@aiwg/cli 2026.10.9 → 2026.10.11

package/agentic/code/providers/model-capabilities.v1.json

@@ -4,6 +4,9 @@
   "verifiedAt": "2026-07-20",
   "providers": {
     "antigravity": {
+      "sessionEnvAllowlist": [
+        "GEMINI_API_KEY"
+      ],
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
@@ -19,7 +22,7 @@
       "invalidPinFallback": "Provider validation/error; never assume fallback",
       "configTarget": "agy launch arguments; custom-agent model tiers are not projected from generic AIWG model ids",
       "artifactFormat": "YAML frontmatter plus Markdown; runtime --model and --effort flags",
-      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed",
+      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://antigravity.google/docs/cli/subagents/",
       "verifiedAt": "2026-09-04",
       "workerHealthAdapter": {
@@ -154,7 +157,7 @@
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "--dangerously-skip-permissions and --remote-control are never part of the direct profile; neither was ever shipped as a new argv-prompt path.",
               "A soft-denied tool permission request (exit 0, stderr notice naming the allow-rule needed) is NOT the same as success; its exact stderr wording is not evidenced from help or changelog, so this is an open, honestly-marked detection gap rather than an invented check (tools/ralph-external/lib/antigravity-adapter.mjs ANTIGRAVITY_SOFT_DENY_RISK_NOTE).",
-              "GEMINI_API_KEY in envAllowlist is a strings-sourced GUESS, not confirmed to authenticate this CLI. Live fix-round-1 probes (D/E, no login present) show a bare run stops at \"Error: authentication required. Run 'agy' to log in, then retry.\" — this is an interactive Google-account login, not a documented env-key or OpenRouter-style flag. The manual smoke run is BLOCKED until an operator completes an interactive `agy` login on the target host.",
+              "GEMINI_API_KEY is documented at https://antigravity.google/docs/install/ (reviewed 2026-10-26): settings.json must also set modelProvider to gemini; the key alone has no effect. Earlier 1.3.3 probes only exercised missing account login. This documentation confirms the credential name, not authenticated execution or qualification of this version-bound worker profile.",
               "The 1.3.3 --effort enum (low|medium|high|xhigh|max) supersedes the stale 1.1.26-pinned three-value set in tools/providers/antigravity-transport.mjs (a separate, unedited legacy transport used by the MCP/doctor bridge, not this direct-shell profile).",
               "Flag validation happens BEFORE auth: live probe F, `agy --print=x --input-format bogus --output-format stream-json`, returned \"Error: unknown --input-format \\\"bogus\\\" (want text or stream-json)\" without reaching the auth stop, confirming --input-format is validated against exactly {text, stream-json} independent of login state.",
               "The brief reaches agy through adapter-frame: the installed buildWorkerStdinFrame hook supplies exactly one NDJSON user message and EOF. The stdin control stays unqualified pending one authenticated smoke run."
@@ -510,7 +513,7 @@
             "approval_policy=\"${approval}\"",
             "--skip-git-repo-check",
             "-o",
-            "${final}",
+            "${final}.last-message",
             "--json",
             "-"
           ],
@@ -575,7 +578,7 @@
               },
               "finalOutput": {
                 "support": "unqualified",
-                "mapping": "[-o/--output-last-message F] last-message file; --json carries the JSONL thread/turn/item/error event stream on stdout",
+                "mapping": "[-o/--output-last-message F.last-message] launcher-owned last-message capture, separate from worker-written workerClaims JSON at F (brief output.resultPath / --final-output); --json carries the JSONL thread/turn/item/error event stream on stdout",
                 "evidence": "H: codex-cli 0.161.0 exec --help documents -o/--output-last-message and --json; unqualified until live evidence"
               },
               "stdin": {
@@ -865,6 +868,9 @@
       }
     },
     "cursor": {
+      "sessionEnvAllowlist": [
+        "CURSOR_API_KEY"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -873,7 +879,7 @@
