@aiwg/cli 2026.10.9 → 2026.10.10

package/dist/src/models/resolver.js

@@ -6,11 +6,8 @@
  * @architecture @.aiwg/architecture/enhanced-model-selection-design.md
  */
 import { ConfigLoader } from './config-loader.js';
-import { WORKER_DISPATCH_ENABLE_COMMAND, WORKER_DISPATCH_READINESS_COMMAND } from './worker-dispatch-offer.js';
-import { resolveWorkerGroupInstallation, resolveParallelism, validateWorkerGroupQualifications, validateWorkerGroupReferences, validateWorkerBudgetEnforcement, workerActivationDigests, workerConfigDigest, } from '../config/aiwg-config.js';
-import { qualifyWorkerInvocationProfile, validateWorkerPolicyRoute, validateWorkerModelObservation, assertWorkerLaunchMode, hasOperatorWorkerNativeRenderer, hasSelectionRelevantConflicts, workerContextHeadroom, workerModelKey, isCanonicalWorkerModelKey, WorkerSelectionPolicySchema, validateWorkerCatalogDiscovery, } from './provider-policy.js';
-import { MODEL_WRAPPERS } from './provider-models.js';
-import { routeModelTier } from './router.js';
+import { resolveWorkerPlan } from './worker-plan.js';
+export * from './worker-plan.js';
 /**
  * Resolves models for agents using tier system
  */
@@ -252,292 +249,4 @@ export class ModelResolver {
         this.loader.clearCache();
     }
 }
-const matchesChoice = (tuple, choice) => tuple.group === choice.group && tuple.member === choice.member && tuple.model === choice.model && tuple.effort === choice.effort;
-function findWorkerModelRow(rows, model) {
-    const matches = rows?.filter(row => row.id === model || row.apiModelId === model) ?? [];
-    return matches.length === 1 ? matches[0] : undefined;
-}
-function workerCatalogDigest(catalog) {
-    if (!catalog.discovery)
-        return workerConfigDigest(catalog);
-    // Offline loads synthesize fetchedAt. Keep catalog facts and persisted
-    // observation/qualification times pinned, independent of the load clock.
-    const { fetchedAt, ...discovery } = catalog.discovery;
-    return workerConfigDigest({ ...catalog, discovery });
-}
-/** Pure S1 resolution. No probing, launch, activation, admission, or writes.
- * Recheck against freshly loaded snapshots before preparing an invocation. */
-export function resolveWorkerPlan(snapshot, request) {
-    let parallelism = snapshot.config.parallelism ?? {};
-    const policy = snapshot.models.defaults.workerSelection;
-    const digests = {
-        ...snapshot.modelDigests,
-        configDigest: workerActivationDigests(snapshot.config).configDigest,
-        resolvedModelsDigest: workerConfigDigest(snapshot.models),
-        catalogDigest: workerCatalogDigest(snapshot.catalog),
-        profileDigest: workerConfigDigest([snapshot.registry, snapshot.installations]),
-        constraintsDigest: workerConfigDigest(snapshot.constraints),
-    };
-    const plan = {
-        mode: parallelism.worker_mode ?? 'direct', status: 'blocked', role: null, selected: null,
-        eligible: [], alternatives: [], exclusions: [], diagnostics: [], digests,
-        policy: structuredClone(policy), origins: structuredClone(snapshot.models.workerPolicyOrigins),
-        choice: null, capacity: 'conductor-guidance-only', ceilings: {},
-    };
-    const diagnostic = (code, pointer, message) => ({ code, pointer, message });
-    const block = (code, pointer, message) => {
-        plan.diagnostics.push(diagnostic(code, pointer, message));
-    };
-    if (!parallelism.worker_dispatch) {
-        plan.status = 'disabled';
-        block('OG_CONFIG_REFERENCE', '/parallelism/worker_dispatch', `Direct worker dispatch is off (parallelism.worker_dispatch). Enable with \`${WORKER_DISPATCH_ENABLE_COMMAND}\` `
-            + `(then check readiness with \`${WORKER_DISPATCH_READINESS_COMMAND}\`).`);
-        return plan;
-    }
-    const now = new Date(request.now);
-    if (!Number.isFinite(now.getTime()))
-        block('OG_CONFIG_REFERENCE', '/request/now', 'A valid current clock is required');
