agentxchain 2.100.0 → 2.102.0

package/src/lib/normalized-config.js

@@ -556,82 +556,13 @@ export function validateV4Config(data, projectRoot) {
     errors.push(...timeoutValidation.errors);
   }
 
-  warnings.push(...collectRemoteReviewOnlyGateWarnings(data));
+  // Admission control (ADM-001..004) is handled by the validate, doctor, and
+  // run-loop paths which call runAdmissionControl() directly. Config schema
+  // validation here should not duplicate that surface.
 
   return { ok: errors.length === 0, errors, warnings };
 }
 
-export function collectRemoteReviewOnlyGateWarnings(data) {
-  const warnings = [];
-  const routing = data?.routing;
-  const gates = data?.gates;
-  const roles = data?.roles;
-  const runtimes = data?.runtimes;
-
-  if (!routing || !gates || !roles || !runtimes) {
-    return warnings;
-  }
-
-  for (const [phase, route] of Object.entries(routing)) {
-    const exitGateId = route?.exit_gate;
-    if (!exitGateId || !gates[exitGateId]) {
-      continue;
-    }
-
-    const requiredFiles = Array.isArray(gates[exitGateId]?.requires_files)
-      ? gates[exitGateId].requires_files.filter(filePath => typeof filePath === 'string' && filePath.trim())
-      : [];
-    if (requiredFiles.length === 0) {
-      continue;
-    }
-
-    const candidateRoleIds = [
-      route?.entry_role,
-      ...(Array.isArray(route?.allowed_next_roles) ? route.allowed_next_roles : []),
-    ].filter((roleId) => roleId && roleId !== 'human');
-
-    if (candidateRoleIds.length === 0) {
-      continue;
-    }
-
-    const candidateRoles = [...new Set(candidateRoleIds)]
-      .map((roleId) => {
-        const role = roles[roleId];
-        const runtime = role?.runtime ? runtimes[role.runtime] : null;
-        if (!role || !runtime) {
-          return null;
-        }
-        return { roleId, role, runtime };
-      })
-      .filter(Boolean);
-
-    if (candidateRoles.length === 0) {
-      continue;
-    }
-
-    const hasFileProducingRole = candidateRoles.some(({ role }) =>
-      role.write_authority === 'authoritative' || role.write_authority === 'proposed');
-    if (hasFileProducingRole) {
-      continue;
-    }
-
-    const allRemoteReviewOnly = candidateRoles.every(({ role, runtime }) =>
-      role.write_authority === 'review_only' && (runtime.type === 'api_proxy' || runtime.type === 'remote_agent'));
-    if (!allRemoteReviewOnly) {
-      continue;
-    }
-
-    const roleSummary = candidateRoles
-      .map(({ roleId, runtime }) => `${roleId}:${runtime.type}`)
-      .join(', ');
-    warnings.push(
-      `Routing "${phase}" exits through gate "${exitGateId}" with requires_files (${requiredFiles.join(', ')}) but all participating roles are review_only remote runtimes (${roleSummary}). Those files cannot be produced through governed turns; add a proposed/authoritative writer, remove the gate files, or expect operator-managed out-of-band artifacts.`,
-    );
-  }
-
-  return warnings;
-}
-
 export function validateBudgetConfig(budget) {
   const errors = [];
 

package/src/lib/run-loop.js

@@ -32,6 +32,7 @@ import {
   RUNNER_INTERFACE_VERSION,
 } from './runner-interface.js';
 
+import { runAdmissionControl } from './admission-control.js';
 import { mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 
@@ -65,6 +66,13 @@ export async function runLoop(root, config, callbacks, options = {}) {
     }
   };
 
+  // ── Admission control — reject provably dead-end configs ────────────────
+  const admission = runAdmissionControl(config, config);
+  if (!admission.ok) {
+    return makeResult(false, 'admission_rejected', null, 0, [], 0,
+      admission.errors.map(e => `Admission control: ${e}`));
+  }
+
   // ── Initialize if idle ──────────────────────────────────────────────────
   let state = loadState(root, config);
   const shouldRestartCompleted = state?.status === 'completed' && options.startNewRunFromCompleted === true;

package/src/lib/validation.js

@@ -9,7 +9,7 @@ import {
   validateAcceptanceHintCompletion,
   validateGovernedWorkflowKit,
 } from './governed-templates.js';
-import { collectRemoteReviewOnlyGateWarnings } from './normalized-config.js';
+import { runAdmissionControl } from './admission-control.js';
 
 const DEFAULT_REQUIRED_FILES = [
   '.planning/PROJECT.md',
@@ -116,8 +116,10 @@ export function validateGovernedProject(root, rawConfig, config, opts = {}) {
   errors.push(...workflowKit.errors);
   warnings.push(...workflowKit.warnings);
 
-  // Config-shape warnings (dead-end gates, etc.) — mirrors doctor/config --set surfaces
-  warnings.push(...collectRemoteReviewOnlyGateWarnings(rawConfig));
+  // Admission control — reject provably dead-end configs
+  const admission = runAdmissionControl(config, rawConfig);
+  errors.push(...admission.errors);
+  warnings.push(...admission.warnings);
 
   const mustExist = [
     config.files?.state || '.agentxchain/state.json',