atris 3.31.0 → 3.32.0

package/commands/run-front.js

@@ -0,0 +1,144 @@
+// atris run: thin front door over the mission runtime loop.
+// One bounded pursuit: start a mission from the objective (or resume the most
+// logical runnable mission), tick it, complete on pass, then exit.
+// The old plan→do→review loop lives on behind `atris run --legacy`.
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const CLI_PATH = path.join(__dirname, '..', 'bin', 'atris.js');
+
+const RUN_VALUE_FLAGS = new Set([
+  '--owner',
+  '--cadence',
+  '--minutes',
+  '--hours',
+  '--max-ticks',
+  '--max-wall',
+  '--runner',
+  '--runner-bin',
+  '--runner-template',
+  '--runner-model',
+  '--runner-profile',
+]);
+
+function readValueFlag(args, name) {
+  const index = args.indexOf(name);
+  return index >= 0 && index + 1 < args.length ? args[index + 1] : null;
+}
+
+function positiveNumber(value) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+
+function runBudgetSeconds(args = []) {
+  const hours = positiveNumber(readValueFlag(args, '--hours'));
+  if (hours) return Math.round(hours * 3600);
+  const minutes = positiveNumber(readValueFlag(args, '--minutes'));
+  if (minutes) return Math.round(minutes * 60);
+  return null;
+}
+
+function runObjective(args = []) {
+  const words = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (RUN_VALUE_FLAGS.has(arg)) { i++; continue; }
+    if (arg.startsWith('-')) continue;
+    words.push(arg);
+  }
+  return words.join(' ').trim();
+}
+
+// Runners a spawned `mission run` can drive unattended.
+const HEADLESS_DRIVABLE_RUNNERS = new Set(['claude', 'atris2']);
+const CALLER_SESSION_RUNNERS = new Set(['codex_goal', 'caller_session', 'current_agent']);
+
+function liveCodexSession(env = process.env) {
+  return Boolean(String(env.CODEX_THREAD_ID || '').trim());
+}
+
+function runnerDrivableForFrontDoor(runner, options = {}) {
+  const normalized = String(runner || '').trim().toLowerCase();
+  if (HEADLESS_DRIVABLE_RUNNERS.has(normalized)) return true;
+  if (options.allowCallerSessionRunners && CALLER_SESSION_RUNNERS.has(normalized)) return true;
+  return false;
+}
+
+// Most logical mission: a moving one beats a planned one, newer beats older.
+// ready is excluded — it waits for review, not for another worker pass.
+function pickRunnableMission(root = process.cwd(), missionMap = null, options = {}) {
+  let map = missionMap;
+  if (!map) {
+    try { map = require('./mission').loadMissionMap(root); } catch { return null; }
+  }
+  const candidates = Array.from(map.values())
+    .filter((mission) => mission && (mission.status === 'running' || mission.status === 'planning'))
+    .filter((mission) => runnerDrivableForFrontDoor(mission?.runner, options))
+    .filter((mission) => !/^decide and start the next useful mission after:/i.test(String(mission?.objective || '')))
+    .sort((a, b) => {
+      if (a.status !== b.status) return a.status === 'running' ? -1 : 1;
+      return String(b.updated_at || b.created_at || '').localeCompare(String(a.updated_at || a.created_at || ''));
+    });
+  return candidates[0] || null;
+}
+
+function runTickBudget(args, budgetSeconds) {
+  const explicit = positiveNumber(readValueFlag(args, '--max-ticks'));
+  if (explicit) return Math.floor(explicit);
+  // A timed run is a loop contract: keep picking the next useful move until
+  // the wall clock spends the budget (same rule as member run).
+  return budgetSeconds ? Math.max(4, Math.ceil(budgetSeconds / 300)) : 4;
+}
+
+async function runMissionFront(args = []) {
+  const objective = runObjective(args);
+  const budgetSeconds = runBudgetSeconds(args);
+  const maxTicks = runTickBudget(args, budgetSeconds);
+  const maxWallSeconds = positiveNumber(readValueFlag(args, '--max-wall')) || budgetSeconds || 1200;
+
+  if (objective) {
+    const { runRuntimeMissionLoop } = require('../lib/mission-runtime-loop');
+    const result = await runRuntimeMissionLoop({
+      objective,
+      owner: readValueFlag(args, '--owner') || 'mission-lead',
+      cadence: readValueFlag(args, '--cadence') || '',
+      maxTicks,
+      maxWallSeconds,
+      noComplete: args.includes('--no-complete'),
+    }, {
+      cliPath: CLI_PATH,
+      onProgress: (line) => console.log(`  ${line}`),
+    });
+    console.log(result.text || '');
+    return result.ok ? 0 : 1;
+  }
+
+  const mission = pickRunnableMission(process.cwd(), null, {
+    allowCallerSessionRunners: liveCodexSession(),
+  });
+  if (!mission) {
+    console.log('No objective given and no runnable mission found.');
+    console.log('Start one: atris run "<objective>" [--minutes N] [--owner <member>]');
+    console.log('Or keep going indefinitely: atris autopilot');
+    return 1;
+  }
+  console.log(`Resuming mission ${mission.id} (${mission.status}): ${mission.objective}`);
+  const result = spawnSync(process.execPath, [
+    CLI_PATH, 'mission', 'run', mission.id,
+    '--max-ticks', String(maxTicks),
+    '--max-wall', String(maxWallSeconds),
+    '--complete-on-pass',
+  ], { cwd: process.cwd(), stdio: 'inherit' });
+  return result.status || 0;
+}
+
+module.exports = {
+  runMissionFront,
+  pickRunnableMission,
+  liveCodexSession,
+  runnerDrivableForFrontDoor,
+  runObjective,
+  runBudgetSeconds,
+  runTickBudget,
+};

