nomarmy 0.1.0-alpha.20 → 0.1.0-alpha.22

package/bin/nomarmy.mjs

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import { acknowledgeTrust, collectReviewEvidence, trustSuggestions, reviewTrustLearning, trustAcknowledgment } from "../lib/trust-learning.mjs";
+import { writeTrustScoutBrief, writeTrustProposal, loadTrustProposal, trustProposalOrigins } from "../lib/trust-map.mjs";
+import { fillAcceptance, gatherAcceptanceProposals } from "../lib/acceptance-fill.mjs";
 // nomArmy CLI. Every command proposes before it writes anything -- init,
 // setup, model and update all show exactly what would change and write only
 // after explicit confirmation ([y/N]) or an explicit non-interactive flag
@@ -9,10 +12,12 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { execHostGitSync, spawnHostGitSync } from "../lib/worktree-pointer.mjs";
 import { spawn, spawnSync, execFileSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { loadConfig, validateConfig, stringifyConfig, findConfigFile, parseYaml, CONFIG_FILENAMES } from "../lib/config.mjs";
+import { loadContract, loadContracts, checkContract, contractDisplayPath } from "../lib/acceptance.mjs";
 import { scanRepository, compareEvidence } from "../lib/scan.mjs";
 import { buildConfigProposal } from "../lib/propose.mjs";
 import { detectHardware } from "../lib/hardware.mjs";
@@ -24,23 +29,24 @@ import { connectViaWsl, connectClaude, connectCodex, connectCursor, cursorAlread
 import { compareVersions, readPackageVersion, readInstallVersions, copyIsStale } from "../lib/install-freshness.mjs";
 import { loadJobRecords, computeStats, formatStats, formatStatsSummary, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
 import { requestJobStop } from "../lib/openclaw-run.mjs";
-import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings, judgeAgentChoices, chooseJudgeAgent, confirmJudgeHostTools } from "../lib/validators.mjs";
+import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings, judgeAgentChoices, chooseJudgeAgent, confirmJudgeHostTools, validatorTrustDisclosure } from "../lib/validators.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
 import { loadAgents, readAgentsFile, writeAgentsFile, agentsConfigPath, apiAgentAsPoolEntry, describeAgent as describeAgentLabel, agentRunsToolsOnHost, agentProviderId, AGENT_KINDS, API_PROVIDER_TYPES, RESERVED_AGENT_NAMES, BUILTIN_LOCAL_AGENT } from "../lib/agents.mjs";
 import { loadArmy, mergeArmy, describeArmy, readArmyFile, updateArmyInFile, assignRoleInFile, parseTargetSpec, armyLayerPath, globalConfigDir, DEFAULT_ARMY, ARMY_PHASES, LOCAL_CONFIG_FILENAME } from "../lib/army.mjs";
 import { parseLlamaUrl } from "../lib/execution.mjs";
 import { setupSteps, formatSetupSteps, runSetupPlaybook } from "../lib/setup-steps.mjs";
-import { readUsageSnapshots } from "../lib/usage-limits.mjs";
+import { readUsageSnapshots, refreshStaleOverLimitReadings } from "../lib/usage-limits.mjs";
 import { pickMachine, planResize } from "../lib/sandbox-vm.mjs";
 import { listProcesses, staleSessions, formatStaleSessions } from "../lib/stale-sessions.mjs";
 import { readSetting, writeSetting, writeEnvLine, userCommonPath, userProfilePath, profilePathFor, tildePath } from "../lib/user-config.mjs";
 import { MIN_PODMAN_VM_MB } from "../lib/doctor.mjs";
 import { liveLeases } from "../lib/slots.mjs";
 import { ensureProviderConfig } from "../lib/openclaw-config.mjs";
-import { recordProbeSuccess, parseOpenclawAuthProfiles } from "../lib/health.mjs";
+import { linkCodex } from "../lib/codex-link.mjs";
+import { recordProbeSuccess, parseOpenclawAuthProfiles, codexImportRecovery } from "../lib/health.mjs";
 import { pruneJobRuntime } from "../lib/prune.mjs";
-import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
+import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, openclawSignInFailure, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
 import { PINNED_OPENCLAW_VERSION, repairOpenclaw, verifyOpenclaw, configuredSubscriptionVendors } from "../lib/openclaw-install.mjs";
 import { ensureOpenClawOnPath } from "../lib/openclaw-path.mjs";
 import { THINKING_LEVELS } from "../lib/thinking.mjs";
@@ -115,6 +121,11 @@ function usage(code = 0) {
 
 Usage: nomarmy <command> [options]
 
+  acceptance fill <run-id|job-id> [--dry-run] [--json]
+                  Append proposed test proofs to feature contracts.
+  acceptance check [file...] [--json] [--strict]
+                  Check feature contracts in acceptance/*.yml; runs this repository's tests on this machine.
