@aiwg/cli 2026.10.9 → 2026.10.11

package/dist/src/config/aiwg-config.js

@@ -1,3 +1,10 @@
+import { normalizeAiwgConfigCandidate } from './config-normalization.js';
+import { atomicConfigWrite, withWorkerWriteLock } from './worker-write.js';
+import { workerConfigDigest } from './worker-config-digest.js';
+export { workerConfigDigest } from './worker-config-digest.js';
+import { validateParallelismConfig } from './worker-parallelism.js';
+export { validateParallelismConfig, validateWorkerHealthConfig, resolveWorkerGroupInstallation } from './worker-parallelism.js';
+import { expandWorkerGroupTemplates } from './worker-group-templates.js';
 import { validateDecisionConfig } from './decision-config.js';
 /**
  * Project-Level AIWG Config
@@ -10,20 +17,15 @@ import { validateDecisionConfig } from './decision-config.js';
  * @implements #621
  */
 import { validateImportExclusions } from '../sessions/import-exclusions.js';
-import { resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
 export { DEFAULT_DISPATCH_HOST_THRESHOLDS, resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
 import { validateIndexGraphOverrides } from './index-graph-overrides.js';
 import { DEFAULT_RULES_INLINE_BUDGET_TOKENS } from '../rules/inline-budget.mjs';
 export { validateRulesConfig, resolveRulesInlineBudget } from '../rules/inline-budget.mjs';
 import { loadRulePinConfigs, installedRuleCapabilities, validateRulePinCapabilities } from '../rules/pins.mjs';
-import Ajv from 'ajv';
-import addFormats from 'ajv-formats';
 import { readFileSync, existsSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { isCanonicalWorkerModelKey, loadProviderModelCapabilities, resolveWorkerInstallation } from '../models/provider-policy.js';
-import { readFile, writeFile, mkdir, access, readdir, rename, unlink } from 'fs/promises';
-import { createHash, randomBytes } from 'crypto';
-import { resolve, join, dirname, isAbsolute } from 'path';
+import { readFile, access, readdir } from 'fs/promises';
+import { createHash } from 'crypto';
+import { resolve, join, isAbsolute } from 'path';
 import { normalizeNamedCaptures } from '../artifacts/index-builder.js';
 import { getProviderDefinition, getProviderKernelSkillPath, PROVIDER_IDS, resolveProviderPathValue, } from '../providers/provider-definitions.js';
 import { validateAuthorization, } from '../policy/authorization.js';
@@ -175,142 +177,22 @@ export function resolveDelivery(delivery) {
         issue_comment_on_cycle: delivery?.issue_comment_on_cycle ?? true,
     };
 }
-let parallelismValidator;
-/** Offline shape and declaration validation. Qualification is checked at use time. */
-export function validateParallelismConfig(value) {
-    if (value === undefined)
-        return [];
-    if (!parallelismValidator) {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const candidates = [resolve(here, '../../vscode-extension/schemas/aiwg.config.v1.json'), resolve(here, '../../../vscode-extension/schemas/aiwg.config.v1.json')];
-        const file = candidates.find(existsSync);
-        if (!file)
-            throw new Error('Parallelism schema is unavailable');
-        const schema = JSON.parse(readFileSync(file, 'utf8'));
-        const ajv = addFormats(new Ajv({ strict: true, allErrors: true }));
-        parallelismValidator = ajv.compile({ ...schema.properties.parallelism, definitions: schema.definitions });
-    }
-    if (!parallelismValidator(value))
-        return (parallelismValidator.errors ?? []).map(error => `OG_CONFIG_REFERENCE /parallelism${error.instancePath}: ${error.message}`);
-    const policy = value;
-    const errors = [];
-    const error = (pointer, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/${pointer}: ${message}`); };
-    const builtinIds = new Set(PROVIDER_IDS.filter(id => id !== 'generic'));
-    for (const [id, installation] of Object.entries(policy.clis ?? {})) {
-        if (installation.adapter.startsWith('providers:') && !builtinIds.has(installation.adapter.slice(10)))
-            error(`clis/${id}/adapter`, 'Unknown provider binding');
-    }
-    for (const [id, group] of Object.entries(policy.groups ?? {})) {
-        if (group.execution?.launchMode === 'native-sandbox'
-            && (!['read-only', 'workspace-write'].includes(group.execution.sandbox ?? '')
-                || (group.execution.transport ?? 'shell') !== 'shell')) {
