nomarmy 0.1.0-alpha.12 → 0.1.0-alpha.14

package/README.md

@@ -52,6 +52,8 @@ Failing verification stays failed, unconditionally. A malformed report isn't aut
 
 **Checking without building** costs nothing: `mode: verify` runs a verification profile against any branch, with no worker and no model tokens.
 
+**Want deeper checks?** Three optional [validators](https://github.com/rayson-tech/nomarmy/blob/main/docs/validators.md) go further, each only adding review flags: mutation testing (do the tests pin down the changed lines?), Jev (do a scout's citations support its findings, does a report match its diff?) and a model judge (acceptance criteria, weakened tests).
+
 ## Where the work runs
 
 - **Agents** say where a job can run: an API key, your own ChatGPT or Muse Code subscription, or a local model on llama.cpp.
@@ -74,10 +76,12 @@ Developed and maintained by Rayson Technologies. This is an alpha (`0.1.0-alpha`
 | [Agents and the army](https://github.com/rayson-tech/nomarmy/blob/main/docs/agents-and-army.md) | Where a job can run, who does what, usage limits, picking an agent |
 | [`/feature` runs](https://github.com/rayson-tech/nomarmy/blob/main/docs/feature-runs.md) | A feature end to end, and watching what nomArmy is doing |
 | [Your repository](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md) | `.nomarmy.yml`, verification, dependencies, private registries, what nomArmy checks |
+| [Validators](https://github.com/rayson-tech/nomarmy/blob/main/docs/validators.md) | Optional deeper checks: mutation testing, Jev, a model judge |
 | [Harnesses](https://github.com/rayson-tech/nomarmy/blob/main/docs/harnesses.md) | Ecosystem registry, detection, network levels, and requirements |
 | [Configuration](https://github.com/rayson-tech/nomarmy/blob/main/docs/configuration.md) | Settings, swapping the local model, sizing, admission |
 | [Reference](https://github.com/rayson-tech/nomarmy/blob/main/docs/reference.md) | Every CLI command and MCP tool |
 | [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md) | What the sandbox holds back, and the one exception |
+| [FAQ](https://github.com/rayson-tech/nomarmy/blob/main/docs/faq.md) | Which model for which role, switching models, usage limits |
 | [Troubleshooting](https://github.com/rayson-tech/nomarmy/blob/main/docs/troubleshooting.md) | Symptoms and fixes |
 
 ## Security
@@ -97,6 +101,8 @@ A nom gets a writable git worktree inside a Podman sandbox and nothing else: no
 | The army and `/feature` | Driven by a real Claude Code General across three runs, about 18 implement jobs |
 | Harnesses: Go, Rust, Python, Node and mixed repos; Playwright; fake services | Live-verified offline |
 | Private registries and a verification-only network allowlist | Live-verified; each passed an independent security review |
+| Validators: mutation testing, Jev, a model judge | Unit and live tested; Jev and the judge evaluated on real job records |
+| `nomarmy stats` | Checked against a hand-built report on real job records |
 
 What we've learned from real runs, including where delegating pays and where it doesn't, is in [docs/findings.md](https://github.com/rayson-tech/nomarmy/blob/main/docs/findings.md).
 

package/bin/nomarmy.mjs

@@ -20,7 +20,8 @@ import { readGGUFMetadata, resolveModelPath, totalSplitBytes } from "../lib/gguf
 import { recommend, customRecommendation, evaluateConfig, bytesPerKvElementForCacheTypes, MIN_CONTEXT_PER_NOM } from "../lib/sizing.mjs";
 import { connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv, defaultInstallDir, installMcpCopy, SCOPES, claudeUserScoped, portableServerLaunch } from "../lib/connect.mjs";
 import { compareVersions, readPackageVersion, readInstallVersions, copyIsStale } from "../lib/install-freshness.mjs";
-import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo } from "../lib/stats.mjs";
+import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
+import { requestJobStop } from "../lib/openclaw-run.mjs";
 import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings } from "../lib/validators.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
@@ -198,17 +199,25 @@ Usage: nomarmy <command> [options]
                             which agent the General is, in --global
                             (default) or --local
   config paths    where agents.yml and the three army layers live
-  jobs [--watch|--events|--prune|--wait <jobId>] [--interval N] [--older-than DAYS]
+  jobs [--watch|--events [--until-done]|--prune|--wait <jobId>|--stop <jobId> [--reason <text>]] [--interval N] [--older-than DAYS]
                   what's running across every session (agent, model, phase,
                   last tool call, files changed, heartbeat) and what just
                   finished; --watch redraws every N seconds (default 3);
                   --events prints one line per start, phase change and
-                  finish (for Claude Code's background monitor; --json for
-                  JSON lines); --prune removes the bulky runtime data
+                  finish (--json for JSON lines). It's a stream: read it
+                  with a monitor that wakes on each line. A background
+                  command is only reported when it exits, so there use
+                  --events --until-done, which exits once every job it saw
+                  running has finished (or --wait for one job). The plain
+                  stream ends on its own after 30 minutes with nothing
+                  running (--idle-minutes N); --prune removes the bulky runtime data
                   from finished jobs older than DAYS (default 2), keeping
                   their records, reports and any retained worktree;
                   --wait <jobId> [--timeout <seconds>] blocks for one job
-                  to finish (default timeout 1800; --json is supported)
+                  to finish (default timeout 1800; --json is supported);
+                  --stop <jobId> stops a running job's worker (no report
+                  recovery, no verification), keeping its worktree for
+                  continue_from
   health          check what's likely to break a run before it does:
                   expiring logins, an outdated OpenClaw or plugin, roles
                   that can't be dispatched, an unloadable agents.yml,
@@ -2518,6 +2527,12 @@ function renderJobs({ running, recent }) {
  */
 async function streamJobEvents() {
   const interval = Math.max(1, Number(value("interval", "3")) || 3) * 1000;
+  // A stream nobody reads must still end: a General that ran this as a
+  // background command (reported only on exit) was never told jobs had
+  // finished, and eight of these streams were left running for days.
+  const untilDone = flag("until-done");
+  const idleLimitMs = Math.max(1, Number(value("idle-minutes", "30")) || 30) * 60000;
+  let idleSinceMs = Date.now(), sawRunning = false;
   const seen = new Map();
   const emit = (event, job, detail = "") => {
     if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event, jobId: job.jobId, agent: job.agent, model: job.model, phase: job.phase, detail }));
@@ -2540,10 +2555,23 @@ async function streamJobEvents() {
     seen.clear();
     for (const [id, j] of now) seen.set(id, j);
     first = false;
+    if (running.length) { sawRunning = true; idleSinceMs = Date.now(); }
+    else if (untilDone && sawRunning) {
+      if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "done", detail: "every job seen running has finished" }));
+      else console.log(`${new Date().toLocaleTimeString()}  done      every job seen running has finished`);
+      return;
+    } else if (Date.now() - idleSinceMs >= (untilDone ? Math.min(idleLimitMs, 120000) : idleLimitMs)) {
+      const why = untilDone ? "no job was running to wait for" : `nothing has run for ${Math.round(idleLimitMs / 60000)} minutes`;
+      if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "idle", detail: why }));
+      else console.log(`${new Date().toLocaleTimeString()}  idle      ${why}; exiting`);
+      return;
+    }
     await new Promise((r) => setTimeout(r, interval));
   }
 }
 
