nomarmy 0.1.0-alpha.12 → 0.1.0-alpha.13

package/README.md

@@ -52,6 +52,8 @@ Failing verification stays failed, unconditionally. A malformed report isn't aut
 
 **Checking without building** costs nothing: `mode: verify` runs a verification profile against any branch, with no worker and no model tokens.
 
+**Want deeper checks?** Three optional [validators](https://github.com/rayson-tech/nomarmy/blob/main/docs/validators.md) go further, each only adding review flags: mutation testing (do the tests pin down the changed lines?), Jev (do a scout's citations support its findings, does a report match its diff?) and a model judge (acceptance criteria, weakened tests).
+
 ## Where the work runs
 
 - **Agents** say where a job can run: an API key, your own ChatGPT or Muse Code subscription, or a local model on llama.cpp.
@@ -74,10 +76,12 @@ Developed and maintained by Rayson Technologies. This is an alpha (`0.1.0-alpha`
 | [Agents and the army](https://github.com/rayson-tech/nomarmy/blob/main/docs/agents-and-army.md) | Where a job can run, who does what, usage limits, picking an agent |
 | [`/feature` runs](https://github.com/rayson-tech/nomarmy/blob/main/docs/feature-runs.md) | A feature end to end, and watching what nomArmy is doing |
 | [Your repository](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md) | `.nomarmy.yml`, verification, dependencies, private registries, what nomArmy checks |
+| [Validators](https://github.com/rayson-tech/nomarmy/blob/main/docs/validators.md) | Optional deeper checks: mutation testing, Jev, a model judge |
 | [Harnesses](https://github.com/rayson-tech/nomarmy/blob/main/docs/harnesses.md) | Ecosystem registry, detection, network levels, and requirements |
 | [Configuration](https://github.com/rayson-tech/nomarmy/blob/main/docs/configuration.md) | Settings, swapping the local model, sizing, admission |
 | [Reference](https://github.com/rayson-tech/nomarmy/blob/main/docs/reference.md) | Every CLI command and MCP tool |
 | [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md) | What the sandbox holds back, and the one exception |
+| [FAQ](https://github.com/rayson-tech/nomarmy/blob/main/docs/faq.md) | Which model for which role, switching models, usage limits |
 | [Troubleshooting](https://github.com/rayson-tech/nomarmy/blob/main/docs/troubleshooting.md) | Symptoms and fixes |
 
 ## Security
@@ -97,6 +101,8 @@ A nom gets a writable git worktree inside a Podman sandbox and nothing else: no
 | The army and `/feature` | Driven by a real Claude Code General across three runs, about 18 implement jobs |
 | Harnesses: Go, Rust, Python, Node and mixed repos; Playwright; fake services | Live-verified offline |
 | Private registries and a verification-only network allowlist | Live-verified; each passed an independent security review |
+| Validators: mutation testing, Jev, a model judge | Unit and live tested; Jev and the judge evaluated on real job records |
+| `nomarmy stats` | Checked against a hand-built report on real job records |
 
 What we've learned from real runs, including where delegating pays and where it doesn't, is in [docs/findings.md](https://github.com/rayson-tech/nomarmy/blob/main/docs/findings.md).
 