+                  --strict fails on unproven criteria as well as broken or missing.
   scan            Inspect this repository and report its execution environment.
                   --check   compare the evidence against a committed .nomarmy.yml
   init            Propose a .nomarmy.yml from this repository's scan evidence
@@ -145,6 +156,11 @@ Usage: nomarmy <command> [options]
   update          Update nomArmy and reconnect your coordinators: installs
                   npm's latest alpha, or for a git checkout pulls (fast-forward
                   only; refuses on local changes). Then restart open sessions.
+  trust map       Write a read-only review scout brief for the General.
+                  --from <scout.yml> --scout-job <job-id> records the cited scout origin.
+  trust review    Accept, drop or edit scout and evidence-backed proposals.
+                  --json lists; --accept-all or --decisions '<JSON array>' writes.
+  trust ack <job> --accept|--reject [--reason "text"]  Sign off a human gate.
   agents <list|add|update|remove>
                   Every account a job can run on, in one list:
                   ~/.config/nomarmy/agents.yml (or NOMARMY_CONFIG_DIR).
@@ -174,7 +190,13 @@ Usage: nomarmy <command> [options]
                             --model --auth-env [--base-url]
                             [--openclaw-provider --plugin] [--register]
                             [--update-mcp] (api); --provider --model
-                            --owner (subscription); and optionally
+                            --owner (subscription). Codex JSON setup can
+                            --link-openclaw after CLI login; removing a
+                            capturing email profile non-interactively needs
+                            --remove-email-profiles. Interactive Codex setup
+                            asks before copying the CLI login (default yes),
+                            and offers email-profile removal separately.
+                            For any kind, optionally
                             --max-concurrent --context-window
                             --thinking [minimal|low|medium|high|xhigh|adaptive|max|ultra] --no-thinking
                   update <name>
@@ -186,7 +208,7 @@ Usage: nomarmy <command> [options]
                             --no-model clears the default model, so every
                             role or job names its own.
                             (--json with the matching flags; --probe to
-                            test-call a subscription's new model first)
+                            test-call the agent; without a name, all agents)
                   remove <name>
                             remove one agent
   army <show|init|assign|general>
@@ -1256,6 +1278,7 @@ function catalogModelsFor(provider) {
 /** One real, one-token completion through OpenClaw to test a model. */
 // Why the last probeWorker() call failed, in the vendor's words when it said.
 let lastProbeFailure = null;
+let lastProbeText = "";
 function probeWorker(provider, model) {
   // The route a job takes: the ambient OpenClaw config and a state dir of
   // its own, never --isolated. --isolated skips that config, and with it the
@@ -1271,7 +1294,10 @@ function probeWorker(provider, model) {
       "--json", "--cwd", cwd, "--state-dir", stateDir, "--timeout", "90"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], cwd });
     // Streams kept apart: OpenClaw logs a "run ... ended" line to stderr
     // AFTER the JSON envelope, and the merged text doesn't parse.
-    const outcome = probeOutcome({ stdout: result.stdout ?? "", stderr: result.stderr ?? "" });
+    const stdout = result.stdout ?? "";
+    const stderr = result.stderr ?? "";
+    const outcome = probeOutcome({ stdout, stderr });
+    lastProbeText = `${stderr}\n${stdout}`;
     lastProbeFailure = outcome.ok ? null : outcome.reason;
     if (outcome.ok) recordProbeSuccess(agentStateRoot(), `${provider}/${model}`);
     return outcome.ok;
@@ -1303,10 +1329,15 @@ function reapProbeSandbox(stateDir) {
 /**
  * OpenClaw's own provider login, for the vendors whose plugin wants one on
  * top of the vendor CLI's login (Claude doesn't: OpenClaw reuses the CLI
- * session directly). Run when the catalog or auth-profile check shows
- * linking is needed, never preemptively.
+ * session directly). Codex always refreshes its imported copy after CLI
+ * login is confirmed; other providers link when catalog or auth checks fail.