       "invalidPinFallback": "Plan/admin fallback may apply; record observed result",
       "configTarget": ".cursor/agents/*.md",
       "artifactFormat": "YAML frontmatter plus Markdown",
-      "verification": "Schema fixture and entitled Cursor invocation",
+      "verification": "Schema fixture and entitled Cursor invocation. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://cursor.com/docs/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -1465,6 +1471,9 @@
       }
     },
     "warp": {
+      "sessionEnvAllowlist": [
+        "WARP_API_KEY"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -1473,7 +1482,7 @@
       "invalidPinFallback": "Profile availability dependent",
       "configTarget": "Warp agent profile or run configuration",
       "artifactFormat": "Saved profile / run control plane",
-      "verification": "Inspect active profile and run metadata",
+      "verification": "Inspect active profile and run metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.warp.dev/agent-platform/capabilities/agent-profiles-permissions",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -1606,7 +1615,7 @@
               "Unknown model, effort, permission or required step mappings block dispatch.",
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "There is NO `oz` symlink on the evidenced host: the real executable is `warp-terminal`, with `agent run` etc. as its subcommands; `runtimeDriver`/`executable` are pinned to that, not to a bare `oz`.",
-              "BRIEF TRANSPORT IS BLOCKED PENDING A SHARED CHANGE: `--prompt` places the brief on argv (never emitted by this profile); `-f/--file` is NOT a member of the required `<--prompt|--saved-prompt|--task-id|--skill>` group (live probe, 2026-10-11) and its own config-file schema is undocumented, so it cannot be assumed to carry the brief; `--skill` is the only remaining required-group member that can carry free text (`agent run --help`: 'Use a skill as the base prompt for the agent' when given without `--prompt`), but its search root relative to `--cwd` and behavior when the skill is missing are UNVERIFIED behind the login gate. The pure adapter derives a distinct `aiwg-brief-<invocationId>` path without writes and refuses unsafe IDs. `buildWarpBriefSkillFile()` (tools/ralph-external/lib/warp-adapter.mjs) exports the exact path/content an execution-time file-generation primitive would need to write before this argv runs; that primitive does not exist in the shared session-launcher today (the same class of gap as #2998 for Antigravity's stdin frame). Needed shared change: an execution-time generated-artifact primitive the session-launcher can call with the adapter-exported `{ relativePath, content }` immediately before spawning the worker process, with invocation identity supplied to the adapter, refusal to overwrite an existing path, cleanup afterward, and no commits of generated skills (pending #3002). Brief transport is NOT available today.",
+              "Brief delivery is wired through buildWorkerArtifacts and the shared session launcher: one bounded workspace-relative .agents/skills/aiwg-brief-<invocationId>/SKILL.md file, exclusive creation, no symlink components, collision preservation and cleanup on failure, completion or stop. The same invocation ID binds --skill and the artifact path; brief text never rides argv. Real skill search relative to --cwd and missing-skill behavior remain UNVERIFIED behind authentication; synthetic file-delivery tests do not qualify the profile.",
               "`--environment`/`-e` (cloud environment/runner) and `--harness claude|codex` (third-party harness mode) are documented but NEVER emitted by this profile; the cloud subcommand is also never emitted. Execution location is unverified until an authenticated run.",
               "`--no-snapshot` is always emitted: `agent run --help` documents it as disabling the end-of-run workspace snapshot upload. This flag does not establish execution location or absence of other uploads.",
               "No live success/error output was observed (no login on the evidenced host): `finalOutput`/`structuredOutput` support is grade H/R only, never upgraded past `unqualified`."