-    if (!request.context || typeof request.context.estimator !== 'string')
-        block('OG_CONFIG_REFERENCE', '/request/context', 'A named, bounded context estimate is required');
-    if (snapshot.constraints?.revokedModels?.some(key => !isCanonicalWorkerModelKey(key)))
-        block('OG_CONFIG_REFERENCE', '/constraints/revokedModels', 'Revocations require canonical inference model keys');
-    if (request.expectedDigests && (Object.keys(request.expectedDigests).length !== Object.keys(digests).length
-        || Object.entries(digests).some(([key, value]) => request.expectedDigests[key] !== value))) {
-        block('OG_CONFIG_REFERENCE', '/request/expectedDigests', 'Current input digests changed; resolve again');
-    }
-    if (Object.values(snapshot.modelDigests).length !== 3 || Object.values(digests).some(value => !/^sha256:[a-f0-9]{64}$/.test(value))) {
-        block('OG_CONFIG_REFERENCE', '/models', 'Current loader input digests are required');
-    }
-    if (plan.mode === 'managed') {
-        const activation = parallelism.activation;
-        if (!activation || ['configDigest', 'projectModelsDigest', 'userModelsDigest', 'builtinModelsDigest'].some(key => activation[key] !== digests[key])) {
-            block('OG_CONFIG_REFERENCE', '/parallelism/activation', 'Managed activation is missing or stale');
-        }
-    }
-    if (!policy)
-        block('OG_CONFIG_REFERENCE', '/defaults/workerSelection', 'Current merged worker policy is required');
-    const catalogErrors = validateWorkerCatalogDiscovery(snapshot.catalog.discovery);
-    if (catalogErrors.length)
-        block('OG_ADAPTER_UNQUALIFIED', '/catalog/discovery', catalogErrors.join('; '));
-    if (plan.diagnostics.length || !policy)
-        return plan;
-    const policyShape = WorkerSelectionPolicySchema.safeParse(policy);
-    if (!policyShape.success) {
-        block('OG_CONFIG_REFERENCE', '/defaults/workerSelection', policyShape.error.message);
-        return plan;
-    }
-    for (const message of validateWorkerGroupReferences(parallelism, policy))
-        block('OG_CONFIG_REFERENCE', '/parallelism', message);
-    if (plan.diagnostics.length)
-        return plan;
-    parallelism = resolveParallelism(parallelism, snapshot.config.providers?.[0]);
-    const ceilingLayers = [parallelism.budgets?.perRun, parallelism.budgets?.perTask,
-        { maxAttempts: parallelism.retry?.maxAttempts ?? 3 }, snapshot.constraints?.ceilings, request.ceilings];
-    for (const key of ['tokens', 'costUsd', 'wallSeconds', 'maxAttempts']) {
-        const values = ceilingLayers.map(layer => layer?.[key]).filter((value) => value !== undefined);
-        if (values.some(value => !Number.isFinite(value) || value < 0 || key !== 'costUsd' && !Number.isSafeInteger(value))) {
-            block('OG_CONFIG_REFERENCE', `/request/ceilings/${key}`, 'Ceilings must be finite nonnegative values; counts must be integers');
-        }
-        else if (values.length)
-            plan.ceilings[key] = Math.min(...values);
-    }
-    if (plan.ceilings.maxAttempts === 0)
-        block('OG_BUDGET_UNMEASURABLE', '/request/ceilings/maxAttempts', 'No task attempts remain');
-    const qualifiedRoles = {};
-    for (const [groupId, group] of Object.entries(parallelism.groups ?? {})) {
-        for (const member of group.members) {
-            const observed = findWorkerModelRow(snapshot.catalog.discovery?.instances?.[member.cli]?.models, member.model)?.worker;
-            qualifiedRoles[`${groupId}/${member.id}`] = observed?.qualification.status === 'qualified'
-                ? observed.qualification.roles.filter(role => policy.roleGuidance?.[role]?.groups.includes(groupId)) : [];
-        }
-    }
-    // Qualification gaps are group-scoped: an unqualified group must not block a
-    // request that never considers it. Gaps are applied once the candidates are known.