-            error(`groups/${id}/execution/launchMode`, 'native-sandbox requires an enforcing read-only or workspace-write shell sandbox');
-        }
-        if (group.execution?.launchMode === 'native-sandbox') {
-            if (group.execution.approval === 'on-request')
-                error(`groups/${id}/execution/approval`, 'native-sandbox requires approval="never"');
-            if (group.execution.network === 'allowlisted')
-                error(`groups/${id}/execution/network`, 'native-sandbox requires network="deny"');
-        }
-        const ids = new Set();
-        for (const member of group.members) {
-            if (ids.has(member.id))
-                error(`groups/${id}/members`, 'Duplicate member ID');
-            ids.add(member.id);
-            if (!policy.clis?.[member.cli] && !builtinIds.has(member.cli))
-                error(`groups/${id}/members/${member.id}/cli`, 'Unknown installation');
-            if (group.execution?.launchMode === 'native-sandbox'
-                && (policy.clis?.[member.cli]?.adapter ?? `providers:${member.cli}`) !== 'providers:codex') {
-                error(`groups/${id}/members/${member.id}/cli`, 'native-sandbox requires a codex adapter');
-            }
-        }
-        for (const member of group.fallback ?? [])
-            if (!ids.has(member))
-                error(`groups/${id}/fallback`, 'Unknown fallback member');
-        for (const role of group.requiredRoles ?? []) {
-            if (!group.members.some(m => m.enabled !== false && policy.clis?.[m.cli]?.enabled !== false && m.roles.includes(role)))
-                error(`groups/${id}/requiredRoles`, `No enabled member covers ${role}`);
-        }
-    }
-    const admission = policy.admission;
-    for (const group of Object.keys(admission?.groupCaps ?? {}))
-        if (!policy.groups?.[group])
-            error('admission/groupCaps', 'Unknown group');
-    for (const cli of Object.keys(admission?.cliCaps ?? {}))
-        if (!policy.clis?.[cli] && !builtinIds.has(cli))
-            error('admission/cliCaps', 'Unknown installation');
-    for (const key of Object.keys(admission?.memberCaps ?? {})) {
-        const [group, member, extra] = key.split('/');
-        if (extra !== undefined || !policy.groups?.[group]?.members.some(m => m.id === member))
-            error('admission/memberCaps', 'Unknown group/member');
-    }
-    for (const key of Object.keys(admission?.modelCaps ?? {}))
-        if (!isCanonicalWorkerModelKey(key))
-            error('admission/modelCaps', 'Noncanonical inference model key');
-    if (admission?.hostResources !== undefined) {
-        try {
-            resolveDispatchHostThresholds(undefined, admission.hostResources);
-        }
-        catch (validation) {
-            error('admission/hostResources', validation instanceof Error ? validation.message : String(validation));
-        }
-    }
-    errors.push(...validateWorkerHealthConfig(policy.health));
-    return errors;
-}
-/** Cross-field health preferences are validated offline; controls are qualified at dispatch. */
-export function validateWorkerHealthConfig(health) {
-    if (health === undefined)
-        return [];
-    const errors = [];
-    const error = (field, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/health/${field}: ${message}`); };
-    const checkSeconds = health.checkSeconds ?? 15;
-    if (checkSeconds > (health.startupSeconds ?? 60))
-        error('checkSeconds', 'Must not exceed startupSeconds');
-    if ((health.quietSeconds ?? 90) >= (health.stallSeconds ?? 300))
-        error('quietSeconds', 'Must be less than stallSeconds');
-    if ((health.cooldownSeconds ?? 120) > (health.maxCooldownSeconds ?? 900))
-        error('cooldownSeconds', 'Must not exceed maxCooldownSeconds');
-    for (const role of Object.keys(health.roleScale ?? {})) {
-        if (!['efficiency', 'coding', 'reasoning'].includes(role))
-            error('roleScale', `Unknown role ${role}`);
-    }
-    for (const field of ['modelScale', 'modelStartupSeconds']) {
-        for (const [key, value] of Object.entries(health[field] ?? {})) {
-            if (!isCanonicalWorkerModelKey(key))
-                error(field, 'Noncanonical inference model key');
-            if (field === 'modelStartupSeconds' && checkSeconds > value)
-                error(field, 'Model startup must cover checkSeconds');
-        }
-    }
-    return errors;
-}
-/** Resolve one enabled installation through trusted metadata, without probes.