package/commands/run.js

@@ -381,12 +381,15 @@ async function runAtris(options = {}) {
     process.exit(1);
   }
 
-  // Check configured runner CLI is available.
-  try {
-    execSync(buildRunnerAvailabilityCommand(), { stdio: 'pipe' });
-  } catch (err) {
-    console.error(runnerAvailabilityFailureMessage(err));
-    process.exit(1);
+  // Check configured runner CLI is available. Dry runs preview context only —
+  // they must work on machines (and CI) without the runner installed.
+  if (!dryRun) {
+    try {
+      execSync(buildRunnerAvailabilityCommand(), { stdio: 'pipe' });
+    } catch (err) {
+      console.error(runnerAvailabilityFailureMessage(err));
+      process.exit(1);
+    }
   }
 
   console.log('');

package/commands/sign.js

@@ -0,0 +1,90 @@
+const fs = require('fs');
+const path = require('path');
+
+// atris sign: co-author trailer on every commit in an atris workspace.
+// Installs a prepare-commit-msg hook that appends "Co-authored-by: Atris"
+// when the repo has an atris/ folder — same credit line Claude and Cursor use.
+// Idempotent and non-destructive: appends a marked block, removes only its own block.
+
+const MARKER = '# atris co-author';
+const TRAILER = 'Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>';
+
+const HOOK_BLOCK = `
+${MARKER}
+if [ -d "$(git rev-parse --show-toplevel 2>/dev/null)/atris" ] && [ "$2" != "merge" ] && [ "$2" != "squash" ]; then
+  if ! grep -qi "^co-authored-by: atris" "$1"; then
+    printf '\\nCo-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>\\n' >> "$1"
+  fi
+fi
+`;
+
+function hookPathFor(root) {
+  return path.join(root, '.git', 'hooks', 'prepare-commit-msg');
+}
+
+// Install the marked block into .git/hooks/prepare-commit-msg. Returns { hookPath, already }.
+function installSignHook(root = process.cwd()) {
+  if (!fs.existsSync(path.join(root, '.git'))) throw new Error('not a git repo (no .git here)');
+  const hookPath = hookPathFor(root);
+  fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+  let content = '';
+  try { content = fs.readFileSync(hookPath, 'utf8'); } catch {}
+  if (content.includes(MARKER)) return { hookPath, already: true };
+  if (!content) content = '#!/bin/sh\n';
+  if (!content.endsWith('\n')) content += '\n';
+  content += HOOK_BLOCK;
+  fs.writeFileSync(hookPath, content);
+  fs.chmodSync(hookPath, 0o755);
+  return { hookPath, already: false };
+}
+
+// Remove only our marked block; leave the rest of the hook untouched.
+function removeSignHook(root = process.cwd()) {
+  const hookPath = hookPathFor(root);
+  let content = '';
+  try { content = fs.readFileSync(hookPath, 'utf8'); } catch { return { hookPath, removed: false }; }
+  if (!content.includes(MARKER)) return { hookPath, removed: false };