+const commitSha = (commit) => (typeof commit === "string" ? commit : typeof commit?.sha === "string" ? commit.sha : null);
+
 /** Wait for one job in the shared, cross-session state directory. */
 async function waitForJobCli() {
   const requested = value("wait");
@@ -2580,7 +2608,8 @@ async function waitForJobCli() {
         outcome: meta.outcome ?? status.outcome ?? null,
         coordinatorStatus: meta.coordinatorStatus ?? status.coordinatorStatus ?? null,
         branch: meta.branch ?? status.branch ?? null,
-        commit: meta.commit?.sha ?? meta.commit ?? status.commit?.sha ?? status.commit ?? null,
+        // A job that made no commit has commit: { created: false, sha: null }; only a sha is a commit.
+        commit: commitSha(meta.commit) ?? commitSha(status.commit),
         issues,
       };
       if (json) out(result);
@@ -2621,6 +2650,13 @@ function pruneJobRuntimeCli() {
 
 async function cmdJobs() {
   if (flag("wait")) return waitForJobCli();
+  if (flag("stop")) {
+    const r = requestJobStop({ jobsRoot: jobsRootDir(), jobId: value("stop"), reason: value("reason") });
+    if (json) return out(r);
+    console.log(r.ok ? c.green(`✓ ${r.message}`) : c.red(`✗ ${r.message}`));
+    if (!r.ok) process.exitCode = 1;
+    return;
+  }
   if (flag("events")) return streamJobEvents();
   if (flag("prune")) return pruneJobRuntimeCli();
   if (json) return out(collectJobs());
@@ -2676,7 +2712,9 @@ function cmdStats() {
     try { repo = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
     catch { throw new Error(`${repoDir} isn't inside a git repository; run nomarmy stats from one, or pass --repo <name> or --all-repos`); }
   }
-  const stats = computeStats(records, { repo, sinceMs: parseSince(value("since")), untilMs: parseSince(value("until")), role: value("role"), model: value("model") });
+  let agentFor = () => null;
+  try { agentFor = agentLookup(loadAgents(globalConfigDir()).agents, agentProviderId); } catch { /* no agents.yml: commands name <agent> */ }
+  const stats = computeStats(records, { repo, sinceMs: parseSince(value("since")), untilMs: parseSince(value("until")), role: value("role"), model: value("model"), agentFor });
   if (json) return out(stats);
   console.log(formatStats(stats));
 }

package/lib/admission.mjs

@@ -236,6 +236,15 @@ export function createJobRuntime(deps) {
     // verify_regression re-runs `verification`; with no profile set there is
     // nothing to re-run. Refuse before starting anything, matching every other
     // admission check here, rather than silently no-op at runtime.
+    // stakes applies to what gets committed; reviews names the job a scout reviews.
+    jobs.forEach((j, i) => {
+      const at = jobs.length > 1 ? `job ${i + 1}: ` : "";
+      if (j.stakes === "high" && (j.mode ?? "implement") !== "implement") problems.push(`${at}stakes: high applies to implement jobs; for a review, send a scout with reviews: <job id>`);
+      if (j.reviews) {
+        if (j.mode !== "scout") problems.push(`${at}reviews: <job id> marks a scout as a review of that job; this job is ${j.mode ?? "implement"}`);
+        else if (!fs.existsSync(path.join(jobsRoot, j.reviews, "metadata.json"))) problems.push(`${at}reviews: no finished job ${j.reviews} to review (see local_worker_jobs)`);
+      }
+    });
     // continue_from: the retained job must exist, be unfinished and uncommitted,
     // and belong to this repo; see lib/continue-from.mjs.
     jobs.forEach((j, i) => {

package/lib/coordinator-instructions.mjs

@@ -14,13 +14,14 @@ Before dispatching:
 - Agents' usage limits show in army and local_worker_capacity; a job on an agent at its limit is held. Ask the operator before resubmitting with confirm_over_limit: true, or move the job to another agent. Never set it on your own.
 - A Claude subscription agent (claude-cli) runs its tools on this machine, outside the sandbox: use it for scout and review work. nomArmy refuses implement jobs on it unless the operator set allow_host_tools; send build work to a sandboxed agent.
 - To run tests without changing anything, use mode: verify; it costs no model usage.
+- Mark an implement job stakes: high when a mistake would be costly (security, access control, personal or tenant data, data loss, money, irreversible changes), however small it is. It then needs a verification profile, keeps the revert check, and needs an independent review before you accept it: a scout on another vendor with reviews: <job id>.
 - Brief outcomes, not edits: a task, explicit acceptance criteria, and the tests that prove it. Put facts you've already resolved in evidence.
-- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator; otherwise poll local_worker_status with wait_seconds. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
+- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --events --until-done\`, which exits when they've all finished); otherwise poll local_worker_status with wait_seconds. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
 
 Trust boundary:
 - A worker's four-line report is a claim; nomArmy's verified git record and independent verification are the evidence. A job isn't complete if its report is missing or malformed, its STATUS is partial or blocked, STATUS done lacks VERIFICATION pass, or its changes aren't committed by nomArmy.
 - Read the diff of anything material before integrating it. nomArmy commits on the worker's branch and never merges into yours: integration, conflicts and pushes are yours.
-- To finish a job that came back partial, blocked or failing verification, dispatch the correction with continue_from: <that job id>. The new job starts with its unfinished work in place and verifies the whole. Don't fix and commit a worker's files yourself: that lands them unverified. If you must, commit them on a branch, run mode: verify on it before building on it, and say so in your report.
+- A job on the wrong track can be stopped with local_worker_stop; it keeps its worktree. To finish a job that came back partial, blocked, failing verification or stopped, dispatch the correction with continue_from: <that job id> (a cheaper model is fine). The new job starts with its unfinished work in place and verifies the whole. Don't fix and commit a worker's files yourself: that lands them unverified. If you must, commit them on a branch, run mode: verify on it before building on it, and say so in your report.
 - Failed and incomplete worktrees are kept for review; clean up with local_worker_cleanup or local_worker_sweep once you've decided.
 
 Never delegate deployments, production access, cloud or SSH credentials, secrets, Terraform state or kubectl contexts to a worker.`;

package/lib/execute.mjs

@@ -1,4 +1,4 @@
-import { writeStatus, shouldRetryTransientAbort, shouldAttemptScoutRecovery } from "./openclaw-run.mjs";
+import { writeStatus, shouldRetryTransientAbort, shouldAttemptScoutRecovery, readStopRequest } from "./openclaw-run.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -12,7 +12,7 @@ import { continuationProblem, continuationBase, snapshotRetainedWork, applyRetai
 import { checkScoutCitations, checkReportClaims } from "./jev-checks.mjs";
 import { runJudge } from "./judge.mjs";
 import { pickMutants, runMutants, describeSurvivors } from "./mutation.mjs";
-import { estimateDisplacement } from "./transcript.mjs";
+import { estimateDisplacement, readOpenClawTranscript } from "./transcript.mjs";
 import { outlineFile, findReferences } from "./repo-query.mjs";
 import { loadConfig } from "./config.mjs";
 import { linkNodePackages, nodeModulesState, repairHostInstalls } from "./sandbox-images.mjs";
@@ -20,7 +20,7 @@ import { detectTestSabotage, addedLinesOf, loadDependencyNames } from "./sabotag
 import { describeRecoveryChanges, reportRecoveryPrompt } from "./worker-prompt.mjs";
 import { parseWorkerReport } from "./report.mjs";
 import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "./outcomes.mjs";
-import { resolveOutcome, finalText, workerMetadata, applyRefactorContract, applyVerificationPolicy } from "./outcome.mjs";
+import { resolveOutcome, finalText, workerMetadata, applyRefactorContract, applyVerificationPolicy, HIGH_STAKES_NOTE } from "./outcome.mjs";
 import { parseAddedLineNumbers, isTestPath, isDocumentationPath, detectScopedTestSelectionRisk, detectUnwiredNewDefinitions, detectMislabeledTestNames, detectPossibleSecrets, detectVerificationInputChanges } from "./diff-checks.mjs";
 
 // ---------------------------------------------------------------------------
@@ -42,7 +42,7 @@ export function createExecutor(deps) {
   // Optional Jev checks (lib/validators.mjs): the server wires the settings; without them (tests), none run.
   const jevSettingsFor = (check) => { try { const s = deps.jevSettings?.(); return s?.checks?.includes(check) ? s : null; } catch { return null; } };
 
