fullstackgtm 0.48.0 → 0.50.0

package/dist/cli/help.js

@@ -176,9 +176,10 @@ Usage:
   fullstackgtm suggest --plan-id <id> | --plan <path>  [source options] [--json] [--out <path>]
                                                derive values for requires_human_* placeholders
                                                from snapshot evidence, with confidence + reasons
-  fullstackgtm plans list [--status <s>] | show <id> | reject <id>
+  fullstackgtm plans list [--status <s>] | show <id> | sync | reject <id>
   fullstackgtm plans approve <id> --operations <ids|all> [--value <opId>=<v>]
   fullstackgtm plans approve <id> --values-from <suggestions.json> [--min-confidence high|low] [--include-creates]
+  fullstackgtm plans recover <id> --acknowledge-uncertain-writes
   fullstackgtm apply --plan-id <id> --provider <name>
   fullstackgtm apply --plan-id <id> --channel outbox          (render approved openers; transmits nothing)
   fullstackgtm apply --plan <path> --provider <name> --approve <ids|all> [options]
@@ -199,7 +200,11 @@ Profiles (multi-organization use):
 Plan lifecycle:
   audit --save persists the dry-run plan to ~/.fullstackgtm/plans. Approve
   specific operations (optionally with --value <opId>=<v> for placeholders),
-  then apply by id — the store enforces approval and records every run.
+  then apply by id — the store enforces approval and records every run. When
+  paired, local and hosted are replicas of the same immutable plan: either
+  capable surface may approve or apply, and each CLI check-in imports missing
+  approvals and exact operation receipts. Use \`plans sync\` for an explicit
+  check-in; offline changes reconcile later without blocking local work.
 
 Authentication (checked in order):
   1. --token-env <name>        explicit env var for this invocation (hubspot)
@@ -226,6 +231,8 @@ Audit options:
   --config <path>        Config file (default: ./fullstackgtm.config.json if present)
                          { "policy": {...}, "rules": {"enabled":[],"disabled":[]},
                            "rulePackages": ["./team-rules.mjs"] }
+  --allow-plugins        Execute rulePackages from an explicit --config path after review
+  --no-plugins           Ignore rulePackages; use declarative config and built-in rules only
   --rules <ids>          Comma-separated rule ids to run (default: all; see \`rules\`)
   --json                 Print the JSON patch plan instead of markdown
   --out <path>           Also write the JSON patch plan to a file
@@ -492,14 +499,15 @@ export const HELP = {
         seeAlso: ["audit", "plans", "apply"],
     },
     plans: {
-        summary: "plan lifecycle: list / show / approve / reject saved plans",
+        summary: "replicated plan lifecycle: list / show / sync / approve / reject",
         phase: "Govern",
         synopsis: [
-            "fullstackgtm plans list [--status <s>] | show <id> | reject <id>",
+            "fullstackgtm plans list [--status <s>] | show <id> | sync | reject <id>",
             "fullstackgtm plans approve <id> --operations <ids|all> [--value <opId>=<v>]",
             "fullstackgtm plans approve <id> --values-from <suggestions.json> [--min-confidence high|low]",
+            "fullstackgtm plans recover <id> --acknowledge-uncertain-writes",
         ],
-        detail: "Approval is explicit and per-operation; placeholders need a concrete --value or a suggestion to be approvable.",
+        detail: "Approval is explicit and per-operation; placeholders need a concrete --value or a suggestion to be approvable. When paired, hosted and CLI are eventually consistent replicas of one immutable plan. `plans sync` explicitly exchanges approval revisions, execution state, and exact per-operation receipts; ordinary plan commands also check in best-effort. Either surface may apply when its CRM connector supports the selected operations.",
         seeAlso: ["audit", "suggest", "apply"],
     },
     apply: {
@@ -510,7 +518,7 @@ export const HELP = {
             "fullstackgtm apply --plan-id <id> --channel outbox   (render approved drafted openers to the outbox; transmits nothing)",
             "fullstackgtm apply --plan <path> --provider <name> --approve <ids|all> [--value <opId>=<v>]",
         ],
-        detail: "The only verb that mutates a CRM. Writes only operations approved via `plans approve` or `--approve`, with compare-and-set and readback. Never writes requires_human_* placeholders without a --value override.",
+        detail: "The CLI CRM-write verb. Writes only operations approved locally or imported from the shared hosted replica, with an online execution claim when available, stable operation ids, compare-and-set, resolve-before-create, and readback. Hosted may execute the same synchronized plan when it has a compatible CRM connection; its exact operation receipts are imported on the next CLI check-in. Never writes requires_human_* placeholders without a --value override.",
         seeAlso: ["plans", "suggest", "audit-log"],
     },
     "audit-log": {
@@ -585,11 +593,11 @@ export const HELP = {
 };
 // Verbs that print their own richer multi-subcommand help; runCli routes their
 // `--help` to themselves, so commandHelp() only renders these via `help <verb>`.