+  const cleaned = content.replace(HOOK_BLOCK, '');
+  if (cleaned.trim() === '#!/bin/sh') {
+    fs.unlinkSync(hookPath);
+  } else {
+    fs.writeFileSync(hookPath, cleaned);
+  }
+  return { hookPath, removed: true };
+}
+
+function signStatus(root = process.cwd()) {
+  const hookPath = hookPathFor(root);
+  let content = '';
+  try { content = fs.readFileSync(hookPath, 'utf8'); } catch {}
+  return { hookPath, installed: content.includes(MARKER) };
+}
+
+function signCommand(sub) {
+  const rel = (p) => path.relative(process.cwd(), p);
+  if (sub === 'off' || sub === 'remove') {
+    const { hookPath, removed } = removeSignHook();
+    console.log(removed
+      ? `\n  ✓ atris co-author removed: ${rel(hookPath)}\n`
+      : `\n  nothing to remove — atris co-author is not installed\n`);
+    return 0;
+  }
+  if (sub === 'status') {
+    const { hookPath, installed } = signStatus();
+    console.log(installed
+      ? `\n  ✓ atris co-author is on: ${rel(hookPath)}\n    every commit gets: ${TRAILER}\n`
+      : `\n  atris co-author is off — run 'atris sign' to turn it on\n`);
+    return installed ? 0 : 1;
+  }
+  if (sub && sub !== 'on' && sub !== 'install') {
+    console.log(`\n  atris sign — co-author trailer on every commit\n\n  atris sign          install the prepare-commit-msg hook\n  atris sign off      remove it\n  atris sign status   check whether it's installed\n\n  While installed, any commit in a repo with an atris/ folder gets:\n    ${TRAILER}\n`);
+    return 0;
+  }
+  const { hookPath, already } = installSignHook();
+  console.log(already
+    ? `\n  already installed: ${rel(hookPath)}\n`
+    : `\n  ✓ atris co-author installed: ${rel(hookPath)}\n    every commit here now gets: ${TRAILER}\n`);
+  return 0;
+}
+
+module.exports = { signCommand, installSignHook, removeSignHook, signStatus, TRAILER };

package/commands/task.js

@@ -8,13 +8,14 @@ const http = require('http');
 const path = require('path');
 const os = require('os');
 const { taskProofState, buildVerifiedProof } = require('../lib/task-proof');
-const { evaluateAutoAccept, parseVerifyCommand } = require('../lib/auto-accept-certified');
+const { evaluateAutoAccept, parseVerifyCommand, runVerifyCommand, DENIED_TAGS } = require('../lib/auto-accept-certified');
 const { extractReceiptEvidence } = require('../lib/receipt-evidence');
 const escapeRegExp = require('../lib/escape-regexp');
 const {
   normalizeOwnerSlug,
   resolveFunctionalOwner: resolveFunctionalTaskOwner,
 } = require('../lib/functional-owner');
+const { operatorReady, hasAgentJargon } = require('./autoland');
 
 const DEFAULT_OWNER = process.env.ATRIS_AGENT_ID
   || process.env.USER
@@ -90,6 +91,14 @@ function getTaskDb() {
   }
 }
 