-  async function executeJob({ task, acceptance, verification, mode = "implement", baseRef, timeoutSeconds = 600, profile = "coder", reasoning = "high", pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, evidence = null, verifyRegression = false, commitSubject = null, refactor = false, continueFrom = null, jobId: presetJobId = null }) {
+  async function executeJob({ task, acceptance, verification, mode = "implement", baseRef, timeoutSeconds = 600, profile = "coder", reasoning = "high", pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, evidence = null, verifyRegression = false, commitSubject = null, refactor = false, continueFrom = null, stakes = null, reviews = null, jobId: presetJobId = null }) {
     await assertRepo();
     // A continuation starts from the retained job's own base commit.
     let continuation = null;
@@ -66,9 +66,9 @@ export function createExecutor(deps) {
     progress("starting", { startedAt: new Date().toISOString(), agent: mode === "verify" ? null : pool ?? subscriptionWorker ?? "local", model: model ?? null });
     const common = { task, acceptance, base, jobId, jobDir, runtimeDir, timeoutSeconds, profile, reasoning, pool, subscriptionWorker, onBehalfOf, model, reportSize, workerId, progress, jobStartedMs };
     if (mode === "verify") return executeVerify({ ...common, verification });
-    if (mode === "scout") return executeScout(common);
+    if (mode === "scout") return executeScout({ ...common, reviews });
     if (mode === "decompose") return executeDecompose(common);
-    return executeImplement({ ...common, verification, evidence, verifyRegression, commitSubject, refactor, continuation });
+    return executeImplement({ ...common, verification, evidence, verifyRegression, commitSubject, refactor, continuation, stakes });
   }
 
   async function executeVerify({ task, verification: profile, base, jobId, jobDir, workerId, progress, jobStartedMs }) {
@@ -103,7 +103,7 @@ export function createExecutor(deps) {
     return { ok: outcome === OUTCOMES.VERIFIED, manifest, jobDir, report: "" };
   }
 
-  async function executeImplement({ task, acceptance, verification, base, jobId, jobDir, runtimeDir, timeoutSeconds, profile, reasoning, pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, evidence, verifyRegression = false, commitSubject = null, refactor = false, continuation = null, progress, jobStartedMs }) {
+  async function executeImplement({ task, acceptance, verification, base, jobId, jobDir, runtimeDir, timeoutSeconds, profile, reasoning, pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, evidence, verifyRegression = false, commitSubject = null, refactor = false, continuation = null, stakes = null, progress, jobStartedMs }) {
     const mode = "implement";
     let branch = `agent/${jobId}`, worktree = path.join(jobDir, "worktree");
     try {
@@ -275,6 +275,9 @@ export function createExecutor(deps) {
         // failed job that changed nothing was recorded "pass" (a Senti run),
         // which reads as evidence about work that never happened.
         independentVerification = normalizeVerification({ status: "not_run", basis: "not-applicable", reason: "the worker changed nothing, so there was none of its work to verify" }, verification ?? null);
+      } else if (workerStopReason === "stopped") {
+        // Stopped on request: end now, without spending time on tests.
+        independentVerification = normalizeVerification({ status: "not_run", basis: "not-applicable", reason: "the job was stopped on request" }, verification ?? null);
       } else if (verificationFlow.verificationRunner || !reportValidation.valid) {
         independentVerification = await runIndependentVerification({ profile: verification ?? null, cwd, jobId, baseSha: base.sha, branch, mode, record: preCommit, logFile: path.join(jobDir, "verification.log") });
       }
@@ -522,7 +525,8 @@ export function createExecutor(deps) {
         : mutation?.status === "survivors"
           ? { ...afterConfig, reviewRequired: true, reasons: [...afterConfig.reasons, describeSurvivors(mutation, verification)] }
           : afterConfig;
-      const finalOutcome = applyRefactorContract(applyVerificationPolicy(afterMutation, independentVerification.status, repoPolicy()),
+      const afterStakes = stakes === "high" ? { ...afterMutation, reviewRequired: true, reasons: [...afterMutation.reasons, HIGH_STAKES_NOTE] } : afterMutation;
+      const finalOutcome = applyRefactorContract(applyVerificationPolicy(afterStakes, independentVerification.status, repoPolicy()),
         { refactor, verificationStatus: independentVerification.status, testChanges: preCommit.testChanges });
 
       progress("commit");
@@ -533,7 +537,10 @@ export function createExecutor(deps) {
 
       let coordinatorStatus = COORDINATOR_STATUS_BY_OUTCOME[finalOutcome.outcome] ?? "incomplete";
       const issues = [...finalOutcome.reasons, ...(preCommit.issues ?? [])];
-      if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
+      if (workerStopReason === "stopped") {
+        const request = readStopRequest(jobDir);
+        issues.push(`stopped on request${request?.reason ? `: ${request.reason}` : ""}; the worktree is kept, so continue_from can pick the work up (on another model too)`);
+      } else if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
       if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the worker's report was recovered from the run's transcript`);
       if (jevClaims?.error) issues.push(`Jev report check skipped (${jevClaims.error}); this job's result doesn't depend on it`);
       if (judged?.error) issues.push(`Judge ${judged.skipped ? "skipped" : "didn't answer"} (${judged.error}); this job's result doesn't depend on it`);
@@ -547,7 +554,7 @@ export function createExecutor(deps) {
         // the diffstat right in the issue a caller actually reads -- not just
         // buried in the full manifest's git record -- is what makes "go look at
         // the worktree" worth doing instead of discarding the job.
-        issues.push(`repository changes remain uncommitted (${record.filesChanged} file(s), +${record.additions}/-${record.deletions}): ${commit.reason}`);
+        if (record.filesChanged > 0) issues.push(`repository changes remain uncommitted (${record.filesChanged} file(s), +${record.additions}/-${record.deletions}): ${commit.reason}`);
       }
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`worker recorded ${failures} tool failure(s)`);
       if (record.ignoredRuntimeJunk.length) issues.push(`runtime junk ignored: ${record.ignoredRuntimeJunk.join(", ")}`);
@@ -565,9 +572,9 @@ export function createExecutor(deps) {
 