-export const BESPOKE_HELP = ["init", "call", "market", "tam", "enrich", "bulk-update", "schedule", "signals", "icp", "draft"];
+export const BESPOKE_HELP = ["init", "call", "market", "tam", "enrich", "schedule", "signals", "icp", "draft"];
 export const GLOBAL_FLAGS = ["--help", "--full"];
 export const GLOBAL_SHORT_FLAGS = ["-h"];
 export const SOURCE_FLAGS = ["--provider", "--token-env", "--input", "--demo", "--sample", "--seed", "--today"];
-export const AUDIT_FLAGS = ["--config", "--rules", "--stale-days", "--fail-on", "--save", "--dry-run", "--json", "--out", "--full"];
+export const AUDIT_FLAGS = ["--config", "--allow-plugins", "--no-plugins", "--rules", "--stale-days", "--fail-on", "--save", "--dry-run", "--json", "--out", "--full"];
 // Complete per-command flag registry used by runCli's fail-closed flag
 // validation. Keep this next to HELP so focused help, machine capabilities,
 // and the parser safety gate have one command inventory to reconcile against.
@@ -605,21 +613,21 @@ export const COMMAND_FLAGS = {
     snapshot: [...SOURCE_FLAGS, "--since", "--out", "--archive"],
     audit: [...SOURCE_FLAGS, ...AUDIT_FLAGS],
     report: [...SOURCE_FLAGS, ...AUDIT_FLAGS, "--plan", "--client", "--title", "--prepared-by", "--format", "--max-examples"],
-    diff: ["--before", "--after", "--config", "--stale-days", "--today", "--json", "--fail-on-new-findings"],
-    rules: ["--config", "--json"],
+    diff: ["--before", "--after", "--config", "--allow-plugins", "--no-plugins", "--stale-days", "--today", "--json", "--fail-on-new-findings"],
+    rules: ["--config", "--allow-plugins", "--no-plugins", "--json"],
     resolve: [...SOURCE_FLAGS, "--name", "--domain", "--email", "--account-id", "--json"],
     hierarchy: [...SOURCE_FLAGS, "--json", "--out"],
     relationships: [...SOURCE_FLAGS, "--account-id", "--domain", "--json", "--out"],
     route: [...SOURCE_FLAGS, "--match", "--no-inherit-owner", "--reassign-owned", "--policy", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
-    fix: [...SOURCE_FLAGS, "--config", "--rule", "--provider", "--min-confidence", "--include-creates", "--yes", "--confirm", "--dry-run"],
+    fix: [...SOURCE_FLAGS, "--config", "--allow-plugins", "--no-plugins", "--rule", "--provider", "--min-confidence", "--include-creates", "--yes", "--confirm", "--dry-run"],
     "bulk-update": [...SOURCE_FLAGS, "--where", "--set", "--guard", "--require", "--create-task", "--archive", "--force-archive-duplicates", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
     dedupe: [...SOURCE_FLAGS, "--key", "--keep", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
     reassign: [...SOURCE_FLAGS, "--from", "--assign-unowned", "--to", "--objects", "--where", "--except-deal-stage", "--include-closed-deals", "--reason", "--max-operations", "--save", "--dry-run", "--json", "--out"],
     backfill: [...SOURCE_FLAGS, "--since", "--pipeline", "--match-property", "--skip-unmatched", "--save", "--dry-run", "--json"],
-    enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--stale-days", "--assign-owner", "--objects", "--max", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--json", "--out"],
+    enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--list", "--stale-days", "--assign-owner", "--objects", "--max", "--scan-limit", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--json", "--out"],
     call: [...SOURCE_FLAGS, "--transcript", "--title", "--source", "--model", "--deterministic", "--heuristics", "--llm", "--json", "--ndjson", "--out", "--call", "--call-type", "--rubric", "--list", "--list-rubrics", "--attendees", "--domain", "--deal", "--save", "--dry-run"],
     suggest: [...SOURCE_FLAGS, "--plan-id", "--plan", "--json", "--out"],
-    plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--json"],
+    plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--acknowledge-uncertain-writes", "--json"],
     apply: ["--plan", "--plan-id", "--provider", "--channel", "--token-env", "--approve", "--value", "--json", "--config"],
     "audit-log": ["--in", "--out", "--json"],
     merge: ["--input", "--out", "--json"],
@@ -628,10 +636,10 @@ export const COMMAND_FLAGS = {
     icp: [...SOURCE_FLAGS, "--name", "--signals-from", "--with-history", "--prompt", "--min-score", "--from-judge", "--golden", "--against-outcomes", "--min-accuracy", "--model", "--label", "--save", "--json", "--out"],
     signals: ["--bucket", "--source", "--connector", "--connector-opt", "--watchlist", "--keywords", "--from", "--label", "--since", "--account", "--contact", "--unjudged", "--touch", "--result", "--save", "--json", "--explain"],
     draft: ["--from-judge", "--min-score", "--prompt", "--model", "--channel", "--save", "--dry-run", "--json", "--out"],
-    schedule: ["--cron", "--label", "--provider", "--trigger", "--runs", "--json"],
+    schedule: ["--cron", "--label", "--provider", "--trigger", "--timer", "--runs", "--json"],
 };
 export const FLAGS_WITH_VALUES = new Set([
-    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--login-url", "--match", "--match-property", "--max", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
+    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
 ]);
 // Lifecycle-grouped front door. One line per verb, organized by the
 // Prevent→Detect→Remediate→Verify loop so a new user sees ~6 jobs, not 22 verbs.