- * Implicit canonical IDs inherit current-account auth; no account/quota identity
- * is invented. Profile qualification remains the invocation owner's obligation.
+/**
+ * Provider-scoped parallelism cap — limits how many concurrent subagents,
+ * Ralph loops, and Mission Control missions agents may spawn. Designed to
+ * keep AIWG within the rate-limit envelope of the underlying model provider
+ * (Anthropic per-key TPM/RPM caps are the most-reported trigger).
+ *
+ * Composes with (effective limit = MIN of):
+ *   - `parallelism.max_parallel_subagents` (this config)
+ *   - `context-budget` rule's `AIWG_CONTEXT_WINDOW`-derived cap, if set
+ *   - `rlm-context-management` Rule 8's 7-agent hard cap (RLM dispatches only)
+ *   - The natural task decomposition (no point spawning 4 when only 2 subtasks exist)
+ *
+ * Every field is optional. Defaults applied via {@link resolveParallelism}.
+ *
+ * @implements #1359
  */
-export function resolveWorkerGroupInstallation(parallelism, installationId, registry = loadProviderModelCapabilities()) {
-    const errors = validateParallelismConfig(parallelism);
-    if (errors.length)
-        throw new Error(errors.join('; '));
-    if (!parallelism.worker_dispatch)
-        throw new Error('OG_CONFIG_REFERENCE /parallelism/worker_dispatch: Worker dispatch is disabled');
-    const explicit = parallelism.clis?.[installationId];
-    const installation = explicit
-        ? structuredClone(explicit)
-        : { adapter: `providers:${installationId}`, enabled: true };
-    if (!explicit && (!PROVIDER_IDS.includes(installationId) || installationId === 'generic')) {
-        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Unknown canonical installation`);
-    }
-    if (installation.enabled === false)
-        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Installation is disabled`);
-    try {
-        return { installation: { ...installation, enabled: true }, ...resolveWorkerInstallation(registry, installation) };
-    }
-    catch (error) {
-        throw new Error(`OG_ADAPTER_UNQUALIFIED /parallelism/clis/${installationId}: ${error}`);
-    }
-}
 /** Validate current model restrictions and group references before any write.
  * Disabled/unbound projects retain their existing config-only edit behavior.
  * This is shared validation, not Tier 1 coherent activation.
