@aiwg/cli 2026.9.21 → 2026.10.0

package/dist/src/artifacts/query-engine.js

@@ -949,8 +949,12 @@ export async function discoverCapability(cwd, params) {
                     continue;
                 }
             }
-            if (loaded.reason)
+            if (loaded.reason) {
                 unavailableReason ??= loaded.reason;
+                if (graph === 'framework' && !params.graph) {
+                    console.error(`Warning: framework capabilities are unavailable: ${loaded.reason}`);
+                }
+            }
             entries.push(...loaded.entries.map((entry) => withIndexProvenance(entry, graph)));
             const discovered = await queryFortemiCoreAiwgDiscovery(cwd, {
                 graph,
@@ -1138,6 +1142,19 @@ export async function discoverCapability(cwd, params) {
     }
     const scored = dedupeDiscoverResults(await applyFacetFusion(Array.from(combinedByPath.values()).sort(compareDiscoverResults), candidates, params.phrase)).slice(0, limit);
     const relaxed = scored.some(result => !strictPaths.has(result.entry.path));
+    if (params.shadowRoute) {
+        try {
+            await params.shadowRoute.observe(params.phrase, scored.map(result => ({
+                id: discoveryIdForEntry(result.entry), name: result.entry.name ?? result.entry.title,
+                type: result.entry.type, capability: result.entry.capability ?? result.entry.summary,
+                score: result.score,
+            })));
+        }
+        catch {
+            // An optional observation failure must never replace deterministic discovery.
+            params.shadowRoute.disable();
+        }
+    }
     const queryTimeMs = Date.now() - startTime;
     /**
      * Resolve a stored framework-graph path to an absolute AIWG_ROOT
@@ -1171,7 +1188,7 @@ export async function discoverCapability(cwd, params) {
     // broader phrase / type filter, and a capability refresh via `aiwg use`.
     const emptyResultHint = scored.length === 0
         ? backend === 'fortemi-core'
-            ? `No capability matched "${params.phrase}" among ${entries.length} Fortemi Core static-cache capabilities. Try a broader phrase or a \`--type\` filter. If the local index changed, refresh the cache with \`aiwg index sync\`, or pass \`--backend local\` to use the legacy local index.`
+            ? `No capability matched "${params.phrase}" among ${entries.length} Fortemi Core static-cache capabilities. Try a broader phrase or a \`--type\` filter. If the local index changed, refresh the cache with \`aiwg index sync ${params.graph ? `--graph ${params.graph}` : '--all'}\`, or pass \`--backend local\` to use the legacy local index.`
             : `No capability matched "${params.phrase}" among ${entries.length} indexed capabilities. Try a broader phrase or a \`--type\` filter. If you just installed or authored capabilities, refresh discovery with \`aiwg use <framework>\` (or \`aiwg index build\`).`
         : null;
     const includePaths = params.includePaths ?? true;
@@ -1272,7 +1289,9 @@ export async function discoverCapability(cwd, params) {
     }
     if (scored.length === 0) {
         console.log(`No discovery matches for "${params.phrase}" in types: ${types.join(',')}.`);
-        console.log('Try a broader phrase or a `--type` filter. If capabilities were just added, refresh with `aiwg use <framework>` (or `aiwg index build`).');
+        console.log(backend === 'fortemi-core'
+            ? emptyResultHint
+            : 'Try a broader phrase or a `--type` filter. If capabilities were just added, refresh with `aiwg use <framework>` (or `aiwg index build`).');
         return;
     }
     const relaxedNote = relaxed ? ' — relaxed match (verbose query)' : '';
@@ -1410,8 +1429,12 @@ async function loadShowEntries(cwd, params) {
                     continue;
                 }
             }
-            if (loaded.reason)
+            if (loaded.reason) {
                 unavailableReason ??= loaded.reason;
+                if (graph === 'framework' && !params.graph) {
+                    console.error(`Warning: framework capabilities are unavailable: ${loaded.reason}`);
+                }
+            }
             entries.push(...loaded.entries.map((entry) => withIndexProvenance(entry, graph)));
         }
         if (entries.length === 0 && unavailableReason) {
@@ -1464,7 +1487,15 @@ function findShowMatches(entries, types, needle) {