package/dist/cli/market.js

@@ -2,7 +2,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createFilePlanStore } from "../planStore.js";
-import { captureMarket, computeFrontStates, createFileObservationStore, diffFrontStates, loadCaptureTexts, loadMarketConfig, starterMarketConfig, validateObservationSet, verifyEvidenceSpans } from "../market.js";
+import { captureMarket, computeFrontStates, createFileObservationStore, diffFrontStates, loadCaptureTexts, loadMarketConfig, observationId, starterMarketConfig, validateObservationSet, verifyEvidenceSpans } from "../market.js";
 import { assessAxes, axesReportToText } from "../marketAxes.js";
 import { computeDirectives, computeOverlayStats, directivesToPlan, overlayToMarkdown } from "../marketOverlay.js";
 import { computeScaleIndex, scaleReportToText } from "../marketScale.js";
@@ -24,6 +24,7 @@ import { unknownSubcommandError } from "./suggest.js";
  */
 const MARKET_SUBCOMMANDS = [
     "init", "capture", "classify", "worksheet", "observe", "fronts", "axes", "overlay", "scale", "report", "refresh",
+    "schema", "hints", "observe-template", "review",
 ];
 export async function marketCommand(args) {
     const [subcommand, ...rest] = args;
@@ -35,9 +36,13 @@ export async function marketCommand(args) {
 market init --category <name> [--out <path>]   write a starter market.config.json
 market init --category <name> --auto --vendor <url> [--vendor <url>...] [--anchor <url>] [--max-claims n]
                                                LLM-propose vendors + claim taxonomy from seed pages (needs an API key)
+market schema                                  print exact MarketConfig + ObservationSet shapes and a tiny example
 market capture [--config <path>] [--run <label>]
 market classify [--run <label>] [--capture-run <label>] [--vendor <id>] [--model m] [--out <path>]
 market worksheet --vendor <id> [--capture-run <label>] [--out <path>]
+market hints [--vendor <id>] [--capture-run <label>] [--json]
+market observe-template [--run <label>] [--out <path>]
+market review --from <observations.json> [--json]
 market observe --from <observations.json|sets.jsonl|spool-dir> [--unverified]
 market fronts [--config <path>] [--run <label>] [--diff <prior-run>] [--json]
 market axes [--config <path>] [--run <label>] [--json]
@@ -78,6 +83,63 @@ one client's category intel never bleeds into another's). Front states are
 recomputed deterministically on every invocation — never stored.`);
         return;
     }
+    if (subcommand === "schema") {
+        console.log(`MarketConfig shape:
+{
+  "category": "string",
+  "anchorVendor": "optional vendor id",
+  "vendors": [{
+    "id": "stable-vendor-id",
+    "name": "Vendor Name",
+    "urls": { "home": "https://...", "pricing": null, "product": ["https://..."] },
+    "aliases": ["optional alternate names"]
+  }],
+  "claims": [{
+    "id": "stable-claim-id",
+    "capability": "Specific differentiating capability",
+    "icp": "buyer/segment this claim matters to",
+    "pricingStructure": "pricing motion implied by the claim, or unknown",
+    "definition": "How to judge LOUD vs QUIET vs ABSENT from page text",
+    "terms": ["buyer/search terms for deterministic mention matching"]
+  }],
+  "surfaceRule": "LOUD = hero/primary positioning; QUIET = supported but secondary; ABSENT = no support; UNOBSERVABLE = no usable capture."