  */
-function openclawProviderLogin(vendor) {
+async function openclawProviderLogin(vendor, rl) {
+  if (vendor === SUBSCRIPTION_VENDORS.codex) return linkCodex({
+    run: runQuiet, command: openclawCmd(), isTTY: Boolean(input.isTTY),
+    importLogin: flag("link-openclaw"), removeEmailProfiles: flag("remove-email-profiles"),
+    confirm: (prompt, opts) => confirm(rl, prompt, opts), print: (message) => console.log(c.dim(message)),
+  });
   const provider = vendor.credential.loginProvider ?? vendor.provider;
   console.log(c.dim(`Linking OpenClaw to it (\`openclaw models auth login --provider ${provider}\`) -- follow its prompts:`));
   const ok = runInteractive(openclawCmd(), ["models", "auth", "login", "--provider", provider]);
@@ -1542,7 +1573,7 @@ async function addApiAgent(rl, agents) {
 const OWNER_EMAIL_RE = /^[^@\s]+@[^@\s]+$/;
 function validOwnerEmail(email) { return typeof email === "string" && OWNER_EMAIL_RE.test(email); }
 function gitUserEmail() {
-  const result = spawnSync("git", ["config", "user.email"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  const result = spawnHostGitSync(repoDir, ["config", "user.email"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   const email = result.status === 0 ? result.stdout.trim() : "";
   return validOwnerEmail(email) ? email : "";
 }
@@ -1575,16 +1606,23 @@ async function addSubscriptionAgent(rl, agents) {
   console.log(`\n${c.bold("→")} Models`);
   const needsOpenclawLogin = vendor.credential.kind === "openclaw-login";
   let linkedOpenclaw = false;
+  if (vendorKey === "codex") {
+    linkedOpenclaw = await openclawProviderLogin(vendor, rl);
+    if (!linkedOpenclaw) {
+      console.log(c.red("✗ Sign-in has no usable auth profile. Retry with `nomarmy agents add subscription codex`."));
+      process.exitCode = 1; return;
+    }
+  }
   let models = catalogModelsFor(vendor.provider);
-  if (!models.length && needsOpenclawLogin) {
-    linkedOpenclaw = openclawProviderLogin(vendor);
+  if (!models.length && needsOpenclawLogin && !linkedOpenclaw) {
+    linkedOpenclaw = await openclawProviderLogin(vendor, rl);
     if (!linkedOpenclaw) { console.log(c.red(`✗ Sign-in failed or was canceled. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); process.exitCode = 1; return; }
     models = catalogModelsFor(vendor.provider);
   }
   // Catalog entries can be cached, and a particular model can refuse a
   // working login. Check OpenClaw's auth profile before asking for details.
   if (needsOpenclawLogin && !hasUsableOpenclawAuthProfile(vendor.provider)) {
-    if (linkedOpenclaw || !openclawProviderLogin(vendor) || !hasUsableOpenclawAuthProfile(vendor.provider)) {
+    if (linkedOpenclaw || !(await openclawProviderLogin(vendor, rl)) || !hasUsableOpenclawAuthProfile(vendor.provider)) {
       console.log(c.red(`✗ Sign-in has no usable auth profile. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`));
       process.exitCode = 1;
       return;
@@ -1598,7 +1636,8 @@ async function addSubscriptionAgent(rl, agents) {
   const pick = (await rl.question(c.bold(`Default model, optional${models.length ? " (a number or an id)" : ""}; blank = pick per role: `))).trim();
   const model = /^\d+$/.test(pick) && models.length ? models[Number(pick) - 1] : pick || null;
   if (pick && !model) throw new Error(`Not a valid choice: "${pick}".`);
-  // The test call needs some model; it checks the model, not the login.
+  // A usable profile is only a fast precondition. The test call is what
+  // proves sign-in: an unexpired Codex import can still answer 401.
   const probeModel = model ?? models[0] ?? vendor.defaultModel;
 
   const ownerDefault = validOwnerEmail(auth.email) ? auth.email : gitUserEmail();
@@ -1611,9 +1650,17 @@ async function addSubscriptionAgent(rl, agents) {
   if (!name) { console.log(c.dim("Stopped; nothing was written.")); return; }
 
   console.log(`\n${c.bold("→")} Test call`);
-  const works = probeModel ? probeWorker(vendor.provider, probeModel) : false;
+  const probed = Boolean(probeModel);
+  const works = probed ? probeWorker(vendor.provider, probeModel) : false;
   if (works) console.log(c.green(`✓ ${vendor.provider}/${probeModel} answered a real test prompt.`));
-  else {
+  else if (needsOpenclawLogin && probed && openclawSignInFailure(`${lastProbeFailure ?? ""}\n${lastProbeText}`)) {
+    const why = lastProbeFailure ? `: ${lastProbeFailure}` : "";
+    console.log(c.red(`✗ Sign-in failed${why}.`));
+    console.log(`  fix: ${codexImportRecovery()}`);
+    console.log(c.dim("Stopped; nothing was written."));
+    process.exitCode = 1;
+    return;
+  } else {
     console.log(c.yellow(probeModel ? `⚠ The login works, but ${vendor.provider}/${probeModel} didn't answer a real test prompt.` : "⚠ The login works, but no model is available for a test call."));
     console.log(c.dim(`You can retry later with \`nomarmy agents update ${name} --probe\`.`));
     if (!(await confirm(rl, "Save the agent anyway?", { defaultYes: false }))) {
@@ -1648,6 +1695,17 @@ async function cmdAgentsAddJson() {
     const thinking = resolveThinkingFlag();
     if (thinking !== undefined) agent.thinking = thinking;
   }
+  if (kind === "subscription" && agent.provider === "openai" && (flag("link-openclaw") || flag("remove-email-profiles"))) {
+    if (!readLoginStatus("codex").loggedIn) throw new Error("Confirm Codex CLI login first: codex login");
+    const linked = await linkCodex({ run: runQuiet, command: openclawCmd(),
+      importLogin: flag("link-openclaw"), removeEmailProfiles: flag("remove-email-profiles"), print: (message) => console.error(message) });
+    if (!linked) throw new Error(flag("link-openclaw")
+      ? "Codex import failed; nothing was written."