@@ -329,17 +211,6 @@ export async function validateWorkerConfigCandidate(projectDir, config, options)
     const { ConfigLoader } = await import('../models/config-loader.js');
     await new ConfigLoader(projectDir, options).load(config.parallelism);
 }
-/** Hash canonical JSON, treating absent optional model files as null. */
-export function workerConfigDigest(value) {
-    const canonical = (node) => {
-        if (Array.isArray(node))
-            return node.map(canonical);
-        if (node !== null && typeof node === 'object')
-            return Object.fromEntries(Object.keys(node).sort().filter(key => node[key] !== undefined).map(key => [key, canonical(node[key])]));
-        return node ?? null;
-    };
-    return `sha256:${createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex')}`;
-}
 export function workerActivationDigests(config, projectModels, userModels, builtinModels) {
     const candidate = structuredClone(config);
     if (candidate.parallelism)
@@ -415,6 +286,10 @@ export function getProviderParallelismDefaults(provider) {
  * @implements #1359
  */
 export function resolveParallelism(parallelism, primaryProvider) {
+    const expansion = expandWorkerGroupTemplates(parallelism);
+    if (expansion.errors.length)
+        throw new Error(expansion.errors.join('; '));
+    parallelism = expansion.parallelism;
     const defaults = getProviderParallelismDefaults(primaryProvider);
     const resolved = {
         max_parallel_subagents: parallelism?.max_parallel_subagents ?? defaults.max_parallel_subagents,
@@ -441,7 +316,7 @@ export function resolveParallelism(parallelism, primaryProvider) {
         for (const cli of Object.values(resolved.clis ?? {}))
             cli.enabled ??= true;
         if (resolved.admission)
-            resolved.admission = { maxQueued: 128, queueTimeoutSeconds: 300, leaseSeconds: 60, authorityRef: 'project', ...resolved.admission };
+            resolved.admission = { maxQueued: 128, queueTimeoutSeconds: 300, leaseSeconds: 60, starvationSeconds: 120, authorityRef: 'project', ...resolved.admission };
         if (resolved.budgets)
             resolved.budgets = { enforcement: 'observed', unknownCost: 'deny', ...resolved.budgets };
         if (resolved.retry)
@@ -1071,12 +946,7 @@ export async function readAiwgConfigCandidate(projectDir) {
     const content = await readFile(filePath, 'utf-8');
     const parsed = JSON.parse(content);
     // Ensure required fields exist (forward-compat)
-    if (!parsed.providers)
-        parsed.providers = ['claude'];
-    if (!parsed.installed)
-        parsed.installed = {};
-    if (!parsed.scripts)
-        parsed.scripts = {};
+    normalizeAiwgConfigCandidate(parsed);
     if (parsed.sessions !== undefined && (parsed.sessions === null || typeof parsed.sessions !== 'object' || Array.isArray(parsed.sessions)
         || (parsed.sessions.codex_roots !== undefined && (!Array.isArray(parsed.sessions.codex_roots)
             || !parsed.sessions.codex_roots.every((root) => typeof root === 'string' && root.trim().length > 0))))) {
@@ -1164,6 +1034,9 @@ export async function readAiwgConfig(projectDir, options) {
  * sync so split-root health remains deterministic.
  */
 export async function writeAiwgConfig(projectDir, config) {
+    return withWorkerWriteLock(projectDir, () => writeAiwgConfigUnlocked(projectDir, config));
+}
+async function writeAiwgConfigUnlocked(projectDir, config) {
     // Uninstall is an explicit capability change. Retire project selectors for
     // removed capabilities before strict validation, and tell the operator.
     const previousFile = getConfigPath(projectDir);
@@ -1222,28 +1095,7 @@ export async function writeAiwgConfig(projectDir, config) {
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);
     const content = JSON.stringify(config, null, 2) + '\n';
-    const writeAtomic = async (filePath) => {
-        await mkdir(dirname(filePath), { recursive: true });
-        // Atomic write: emit to a temp sibling, fsync-ish via rename. Prevents a
-        // crash or kill mid-write from corrupting the config file. Rename is
-        // atomic on POSIX and on NTFS when both paths are on the same volume.
-        // The random suffix avoids collisions if two concurrent writers run.
-        const tmpPath = `${filePath}.${randomBytes(6).toString('hex')}.tmp`;
-        try {
-            await writeFile(tmpPath, content, 'utf-8');
-            await rename(tmpPath, filePath);
-        }
-        catch (err) {
-            // Best-effort cleanup of the temp file on failure, ignoring ENOENT.