+}
+
+ObservationSet shape:
+{
+  "id": "set_run1",
+  "category": "same category as config",
+  "runLabel": "run-1",
+  "runAt": "2026-06-11T00:00:00.000Z",
+  "extractor": "manual|agent:<model>|llm:<provider>:<model>",
+  "observations": [{
+    "id": "stable observation id (any unique string is accepted)",
+    "vendorId": "vendor id from config",
+    "claimId": "claim id from config",
+    "observedAt": "2026-06-11",
+    "intensity": "loud|quiet|absent|unobservable",
+    "confidence": "high|medium|low",
+    "reason": "one reviewer-facing sentence",
+    "evidence": [{
+      "id": "ev1",
+      "sourceSystem": "web",
+      "sourceObjectType": "page",
+      "sourceObjectId": "source URL",
+      "text": "VERBATIM quote from captured page text",
+      "metadata": { "url": "source URL", "captureHash": "hash from worksheet" }
+    }]
+  }]
+}
+
+Rules:
+- exactly one observation per vendor × claim cell
+- loud/quiet require ≥1 verbatim evidence quote
+- absent/unobservable use [] evidence
+- unobservable means no usable captured page exists for the vendor; if pages were captured but the claim is unsupported, use absent
+- submit with: fullstackgtm market observe --from observations.json
+- derive outputs with: fullstackgtm market fronts --json; fullstackgtm market report --format md --out market-report.md`);
+        return;
+    }
     if (subcommand === "init") {
         const category = option(rest, "--category");
         if (!category)
@@ -148,7 +210,20 @@ recomputed deterministically on every invocation — never stored.`);
                 return;
             }
             if (!rest.includes("--unverified")) {
-                const { textByHash } = loadCaptureTexts(config.category);
+                const { entries, textByHash } = loadCaptureTexts(config.category);
+                const usableVendorIds = new Set(entries
+                    .filter((entry) => entry.runLabel === set.runLabel && entry.captureHash && textByHash.has(entry.captureHash))
+                    .map((entry) => entry.vendorId));
+                const unsupportedUnobservable = set.observations.filter((obs) => obs.intensity === "unobservable" && usableVendorIds.has(obs.vendorId));
+                if (unsupportedUnobservable.length > 0) {
+                    console.error(`Rejected: ${unsupportedUnobservable.length} unobservable reading(s) for vendors with usable captures`);
+                    for (const obs of unsupportedUnobservable.slice(0, 20)) {
+                        console.error(`  - ${obs.vendorId} × ${obs.claimId}: vendor has captured page text; unsupported claims should be absent, not unobservable`);
+                    }
+                    console.error("Use unobservable only when no usable captured page exists for that vendor/run. (--unverified skips this gate when captures genuinely live elsewhere.)");
+                    process.exitCode = 1;
+                    return;
+                }
                 const failures = verifyEvidenceSpans(set.observations, textByHash);
                 if (failures.length > 0) {
                     console.error(`Rejected: ${failures.length} evidence span(s) failed verification against the stored captures`);
@@ -181,6 +256,109 @@ recomputed deterministically on every invocation — never stored.`);
         }
         return;
     }
+    if (subcommand === "hints") {
+        const vendorFilter = option(rest, "--vendor");
+        const vendorIds = vendorFilter ? [vendorFilter] : config.vendors.map((vendor) => vendor.id);
+        const worksheets = vendorIds.map((vendorId) => buildWorksheet(config, vendorId, { captureRun: option(rest, "--capture-run") ?? undefined }));
+        if (rest.includes("--json")) {
+            console.log(JSON.stringify({
+                category: config.category,
+                captureRun: worksheets[0]?.captureRun ?? null,
+                vendors: worksheets.map((worksheet) => ({ vendor: worksheet.vendor, claimHints: worksheet.claimHints })),
+            }, null, 2));
+            return;
+        }
+        for (const worksheet of worksheets) {
+            console.log(`\n## ${worksheet.vendor.id} — ${worksheet.vendor.name}`);
+            if (worksheet.pages.length === 0) {
+                console.log("No usable captures: classify every claim as unobservable.");
+                continue;
+            }
+            for (const hint of worksheet.claimHints) {
+                console.log(`\n${hint.claimId}`);
+                if (hint.matches.length === 0) {
+                    console.log("  no lexical matches in captured text (usually absent; still inspect pages for synonyms)");
+                    continue;
+                }
+                for (const match of hint.matches)
+                    console.log(`  - ${match.term} @ ${match.url}: ${match.quote}`);
+            }
+        }
+        return;
+    }
+    if (subcommand === "observe-template") {
+        const runLabel = option(rest, "--run") ?? "run-1";
+        const now = new Date().toISOString();
+        const observations = config.vendors.flatMap((vendor) => {
+            const worksheet = buildWorksheet(config, vendor.id, { captureRun: runLabel });
+            const noPages = worksheet.pages.length === 0;
+            return config.claims.map((claim) => ({
+                id: observationId(config.category, runLabel, vendor.id, claim.id),
+                vendorId: vendor.id,
+                claimId: claim.id,
+                observedAt: now.slice(0, 10),
+                intensity: noPages ? "unobservable" : "absent",
+                confidence: "low",
+                reason: noPages ? `No usable captures for ${vendor.name}; cannot judge.` : "TODO: inspect worksheet/hints and classify this cell.",
+                evidence: [],
+                _claimHints: worksheet.claimHints.find((hint) => hint.claimId === claim.id)?.matches ?? [],
+            }));
+        });