-    const qualificationGaps = validateWorkerGroupQualifications(parallelism, qualifiedRoles).map(diagnostic => ({
-        ...diagnostic, message: `${diagnostic.message}. Run aiwg doctor --probe-workers --qualify.`,
-    }));
-    const gapGroup = (diagnostic) => diagnostic.pointer.split('/')[3] ?? '';
-    const taskRole = request.taskClass ? policy.taskClasses?.[request.taskClass] : undefined;
-    const role = request.role ?? taskRole;
-    plan.role = role ?? null;
-    if (request.taskClass && (!taskRole || request.role && taskRole !== request.role))
-        block('OG_CONFIG_REFERENCE', '/request/taskClass', 'Unknown task class or conflicting role');
-    const guidance = role ? policy.roleGuidance?.[role] : undefined;
-    if (!role || !guidance)
-        block('OG_CONFIG_REFERENCE', '/defaults/workerSelection/roleGuidance', 'Requested role has no guidance');
-    if (request.member && !request.group)
-        block('OG_CONFIG_REFERENCE', '/request/member', 'Group-local member pins require a group');
-    if (request.group && !guidance?.groups.includes(request.group))
-        block('OG_CONFIG_REFERENCE', '/request/group', 'Group is outside role guidance');
-    if ([request.maxParallel, snapshot.constraints?.maxParallel].some(value => value !== undefined && (!Number.isSafeInteger(value) || value < 0)))
-        block('OG_CONFIG_REFERENCE', '/request/maxParallel', 'Capacity ceilings must be nonnegative integers');
-    if (request.requireDifferentFamily && (!request.reviewOf || validateWorkerModelObservation(request.reviewOf).length
-        || hasSelectionRelevantConflicts(request.reviewOf) || !request.reviewOf.family || request.reviewOf.family === 'unknown')) {
-        block('OG_MODEL_UNAPPROVED', '/request/reviewOf', 'Required review needs unambiguous observed source lineage');
-    }
-    const candidateGroups = request.group ? [request.group] : guidance?.groups ?? [];
-    const unqualifiedGroups = new Set(qualificationGaps.map(gapGroup));
-    const qualifiedGroups = candidateGroups.filter(groupId => !unqualifiedGroups.has(groupId));
-    if (!qualifiedGroups.length) {
-        plan.diagnostics.push(...qualificationGaps.filter(gap => candidateGroups.includes(gapGroup(gap))));
-    }
-    else {
-        // Unpinned requests skip an unqualified guidance group visibly instead of failing the role.
-        for (const groupId of candidateGroups.filter(groupId => unqualifiedGroups.has(groupId))) {
-            const gaps = qualificationGaps.filter(gap => gapGroup(gap) === groupId);
-            for (const member of parallelism.groups?.[groupId]?.members ?? []) {
-                plan.exclusions.push({ group: groupId, member: member.id, model: member.model, effort: null, diagnostics: gaps });
-            }
-        }
-    }
-    if (plan.diagnostics.length || !role || !guidance)
-        return plan;
-    const wrapperPin = snapshot.models.agentOverrides[MODEL_WRAPPERS[role]]?.['model-override'];
-    const groups = qualifiedGroups;
-    for (const groupId of groups) {
-        const group = parallelism.groups[groupId];
-        const permissions = { ...group.execution, transport: group.execution?.transport ?? 'shell' };
-        const transport = permissions.transport;
-        // Priority is guidance only. Preserve declaration order for ties; fallback order stays explicit.