-            try {
-                await unlink(tmpPath);
-            }
-            catch {
-                /* ignore */
-            }
-            throw err;
-        }
-    };
+    const writeAtomic = (file) => atomicConfigWrite(file, content);
     await writeAtomic(localPath);
     if (artifactPath !== localPath) {
         try {
@@ -1454,6 +1306,7 @@ export function validateWorkerGroupReferences(parallelism, selection, qualifiedR
     const errors = validateParallelismConfig(parallelism);
     if (errors.length)
         return errors;
+    parallelism = expandWorkerGroupTemplates(parallelism).parallelism;
     for (const [role, guidance] of Object.entries(selection.roleGuidance ?? {})) {
         for (const group of guidance.groups)
             if (!parallelism.groups?.[group])
@@ -1467,9 +1320,10 @@ export function validateWorkerGroupReferences(parallelism, selection, qualifiedR
 /** Structured qualification gaps retain role scope for readiness projections. */
 export function validateWorkerGroupQualifications(parallelism, qualifiedRoles) {
     const diagnostics = [];
+    parallelism = expandWorkerGroupTemplates(parallelism).parallelism;
     for (const [id, group] of Object.entries(parallelism.groups ?? {})) {
         for (const role of group.requiredRoles ?? []) {
-            if (!group.members.some(m => m.enabled !== false && parallelism.clis?.[m.cli]?.enabled !== false
+            if (!(group.members ?? []).some(m => m.enabled !== false && parallelism.clis?.[m.cli]?.enabled !== false
                 && m.roles.includes(role) && qualifiedRoles[`${id}/${m.id}`]?.includes(role))) {
                 diagnostics.push({ code: 'OG_ADAPTER_UNQUALIFIED', pointer: `/parallelism/groups/${id}/requiredRoles`,
                     message: `No qualified route covers ${role}`, roles: [role] });

package/dist/src/config/cli-help.js

@@ -0,0 +1,54 @@
+// Documents the existing config commands and reviewed worker maintenance flags.
+export function printUsage() {
+    console.log(`Usage: aiwg config <subcommand> [options]
+
+Subcommands:
+  get <key>                       Read a user config value
+  get --project <key>             Read a project config value or merged defaults.workerSelection
+    [--origins]                  Include model policy sources, pointers and input digests
+  set <key> <value>               Write a user config value
+  set --project <key> <value>     Write a project config value (validates enums)
+  list                Show all user config
+  show --project      Show resolved project config and artifact root
+  validate            Validate user config files
+  validate --project  Validate resolved project config taxonomy/index semantics
+    [--provider gitea|github|local] [--available-label NAME ...]
+  reset [<key>]       Reset key or all config to defaults
+  path                Print config directory path
+  edit                Open config in $EDITOR/$VISUAL (requires a terminal)
+  edit --print-path   Print the config file path instead of opening an editor
+  gitignore           Show/check/fix .gitignore AIWG entries
+
+Reviewed worker policy pair (project scope, no prompts):
+  set --project --parallelism FILE --worker-selection FILE --propose FILE
+  set --project --apply FILE --authorize DIGEST
+  set --project --apply FILE --standing-authorization FILE
+  set --project --recover --authorize DIGEST
+  --target DIRECTORY selects the project. Proposal inputs are JSON files.
+
+Global flags:
+  --config-dir <path> Override config directory
+
+Examples:
+  aiwg config get defaults.provider
+  aiwg config set defaults.verbosity quiet
+  aiwg config set updates.channel next
+  aiwg config list
+  aiwg config show --project
+  aiwg config show --project --json
+  aiwg config get --project delivery.mode
+  aiwg config set --project delivery.mode pr-required
+  aiwg config set --project delivery.merge_style squash
+  aiwg config get --project parallelism
+  aiwg config get --project defaults.workerSelection --origins
+  aiwg config set --project parallelism.max_parallel_subagents 6
+  aiwg config reset --project parallelism
+  aiwg config validate
+  aiwg config path
+  aiwg config reset defaults.provider
+  aiwg config --config-dir /custom/path list
+  aiwg config gitignore
+  aiwg config gitignore --fix
+  aiwg config gitignore --check`);
+}
+//# sourceMappingURL=cli-help.js.map

package/dist/src/config/cli.js

@@ -1,3 +1,4 @@
+import { printUsage } from './cli-help.js';
 /**
  * Config CLI — Subcommand router for `aiwg config`
  *
@@ -19,8 +20,8 @@
  */
 import { fileURLToPath } from 'url';
 import path from 'path';
-import { isDeepStrictEqual } from 'node:util';
-import { normalizeProviderDefinitionId } from '../providers/provider-definitions.js';
+import { warnStaleParallelism } from './worker-guidance-warning.js';
+import { handleWorkerAdoptionArgs } from './worker-adoption-cli.js';
 import { UserConfig } from './user-config.js';
 import { AiwgError, EXIT_CODES } from '../cli/errors.js';
 import { isInteractive } from '../cli/env.js';
@@ -28,32 +29,12 @@ import { splitParams } from '../cli/agent-spawn.js';
 import { exitCodeForSpawnResult } from '../cli/child-process-result.js';
 import { projectControlPath, resolveProjectAiwgDir } from './project-artifacts.js';
 const _scriptDir = path.dirname(fileURLToPath(import.meta.url));
-function warnStaleParallelism(cfg, projectDir, key, before) {
-    if (key !== 'parallelism' && !key.startsWith('parallelism.'))