+        const set = { id: `set_${runLabel}`, category: config.category, runLabel, runAt: now, extractor: "manual-template", observations };
+        const payload = `${JSON.stringify(set, null, 2)}\n`;
+        const outPath = option(rest, "--out");
+        if (outPath) {
+            writeFileSync(resolve(process.cwd(), outPath), payload);
+            console.log(`Wrote ${outPath}: ${observations.length} template observations. Fill TODO cells, then run market review --from ${outPath}`);
+        }
+        else {
+            console.log(payload);
+        }
+        return;
+    }
+    if (subcommand === "review") {
+        const fromPath = option(rest, "--from");
+        if (!fromPath)
+            throw new Error("market review requires --from <observations.json>");
+        const set = JSON.parse(readFileSync(resolve(process.cwd(), fromPath), "utf8"));
+        const errors = validateObservationSet(config, set).map((detail) => ({ code: "invalid_observation_set", detail }));
+        const warnings = [];
+        const { entries, textByHash } = loadCaptureTexts(config.category);
+        const usableVendorIds = new Set(entries
+            .filter((entry) => entry.runLabel === set.runLabel && entry.captureHash && textByHash.has(entry.captureHash))
+            .map((entry) => entry.vendorId));
+        for (const obs of set.observations) {
+            if (obs.intensity === "unobservable" && usableVendorIds.has(obs.vendorId)) {
+                errors.push({ code: "unobservable_with_captures", detail: `${obs.vendorId} × ${obs.claimId}: vendor has captured page text; use absent when unsupported.` });
+            }
+            if ((obs.intensity === "absent" || obs.intensity === "unobservable") && usableVendorIds.has(obs.vendorId)) {
+                const hints = buildWorksheet(config, obs.vendorId, { captureRun: set.runLabel }).claimHints.find((hint) => hint.claimId === obs.claimId)?.matches ?? [];
+                if (hints.length > 0) {
+                    warnings.push({
+                        code: "support_candidate_marked_absent",
+                        detail: `${obs.vendorId} × ${obs.claimId}: ${hints.length} candidate snippet(s) matched terms but cell is ${obs.intensity}; verify absent vs quiet. Example: ${hints[0].quote}`,
+                    });
+                }
+            }
+        }
+        for (const failure of verifyEvidenceSpans(set.observations, textByHash)) {
+            errors.push({ code: "bad_evidence", detail: `${failure.vendorId} × ${failure.claimId}: ${failure.problem}` });
+        }
+        const summary = { ok: errors.length === 0, errors, warnings };
+        if (rest.includes("--json")) {
+            console.log(JSON.stringify(summary, null, 2));
+        }
+        else {
+            console.log(`${summary.ok ? "OK" : "FAILED"}: ${errors.length} error(s), ${warnings.length} warning(s)`);
+            for (const err of errors.slice(0, 20))
+                console.log(`ERROR ${err.code}: ${err.detail}`);
+            for (const warn of warnings.slice(0, 20))
+                console.log(`WARN  ${warn.code}: ${warn.detail}`);
+        }
+        if (errors.length > 0)
+            process.exitCode = 1;
+        return;
+    }
     if (subcommand === "classify") {
         const credential = await requireLlmCredential("market classify");
         const vendorFilter = option(rest, "--vendor");

package/dist/cli/plans.js

@@ -2,7 +2,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.js";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.js";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.js";
 import { applyPatchPlan } from "../connector.js";
 import { diffFindings, diffSnapshots, diffToMarkdown } from "../diff.js";
 import { createChannelConnector } from "../connectors/outboxChannel.js";
@@ -14,6 +14,7 @@ import { createFilePlanStore } from "../planStore.js";
 import { ENRICH_CONFIG_FILE_NAME, loadEnrichConfig } from "../enrich.js";
 import { loadMeter, recordConsumption, remaining } from "../acquireMeter.js";
 import { progressReporter, reportCounts } from "../runReport.js";
+import { claimHostedPlanApply, reconcileHostedPatchPlan, releaseHostedPlanApply, reportHostedPlanLifecycle, uploadHostedPatchPlan } from "../hostedPatchPlan.js";
 import { APPLY_STAGES, composeListeners, createProgressEmitter } from "../progress.js";
 import { connectorFor, isOptionValue, numericOption, option, repeatedOption, selectedRules } from "./shared.js";
 import { colorEnabled, createProgressRenderer, paint, planStatusWord, stylizePlanMarkdown, table, truncateToWidth } from "./ui.js";
@@ -132,9 +133,20 @@ export async function apply(args) {
     let valueOverrides;
     const store = planId ? createFilePlanStore() : null;
     if (planId && store) {
-        const stored = await store.get(planId);
+        let stored = await store.get(planId);
         if (!stored)
             throw new Error(`No stored plan with id ${planId}.`);
+        const reconciliation = await reconcileHostedPatchPlan(store, stored);
+        if (reconciliation.status === "conflict")
+            throw new Error(`Refusing to apply plan ${planId}: ${reconciliation.reason}.`);
+        if (reconciliation.status === "updated") {
+            stored = reconciliation.stored;
+            console.error(`Synced hosted ${reconciliation.remoteStatus} state for ${planId}.`);
+        }
+        if (stored.status === "applied") {
+            console.log(`Plan ${planId} was already applied by another replica; imported its execution receipt. No provider writes were attempted.`);
+            return;
+        }
         if (stored.status !== "approved") {
             throw new Error(`Plan ${planId} is ${stored.status}; approve operations first with \`fullstackgtm plans approve ${planId} --operations <ids|all>\`.`);
         }
@@ -210,6 +222,46 @@ export async function apply(args) {
     // A channel (e.g. outbox) renders approved ops to a local artifact and
     // transmits nothing; a CRM provider writes records. Same governed apply path.