+function warnIfTaskTitleNeedsOperatorWhy(title) {
+  const text = String(title || '').trim();
+  if (!text || operatorReady(text)) return null;
+  const warning = 'Warning: add the why in plain words to this task title: what it buys or costs, who benefits, and no flags or identifiers.';
+  console.error(warning);
+  return warning;
+}
+
 function taskUsageText() {
   return `
 atris task - durable local task state (SQLite, gitignored)
@@ -113,6 +122,8 @@ atris task - durable local task state (SQLite, gitignored)
   atris task review-chat <id> [--as <owner>]  Start a task-owned /codex verification chat
   atris task accept <id> [--proof "..."] [--public]
                                            Human accepts proof, marks done; --public also publishes AgentXP
+  atris task certify-verified [--dry-run] [--limit <n>] [--as <actor>]
+                                           Re-run the runnable check named in each Review proof as a second actor; passing rows certify (denied lanes and check-less rows wait for a human)
   atris task auto-accept-certified --dry-run [--strict-verify] [--limit <n>]
                                            Preview certified Review rows; live accept needs --confirm-human-accept --as <human>
   atris task revise <id> --note "..."      Send reviewed work back to Do
@@ -374,13 +385,36 @@ function textFlag(args, names) {
 
 function landingFlags(args) {
   return {
-    happened: textFlag(args, ['--happened', '--what-happened']),
+    happened: textFlag(args, ['--landing', '--happened', '--what-happened']),
     checked: textFlag(args, ['--checked', '--how-checked']),
     tested: textFlag(args, ['--tested', '--what-tested']),
     decision: textFlag(args, ['--decision', '--acceptance']),
   };
 }
 