-        const members = group.members.map((member, index) => ({ member, index })).sort((a, b) => (a.member.priority ?? 100) - (b.member.priority ?? 100) || a.index - b.index);
-        for (const { member } of members) {
-            const binding = snapshot.installations[member.cli];
-            const discovery = snapshot.catalog.discovery?.instances?.[member.cli];
-            const row = findWorkerModelRow(discovery?.models, member.model);
-            const observation = row?.worker;
-            const efforts = request.effort !== undefined ? [request.effort]
-                : [...new Set([guidance.initialEffort, ...guidance.effortLadder])];
-            for (const effort of efforts) {
-                const tuple = { group: groupId, member: member.id, model: member.model, effort };
-                const reasons = [];
-                const deny = (code, pointer, message) => { reasons.push(diagnostic(code, pointer, message)); };
-                const pointer = `/parallelism/groups/${groupId}/members/${member.id}`;
-                if (request.transport !== undefined && request.transport !== transport)
-                    deny('OG_POLICY_RELAXATION', '/request/transport', 'Requested transport differs from resolved group permissions');
-                if (member.enabled === false || parallelism.clis?.[member.cli]?.enabled === false)
-                    deny('OG_CONFIG_REFERENCE', pointer, 'Member or installation is disabled');
-                if (!member.roles.includes(role))
-                    deny('OG_CONFIG_REFERENCE', pointer, 'Member does not cover requested role');
-                const pinMismatch = request.member && request.member !== member.id || request.model && request.model !== member.model || wrapperPin && wrapperPin !== member.model;
-                const substitution = request.substitution && matchesChoice(tuple, request.substitution) && request.substitution.rationale.trim();
-                if (pinMismatch && !substitution)
-                    deny('OG_PIN_MISMATCH', pointer, 'Exact request or wrapper pin requires explicit substitution');
-                if (!observation || !binding || !row?.llmProvider || !row.apiModelId)
-                    deny('OG_ADAPTER_UNQUALIFIED', pointer, 'Missing exact model, inference provider, observation or current installation evidence. Run aiwg doctor --probe-workers --qualify.');
-                if (observation && binding && row?.llmProvider && row.apiModelId) {
-                    const shapeErrors = validateWorkerModelObservation(observation);
-                    if (shapeErrors.length) {
-                        deny('OG_ADAPTER_UNQUALIFIED', '/worker', shapeErrors.join('; '));
-                        plan.exclusions.push({ ...tuple, diagnostics: reasons });
-                        continue;
-                    }
-                    if (observation.cliId !== member.cli || observation.runtimeVersion !== binding.cliVersion
-                        || observation.accountScope !== binding.accountScope || observation.endpointFingerprint !== binding.endpointFingerprint
-                        || discovery?.accountBinding !== binding.accountScope || discovery?.runtimeVersion !== binding.cliVersion
-                        || parallelism.clis?.[member.cli]?.accountScope && parallelism.clis[member.cli].accountScope !== binding.accountScope) {
-                        deny('OG_ADAPTER_UNQUALIFIED', pointer, 'Catalog and current installation scope differ');
-                    }
-                    reasons.push(...validateWorkerPolicyRoute({ policy, role, inferenceProvider: row.llmProvider, apiModelId: row.apiModelId,
-                        selectedModel: member.model, effort, identityEvidence: binding.identityEvidence, observation,
-                        wrapperPin, ...(substitution ? { substitution: request.substitution } : {}), dataClass: request.dataClass, now, context: request.context }));
-                    if (request.requireDifferentFamily && (observation.family === 'unknown' || observation.family === request.reviewOf.family))
-                        deny('OG_MODEL_UNAPPROVED', '/worker/family', 'Required review must use a different observed family');
-                    try {
-                        const { adapter } = resolveWorkerGroupInstallation(parallelism, member.cli, snapshot.registry);
-                        const configuredProfile = parallelism.clis?.[member.cli]?.invocationProfile;
-                        const profilePointer = `/parallelism/clis/${member.cli}/invocationProfile`;
-                        if (configuredProfile && !Object.hasOwn(adapter.invocationProfiles ?? {}, configuredProfile)) {