-        return;
-    if (isDeepStrictEqual(before, getDottedPath(cfg, key)))
-        return;
-    const configured = (cfg.providers ?? []).map(normalizeProviderDefinitionId).filter((id) => !!id);
-    const recorded = Object.values(cfg.installed ?? {}).flatMap(entry => Object.keys(entry.deployedTo ?? {}))
-        .map(normalizeProviderDefinitionId).filter((id) => !!id).sort();
-    const providers = [...new Set([...configured, ...recorded])];
-    const targets = providers.length ? providers : ['<provider>'];
-    const lines = [
-        `WARNING: ${key} changed project configuration; generated workspace/provider guidance may now be stale.`,
-        `From project root ${path.resolve(projectDir)}, preview and refresh every configured or recorded provider context:`,
-        ...targets.flatMap(provider => [
-            `  aiwg regenerate --workspace --provider ${provider} --dry-run`,
-            `  aiwg regenerate --workspace --provider ${provider}`,
-        ]),
-        '  aiwg workspace-context doctor',
-        `Shared parallelism defaults and labels use primary provider '${cfg.providers?.[0] ?? 'unknown'}' (providers[0]); --provider selects the adapter/context target.`,
-    ];
-    console.error(lines.join('\n'));
-}
 /**
  * Main CLI entry point for `aiwg config <subcommand> [args]`
  */
 export async function main(args) {
+    if (await handleWorkerAdoptionArgs(args, process.cwd(), 'config'))
+        return;
     // Extract --config-dir flag before routing
     let configDir;
     const filteredArgs = [];
@@ -910,51 +891,6 @@ async function handleGitignore(args) {
         process.exit(result.status ?? 1);
     }
 }
-function printUsage() {
-    console.log(`Usage: aiwg config <subcommand> [options]
-
-Subcommands:
-  get <key>                       Read a user config value
-  get --project <key>             Read a project config value or merged defaults.workerSelection
-    [--origins]                  Include model policy sources, pointers and input digests
-  set <key> <value>               Write a user config value
-  set --project <key> <value>     Write a project config value (validates enums)
-  list                Show all user config
-  show --project      Show resolved project config and artifact root
-  validate            Validate user config files
-  validate --project  Validate resolved project config taxonomy/index semantics
-    [--provider gitea|github|local] [--available-label NAME ...]
-  reset [<key>]       Reset key or all config to defaults
-  path                Print config directory path
-  edit                Open config in $EDITOR/$VISUAL (requires a terminal)
-  edit --print-path   Print the config file path instead of opening an editor
-  gitignore           Show/check/fix .gitignore AIWG entries
-
-Global flags:
-  --config-dir <path> Override config directory
-
-Examples:
-  aiwg config get defaults.provider
-  aiwg config set defaults.verbosity quiet
-  aiwg config set updates.channel next
-  aiwg config list
-  aiwg config show --project
-  aiwg config show --project --json
-  aiwg config get --project delivery.mode
-  aiwg config set --project delivery.mode pr-required
-  aiwg config set --project delivery.merge_style squash
-  aiwg config get --project parallelism
-  aiwg config get --project defaults.workerSelection --origins
-  aiwg config set --project parallelism.max_parallel_subagents 6
-  aiwg config reset --project parallelism
-  aiwg config validate
-  aiwg config path
-  aiwg config reset defaults.provider
-  aiwg config --config-dir /custom/path list
-  aiwg config gitignore
-  aiwg config gitignore --fix
-  aiwg config gitignore --check`);
-}
 /** Same configuration owner and validation used by the rules command wrappers. */
 export async function setRuleConfigKey(cwd, source, key, raw, userConfigDir) {
     assertSafeConfigPath(key);

package/dist/src/config/config-normalization.js

@@ -0,0 +1,10 @@
+export function normalizeAiwgConfigCandidate(parsed) {
+    if (!parsed.providers)
+        parsed.providers = ['claude'];
+    if (!parsed.installed)
+        parsed.installed = {};
+    if (!parsed.scripts)
+        parsed.scripts = {};
+    return parsed;
+}
+//# sourceMappingURL=config-normalization.js.map

package/dist/src/config/worker-activation-gate.js

@@ -0,0 +1,26 @@
+// Rechecks the persistent apply block at managed admission, including already-created schedulers.
