@aiwg/cli 2026.10.9 → 2026.10.11

package/tools/agents/providers/conductor-data-guard.mjs

@@ -0,0 +1,61 @@
+// Compile the existing project data policy into project-local provider refusals.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { importImpl, resolveImpl } from '../../_resolve-impl.mjs';
+
+const quote = value => `'${value.replace(/'/g, `'"'"'`)}'`;
+
+// Local-only paths are declared only in project/user models.json or project
+// parallelism (the built-in defaults declare none). Skip the full model-config
+// load when none of them mention the field, so ordinary deploys never depend
+// on the framework default config (absent from the slim CLI package).
+function declaresLocalOnlyPaths(targetDir) {
+  const userDir = process.env.AIWG_CONFIG || path.join(os.homedir(), '.config/aiwg');
+  return [path.join(targetDir, 'models.json'), path.join(userDir, 'models.json'), path.join(targetDir, '.aiwg/aiwg.config')]
+    .some(file => { try { return fs.readFileSync(file, 'utf8').includes('localOnlyPaths'); } catch { return false; } });
+}
+
+export async function deployConductorDataGuard(targetDir, provider, opts = {}) {
+  if (!declaresLocalOnlyPaths(targetDir)) return [];
+  // Always resolve policy through the existing loader, including inherited restrictions.
+  const { ConfigLoader } = await importImpl(import.meta.url, 'models/config-loader.js');
+  const { readAiwgConfig } = await importImpl(import.meta.url, 'config/aiwg-config.js');
+  const guard = await importImpl(import.meta.url, 'models/conductor-data-policy.mjs');
+  const config = await readAiwgConfig(targetDir);
+  const models = await new ConfigLoader(targetDir).load(config?.parallelism);
+  const paths = guard.collectLocalOnlyPaths(models.defaults.workerSelection, config?.parallelism);
+  if (!paths.length || opts.dryRun) return paths;
+  const root = path.resolve(targetDir);
+  if (provider === 'claude') {
+    const settingsPath = path.join(root, '.claude/settings.json');
+    const settings = fs.existsSync(settingsPath) ? JSON.parse(fs.readFileSync(settingsPath, 'utf8')) : {};
+    const hookPath = path.join(root, '.claude/hooks/aiwg-local-only.mjs');
+    const hookSource = fs.readFileSync(resolveImpl(import.meta.url, 'models/conductor-data-policy.mjs'), 'utf8');
+    fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+    fs.writeFileSync(hookPath, `${hookSource}\nrunConductorDataHook(${JSON.stringify(root)}, ${JSON.stringify(paths)});\n`);
+    settings.permissions ??= {};
+    settings.permissions.deny = [...new Set([...(settings.permissions.deny ?? []), ...paths.flatMap(file => [
+      `Read(//${path.join(root, file).slice(1)})`, `Read(//${path.join(root, file).slice(1)}/**)`,
+    ])])];
+    settings.hooks ??= {};
+    const command = `node ${quote(hookPath)}`;
+    const entries = settings.hooks.PreToolUse ?? [];
+    settings.hooks.PreToolUse = [...entries.filter(entry => !entry.hooks?.some(hook => hook.command === command)),
+      { matcher: '.*', hooks: [{ type: 'command', command }] }];
+    fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+  } else if (provider === 'codex') {
+    const rulesPath = path.join(root, '.codex/rules/aiwg-local-only.rules');
+    const lines = ['# AIWG local-only inputs: explicit command prefixes only; not filesystem isolation.'];
+    for (const file of paths) for (const spelling of [file, `./${file}`, path.join(root, file)]) {
+      for (const command of ['cat', 'head', 'tail', 'less', 'more', 'sed', 'awk', 'grep', 'rg']) {
+        lines.push(`prefix_rule(pattern = ${JSON.stringify([command, spelling])}, decision = "forbidden")`);
+      }
+    }
+    fs.mkdirSync(path.dirname(rulesPath), { recursive: true });
+    fs.writeFileSync(rulesPath, lines.join('\n') + '\n');
+  }
+  console.log(`Local-only conductor guard (${provider}): ${paths.join(', ')}; shell coverage is limited.`);
+  return paths;
+}

