@aiwg/cli 2026.9.24 → 2026.10.1

package/dist/src/cli/handlers/decision.js

@@ -0,0 +1,177 @@
+import { askDecision, DecisionAskUsageError, decisionCapabilities, evaluateRequestPath, listPatterns, livePlan, materializeSyntheticClassificationSetup, readDecisionContextFile, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
+function jsonResult(value, exitCode = 0) {
+    return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
+}
+function usage() {
+    return [
+        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup> [options]',
+        '       aiwg decision ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--context <text> | --context-file <path> | --context-stdin] [--threshold 0.8] [--timeout-ms 15000] [--json]',
+        '',
+        'Commands:',
+        '  capabilities|status                 Show offline readiness, primitives, config and feature availability',
+        '  patterns list                       List governed decision pattern packs',
+        '  patterns show <id>                  Show one pattern pack and schemas',
+        '  patterns offline-run <id> [fixture] Run a recorded offline fixture through the decision runtime',
+        '  patterns live-plan <id> [--opt-in] [--credential-resolved] [--egress-approved]',
+        '  validate <request|definition|ruleset|binding> <path>',
+        '  evaluate --request <path> [--host-policy-module <path>]',
+        '  setup synthetic-classification [--output-dir <dir>]',
+        '  setup jev [--token-stdin] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
+        '  ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5)',
+    ].join('\n');
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    return args[index + 1];
+}
+function takeRequiredOption(args, name) {
+    const value = takeOption(args, name);
+    if (!value || value.startsWith('--'))
+        throw new DecisionAskUsageError(`missing-${name.slice(2)}`, `${name} requires a value`);
+    return value;
+}
+function patternId(value) {
+    if (!value)
+        throw new Error('Pattern id is required');
+    return value;
+}
+function flagCount(args, names) {
+    return args.filter(arg => names.includes(arg)).length;
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+    return Buffer.concat(chunks).toString('utf8');
+}
+function parseNumber(value, name) {
+    if (value === undefined)
+        throw new DecisionAskUsageError(`missing-${name.slice(2)}`, `${name} requires a value`);
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed))
+        throw new DecisionAskUsageError(`invalid-${name.slice(2)}`, `${name} must be numeric`);
+    return parsed;
+}
+function parseScale(value) {
+    if (!value)
+        throw new DecisionAskUsageError('invalid-scale', '--scale requires a range like 1-5');
+    const match = /^(-?\d+)-(-?\d+)$/.exec(value);
+    if (!match)
+        throw new DecisionAskUsageError('invalid-scale', '--scale requires a range like 1-5');
+    return { low: Number(match[1]), high: Number(match[2]) };
+}
+async function decisionSetupJev(rest) {
+    const token = rest.includes('--token-stdin') ? (await readStdin()).trim() : undefined;
+    const result = await setupJev({
+        token,
+        region: takeOption(rest, '--region'),
+        endpoint: takeOption(rest, '--endpoint'),
+        verify: rest.includes('--verify'),
+        remove: rest.includes('--remove'),
+    }, { env: process.env });
+    return jsonResult(result);
+}
+async function decisionAsk(ctx) {
+    const args = ctx.args.slice(1);
+    const modeCount = flagCount(args, ['--yes-no']) + (args.includes('--choices') ? 1 : 0) + (args.includes('--scale') ? 1 : 0);
+    if (modeCount !== 1)
+        throw new DecisionAskUsageError('invalid-mode', 'Select exactly one of --yes-no, --choices, or --scale');
+    const contextModes = flagCount(args, ['--context', '--context-file', '--context-stdin']);
+    if (contextModes > 1)
+        throw new DecisionAskUsageError('invalid-context', 'Select at most one context source');
+    const question = args.includes('--question') ? takeRequiredOption(args, '--question') : '';
+    let context = takeOption(args, '--context');
+    if (args.includes('--context') && (context === undefined || context.startsWith('--'))) {
+        throw new DecisionAskUsageError('missing-context', '--context requires text');
+    }
+    if (args.includes('--context-file')) {
+        const filePath = takeRequiredOption(args, '--context-file');
+        context = await readDecisionContextFile(filePath);
+    }