@@ -2284,6 +2293,7 @@
       }
     },
     "windsurf": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2292,7 +2302,7 @@
       "invalidPinFallback": "No portable custom-child selector",
       "configTarget": "No supported portable artifact field",
       "artifactFormat": "Informational policy only",
-      "verification": "Assert unsupported fields are omitted",
+      "verification": "Assert unsupported fields are omitted. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.devin.ai/desktop/cascade/skills",
       "verifiedAt": "2026-07-20",
       "workerHealthCoverage": {
@@ -2312,6 +2322,22 @@
       }
     },
     "openclaw": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "OPENCLAW_HOME",
+        "OPENCLAW_STATE_DIR",
+        "OPENCLAW_CONFIG_PATH",
+        "OPENCLAW_GATEWAY_URL",
+        "OPENCLAW_GATEWAY_TOKEN",
+        "OPENCLAW_GATEWAY_PASSWORD"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2320,7 +2346,7 @@
       "invalidPinFallback": "Provider/account fallback must be observed",
       "configTarget": "OpenClaw subagent configuration",
       "artifactFormat": "JSON/JSONC runtime configuration",
-      "verification": "Inspect resolved subagent metadata",
+      "verification": "Inspect resolved subagent metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.openclaw.ai/tools/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2508,6 +2534,7 @@
       }
     },
     "grokbot": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "informational",
@@ -2516,7 +2543,7 @@
       "invalidPinFallback": "Report unsupported; do not fabricate xAI/Grok model pins as native",
       "configTarget": "Grok Bot has no verified AIWG-owned model config path",
       "artifactFormat": "Informational only",
-      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational",
+      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
       "verifiedAt": "2026-09-15",
       "workerHealthCoverage": {
@@ -2536,6 +2563,10 @@
       }
     },
     "grok-build": {
+      "sessionEnvAllowlist": [
+        "XAI_API_KEY",
+        "GROK_HOME"
+      ],
       "agent": "inherited",
       "skill": "inherited",
       "globalChild": "native",
@@ -2544,7 +2575,7 @@
       "invalidPinFallback": "Report the unavailable alias; use the sole discovered model only when exactly one is available",
       "configTarget": "$GROK_HOME/config.toml [models] and [model.<alias>] (read-only discovery)",
       "artifactFormat": "Grok Build model alias",
-      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers",
+      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.x.ai/build/settings",
       "verifiedAt": "2026-09-21",
       "workerHealthAdapter": {
@@ -2736,6 +2767,25 @@
       }
     },
     "hermes": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_TOKEN",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "OPENAI_BASE_URL",
+        "ANTHROPIC_BASE_URL",
+        "OPENROUTER_BASE_URL",
+        "CUSTOM_BASE_URL",
+        "HERMES_HOME",
+        "HERMES_INFERENCE_PROVIDER"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2744,7 +2794,7 @@
       "invalidPinFallback": "Provider resolution is global; report actual model",
       "configTarget": "Hermes delegation configuration",
       "artifactFormat": "Global CLI/config setting",
-      "verification": "Inspect Hermes delegation configuration",
+      "verification": "Inspect Hermes delegation configuration. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2927,6 +2977,19 @@
       }
     },
     "openhuman": {
+      "sessionEnvAllowlist": [
+        "OPENHUMAN_CORE_TOKEN",
+        "OPENHUMAN_CORE_RPC_URL",
+        "OPENHUMAN_CORE_HOST",
+        "OPENHUMAN_CORE_PORT",
+        "OPENHUMAN_WORKSPACE",
+        "OPENHUMAN_DOTENV_PATH",
+        "OPENHUMAN_KEYRING_MASTER_KEY",
+        "OPENHUMAN_KEYRING_MASTER_KEY_FILE",
+        "OPENHUMAN_APP_ENV",
+        "BACKEND_URL",
+        "OPENHUMAN_MODEL"
+      ],
       "agent": "compiled",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2935,7 +2998,7 @@
       "invalidPinFallback": "Exact pins validate; semantic hints route dynamically",
       "configTarget": "OpenHuman agent TOML",
       "artifactFormat": "Standalone TOML agent definition",
-      "verification": "Parse against OpenHuman definition schema",
+      "verification": "Parse against OpenHuman definition schema. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -3154,6 +3217,7 @@
             "${effort}",
             "--workspace",
             "${workspace}",
+            "--trust-workspace",
             "--approval-mode",
             "never",
             "--approval-judge",
@@ -3246,8 +3310,8 @@
               },
               "trust": {
                 "support": "unqualified",
-                "mapping": "[]",
-                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
+                "mapping": "[\"--trust-workspace\"]",
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation. Tier 0 workspaces are conductor-prepared worker trees the conductor owns, so the profile binds --trust-workspace by default (#3685: untrusted Muse loads project_sources=0 with user skills only and empty hook admission; trusted loads project_sources=1, project skills and hooks)."