     const connector = channel ? createChannelConnector(channel) : await connectorFor(provider, args);
+    let applyClaimId;
+    let hostedApplyClaimId;
+    if (planId && store) {
+        const claimed = await store.claimApply(planId, { provider: provider ?? `channel:${channel}`, source: "cli" });
+        applyClaimId = claimed.claimId;
+        const hostedClaim = await claimHostedPlanApply(claimed.stored);
+        if (hostedClaim.status === "applied") {
+            await store.abortApplyPreflight(planId, claimed.claimId, "Another replica completed apply before provider I/O.");
+            const refreshed = await store.get(planId);
+            if (refreshed)
+                await reconcileHostedPatchPlan(store, refreshed);
+            console.log(`Plan ${planId} was already applied by another replica. No provider writes were attempted.`);
+            return;
+        }
+        if (hostedClaim.status === "conflict") {
+            await store.abortApplyPreflight(planId, claimed.claimId, `Hosted execution claim failed: ${hostedClaim.reason}`);
+            throw new Error(`Refusing to apply plan ${planId}: could not coordinate with its hosted replica (${hostedClaim.reason}).`);
+        }
+        if (hostedClaim.status === "unavailable") {
+            console.error(`Hosted replica is unavailable (${hostedClaim.reason}); continuing local-first. Resolve-before-create and provider conflict guards remain active, and the execution receipt will sync on a later check-in.`);
+        }
+        if (hostedClaim.status === "claimed") {
+            hostedApplyClaimId = hostedClaim.claimId;
+            await store.recordHostedClaim(planId, claimed.claimId, hostedClaim.claimId);
+        }
+        const claimedVerification = verifyApprovalDigests(claimed.stored.plan.operations, claimed.stored.approvedOperationIds, claimed.stored.valueOverrides, claimed.stored.approvalDigests);
+        if (!claimedVerification.ok) {
+            if (hostedApplyClaimId) {
+                const released = await releaseHostedPlanApply(claimed.stored, hostedApplyClaimId, "Approval integrity verification failed after claim and before provider I/O.");
+                if (released.status === "conflict" || released.status === "unavailable") {
+                    console.error(`Hosted apply claim may require recovery: ${released.reason}.`);
+                }
+            }
+            await store.abortApplyPreflight(planId, claimed.claimId, "Approval integrity verification failed after the claim and before provider I/O.");
+            throw new Error(`Refusing to apply plan ${planId}: approval changed while acquiring the apply claim.`);
+        }
+        plan = claimed.stored.plan;
+        approvedOperationIds = claimed.stored.approvedOperationIds;
+        valueOverrides = claimed.stored.valueOverrides;
+    }
     // Interactive terminals get a live apply board on stderr while the run
     // executes (preflight → operations → results, with a per-op safety ticker);
     // piped runs render nothing. Either way the emitter streams heartbeats to
@@ -224,11 +276,23 @@ export async function apply(args) {
             progress,
         });
     }
+    catch (error) {
+        // Once applyPatchPlan starts, an exception cannot prove that the provider
+        // performed no write. Keep the claim fail-closed for operator reconciliation.