package/bin/nomarmy.mjs

@@ -21,6 +21,7 @@ import { recommend, customRecommendation, evaluateConfig, bytesPerKvElementForCa
 import { connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv, defaultInstallDir, installMcpCopy, SCOPES, claudeUserScoped, portableServerLaunch } from "../lib/connect.mjs";
 import { compareVersions, readPackageVersion, readInstallVersions, copyIsStale } from "../lib/install-freshness.mjs";
 import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo } from "../lib/stats.mjs";
+import { requestJobStop } from "../lib/openclaw-run.mjs";
 import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings } from "../lib/validators.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
@@ -198,17 +199,25 @@ Usage: nomarmy <command> [options]
                             which agent the General is, in --global
                             (default) or --local
   config paths    where agents.yml and the three army layers live
-  jobs [--watch|--events|--prune|--wait <jobId>] [--interval N] [--older-than DAYS]
+  jobs [--watch|--events [--until-done]|--prune|--wait <jobId>|--stop <jobId> [--reason <text>]] [--interval N] [--older-than DAYS]
                   what's running across every session (agent, model, phase,
                   last tool call, files changed, heartbeat) and what just
                   finished; --watch redraws every N seconds (default 3);
                   --events prints one line per start, phase change and
-                  finish (for Claude Code's background monitor; --json for
-                  JSON lines); --prune removes the bulky runtime data
+                  finish (--json for JSON lines). It's a stream: read it
+                  with a monitor that wakes on each line. A background
+                  command is only reported when it exits, so there use
+                  --events --until-done, which exits once every job it saw
+                  running has finished (or --wait for one job). The plain
+                  stream ends on its own after 30 minutes with nothing
+                  running (--idle-minutes N); --prune removes the bulky runtime data
                   from finished jobs older than DAYS (default 2), keeping
                   their records, reports and any retained worktree;
                   --wait <jobId> [--timeout <seconds>] blocks for one job
-                  to finish (default timeout 1800; --json is supported)
+                  to finish (default timeout 1800; --json is supported);
+                  --stop <jobId> stops a running job's worker (no report
+                  recovery, no verification), keeping its worktree for
+                  continue_from
   health          check what's likely to break a run before it does:
                   expiring logins, an outdated OpenClaw or plugin, roles
                   that can't be dispatched, an unloadable agents.yml,
@@ -2518,6 +2527,12 @@ function renderJobs({ running, recent }) {
  */
 async function streamJobEvents() {
   const interval = Math.max(1, Number(value("interval", "3")) || 3) * 1000;
+  // A stream nobody reads must still end: a General that ran this as a
+  // background command (reported only on exit) was never told jobs had
+  // finished, and eight of these streams were left running for days.
+  const untilDone = flag("until-done");
+  const idleLimitMs = Math.max(1, Number(value("idle-minutes", "30")) || 30) * 60000;
+  let idleSinceMs = Date.now(), sawRunning = false;
   const seen = new Map();
   const emit = (event, job, detail = "") => {
     if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event, jobId: job.jobId, agent: job.agent, model: job.model, phase: job.phase, detail }));
@@ -2540,10 +2555,23 @@ async function streamJobEvents() {
     seen.clear();
     for (const [id, j] of now) seen.set(id, j);
     first = false;
+    if (running.length) { sawRunning = true; idleSinceMs = Date.now(); }
+    else if (untilDone && sawRunning) {
+      if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "done", detail: "every job seen running has finished" }));
+      else console.log(`${new Date().toLocaleTimeString()}  done      every job seen running has finished`);
+      return;
+    } else if (Date.now() - idleSinceMs >= (untilDone ? Math.min(idleLimitMs, 120000) : idleLimitMs)) {
+      const why = untilDone ? "no job was running to wait for" : `nothing has run for ${Math.round(idleLimitMs / 60000)} minutes`;
+      if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "idle", detail: why }));
+      else console.log(`${new Date().toLocaleTimeString()}  idle      ${why}; exiting`);
+      return;
+    }
     await new Promise((r) => setTimeout(r, interval));
   }
 }
 
+const commitSha = (commit) => (typeof commit === "string" ? commit : typeof commit?.sha === "string" ? commit.sha : null);
+
 /** Wait for one job in the shared, cross-session state directory. */
 async function waitForJobCli() {
   const requested = value("wait");
@@ -2580,7 +2608,8 @@ async function waitForJobCli() {
         outcome: meta.outcome ?? status.outcome ?? null,
         coordinatorStatus: meta.coordinatorStatus ?? status.coordinatorStatus ?? null,
         branch: meta.branch ?? status.branch ?? null,
-        commit: meta.commit?.sha ?? meta.commit ?? status.commit?.sha ?? status.commit ?? null,
+        // A job that made no commit has commit: { created: false, sha: null }; only a sha is a commit.
+        commit: commitSha(meta.commit) ?? commitSha(status.commit),
         issues,
       };
       if (json) out(result);
@@ -2621,6 +2650,13 @@ function pruneJobRuntimeCli() {
 