+    if (args.includes('--context-stdin'))
+        context = await readStdin();
+    const choices = args.includes('--choices') ? takeRequiredOption(args, '--choices') : undefined;
+    const scale = args.includes('--scale') ? parseScale(takeOption(args, '--scale')) : null;
+    const input = {
+        question,
+        mode: args.includes('--yes-no') ? { kind: 'yes-no' }
+            : choices !== undefined ? { kind: 'choices', choices: choices.split(',').map(value => value.trim()).filter(Boolean) }
+                : { kind: 'scale', ...scale },
+        ...(context === undefined ? {} : { context }),
+        ...(args.includes('--threshold') ? { threshold: parseNumber(takeOption(args, '--threshold'), '--threshold') } : {}),
+        ...(args.includes('--timeout-ms') ? { timeoutMs: parseNumber(takeOption(args, '--timeout-ms'), '--timeout-ms') } : {}),
+    };
+    const result = await askDecision(input, { env: process.env });
+    if (args.includes('--json'))
+        return jsonResult(result);
+    if (result.status === 'fallback')
+        return { exitCode: 0, message: `FALLBACK to LLM: ${result.reason}`, rawOutput: true };
+    return { exitCode: 0, message: `${String(result.answer)} (confidence ${result.confidence?.toFixed(2) ?? 'unknown'}, ${result.model ?? 'unknown-model'})`, rawOutput: true };
+}
+async function executeDecision(ctx) {
+    const [command, subcommand, ...rest] = ctx.args;
+    const options = { cwd: ctx.cwd, frameworkRoot: ctx.frameworkRoot, env: process.env };
+    try {
+        if (!command || command === '--help' || command === '-h')
+            return { exitCode: 0, message: usage(), rawOutput: true };
+        if (command === 'capabilities' || command === 'status')
+            return jsonResult(decisionCapabilities(options));
+        if (command === 'ask')
+            return await decisionAsk(ctx);
+        if (command === 'patterns') {
+            if (subcommand === 'list')
+                return jsonResult(listPatterns());
+            if (subcommand === 'show')
+                return jsonResult(showPattern(patternId(rest[0])));
+            if (subcommand === 'offline-run')
+                return jsonResult(await runOfflinePattern(patternId(rest[0]), rest[1]));
+            if (subcommand === 'live-plan')
+                return jsonResult(livePlan(patternId(rest[0]), {
+                    explicitOptIn: rest.includes('--opt-in'),
+                    credentialResolved: rest.includes('--credential-resolved'),
+                    egressApproved: rest.includes('--egress-approved'),
+                }));
+        }
+        if (command === 'validate') {
+            const target = subcommand;
+            const result = await validateDecisionInput(target, rest[0] ?? '', options);
+            return jsonResult(result, result.valid ? 0 : 2);
+        }
+        if (command === 'evaluate') {
+            const request = takeOption(ctx.args, '--request');
+            if (!request)
+                return { exitCode: 2, message: 'decision evaluate requires --request <path>' };
+            const result = await evaluateRequestPath(request, options, {
+                hostPolicyModulePath: takeOption(ctx.args, '--host-policy-module'),
+            });
+            return jsonResult(result, result.exitCode);
+        }
+        if (command === 'setup' && subcommand === 'synthetic-classification') {
+            const outputDir = takeOption(ctx.args, '--output-dir');
+            if (outputDir)
+                return jsonResult(await materializeSyntheticClassificationSetup(outputDir, {}, options));
+            return jsonResult(syntheticClassificationSetup({}, options));
+        }
+        if (command === 'setup' && subcommand === 'jev')
+            return await decisionSetupJev(rest);
+        return { exitCode: 2, message: usage(), rawOutput: true };
+    }
+    catch (error) {
+        if (error instanceof DecisionAskUsageError) {
+            return { exitCode: 2, message: JSON.stringify({ schema: 'aiwg-decision-error/v1', reason: error.reason, message: error.message }, null, 2), rawOutput: true };
+        }
+        return { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+    }
+}
+export const decisionHandler = {
+    id: 'decision',
+    name: 'Decision Driver',
+    description: 'Inspect, validate and run governed decision classification workflows',
+    category: 'utility',
+    aliases: [],
+    help: async () => ({ exitCode: 0, message: usage(), rawOutput: true }),
+    execute: executeDecision,
+};
+//# sourceMappingURL=decision.js.map