             const slugLayoutMatch = ((basename === 'SKILL.md' && e.type === 'skill') ||
                 (basename === 'BEHAVIOR.md' && e.type === 'behavior')) &&
                 dirStem === needle;
-            return slugLayoutMatch || fileStem === needle || e.name === needle;
+            if (slugLayoutMatch || fileStem === needle || e.name === needle)
+                return true;
+            if (e.type === 'gate-pack' && typeof e.name === 'string') {
+                const gateStem = fileStem.replace(/\.gatepack$/i, '');
+                const rest = e.name.includes(':') ? e.name.slice(e.name.indexOf(':') + 1) : e.name;
+                const short = rest.includes('/') ? rest.slice(rest.indexOf('/') + 1) : rest;
+                return gateStem === needle || rest === needle || short === needle;
+            }
+            return false;
         });
     }
     if (matches.length === 0) {
@@ -1516,6 +1547,68 @@ async function fortemiRecordForEntry(cwd, entry, sourcePaths) {
     const id = discoveryIdForEntry(entry);
     return loaded.exported.items.find((record) => record.id === id || record.source.path === entry.path) ?? null;
 }
+/**
+ * Scan bundle `gate-packs/` directories for a pack matching `needle` (#2830).
+ *
+ * Accepts the full namespaced id, the rest-path or the short pack name and
+ * probes `<bundle>/gate-packs/<pack>.gatepack.{yaml,yml,json}`. Never looks
+ * under `gates/`, which agent-persistence HITL owns.
+ */
+async function findGatePackInCorpus(groups, needle) {
+    const path = await import('node:path');
+    const fsp = (await import('node:fs')).promises;
+    const trimmed = needle.trim();
+    const rest = trimmed.includes(':') ? trimmed.slice(trimmed.indexOf(':') + 1) : trimmed;
+    const slash = rest.indexOf('/');
+    const wantedBundle = slash >= 0 ? rest.slice(0, slash) : null;
+    const wantedPack = slash >= 0 ? rest.slice(slash + 1) : rest;
+    if (!wantedPack || /\s/.test(wantedPack) || wantedPack.includes(':') || wantedPack.includes('/'))
+        return null;
+    const extensions = ['.gatepack.yaml', '.gatepack.yml', '.gatepack.json'];
+    const ordered = wantedBundle
+        ? groups.flatMap(group => [{ group, bundle: wantedBundle }])
+        : null;
+    const probe = async (group, bundle) => {
+        for (const extension of extensions) {
+            const candidate = path.join(group.dir, bundle, 'gate-packs', `${wantedPack}${extension}`);
+            try {
+                const stat = await fsp.stat(candidate);
+                if (stat.isFile())
+                    return { path: candidate, bundleKind: group.kind, bundleId: bundle };
+            }
+            catch {
+                // not present — continue
+            }
+        }
+        return null;
+    };
+    if (ordered) {
+        for (const { group, bundle } of ordered) {
+            const found = await probe(group, bundle);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    for (const group of groups) {
+        let bundles;
+        try {
+            bundles = (await fsp.readdir(group.dir, { withFileTypes: true }))
+                .filter(d => d.isDirectory())
+                .map(d => d.name)
+                .sort();
+        }
+        catch {
+            continue;
+        }
+        for (const bundle of bundles) {
+            const found = await probe(group, bundle);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
 /**
  * Scan the AIWG_ROOT corpus for an artifact matching `name` (#1221).
  *
@@ -1582,6 +1675,16 @@ async function findCorpusArtifact(aiwgRoot, name, typeFilter) {
             }
         }
     }
+    // Gate packs live in `<bundle>/gate-packs/*.gatepack.yaml|json` (never
+    // `gates/`, which agent-persistence HITL uses). The needle may be the full
+    // namespaced id (`aiwg:decision-engine/integrity-ceiling`), the rest-path
+    // (`decision-engine/integrity-ceiling`) or the short pack name
+    // (`integrity-ceiling`). (#2830)
+    if (typeFilter.length === 0 || typeFilter.includes('gate-pack')) {
+        const gateMatch = await findGatePackInCorpus(groups, name);
+        if (gateMatch)
+            return { ...gateMatch, type: 'gate-pack' };
+    }
     // Top-level agents live at `agentic/code/agents/<category>/<name>.md`
     // (e.g. `personas/aiwg-writer.md`) — a flat-under-category layout the
     // bundle groups above do not cover. Scan it directly so persona/agent