-                            deny('OG_CONFIG_REFERENCE', profilePointer, 'Configured invocation profile is not registered for this adapter; select a registered profile.');
-                        }
-                        else if (configuredProfile && configuredProfile !== binding.profile) {
-                            deny('OG_PIN_MISMATCH', profilePointer, 'Configured invocation profile differs from installation qualification; qualify the selected profile again.');
-                        }
-                        const configuredServer = parallelism.clis?.[member.cli]?.mcpServerRef;
-                        if (transport === 'mcp' && configuredServer && configuredServer !== binding.mcp?.serverRef)
-                            throw new Error('Configured MCP server changed');
-                        if (!hasOperatorWorkerNativeRenderer(adapter) && (adapter.capabilities.modelPin === 'unsupported' || !adapter.capabilities.nativeFallbackControllable))
-                            throw new Error('Exact model or fallback control is unqualified; qualify an adapter with these controls');
-                        if (policy.guards?.denySelfDelegation !== false && !adapter.capabilities.nestedAgentsControllable)
-                            throw new Error('Child-agent control is unqualified. Review models.json defaults.workerSelection.guards.denySelfDelegation; false permits uncontrolled child agents without qualifying their behavior.');
-                        if (binding.identityEvidence === 'backend-attested' && adapter.capabilities.modelPin !== 'observed')
-                            throw new Error('Requested-only mapping cannot attest backend identity');
-                        if (!hasOperatorWorkerNativeRenderer(adapter) && group.execution?.sandbox && !adapter.capabilities.sandboxModes.includes(group.execution.sandbox))
-                            throw new Error('Requested sandbox mode is unqualified');
-                        assertWorkerLaunchMode(adapter, permissions);
-                        qualifyWorkerInvocationProfile(adapter, { profile: binding.profile, transport, cliVersion: binding.cliVersion,
-                            policy, permissions, effort, boundary: binding.boundary,
-                            requiredControls: request.requiredControls, mcp: binding.mcp });
-                        if (hasOperatorWorkerNativeRenderer(adapter) && transport === 'shell' && permissions.sandbox === 'external') {
-                            reasons.push({ code: 'OG_SANDBOX_EXTERNAL', blocking: false,
-                                pointer: `/parallelism/groups/${groupId}/execution/sandbox`,
-                                message: `${adapter.provider} CLI's own sandbox is disabled by explicit external policy; isolation relies on the per-task worktree and launcher resource scope.` });
-                        }
-                        const { maxAttempts: _maxAttempts, ...budgetLimits } = plan.ceilings;
-                        const budgetDimensions = { tokens: 'tokens', cost: 'costUsd', 'wall-time': 'wallSeconds' };
-                        const enforceable = adapter.capabilities.hardBudget.map(key => budgetDimensions[key]);
-                        for (const message of validateWorkerBudgetEnforcement({ ...parallelism.budgets, perTask: budgetLimits }, enforceable))
-                            deny('OG_BUDGET_UNMEASURABLE', '/parallelism/budgets', message);
-                    }
-                    catch (error) {
-                        deny('OG_ADAPTER_UNQUALIFIED', pointer, String(error));
-                    }
-                    let key;
-                    try {
-                        key = workerModelKey(row.llmProvider, row.apiModelId);
-                    }
-                    catch {
-                        plan.exclusions.push({ ...tuple, diagnostics: reasons });
-                        continue;
-                    }
-                    if (snapshot.constraints?.revokedModels?.includes(key))
-                        deny('OG_MODEL_UNAPPROVED', '/constraints/revokedModels', 'Current model revocation');
-                    if (snapshot.constraints?.unavailableMembers?.includes(`${groupId}/${member.id}`))
-                        deny('OG_ADAPTER_UNQUALIFIED', pointer, 'Member is currently unavailable');
-                    const premium = ['premium', 'max-quality'].includes(guidance.tier) || observation.pricing.costClass === 'premium';
-                    // Worker candidates always invoke a model; deterministic/routine hints must not bypass premium authority.