 async function cmdJobs() {
   if (flag("wait")) return waitForJobCli();
+  if (flag("stop")) {
+    const r = requestJobStop({ jobsRoot: jobsRootDir(), jobId: value("stop"), reason: value("reason") });
+    if (json) return out(r);
+    console.log(r.ok ? c.green(`✓ ${r.message}`) : c.red(`✗ ${r.message}`));
+    if (!r.ok) process.exitCode = 1;
+    return;
+  }
   if (flag("events")) return streamJobEvents();
   if (flag("prune")) return pruneJobRuntimeCli();
   if (json) return out(collectJobs());

package/lib/coordinator-instructions.mjs

@@ -15,12 +15,12 @@ Before dispatching:
 - A Claude subscription agent (claude-cli) runs its tools on this machine, outside the sandbox: use it for scout and review work. nomArmy refuses implement jobs on it unless the operator set allow_host_tools; send build work to a sandboxed agent.
 - To run tests without changing anything, use mode: verify; it costs no model usage.
 - Brief outcomes, not edits: a task, explicit acceptance criteria, and the tests that prove it. Put facts you've already resolved in evidence.
-- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator; otherwise poll local_worker_status with wait_seconds. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
+- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --events --until-done\`, which exits when they've all finished); otherwise poll local_worker_status with wait_seconds. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
 
 Trust boundary:
 - A worker's four-line report is a claim; nomArmy's verified git record and independent verification are the evidence. A job isn't complete if its report is missing or malformed, its STATUS is partial or blocked, STATUS done lacks VERIFICATION pass, or its changes aren't committed by nomArmy.
 - Read the diff of anything material before integrating it. nomArmy commits on the worker's branch and never merges into yours: integration, conflicts and pushes are yours.
-- To finish a job that came back partial, blocked or failing verification, dispatch the correction with continue_from: <that job id>. The new job starts with its unfinished work in place and verifies the whole. Don't fix and commit a worker's files yourself: that lands them unverified. If you must, commit them on a branch, run mode: verify on it before building on it, and say so in your report.
+- A job on the wrong track can be stopped with local_worker_stop; it keeps its worktree. To finish a job that came back partial, blocked, failing verification or stopped, dispatch the correction with continue_from: <that job id> (a cheaper model is fine). The new job starts with its unfinished work in place and verifies the whole. Don't fix and commit a worker's files yourself: that lands them unverified. If you must, commit them on a branch, run mode: verify on it before building on it, and say so in your report.
 - Failed and incomplete worktrees are kept for review; clean up with local_worker_cleanup or local_worker_sweep once you've decided.
 
 Never delegate deployments, production access, cloud or SSH credentials, secrets, Terraform state or kubectl contexts to a worker.`;

package/lib/execute.mjs

@@ -1,4 +1,4 @@
-import { writeStatus, shouldRetryTransientAbort, shouldAttemptScoutRecovery } from "./openclaw-run.mjs";
+import { writeStatus, shouldRetryTransientAbort, shouldAttemptScoutRecovery, readStopRequest } from "./openclaw-run.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -12,7 +12,7 @@ import { continuationProblem, continuationBase, snapshotRetainedWork, applyRetai
 import { checkScoutCitations, checkReportClaims } from "./jev-checks.mjs";
 import { runJudge } from "./judge.mjs";
 import { pickMutants, runMutants, describeSurvivors } from "./mutation.mjs";
-import { estimateDisplacement } from "./transcript.mjs";
+import { estimateDisplacement, readOpenClawTranscript } from "./transcript.mjs";
 import { outlineFile, findReferences } from "./repo-query.mjs";
 import { loadConfig } from "./config.mjs";
 import { linkNodePackages, nodeModulesState, repairHostInstalls } from "./sandbox-images.mjs";
@@ -275,6 +275,9 @@ export function createExecutor(deps) {
         // failed job that changed nothing was recorded "pass" (a Senti run),
         // which reads as evidence about work that never happened.
         independentVerification = normalizeVerification({ status: "not_run", basis: "not-applicable", reason: "the worker changed nothing, so there was none of its work to verify" }, verification ?? null);
+      } else if (workerStopReason === "stopped") {
+        // Stopped on request: end now, without spending time on tests.
+        independentVerification = normalizeVerification({ status: "not_run", basis: "not-applicable", reason: "the job was stopped on request" }, verification ?? null);
       } else if (verificationFlow.verificationRunner || !reportValidation.valid) {
         independentVerification = await runIndependentVerification({ profile: verification ?? null, cwd, jobId, baseSha: base.sha, branch, mode, record: preCommit, logFile: path.join(jobDir, "verification.log") });
       }
@@ -533,7 +536,10 @@ export function createExecutor(deps) {
 