+import { normalizeAiwgConfigCandidate } from './config-normalization.js';
+import { readFileSync } from 'node:fs';
+import { getConfigPath, workerActivationDigests, workerConfigDigest } from './aiwg-config.js';
+import { workerDispatchBlocked } from './worker-write.js';
+export function assertWorkerActivationCurrent(project, expected) {
+    if (workerDispatchBlocked(project))
+        throw new Error('Managed dispatch is closed for worker policy apply/recovery');
+    if (expected) {
+        let raw;
+        try {
+            raw = readFileSync(getConfigPath(project), 'utf8');
+        }
+        catch (error) {
+            // Fail closed: an admission bound to an activation cannot be verified without the project config.
+            if (error.code === 'ENOENT')
+                throw new Error(`Managed activation cannot be verified: ${getConfigPath(project)} is missing`);
+            throw error;
+        }
+        const config = normalizeAiwgConfigCandidate(JSON.parse(raw));
+        if (workerConfigDigest(config.parallelism?.activation) !== workerConfigDigest(expected)
+            || workerActivationDigests(config).configDigest !== expected.configDigest)
+            throw new Error('Managed activation changed; reload the current config and admission binding');
+    }
+}
+//# sourceMappingURL=worker-activation-gate.js.map

package/dist/src/config/worker-adoption-cli.js

@@ -0,0 +1,102 @@
+// Adds headless proposal/review/apply flags to the existing config and models setters.
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { atomicConfigWrite, workerWriteLock } from './worker-write.js';
+export async function handleWorkerAdoptionArgs(args, cwd, owner, signal, dryRun = false) {
+    args = args.flatMap(arg => {
+        const equals = arg.startsWith('--') ? arg.indexOf('=') : -1;
+        return equals > 0 ? [arg.slice(0, equals), arg.slice(equals + 1)] : [arg];
+    });
+    if (!args.some(arg => ['--propose', '--apply', '--authorize', '--standing-authorization', '--parallelism', '--worker-selection', '--recover'].includes(arg)))
+        return false;
+    if (dryRun)
+        throw new Error('Reviewed maintenance cannot write in dry-run mode; use --propose explicitly to create a review');
+    if (!['set', 'set-default'].includes(args[0]) || (owner === 'config' && args[0] !== 'set'))
+        throw new Error('Reviewed adoption flags are supported only on existing config/models setters; refresh cannot authorize or apply preferences');
+    const { applyWorkerAdoption, proposeWorkerAdoption, recoverWorkerAdoption } = await import('./worker-adoption.js');
+    const flags = new Map();
+    const positionals = [];
+    const values = new Set(['--target', '--propose', '--apply', '--authorize', '--standing-authorization', '--parallelism', '--worker-selection']);
+    for (let i = 1; i < args.length; i++) {
+        const arg = args[i];
+        if (values.has(arg)) {
+            if (!args[i + 1] || args[i + 1].startsWith('--') || flags.has(arg))
+                throw new Error(`A single value is required for ${arg}`);
+            flags.set(arg, args[++i]);
+        }
+        else if (arg === '--project' || arg === '--json' || arg === '--recover')
+            continue;
+        else if (arg.startsWith('--'))
+            throw new Error(`Unsupported reviewed adoption flag: ${arg}`);
+        else
+            positionals.push(arg);
+    }
+    const project = resolve(flags.get('--target') ?? cwd);
+    const readJson = async (file) => JSON.parse(await readFile(resolve(cwd, file), 'utf8'));
+    if (args.includes('--recover')) {
+        if (flags.has('--apply') || flags.has('--propose') || flags.has('--parallelism') || flags.has('--worker-selection') || positionals.length)
+            throw new Error('Recovery accepts only authorization flags');