package/tools/agents/providers/rule-delivery.mjs

@@ -20,6 +20,8 @@ const { guardRulesInlineBudget } = await importImpl(import.meta.url, 'rules/inli
 const { userConfigFile } = await importImpl(import.meta.url, 'config/user-config-dir.mjs');
 const { resolveProjectAiwgDir } = await importImpl(import.meta.url, 'config/project-artifacts-runtime.mjs');
 import { writeContextFileSync, CONTEXT_STAGE_ENV } from './context-write.mjs';
+import { projectOnDemandReferences, renderRuleKernelIndex } from './rule-presentation.mjs';
+export { renderRuleKernelIndex } from './rule-presentation.mjs';
 const PREPARATION_HOOK = Symbol.for('aiwg.provider-preparation-hook.v1');
 
 export function installRuleDeploymentPreparationHook(hook) {
@@ -298,21 +300,6 @@ export async function prepareRuleDelivery(opts) {
   return { rules, bindings, targets, pins: pinned.rules, pinWarnings: pinned.warnings };
 }
 
-export function renderRuleKernelIndex(rules, nativePaths = false) {
-  const summary = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'summary');
-  const paths = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'paths');
-  const kernels = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'kernel');
-  if (!summary.length && !paths.length && !kernels.length) return '';
-  const lines = ['# Rule kernel index', ''];
-  for (const rule of kernels) lines.push(`- ${rule.name} — ${rule.summary || 'Fetch and follow the full rule before governed work.'} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
-  for (const rule of summary) lines.push(`- ${rule.name} — ${rule.summary} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
-  if (paths.length) {
-    lines.push(nativePaths ? '## Path rules (native)' : '## Path rules (prompt emulation)', '',
-      nativePaths ? 'The provider loads these rules for matching paths; full contracts remain available through the commands below.' : 'Before reading or changing files, compare intended project-relative paths with the globs below and fetch matching rules before their first read/write. If paths are initially unknown, check when they become known. An agent-only task has no path match. This is prompt emulation, not a filesystem hook.', '');
-    for (const rule of paths) lines.push(`- ${rule.name} | ${rule.paths.map(glob => `\`${glob}\``).join(', ')} | ${rule.summary} | \`aiwg show rule ${rule.name} --body\``, '');
-  }
-  return lines.join('\n');
-}
 
 function managed(content, opts) {
   return addManagedMarker(content, opts.deployVersion, opts.deploySource || 'bundled');
@@ -334,7 +321,7 @@ function putStartup(file, body) {
 
 /** Tagged rules bypass legacy aggregate writers. Untagged projections retain their tier policy. */
 function projectRules(opts, provider) {
-  const { rules } = opts.ruleDelivery;
+  const rules = projectOnDemandReferences(opts.ruleDelivery.rules, ['claude', 'cursor'].includes(provider.name));
   if (opts.contextFiles !== false && provider.name === 'hermes') {
     // The old context generator carries hardcoded corpus directives. Only the
     // selected contracts below may activate policy; preserve operator prose.