       let coordinatorStatus = COORDINATOR_STATUS_BY_OUTCOME[finalOutcome.outcome] ?? "incomplete";
       const issues = [...finalOutcome.reasons, ...(preCommit.issues ?? [])];
-      if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
+      if (workerStopReason === "stopped") {
+        const request = readStopRequest(jobDir);
+        issues.push(`stopped on request${request?.reason ? `: ${request.reason}` : ""}; the worktree is kept, so continue_from can pick the work up (on another model too)`);
+      } else if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
       if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the worker's report was recovered from the run's transcript`);
       if (jevClaims?.error) issues.push(`Jev report check skipped (${jevClaims.error}); this job's result doesn't depend on it`);
       if (judged?.error) issues.push(`Judge ${judged.skipped ? "skipped" : "didn't answer"} (${judged.error}); this job's result doesn't depend on it`);
@@ -547,7 +553,7 @@ export function createExecutor(deps) {
         // the diffstat right in the issue a caller actually reads -- not just
         // buried in the full manifest's git record -- is what makes "go look at
         // the worktree" worth doing instead of discarding the job.
-        issues.push(`repository changes remain uncommitted (${record.filesChanged} file(s), +${record.additions}/-${record.deletions}): ${commit.reason}`);
+        if (record.filesChanged > 0) issues.push(`repository changes remain uncommitted (${record.filesChanged} file(s), +${record.additions}/-${record.deletions}): ${commit.reason}`);
       }
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`worker recorded ${failures} tool failure(s)`);
       if (record.ignoredRuntimeJunk.length) issues.push(`runtime junk ignored: ${record.ignoredRuntimeJunk.join(", ")}`);
@@ -669,12 +675,18 @@ export function createExecutor(deps) {
       const remainingSeconds = timeoutSeconds - Math.round(workerElapsedMs / 1000);
       if (shouldAttemptScoutRecovery({ workerFailed, workerTimedOut, report, remainingSeconds })) {
         reportRecoveryAttempted = true;
+        // What the first run left, in case the follow-up can't see its session.
+        let filesRead = [], earlierReply = reportText;
+        try {
+          const first = await readOpenClawTranscript(path.join(runtimeDir, "state"));
+          if (first.available) { filesRead = first.filesRead ?? []; earlierReply = earlierReply || first.lastAssistantText || ""; }
+        } catch { /* the reply alone still helps */ }
         try {
           const recoveryResult = await runOpenClaw({
             task, acceptance, verification: null, mode, cwd: worktree, baseRef: base.ref, baseSha: base.sha,
             timeoutSeconds: remainingSeconds, runtimeDir, profile, reasoning, pool, subscriptionWorker, onBehalfOf, model, reportSize, jobDir, workerId: workerId || jobId,
             evidenceTool: evidencePlaced ? evidenceTool : null,
-            overridePrompt: scoutReportRecoveryPrompt({ report: used.report.scout, question: task, acceptance }), logSuffix: "-recovery",
+            overridePrompt: scoutReportRecoveryPrompt({ report: used.report.scout, question: task, acceptance, earlierReply, filesRead }), logSuffix: "-recovery",
           });
           const recoveryReport = parseScoutReport(finalText(recoveryResult), (recoveryResult?.budgetsUsed ?? used).scout);
           if (!isScoutReportUnusable(recoveryReport)) {