       const metrics = buildMetrics({ result: result ?? attempted, record, reportValidation, outcome: finalOutcome, workerElapsedMs, totalElapsedMs: Date.now() - jobStartedMs, regressionCheckElapsedMs, transientAbortRetried });
       const manifest = { version: VERSION, jobId, workerId: workerId || jobId, mode, projectDir, worktree, branch, startedAt, finishedAt,
-        objective: task, acceptance: acceptance ?? [], verificationProfile: verification ?? null, ...(continuedFrom ? { continuedFrom } : {}),
+        objective: task, acceptance: acceptance ?? [], verificationProfile: verification ?? null, ...(continuedFrom ? { continuedFrom } : {}), ...(stakes ? { stakes } : {}),
         ...(mutation ? { mutation: { ...mutation, elapsedSeconds: Math.round((mutationElapsedMs ?? 0) / 1000) } } : {}),
-        ...(jevClaims || judged ? { validators: { ...(jevClaims ? { jev: { check: "report-claims", verdict: jevClaims.verdict, flagged: Boolean(jevClaims.flag), error: jevClaims.error, truncated: Boolean(jevClaims.truncated), inputTokens: jevClaims.usage } } : {}), ...(judged ? { judge: { agent: judge?.agent ?? null, model: judge?.model ?? null, answer: judged.answer, flags: judged.flags, error: judged.error } } : {}) } } : {}),
+        ...(jevClaims || judged ? { validators: { ...(jevClaims ? { jev: { check: "report-claims", verdict: jevClaims.verdict, flagged: Boolean(jevClaims.flag), error: jevClaims.error, truncated: Boolean(jevClaims.truncated), inputTokens: jevClaims.usage } } : {}), ...(judged ? { judge: { agent: judge?.agent ?? null, provider: judge?.provider ?? null, model: judge?.model ?? null, answer: judged.answer, flags: judged.flags, error: judged.error } } : {}) } } : {}),
         outcome: finalOutcome.outcome, recovered: finalOutcome.recovered, recoveryAttempted: finalOutcome.recoveryAttempted,
         reportRecoveryAttempted, reportRecovered,
         reviewRequired: finalOutcome.reviewRequired || record.testChanges.reviewRequired,
@@ -610,7 +617,7 @@ export function createExecutor(deps) {
   // the worktree, so a scout that wrote to its snapshot cannot forge evidence.
   // A clean scout worktree holds no work and is removed; a dirty one is retained
   // because a scout that wrote is a scout that misbehaved, and that is worth a look.
-  async function executeScout({ task, acceptance, base, jobId, jobDir, runtimeDir, timeoutSeconds, profile, reasoning, pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, progress, jobStartedMs }) {
+  async function executeScout({ task, acceptance, base, jobId, jobDir, runtimeDir, timeoutSeconds, profile, reasoning, pool = null, subscriptionWorker = null, onBehalfOf = null, model = null, reportSize = null, workerId, progress, jobStartedMs, reviews = null }) {
     const mode = "scout", worktree = path.join(jobDir, "worktree");
     let worktreeRetained = false;
     try {
@@ -669,12 +676,18 @@ export function createExecutor(deps) {
       const remainingSeconds = timeoutSeconds - Math.round(workerElapsedMs / 1000);
       if (shouldAttemptScoutRecovery({ workerFailed, workerTimedOut, report, remainingSeconds })) {
         reportRecoveryAttempted = true;
+        // What the first run left, in case the follow-up can't see its session.
+        let filesRead = [], earlierReply = reportText;
+        try {
+          const first = await readOpenClawTranscript(path.join(runtimeDir, "state"));
+          if (first.available) { filesRead = first.filesRead ?? []; earlierReply = earlierReply || first.lastAssistantText || ""; }
+        } catch { /* the reply alone still helps */ }
         try {
           const recoveryResult = await runOpenClaw({
             task, acceptance, verification: null, mode, cwd: worktree, baseRef: base.ref, baseSha: base.sha,
             timeoutSeconds: remainingSeconds, runtimeDir, profile, reasoning, pool, subscriptionWorker, onBehalfOf, model, reportSize, jobDir, workerId: workerId || jobId,
             evidenceTool: evidencePlaced ? evidenceTool : null,
-            overridePrompt: scoutReportRecoveryPrompt({ report: used.report.scout, question: task, acceptance }), logSuffix: "-recovery",
+            overridePrompt: scoutReportRecoveryPrompt({ report: used.report.scout, question: task, acceptance, earlierReply, filesRead }), logSuffix: "-recovery",
           });
           const recoveryReport = parseScoutReport(finalText(recoveryResult), (recoveryResult?.budgetsUsed ?? used).scout);
           if (!isScoutReportUnusable(recoveryReport)) {
@@ -753,7 +766,7 @@ export function createExecutor(deps) {
         displacement_verdict: displacement.verdict
       };
       const manifest = { version: VERSION, jobId, workerId: workerId || jobId, mode, projectDir, worktree: worktreeRetained ? worktree : null, branch: null, baseSha: base.sha, startedAt, finishedAt,
-        objective: task, mustCover: acceptance ?? [],
+        objective: task, mustCover: acceptance ?? [], ...(reviews ? { reviews } : {}),
         ...(jevCitations ? { validators: { jev: { check: "scout-citations", checked: jevCitations.checked, flags: jevCitations.flags, errors: jevCitations.errors, inputTokens: jevCitations.usage } } } : {}),
         outcome: outcome.outcome, coordinatorStatus: outcome.coordinatorStatus, reviewRequired: outcome.reviewRequired, issues,
         scout: { question: report.question, confidence: report.confidence, notFound: report.notFound,

package/lib/git-record.mjs

@@ -139,9 +139,26 @@ export function createGitRecord({ run, git, gitRaw }) {
   // idleMinElapsedMs of the work phase has passed (an early snapshot mid-first-
   // edit looks identical to no edit at all). A worktree read failing mid-write
   // is expected, not an error; it just means "nothing to report this tick."
-  function makeIdleDiffTick(cwd, { idleMs, minElapsedMs }) {
-    let lastHash = null, lastChangeAtMs = 0, sawChange = false;
+  //
+  // An unchanged worktree isn't enough on its own: a frontier worker running
+  // a suite of thousands of tests, or reading before its next edit, changes
+  // no file for minutes. Three Senti jobs were cut off at 7 to 13 minutes
+  // while still working. With `activity` (the worker's transcript: event
+  // count and whether a tool call is still running), the breaker waits while
+  // the worker is active, and stops only when it has also gone quiet for
+  // idleMs, or when nothing has changed for ACTIVE_CAP times idleMs however
+  // busy it looks (a worker looping without progress).
+  function makeIdleDiffTick(cwd, { idleMs, minElapsedMs, activity = null }) {
+    const ACTIVE_CAP = 3;
+    let lastHash = null, lastChangeAtMs = 0, sawChange = false, lastEvents = null, lastActivityAtMs = 0, inFlight = false;
     return async elapsedMs => {
+      if (activity) {
+        try {
+          const a = await activity();
+          if (a && a.events !== lastEvents) { lastEvents = a.events; lastActivityAtMs = elapsedMs; }
+          inFlight = Boolean(a?.toolInFlight);
+        } catch { /* a failed read just means no activity signal this tick */ }
+      }
       let statusOut;
       try { statusOut = await gitRaw(["status", "--porcelain=v1", "-z", "--untracked-files=all"], cwd); }
       catch { return { stop: false }; }
@@ -182,6 +199,12 @@ export function createGitRecord({ run, git, gitRaw }) {
       if (!sawChange || elapsedMs < minElapsedMs) return { stop: false };
       const idleForMs = elapsedMs - lastChangeAtMs;
       if (idleForMs < idleMs) return { stop: false };
+      if (activity) {
+        const quietForMs = elapsedMs - lastActivityAtMs;
+        const active = inFlight || quietForMs < idleMs;
+        if (active && idleForMs < idleMs * ACTIVE_CAP) return { stop: false };
+        if (active) return { stop: true, reason: "idle_diff", detail: `worktree unchanged for ${Math.round(idleForMs / 1000)}s while the worker kept working (${ACTIVE_CAP}x the idle limit)` };
+      }
       return { stop: true, reason: "idle_diff", detail: `worktree unchanged for ${Math.round(idleForMs / 1000)}s` };
     };
   }

package/lib/health.mjs

@@ -333,6 +333,14 @@ export async function checkAndRecordHealth({ projectDir, stateRoot, configDir, n
   const install = { ...readInstallVersions(installDir), copyHarnesses: Object.keys(loadHarnesses(path.join(installDir, "harnesses")).harnesses).length };
   const result = await runHealthChecks({ now, mode, armySummary, agentsError, jobsRoot: path.join(stateRoot, "jobs"), pidAlive,
     agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot), install });
+  try {
+    const { loadJobRecords, agentLookup } = await import("./stats.mjs");
+    const { recentSuggestions } = await import("./suggestions.mjs");
+    for (const s of recentSuggestions(loadJobRecords(path.join(stateRoot, "jobs")), { projectDir, agentFor: agents ? agentLookup(agents, agentProviderId) : () => null, now })) {
+      if (s.level !== "warn") continue;
+      result.issues.push({ id: `suggestion:${s.key}`, severity: "warn", title: s.title, detail: s.evidence, fix: s.command ?? "nomarmy stats (routing suggestions)", short: "routing tip" });
+    }
+  } catch { /* suggestions never break a health check */ }
   const toNotify = recordHealth(path.join(stateRoot, "health.json"), result, { now });
   return { result, toNotify };
 }