package/tools/agents/providers/rule-presentation.mjs

@@ -0,0 +1,38 @@
+/** Render deployed rule references without links to catalog-only siblings. */
+import path from 'node:path';
+
+export function projectOnDemandReferences(rules, nativePaths = false) {
+  const byFile = new Map(rules.map(rule => [path.resolve(rule.file), rule]));
+  return rules.map(rule => {
+    const rewrite = content => content?.replace(
+      /\[[^\]\n]+\]\((?:\.\/)?([\w-]+)\.md\)[ \t]*\(`aiwg show rule \1(?: --body)?`, on-demand\)/g,
+      (reference, name) => {
+        const sibling = byFile.get(path.resolve(path.dirname(rule.file), `${name}.md`));
+        // Only known catalog rules can replace a relative file reference. Keep
+        // unknown/broken links and links to files selected for native delivery.
+        if (!sibling?.tagged || sibling.name !== name || sibling.activation === 'kernel' ||
+            (nativePaths && sibling.activation === 'paths')) return reference;
+        return `\`aiwg show rule ${name} --body\` (on-demand)`;
+      },
+    );
+    return { ...rule, content: rewrite(rule.content), body: rewrite(rule.body),
+      ...(rule.coreBody === undefined ? {} : { coreBody: rewrite(rule.coreBody) }) };
+  });
+}
+
+export function renderRuleKernelIndex(rules, nativePaths = false) {
+  const summary = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'summary');
+  const paths = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'paths');
+  const kernels = rules.filter(rule => rule.tagged && (rule.canonicalActivation || rule.activation) === 'kernel');
+  if (!summary.length && !paths.length && !kernels.length) return '';
+  const lines = ['# Rule kernel index', ''];
+  for (const rule of kernels) lines.push(`- ${rule.name} — ${rule.summary || 'Fetch and follow the full rule before governed work.'} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
+  for (const rule of summary) lines.push(`- ${rule.name} — ${rule.summary} Fetch and follow: \`aiwg show rule ${rule.name} --body\`.`, '');
+  if (paths.length) {
+    lines.push(nativePaths ? '## Path rules (native)' : '## Path rules (prompt emulation)', '',
+      nativePaths ? 'The provider loads these rules for matching paths; full contracts remain available through the commands below.' : 'Before reading or changing files, compare intended project-relative paths with the globs below and fetch matching rules before their first read/write. If paths are initially unknown, check when they become known. An agent-only task has no path match. This is prompt emulation, not a filesystem hook.', '');
+    for (const rule of paths) lines.push(`- ${rule.name} | ${rule.paths.map(glob => `\`${glob}\``).join(', ')} | ${rule.summary} | \`aiwg show rule ${rule.name} --body\``, '');
+  }
+  return lines.join('\n');
+}
+

package/tools/plugin/package-plugins.mjs

@@ -41,7 +41,7 @@ const PLUGIN_CONFIGS = {
       skills: 'agentic/code/frameworks/sdlc-complete/skills'
     },
     extraCopy: [
-      { from: 'tools/security/threat-assessment.mjs', to: 'tools/security/threat-assessment.mjs' },
+      ...['threat-assessment.mjs', 'threat-assessment'].map(name => ({ from: `tools/security/${name}`, to: `tools/security/${name}` })),
       { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-architecture-evolution.playbook.yaml', to: 'flows/flow-architecture-evolution.playbook.yaml' },
       { from: 'agentic/code/frameworks/sdlc-complete/flows/flow-release.playbook.yaml', to: 'flows/flow-release.playbook.yaml' }
     ],

package/tools/ralph-external/lib/claude-adapter.mjs

@@ -212,8 +212,8 @@ export class ClaudeAdapter extends ProviderAdapter {
     ];
 
     // Session tracking
-    if (options.sessionId) {
-      args.push('--session-id', options.sessionId);
+    if (options.resumeSession || options.sessionId) {
+      args.push(options.resumeSession ? '--resume' : '--session-id', options.resumeSession || options.sessionId);
     }
 
     // Model selection (Claude passes through directly)

package/tools/ralph-external/lib/codex-adapter.mjs

@@ -44,7 +44,7 @@ const MODEL_MAP = {
  *
  *   codex --no-daemon exec --ignore-user-config -m M \
  *     -c model_reasoning_effort="E" -s S -C W -c approval_policy="never" \
- *     --skip-git-repo-check -o F --json - < briefPath
+ *     --skip-git-repo-check -o F.last-message --json - < briefPath
  *
  * `--no-daemon` is a root-level flag and `--ignore-user-config` is an
  * `exec`-level flag (root `--help` lists no `--ignore-user-config`;
@@ -206,7 +206,7 @@ export class CodexAdapter extends ProviderAdapter {
    * model, explicit effort as one `-c model_reasoning_effort="E"` token
    * (TOML `"E"` quoting via `JSON.stringify`; there is no shell in argv),
    * explicit sandbox/approval (`never` only), the conductor workdir as
-   * `-C`, the final file as `-o`, the JSONL event stream as `--json` and
+   * `-C`, a separate last-message capture as `-o`, the JSONL stream as `--json` and
    * `-` as the prompt argument so the brief arrives on stdin
    * (`stdin: 'brief-text'`). Permission flags from the legacy Ralph loop
    * (`--dangerously-bypass-approvals-and-sandbox`), guessed step caps and
@@ -260,7 +260,7 @@ export class CodexAdapter extends ProviderAdapter {
       '-C', cwd,
       '-c', `approval_policy=${JSON.stringify(approval)}`,
       '--skip-git-repo-check',
-      '-o', finalPath,
+      '-o', `${finalPath}.last-message`,
       '--json',
       '-',
     ];