package/lib/git-record.mjs

@@ -139,9 +139,26 @@ export function createGitRecord({ run, git, gitRaw }) {
   // idleMinElapsedMs of the work phase has passed (an early snapshot mid-first-
   // edit looks identical to no edit at all). A worktree read failing mid-write
   // is expected, not an error; it just means "nothing to report this tick."
-  function makeIdleDiffTick(cwd, { idleMs, minElapsedMs }) {
-    let lastHash = null, lastChangeAtMs = 0, sawChange = false;
+  //
+  // An unchanged worktree isn't enough on its own: a frontier worker running
+  // a suite of thousands of tests, or reading before its next edit, changes
+  // no file for minutes. Three Senti jobs were cut off at 7 to 13 minutes
+  // while still working. With `activity` (the worker's transcript: event
+  // count and whether a tool call is still running), the breaker waits while
+  // the worker is active, and stops only when it has also gone quiet for
+  // idleMs, or when nothing has changed for ACTIVE_CAP times idleMs however
+  // busy it looks (a worker looping without progress).
+  function makeIdleDiffTick(cwd, { idleMs, minElapsedMs, activity = null }) {
+    const ACTIVE_CAP = 3;
+    let lastHash = null, lastChangeAtMs = 0, sawChange = false, lastEvents = null, lastActivityAtMs = 0, inFlight = false;
     return async elapsedMs => {
+      if (activity) {
+        try {
+          const a = await activity();
+          if (a && a.events !== lastEvents) { lastEvents = a.events; lastActivityAtMs = elapsedMs; }
+          inFlight = Boolean(a?.toolInFlight);
+        } catch { /* a failed read just means no activity signal this tick */ }
+      }
       let statusOut;
       try { statusOut = await gitRaw(["status", "--porcelain=v1", "-z", "--untracked-files=all"], cwd); }
       catch { return { stop: false }; }
@@ -182,6 +199,12 @@ export function createGitRecord({ run, git, gitRaw }) {
       if (!sawChange || elapsedMs < minElapsedMs) return { stop: false };
       const idleForMs = elapsedMs - lastChangeAtMs;
       if (idleForMs < idleMs) return { stop: false };
+      if (activity) {
+        const quietForMs = elapsedMs - lastActivityAtMs;
+        const active = inFlight || quietForMs < idleMs;
+        if (active && idleForMs < idleMs * ACTIVE_CAP) return { stop: false };
+        if (active) return { stop: true, reason: "idle_diff", detail: `worktree unchanged for ${Math.round(idleForMs / 1000)}s while the worker kept working (${ACTIVE_CAP}x the idle limit)` };
+      }
       return { stop: true, reason: "idle_diff", detail: `worktree unchanged for ${Math.round(idleForMs / 1000)}s` };
     };
   }

package/lib/openclaw-run.mjs

@@ -61,6 +61,35 @@ export function makeAbandonedBackgroundProcessTick(stateDir, { idleMs, minElapse
  * tool call and files changed so far (liveProgress), and when. Never asks
  * to stop; a failed read just skips that beat.
  */
+// local_worker_stop (or `nomarmy jobs --stop`) writes this into the job's
+// folder, so any session can stop any job; the next tick ends the worker.
+export const STOP_REQUEST_FILE = "stop-request.json";
+export function makeStopRequestTick(jobDir) {
+  return async () => (fs.existsSync(path.join(jobDir, STOP_REQUEST_FILE)) ? { stop: true, reason: "stopped" } : { stop: false });
+}
+/**
+ * Ask a running job to stop. Refuses what isn't running; never kills
+ * anything itself (the job's own tick does, within one tick).
+ * @returns {{ ok: boolean, message: string }}
+ */
+export function requestJobStop({ jobsRoot, jobId, reason = null, now = new Date() }) {
+  if (!/^[A-Za-z0-9._-]{1,120}$/.test(String(jobId ?? ""))) return { ok: false, message: "not a job id" };
+  const jobDir = path.join(jobsRoot, jobId);
+  let status = null;
+  try { status = JSON.parse(fs.readFileSync(path.join(jobDir, "status.json"), "utf8")); } catch { return { ok: false, message: `no job ${jobId} (see local_worker_jobs)` }; }
+  if (status.state !== "running") return { ok: false, message: `job ${jobId} isn't running (it's ${status.state ?? "unknown"})` };
+  if (status.phase && status.phase !== "worker" && status.phase !== "starting" && status.phase !== "worktree") {
+    return { ok: false, message: `job ${jobId} is past its worker (phase ${status.phase}); it's finishing on its own and spends no more model usage` };
+  }
+  if (fs.existsSync(path.join(jobDir, STOP_REQUEST_FILE))) return { ok: true, message: `a stop was already requested for ${jobId}` };
+  fs.writeFileSync(path.join(jobDir, STOP_REQUEST_FILE), JSON.stringify({ at: now.toISOString(), reason: reason ? String(reason).slice(0, 300) : null }));
+  return { ok: true, message: `stop requested for ${jobId}: its worker ends within about 15 seconds, verification is skipped, and the worktree is kept uncommitted, so continue_from can pick the work up (on another model too)` };
+}
+
+export function readStopRequest(jobDir) {
+  try { return JSON.parse(fs.readFileSync(path.join(jobDir, STOP_REQUEST_FILE), "utf8")); } catch { return null; }
+}
+
 export function makeHeartbeatTick(jobDir, liveProgress) {
   // Never two beats at once: a slow beat used to overlap the next.
   let busy = false;
@@ -475,8 +504,9 @@ export function createOpenClawRunner(deps) {
     // The heartbeat runs for every job, so a running job is always watchable
     // (status.json used to keep its launch-time updatedAt until the end).
     const onTick = combineTicks([
+      makeStopRequestTick(jobDir),
       makeHeartbeatTick(jobDir),
-      ...(idleDiff ? [makeIdleDiffTick(cwd, idleDiff), makeAbandonedBackgroundProcessTick(stateDir, idleDiff)] : []),
+      ...(idleDiff ? [makeIdleDiffTick(cwd, { ...idleDiff, activity: async () => { const t = await readOpenClawTranscriptTail(stateDir, { limit: 5 }); return t.available ? { events: t.events, toolInFlight: t.toolInFlight } : null; } }), makeAbandonedBackgroundProcessTick(stateDir, idleDiff)] : []),
     ]);
     const liveLogs = { stdout: path.join(jobDir, `openclaw${logSuffix}.stdout.log`), stderr: path.join(jobDir, `openclaw${logSuffix}.stderr.log`) };
     // Where this call's own transcript events will start (see salvageFinishedRun).