               },
               "children": {
                 "support": "unqualified",
@@ -3268,13 +3332,13 @@
               "Live qualification is an open S1 blocker; installed help and synthetic/echo mechanics are not paid inference qualification.",
               "Configured-model events provide runtime-configured identity only, never backend attestation.",
               "Contributor data policy is explicit; shared policy denies contributor models and never silently selects the CLI default.",
-              "Workspace trust defaults off; only a host-qualified trust mapping may load rules/skills. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
+              "Workspace trust is bound on for conductor-prepared worker trees (the conductor owns the worktree), so project rules/skills/hooks load; only a host-qualified trust mapping may change it. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
               "Host qualification must bind an absolute output-schema mapping and include that schema in runtimeFiles.",
               "Muse JSONL strict normalization needs the shared strict-parser hook; the MCP bridge must consume the selected provider parser. MSP is not MCP.",
               "Semantic step/tool completion grammar and native session-log layout remain unavailable; unrelated logs, deltas and CPU cannot establish progress.",
               "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions.",
               "Operator qualification approves the installed direct renderer, not authenticated inference or backend model identity.",
-              "Workspace trust defaults off. Only never approval is supported. Explicit unsupported controls block dispatch.",
+              "Workspace trust is on for conductor-prepared worker trees. Only never approval is supported. Explicit unsupported controls block dispatch.",
               "Self-delegation must be explicitly allowed by policy; no native child-denial flag is assumed."
             ],
             "health": {
@@ -3326,6 +3390,200 @@
       }
     }
   },
+  "workerAdapters": {
+    "local-http": {
+      "version": 1,
+      "id": "local-http",
+      "provider": "ollama",
+      "adapterVersion": "1",
+      "supportedVersions": "8.18.0",
+      "runtimeDriver": "installed:local-http",
+      "catalogAdapter": {
+        "kind": "http",
+        "locator": "/api/tags",
+        "parser": "ollama-model-list-v1",
+        "timeoutSeconds": 10,
+        "maxBytes": 65536
+      },
+      "invocation": {
+        "kind": "process",
+        "executable": "curl",
+        "argv": [
+          "-q",
+          "-sS",
+          "--max-redirs",
+          "0",
+          "--proto",
+          "=http",
+          "--noproxy",
+          "*",
+          "--connect-timeout",
+          "10",
+          "--max-time",
+          "300",
+          "--max-filesize",
+          "10485760",
+          "--fail-with-body",
+          "-H",
+          "Content-Type: application/json",
+          "-X",
+          "POST",
+          "http://${endpoint}/api/generate",
+          "--data-binary",
+          "@-"
+        ],
+        "stdin": "adapter-frame",
+        "cwd": "${workspace}",
+        "envAllowlist": [
+          "OLLAMA_HOST"
+        ],
+        "versionArgv": [
+          "--version"
+        ],
+        "versionPattern": "^curl ([0-9A-Za-z.+-]{1,128}) [\\s\\S]{1,4096}$",
+        "maxOutputBytes": 10485760
+      },
+      "capabilities": {
+        "output": "validated-file",
+        "modelPin": "requested",
+        "effort": "not-applicable",
+        "cancel": "process-group",
+        "resume": false,
+        "sandboxModes": [
+          "external"
+        ],
+        "nestedAgentsControllable": true,
+        "nativeFallbackControllable": true,
+        "hardBudget": []
+      },
+      "qualification": {
+        "status": "unqualified"
+      },
+      "invocationProfiles": {
+        "direct-http": {
+          "transport": "shell",
+          "supportedVersions": "8.18.0",
+          "controls": {
+            "model": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "effort": {
+              "support": "not-applicable",
+              "mapping": "unavailable: explicit effort is refused; null effort and empty effort lists only",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "sandbox": {
+              "support": "external",
+              "mapping": "unavailable natively: requires a host OS/executor boundary; local endpoint does not prove local inference",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "approval": {
+              "support": "external",
+              "mapping": "unavailable natively: curl has no approval or permission system; the host authorizes the single text-only POST",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "workdir": {
+              "support": "external",
+              "mapping": "host spawns curl in the resolved absolute workspace; no server-side workspace control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "finalOutput": {