package/dist/src/cli/handlers/gates.js

@@ -0,0 +1,154 @@
+function jsonResult(value, exitCode = 0) {
+    return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
+}
+function usage() {
+    return [
+        'Usage: aiwg gates <validate|evaluate|show|list> [options]',
+        '',
+        'Commands:',
+        '  validate <pack|binding|report> <path> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  evaluate --binding <file> --metrics <file> --holdout <file> [--upstream <file>] --now <iso> --trusted-binding-digest <sha256> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  show <id> [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '  list [--namespace <ns>] [--rule [<rule-id>]] [--pack-dir <dir>] [--aiwg-root <dir>]',
+        '',
+        'Packs live in <bundle>/gate-packs/*.gatepack.yaml|json and register as',
+        'aiwg:<bundle>/<name> (shipped).',
+        'Single files and bundle directories passed via --pack-dir are always',
+        'project: packs; aiwg: is reserved for the installed tree, and a --pack-dir',
+        'manifest claiming a shipped or installed bundle id refuses. An --aiwg-root',
+        'override is untrusted:',
+        'list/show/validate still inspect it, but evaluate refuses it.',
+        'Evaluation is pure and offline: pass --now <iso> for the fake clock.',
+        'The holdout and upstream files must already carry their sealed digests,',
+        'and --upstream is required whenever the binding observes an',
+        'upstream-ceiling gate. Project floors load from .aiwg/aiwg.config in the',
+        'cwd (unreadable or invalid config refuses evaluation). Reports printed',
+        "here carry attestation: 'offline-cli'.",
+    ].join('\n');
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    return args[index + 1];
+}
+function takeAllOptions(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] === name && index + 1 < args.length)
+            values.push(args[index + 1]);
+    }
+    return values;
+}
+function driverOptions(ctx) {
+    // The shipped root resolves from the installed framework location, never
+    // from the cwd: any checkout could otherwise impersonate the aiwg:
+    // namespace. An explicit --aiwg-root is kept for inspection only; packs
+    // loaded from it are marked untrusted and refused by evaluate.
+    const aiwgRoot = takeOption(ctx.args, '--aiwg-root') ?? ctx.frameworkRoot;
+    const packDirs = takeAllOptions(ctx.args, '--pack-dir');
+    return { cwd: ctx.cwd, aiwgRoot, ...(packDirs.length ? { packDirs } : {}) };
+}
+/** Positional args with each known value-flag and its value skipped in order. */
+function positionals(args, skipCommand) {
+    const valueFlags = new Set(['--pack-dir', '--aiwg-root', '--binding', '--metrics', '--holdout', '--upstream', '--now', '--namespace', '--rule', '--trusted-binding-digest']);
+    const found = [];
+    let skipNext = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (valueFlags.has(arg)) {
+            skipNext = true;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        if (arg === skipCommand && index === 0)
+            continue;
+        found.push(arg);
+    }
+    return found;
+}
+async function executeGates(ctx) {
+    const [command] = ctx.args;
+    try {
+        if (!command || command === '--help' || command === '-h')
+            return { exitCode: 0, message: usage(), rawOutput: true };
+        const { validateGateFile, evaluateGatesFromFiles, showGatePack, listGatePacks, packsReferencedByRule, } = await import('../../gates/driver.js');
+        const options = driverOptions(ctx);
+        if (command === 'validate') {
+            const args = positionals(ctx.args, 'validate');
+            const target = (args[0] ?? '');
+            const targetPath = args[1] ?? '';