package/dist/src/artifacts/types.js

@@ -28,6 +28,7 @@ export const OPERATIONAL_DISCOVERY_TYPES = [
     'decision-definition',
     'decision-ruleset',
     'decision-binding',
+    'gate-pack',
     'flow',
     'runbook',
     'template',

package/dist/src/cli/handlers/decision.js

@@ -0,0 +1,88 @@
+import { decisionCapabilities, evaluateRequestPath, listPatterns, livePlan, materializeSyntheticClassificationSetup, runOfflinePattern, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
+function jsonResult(value, exitCode = 0) {
+    return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
+}
+function usage() {
+    return [
+        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup> [options]',
+        '',
+        'Commands:',
+        '  capabilities|status                 Show offline readiness, primitives, config and feature availability',
+        '  patterns list                       List governed decision pattern packs',
+        '  patterns show <id>                  Show one pattern pack and schemas',
+        '  patterns offline-run <id> [fixture] Run a recorded offline fixture through the decision runtime',
+        '  patterns live-plan <id> [--opt-in] [--credential-resolved] [--egress-approved]',
+        '  validate <request|definition|ruleset|binding> <path>',
+        '  evaluate --request <path> [--host-policy-module <path>]',
+        '  setup synthetic-classification [--output-dir <dir>]',
+    ].join('\n');
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    return args[index + 1];
+}
+function patternId(value) {
+    if (!value)
+        throw new Error('Pattern id is required');
+    return value;
+}
+async function executeDecision(ctx) {
+    const [command, subcommand, ...rest] = ctx.args;
+    const options = { cwd: ctx.cwd, frameworkRoot: ctx.frameworkRoot, env: process.env };
+    try {
+        if (!command || command === '--help' || command === '-h')
+            return { exitCode: 0, message: usage(), rawOutput: true };
+        if (command === 'capabilities' || command === 'status')
+            return jsonResult(decisionCapabilities(options));
+        if (command === 'patterns') {
+            if (subcommand === 'list')
+                return jsonResult(listPatterns());
+            if (subcommand === 'show')
+                return jsonResult(showPattern(patternId(rest[0])));
+            if (subcommand === 'offline-run')
+                return jsonResult(await runOfflinePattern(patternId(rest[0]), rest[1]));
+            if (subcommand === 'live-plan')
+                return jsonResult(livePlan(patternId(rest[0]), {
+                    explicitOptIn: rest.includes('--opt-in'),
+                    credentialResolved: rest.includes('--credential-resolved'),
+                    egressApproved: rest.includes('--egress-approved'),
+                }));
+        }
+        if (command === 'validate') {
+            const target = subcommand;
+            const result = await validateDecisionInput(target, rest[0] ?? '', options);
+            return jsonResult(result, result.valid ? 0 : 2);
+        }
+        if (command === 'evaluate') {
+            const request = takeOption(ctx.args, '--request');
+            if (!request)
+                return { exitCode: 2, message: 'decision evaluate requires --request <path>' };
+            const result = await evaluateRequestPath(request, options, {
+                hostPolicyModulePath: takeOption(ctx.args, '--host-policy-module'),
+            });
+            return jsonResult(result, result.exitCode);
+        }
+        if (command === 'setup' && subcommand === 'synthetic-classification') {
+            const outputDir = takeOption(ctx.args, '--output-dir');
+            if (outputDir)
+                return jsonResult(await materializeSyntheticClassificationSetup(outputDir, {}, options));
+            return jsonResult(syntheticClassificationSetup({}, options));
+        }
+        return { exitCode: 2, message: usage(), rawOutput: true };
+    }
+    catch (error) {
+        return { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+    }
+}
+export const decisionHandler = {
+    id: 'decision',
+    name: 'Decision Driver',
+    description: 'Inspect, validate and run governed decision classification workflows',
+    category: 'utility',
+    aliases: [],
+    help: async () => ({ exitCode: 0, message: usage(), rawOutput: true }),
+    execute: executeDecision,
+};
+//# sourceMappingURL=decision.js.map