+              "support": "external",
+              "mapping": "host captures stdout and validates the original envelope and extracted worker claims; no server output-file control",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stdin": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "structuredOutput": {
+              "support": "external",
+              "mapping": "unavailable server schema control; host strict claims parser validates the extracted response",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "stepCap": {
+              "support": "unqualified",
+              "mapping": "unavailable: no model step cap; curl time and size bounds are not a step cap",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "trust": {
+              "support": "native",
+              "mapping": "-q",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "children": {
+              "support": "native",
+              "mapping": "[\"--data-binary\",\"@-\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            },
+            "fallback": {
+              "support": "native",
+              "mapping": "[\"--max-redirs\",\"0\"]",
+              "evidence": "curl 8.18.0 installed help; tools/ralph-external/lib/ollama-adapter.mjs and offline Ollama fixtures; server 0.33.3 API assumptions provisional"
+            }
+          },
+          "envAllowlist": [
+            "OLLAMA_HOST"
+          ],
+          "pitfalls": [
+            "One text-only POST /api/generate, stream:false, explicit model and no tools, child-agent API or fallback request. Coding and explicit effort are refused.",
+            "The model control binds the resolved model in the adapter-frame JSON body; argv contains no model or brief.",
+            "No Ollama CLI, server start or weight-download command is invoked, including for disabled members. Server-side downloads, inference locality and backend identity remain unqualified.",
+            "curl 8.18.0 is the executable version; Ollama 0.33.3 response fields and done_reason=stop remain provisional pending the conductor smoke.",
+            "No native sandbox or approval system exists; external workspace/capture/validation controls require an enforcing host boundary.",
+            "No streaming health grammar, progress, session log, server cancellation, resume or model step cap is available. Owned curl exit is not proof of remote server stop."
+          ],
+          "health": {
+            "version": 1,
+            "handshake": "process-only",
+            "outputFraming": "final-json",
+            "signalParser": "unavailable",
+            "sessionLogLocator": null,
+            "progressEvidence": [],
+            "stopEvidence": "owned curl process identity and observed exit only; remote server cancellation unavailable",
+            "fixtureRef": "test/fixtures/providers/local-http/health/manifest.json",
+            "qualifiedAt": null,
+            "statusOperation": null,
+            "cancelOperation": null,
+            "coverage": "degraded",
+            "qualificationTarget": "unobserved",
+            "evidenceGrades": [
+              "H",
+              "R"
+            ],
+            "provenance": [
+              {
+                "kind": "help",
+                "ref": "docs/providers/ollama-direct.md",
+                "observedAt": "2026-10-09T00:00:00Z",
+                "cliVersion": "8.18.0"
+              },
+              {
+                "kind": "repository",
+                "ref": "tools/ralph-external/lib/ollama-adapter.mjs",
+                "observedAt": "2026-10-26T00:00:00Z",
+                "cliVersion": null
+              }
+            ],
+            "qualificationOwner": "B-OG-09",
+            "qualification": {
+              "status": "unqualified",
+              "scopeDigest": null,
+              "cliVersion": null,
+              "accountScope": null,
+              "profileRef": null,
+              "modelKey": null,
+              "effort": null,
+              "authorizedLive": false
+            }
+          }
+        }
+      }
+    }
+  },
   "workerHealthAdapters": {
     "local-http": {
       "version": 1,

package/bin/aiwg.mjs

@@ -27,6 +27,14 @@ import { existsSync, readFileSync } from 'fs';
 import os from 'os';
 import { randomUUID } from 'crypto';
 
+// Every exit path calls process.exit() right after writing. On a pipe, Node
+// queues writes the reader has not consumed yet and process.exit() drops them,
+// so a slow reader saw JSON reports cut off at the 64 KiB pipe buffer. Blocking
+// pipe writes finish before the next statement runs, so nothing is lost.
+for (const stream of [process.stdout, process.stderr]) {
+  if (!stream.isTTY) stream._handle?.setBlocking?.(true);
+}
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = path.resolve(__dirname, '..');

package/dist/src/cli/handlers/mc-admission.js

@@ -0,0 +1,39 @@
+// Builds the existing MC admission owner with a live worker-activation gate.