package/tools/ralph-external/lib/managed-worker-attempt.mjs

@@ -0,0 +1,86 @@
+// Validate the parent reservation and disclose one-shot attempt bindings.
+import { importImpl } from '../../_resolve-impl.mjs';
+import { sampleWorkerIdentity } from '../process-monitor.mjs';
+import { changedBindings } from './session-attempt.mjs';
+const { qualificationDigest } = await importImpl(import.meta.url, 'models/qualification-digest.mjs');
+
+export function managedAttemptBindings(plan) {
+  const invocation = plan.invocation;
+  const digests = plan.digests ?? {};
+  const selected = invocation?.selected ?? plan.selected;
+  return { policyDigest: invocation?.policyDigest ?? (digests.configDigest && digests.resolvedModelsDigest
+    ? qualificationDigest([digests.configDigest, digests.resolvedModelsDigest]) : null),
+  catalogDigest: invocation?.catalogDigest ?? digests.catalogDigest ?? null,
+  profileDigest: invocation?.profileDigest ?? digests.profileDigest ?? null,
+  selected: selected ? { group: selected.group, member: selected.member, cli: selected.cli,
+    inferenceProvider: selected.inferenceProvider, model: selected.model,
+    effort: typeof selected.effort === 'object' ? selected.effort?.value ?? null : selected.effort ?? null,
+    profileRef: selected.profileRef ?? selected.profile } : null, sessionId: null };
+}
+
+export async function validateManagedAttempt(options, saved, inputs, now, validate, publish) {
+  const attempt = await managedWorkerAttempt(options, saved, inputs, now);
+  await publish(attempt);
+  try {
+    const invocation = await validate(saved, inputs.snapshot, inputs.drivers, now);
+    return { invocation, attempt };
+  } catch (error) {
+    attempt.status = 'blocked'; attempt.errorCode = error.code ?? 'PLAN_REVALIDATION_FAILED';
+    await publish(attempt);
+    throw error;
+  }
+}
+
+export async function managedWorkerAttempt(options, saved, inputs, now) {
+  const { resolveWorkerInvocation } = await importImpl(import.meta.url, 'serve/worker-invocation.js');
+  const current = await resolveWorkerInvocation(inputs.snapshot, saved.request, inputs.drivers, now);
+  const original = options.attempt?.originalBindings ?? managedAttemptBindings(saved);
+  const bindings = managedAttemptBindings(current);
+  return { ...options.attempt, kind: 'fresh', reason: options.attempt?.reason
+    ?? (options.resumeSession || options.sessionId ? 'one-shot-continuation-unsupported' : 'one-shot-profile'),
+    requestedSessionId: options.attempt?.requestedSessionId ?? options.resumeSession ?? options.sessionId ?? null,
+    requestId: options.managedAdmission.requestId, originalBindings: original,
+    bindings, changes: changedBindings(original, bindings),
+    status: current.status === 'eligible' ? 'prepared' : 'blocked',
+    diagnostics: current.diagnostics };
+}
+
+/** Reuse the MC authority and its registered one-shot identity at every spawn boundary. */
+export async function assertManagedWorkerLaunch(options, invocation, inputs, projectRoot = process.cwd()) {
+  if (!options.managedAdmission || invocation.mode !== 'managed'
+    || inputs.snapshot.config.parallelism?.worker_mode !== 'managed') throw new Error('Managed worker admission is required');
+  const { createMcAdmissionScheduler } = await importImpl(import.meta.url, 'cli/handlers/mc.js');
+  const { loadLauncherRegistry } = await importImpl(import.meta.url, 'cli/handlers/ralph-launcher.js');
+  const { workerModelKey } = await importImpl(import.meta.url, 'models/provider-policy.js');
+  const scheduler = await createMcAdmissionScheduler(projectRoot, inputs.snapshot.config);
+  const { requestId, generation } = options.managedAdmission;
+  const snapshot = scheduler.snapshot();
+  const record = snapshot.records[requestId];
+  const deadlineAtMs = Math.min(options.cycleDeadlineAtMs ?? Infinity, ...[record?.accounting?.runKey, record?.accounting?.taskKey]
+    .map(key => snapshot.allowances?.[key]?.deadlineAt).filter(Boolean).map(Date.parse));
+  const registered = loadLauncherRegistry(projectRoot).loops[options.loopId ?? process.env.RALPH_LOOP_ID];
+  const worker = record?.managed;
+  const reservation = record?.accounting?.reservation;
+  if (!record || record.state !== 'admitted' || record.leaseGeneration !== generation
+    || !record.launchClaimedAt || !record.metadata?.invocationId || Date.parse(record.leaseExpiresAt ?? '') <= Date.now()
+    || deadlineAtMs <= Date.now()
+    || worker?.kind !== 'external' || worker.group !== invocation.selected.group
+    || worker.member !== invocation.selected.member || worker.cli !== invocation.selected.cli
+    || worker.model !== workerModelKey(invocation.selected.inferenceProvider, invocation.selected.model)
+    || reservation?.tokens != null && !(invocation.limits.tokens <= reservation.tokens)
+    || reservation?.costUsd != null && !(invocation.limits.costUsd !== null && invocation.limits.costUsd <= reservation.costUsd)
+    || registered?.managedAdmission?.requestId !== requestId || registered.managedAdmission.generation !== generation
+    || registered.managedWorker?.invocationPath !== options.invocationPath
+    || registered.managedWorker?.runDir !== options.runDir) {
+    throw new Error('Managed worker launch differs from the current claimed admission');
+  }
+  if (record.execution) {
+    const identity = sampleWorkerIdentity(process.pid);
+    if (record.execution.pid !== process.pid || !identity?.bootId || !identity.startTicks
+      || record.execution.startedAt !== `${identity.bootId}:${identity.startTicks}:${identity.uid}`) {
+      throw new Error('Managed worker supervisor identity differs');
+    }
+  }
+  return { ...record, deadlineAtMs };
+}
+