+function normalizedLandingSentence(value) {
+  return String(value || '').replace(/\s+/g, ' ').trim();
+}
+
+function defaultLandingSentenceForTitle(title) {
+  return `Completed: ${String(title || '').trim()}.`;
+}
+
+function landingNeedsDayOnePm(sentence, title) {
+  const text = normalizedLandingSentence(sentence);
+  if (!text) return true;
+  if (text.toLowerCase() === normalizedLandingSentence(defaultLandingSentenceForTitle(title)).toLowerCase()) return true;
+  return hasAgentJargon(text) || !operatorReady(text);
+}
+
+function warnIfLandingNeedsDayOnePm(landing, title) {
+  const sentence = landing && typeof landing === 'object' ? landing.happened : '';
+  if (!landingNeedsDayOnePm(sentence, title)) return null;
+  const warning = 'Advisory: add --landing with one capability sentence a day-one PM could read, with the result in plain words and no flags or identifiers.';
+  console.error(warning);
+  return warning;
+}
+
 function numericFlag(args, name) {
   const value = flag(args, name);
   if (value === null || value === true || value === undefined) return null;
@@ -597,18 +631,19 @@ function buildPendingReviewChatPredicate(taskDb, db, workspaceRoot) {
 function createReviewNextTask(taskDb, db, currentTask, title) {
   const nextTitle = String(title || '').trim();
   if (!nextTitle) return null;
+  const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(nextTitle);
   const currentMetadata = currentTask && currentTask.metadata && typeof currentTask.metadata === 'object'
     ? currentTask.metadata
     : {};
   const existing = findExistingReviewNextTask(taskDb, db, currentTask, nextTitle);
-  if (existing) return { id: existing.id, inserted: false };
+  if (existing) return { id: existing.id, inserted: false, operator_title_warning: operatorTitleWarning };
   const goalId = currentMetadata.goal_id || currentMetadata.goalId || null;
   const parentId = currentTask && currentTask.id || null;
   const sourceKey = parentId && typeof taskDb.sourceKey === 'function'
     ? taskDb.sourceKey(`task_review_next:${parentId}`, nextTitle)
     : null;
   try {
-    return taskDb.addTask(db, {
+    const created = taskDb.addTask(db, {
       title: nextTitle,
       tag: currentTask && currentTask.tag || null,
       workspaceRoot: taskDb.workspaceRoot(),
@@ -619,10 +654,11 @@ function createReviewNextTask(taskDb, db, currentTask, title) {
         source: 'task_review_next',
       },
     });
+    return { ...created, operator_title_warning: operatorTitleWarning };
   } catch (error) {
     if (sourceKey && /constraint|unique/i.test(String(error && (error.code || error.message) || error))) {
       const racedExisting = findExistingReviewNextTask(taskDb, db, currentTask, nextTitle);
-      if (racedExisting) return { id: racedExisting.id, inserted: false };
+      if (racedExisting) return { id: racedExisting.id, inserted: false, operator_title_warning: operatorTitleWarning };
     }
     throw error;
   }
@@ -4885,6 +4921,7 @@ function cmdAdd(args) {
   const taskDb = getTaskDb();
   const db = taskDb.open();
   const ws = taskDb.workspaceRoot();
+  const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(title);
   // Generation throttle — the named root cause is generation > human-review rate. An AGENT cannot keep
   // minting tasks while a wall of certified-but-unaccepted work waits; that treadmill is what accept-group
   // only drains. Humans and --force bypass. Closes the tap instead of just enlarging the bucket.
@@ -4910,6 +4947,7 @@ function cmdAdd(args) {
       action: 'created',
       task_id: result.id,
       inserted: result.inserted !== false,
+      operator_title_warning: operatorTitleWarning,
       projection_path: outPath,
       task,
     });
@@ -4952,6 +4990,7 @@ function cmdDelegate(args) {
   const taskDb = getTaskDb();
   const db = taskDb.open();
   const ws = taskDb.workspaceRoot();
+  const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(title);
   const ownerResolution = resolveFunctionalTaskOwner({
     requestedOwner: requestedOwner && requestedOwner !== true ? requestedOwner : null,
     title,
@@ -5007,6 +5046,7 @@ function cmdDelegate(args) {
       executed_by: executedBy || null,
       via,
       handoff,
+      operator_title_warning: operatorTitleWarning,
       projection_path: outPath,
       task,
     });
@@ -5271,6 +5311,7 @@ function buildEndgameTaskSeed({ slug, horizon, owner }) {
 
 function createEndgameSeedTask(taskDb, db, seed, owner) {
   const taskOwner = String(owner || DEFAULT_OWNER);
+  const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(seed.title);
   const result = taskDb.addTask(db, {
     title: seed.title,
     tag: seed.tag,
@@ -5294,6 +5335,7 @@ function createEndgameSeedTask(taskDb, db, seed, owner) {
     ok: true,
     task_id: result.id,
     inserted: result.inserted !== false,
+    operator_title_warning: operatorTitleWarning,
     note_version: note.event.version,
   };
 }
@@ -5367,6 +5409,7 @@ function cmdNext(args) {
             handoff,
             next_agent_action: nextAgentAction,
             note_version: created.note_version,
+            operator_title_warning: created.operator_title_warning || null,
             task: createdTask,
             review_task: reviewTask,
           });
@@ -5445,6 +5488,9 @@ function cmdNext(args) {
   }
   console.log(`next ${taskRef(compactTaskFromProjection(projection, open[0].id))} @${owner}`);
   console.log(open[0].title);
+  const ref = taskRef(compactTaskFromProjection(projection, open[0].id));
+  const { printOperatorNext } = require('../lib/operator-next');
+  printOperatorNext(`atris task step ${ref}`);
 }
 
