nomarmy 0.1.0-alpha.21 → 0.1.0-alpha.22

package/bin/nomarmy.mjs

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import { acknowledgeTrust, collectReviewEvidence, trustSuggestions, reviewTrustLearning, trustAcknowledgment } from "../lib/trust-learning.mjs";
+import { writeTrustScoutBrief, writeTrustProposal, loadTrustProposal, trustProposalOrigins } from "../lib/trust-map.mjs";
+import { fillAcceptance, gatherAcceptanceProposals } from "../lib/acceptance-fill.mjs";
 // nomArmy CLI. Every command proposes before it writes anything -- init,
 // setup, model and update all show exactly what would change and write only
 // after explicit confirmation ([y/N]) or an explicit non-interactive flag
@@ -9,10 +12,12 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { execHostGitSync, spawnHostGitSync } from "../lib/worktree-pointer.mjs";
 import { spawn, spawnSync, execFileSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { loadConfig, validateConfig, stringifyConfig, findConfigFile, parseYaml, CONFIG_FILENAMES } from "../lib/config.mjs";
+import { loadContract, loadContracts, checkContract, contractDisplayPath } from "../lib/acceptance.mjs";
 import { scanRepository, compareEvidence } from "../lib/scan.mjs";
 import { buildConfigProposal } from "../lib/propose.mjs";
 import { detectHardware } from "../lib/hardware.mjs";
@@ -24,7 +29,7 @@ import { connectViaWsl, connectClaude, connectCodex, connectCursor, cursorAlread
 import { compareVersions, readPackageVersion, readInstallVersions, copyIsStale } from "../lib/install-freshness.mjs";
 import { loadJobRecords, computeStats, formatStats, formatStatsSummary, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
 import { requestJobStop } from "../lib/openclaw-run.mjs";
-import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings, judgeAgentChoices, chooseJudgeAgent, confirmJudgeHostTools } from "../lib/validators.mjs";
+import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings, judgeAgentChoices, chooseJudgeAgent, confirmJudgeHostTools, validatorTrustDisclosure } from "../lib/validators.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
 import { loadAgents, readAgentsFile, writeAgentsFile, agentsConfigPath, apiAgentAsPoolEntry, describeAgent as describeAgentLabel, agentRunsToolsOnHost, agentProviderId, AGENT_KINDS, API_PROVIDER_TYPES, RESERVED_AGENT_NAMES, BUILTIN_LOCAL_AGENT } from "../lib/agents.mjs";
@@ -116,6 +121,11 @@ function usage(code = 0) {
 
 Usage: nomarmy <command> [options]
 
+  acceptance fill <run-id|job-id> [--dry-run] [--json]
+                  Append proposed test proofs to feature contracts.
+  acceptance check [file...] [--json] [--strict]
+                  Check feature contracts in acceptance/*.yml; runs this repository's tests on this machine.
+                  --strict fails on unproven criteria as well as broken or missing.
   scan            Inspect this repository and report its execution environment.
                   --check   compare the evidence against a committed .nomarmy.yml
   init            Propose a .nomarmy.yml from this repository's scan evidence
@@ -146,6 +156,11 @@ Usage: nomarmy <command> [options]
   update          Update nomArmy and reconnect your coordinators: installs
                   npm's latest alpha, or for a git checkout pulls (fast-forward
                   only; refuses on local changes). Then restart open sessions.
+  trust map       Write a read-only review scout brief for the General.
+                  --from <scout.yml> --scout-job <job-id> records the cited scout origin.
+  trust review    Accept, drop or edit scout and evidence-backed proposals.
+                  --json lists; --accept-all or --decisions '<JSON array>' writes.
+  trust ack <job> --accept|--reject [--reason "text"]  Sign off a human gate.
   agents <list|add|update|remove>
                   Every account a job can run on, in one list:
                   ~/.config/nomarmy/agents.yml (or NOMARMY_CONFIG_DIR).
@@ -179,8 +194,9 @@ Usage: nomarmy <command> [options]
                             --link-openclaw after CLI login; removing a
                             capturing email profile non-interactively needs
                             --remove-email-profiles. Interactive Codex setup
-                            offers removal (default yes), then imports the
-                            CLI login. For any kind, optionally
+                            asks before copying the CLI login (default yes),
+                            and offers email-profile removal separately.
+                            For any kind, optionally
                             --max-concurrent --context-window
                             --thinking [minimal|low|medium|high|xhigh|adaptive|max|ultra] --no-thinking
                   update <name>
@@ -1319,7 +1335,7 @@ function reapProbeSandbox(stateDir) {
 async function openclawProviderLogin(vendor, rl) {
   if (vendor === SUBSCRIPTION_VENDORS.codex) return linkCodex({
     run: runQuiet, command: openclawCmd(), isTTY: Boolean(input.isTTY),
-    removeEmailProfiles: flag("remove-email-profiles"),
+    importLogin: flag("link-openclaw"), removeEmailProfiles: flag("remove-email-profiles"),
     confirm: (prompt, opts) => confirm(rl, prompt, opts), print: (message) => console.log(c.dim(message)),
   });
   const provider = vendor.credential.loginProvider ?? vendor.provider;
@@ -1557,7 +1573,7 @@ async function addApiAgent(rl, agents) {
 const OWNER_EMAIL_RE = /^[^@\s]+@[^@\s]+$/;
 function validOwnerEmail(email) { return typeof email === "string" && OWNER_EMAIL_RE.test(email); }
 function gitUserEmail() {
-  const result = spawnSync("git", ["config", "user.email"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  const result = spawnHostGitSync(repoDir, ["config", "user.email"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   const email = result.status === 0 ? result.stdout.trim() : "";
   return validOwnerEmail(email) ? email : "";
 }
@@ -1682,8 +1698,10 @@ async function cmdAgentsAddJson() {
   if (kind === "subscription" && agent.provider === "openai" && (flag("link-openclaw") || flag("remove-email-profiles"))) {
     if (!readLoginStatus("codex").loggedIn) throw new Error("Confirm Codex CLI login first: codex login");
     const linked = await linkCodex({ run: runQuiet, command: openclawCmd(),
-      removeEmailProfiles: flag("remove-email-profiles"), print: (message) => console.error(message) });
-    if (!linked) throw new Error("Codex import failed; nothing was written.");
+      importLogin: flag("link-openclaw"), removeEmailProfiles: flag("remove-email-profiles"), print: (message) => console.error(message) });
+    if (!linked) throw new Error(flag("link-openclaw")
+      ? "Codex import failed; nothing was written."
+      : "Codex login was not imported: pass --link-openclaw to authorize copying it into OpenClaw. Nothing was written.");
     if (!probeWorker("openai", agent.model ?? SUBSCRIPTION_VENDORS.codex.defaultModel)) {
       throw new Error(`Codex test call failed; nothing was written. Fix: ${codexImportRecovery()}`);
     }
@@ -1842,7 +1860,7 @@ async function cmdAgents() {
 }
 