+import { join } from 'node:path';
+import { assertWorkerActivationCurrent } from '../../config/worker-activation-gate.js';
+import * as ui from '../ui.js';
+const MC_ROOT = '.aiwg/ralph-external/mc';
+/** Shared binding used by MC and the managed Mission/Flow/Ralph caller paths. */
+export async function createMcAdmissionScheduler(projectRoot, cfg, hostRegistry) {
+    const { resolveParallelism, workerActivationDigests, workerConfigDigest } = await import('../../config/aiwg-config.js');
+    const { FileAdmissionStore, SharedHostScheduler } = await import('../../serve/shared-host-scheduler.js');
+    const provider = cfg?.providers[0] ?? 'unknown';
+    const parallelism = resolveParallelism(cfg?.parallelism, provider);
+    if (parallelism.worker_mode === 'managed') {
+        const { managedProjectAdmissionPolicy, projectAdmissionAuthority } = await import('../../serve/shared-host-scheduler.js');
+        const activation = parallelism.activation;
+        if (!cfg || !activation || activation.configDigest !== workerActivationDigests(cfg).configDigest) {
+            throw new Error('managed admission requires a current activated policy');
+        }
+        const authority = projectAdmissionAuthority(projectRoot);
+        const authorityRef = parallelism.admission?.authorityRef ?? 'project';
+        if (authorityRef.startsWith('host:') && process.env['AIWG_EXECUTOR_IDENTITY_STORE']) {
+            ui.warn('AIWG_EXECUTOR_IDENTITY_STORE is ignored for host admission authority lookup.');
+        }
+        const policy = managedProjectAdmissionPolicy(projectRoot, { ...parallelism,
+            admission: { ...parallelism.admission, authorityRef: 'project' },
+        }, workerConfigDigest(activation), parallelism.max_parallel_subagents);
+        const binding = authorityRef === 'project' ? { store: new FileAdmissionStore(authority.path), policy }
+            : (hostRegistry ?? (await import('../../serve/executor-registry.js')).executorRegistry).resolveHostAdmissionAuthority(authorityRef, policy);
+        const check = () => assertWorkerActivationCurrent(projectRoot, activation);
+        check();
+        const scheduler = new SharedHostScheduler(binding.store, binding.policy, Date.now, check);
+        scheduler.reconcileNow();
+        return scheduler;
+    }
+    const maxConcurrent = parallelism.max_parallel_mc_missions;
+    return new SharedHostScheduler(new FileAdmissionStore(join(projectRoot, MC_ROOT, 'admission.json')), {
+        maxConcurrent, leaseTtlMs: 5 * 60_000, agingIntervalMs: 30_000, allowPreemption: false, defaultHostQuota: maxConcurrent,
+    });
+}
+//# sourceMappingURL=mc-admission.js.map

package/dist/src/cli/handlers/mc.js

@@ -36,37 +36,8 @@ async function readAdmissionConfig(projectRoot) {
         return null;
     }
 }
-/** Shared binding used by MC and the managed Mission/Flow/Ralph caller paths. */
-export async function createMcAdmissionScheduler(projectRoot, cfg, hostRegistry) {
-    const { resolveParallelism, workerActivationDigests, workerConfigDigest } = await import('../../config/aiwg-config.js');
-    const { FileAdmissionStore, SharedHostScheduler } = await import('../../serve/shared-host-scheduler.js');
-    const provider = cfg?.providers[0] ?? 'unknown';
-    const parallelism = resolveParallelism(cfg?.parallelism, provider);
-    if (parallelism.worker_mode === 'managed') {
-        const { managedProjectAdmissionPolicy, projectAdmissionAuthority } = await import('../../serve/shared-host-scheduler.js');
-        const activation = parallelism.activation;
-        if (!cfg || !activation || activation.configDigest !== workerActivationDigests(cfg).configDigest) {
-            throw new Error('managed admission requires a current activated policy');
-        }
-        const authority = projectAdmissionAuthority(projectRoot);
-        const authorityRef = parallelism.admission?.authorityRef ?? 'project';
-        if (authorityRef.startsWith('host:') && process.env['AIWG_EXECUTOR_IDENTITY_STORE']) {
-            ui.warn('AIWG_EXECUTOR_IDENTITY_STORE is ignored for host admission authority lookup.');
-        }
-        const policy = managedProjectAdmissionPolicy(projectRoot, { ...parallelism,
-            admission: { ...parallelism.admission, authorityRef: 'project' },
-        }, workerConfigDigest(activation), parallelism.max_parallel_subagents);
-        const binding = authorityRef === 'project' ? { store: new FileAdmissionStore(authority.path), policy }