-                    const authority = routeModelTier({ ...request.authority, deterministic: false, routine: false,
-                        defaultTier: guidance.tier === 'economy' ? 1 : 2, requestedPremium: premium || request.authority?.requestedPremium });
-                    if (authority.requiresConfirmation)
-                        deny('OG_MODEL_UNAPPROVED', '/request/authority', `${authority.rationale.join('; ')}; agents may pass --authorize-premium only after the human explicitly confirmed the premium escalation (escalation-discipline rule)`);
-                    const installation = parallelism.clis?.[member.cli];
-                    const caps = [parallelism.max_parallel_subagents, group.maxParallel, parallelism.admission?.groupCaps?.[groupId],
-                        parallelism.admission?.memberCaps?.[`${groupId}/${member.id}`], parallelism.admission?.cliCaps?.[member.cli],
-                        parallelism.admission?.modelCaps?.[key], installation && parallelism.admission?.quotaCaps?.[installation.quotaScope],
-                        snapshot.constraints?.maxParallel, request.maxParallel].filter((value) => value !== undefined);
-                    const effectiveMaxParallel = caps.length ? Math.min(...caps) : null;
-                    if (effectiveMaxParallel === 0)
-                        deny('OG_ADAPTER_UNQUALIFIED', '/constraints/maxParallel', 'Current capacity ceiling is zero');
-                    if (!reasons.some(reason => reason.blocking !== false))
-                        plan.eligible.push({ ...tuple, cli: member.cli,
-                            inferenceProvider: row.llmProvider, modelKey: key, family: observation.family, identityEvidence: binding.identityEvidence,
-                            profile: binding.profile, transport,
-                            permissions: structuredClone(permissions), context: workerContextHeadroom(request.context, observation),
-                            observedAt: observation.observedAt, verifiedAt: observation.verifiedAt, observationRef: observation.recordId,
-                            effectiveMaxParallel, diagnostics: reasons });
-                }
-                if (reasons.some(reason => reason.blocking !== false))
-                    plan.exclusions.push({ ...tuple, diagnostics: reasons });
-            }
-        }
-    }
-    if (request.choice) {
-        if (!request.choice.rationale.trim())
-            block('OG_CONFIG_REFERENCE', '/request/choice/rationale', 'Conductor choice requires a rationale');
-        plan.selected = plan.eligible.find(tuple => matchesChoice(tuple, request.choice)) ?? null;
-        if (!plan.selected)
-            block('OG_MODEL_UNAPPROVED', '/request/choice', 'Conductor choice is outside the eligible set');
-    }
-    else
-        plan.selected = plan.eligible[0] ?? null;
-    if (plan.diagnostics.length)
-        plan.selected = null;
-    if (plan.selected) {
-        plan.status = 'eligible';
-        plan.diagnostics.push(...plan.selected.diagnostics.filter(item => item.code === 'OG_SANDBOX_EXTERNAL'));
-        plan.choice = { source: request.choice ? 'conductor' : 'default', rationale: request.choice?.rationale ?? 'Role group order, member priority/declaration order, then qualified effort ladder',
-            ...(request.substitution && matchesChoice(plan.selected, request.substitution) ? { substitution: structuredClone(request.substitution) } : {}) };
-    }
-    plan.alternatives = plan.eligible.filter(tuple => tuple !== plan.selected);
-    return plan;
-}
 //# sourceMappingURL=resolver.js.map

package/dist/src/models/worker-artifact-binding.mjs

@@ -0,0 +1,12 @@
+/** Bind pure artifact declarations to the installed adapter's argv and invocation identity. */
+import { validateWorkerArtifacts } from '../serve/worker-artifacts.mjs';
+
+export function buildInstalledWorkerTransport(instance, input, profile, invocation, executable, environment) {
+  const artifacts = typeof instance.buildWorkerArtifacts === 'function' ? instance.buildWorkerArtifacts(input) : undefined;
+  validateWorkerArtifacts({ ...input, artifacts });
+  return {
+    argv: [executable, ...instance.buildWorkerArgs(input, profile, input.permissions)],
+    stdin: invocation.stdin, envNames: Object.keys(environment),
+    ...(artifacts === undefined ? {} : { artifacts }),
+  };
+}

package/dist/src/models/worker-direct-readiness-policy.js

@@ -0,0 +1,155 @@
+// Resolves direct-worker bindings, member context and offline dispatch eligibility.
+import { resolveWorkerGroupInstallation } from '../config/aiwg-config.js';
+import { resolveWorkerPlan } from './resolver.js';
+export { memberReferences, memberLabels, describeConfigContext, allConfiguredCliIds, isCliRequired, advisoryStatus } from './worker-member-references.js';
+export const SMOKE_NOTE = 'A version probe alone leaves profiles unqualified. To record direct CLI operator approval, run aiwg doctor --probe-workers --qualify; a version probe is not an authenticated smoke run (see #3005).';
+const ADAPTER_REFERENCE = /^(providers|workerAdapters):(.+)$/;
+/**
+ * Resolve the configured binding by exact, case-sensitive namespace:id
+ * lookup — the same shape `resolveWorkerAdapter` (provider-policy.ts) uses
+ * for dispatch and `validateParallelismConfig` uses for config validation.