+      : "Codex login was not imported: pass --link-openclaw to authorize copying it into OpenClaw. Nothing was written.");
+    if (!probeWorker("openai", agent.model ?? SUBSCRIPTION_VENDORS.codex.defaultModel)) {
+      throw new Error(`Codex test call failed; nothing was written. Fix: ${codexImportRecovery()}`);
+    }
+  }
   const written = saveAgents({ ...agents, [name]: agent });
   const saved = written[name];
   let registered = null, mcpUpdated = false;
@@ -1730,7 +1788,7 @@ async function cmdAgentsUpdate() {
     if (flag("owner") || value("owner") !== null || value("provider") !== null || value("kind") !== null) {
       throw new Error("Kind, provider and owner can't be changed -- that's a different agent. Use `nomarmy agents add`.");
     }
-    probe = flag("probe") && current.kind === "subscription";
+    probe = flag("probe");
     if (!Object.keys(changes).length && !probe) throw new Error("Nothing to update -- pass at least one field flag (see `nomarmy agents update` usage).");
   } else {
     if (!process.stdin.isTTY) throw new Error("nomarmy agents update needs an interactive terminal, or the flags to change (e.g. --max-concurrent 3).");
@@ -1779,7 +1837,7 @@ async function cmdAgentsUpdate() {
   }
 
   if (probe && !Object.keys(changes).length) { probeConfiguredAgent(name, current); return; }
-  if (probe && changes.model && !probeWorker(current.provider, changes.model)) {
+  if (probe && changes.model && !probeWorker(agentProviderId(current), changes.model)) {
     out({ error: `a real test prompt to ${current.provider}/${changes.model} didn't come back -- nothing was written` });
     process.exit(1);
   }
@@ -1802,7 +1860,7 @@ async function cmdAgents() {
 }
 
 function git(args) {
-  try { return execFileSync("git", args, { cwd: nomarmyRoot, encoding: "utf8" }).trim(); }
+  try { return execHostGitSync(nomarmyRoot, args, { cwd: nomarmyRoot, encoding: "utf8" }).trim(); }
   catch (error) { throw new Error(`git ${args.join(" ")} failed: ${error.stderr ? String(error.stderr).trim() : error.message}`); }
 }
 
@@ -1988,7 +2046,7 @@ async function cmdConnect() {
   if (nativeWindows && flag("copy-only")) throw new Error("Windows runs nomArmy inside WSL; run nomarmy connect <target> instead of --copy-only");
   let projectDir = null;
   if (scope !== "user") {
-    try { projectDir = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
+    try { projectDir = execHostGitSync(repoDir, ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
     catch { throw new Error(`--scope ${scope} registers nomArmy for one repository, and ${repoDir} isn't inside a git repository. Run it from the repository (or pass --repo <dir>).`); }
   }
   if (flag("copy-only")) {
@@ -2405,7 +2463,7 @@ function armyLayerFlag(fallback = "global") {
   return chosen[0] ?? fallback;
 }
 
-function loadArmyForCli({ globalOnly = false } = {}) {
+function loadArmyForCli({ globalOnly = false, usageRefresh = null } = {}) {
   const agents = loadAgentsOrExit().agents;
   const loaded = globalOnly
     ? (() => {
@@ -2414,8 +2472,8 @@ function loadArmyForCli({ globalOnly = false } = {}) {
         return { ...mergeArmy([{ layer: "global", army }]), layers: [{ layer: "global", path: filePath, exists: fs.existsSync(filePath), hasArmy: Boolean(army) }] };
       })()
     : loadArmy({ projectDir: repoDir });
-  const usageSnapshots = readUsageSnapshots(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
-  return { loaded, agents, summary: describeArmy(loaded, { agents, describeAgent: describeAgentLabel, usageSnapshots, agentProviderId }) };
+  const usageSnapshots = usageRefresh?.snapshots ?? readUsageSnapshots(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
+  return { loaded, agents, summary: describeArmy(loaded, { agents, describeAgent: describeAgentLabel, usageSnapshots, agentProviderId, usageRefreshError: usageRefresh?.error ?? null, usageRefreshFailed: usageRefresh?.failedProviders ?? null }) };
 }
 
 // Claude Code adds settings.local.json to .gitignore for the same reason:
@@ -2453,7 +2511,9 @@ function repositoryHere(dir) {
 
 async function cmdArmyShow() {
   const inRepository = repositoryHere(repoDir);
-  const { summary } = loadArmyForCli({ globalOnly: !inRepository });
+  const stateRoot = process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents");
+  const usageRefresh = await refreshStaleOverLimitReadings(stateRoot);