 function continueWorkForReviewTask(taskDb, db, taskId, { owner = DEFAULT_OWNER } = {}) {
@@ -5488,6 +5534,7 @@ function continueWorkForReviewTask(taskDb, db, taskId, { owner = DEFAULT_OWNER }
     parent_task_id: taskId,
     next_task_id: nextCreated ? nextCreated.id : null,
     created: Boolean(nextCreated && nextCreated.inserted !== false),
+    operator_title_warning: nextCreated ? nextCreated.operator_title_warning || null : null,
     owner: String(owner || DEFAULT_OWNER),
     projection_path: outPath,
     parent,
@@ -7549,6 +7596,7 @@ function cmdFinish(args) {
   const currentTask = taskDb.getTask(db, taskId);
   const actor = String(flag(args, '--as') || DEFAULT_OWNER);
   const proof = proofFlagValue(args);
+  const landing = landingFlags(args);
   const failed = hasFlag(args, '--failed');
   const hasReview = hasFlag(args, '--review') || flag(args, '--lesson') || flag(args, '--next') || flag(args, '--proof') || flag(args, '--reward');
   if (agentProofOnlyMode() && !failed) {
@@ -7585,6 +7633,7 @@ function cmdFinish(args) {
     process.exit(1);
   }
   if (hasReview) {
+    const landingAdvisory = !failed ? warnIfLandingNeedsDayOnePm(landing, currentTask && currentTask.title) : null;
     const result = taskDb.reviewTask(db, {
       id: taskId,
       actor,
@@ -7593,6 +7642,7 @@ function cmdFinish(args) {
       nextTask: typeof flag(args, '--next') === 'string' ? flag(args, '--next') : '',
       proof,
       careerXpEligible: false,
+      landing,
     });
     const nextCreated = createNextTaskIfRequested(taskDb, db, args, currentTask, result.episode.next_task_suggestion);
     const xpProjection = refreshCareerXpAfterReview(result);
@@ -7606,6 +7656,7 @@ function cmdFinish(args) {
         reward: result.episode.reward.value,
         episode: result.episode,
         xp_projection: xpProjection,
+        landing_advisory: landingAdvisory,
         next_task_id: nextCreated ? nextCreated.id : null,
         projection_path: outPath,
         task: compactTaskFromProjection(projection, taskId),
@@ -7700,6 +7751,7 @@ function cmdReady(args) {
     console.error(`ready failed: ${result.reason}`);
     process.exit(1);
   }
+  const landingAdvisory = warnIfLandingNeedsDayOnePm(landing, result.row && result.row.title);
   const { projection, outPath } = writeDefaultProjection(taskDb, db);
   const agentCertified = result.event.payload.agent_certified === true;
   const projectionTask = taskFromProjection(projection, taskId)
@@ -7741,6 +7793,7 @@ function cmdReady(args) {
       agent_certified: agentCertified,
       handoff,
       result_trace: resultTrace,
+      landing_advisory: landingAdvisory,
       ...(nextTaskInput.ignored ? { review_next_task_ignored: nextTaskInput.ignored } : {}),
       projection_path: outPath,
       task: compactTaskFromProjection(projection, taskId),
@@ -7909,6 +7962,151 @@ function acceptReviewTask(taskDb, db, taskId, { actor, proof, reward, lesson = '
   return { ok: true, reviewed };
 }
 