+ * No alias normalization happens for either namespace, so a binding this
+ * accepts is also a binding the public config validator accepts, and a
+ * custom `workerAdapters:<id>` reference resolves against
+ * `registry.workerAdapters`, never against the provider-alias registry.
+ *
+ * For the `providers` namespace this falls back from `workerAdapter` to
+ * `workerHealthAdapter` when no direct-dispatch binding is pinned yet — the
+ * install/version metadata is identical either way, and that is exactly
+ * what lets install readiness and dispatch eligibility disagree honestly
+ * (installed and in range, but the resolver still has no workerAdapter to
+ * dispatch through).
+ */
+export function resolveDirectBinding(registry, configuredAdapter, cli) {
+    let namespace;
+    let id;
+    if (configuredAdapter !== undefined) {
+        const match = ADAPTER_REFERENCE.exec(configuredAdapter.trim());
+        if (!match)
+            return { error: `Invalid worker adapter reference '${configuredAdapter}'` };
+        [, namespace, id] = match;
+    }
+    else {
+        namespace = 'providers';
+        id = cli;
+    }
+    if (namespace === 'providers') {
+        const entry = registry.providers[id];
+        const adapter = entry?.workerAdapter ?? entry?.workerHealthAdapter;
+        if (!adapter)
+            return { error: `No direct worker profile is registered for binding 'providers:${id}'` };
+        return { adapter, adapterRef: `providers:${id}` };
+    }
+    const adapter = registry.workerAdapters?.[id];
+    if (!adapter)
+        return { error: `Unknown worker adapter reference 'workerAdapters:${id}'` };
+    return { adapter, adapterRef: `workerAdapters:${id}` };
+}
+const offlineDirectContext = () => ({ estimator: 'doctor-offline-direct-context-v1', briefTokens: 0, inputTokens: 0, toolOutputAllowance: 0, reservedOutput: 0 });
+/**
+ * Dispatch eligibility from the actual offline dispatch resolver
+ * (`resolveWorkerPlan`): called once per role for every group member
+ * referencing this cli, never re-derived. A resolvable binding alone is not
+ * reported as eligible — eligibility requires the resolver to actually place
+ * at least one referencing member in its eligible/alternatives set. Refusals
+ * are member-specific and name the resolver's own missing-evidence or policy
+ * diagnostics.
+ */
+function resolveEligibilityFromDispatchResolver(resolverSnapshot, registry, cli, refs) {
+    const snapshot = {
+        config: resolverSnapshot.config, models: resolverSnapshot.models, modelDigests: resolverSnapshot.modelDigests,
+        catalog: resolverSnapshot.catalog, registry, installations: {},
+    };
+    const diagnostics = new Map();
+    const uncovered = [];
+    for (const ref of refs) {
+        if (!ref.enabled)
+            continue;
+        const matches = (tuple) => tuple.group === ref.groupId && tuple.member === ref.memberId;
+        const seen = [];
+        let eligibleHere = false;
+        for (const role of ref.member.roles) {
+            const plan = resolveWorkerPlan(snapshot, {
+                role: role, group: ref.groupId, member: ref.memberId,
+                now: resolverSnapshot.now, context: offlineDirectContext(),
+            });
+            if ([plan.selected, ...plan.alternatives].some(tuple => tuple && matches(tuple))) {
+                eligibleHere = true;
+                break;
+            }
+            const exclusion = plan.exclusions.find(matches);
+            for (const diagnostic of exclusion?.diagnostics ?? plan.diagnostics) {
+                // Only an exact member pointer is generalized; other config pointers
+                // remain distinct even when their diagnostic text happens to match.