+  const { summary } = loadArmyForCli({ globalOnly: !inRepository, usageRefresh });
   if (json) return out(summary);
   const g = summary.general;
   console.log(c.bold("🪖 nomArmy") + (inRepository ? c.dim(`  (${repoDir})`) : ""));
@@ -2727,6 +2787,7 @@ function collectJobs({ recent = 8, runId = null, projectDir = null } = {}) {
       lastTool: status.lastTool ? `${status.lastTool.tool}${status.lastTool.target ? ` ${String(status.lastTool.target).slice(0, 40)}` : ""}` : null,
       filesChanged: status.filesChangedLive ?? meta?.git?.filesChanged?.length ?? null,
       heartbeatAgeSeconds: status.heartbeatAt ? Math.round((Date.now() - Date.parse(status.heartbeatAt)) / 1000) : null,
+      ...(meta?.trust ? { trust: meta.trust } : {}),
       started, dir,
     };
   }).filter(Boolean).sort((a, b) => b.started - a.started);
@@ -2746,6 +2807,10 @@ function renderJobs({ running, recent }) {
   }
   lines.push("", c.bold("Recent"));
   for (const j of recent) lines.push(`  ${j.jobId.padEnd(40)} ${String(j.phase).padEnd(20)} ${fmtSeconds(j.elapsedSeconds).padStart(7)}  ${c.dim(`${j.agent ?? ""}${j.model ? `/${j.model}` : ""}`)}`);
+  for (const j of [...running, ...recent]) if (j.trust?.level === "human") {
+    const ack = trustAcknowledgment(j.trust);
+    lines.push(`  ${j.jobId}: human review ${ack ? `acknowledged (${ack.decision}) by ${ack.who} at ${ack.when}${ack.reason ? `: ${ack.reason}` : ""}` : "pending"}`);
+  }
   return lines.join("\n");
 }
 
@@ -2920,6 +2985,7 @@ async function cmdHealth() {
   const { checkAndRecordHealth } = await import("../lib/health.mjs");
   const stateRoot = process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents");
   const { result } = await checkAndRecordHealth({ projectDir: repoDir, stateRoot, configDir: globalConfigDir(), env: installEnv() });
+  if (result.issues.some((i) => i.severity === "error")) process.exitCode = 1;
   if (json) return out(result);
   console.log(c.bold("🍪 nomArmy health") + c.dim(`  ${new Date(result.checkedAt).toLocaleString()}`));
   if (!result.issues.length) { console.log(c.green("\n✓ Nothing to fix.")); return; }
@@ -2947,7 +3013,7 @@ async function shareStats(stats) {
   if (flag("share")) console.log(shareMarkdown(stats, { scope }));
   if (flag("badge")) {
     const given = value("badge");
-    const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    const top = spawnHostGitSync(process.cwd(), ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
     const root = top.status === 0 ? top.stdout.trim() : process.cwd();
     const file = path.resolve(root, given ?? path.join(".github", "nomarmy-badge.svg"));
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -2964,7 +3030,7 @@ function cmdStats() {
   let repo = null;
   if (value("repo")) repo = resolveRepo(records, value("repo"));
   else if (!flag("all-repos")) {
-    try { repo = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
+    try { repo = execHostGitSync(repoDir, ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
     catch { throw new Error(`${repoDir} isn't inside a git repository; run nomarmy stats from one, or pass --repo <name> or --all-repos`); }
   }
   let agentFor = () => null;
@@ -3010,10 +3076,18 @@ async function cmdValidators() {
     try { config = loadValidators(); } catch (error) { if (json) return out({ error: error.message }); console.log(c.red(error.message)); process.exitCode = 1; return; }
     const judge = config.judge ? { enabled: config.judge.enabled, agent: config.judge.agent, model: config.judge.model, checks: config.judge.checks, hostTools: config.judge.host_tools } : null;
     const jev = config.jev ? { enabled: config.jev.enabled, checks: config.jev.checks, model: config.jev.model, key: config.jev.key_env ? `env ${config.jev.key_env}` : config.jev.key_file, keyReadable: Boolean(jevSettings()) } : null;
+    if (jev) jev.trustJudgment = validatorTrustDisclosure("Jev", "TypeSafe");
+    if (judge) {
+      const agents = loadAgents(globalConfigDir()).agents;
+      const vendor = agentProviderId(agents[judge.agent]) ?? `the configured vendor for agent "${judge.agent}" (agent unavailable)`;
+      judge.trustJudgment = validatorTrustDisclosure("the judge", vendor);
+    }
     if (json) return out({ path: validatorsPath(), jev, judge });
     if (!jev && !judge) { console.log("No validators configured. Add one with: nomarmy validators add jev, or nomarmy validators add judge --agent <name> --model <model>"); return; }