+        if (planId && store && applyClaimId)
+            await store.markApplyUncertain(planId, applyClaimId);
+        throw error;
+    }
     finally {
         renderer.done();
     }
     if (planId && store) {
-        await store.recordRun(planId, run);
+        const recorded = await store.recordRun(planId, run, applyClaimId);
+        const durableHostedClaimId = recorded.applyAttempts?.find((attempt) => attempt.id === applyClaimId)?.hostedClaimId;
+        const mirrored = await reportHostedPlanLifecycle(recorded, { claimId: durableHostedClaimId ?? hostedApplyClaimId });
+        if (mirrored.status === "unavailable" || mirrored.status === "conflict") {
+            console.error(`Hosted plan status is stale: ${mirrored.reason}. Local apply history remains authoritative.`);
+        }
     }
     // Charge the acquire meter for the creates that actually landed.
     if (createOps.length > 0) {
@@ -272,8 +336,9 @@ export async function diffCommand(args) {
     }
     const before = JSON.parse(readFileSync(resolve(process.cwd(), beforePath), "utf8"));
     const after = JSON.parse(readFileSync(resolve(process.cwd(), afterPath), "utf8"));
-    const loaded = loadConfig(option(args, "--config") ?? undefined);
-    const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+    const explicitConfig = option(args, "--config") ?? undefined;
+    const loaded = loadConfig(explicitConfig);
+    const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
     const policy = mergePolicy(defaultPolicy(), loaded?.config);
     const today = option(args, "--today");
     if (today)
@@ -332,7 +397,14 @@ export async function plansCommand(args) {
     const [subcommand, ...rest] = args;
     if (subcommand === "list" || subcommand === undefined) {
         const status = option(rest, "--status");
-        const plans = await store.list(status ?? undefined);
+        let plans = await store.list(status ?? undefined);
+        const synced = await Promise.all(plans.map(async (stored) => {
+            const result = await reconcileHostedPatchPlan(store, stored);
+            if (result.status === "updated")
+                return result.stored;
+            return stored;
+        }));
+        plans = status ? synced.filter((stored) => stored.status === status) : synced;
         if (rest.includes("--json") || args.includes("--json")) {
             console.log(JSON.stringify(plans.map((stored) => ({
                 id: stored.plan.id,
@@ -386,9 +458,17 @@ export async function plansCommand(args) {
         const planId = rest.find((arg) => !arg.startsWith("--"));
         if (!planId)
             throw new Error("Usage: fullstackgtm plans show <planId>");
-        const stored = await store.get(planId);
+        let stored = await store.get(planId);
         if (!stored)
             throw new Error(`No stored plan with id ${planId}.`);
+        const reconciliation = await reconcileHostedPatchPlan(store, stored);
+        if (reconciliation.status === "updated") {
+            stored = reconciliation.stored;
+            console.error(`Synced hosted ${reconciliation.remoteStatus} state for ${planId}.`);
+        }
+        else if (reconciliation.status === "conflict") {
+            console.error(`Hosted sync conflict: ${reconciliation.reason}.`);
+        }
         if (rest.includes("--json")) {
             console.log(JSON.stringify(stored, null, 2));
             return;
@@ -397,6 +477,19 @@ export async function plansCommand(args) {
         console.log(`Status: ${planStatusWord(stored.status, showPaint)}`);
         console.log(`Approved operations: ${stored.approvedOperationIds.join(", ") || "none"}`);
         console.log(`Runs: ${stored.runs.length}`);
+        const mirror = await uploadHostedPatchPlan(stored);
+        if (mirror.status === "saved")
+            console.log(`Hosted review: ${mirror.state.url}`);
+        else if (mirror.status === "unavailable" || mirror.status === "conflict")
+            console.log(`Hosted review: sync pending (${mirror.reason})`);
+        if (stored.applyAttempts?.length) {
+            console.log("Apply attempts:");
+            for (const attempt of stored.applyAttempts) {
+                console.log(`  ${attempt.id}  ${attempt.status}  ${attempt.provider} via ${attempt.source}  ${attempt.claimedAt}`);
+                if (attempt.note)
+                    console.log(`    ${attempt.note}`);
+            }
+        }
         console.log("");
         console.log(stylizePlanMarkdown(patchPlanToMarkdown(stored.plan), showPaint));
         return;
@@ -441,6 +534,10 @@ export async function plansCommand(args) {
             ...fileOverrides,
             ...explicitOverrides,
         });
+        const mirror = await reportHostedPlanLifecycle(updated);
+        if (mirror.status === "unavailable" || mirror.status === "conflict") {
+            console.error(`Hosted plan status is stale: ${mirror.reason}. Local approval remains authoritative.`);
+        }
         console.log(`Approved ${updated.approvedOperationIds.length} operation(s) on ${planId}. Apply with \`fullstackgtm apply --plan-id ${planId} --provider <name>\`.`);
         return;
     }
@@ -448,9 +545,57 @@ export async function plansCommand(args) {