-            : (hostRegistry ?? (await import('../../serve/executor-registry.js')).executorRegistry).resolveHostAdmissionAuthority(authorityRef, policy);
-        const scheduler = new SharedHostScheduler(binding.store, binding.policy);
-        scheduler.reconcileNow();
-        return scheduler;
-    }
-    const maxConcurrent = parallelism.max_parallel_mc_missions;
-    return new SharedHostScheduler(new FileAdmissionStore(join(projectRoot, MC_ROOT, 'admission.json')), {
-        maxConcurrent, leaseTtlMs: 5 * 60_000, agingIntervalMs: 30_000, allowPreemption: false, defaultHostQuota: maxConcurrent,
-    });
-}
+import { createMcAdmissionScheduler } from './mc-admission.js';
+export { createMcAdmissionScheduler } from './mc-admission.js';
 const mcWorkerSupport = () => workerConsumerSupport([...WORKER_BASELINE_FEATURES, 'worker-health.v1']);
 function workerDispatch(mission) {
     const bindings = new Set();

package/dist/src/cli/handlers/models-help.js

@@ -0,0 +1,52 @@
+// Documents the existing model maintenance and resolution commands.
+export const MODELS_HELP = `Usage: aiwg models <subcommand> [options]
+
+Subcommands:
+  list                         List discovered agent and skill model policies
+  audit                        Compile selected policies and report diagnostics
+  resolve                      Resolve artifact policies, or a direct worker invocation
+  validate                     Validate selected artifact policies (not worker configuration)
+  sources                      Show the effective model catalog without network refresh
+  refresh                      Refresh model discovery (may access the network)
+  set-default <TIER>           Write defaults.tier to models.json
+  set --tier <TIER>            Update selected agent/skill frontmatter; requires a selector or --all
+  migrate                      Add canonical role/tier hints to legacy skills
+
+Artifact selectors and options:
+  --agent <name>  --skill <name>  --glob <pattern>  --role <role>
+  --tier <tier>  --framework <name>  --all
+  --provider <provider>         Provider for artifact compilation (default: claude)
+  --model <id>                  Explicit Grok Build model for artifact resolve
+  --target <directory>         Artifact/project root (default: current directory)
+  --propose <file>             Review pair edits (--parallelism/--worker-selection JSON files)
+  --apply <file>               Apply with --authorize DIGEST or --standing-authorization FILE
+  --recover                    Restore retained pair with the original authorization
+  --scope project|user         set-default destination (default: project)
+  --dry-run                    Preview mutations without writing
+  --json                       Emit JSON
+  --drift                      Include catalog drift for sources/refresh
+  --url <url>                  Remote catalog URL for refresh
+  --help, -h                   Show this reference
+  TIER: economy | standard | premium | max-quality
+
+Direct worker resolution (plans an invocation; does not launch it):
+  aiwg models resolve --role <role> --task <class> --group <group>
+    --brief <file> --workdir <tree> --final-output <file>
+    [--transport shell|mcp] [--format json|shell] [--authorize-premium]
+  --role                       efficiency | coding | reasoning | configured project alias
+  --task                       Task class from defaults.workerSelection.taskClasses
+                               Built-ins: inventory, implementation, architecture, review
+  --group                      Group from parallelism.groups and the role's guidance
+  --brief                      Absolute path to the task brief
+  --workdir                    Absolute path to the worker tree
+  --final-output               Absolute path for the final result
+  --transport                  Must match group execution transport (default: shell)
+  --format                     JSON plan or POSIX shell command (default: json)
+  --json                       Alias for --format json
+  --authorize-premium          Authorize premium for this resolution only
+                               Agents require explicit human confirmation of escalation
+
+Worker groups live in .aiwg/aiwg.config; role guidance lives in project-root models.json.
+Configure both, then run aiwg doctor --probe-workers --qualify.
+See docs/getting-started/worker-dispatch.md for a complete example.`;
+//# sourceMappingURL=models-help.js.map