     if (jev) console.log(`Jev: ${jev.enabled ? c.green("on") : "off"} (${jev.model}); checks: ${jev.checks.join(", ")}; key: ${jev.key}${jev.keyReadable ? "" : c.red(" (not readable)")}`);
+    if (jev) console.log(`  Also drives the trust judgment. ${jev.trustJudgment}`);
     if (judge) console.log(`Judge: ${judge.enabled ? c.green("on") : "off"} (${judge.agent}/${judge.model}); checks: ${judge.checks.join(", ")}${judge.hostTools ? c.yellow("; host tools allowed") : ""}`);
+    if (judge) console.log(`  Also drives the trust judgment. ${judge.trustJudgment}`);
     return;
   }
   if (name === "judge") return cmdValidatorsJudge(sub);
@@ -3025,12 +3099,14 @@ async function cmdValidators() {
       console.log("Its answers only add review flags; they never pass a check or allow a commit.");
       console.log(c.yellow("It sends excerpts of your code (findings, cited lines, diffs, worker reports) to TypeSafe.\n"));
     }
+    const trustJudgment = validatorTrustDisclosure("Jev", "TypeSafe");
+    (json ? console.error : console.log)(`Before saving: ${trustJudgment}`);
     const key = flag("key-stdin") ? await readStdin() : await readHiddenLine("TypeSafe API key (not shown): ");
     const saved = saveJevKey(key);
     let ok = false, why = null;
     try { ok = await testJev(jevSettings()); } catch (error) { why = error.message; }
-    if (json) return out({ saved: true, keyFile: saved.keyFile, configPath: saved.configPath, test: ok ? "pass" : "fail", reason: why });
-    console.log(c.green(`✓ Saved the key to ${saved.keyFile} (readable only by you) and turned Jev on in ${saved.configPath}.`));
+    if (json) return out({ saved: true, keyFile: saved.keyFile, configPath: saved.configPath, test: ok ? "pass" : "fail", reason: why, trustJudgment });
+    console.log(c.green(`✓ Saved the key to ${saved.keyFile} (readable only by you) and turned Jev on in ${saved.configPath}. ${trustJudgment}`));
     console.log(ok ? c.green("✓ Test call answered. New jobs use it; restart open coordinator sessions to pick it up.") : c.red(`✗ Test call failed: ${why ?? "no answer"}. Check the key, then: nomarmy validators test jev`));
     if (!ok) process.exitCode = 1;
     return;
@@ -3086,6 +3162,8 @@ async function cmdValidatorsJudge(sub) {
       model = /^\d+$/.test(answer) && listed[Number(answer) - 1] ? listed[Number(answer) - 1] : answer || fallback;
       if (!model) { rl?.close(); throw new Error("A model id is required."); }
     }
+    const trustJudgment = validatorTrustDisclosure("the judge", agentProviderId(agents[agent]));
+    (json ? console.error : console.log)(`Before saving: ${trustJudgment}`);
     let hostTools = flag("host-tools");
     if (agentRunsToolsOnHost(agents[agent]) && !hostTools) {
       if (!process.stdin.isTTY || json) {
@@ -3102,8 +3180,8 @@ async function cmdValidatorsJudge(sub) {
     const settings = resolve();
     if (settings?.problem) throw new Error(settings.problem);
     const test = await probe(settings);
-    if (json) return out({ saved: true, configPath: saved.configPath, test: test.ok ? "pass" : test.refused ? "refused" : "inconclusive", reason: test.reason });
-    console.log(c.green(`✓ The judge is ${agent}/${model}, in ${saved.configPath}.`));
+    if (json) return out({ saved: true, configPath: saved.configPath, test: test.ok ? "pass" : test.refused ? "refused" : "inconclusive", reason: test.reason, trustJudgment });
+    console.log(c.green(`✓ The judge is ${agent}/${model}, in ${saved.configPath}. ${trustJudgment}`));
     if (dominantBuilderVendor === null) {
       try {
         const roles = loadArmy({ projectDir: repoDir }).army.roles;
@@ -3141,7 +3219,111 @@ function cmdMcp() {
   child.on("exit", (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 1); });
 }
 
-const commands = { stats: cmdStats, validators: cmdValidators, mcp: cmdMcp, scan: cmdScan, validate: cmdValidate, sizing: cmdSizing, init: cmdInit, setup: cmdSetup, install: cmdInstall, model: cmdModel, agents: cmdAgents, army: cmdArmy, jobs: cmdJobs, statusline: cmdStatusline, health: cmdHealth, config: cmdConfig, update: cmdUpdate, connect: cmdConnect, sandbox: cmdSandbox, start: cmdStart, stop: cmdStop, uninstall: cmdUninstall, help: () => usage(0) };
+async function cmdAcceptance() {
+  if (argv[1] === "fill") {
+    const ids = [];
+    for (let i = 2; i < argv.length; i++) {