+            if (!['pack', 'binding', 'report', 'auto'].includes(target) || !targetPath) {
+                return { exitCode: 2, message: `gates validate requires <pack|binding|report|auto> <path>\n\n${usage()}`, rawOutput: true };
+            }
+            const result = await validateGateFile(target === 'auto' ? 'auto' : target, targetPath, options);
+            return jsonResult(result, result.valid ? 0 : 2);
+        }
+        if (command === 'evaluate') {
+            const binding = takeOption(ctx.args, '--binding');
+            const metrics = takeOption(ctx.args, '--metrics');
+            const holdout = takeOption(ctx.args, '--holdout');
+            const upstream = takeOption(ctx.args, '--upstream');
+            const now = takeOption(ctx.args, '--now');
+            const trustedBindingDigest = takeOption(ctx.args, '--trusted-binding-digest');
+            if (!binding || !metrics || !holdout || !now || !trustedBindingDigest) {
+                return { exitCode: 2, message: `gates evaluate requires --binding <file> --metrics <file> --holdout <file> --now <iso> --trusted-binding-digest <sha256:..>\n\n${usage()}`, rawOutput: true };
+            }
+            if (!/^sha256:[0-9a-f]{64}$/.test(trustedBindingDigest)) {
+                return { exitCode: 2, message: `gates evaluate requires --trusted-binding-digest <sha256:..> (64 hex chars)\n\n${usage()}`, rawOutput: true };
+            }
+            const report = await evaluateGatesFromFiles({
+                bindingPath: binding, metricsPath: metrics, holdoutPath: holdout,
+                ...(upstream ? { upstreamPath: upstream } : {}), now,
+                trustedBindingDigest: trustedBindingDigest,
+            }, options);
+            return jsonResult(report, 0);
+        }
+        if (command === 'show') {
+            const id = positionals(ctx.args, 'show')[0];
+            if (!id)
+                return { exitCode: 2, message: `gates show requires <id>\n\n${usage()}`, rawOutput: true };
+            return jsonResult(showGatePack(id, options), 0);
+        }
+        if (command === 'list') {
+            const namespace = takeOption(ctx.args, '--namespace');
+            const ruleIndex = ctx.args.indexOf('--rule');
+            const ruleValue = ruleIndex >= 0 ? ctx.args[ruleIndex + 1] : undefined;
+            const rule = ruleIndex >= 0 ? (ruleValue && !ruleValue.startsWith('-') ? ruleValue : null) : undefined;
+            const packs = listGatePacks({ ...options, ...(namespace ? { namespace } : {}) });
+            if (rule === undefined)
+                return jsonResult({ schema: 'aiwg-gates-list/v1', packs }, 0);
+            if (rule === null) {
+                return jsonResult({
+                    schema: 'aiwg-gates-list/v1', packs,
+                    enforcedBy: { status: 'stub', note: 'Rule enforcedBy coverage is tracked in #2839; rules without enforcedBy remain guidance.' },
+                }, 0);
+            }
+            const referenced = new Set(await packsReferencedByRule(rule, options));
+            return jsonResult({
+                schema: 'aiwg-gates-list/v1', rule,
+                packs: packs.filter(pack => referenced.has(pack.id)),
+                enforcedBy: { status: 'stub', note: 'Rule enforcedBy coverage is tracked in #2839.' },
+            }, 0);
+        }
+        return { exitCode: 2, message: usage(), rawOutput: true };
+    }
+    catch (error) {
+        return { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
+    }
+}
+export const gatesHandler = {
+    id: 'gates',
+    name: 'Gates',
+    description: 'Validate, evaluate and inspect declarative gate packs offline',
+    category: 'utility',
+    aliases: [],
+    help: async () => ({ exitCode: 0, message: usage(), rawOutput: true }),
+    execute: executeGates,
+};
+//# sourceMappingURL=gates.js.map