package/tools/ralph-external/lib/muse-adapter.mjs

@@ -31,6 +31,13 @@
  *   - `--approval-mode <mode>` — common to both; "`muse exec` accepts both
  *     approval flags" (configuration). Opt-in only: the adapter sets NO
  *     approval posture by default (#230 out of scope: `--yolo` defaults).
+ *   - `--trust-workspace` — loads project rules, skills and hooks for the
+ *     workspace (#3685: untrusted Muse reports `rules.context_load`
+ *     `project_sources=0` with user skills only and empty hook admission;
+ *     trusted reports `project_sources=1` with project skills and hooks).
+ *     Tier 0 workspaces are conductor-prepared worker trees the conductor
+ *     owns, so the direct profile binds this flag by default through the
+ *     host-controlled trust mapping; the brief never supplies it.
  *   - `muse export --session <uuid> --out <path>` — offline,
  *     byte-deterministic transcript projection; `--last` and `--redacted`
  *     skip the picker / redact payload strings (cookbook:
@@ -173,6 +180,9 @@ export class MuseAdapter extends ProviderAdapter {
     if ((permissions.approval ?? 'never') !== 'never') throw new Error('Muse direct worker approval requires never');
     // Trust is a host-owned, qualification-bound control, like the schema.
     // Brief contents and CLI defaults cannot opt into workspace instructions.
+    // Tier 0 binds ["--trust-workspace"] because the workspace is always a
+    // conductor-prepared worker tree (#3685); untrusted trees stay refused
+    // at dispatch by the operator native-argv gate.
     let trust;
     try { trust = JSON.parse(profile.controls.trust.mapping); } catch { /* fail closed below */ }
     if (!Array.isArray(trust) || !(trust.length === 0 || trust.length === 1 && trust[0] === '--trust-workspace')) {

package/tools/ralph-external/lib/provider-adapter.mjs

@@ -1,220 +1,14 @@
-/**
- * Provider Adapter Base Class for External Ralph Loop
- *
- * Defines the interface that all CLI provider adapters must implement.
- * Each adapter wraps a specific agentic coding CLI (claude, codex, etc.)
- * and handles binary resolution, argument construction, model mapping,
- * and output parsing.
- *
- * @implements Plan: Multi-Provider Support for External Ralph Loop
- */
-
 import { spawn } from 'child_process';
 import { importImpl } from '../../_resolve-impl.mjs';
 import { createWorkerHealthObserver, observeProviderHealthEvent } from './worker-health.mjs';
 