package/lib/openclaw-run.mjs

@@ -61,6 +61,35 @@ export function makeAbandonedBackgroundProcessTick(stateDir, { idleMs, minElapse
  * tool call and files changed so far (liveProgress), and when. Never asks
  * to stop; a failed read just skips that beat.
  */
+// local_worker_stop (or `nomarmy jobs --stop`) writes this into the job's
+// folder, so any session can stop any job; the next tick ends the worker.
+export const STOP_REQUEST_FILE = "stop-request.json";
+export function makeStopRequestTick(jobDir) {
+  return async () => (fs.existsSync(path.join(jobDir, STOP_REQUEST_FILE)) ? { stop: true, reason: "stopped" } : { stop: false });
+}
+/**
+ * Ask a running job to stop. Refuses what isn't running; never kills
+ * anything itself (the job's own tick does, within one tick).
+ * @returns {{ ok: boolean, message: string }}
+ */
+export function requestJobStop({ jobsRoot, jobId, reason = null, now = new Date() }) {
+  if (!/^[A-Za-z0-9._-]{1,120}$/.test(String(jobId ?? ""))) return { ok: false, message: "not a job id" };
+  const jobDir = path.join(jobsRoot, jobId);
+  let status = null;
+  try { status = JSON.parse(fs.readFileSync(path.join(jobDir, "status.json"), "utf8")); } catch { return { ok: false, message: `no job ${jobId} (see local_worker_jobs)` }; }
+  if (status.state !== "running") return { ok: false, message: `job ${jobId} isn't running (it's ${status.state ?? "unknown"})` };
+  if (status.phase && status.phase !== "worker" && status.phase !== "starting" && status.phase !== "worktree") {
+    return { ok: false, message: `job ${jobId} is past its worker (phase ${status.phase}); it's finishing on its own and spends no more model usage` };
+  }
+  if (fs.existsSync(path.join(jobDir, STOP_REQUEST_FILE))) return { ok: true, message: `a stop was already requested for ${jobId}` };
+  fs.writeFileSync(path.join(jobDir, STOP_REQUEST_FILE), JSON.stringify({ at: now.toISOString(), reason: reason ? String(reason).slice(0, 300) : null }));
+  return { ok: true, message: `stop requested for ${jobId}: its worker ends within about 15 seconds, verification is skipped, and the worktree is kept uncommitted, so continue_from can pick the work up (on another model too)` };
+}
+
+export function readStopRequest(jobDir) {
+  try { return JSON.parse(fs.readFileSync(path.join(jobDir, STOP_REQUEST_FILE), "utf8")); } catch { return null; }
+}
+
 export function makeHeartbeatTick(jobDir, liveProgress) {
   // Never two beats at once: a slow beat used to overlap the next.
   let busy = false;
@@ -475,8 +504,9 @@ export function createOpenClawRunner(deps) {
     // The heartbeat runs for every job, so a running job is always watchable
     // (status.json used to keep its launch-time updatedAt until the end).
     const onTick = combineTicks([
+      makeStopRequestTick(jobDir),
       makeHeartbeatTick(jobDir),
-      ...(idleDiff ? [makeIdleDiffTick(cwd, idleDiff), makeAbandonedBackgroundProcessTick(stateDir, idleDiff)] : []),
+      ...(idleDiff ? [makeIdleDiffTick(cwd, { ...idleDiff, activity: async () => { const t = await readOpenClawTranscriptTail(stateDir, { limit: 5 }); return t.available ? { events: t.events, toolInFlight: t.toolInFlight } : null; } }), makeAbandonedBackgroundProcessTick(stateDir, idleDiff)] : []),
     ]);
     const liveLogs = { stdout: path.join(jobDir, `openclaw${logSuffix}.stdout.log`), stderr: path.join(jobDir, `openclaw${logSuffix}.stderr.log`) };
     // Where this call's own transcript events will start (see salvageFinishedRun).

package/lib/outcome.mjs

@@ -207,8 +207,17 @@ export function policyAdmissionProblems(job, policy) {
   // A refactor meets the regression requirement through its own contract
   // (applyRefactorContract), not the revert check.
   if (policy.require_regression_check && job.verify_regression === false && !job.refactor) problems.push("this repo requires the revert check (policy.require_regression_check in .nomarmy.yml): verify_regression can't be false (a behavior-preserving change can declare refactor: true instead)");
+  // stakes: high (security, data loss, irreversible): the checks a General
+  // could skip on routine work are mandatory, whatever the repo's policy.
+  if (job.stakes === "high") {
+    if (!job.verification && !job.refactor) problems.push("a stakes: high job needs a `verification` profile: its result is only as good as the tests that prove it");
+    if (job.verify_regression === false && !job.refactor) problems.push("a stakes: high job can't turn the revert check off (verify_regression: false): it's the proof a test catches the change");
+  }
   return problems;
 }
+
+/** The review line every high-stakes job carries, whatever its outcome. */
+export const HIGH_STAKES_NOTE = "HIGH STAKES: accept this only after an independent review: a scout on another vendor (army_role security-analyst or similar) with reviews: <this job id>, or a judge on another vendor. Passing its tests isn't enough on its own; most defects that pass every check are in security, data or deploy-only paths.";
 /**
  * A declared refactor commits only when verification passed and no test
  * file was added, changed or deleted. Mechanical, not the General's call:

package/lib/process.mjs

@@ -73,7 +73,10 @@ export function createProcess(ctx) {
         if (ticker) clearInterval(ticker);
         child.kill("SIGTERM");
         const error = new Error(message);
-        error.timedOut = true;
+        // A stop someone asked for (local_worker_stop) isn't a timeout: a
+        // timeout invites a report-recovery call, which would spend exactly
+        // the usage the stop was meant to save.
+        error.timedOut = stopReason !== "stopped";
         if (stopReason) error.stopReason = stopReason;
         reject(error);
       };

package/lib/scout.mjs

@@ -438,9 +438,22 @@ export function isScoutReportUnusable(report) {
 // The recovery call carries the question itself: a reply cut off mid-run can
 // leave the resumed session without it, and a scout told only to "restate the
 // question" then came back with an empty report (a live PM scout, twice).
-export function scoutReportRecoveryPrompt({ report = { targetTokens: 600, hardCapTokens: 1024 }, question = null, acceptance = [] } = {}) {
+// A recovery call can't count on seeing the first run's work: when OpenClaw's
+// cleanup crashes ("state ownership retained"), the follow-up starts a fresh
+// session, and a scout told "report only what you already found" came back
+// with nothing after nine minutes of real research. So the recovery carries
+// what the first run left: its cut-off reply and the files it read, which it
+// may re-read to confirm line numbers, and nothing else.
+const EARLIER_REPLY_CHARS = 12000;
+export function scoutReportRecoveryPrompt({ report = { targetTokens: 600, hardCapTokens: 1024 }, question = null, acceptance = [], earlierReply = "", filesRead = [] } = {}) {
   const asked = question ? `\n\nThe question you were answering:\n${String(question).trim()}${acceptance?.length ? `\n\nA complete answer covers:\n${acceptance.map((a) => `- ${a}`).join("\n")}` : ""}` : "";
-  return `Your previous reply ended without the required SCOUT REPORT, or was cut off before reaching END.${asked}\n\nDo not repeat, redo, retry, or explore further. Do not call any tool. Based only on what you already found, reply with ONLY the report below, nothing before it, nothing after it:\n\nSCOUT REPORT\nQUESTION: <the question restated in one line>\nCONFIDENCE: high | medium | low\nFINDING: <one sentence> [src/example.js:10-24]\nNOT_FOUND: none | <what you looked for and could not find>\nEND\n\nIf you did not actually find anything worth a FINDING, say so under NOT_FOUND rather than inventing one. Target ${report.targetTokens} tokens; ${report.hardCapTokens} is the hard cap.`;
+  const reply = String(earlierReply ?? "").trim();
+  const earlier = reply ? `\n\nYour earlier reply, as far as it got${reply.length > EARLIER_REPLY_CHARS ? " (its last part)" : ""}:\n${reply.length > EARLIER_REPLY_CHARS ? reply.slice(-EARLIER_REPLY_CHARS) : reply}` : "";
+  const files = filesRead?.length ? `\n\nFiles you read during that work: ${filesRead.slice(0, 60).join(", ")}` : "";
+  const tools = filesRead?.length
+    ? "Do not explore further. You may re-read the files listed above to confirm exact line numbers for what you found; call no other tool."
+    : "Do not repeat, redo, retry, or explore further. Do not call any tool.";
+  return `Your previous reply ended without the required SCOUT REPORT, or was cut off before reaching END.${asked}${earlier}${files}\n\n${tools} Based on what you already found, reply with ONLY the report below, nothing before it, nothing after it:\n\nSCOUT REPORT\nQUESTION: <the question restated in one line>\nCONFIDENCE: high | medium | low\nFINDING: <one sentence> [src/example.js:10-24]\nNOT_FOUND: none | <what you looked for and could not find>\nEND\n\nIf you did not actually find anything worth a FINDING, say so under NOT_FOUND rather than inventing one. Target ${report.targetTokens} tokens; ${report.hardCapTokens} is the hard cap.`;
 }
 
 // ---------------------------------------------------------------------------

package/lib/stats.mjs

@@ -5,6 +5,9 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { computeSuggestions, formatSuggestions, reviewOf } from "./suggestions.mjs";
+
+const SUGGESTION_WINDOW_MS = 14 * 86400000;
 
 /** Every readable job record under jobsRoot. */
 export function loadJobRecords(jobsRoot) {
@@ -17,6 +20,15 @@ export function loadJobRecords(jobsRoot) {
   return records;
 }
 