package/dist/src/cli/handlers/gates.js

@@ -0,0 +1,154 @@
+function jsonResult(value, exitCode = 0) {
+    return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
+}
+function usage() {
+    return [
+        'Usage: aiwg gates <validate|evaluate|show|list> [options]',
+        '',
+        'Commands:',
+        '  validate <pack|binding|report> <path> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  evaluate --binding <file> --metrics <file> --holdout <file> [--upstream <file>] --now <iso> --trusted-binding-digest <sha256> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  show <id> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  list [--namespace <ns>] [--rule [<rule-id>]] [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '',
+        'Packs live in <bundle>/gate-packs/*.gatepack.yaml|json and register as',
+        'aiwg:<bundle>/<name> (shipped).',
+        'Single files and bundle directories passed via --pack-dir are always',
+        'project: packs; aiwg: is reserved for the installed tree, and a --pack-dir',
+        'manifest claiming a shipped or installed bundle id refuses. An --aiwg-root',
+        'override is untrusted:',
+        'list/show/validate still inspect it, but evaluate refuses it.',
+        'Evaluation is pure and offline: pass --now <iso> for the fake clock.',
+        'The holdout and upstream files must already carry their sealed digests,',
+        'and --upstream is required whenever the binding observes an',
+        'upstream-ceiling gate. Project floors load from .aiwg/aiwg.config in the',
+        'cwd (unreadable or invalid config refuses evaluation). Reports printed',
+        "here carry attestation: 'offline-cli'.",
+    ].join('\n');
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    return args[index + 1];
+}
+function takeAllOptions(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] === name && index + 1 < args.length)
+            values.push(args[index + 1]);
+    }
+    return values;
+}
+function driverOptions(ctx) {
+    // The shipped root resolves from the installed framework location, never
+    // from the cwd: any checkout could otherwise impersonate the aiwg:
+    // namespace. An explicit --aiwg-root is kept for inspection only; packs
+    // loaded from it are marked untrusted and refused by evaluate.
+    const aiwgRoot = takeOption(ctx.args, '--aiwg-root') ?? ctx.frameworkRoot;
+    const packDirs = takeAllOptions(ctx.args, '--pack-dir');
+    return { cwd: ctx.cwd, aiwgRoot, ...(packDirs.length ? { packDirs } : {}) };
+}
+/** Positional args with each known value-flag and its value skipped in order. */
+function positionals(args, skipCommand) {
+    const valueFlags = new Set(['--pack-dir', '--aiwg-root', '--binding', '--metrics', '--holdout', '--upstream', '--now', '--namespace', '--rule', '--trusted-binding-digest']);
+    const found = [];
+    let skipNext = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (valueFlags.has(arg)) {
+            skipNext = true;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        if (arg === skipCommand && index === 0)
+            continue;
+        found.push(arg);
+    }
+    return found;
+}
+async function executeGates(ctx) {
+    const [command] = ctx.args;
+    try {
+        if (!command || command === '--help' || command === '-h')
+            return { exitCode: 0, message: usage(), rawOutput: true };
+        const { validateGateFile, evaluateGatesFromFiles, showGatePack, listGatePacks, packsReferencedByRule, } = await import('../../gates/driver.js');
+        const options = driverOptions(ctx);
+        if (command === 'validate') {
+            const args = positionals(ctx.args, 'validate');
+            const target = (args[0] ?? '');
+            const targetPath = args[1] ?? '';