 function git(args) {
-  try { return execFileSync("git", args, { cwd: nomarmyRoot, encoding: "utf8" }).trim(); }
+  try { return execHostGitSync(nomarmyRoot, args, { cwd: nomarmyRoot, encoding: "utf8" }).trim(); }
   catch (error) { throw new Error(`git ${args.join(" ")} failed: ${error.stderr ? String(error.stderr).trim() : error.message}`); }
 }
 
@@ -2028,7 +2046,7 @@ async function cmdConnect() {
   if (nativeWindows && flag("copy-only")) throw new Error("Windows runs nomArmy inside WSL; run nomarmy connect <target> instead of --copy-only");
   let projectDir = null;
   if (scope !== "user") {
-    try { projectDir = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
+    try { projectDir = execHostGitSync(repoDir, ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
     catch { throw new Error(`--scope ${scope} registers nomArmy for one repository, and ${repoDir} isn't inside a git repository. Run it from the repository (or pass --repo <dir>).`); }
   }
   if (flag("copy-only")) {
@@ -2769,6 +2787,7 @@ function collectJobs({ recent = 8, runId = null, projectDir = null } = {}) {
       lastTool: status.lastTool ? `${status.lastTool.tool}${status.lastTool.target ? ` ${String(status.lastTool.target).slice(0, 40)}` : ""}` : null,
       filesChanged: status.filesChangedLive ?? meta?.git?.filesChanged?.length ?? null,
       heartbeatAgeSeconds: status.heartbeatAt ? Math.round((Date.now() - Date.parse(status.heartbeatAt)) / 1000) : null,
+      ...(meta?.trust ? { trust: meta.trust } : {}),
       started, dir,
     };
   }).filter(Boolean).sort((a, b) => b.started - a.started);
@@ -2788,6 +2807,10 @@ function renderJobs({ running, recent }) {
   }
   lines.push("", c.bold("Recent"));
   for (const j of recent) lines.push(`  ${j.jobId.padEnd(40)} ${String(j.phase).padEnd(20)} ${fmtSeconds(j.elapsedSeconds).padStart(7)}  ${c.dim(`${j.agent ?? ""}${j.model ? `/${j.model}` : ""}`)}`);
+  for (const j of [...running, ...recent]) if (j.trust?.level === "human") {
+    const ack = trustAcknowledgment(j.trust);
+    lines.push(`  ${j.jobId}: human review ${ack ? `acknowledged (${ack.decision}) by ${ack.who} at ${ack.when}${ack.reason ? `: ${ack.reason}` : ""}` : "pending"}`);
+  }
   return lines.join("\n");
 }
 