+      if (argv[i] === "--repo") { i++; continue; }
+      if (["--json", "--dry-run"].includes(argv[i])) continue;
+      if (argv[i].startsWith("--")) throw new Error(`Unknown acceptance option: ${argv[i]}`);
+      ids.push(argv[i]);
+    }
+    if (ids.length !== 1) throw new Error("Usage: nomarmy acceptance fill <run-id|job-id> [--dry-run] [--json]");
+    const proposals = gatherAcceptanceProposals({ id: ids[0], repoDir, jobsRoot: jobsRootDir(), runsRoot: path.join(agentStateRoot(), "runs") });
+    const result = await fillAcceptance({ repoDir, proposals, dryRun: flag("dry-run") });
+    if (json) out(result);
+    else if (!result.criteria.length) console.log("No new acceptance proofs.");
+    else for (const item of result.criteria) {
+      console.log(`${item.criterion}: ${result.dryRun ? "would add" : "added"} ${item.added.length} proof(s) in ${item.file}; status ${item.status}`);
+      for (const ref of item.added) console.log(`  ${ref.file}: ${ref.test}`);
+    }
+    if (!json && result.verificationError) console.log(result.verificationError);
+    return;
+  }
+  if (argv[1] !== "check") throw new Error("Usage: nomarmy acceptance check [file...] [--json] [--strict]");
+  const files = [];
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === "--repo") { i++; continue; }
+    if (["--json", "--strict"].includes(argv[i])) continue;
+    if (argv[i].startsWith("--")) throw new Error(`Unknown acceptance option: ${argv[i]}`);
+    files.push(argv[i]);
+  }
+  const contracts = files.length ? files.map((file) => loadContract(path.resolve(repoDir, file))) : loadContracts(repoDir);
+  const results = contracts.map((contract) => ({
+    file: contractDisplayPath(repoDir, contract.file),
+    feature: contract.feature,
+    criteria: checkContract(contract, { repoDir }),
+  }));
+  const totals = { met: 0, broken: 0, missing: 0, unproven: 0, retired: 0 };
+  for (const result of results) for (const criterion of result.criteria) totals[criterion.status]++;
+  if (json) out({ contracts: results, totals });
+  else {
+    results.forEach((result, index) => {
+      console.log(c.bold(`${result.file}: ${result.feature}`));
+      const idWidth = Math.max(0, ...result.criteria.map((criterion) => criterion.id.length));
+      result.criteria.forEach((criterion, criterionIndex) => {
+        const failed = ["broken", "missing"].includes(criterion.status);
+        const label = failed ? c.red(criterion.status.toUpperCase())
+          : criterion.status === "met" ? c.green("met") : c.yellow(criterion.status);
+        const detail = criterion.failures.map((failure) => failure.command ?? `${failure.file}: ${failure.test}`).join("; ")
+          || (criterion.status === "unproven" ? criterion.note ?? contracts[index].criteria[criterionIndex].note ?? "" : "");
+        const manual = criterion.status === "met" && criterion.manual?.length
+          ? ` (manual: ${criterion.manual.map((ref) => `${ref.checked_by}, ${ref.date}`).join("; ")})` : "";
+        const skipped = criterion.notApplicable?.length ? ` (${criterion.notApplicable.length} proofs not run on ${process.platform})` : "";
+        console.log(`${criterion.id.padEnd(idWidth)}  ${label}${manual}${skipped}${detail ? `  ${detail}` : ""}`);
+      });
+    });
+    console.log(`Total: ${Object.entries(totals).map(([status, count]) => `${count} ${status}`).join(", ")}`);
+  }
+  if (totals.broken || totals.missing || (flag("strict") && totals.unproven)) process.exitCode = 1;
+}
+
+async function cmdTrust() {
+  let result;
+  if (argv[1] === "ack") {
+    if (flag("accept") === flag("reject")) throw new Error("Choose exactly one of --accept or --reject");
+    result = acknowledgeTrust({ jobsRoot: jobsRootDir(), stateDir: agentStateRoot(), operatorDir: repoDir, jobId: argv[2], decision: flag("accept") ? "accept" : "reject", reason: value("reason", "") });
+  } else if (argv[1] === "map") {
+    result = value("from")
+      ? writeTrustProposal(repoDir, parseYaml(fs.readFileSync(path.resolve(repoDir, value("from")), "utf8")), { scoutJobId: value("scout-job") ?? null })
+      : writeTrustScoutBrief({ operatorDir: repoDir, roles: loadArmy({ projectDir: repoDir }).army.roles });
+  } else if (argv[1] === "review") {
+    const learning = { stateDir: agentStateRoot(), operatorDir: repoDir };
+    collectReviewEvidence({ ...learning, records: loadJobRecords(jobsRootDir()) });