+// Second-actor certification for proof-backed Review rows whose proof names a
+// runnable, allowlisted check. Re-running that check as a distinct actor IS
+// the independent verification the certification gate asks for — the row
+// becomes certified and autoland can land it on the same heartbeat. Rows in
+// denied lanes, without a runnable check, or already certified keep their
+// existing paths (review chats, human accept).
+function certifyVerifyCandidate(task) {
+  const metadata = task.metadata || {};
+  const review = task.review || {};
+  const recorded = typeof metadata.verify === 'string' && metadata.verify.trim() ? [metadata.verify.trim()] : [];
+  const proof = String(review.proof || metadata.latest_agent_proof || '');
+  for (const raw of [...recorded, ...taskReviewEvidenceCommands(proof)]) {
+    // The evidence extractor can keep trailing prose ("git diff --check. Evidence
+    // inspected: ..."); try the full clause, then the first sentence of it.
+    for (const candidate of [raw, raw.split(/\.(?:\s|$)/)[0]].map((c) => String(c || '').trim())) {
+      if (candidate && parseVerifyCommand(candidate).ok) return candidate;
+    }
+  }
+  return null;
+}
+
+function stampCertifyVerifyMetadata(taskDb, db, taskId, actor, verify) {
+  const row = taskDb.getTask(db, taskId);
+  if (!row) return;
+  const metadata = row.metadata && typeof row.metadata === 'object' ? { ...row.metadata } : {};
+  metadata.verify = metadata.verify || verify;
+  metadata.certified_verified_at = new Date().toISOString();
+  metadata.certified_verified_by = actor;
+  db.prepare(`
+    UPDATE tasks
+       SET metadata = ?,
+           updated_at = ?
+     WHERE id = ?
+  `).run(JSON.stringify(metadata), Date.now(), taskId);
+}
+
+function cmdCertifyVerified(args) {
+  const dryRun = hasFlag(args, '--dry-run');
+  const asJson = wantsJson(args);
+  const actor = String(flag(args, '--as') || 'autoland-verifier');
+  const limitRaw = flag(args, '--limit');
+  const max = limitRaw && limitRaw !== true ? Math.max(1, Number(limitRaw) || 6) : 6;
+
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const { projection } = writeDefaultProjection(taskDb, db);
+  const candidates = (projection.tasks || [])
+    .filter((t) => t && t.status === 'review')
+    .sort((a, b) => Number(b.updated_at || 0) - Number(a.updated_at || 0))
+    .slice(0, max);
+  const results = [];
+  for (const item of candidates) {
+    const fullProjection = enrichTaskProjection(taskDb.taskProjection(db, { taskId: item.id }));
+    const task = fullProjection.tasks[0] || null;
+    if (!task) {
+      results.push({ ref: item.display_id || item.id, action: 'skipped', reason: 'task_not_found' });
+      continue;
+    }
+    const ref = task.display_id || task.legacy_ref || task.id;
+    const metadata = task.metadata || {};
+    const review = task.review || {};
+    if (task.status !== 'review') {
+      results.push({ ref, action: 'skipped', reason: 'not_in_review' });
+      continue;
+    }
+    const approval = String(review.approval_status || metadata.approval_status || 'pending').toLowerCase();
+    if (approval !== 'pending') {
+      results.push({ ref, action: 'skipped', reason: `approval_${approval}` });
+      continue;
+    }
+    const tag = String(task.tag || '').toLowerCase();
+    if (DENIED_TAGS.has(tag)) {
+      results.push({ ref, action: 'skipped', reason: `denied_tag_${tag}` });
+      continue;
+    }
+    // Skip only rows the accept lane can already land, or rows blocked by
+    // something an executed second-actor check cannot cure. A row with two
+    // passes from ONE actor is exactly what this command exists to cure —
+    // "certified" alone is not landable.
+    const evaluation = evaluateAutoAccept(task, { strictVerify: false });
+    if (evaluation.eligible) {
+      results.push({ ref, action: 'skipped', reason: 'already_landable' });
+      continue;
+    }
+    const curable = ['not_agent_certified', 'needs_second_reviewer_or_third_pass', 'insufficient_review_passes'];
+    if (!curable.includes(evaluation.reason)) {
+      results.push({ ref, action: 'skipped', reason: evaluation.reason });
+      continue;
+    }
+    const verify = certifyVerifyCandidate(task);