package/lib/process.mjs

@@ -73,7 +73,10 @@ export function createProcess(ctx) {
         if (ticker) clearInterval(ticker);
         child.kill("SIGTERM");
         const error = new Error(message);
-        error.timedOut = true;
+        // A stop someone asked for (local_worker_stop) isn't a timeout: a
+        // timeout invites a report-recovery call, which would spend exactly
+        // the usage the stop was meant to save.
+        error.timedOut = stopReason !== "stopped";
         if (stopReason) error.stopReason = stopReason;
         reject(error);
       };

package/lib/scout.mjs

@@ -438,9 +438,22 @@ export function isScoutReportUnusable(report) {
 // The recovery call carries the question itself: a reply cut off mid-run can
 // leave the resumed session without it, and a scout told only to "restate the
 // question" then came back with an empty report (a live PM scout, twice).
-export function scoutReportRecoveryPrompt({ report = { targetTokens: 600, hardCapTokens: 1024 }, question = null, acceptance = [] } = {}) {
+// A recovery call can't count on seeing the first run's work: when OpenClaw's
+// cleanup crashes ("state ownership retained"), the follow-up starts a fresh
+// session, and a scout told "report only what you already found" came back
+// with nothing after nine minutes of real research. So the recovery carries
+// what the first run left: its cut-off reply and the files it read, which it
+// may re-read to confirm line numbers, and nothing else.
+const EARLIER_REPLY_CHARS = 12000;
+export function scoutReportRecoveryPrompt({ report = { targetTokens: 600, hardCapTokens: 1024 }, question = null, acceptance = [], earlierReply = "", filesRead = [] } = {}) {
   const asked = question ? `\n\nThe question you were answering:\n${String(question).trim()}${acceptance?.length ? `\n\nA complete answer covers:\n${acceptance.map((a) => `- ${a}`).join("\n")}` : ""}` : "";
-  return `Your previous reply ended without the required SCOUT REPORT, or was cut off before reaching END.${asked}\n\nDo not repeat, redo, retry, or explore further. Do not call any tool. Based only on what you already found, reply with ONLY the report below, nothing before it, nothing after it:\n\nSCOUT REPORT\nQUESTION: <the question restated in one line>\nCONFIDENCE: high | medium | low\nFINDING: <one sentence> [src/example.js:10-24]\nNOT_FOUND: none | <what you looked for and could not find>\nEND\n\nIf you did not actually find anything worth a FINDING, say so under NOT_FOUND rather than inventing one. Target ${report.targetTokens} tokens; ${report.hardCapTokens} is the hard cap.`;
+  const reply = String(earlierReply ?? "").trim();
+  const earlier = reply ? `\n\nYour earlier reply, as far as it got${reply.length > EARLIER_REPLY_CHARS ? " (its last part)" : ""}:\n${reply.length > EARLIER_REPLY_CHARS ? reply.slice(-EARLIER_REPLY_CHARS) : reply}` : "";
+  const files = filesRead?.length ? `\n\nFiles you read during that work: ${filesRead.slice(0, 60).join(", ")}` : "";
+  const tools = filesRead?.length
+    ? "Do not explore further. You may re-read the files listed above to confirm exact line numbers for what you found; call no other tool."
+    : "Do not repeat, redo, retry, or explore further. Do not call any tool.";
+  return `Your previous reply ended without the required SCOUT REPORT, or was cut off before reaching END.${asked}${earlier}${files}\n\n${tools} Based on what you already found, reply with ONLY the report below, nothing before it, nothing after it:\n\nSCOUT REPORT\nQUESTION: <the question restated in one line>\nCONFIDENCE: high | medium | low\nFINDING: <one sentence> [src/example.js:10-24]\nNOT_FOUND: none | <what you looked for and could not find>\nEND\n\nIf you did not actually find anything worth a FINDING, say so under NOT_FOUND rather than inventing one. Target ${report.targetTokens} tokens; ${report.hardCapTokens} is the hard cap.`;
 }
 