+            if (!['pack', 'binding', 'report', 'auto'].includes(target) || !targetPath) {
+                return { exitCode: 2, message: `gates validate requires <pack|binding|report|auto> <path>\n\n${usage()}`, rawOutput: true };
+            }
+            const result = await validateGateFile(target === 'auto' ? 'auto' : target, targetPath, options);
+            return jsonResult(result, result.valid ? 0 : 2);
+        }
+        if (command === 'evaluate') {
+            const binding = takeOption(ctx.args, '--binding');
+            const metrics = takeOption(ctx.args, '--metrics');
+            const holdout = takeOption(ctx.args, '--holdout');
+            const upstream = takeOption(ctx.args, '--upstream');
+            const now = takeOption(ctx.args, '--now');
+            const trustedBindingDigest = takeOption(ctx.args, '--trusted-binding-digest');
+            if (!binding || !metrics || !holdout || !now || !trustedBindingDigest) {
+                return { exitCode: 2, message: `gates evaluate requires --binding <file> --metrics <file> --holdout <file> --now <iso> --trusted-binding-digest <sha256:..>\n\n${usage()}`, rawOutput: true };
+            }
+            if (!/^sha256:[0-9a-f]{64}$/.test(trustedBindingDigest)) {
+                return { exitCode: 2, message: `gates evaluate requires --trusted-binding-digest <sha256:..> (64 hex chars)\n\n${usage()}`, rawOutput: true };
+            }
+            const report = await evaluateGatesFromFiles({
+                bindingPath: binding, metricsPath: metrics, holdoutPath: holdout,
+                ...(upstream ? { upstreamPath: upstream } : {}), now,
+                trustedBindingDigest: trustedBindingDigest,
+            }, options);
+            return jsonResult(report, 0);
+        }
+        if (command === 'show') {
+            const id = positionals(ctx.args, 'show')[0];
+            if (!id)
+                return { exitCode: 2, message: `gates show requires <id>\n\n${usage()}`, rawOutput: true };
+            return jsonResult(showGatePack(id, options), 0);
+        }
+        if (command === 'list') {
+            const namespace = takeOption(ctx.args, '--namespace');
+            const ruleIndex = ctx.args.indexOf('--rule');
+            const ruleValue = ruleIndex >= 0 ? ctx.args[ruleIndex + 1] : undefined;
+            const rule = ruleIndex >= 0 ? (ruleValue && !ruleValue.startsWith('-') ? ruleValue : null) : undefined;
+            const packs = listGatePacks({ ...options, ...(namespace ? { namespace } : {}) });
+            if (rule === undefined)
+                return jsonResult({ schema: 'aiwg-gates-list/v1', packs }, 0);
+            if (rule === null) {
+                return jsonResult({
+                    schema: 'aiwg-gates-list/v1', packs,
+                    enforcedBy: { status: 'stub', note: 'Rule enforcedBy coverage is tracked in #2839; rules without enforcedBy remain guidance.' },
+                }, 0);
+            }
+            const referenced = new Set(await packsReferencedByRule(rule, options));
+            return jsonResult({
+                schema: 'aiwg-gates-list/v1', rule,
+                packs: packs.filter(pack => referenced.has(pack.id)),
+                enforcedBy: { status: 'stub', note: 'Rule enforcedBy coverage is tracked in #2839.' },
+            }, 0);
+        }
+        return { exitCode: 2, message: usage(), rawOutput: true };
+    }
+    catch (error) {
+        return { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+    }
+}
+export const gatesHandler = {
+    id: 'gates',
+    name: 'Gates',
+    description: 'Validate, evaluate and inspect declarative gate packs offline',
+    category: 'utility',
+    aliases: [],
+    help: async () => ({ exitCode: 0, message: usage(), rawOutput: true }),
+    execute: executeGates,
+};
+//# sourceMappingURL=gates.js.map

