group, member: selected.member, cli: selected.cli,
+    inferenceProvider: selected.inferenceProvider, model: selected.model,
+    effort: typeof selected.effort === 'object' ? selected.effort?.value ?? null : selected.effort ?? null,
+    profileRef: selected.profileRef ?? selected.profile } : null, sessionId: null };
+}
+
+export async function validateManagedAttempt(options, saved, inputs, now, validate, publish) {
+  const attempt = await managedWorkerAttempt(options, saved, inputs, now);
+  await publish(attempt);
+  try {
+    const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now);
+    return { invocation, attempt };
+  } catch (error) {
+    attempt.status = 'blocked'; attempt.errorCode = error.code ?? 'PLAN_REVALIDATION_FAILED';
+    await publish(attempt);
+    throw error;
+  }
+}
+
+export async function managedWorkerAttempt(options, saved, inputs, now) {
+  const { resolveWorkerInvocation } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
+  const current = await resolveWorkerInvocation(inputs.snapshot, saved.request, inputs.drivers, now);
+  const original = options.attempt?.originalBindings ?? managedAttemptBindings(saved);
+  const bindings = managedAttemptBindings(current);
+  return { ...options.attempt, kind: 'fresh', reason: options.attempt?.reason
+    ?? (options.resumeSession || options.sessionId ? 'one-shot-continuation-unsupported' : 'one-shot-profile'),
+    requestedSessionId: options.attempt?.requestedSessionId ?? options.resumeSession ?? options.sessionId ?? null,
+    requestId: options.managedAdmission.requestId, originalBindings: original,
+    bindings, changes: changedBindings(original, bindings),
+    status: current.status === 'eligible' ? 'prepared' : 'blocked',
+    diagnostics: current.diagnostics };
+}
+
+/** Reuse the MC authority and its registered one-shot identity at every spawn boundary. */
+export async function assertManagedWorkerLaunch(options, invocation, inputs, projectRoot = process.cwd()) {
+  if (!options.managedAdmission || invocation.mode !== 'managed'
+    || inputs.snapshot.config.parallelism?.worker_mode !== 'managed') throw new Error('Managed worker admission is required');
+  const { createMcAdmissionScheduler } = await importImpl(import.meta.url, 'cli/handlers/mc.js');
+  const { loadLauncherRegistry } = await importImpl(import.meta.url, 'cli/handlers/ralph-launcher.js');
+  const { workerModelKey } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const scheduler = await createMcAdmissionScheduler(projectRoot, inputs.snapshot.config);
+  const { requestId, generation } = options.managedAdmission;
+  const snapshot = scheduler.snapshot();
+  const record = snapshot.records[requestId];
+  const deadlineAtMs = Math.min(options.cycleDeadlineAtMs ?? Infinity, ...[record?.accounting?.runKey, record?.accounting?.taskKey]
+    .map(key => snapshot.allowances?.[key]?.deadlineAt).filter(Boolean).map(Date.parse));
+  const registered = loadLauncherRegistry(projectRoot).loops[options.loopId ?? process.env.RALPH_LOOP_ID];
+  const worker = record?.managed;
+  const reservation = record?.accounting?.reservation;
+  if (!record || record.state !== 'admitted' || record.leaseGeneration !== generation
+    || !record.launchClaimedAt || !record.metadata?.invocationId || Date.parse(record.leaseExpiresAt ?? '') <= Date.now()
+    || deadlineAtMs <= Date.now()
+    || worker?.kind !== 'external' || worker.group !== invocation.selected.group
+    || worker.member !== invocation.selected.member || worker.cli !== invocation.selected.cli
+    || worker.model !== workerModelKey(invocation.selected.inferenceProvider, invocation.selected.model)
+    || reservation?.tokens != null && !(invocation.limits.tokens <= reservation.tokens)
+    || reservation?.costUsd != null && !(invocation.limits.costUsd !== null && invocation.limits.costUsd <= reservation.costUsd)
+    || registered?.managedAdmission?.requestId !== requestId || registered.managedAdmission.generation !== generation
+    || registered.managedWorker?.invocationPath !== options.invocationPath
+    || registered.managedWorker?.runDir !== options.runDir) {
+    throw new Error('Managed worker launch differs from the current claimed admission');
+  }
+  if (record.execution) {
+    const identity = sampleWorkerIdentity(process.pid);
+    if (record.execution.pid !== process.pid || !identity?.bootId || !identity.startTicks
+      || record.execution.startedAt !== `${identity.bootId}:${identity.startTicks}:${identity.uid}`) {
+      throw new Error('Managed worker supervisor identity differs');
+    }
+  }
+  return { ...record, deadlineAtMs };
+}
+