 // ---------------------------------------------------------------------------

package/lib/transcript.mjs

@@ -99,6 +99,9 @@ export function summarizeTranscriptEvents(events) {
     }
   }
   out.filesRead = [...new Set(out.filesRead)];
+  // A tool call with no result yet: the worker is waiting on it (a long test
+  // run writes nothing to the transcript until it returns).
+  out.toolInFlight = pending.length > 0;
   return out;
 }
 

package/mcp/server.mjs

@@ -36,6 +36,7 @@ import { readUsageSnapshots, usageStatus } from "../lib/usage-limits.mjs";
 import { modelRefusals } from "../lib/health.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
 import { restartNotice } from "../lib/install-freshness.mjs";
+import { requestJobStop } from "../lib/openclaw-run.mjs";
 import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo } from "../lib/stats.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { jevSettings, judgeSettings } from "../lib/validators.mjs";
@@ -443,6 +444,14 @@ server.tool("stats", "What nomArmy's own job records show for this repository (o
   } catch (error) { return toolText(error.message, true); }
 });
 
+server.tool("local_worker_stop", "Stop a running job's worker, for example one burning a frontier model's usage on the wrong track. Its worker ends within about 15 seconds, without the report-recovery call a timeout gets and without running verification; its worktree is kept uncommitted, so a new job with continue_from: <job_id> (and a cheaper model if you like) can finish the work. Works for a job started by any session. Refuses a job that isn't running or is already past its worker.", {
+  job_id: z.string().regex(/^[A-Za-z0-9._-]{1,120}$/),
+  reason: z.string().max(300).optional().describe("Why it's being stopped; recorded in the job's issues."),
+}, async ({ job_id, reason }) => {
+  const r = requestJobStop({ jobsRoot, jobId: job_id, reason: reason ?? null });
+  return toolText(r.message, !r.ok);
+});
+
 server.tool("local_worker_capacity", "What this host can take right now: context per nom and the brief/report budgets derived from it, memory pressure and whether another job would be admitted, and the jobs currently running. Read-only.", {}, async () => {
   await budgetState.refresh();
   return toolText(JSON.stringify(withRestartNotice(capacitySnapshot()), null, 2));

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.13",
   "private": false,
   "type": "module",
   "engines": {

package/playbooks/feature.md

@@ -26,7 +26,7 @@ Stop and ask only for something irreversible or outside this repository: merging
 
 ## Watching jobs
 
-Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. `nomarmy jobs --events` remains available for a stream covering every job. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
+Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. For several jobs at once, `nomarmy jobs --events --until-done` exits when every one has finished. The plain `nomarmy jobs --events` stream never exits on its own while jobs run, so don't run it as a background command (you'd only hear when it exits); use it only with a monitor that wakes on each line. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
 
 ## Limits