package/dist/src/cli/handlers/index.js

@@ -73,12 +73,14 @@ import { installationHandler } from './installation.js';
 import { uhpHandler } from './uhp.js';
 import { schemaHandler } from './schema.js';
 import { datasetHandler } from './dataset.js';
+import { decisionHandler } from './decision.js';
+import { gatesHandler } from './gates.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, writerProfileHandler, botHandoffHandler, buildVerifyHandler, writingHandler, schemaHandler, datasetHandler, installationHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, writerProfileHandler, botHandoffHandler, buildVerifyHandler, writingHandler, schemaHandler, datasetHandler, decisionHandler, gatesHandler, installationHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -169,6 +171,8 @@ export const allHandlers = [
     writingHandler,
     schemaHandler,
     datasetHandler,
+    decisionHandler,
+    gatesHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/sessions.js

@@ -64,6 +64,7 @@ Options:
   --provider-home <path>  Override the provider home root (testing/portable homes)
   --codex-root <path>  Explicitly authorize a shared Codex sessions/export root
   --omp-root <path>  Explicitly authorize an OMP profile sessions root
+  --muse-root <path>  Explicitly authorize a Muse Code sessions root
   --dsh-root <path>  Explicitly authorize a DeepSeek Harness sessions root
   --confirm, --yes  Confirm a persistent discovered batch import
   --lock-wait-ms <n>  Maximum import-lease wait (default 5000)
@@ -1172,6 +1173,8 @@ async function discoverWorkspace(ctx, args) {
             : undefined,
         ompRoot: args.values.has('--omp-root')
             ? resolve(ctx.cwd, args.values.get('--omp-root')) : undefined,
+        museRoot: args.values.has('--muse-root')
+            ? resolve(ctx.cwd, args.values.get('--muse-root')) : undefined,
         dshRoot: args.values.has('--dsh-root')
             ? resolve(ctx.cwd, args.values.get('--dsh-root')) : undefined,
         codexRoot: args.values.has('--codex-root')
@@ -1439,14 +1442,14 @@ function providerDisposition(provider) {
     }
     if (provider === 'muse') {
         return {
-            provider, disposition: 'manual-only', operationalState: 'available',
-            supportedOperations: ['inspect', 'stream'],
-            acquisitionModes: ['manual-export'],
-            reasonCode: 'MANUAL_SOURCE_SELECTION_REQUIRED',
-            remediation: 'Run `muse export --session <id-or-session.jsonl>` and explicitly select the trajectory JSON; sessions live under $XDG_DATA_HOME/muse/sessions, but that native log format is internal, so auto-discover is unsupported.',
+            provider, disposition: 'implemented', operationalState: 'available',
+            supportedOperations: ['discover', 'inspect', 'stream'],
+            acquisitionModes: ['manual-export', 'jsonl'],
+            reasonCode: null,
+            remediation: 'Import an explicit `muse export` trajectory JSON, or pass `--muse-root` with an explicitly authorized $XDG_DATA_HOME/muse/sessions root for evidence-gated native discovery.',
             evidence: {
                 adapterVersion: MUSE_ADAPTER_VERSION,
-                verifiedAt: '2026-09-24',
+                verifiedAt: '2026-10-02',
                 documentation: 'docs/providers/muse-sessions.md',
             },
         };
@@ -1559,7 +1562,7 @@ function parseArgs(argv) {
         '--entity', '--sensitivity', '--extraction-state', '--page-size', '--max-documents',
         '--state', '--reviewer', '--reason', '--policy-version', '--min-confidence',
         '--consumer', '--actor-class', '--reason-code', '--dependent-action', '--basis',
-        '--manifest', '--provider-home', '--codex-root', '--omp-root', '--dsh-root', '--lock-wait-ms', '--min-coverage', '--gap',
+        '--manifest', '--provider-home', '--codex-root', '--omp-root', '--muse-root', '--dsh-root', '--lock-wait-ms', '--min-coverage', '--gap',
         '--inactivity-threshold',
         '--control-events',
         '--session', '--status', '--actor', '--group-by',

package/dist/src/cli/handlers/utilities.js

@@ -29,6 +29,13 @@ const REGISTRY_ID_TO_USE_NAME = {
     'research-complete': 'research',
     'forensics-complete': 'forensics',
 };
+function flagValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index >= 0)
+        return args[index + 1];
+    const prefix = `${flag}=`;
+    return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
 /**
  * Read the installed frameworks from the on-disk registry.
  */
@@ -519,6 +526,19 @@ export const doctorHandler = {
         catch (error) {
             console.log(`\n── Grok Build native extensions ──\n  ⚠ unable to audit: ${error instanceof Error ? error.message : String(error)}`);
         }
+        try {
+            const projectDir = ctx.cwd || process.cwd();
+            const provider = flagValue(ctx.args, '--provider');
+            const requested = provider === 'muse' || ctx.args.includes('--all-providers');
+            const { inspectMuseNative, isMuseDeployedProject } = await import('../../mcp/muse-native-config.mjs');
+            if (requested || await isMuseDeployedProject(projectDir)) {
+                const native = await inspectMuseNative({ projectDir });
+                console.log(`\n── Muse Code native extensions ──\n  CLI: ${native.cli}\n  Hooks: ${native.hooks}\n  MCP: ${native.mcp}`);
+            }
+        }
+        catch (error) {
+            console.log(`\n── Muse Code native extensions ──\n  ⚠ unable to audit: ${error instanceof Error ? error.message : String(error)}`);
+        }
         try {
             const { buildAgentSkillsDoctorSection } = await import('../../skills/doctor.js');
             const section = buildAgentSkillsDoctorSection(ctx.cwd || process.cwd());