package/dist/src/cli/handlers/index.js

@@ -73,12 +73,14 @@ import { installationHandler } from './installation.js';
 import { uhpHandler } from './uhp.js';
 import { schemaHandler } from './schema.js';
 import { datasetHandler } from './dataset.js';
+import { decisionHandler } from './decision.js';
+import { gatesHandler } from './gates.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, writerProfileHandler, botHandoffHandler, buildVerifyHandler, writingHandler, schemaHandler, datasetHandler, installationHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, writerProfileHandler, botHandoffHandler, buildVerifyHandler, writingHandler, schemaHandler, datasetHandler, decisionHandler, gatesHandler, installationHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -169,6 +171,8 @@ export const allHandlers = [
     writingHandler,
     schemaHandler,
     datasetHandler,
+    decisionHandler,
+    gatesHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/sessions.js

@@ -64,6 +64,7 @@ Options:
   --provider-home <path>  Override the provider home root (testing/portable homes)
   --codex-root <path>  Explicitly authorize a shared Codex sessions/export root
   --omp-root <path>  Explicitly authorize an OMP profile sessions root
+  --muse-root <path>  Explicitly authorize a Muse Code sessions root
   --dsh-root <path>  Explicitly authorize a DeepSeek Harness sessions root
   --confirm, --yes  Confirm a persistent discovered batch import
   --lock-wait-ms <n>  Maximum import-lease wait (default 5000)
@@ -1172,6 +1173,8 @@ async function discoverWorkspace(ctx, args) {
             : undefined,
         ompRoot: args.values.has('--omp-root')
             ? resolve(ctx.cwd, args.values.get('--omp-root')) : undefined,
+        museRoot: args.values.has('--muse-root')
+            ? resolve(ctx.cwd, args.values.get('--muse-root')) : undefined,
         dshRoot: args.values.has('--dsh-root')
             ? resolve(ctx.cwd, args.values.get('--dsh-root')) : undefined,
         codexRoot: args.values.has('--codex-root')
@@ -1439,14 +1442,14 @@ function providerDisposition(provider) {
     }
     if (provider === 'muse') {
         return {
-            provider, disposition: 'manual-only', operationalState: 'available',
-            supportedOperations: ['inspect', 'stream'],
-            acquisitionModes: ['manual-export'],
-            reasonCode: 'MANUAL_SOURCE_SELECTION_REQUIRED',
-            remediation: 'Run `muse export --session <id-or-session.jsonl>` and explicitly select the trajectory JSON; sessions live under $XDG_DATA_HOME/muse/sessions, but that native log format is internal, so auto-discover is unsupported.',
+            provider, disposition: 'implemented', operationalState: 'available',
+            supportedOperations: ['discover', 'inspect', 'stream'],
+            acquisitionModes: ['manual-export', 'jsonl'],
+            reasonCode: null,
+            remediation: 'Import an explicit `muse export` trajectory JSON, or pass `--muse-root` with an explicitly authorized $XDG_DATA_HOME/muse/sessions root for evidence-gated native discovery.',
             evidence: {
                 adapterVersion: MUSE_ADAPTER_VERSION,
-                verifiedAt: '2026-09-24',
+                verifiedAt: '2026-10-02',
                 documentation: 'docs/providers/muse-sessions.md',
             },
         };
@@ -1559,7 +1562,7 @@ function parseArgs(argv) {
         '--entity', '--sensitivity', '--extraction-state', '--page-size', '--max-documents',
         '--state', '--reviewer', '--reason', '--policy-version', '--min-confidence',
         '--consumer', '--actor-class', '--reason-code', '--dependent-action', '--basis',
-        '--manifest', '--provider-home', '--codex-root', '--omp-root', '--dsh-root', '--lock-wait-ms', '--min-coverage', '--gap',
+        '--manifest', '--provider-home', '--codex-root', '--omp-root', '--muse-root', '--dsh-root', '--lock-wait-ms', '--min-coverage', '--gap',
         '--inactivity-threshold',
         '--control-events',
         '--session', '--status', '--actor', '--group-by',

package/dist/src/cli/handlers/utilities.js

@@ -29,6 +29,13 @@ const REGISTRY_ID_TO_USE_NAME = {
     'research-complete': 'research',
     'forensics-complete': 'forensics',
 };
+function flagValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index >= 0)
+        return args[index + 1];
+    const prefix = `${flag}=`;
+    return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
 /**
  * Read the installed frameworks from the on-disk registry.
  */
@@ -519,6 +526,19 @@ export const doctorHandler = {
         catch (error) {
             console.log(`\n── Grok Build native extensions ──\n  ⚠ unable to audit: ${error instanceof Error ? error.message : String(error)}`);
         }
+        try {
+            const projectDir = ctx.cwd || process.cwd();
+            const provider = flagValue(ctx.args, '--provider');
+            const requested = provider === 'muse' || ctx.args.includes('--all-providers');
+            const { inspectMuseNative, isMuseDeployedProject } = await import('../../mcp/muse-native-config.mjs');
+            if (requested || await isMuseDeployedProject(projectDir)) {
+                const native = await inspectMuseNative({ projectDir });
+                console.log(`\n── Muse Code native extensions ──\n  CLI: ${native.cli}\n  Hooks: ${native.hooks}\n  MCP: ${native.mcp}`);
+            }
+        }
+        catch (error) {
+            console.log(`\n── Muse Code native extensions ──\n  ⚠ unable to audit: ${error instanceof Error ? error.message : String(error)}`);
+        }
         try {
             const { buildAgentSkillsDoctorSection } = await import('../../skills/doctor.js');
             const section = buildAgentSkillsDoctorSection(ctx.cwd || process.cwd());