+        if (flags.has('--authorize') === flags.has('--standing-authorization'))
+            throw new Error('Recovery requires exactly one authorization');
+        const authority = flags.has('--authorize') ? { digest: flags.get('--authorize') } : await readJson(flags.get('--standing-authorization'));
+        await recoverWorkerAdoption(project, authority, { signal });
+        console.log('Previous validated policy pair restored; guidance regenerated.');
+        return true;
+    }
+    if (flags.has('--apply')) {
+        if (flags.has('--propose') || flags.has('--parallelism') || flags.has('--worker-selection') || positionals.length)
+            throw new Error('Apply accepts only a reviewed proposal and authorization');
+        if (flags.has('--authorize') === flags.has('--standing-authorization'))
+            throw new Error('Supply exactly one of --authorize DIGEST or --standing-authorization FILE');
+        const proposal = await readJson(flags.get('--apply'));
+        const authority = flags.has('--authorize') ? { digest: flags.get('--authorize') } : await readJson(flags.get('--standing-authorization'));
+        await applyWorkerAdoption(project, proposal, authority, { signal });
+        console.log(JSON.stringify({ applied: proposal.digest, revision: proposal.after.parallelism?.worker_mode === 'managed' ? proposal.baseRevision + 1 : null }));
+        return true;
+    }
+    if (!flags.has('--propose') || flags.has('--authorize') || flags.has('--standing-authorization'))
+        throw new Error('Use --propose FILE to review first, then --apply FILE with separate authorization');
+    const changes = {};
+    if (flags.has('--parallelism'))
+        changes.parallelism = await readJson(flags.get('--parallelism'));
+    if (flags.has('--worker-selection'))
+        changes.workerSelection = await readJson(flags.get('--worker-selection'));
+    if (positionals.length) {
+        const [key, raw] = positionals;
+        const parts = key.split('.');
+        if (owner !== 'config' || parts[0] !== 'parallelism' || positionals.length !== 2 || flags.has('--parallelism')
+            || parts.some(part => !part || ['__proto__', 'prototype', 'constructor', 'activation'].includes(part)))
+            throw new Error('Reviewed edits support safe parallelism fields; model preferences use --worker-selection FILE');
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            value = raw;
+        }
+        if (parts.length === 1)
+            changes.parallelism = value;
+        else {
+            const base = await proposeWorkerAdoption(project, {});
+            const parallelism = structuredClone(base.before.parallelism ?? {});
+            let node = parallelism;
+            for (const part of parts.slice(1, -1)) {
+                if (!Object.hasOwn(node, part) || !node[part] || typeof node[part] !== 'object')
+                    node[part] = {};
+                node = node[part];
+            }
+            node[parts.at(-1)] = value;
+            changes.parallelism = parallelism;
+        }
+    }
+    if (!Object.keys(changes).length)
+        throw new Error('Proposal requires --parallelism FILE or --worker-selection FILE');
+    const proposal = await proposeWorkerAdoption(project, changes, { signal });
+    const file = resolve(cwd, flags.get('--propose'));
+    if (proposal.inputs.some(input => input.file === file) || file.startsWith(workerWriteLock(project)))
+        throw new Error('Proposal output must be separate from activation inputs and recovery files');
+    await atomicConfigWrite(file, JSON.stringify(proposal, null, 2) + '\n');
+    console.log(JSON.stringify(proposal, null, 2));
+    return true;
+}
+//# sourceMappingURL=worker-adoption-cli.js.map