         const planId = rest.find((arg) => !arg.startsWith("--"));
         if (!planId)
             throw new Error("Usage: fullstackgtm plans reject <planId>");
-        await store.reject(planId);
+        const rejected = await store.reject(planId);
+        const mirror = await reportHostedPlanLifecycle(rejected);
+        if (mirror.status === "unavailable" || mirror.status === "conflict") {
+            console.error(`Hosted plan status is stale: ${mirror.reason}. Local rejection remains authoritative.`);
+        }
         console.log(`Rejected ${planId}.`);
         return;
     }
-    throw unknownSubcommandError("plans", subcommand, ["list", "show", "approve", "reject"]);
+    if (subcommand === "recover") {
+        const planId = rest.find((arg) => !arg.startsWith("--"));
+        if (!planId) {
+            throw new Error("Usage: fullstackgtm plans recover <planId> --acknowledge-uncertain-writes");
+        }
+        const stored = await store.get(planId);
+        if (!stored)
+            throw new Error(`No stored plan with id ${planId}.`);
+        if (stored.status !== "applying" || !stored.applyClaim) {
+            throw new Error(`Plan ${planId} has no unresolved apply attempt.`);
+        }
+        const attempt = stored.applyAttempts?.find((entry) => entry.id === stored.applyClaim?.id);
+        if (!rest.includes("--acknowledge-uncertain-writes")) {
+            throw new Error(`Plan ${planId} has an unresolved ${attempt?.provider ?? "provider"} apply attempt (${stored.applyClaim.id}). ` +
+                "Inspect the affected records in the provider; do not replay automatically. If you accept that some writes may already have landed, " +
+                `run \`fullstackgtm plans recover ${planId} --acknowledge-uncertain-writes\`. This clears every approval and requires a fresh review and approval before retrying.`);
+        }
+        await store.recoverApply(planId);
+        console.log(`Released ${planId} to needs_approval after acknowledging uncertain provider state. ` +
+            `No writes were replayed. Re-audit provider state, review the plan, then approve operations again before any apply.`);
+        return;
+    }
+    if (subcommand === "sync") {
+        const plans = await store.list();
+        let updated = 0;
+        const warnings = [];
+        for (const stored of plans) {
+            const result = await reconcileHostedPatchPlan(store, stored);
+            if (result.status === "updated")
+                updated += 1;
+            else if (result.status === "conflict" || result.status === "unavailable")
+                warnings.push(`${stored.plan.id}: ${result.reason}`);
+            if (stored.status === "applied") {
+                const hostedClaimId = [...(stored.applyAttempts ?? [])].reverse().find((attempt) => attempt.hostedClaimId)?.hostedClaimId;
+                const pushed = await reportHostedPlanLifecycle(stored, { claimId: hostedClaimId });
+                if (pushed.status === "conflict" || pushed.status === "unavailable")
+                    warnings.push(`${stored.plan.id} receipt: ${pushed.reason}`);
+            }
+        }
+        console.log(`Plan replicas synchronized: ${updated} updated, ${plans.length - updated} unchanged.`);
+        for (const warning of warnings)
+            console.error(`  ${warning}`);
+        return;
+    }
+    throw unknownSubcommandError("plans", subcommand, ["list", "show", "sync", "approve", "reject", "recover"]);
 }

package/dist/cli/shared.d.ts

@@ -23,7 +23,9 @@ export declare function saveRequested(args: string[]): boolean;
 export declare function confirmRequested(args: string[], ...legacyAliases: string[]): boolean;
 export declare function numericOption(args: string[], name: string): number | undefined;
 export declare function connectorFor(provider: string, args: string[], progress?: ProgressEmitter): Promise<GtmConnector>;
-export declare function readSnapshot(args: string[], progress?: ProgressEmitter): Promise<CanonicalGtmSnapshot>;
+export declare function readSnapshot(args: string[], progress?: ProgressEmitter, options?: {
+    persistProgress?: boolean;
+}): Promise<CanonicalGtmSnapshot>;
 /**
  * Validate that an --input file actually has the canonical snapshot shape
  * (the JSON `snapshot --out` writes) instead of blindly casting — a plan or

package/dist/cli/shared.js

@@ -131,7 +131,7 @@ export async function connectorFor(provider, args, progress) {
     throw new Error(`Unknown provider: ${provider}.${providerSuggestion ? ` Did you mean ${providerSuggestion}?` : ""} ` +
         "Supported providers: hubspot, salesforce, stripe");
 }
-export async function readSnapshot(args, progress) {
+export async function readSnapshot(args, progress, options = {}) {
     const provider = option(args, "--provider");
     if (provider) {
         // A verb driving its own progress board (e.g. `backfill stripe`) passes
@@ -153,7 +153,7 @@ export async function readSnapshot(args, progress) {
             return await connector.fetchSnapshot();
         }
         finally {
-            renderer.done();
+            renderer.done({ persist: options.persistProgress });
         }
     }
     if (args.includes("--demo")) {