+/** An agent name from agents.yml for a provider id, when exactly one agent uses it. */
+export function agentLookup(agents = {}, providerOf) {
+  return (provider) => {
+    if (!provider) return null;
+    const names = Object.entries(agents).filter(([, a]) => { try { return providerOf(a) === provider; } catch { return false; } }).map(([name]) => name);
+    return names.length === 1 ? names[0] : null;
+  };
+}
+
 /** "7d", "24h", or a date; returns epoch ms or null. */
 export function parseSince(value, now = Date.now()) {
   if (!value) return null;
@@ -87,7 +99,7 @@ export function resolveRepo(records, value) {
  * @param {object[]} records
  * @param {{ repo?: string|null, sinceMs?: number|null, untilMs?: number|null, role?: string|null, model?: string|null }} filter
  */
-export function computeStats(records, { repo = null, sinceMs = null, untilMs = null, role = null, model = null } = {}) {
+export function computeStats(records, { repo = null, sinceMs = null, untilMs = null, role = null, model = null, agentFor = () => null, now = Date.now() } = {}) {
   const inRange = records.filter((r) => {
     const at = Date.parse(r.startedAt ?? r.finishedAt ?? "");
     if (sinceMs != null && !(at >= sinceMs)) return false;
@@ -169,6 +181,13 @@ export function computeStats(records, { repo = null, sinceMs = null, untilMs = n
     notCompleted: sortDesc(count(jobs.filter((r) => !/^(WORKER_DONE|RECOVERED_SUCCESS|VERIFIED|SCOUT_DONE|DECOMPOSE_DONE|SCOUT_NOT_FOUND)$/.test(r.outcome ?? "")), (r) => r.outcome)),
     reviewers,
     signals: sortDesc(signals),
+    highStakes: (() => {
+      const high = implement.filter((r) => r.stakes === "high");
+      return { jobs: high.length, reviewed: high.filter((r) => reviewOf(r, records)).length };
+    })(),
+    // How you're set up now: the last 14 days unless a period was asked for.
+    suggestions: computeSuggestions(sinceMs == null ? jobs.filter((r) => Date.parse(r.startedAt ?? "") >= now - SUGGESTION_WINDOW_MS) : jobs, { agentFor }),
+    suggestionWindow: sinceMs == null ? "the last 14 days" : "this period",
   };
 }
 
@@ -183,6 +202,9 @@ export function formatStats(s) {
   const lines = [
     `nomArmy stats${s.repo ? ` for ${s.repo}` : " (all repositories)"}${s.role ? `, role ${s.role}` : ""}${s.model ? `, model ${s.model}` : ""}, ${s.period.from ? `${s.period.from.slice(0, 10)} to ${s.period.to.slice(0, 10)}` : "no jobs"}`,
     "",
+    `SUGGESTIONS (from ${s.suggestionWindow ?? "this period"}; never applied for you)`,
+    ...formatSuggestions(s.suggestions ?? []),
+    "",
     "VOLUME",
     `  Jobs          ${s.volume.jobs}: ${list(s.volume.byMode)}${s.unplacedVerifyRuns ? ` (plus ${s.unplacedVerifyRuns} older verify run(s) that don't record their repository)` : ""}`,
     `  By role       ${list(s.volume.byRole)}`,
@@ -198,6 +220,7 @@ export function formatStats(s) {
     `  Passed, but reverting still passed    ${c.revertStillPassed}${pct(c.revertStillPassed, c.claimedDone)}`,
     `  Passed both                           ${c.passedBoth}${pct(c.passedBoth, c.claimedDone)}`,
     `    of those, flagged by another check  ${c.flaggedAfterPassing} (mutants, Jev, judge, rewritten checks)`,
+    `  High-stakes jobs                      ${s.highStakes?.jobs ?? 0}, ${s.highStakes?.reviewed ?? 0} with an independent review`,
     "  Defects the General found at integration aren't in the records; count them in your own review.",
     "",
     "DIDN'T COMPLETE",