package/dist/src/config/aiwg-config.js

@@ -17,6 +17,7 @@ import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from './project-artifacts.js';
 import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
 import { defaultArtifactOutputs, validateArtifactOutputs } from '../artifacts/output-policy.js';
+import { validateGatesConfig } from '../gates/floors.js';
 import { validateUhpConfig } from '../uhp/config.js';
 const CONFIG_FILENAME = 'aiwg.config';
 /**
@@ -174,7 +175,7 @@ export function resolveDelivery(delivery) {
  *     should tune. Conservative 10 default.
  *   - grokbot: desktop multi-agent; conservative 4 until native evidence.
 *   - grok-build: experimental; conservative 4 until Wave 2/3 evidence.
- *   - muse: experimental; conservative 4 until Wave 2/3 evidence.
+ *   - muse: stable; conservative 4 until native concurrency evidence.
  *   - unknown: conservative 4 default.
  */
 export const PROVIDER_PARALLELISM_DEFAULTS = {
@@ -192,7 +193,7 @@ export const PROVIDER_PARALLELISM_DEFAULTS = {
     // Desktop multi-agent; conservative until native concurrency evidence exists.
     grokbot: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     'grok-build': { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
-    // Muse Code is experimental; conservative until Wave 2/3 native concurrency evidence (#235).
+    // Muse Code is stable; keep conservative defaults until native concurrency evidence (#235).
     muse: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     // Conservative defaults for remaining stable/experimental harnesses (#249).
     openhuman: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
@@ -882,6 +883,15 @@ export async function readAiwgConfig(projectDir) {
     const uhpErrors = validateUhpConfig(parsed.uhp);
     if (uhpErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
+    // Gates errors warn (non-fatal): an invalid `gates` section must not brick
+    // every command that reads the config. Gates entry points (`aiwg gates
+    // evaluate`, binding resolution with floors) re-validate strictly via
+    // `validateGatesConfig` and fail closed there; `writeAiwgConfig` below
+    // stays strict so bad policy is never persisted.
+    const gatesErrors = validateGatesConfig(parsed.gates);
+    if (gatesErrors.length > 0) {
+        console.warn(`Invalid gates section in .aiwg/aiwg.config (ignored):\n${gatesErrors.join('\n')}`);
+    }
     return parsed;
 }
 /**
@@ -903,6 +913,9 @@ export async function writeAiwgConfig(projectDir, config) {
     const uhpErrors = validateUhpConfig(config.uhp);
     if (uhpErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
+    const gatesErrors = validateGatesConfig(config.gates);
+    if (gatesErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${gatesErrors.join('\n')}`);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);

package/dist/src/decision/acceptance.js

@@ -76,6 +76,31 @@ export function applyPrimitiveAcceptance(definition, policy, observation) {
     }
     return routed(observation, policy, policy.defaultRoute, 'default', evidence);
 }
+export function applyTargetAcceptance(definition, target, observation) {
+    if (observation.status !== 'success')
+        return observation;
+    if (target.acceptance.mode === 'typed-value')
+        return observation;
+    if (target.acceptance.mode === 'primitive-policy')
+        return applyPrimitiveAcceptance(definition, target.acceptance, observation);
+    if (!observation.uncertainty || observation.uncertainty.confidence === null)
+        return abstained('missing-confidence', observation);
+    if (observation.uncertainty.profile !== target.acceptance.profile)
+        return abstained('confidence-profile-mismatch', observation);
+    // Compare on the probability scale: minimumBps / 10_000 is the exact double for the decimal threshold,
+    // whereas confidence * 10_000 can round below it (0.7 * 10_000 === 6999.999999999999).
+    return observation.uncertainty.confidence < target.acceptance.minimumBps / 10_000
+        ? abstained('low-confidence', observation) : observation;
+}
+// Mirrors the evaluator's failure observation: an abstention keeps provenance but drops the value.
+function abstained(reason, observation) {
+    return {
+        status: 'abstained', reason, uncertainty: observation.uncertainty ?? null,
+        actualModel: observation.actualModel ?? null,
+        usage: observation.usage ?? { inputTokens: null, outputTokens: null, costUsd: null },
+        requestId: observation.requestId ?? null,
+    };
+}
 function deriveEvidence(definition, observation) {
     const values = {};
     const add = (metric, value, normalized, provenance, calibrationRef = null) => {