-/**
- * Thrown by {@link parseStrictWorkerJson} with a stable `code` so callers can
- * map a scan failure to a specific contract-violation message without
- * string-matching free-text.
- */
-class StrictJsonScanError extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-}
-
-/**
- * RFC 8259 JSON parser used on every strict worker-final path (JSONL lines,
- * `format: 'json'`, and the MCP `content[0].text`/top-level envelope) instead
- * of `JSON.parse`. `JSON.parse` silently keeps the LAST value when an object
- * repeats a member name — RFC 8259 §4 explicitly leaves this to the
- * implementation, and V8 picks "last wins". That lets a forged worker final
- * smuggle a second, hidden value past a first one: a trailing duplicate
- * `"status":"completed"` can overwrite an earlier `"status":"failed"`, or a
- * trailing duplicate `"type":"result"` can collapse a `"type":"message"`
- * framing envelope into a bogus result in one line (#2890 BLOCKER 1+2).
- *
- * This scanner tracks member names per object independently at every
- * nesting level (a sibling object may reuse a name the scanner already saw
- * in its parent or an earlier sibling) and rejects any object that repeats
- * one. Names are compared only after the scanner has fully decoded them —
- * resolving `\"`, other single-character escapes, and `\uXXXX` escapes
- * (including surrogate pairs, since JS string concatenation of two decoded
- * UTF-16 code units forms the pair automatically) — so an escape-obfuscated
- * collision (`"status"` vs `"status"`) is caught exactly like a literal
- * one. A non-colliding unknown key, escaped or not, is left for the existing
- * `additionalProperties: false` schema check to reject, unchanged.
- *
- * Nesting depth is bounded during the scan (not only afterward, by
- * `boundedJson()`'s post-parse walk) so pathological depth fails fast with a
- * clear `DEPTH` code instead of relying on a recursive-descent stack
- * overflow to be caught as a generic syntax error.
- *
- * @param {string} text - Decoded JSON text (already UTF-8 validated by the caller)
- * @param {number} maxDepth - Same bound as `WORKER_MAX_NESTING_DEPTH`; root value is depth 1
- * @returns {unknown}
- */
-function parseStrictWorkerJson(text, maxDepth) {
-  const length = text.length;
-  let index = 0;
-
-  function fail(code, message) {
-    throw new StrictJsonScanError(code, `${message} (offset ${index})`);
-  }
-
-  function skipWhitespace() {
-    while (index < length) {
-      const code = text.charCodeAt(index);
-      if (code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0d) index += 1;
-      else break;
-    }
-  }
-
-  function parseValue(depth) {
-    skipWhitespace();
-    if (index >= length) fail('SYNTAX', 'Unexpected end of JSON input');
-    const code = text.charCodeAt(index);
-    if (code === 0x7b) return parseObject(depth);
-    if (code === 0x5b) return parseArray(depth);
-    if (code === 0x22) return parseString();
-    if (code === 0x2d || (code >= 0x30 && code <= 0x39)) return parseNumber();
-    if (text.startsWith('true', index)) { index += 4; return true; }
-    if (text.startsWith('false', index)) { index += 5; return false; }
-    if (text.startsWith('null', index)) { index += 4; return null; }
-    fail('SYNTAX', 'Unexpected token');
-  }
-
-  function parseObject(depth) {
-    if (depth > maxDepth) fail('DEPTH', 'Worker nesting depth exceeds bound');
-    index += 1; // {
-    const result = {};
-    const seen = new Set();
-    skipWhitespace();
-    if (text.charCodeAt(index) === 0x7d) { index += 1; return result; }
-    for (;;) {
-      skipWhitespace();
-      if (text.charCodeAt(index) !== 0x22) fail('SYNTAX', 'Expected object member name');
-      const key = parseString();
-      if (seen.has(key)) fail('DUPLICATE', `Duplicate object member name ${JSON.stringify(key)}`);
-      seen.add(key);
-      skipWhitespace();
-      if (text.charCodeAt(index) !== 0x3a) fail('SYNTAX', 'Expected colon after object member name');
-      index += 1;
-      // Define, never assign: assignment would invoke the inherited __proto__
-      // setter, hiding the member from own-key validation and diverging from