package/lib/suggestions.mjs

@@ -0,0 +1,118 @@
+// Routing suggestions from the job records: which role and model pairings
+// are working, which aren't, and what a change would be. Evidence first,
+// with minimum sample sizes; roles do different work, so a comparison across
+// roles is worded as something to try, not a verdict. Never applied: the
+// operator or the General decides, and each suggestion carries the command.
+
+import { jobRole } from "./stats.mjs";
+
+export const MIN_JOBS = 5;
+const OK = /^(WORKER_DONE|RECOVERED_SUCCESS|SCOUT_DONE|SCOUT_NOT_FOUND|DECOMPOSE_DONE|VERIFIED)$/;
+
+const provider = (r) => r.metrics?.worker_provider ?? r.worker?.provider ?? null;
+const model = (r) => r.metrics?.worker_model ?? r.worker?.model ?? null;
+const agent = (r) => r.labels?.agent ?? null;
+const pct = (n, of) => Math.round((100 * n) / of);
+
+/** Whether a high-stakes job has had an independent review: a scout, or a judge, on another vendor. */
+export function reviewOf(job, records) {
+  const workerProvider = provider(job);
+  const scout = records.find((r) => r.mode === "scout" && r.reviews === job.jobId && provider(r) && provider(r) !== workerProvider);
+  if (scout) return { by: "scout", jobId: scout.jobId, provider: provider(scout) };
+  const judge = job.validators?.judge;
+  if (judge?.answer && judge.provider && judge.provider !== workerProvider) return { by: "judge", provider: judge.provider };
+  return null;
+}
+
+/**
+ * @param {object[]} records this repo's records, already filtered to a period
+ * @returns {{ level: "warn"|"info", key: string, title: string, evidence: string, command: string|null }[]}
+ */
+export function computeSuggestions(records, { minJobs = MIN_JOBS, agentFor = () => null } = {}) {
+  const out = [];
+  const work = records.filter((r) => r.mode === "implement" || r.mode === "scout");
+
+  // Per role and model.
+  const groups = new Map();
+  for (const r of work) {
+    const key = `${jobRole(r) ?? ""}|${model(r) ?? ""}|${r.mode}`;
+    const g = groups.get(key) ?? { role: jobRole(r), model: model(r), mode: r.mode, agent: agent(r), provider: provider(r), jobs: 0, ok: 0, timeout: 0, unsupported: 0, tokens: 0 };
+    g.jobs++; if (OK.test(r.outcome ?? "")) g.ok++;
+    if (r.outcome === "WORKER_TIMEOUT") g.timeout++;
+    if (r.outcome === "SCOUT_UNSUPPORTED") g.unsupported++;
+    g.tokens += r.metrics?.worker_tokens_total ?? 0;
+    g.agent = g.agent ?? agent(r) ?? agentFor(provider(r));
+    groups.set(key, g);
+  }
+  const assign = (g, to = "<another model>") => (g.role ? `nomarmy army assign ${g.role} ${g.agent ?? "<agent>"} ${to}` : null);
+
+  for (const g of groups.values()) {
+    if (!g.model) continue;
+    const kind = g.mode === "scout" ? "scouts" : "implement jobs";
+    const who = g.role ? `${g.role} on ${g.model}` : `${kind} with no role on ${g.model}`;
+    // Scouts that come back empty.
+    if (g.mode === "scout" && g.jobs >= 3 && g.unsupported / g.jobs >= 0.4) {
+      out.push({ level: "warn", key: `scout-unsupported:${g.role}:${g.model}`, title: `${who}: ${g.unsupported} of ${g.jobs} scouts came back unsupported`,
+        evidence: "Their findings couldn't be tied to cited lines. A different agent, or report: full, usually fixes it.", command: assign(g) });
+      continue;
+    }
+    if (g.jobs < minJobs) continue;
+    // A pairing that rarely finishes.
+    if (g.ok / g.jobs < 0.5) {
+      const better = [...groups.values()].filter((o) => o !== g && o.mode === g.mode && o.jobs >= minJobs && o.model && o.ok / o.jobs >= g.ok / g.jobs + 0.2)
+        .sort((a, b) => b.ok / b.jobs - a.ok / a.jobs)[0];
+      out.push({ level: "warn", key: `low-success:${g.role}:${g.model}:${g.mode}`, title: `${who} finished ${g.ok} of ${g.jobs} ${g.role ? kind : ""}`.trim() + ` (${pct(g.ok, g.jobs)}%)`,
+        evidence: (better ? `${better.model} finished ${pct(better.ok, better.jobs)}% of its ${better.jobs} ${kind} here${better.role ? ` (as ${better.role})` : ""}.` : "No other model has enough jobs here to compare.") + (g.role ? "" : " These ran with no army role: send this kind of work to a role on a stronger agent instead."),
+        command: g.role ? assign(g, better?.model ?? "<another model>") : null });
+    }
+    // Timeouts.
+    if (g.timeout >= 3 && g.timeout / g.jobs >= 0.25) {
+      out.push({ level: "info", key: `timeouts:${g.role}:${g.model}`, title: `${who} timed out on ${g.timeout} of ${g.jobs} jobs`,
+        evidence: "Smaller briefs (one outcome each), a longer timeout_seconds, or a faster model would help.", command: null });
+    }
+  }
+
+  // A lighter model doing as well on implement work, for much less.
+  const impl = [...groups.values()].filter((g) => g.mode === "implement" && g.model && g.jobs >= minJobs && g.tokens > 0);
+  for (const heavy of impl) {
+    for (const light of impl) {
+      if (light === heavy || light.model === heavy.model) continue;
+      const lightRate = light.ok / light.jobs, heavyRate = heavy.ok / heavy.jobs;
+      if (lightRate >= heavyRate - 0.05 && light.tokens / light.jobs <= 0.5 * (heavy.tokens / heavy.jobs)) {
+        out.push({ level: "info", key: `lighter:${heavy.role}:${heavy.model}:${light.model}`,
+          title: `${light.model} finished ${pct(light.ok, light.jobs)}% of its jobs${light.role ? ` (as ${light.role})` : ""} on ${Math.round((light.tokens / light.jobs) / 1000)}k tokens a job; ${heavy.model}${heavy.role ? ` (as ${heavy.role})` : ""} finished ${pct(heavy.ok, heavy.jobs)}% on ${Math.round((heavy.tokens / heavy.jobs) / 1000)}k`,
+          evidence: "They did different work, so try it rather than switch outright: put the role on auto so the General picks per job, or send its routine pieces to the lighter model.",
+          command: heavy.role ? `nomarmy army assign ${heavy.role} ${heavy.agent ?? "<agent>"} auto` : null });
+      }
+    }
+  }
+
+  // Where the money goes.
+  const spend = new Map();
+  for (const r of work) if (Number.isFinite(r.metrics?.worker_cost_usd) && r.metrics.worker_cost_usd > 0) spend.set(model(r), (spend.get(model(r)) ?? 0) + r.metrics.worker_cost_usd);
+  const total = [...spend.values()].reduce((a, b) => a + b, 0);
+  const [top, topUsd] = [...spend.entries()].sort((a, b) => b[1] - a[1])[0] ?? [];
+  if (top && topUsd >= 5 && topUsd / total >= 0.5) {
+    out.push({ level: "info", key: `spend:${top}`, title: `${top} is ${pct(topUsd, total)}% of API spend ($${topUsd.toFixed(2)} of $${total.toFixed(2)})`,
+      evidence: "Worth knowing rather than changing if it's catching real problems; check its reviews' findings before moving it.", command: null });
+  }
+
+  // High-stakes work without an independent review.
+  const unreviewed = records.filter((r) => r.mode === "implement" && r.stakes === "high" && !reviewOf(r, records));
+  if (unreviewed.length) {
+    out.push({ level: "warn", key: `unreviewed:${unreviewed.map((r) => r.jobId).sort().join(",")}`, title: `${unreviewed.length} high-stakes job(s) without an independent review: ${unreviewed.slice(0, 5).map((r) => r.jobId).join(", ")}`,
+      evidence: "Send a scout on another vendor with reviews: <job id> before accepting them (or configure a judge on another vendor).", command: null });
+  }
+  return out;
+}
+
+/** This repository's suggestions from its last 14 days of jobs. */
+export function recentSuggestions(records, { projectDir, agentFor = () => null, now = Date.now(), days = 14 } = {}) {
+  const since = now - days * 86400000;
+  return computeSuggestions(records.filter((r) => r.projectDir === projectDir && Date.parse(r.startedAt ?? "") >= since), { agentFor });
+}
+
+export function formatSuggestions(list) {
+  if (!list.length) return ["  none: nothing in the records suggests a routing change"];
+  return list.flatMap((s) => [`  ${s.level === "warn" ? "!" : "-"} ${s.title}`, `    ${s.evidence}`, ...(s.command ? [`    ${s.command}`] : [])]);
+}

package/lib/transcript.mjs

@@ -99,6 +99,9 @@ export function summarizeTranscriptEvents(events) {
     }
   }
   out.filesRead = [...new Set(out.filesRead)];
+  // A tool call with no result yet: the worker is waiting on it (a long test
+  // run writes nothing to the transcript until it returns).
+  out.toolInFlight = pending.length > 0;
   return out;
 }
 

package/mcp/server.mjs

@@ -36,7 +36,9 @@ import { readUsageSnapshots, usageStatus } from "../lib/usage-limits.mjs";
 import { modelRefusals } from "../lib/health.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
 import { restartNotice } from "../lib/install-freshness.mjs";
-import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo } from "../lib/stats.mjs";
+import { requestJobStop } from "../lib/openclaw-run.mjs";
+import { loadJobRecords, computeStats, formatStats, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
+import { recentSuggestions } from "../lib/suggestions.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { jevSettings, judgeSettings } from "../lib/validators.mjs";
 import { agentRunsToolsOnHost } from "../lib/dispatch-schema.mjs";
@@ -301,6 +303,8 @@ export const jobSchema = z.object({
   model: z.string().regex(/^\S{1,200}$/).optional().describe("The model to run on the job's agent (an api or subscription agent), e.g. \"gpt-6-sol\". Overrides the role's model and the agent's default. Required when the role's model is \"auto\" or the agent has no default. The `army` tool lists each agent's models. Refused on the local agent, whose model `nomarmy model` sets."),
   run_id: z.string().regex(/^run-[a-z0-9-]{1,80}$/).optional().describe("The /feature run this job belongs to (from run_start). Admission then enforces the run's limits (jobs, api spend, hours) and refuses an agent the run has paused after a vendor usage-limit error; the finished job is recorded into the run."),
   report: z.enum(["brief", "standard", "full"]).optional().describe("How much the worker may report back, capped by its agent's tier: brief (today's local-sized report), standard (the default), full (the frontier ceiling: about 2k tokens for implement, 4k for a scout). An api or subscription scout defaults to full because its findings are the point; other jobs default to standard. The report lands in your own context and is re-read every later turn. No effect on the local model, whose caps are calibrated."),
+  stakes: z.enum(["normal", "high"]).optional().describe("implement: how much a mistake would cost, separate from how hard the work is. high for anything touching security or access control, personal or tenant data, data loss, money, or changes that can't be undone: a verification profile is then required, the revert check can't be turned off, and the job always comes back needing review until an independent review (a scout on another vendor with reviews: <job id>, or a judge on another vendor) has looked at it. A one-line auth change is simple and high-stakes."),
+  reviews: z.string().regex(/^[A-Za-z0-9._-]{1,120}$/).optional().describe("scout: the job id this scout independently reviews, so the review is recorded against that job (nomarmy stats shows high-stakes jobs with and without one). Use a different vendor than the job's worker."),
   commit_subject: z.string().max(200).optional().describe("implement: the subject line of the commit nomArmy makes on the worker branch, e.g. \"Keep held-back tables in the list_tables cache\". Defaults to the task's first sentence; the body is the worker's NOTE, and the job id is a trailer."),
   army_role: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/).optional().describe("Dispatch by army role (e.g. \"sr-dev\", \"security-analyst\"): nomArmy runs it on the agent this repo assigns to that role and puts the role's description at the top of the brief. Call the `army` tool first to see this repo's roles. Mutually exclusive with agent. Add on_behalf_of in case the role's agent is a subscription; it's ignored otherwise."),
   confirm_over_limit: z.boolean().optional().describe("Override a reached usage limit: the General must ask the operator before resubmitting with confirm_over_limit: true, or send the job to another agent. nomArmy never sets it itself."),
@@ -352,7 +356,7 @@ function jobArgs(args, workerId) {
   return { task: args.task, acceptance: args.acceptance, verification: args.verification, mode: args.mode, baseRef: args.base_ref,
     timeoutSeconds: args.timeout_seconds, profile: args.profile, reasoning: args.reasoning, pool: args.pool,
     subscriptionWorker, onBehalfOf: args.on_behalf_of, model: args.model ?? null, reportSize: args.report ?? null, evidence: args.evidence,
-    verifyRegression: resolveVerifyRegression(args), commitSubject: args.commit_subject ?? null, refactor: Boolean(args.refactor), continueFrom: args.continue_from ?? null, workerId };
+    verifyRegression: resolveVerifyRegression(args), commitSubject: args.commit_subject ?? null, refactor: Boolean(args.refactor), continueFrom: args.continue_from ?? null, stakes: args.stakes ?? null, reviews: args.reviews ?? null, workerId };
 }
 server.tool("local_worker", "Run one isolated local worker and wait for it. mode=implement edits in its own worktree and the coordinator commits only on a valid done report (or a recovered job that passed independent verification); failed or incomplete worktrees are retained. mode=scout answers a question from a read-only snapshot with mandatory [path:line] citations that nomArmy verifies and expands. mode=decompose (also read-only) proposes 2+ independent subtasks for a broad objective instead of one worker turn trying to do too much; the proposal is never auto-dispatched, review it and make a separate call with the subtasks you choose. Refuses under memory pressure or over capacity; use local_worker_start + local_worker_status to avoid blocking.", jobSchema.shape,
   async rawArgs => {
@@ -438,11 +442,21 @@ server.tool("stats", "What nomArmy's own job records show for this repository (o
 }, async ({ since, until, all_repos, repo, role, model, format }) => {
   try {
     const records = loadJobRecords(jobsRoot);
-    const stats = computeStats(records, { repo: repo ? resolveRepo(records, repo) : all_repos ? null : projectDir, sinceMs: parseSince(since), untilMs: parseSince(until), role: role ?? null, model: model ?? null });
+    let agentFor = () => null;
+    try { agentFor = agentLookup(agentsConfig().agents, agentProviderId); } catch { /* commands name <agent> */ }
+    const stats = computeStats(records, { repo: repo ? resolveRepo(records, repo) : all_repos ? null : projectDir, sinceMs: parseSince(since), untilMs: parseSince(until), role: role ?? null, model: model ?? null, agentFor });
     return toolText(format === "json" ? JSON.stringify(stats, null, 2) : formatStats(stats));
   } catch (error) { return toolText(error.message, true); }
 });
 