package/dist/src/decision/adapters/jev.js

@@ -34,6 +34,7 @@ export class JevDecisionAdapter {
     pinnedFetch;
     now;
     region;
+    observeResponseBody;
     constructor(options = {}) {
         this.endpoint = options.endpoint ?? JEV_ENDPOINT;
         this.fetchImpl = options.fetch ?? fetch;
@@ -42,6 +43,23 @@ export class JevDecisionAdapter {
         this.pinnedFetch = options.pinnedFetch ?? pinnedHttpsFetch;
         this.now = options.now ?? Date.now;
         this.region = options.region?.trim() ? options.region : null;
+        this.observeResponseBody = options.observeResponseBody;
+    }
+    observeResponse(body) {
+        if (!this.observeResponseBody)
+            return;
+        let parsed = {};
+        try {
+            parsed = asRecord(parseBoundedJson(body));
+        }
+        catch { /* Invalid answers still have bounded body evidence. */ }
+        let usage = emptyUsage();
+        try {
+            usage = normalizeUsage(parsed.usage);
+        }
+        catch { /* Missing usage is unknown, including on auth errors. */ }
+        this.observeResponseBody(body, { actualModel: typeof parsed.model === 'string' && parsed.model ? parsed.model : null,
+            usage });
     }
     async capabilities() {
         return {
@@ -167,6 +185,7 @@ export class JevDecisionAdapter {
         if (!response.ok) {
             try {
                 const errorBody = await readBoundedBody(response, signal);
+                this.observeResponse(errorBody);
                 if (!metadata.requestId && response.headers.get('content-type')?.includes('json')) {
                     let parsedError;
                     try {
@@ -198,6 +217,7 @@ export class JevDecisionAdapter {
         let parsed;
         try {
             const encoded = await readBoundedBody(response, signal);
+            this.observeResponse(encoded);
             parsed = parseBoundedJson(encoded);
             if (request.signal.aborted)
                 return externalInterruption(request, 'terminal-response', metadata);
@@ -304,7 +324,7 @@ export class JevDecisionAdapter {
         }
         if (!response.ok) {
             try {
-                await readBoundedBody(response, signal);
+                this.observeResponse(await readBoundedBody(response, signal));
             }
             catch {
                 return batchFailure(requests, failure('invalid-output', metadata));
@@ -313,7 +333,9 @@ export class JevDecisionAdapter {
             return batchFailure(requests, failure(mapStatus(response.status), { ...metadata, ...(retryAfterMs === null ? {} : { retryAfterMs }) }));
         }
         try {
-            const parsed = parseBoundedJson(await readBoundedBody(response, signal));
+            const encoded = await readBoundedBody(response, signal);
+            this.observeResponse(encoded);
+            const parsed = parseBoundedJson(encoded);
             const normalized = normalizeBatchResponse(requests, parsed).map(answer => ({
                 questionId: answer.questionId,
                 observation: { ...answer.observation, ...metadata },
@@ -431,7 +453,11 @@ function normalizeAnswer(request, body, questionId) {
                 throw new DecisionValidationError('Score legend does not match declared levels');
         });
         const mean = Object.entries(distribution).reduce((sum, [index, probability]) => sum + Number(index) * probability, 0);
-        if (Math.abs(mean - answer.score) > 0.02)
+        // Jev reports probabilities and the score to two decimals, so each probability carries up to
+        // 0.005 of rounding error, weighted by its index, plus 0.005 on the score itself.
+        const indexSum = Object.keys(distribution).reduce((sum, index) => sum + Number(index), 0);
+        const tolerance = Math.max(0.02, 0.005 * indexSum + 0.005) + 1e-9;
+        if (Math.abs(mean - answer.score) > tolerance)
             throw new DecisionValidationError('Score is not the distribution weighted mean');
         validateDecisionValue(request.definition, answer.score);
         return success(answer.score, model, usage, uncertainty(answer.confidence, distribution, 'typesafe-distribution-v1'));