+    const stored = loadTrustProposal(repoDir);
+    const suggestions = trustSuggestions(learning);
+    const proposed = [...stored, ...suggestions.map(s => s.entry)];
+    const origins = [...trustProposalOrigins(repoDir, stored), ...suggestions.map(s => ({ writer: "trust learning", status: "evidence-backed", evidence: s.evidence }))];
+    if (json && !flag("accept-all") && !value("decisions")) return out({ status: "pending", entries: proposed, origins });
+    let decisions = value("decisions") ? JSON.parse(value("decisions")) : undefined;
+    if (!flag("accept-all") && decisions === undefined) {
+      if (!input.isTTY) throw new Error("Use --accept-all or --decisions '<JSON array>' for scripted review; --json alone only lists proposals.");
+      decisions = [];
+      const rl = createInterface({ input, output });
+      try {
+        for (const [index, entry] of proposed.entries()) {
+          const origin = origins[index];
+          console.log(`Origin: ${origin.scoutJobId ?? "unknown"} (${origin.writer ?? origin.status})`);
+          if (origin.evidence) console.log(`${origin.evidence.summary}; jobs: ${origin.evidence.jobIds.join(", ")}`);
+          console.log(`${entry.symbol} (${entry.file}:${entry.line}), ${entry.category}: ${entry.reason}`);
+          let action;
+          do { action = (await rl.question("Accept, drop or edit? [a/d/e] ")).trim().toLowerCase(); } while (!["a", "d", "e"].includes(action));
+          if (action !== "e") { decisions.push({ action: action === "a" ? "accept" : "drop" }); continue; }
+          const edited = {};
+          for (const key of ["symbol", "file", "category", "reason"]) edited[key] = (await rl.question(`${key} [${entry[key]}]: `)).trim() || entry[key];
+          decisions.push({ action: "edit", entry: edited });
+        }
+      } finally { rl.close(); }
+    }
+    result = reviewTrustLearning({ ...learning, decisions, acceptAll: flag("accept-all"), expected: proposed });
+  } else throw new Error("Usage: nomarmy trust map [--from scout.yml --scout-job job-id] | trust ack <job-id> --accept|--reject [--reason text] | trust review [--accept-all | --decisions '<JSON array>'] [--json]");
+  if (json) out(result);
+  else if (result.status === "acknowledged") console.log(`${result.jobId}: human review acknowledged (${result.ack.decision}) by ${result.ack.who} at ${result.ack.when}${result.ack.reason ? `: ${result.ack.reason}` : ""}`);
+  else if (result.status === "awaiting-scout") console.log(`Scout brief: ${result.brief}. General must dispatch the read-only review scout, then import its cited YAML with nomarmy trust map --from scout.yml --scout-job job-id. Nothing is active yet.`);
+  else console.log(`${result.status}: ${result.map ?? result.proposal} (${result.entries.length} entries)`);
+}
+
+const commands = { trust: cmdTrust, acceptance: cmdAcceptance, stats: cmdStats, validators: cmdValidators, mcp: cmdMcp, scan: cmdScan, validate: cmdValidate, sizing: cmdSizing, init: cmdInit, setup: cmdSetup, install: cmdInstall, model: cmdModel, agents: cmdAgents, army: cmdArmy, jobs: cmdJobs, statusline: cmdStatusline, health: cmdHealth, config: cmdConfig, update: cmdUpdate, connect: cmdConnect, sandbox: cmdSandbox, start: cmdStart, stop: cmdStop, uninstall: cmdUninstall, help: () => usage(0) };
 // doctor command
 async function cmdDoctor() {
   if (windowsFrontEnd()) {
@@ -3150,7 +3332,10 @@ async function cmdDoctor() {
   }
   // Import lazily to avoid circular dependencies
   const { runDoctor } = await import("../lib/doctor.mjs");
-  const vendors = configuredSubscriptionVendors(loadAgentsOrExit().agents);
+  const agents = loadAgentsOrExit().agents;
+  const vendors = configuredSubscriptionVendors(agents);
+  let armySummary = null;
+  try { armySummary = describeArmy(loadArmy({ projectDir: repoDir }), { agents }); } catch { /* other doctor checks still run */ }
   let checks;
   if (flag("fix")) {
     const repaired = await repairOpenclaw({
@@ -3166,7 +3351,8 @@ async function cmdDoctor() {
   } else {
     checks = verifyOpenclaw({ command: openclawCmd(), vendors });
   }
-  await runDoctor({ json, exit: true, env: installEnv(), additionalChecks: checks });
+  await runDoctor({ json, exit: true, env: installEnv(), additionalChecks: checks,
+    runtime: { agents, armySummary, openclawCmd: openclawCmd() } });
 }
 commands.doctor = cmdDoctor;
 if (windowsFrontEnd() && windowsPlan(argv) === "FORWARD") {