package/dist/src/config/aiwg-config.js

@@ -17,6 +17,7 @@ import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from './project-artifacts.js';
 import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
 import { defaultArtifactOutputs, validateArtifactOutputs } from '../artifacts/output-policy.js';
+import { validateGatesConfig } from '../gates/floors.js';
 import { validateUhpConfig } from '../uhp/config.js';
 const CONFIG_FILENAME = 'aiwg.config';
 /**
@@ -174,7 +175,7 @@ export function resolveDelivery(delivery) {
  *     should tune. Conservative 10 default.
  *   - grokbot: desktop multi-agent; conservative 4 until native evidence.
 *   - grok-build: experimental; conservative 4 until Wave 2/3 evidence.
- *   - muse: experimental; conservative 4 until Wave 2/3 evidence.
+ *   - muse: stable; conservative 4 until native concurrency evidence.
  *   - unknown: conservative 4 default.
  */
 export const PROVIDER_PARALLELISM_DEFAULTS = {
@@ -192,7 +193,7 @@ export const PROVIDER_PARALLELISM_DEFAULTS = {
     // Desktop multi-agent; conservative until native concurrency evidence exists.
     grokbot: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     'grok-build': { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
-    // Muse Code is experimental; conservative until Wave 2/3 native concurrency evidence (#235).
+    // Muse Code is stable; keep conservative defaults until native concurrency evidence (#235).
     muse: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     // Conservative defaults for remaining stable/experimental harnesses (#249).
     openhuman: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
@@ -882,6 +883,15 @@ export async function readAiwgConfig(projectDir) {
     const uhpErrors = validateUhpConfig(parsed.uhp);
     if (uhpErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
+    // Gates errors warn (non-fatal): an invalid `gates` section must not brick
+    // every command that reads the config. Gates entry points (`aiwg gates
+    // evaluate`, binding resolution with floors) re-validate strictly via
+    // `validateGatesConfig` and fail closed there; `writeAiwgConfig` below
+    // stays strict so bad policy is never persisted.
+    const gatesErrors = validateGatesConfig(parsed.gates);
+    if (gatesErrors.length > 0) {
+        console.warn(`Invalid gates section in .aiwg/aiwg.config (ignored):\n${gatesErrors.join('\n')}`);
+    }
     return parsed;
 }
 /**
@@ -903,6 +913,9 @@ export async function writeAiwgConfig(projectDir, config) {
     const uhpErrors = validateUhpConfig(config.uhp);
     if (uhpErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
+    const gatesErrors = validateGatesConfig(config.gates);
+    if (gatesErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${gatesErrors.join('\n')}`);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);

package/dist/src/decision/acceptance.js

@@ -76,6 +76,31 @@ export function applyPrimitiveAcceptance(definition, policy, observation) {
     }
     return routed(observation, policy, policy.defaultRoute, 'default', evidence);
 }
+export function applyTargetAcceptance(definition, target, observation) {
+    if (observation.status !== 'success')
+        return observation;
+    if (target.acceptance.mode === 'typed-value')
+        return observation;
+    if (target.acceptance.mode === 'primitive-policy')
+        return applyPrimitiveAcceptance(definition, target.acceptance, observation);
+    if (!observation.uncertainty || observation.uncertainty.confidence === null)
+        return abstained('missing-confidence', observation);
+    if (observation.uncertainty.profile !== target.acceptance.profile)
+        return abstained('confidence-profile-mismatch', observation);
+    // Compare on the probability scale: minimumBps / 10_000 is the exact double for the decimal threshold,
+    // whereas confidence * 10_000 can round below it (0.7 * 10_000 === 6999.999999999999).
+    return observation.uncertainty.confidence < target.acceptance.minimumBps / 10_000
+        ? abstained('low-confidence', observation) : observation;
+}
+// Mirrors the evaluator's failure observation: an abstention keeps provenance but drops the value.
+function abstained(reason, observation) {
+    return {
+        status: 'abstained', reason, uncertainty: observation.uncertainty ?? null,
+        actualModel: observation.actualModel ?? null,
+        usage: observation.usage ?? { inputTokens: null, outputTokens: null, costUsd: null },
+        requestId: observation.requestId ?? null,
+    };
+}
 function deriveEvidence(definition, observation) {
     const values = {};
     const add = (metric, value, normalized, provenance, calibrationRef = null) => {