+    if (!verify) {
+      results.push({ ref, action: 'skipped', reason: 'no_runnable_check_in_proof' });
+      continue;
+    }
+    if (dryRun) {
+      results.push({ ref, action: 'would_certify', verify });
+      continue;
+    }
+    const run = runVerifyCommand(verify, task.workspace_root || process.cwd());
+    if (!run.ok) {
+      results.push({ ref, action: 'verify_failed', reason: run.reason, verify });
+      continue;
+    }
+    const builderProof = String(review.proof || metadata.latest_agent_proof || '').slice(0, 200);
+    const readied = taskDb.readyTask(db, {
+      id: task.id,
+      actor,
+      proof: `Second-actor check: \`${verify}\` re-run by ${actor}, exited 0. Builder proof inspected: ${builderProof}`,
+      lesson: '',
+      nextTask: '',
+    });
+    if (!readied.ready) {
+      results.push({ ref, action: 'certify_failed', reason: readied.reason, verify });
+      continue;
+    }
+    stampCertifyVerifyMetadata(taskDb, db, task.id, actor, verify);
+    const certifiedNow = readied.event?.payload?.agent_certified === true;
+    results.push({ ref, action: certifiedNow ? 'certified' : 'pass_recorded', verify });
+  }
+  const { outPath } = writeDefaultProjection(taskDb, db);
+  const certified = results.filter((r) => r.action === 'certified').length;
+  const payload = {
+    ok: true,
+    action: dryRun ? 'certify_verified_dry_run' : 'certify_verified',
+    actor,
+    certified,
+    would_certify: results.filter((r) => r.action === 'would_certify').length,
+    skipped: results.filter((r) => r.action === 'skipped').length,
+    failed: results.filter((r) => r.action === 'verify_failed' || r.action === 'certify_failed').length,
+    results,
+    projection_path: outPath,
+  };
+  if (asJson) {
+    console.log(JSON.stringify(payload, null, 2));
+  } else if (results.length === 0) {
+    console.log('certify-verified: no review rows to consider.');
+  } else {
+    for (const r of results) {
+      console.log(`${r.action.padEnd(14)} ${r.ref}${r.verify ? `  \`${r.verify}\`` : ''}${r.reason ? `  (${r.reason})` : ''}`);
+    }
+    console.log(`certified ${certified}; humans keep denied lanes and rows without a runnable check.`);
+  }
+  return payload;
+}
+
 function cmdAutoAcceptCertified(args) {
   const dryRun = hasFlag(args, '--dry-run');
   const strictVerify = hasFlag(args, '--strict-verify');
@@ -9256,13 +9454,14 @@ async function handleTaskApi(req, res, taskDb, db) {
     const body = await readJsonBody(req);
     const title = String(body.title || '').trim();
     if (!title) return sendJson(res, 400, { ok: false, reason: 'missing_title', detail: 'title required' });
+    const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(title);
     const result = taskDb.addTask(db, {
       title,
       tag: body.tag ? String(body.tag) : 'tasks',
       workspaceRoot: taskDb.workspaceRoot(),
     });
     const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'created', task_id: result.id, projection_path: outPath, task: taskFromProjection(projection, result.id) });
+    return sendJson(res, 200, { ok: true, action: 'created', task_id: result.id, operator_title_warning: operatorTitleWarning, projection_path: outPath, task: taskFromProjection(projection, result.id) });
   }
   if (req.method === 'POST' && url.pathname === '/api/tasks/clear-plan') {
     const body = await readJsonBody(req);
@@ -9769,6 +9968,8 @@ async function run(args) {
     case 'auto-accept-certified':
     case 'auto-accept':
       return cmdAutoAcceptCertified(rest);
+    case 'certify-verified':
+      return cmdCertifyVerified(rest);
     case 'accept-group':
       return cmdAcceptGroup(rest);
     case 'revise': return cmdRevise(rest);

package/commands/truth.js

@@ -38,7 +38,8 @@ function loadMissions(cwd) {
       if (id) seen.set(id, rec);
     } catch { /* skip bad lines */ }
   }
-  return [...seen.values()].filter((m) => m.status && m.status !== 'complete' && m.status !== 'archived');
+  // stopped = killed-on-purpose = a closed loop; only genuinely open states count
+  return [...seen.values()].filter((m) => m.status && !['complete', 'archived', 'stopped'].includes(m.status));
 }
 
 function loadTaskCounts() {