-      // JSON.parse, which creates an ordinary own property.
-      Object.defineProperty(result, key, { value: parseValue(depth + 1), enumerable: true, writable: true, configurable: true });
-      skipWhitespace();
-      const delimiter = text.charCodeAt(index);
-      if (delimiter === 0x2c) { index += 1; continue; }
-      if (delimiter === 0x7d) { index += 1; break; }
-      fail('SYNTAX', 'Expected , or } in object');
-    }
-    return result;
-  }
-
-  function parseArray(depth) {
-    if (depth > maxDepth) fail('DEPTH', 'Worker nesting depth exceeds bound');
-    index += 1; // [
-    const result = [];
-    skipWhitespace();
-    if (text.charCodeAt(index) === 0x5d) { index += 1; return result; }
-    for (;;) {
-      result.push(parseValue(depth + 1));
-      skipWhitespace();
-      const delimiter = text.charCodeAt(index);
-      if (delimiter === 0x2c) { index += 1; continue; }
-      if (delimiter === 0x5d) { index += 1; break; }
-      fail('SYNTAX', 'Expected , or ] in array');
-    }
-    return result;
-  }
-
-  function parseString() {
-    index += 1; // opening quote
-    let value = '';
-    for (;;) {
-      if (index >= length) fail('SYNTAX', 'Unterminated string');
-      const code = text.charCodeAt(index);
-      if (code === 0x22) { index += 1; return value; }
-      if (code === 0x5c) {
-        index += 1;
-        const escape = text[index];
-        if (escape === undefined) fail('SYNTAX', 'Unterminated escape sequence');
-        switch (escape) {
-          case '"': value += '"'; index += 1; break;
-          case '\\': value += '\\'; index += 1; break;
-          case '/': value += '/'; index += 1; break;
-          case 'b': value += '\b'; index += 1; break;
-          case 'f': value += '\f'; index += 1; break;
-          case 'n': value += '\n'; index += 1; break;
-          case 'r': value += '\r'; index += 1; break;
-          case 't': value += '\t'; index += 1; break;
-          case 'u': {
-            const hex = text.slice(index + 1, index + 5);
-            if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail('SYNTAX', 'Invalid unicode escape');
-            // Decoded code unit is appended as-is; two consecutive decoded
-            // surrogate halves recombine into one character automatically
-            // through normal JS UTF-16 string concatenation.
-            value += String.fromCharCode(parseInt(hex, 16));
-            index += 5;
-            break;
-          }
-          default: fail('SYNTAX', 'Invalid escape sequence');
-        }
-      } else if (code < 0x20) {
-        fail('SYNTAX', 'Unescaped control character in string');
-      } else {
-        value += text[index];
-        index += 1;
-      }
-    }
-  }
-
-  function parseNumber() {
-    const start = index;
-    if (text.charCodeAt(index) === 0x2d) index += 1;
-    if (text.charCodeAt(index) === 0x30) {
-      index += 1;
-    } else if (text.charCodeAt(index) >= 0x31 && text.charCodeAt(index) <= 0x39) {
-      index += 1;
-      while (text.charCodeAt(index) >= 0x30 && text.charCodeAt(index) <= 0x39) index += 1;
-    } else fail('SYNTAX', 'Invalid number');
-    if (text.charCodeAt(index) === 0x2e) {
-      index += 1;
-      if (!(text.charCodeAt(index) >= 0x30 && text.charCodeAt(index) <= 0x39)) fail('SYNTAX', 'Invalid number fraction');
-      while (text.charCodeAt(index) >= 0x30 && text.charCodeAt(index) <= 0x39) index += 1;
-    }
-    if (text.charCodeAt(index) === 0x65 || text.charCodeAt(index) === 0x45) {
-      index += 1;
-      if (text.charCodeAt(index) === 0x2b || text.charCodeAt(index) === 0x2d) index += 1;
-      if (!(text.charCodeAt(index) >= 0x30 && text.charCodeAt(index) <= 0x39)) fail('SYNTAX', 'Invalid number exponent');
-      while (text.charCodeAt(index) >= 0x30 && text.charCodeAt(index) <= 0x39) index += 1;
-    }
-    return Number(text.slice(start, index));
-  }
-
-  const result = parseValue(1);
-  skipWhitespace();
-  if (index !== length) fail('SYNTAX', 'Unexpected trailing characters after JSON value');
-  return result;
-}
+import { parseStrictWorkerJson, StrictJsonScanError } from './strict-worker-json.mjs';
+import { classifySessionAttempt } from './session-attempt.mjs';
 