+                const memberPointer = `/parallelism/groups/${ref.groupId}/members/${ref.memberId}`;
+                const pointer = diagnostic.pointer === memberPointer || diagnostic.pointer.startsWith(`${memberPointer}/`)
+                    ? `/parallelism/groups/${ref.groupId}/members${diagnostic.pointer.slice(memberPointer.length)}`
+                    : diagnostic.pointer;
+                seen.push({ ...diagnostic, pointer, members: [`${ref.groupId}/${ref.memberId}`],
+                    roles: diagnostic.roles ?? [role] });
+            }
+        }
+        if (eligibleHere) {
+            return { eligibility: 'eligible',
+                detail: `Dispatch resolver accepts cli '${cli}' for group '${ref.groupId}' member '${ref.memberId}'. `
+                    + `Dispatch eligibility: eligible. ${SMOKE_NOTE}` };
+        }
+        if (!seen.length)
+            uncovered.push(`${ref.groupId}/${ref.memberId}`);
+        for (const diagnostic of seen) {
+            const key = JSON.stringify([diagnostic.code, diagnostic.pointer, diagnostic.message,
+                diagnostic.blocking, diagnostic.origins]);
+            const shared = diagnostics.get(key);
+            if (shared) {
+                shared.members = [...new Set([...shared.members, ...diagnostic.members])];
+                shared.roles = [...new Set([...shared.roles, ...diagnostic.roles])];
+            }
+            else
+                diagnostics.set(key, diagnostic);
+        }
+    }
+    if (!diagnostics.size && !uncovered.length) {
+        return { eligibility: 'blocked',
+            detail: `Dispatch resolver has no enabled group member to evaluate for cli '${cli}'. `
+                + `Dispatch eligibility: blocked. ${SMOKE_NOTE}` };
+    }
+    const distinct = [...diagnostics.values()];
+    const reasons = distinct.map(diagnostic => `${diagnostic.code} ${diagnostic.pointer}: ${diagnostic.message}`
+        + ` [roles: ${diagnostic.roles.join(', ')}; members: ${diagnostic.members.join(', ')}]`);
+    if (uncovered.length)
+        reasons.push(`No qualified route [members: ${uncovered.join(', ')}]`);
+    return { eligibility: 'blocked', diagnostics: distinct,
+        detail: `Dispatch resolver refuses cli '${cli}': ${reasons.join('; ')}. `
+            + `Dispatch eligibility: blocked. ${SMOKE_NOTE}` };
+}
+/**
+ * Binding-only fallback used only when the caller has not supplied a
+ * `resolverSnapshot` (for example a direct unit-level call that never
+ * resolved the wider model config/catalog). States plainly that this is a
+ * binding-level result, not the dispatch resolver's verdict.
+ */
+function resolveEligibilityFromBindingOnly(parallelism, registry, cli, installReady) {
+    try {
+        const resolved = resolveWorkerGroupInstallation(parallelism, cli, registry);
+        return { eligibility: 'eligible',
+            detail: `Resolver accepts cli '${cli}' (binding '${resolved.installation.adapter}'). Dispatch eligibility: eligible at binding level only — `
+                + `no resolver snapshot was supplied, so group/member qualification was not evaluated. `
+                + `Launch additionally requires current installation evidence and model observation under the dispatch resolver's gates. `
+                + `${SMOKE_NOTE}` };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        const readyNote = installReady
+            ? ' The CLI is installed with an in-range version, but dispatch stays refused for the reason above; '
+                + `an authenticated smoke run (see #3005) alone does not satisfy the resolver gates. ${SMOKE_NOTE}`
+            : ` ${SMOKE_NOTE}`;
+        return { eligibility: 'blocked',
+            detail: `Resolver refuses cli '${cli}': ${reason}. Dispatch eligibility: blocked.${readyNote}` };
+    }
+}
+export function checkDispatchEligibility(parallelism, registry, cli, installReady, resolverSnapshot, refs) {
+    if (resolverSnapshot && refs.length)
+        return resolveEligibilityFromDispatchResolver(resolverSnapshot, registry, cli, refs);
+    return resolveEligibilityFromBindingOnly(parallelism, registry, cli, installReady);
+}
+//# sourceMappingURL=worker-direct-readiness-policy.js.map