+server.tool("local_worker_stop", "Stop a running job's worker, for example one burning a frontier model's usage on the wrong track. Its worker ends within about 15 seconds, without the report-recovery call a timeout gets and without running verification; its worktree is kept uncommitted, so a new job with continue_from: <job_id> (and a cheaper model if you like) can finish the work. Works for a job started by any session. Refuses a job that isn't running or is already past its worker.", {
+  job_id: z.string().regex(/^[A-Za-z0-9._-]{1,120}$/),
+  reason: z.string().max(300).optional().describe("Why it's being stopped; recorded in the job's issues."),
+}, async ({ job_id, reason }) => {
+  const r = requestJobStop({ jobsRoot, jobId: job_id, reason: reason ?? null });
+  return toolText(r.message, !r.ok);
+});
+
 server.tool("local_worker_capacity", "What this host can take right now: context per nom and the brief/report budgets derived from it, memory pressure and whether another job would be admitted, and the jobs currently running. Read-only.", {}, async () => {
   await budgetState.refresh();
   return toolText(JSON.stringify(withRestartNotice(capacitySnapshot()), null, 2));
@@ -552,6 +566,12 @@ server.tool("army", "Who you, the General, are and who you call for what in this
         role.modelNote = `${role.model} isn't in OpenClaw's catalog for ${role.agent}; \`army assign\` checked it with a real test call when it was set, and the catalog can lag new models. Use it as assigned; if a job reports "Unknown model", reassign.`;
       }
     }
+    // Routing suggestions from this repo's recent jobs (lib/suggestions.mjs):
+    // tell the operator about them; never apply one without their say-so.
+    try {
+      const list = recentSuggestions(loadJobRecords(jobsRoot), { projectDir, agentFor: agentLookup(agents, agentProviderId) });
+      if (list.length) summary.suggestions = { note: "From this repo's last 14 days of jobs. Tell the operator; change routing only with their say-so (nomarmy army assign).", items: list.map(({ level, title, evidence, command }) => ({ level, title, evidence, command })) };
+    } catch { /* suggestions are a bonus; the army summary stands without them */ }
     return toolText(JSON.stringify(withRestartNotice(summary), null, 2));
   } catch (error) {
     return toolText(error.message, true);

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.14",
   "private": false,
   "type": "module",
   "engines": {

package/playbooks/feature.md

@@ -12,9 +12,10 @@ You are the General. Build this feature end to end with nomArmy's army and come
 
 Follow the army's workflow, calling only the roles the work needs:
 
+0. **Routing.** The `army` tool's `suggestions` come from this repo's recent jobs (a role that keeps failing, a cheaper model doing as well, unreviewed high-stakes work). Tell the operator about any at the start and in your final summary; change routing only if they say so.
 1. **Plan.** Scout the repo as needed (`repo_evidence` first; a scout only for research that would pull many files into your context). Write the plan into the run log: the outcome, acceptance criteria, the pieces, and which role gets each.
-2. **Build.** Dispatch with `army_role` (and `on_behalf_of` when the role's agent is a subscription). The Sr Dev takes the core and harder work; the Jr Dev takes simple, fully specified pieces; UI/UX takes UI. For a role on `auto`, pick the model from the agent's list in the `army` tool: the lighter model for routine work, the frontier one for subtle work.
-3. **Review.** When the build is in, call the specialists that apply (data architect for data work, security analyst for anything touching auth, input, secrets or data exposure), then the PM against the plan. Send what they find back to the builders as new, bounded jobs. A build job that comes back partial, blocked or failing verification is finished with `continue_from: <its job id>` and a brief of just the correction, never by fixing its files yourself: only verified work lands.
+2. **Build.** Dispatch with `army_role` (and `on_behalf_of` when the role's agent is a subscription). The Sr Dev takes the core and harder work; the Jr Dev takes simple, fully specified pieces; UI/UX takes UI. For a role on `auto`, pick the model from the agent's list in the `army` tool: the lighter model for routine work, the frontier one for subtle work. Mark a job `stakes: high` when a mistake would be costly (security or access control, personal or tenant data, data loss, money, anything irreversible), however small the change: that's separate from how hard it is.
+3. **Review.** When the build is in, call the specialists that apply (data architect for data work, security analyst for anything touching auth, input, secrets or data exposure), then the PM against the plan. Every `stakes: high` build job gets an independent review before you accept it: a scout on a different vendor than its worker, with `reviews: <that job id>`. Send what they find back to the builders as new, bounded jobs. A build job that comes back partial, blocked or failing verification is finished with `continue_from: <its job id>` and a brief of just the correction, never by fixing its files yourself: only verified work lands.
 4. **Acceptance.** PO and stakeholder test end to end. Checks that only run existing tests use mode: verify; writing new e2e checks is still an implement job. Fix what they find the same way.
 5. **Integrate.** Review every diff against nomArmy's verified record -- a worker's report is a claim, not evidence -- and bring the accepted work together on one branch. **Never merge into the developer's branch, and never push.** The finished state is a branch ready for the operator to review and merge.
 
@@ -26,7 +27,7 @@ Stop and ask only for something irreversible or outside this repository: merging
 
 ## Watching jobs
 
-Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. `nomarmy jobs --events` remains available for a stream covering every job. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
+Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. For several jobs at once, `nomarmy jobs --events --until-done` exits when every one has finished. The plain `nomarmy jobs --events` stream never exits on its own while jobs run, so don't run it as a background command (you'd only hear when it exits); use it only with a monitor that wakes on each line. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
 
 ## Limits