 const installedOwner = await importImpl(import.meta.url, 'models/worker-installation.mjs');
 export const { workerNegativeFixtureSuite, workerNegativeFixtureDigest, registerProvider, createProvider, listProviders, hasProvider } = installedOwner;
 
-/**
- * Whether the optional muse exec Ralph adapter is registered.
- * Enabled by default; set `AIWG_MUSE_RALPH_ENABLED` to `0`, `false`, `no`,
- * or `off` to disable the adapter without affecting
- * `aiwg use --provider muse` (the deploy/writer path lives in `src/` and
- * never consults this registry). See
- * `tools/ralph-external/lib/muse-adapter.mjs` (#230).
- *
- * @returns {boolean}
- */
+/** The optional Muse adapter is independent of provider deployment. */
 export function isMuseRalphEnabled() {
   const raw = String(process.env.AIWG_MUSE_RALPH_ENABLED ?? '').trim().toLowerCase();
   return !['0', 'false', 'no', 'off'].includes(raw);
@@ -661,24 +455,15 @@ export class ProviderAdapter {
     return null;
   }
 
-  /**
-   * Check if a capability is supported, and optionally log a warning.
-   *
-   * @param {string} capability - Capability name from ProviderCapabilities
-   * @param {string} [context] - Context for the warning message
-   * @returns {boolean}
-   */
+  classifySessionAttempt(request) {
+    return classifySessionAttempt(this, request);
+  }
+
   hasCapability(capability) {
     const caps = this.getCapabilities();
     return !!caps[capability];
   }
 
-  /**
-   * Log a capability warning when a feature is not supported.
-   *
-   * @param {string} capability - Capability name
-   * @param {string} feature - Human-readable feature description
-   */
   warnUnsupported(capability, feature) {
     if (!this.hasCapability(capability)) {
       console.warn(
@@ -687,52 +472,18 @@ export class ProviderAdapter {
     }
   }
 }
-
-// ============================================================================
-// Provider Registry & Factory
-// ============================================================================
-
 export async function loadInstalledWorkerAdapters(request) {
   await ensureProvidersRegistered();
   return installedOwner.loadInstalledWorkerAdapters(request);
 }
 
-// ============================================================================
-// Auto-register built-in providers on import
-// ============================================================================
-
-// Lazy imports to avoid circular dependencies - adapters register themselves
-// when their modules are loaded. We trigger that here.
+// Adapters register themselves; keep imports lazy to avoid registry cycles.
 async function registerBuiltinProviders() {
-  try {
-    await import('./claude-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  try {
-    await import('./codex-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  try {
-    await import('./opencode-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  try {
-    await import('./factory-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  try {
-    await import('./pi-adapter.mjs');
-    await import('./omp-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  try {
-    await import('./deepseek-harness-adapter.mjs');
-  } catch { /* ignore if not found */ }
-  // #230: optional / post-experimental. Disabled via AIWG_MUSE_RALPH_ENABLED=0
-  // without affecting `aiwg use --provider muse`.
-  if (isMuseRalphEnabled()) {
-    try {
-      await import('./muse-adapter.mjs');
-    } catch { /* ignore if not found */ }
+  for (const name of ['claude', 'codex', 'opencode', 'factory', 'pi', 'omp', 'deepseek-harness',
+    ...(isMuseRalphEnabled() ? ['muse'] : [])]) {
+    try { await import(`./${name}-adapter.mjs`); } catch { /* Optional adapter unavailable. */ }
   }
 }
-
-// Run registration — store promise so callers can await it
 const _registrationPromise = registerBuiltinProviders();
 
 /**