@@ -2990,7 +3013,7 @@ async function shareStats(stats) {
   if (flag("share")) console.log(shareMarkdown(stats, { scope }));
   if (flag("badge")) {
     const given = value("badge");
-    const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    const top = spawnHostGitSync(process.cwd(), ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
     const root = top.status === 0 ? top.stdout.trim() : process.cwd();
     const file = path.resolve(root, given ?? path.join(".github", "nomarmy-badge.svg"));
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -3007,7 +3030,7 @@ function cmdStats() {
   let repo = null;
   if (value("repo")) repo = resolveRepo(records, value("repo"));
   else if (!flag("all-repos")) {
-    try { repo = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
+    try { repo = execHostGitSync(repoDir, ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
     catch { throw new Error(`${repoDir} isn't inside a git repository; run nomarmy stats from one, or pass --repo <name> or --all-repos`); }
   }
   let agentFor = () => null;
@@ -3053,10 +3076,18 @@ async function cmdValidators() {
     try { config = loadValidators(); } catch (error) { if (json) return out({ error: error.message }); console.log(c.red(error.message)); process.exitCode = 1; return; }
     const judge = config.judge ? { enabled: config.judge.enabled, agent: config.judge.agent, model: config.judge.model, checks: config.judge.checks, hostTools: config.judge.host_tools } : null;
     const jev = config.jev ? { enabled: config.jev.enabled, checks: config.jev.checks, model: config.jev.model, key: config.jev.key_env ? `env ${config.jev.key_env}` : config.jev.key_file, keyReadable: Boolean(jevSettings()) } : null;
+    if (jev) jev.trustJudgment = validatorTrustDisclosure("Jev", "TypeSafe");
+    if (judge) {
+      const agents = loadAgents(globalConfigDir()).agents;
+      const vendor = agentProviderId(agents[judge.agent]) ?? `the configured vendor for agent "${judge.agent}" (agent unavailable)`;
+      judge.trustJudgment = validatorTrustDisclosure("the judge", vendor);
+    }
     if (json) return out({ path: validatorsPath(), jev, judge });
     if (!jev && !judge) { console.log("No validators configured. Add one with: nomarmy validators add jev, or nomarmy validators add judge --agent <name> --model <model>"); return; }
     if (jev) console.log(`Jev: ${jev.enabled ? c.green("on") : "off"} (${jev.model}); checks: ${jev.checks.join(", ")}; key: ${jev.key}${jev.keyReadable ? "" : c.red(" (not readable)")}`);
+    if (jev) console.log(`  Also drives the trust judgment. ${jev.trustJudgment}`);
     if (judge) console.log(`Judge: ${judge.enabled ? c.green("on") : "off"} (${judge.agent}/${judge.model}); checks: ${judge.checks.join(", ")}${judge.hostTools ? c.yellow("; host tools allowed") : ""}`);
+    if (judge) console.log(`  Also drives the trust judgment. ${judge.trustJudgment}`);
     return;
   }
   if (name === "judge") return cmdValidatorsJudge(sub);
@@ -3068,12 +3099,14 @@ async function cmdValidators() {
       console.log("Its answers only add review flags; they never pass a check or allow a commit.");
       console.log(c.yellow("It sends excerpts of your code (findings, cited lines, diffs, worker reports) to TypeSafe.\n"));
     }
+    const trustJudgment = validatorTrustDisclosure("Jev", "TypeSafe");
+    (json ? console.error : console.log)(`Before saving: ${trustJudgment}`);
     const key = flag("key-stdin") ? await readStdin() : await readHiddenLine("TypeSafe API key (not shown): ");
     const saved = saveJevKey(key);
     let ok = false, why = null;
     try { ok = await testJev(jevSettings()); } catch (error) { why = error.message; }
-    if (json) return out({ saved: true, keyFile: saved.keyFile, configPath: saved.configPath, test: ok ? "pass" : "fail", reason: why });
-    console.log(c.green(`✓ Saved the key to ${saved.keyFile} (readable only by you) and turned Jev on in ${saved.configPath}.`));
+    if (json) return out({ saved: true, keyFile: saved.keyFile, configPath: saved.configPath, test: ok ? "pass" : "fail", reason: why, trustJudgment });
+    console.log(c.green(`✓ Saved the key to ${saved.keyFile} (readable only by you) and turned Jev on in ${saved.configPath}. ${trustJudgment}`));
     console.log(ok ? c.green("✓ Test call answered. New jobs use it; restart open coordinator sessions to pick it up.") : c.red(`✗ Test call failed: ${why ?? "no answer"}. Check the key, then: nomarmy validators test jev`));
     if (!ok) process.exitCode = 1;
     return;
@@ -3129,6 +3162,8 @@ async function cmdValidatorsJudge(sub) {
       model = /^\d+$/.test(answer) && listed[Number(answer) - 1] ? listed[Number(answer) - 1] : answer || fallback;
       if (!model) { rl?.close(); throw new Error("A model id is required."); }
     }
+    const trustJudgment = validatorTrustDisclosure("the judge", agentProviderId(agents[agent]));
+    (json ? console.error : console.log)(`Before saving: ${trustJudgment}`);
     let hostTools = flag("host-tools");
     if (agentRunsToolsOnHost(agents[agent]) && !hostTools) {
       if (!process.stdin.isTTY || json) {
@@ -3145,8 +3180,8 @@ async function cmdValidatorsJudge(sub) {
     const settings = resolve();
     if (settings?.problem) throw new Error(settings.problem);
     const test = await probe(settings);
-    if (json) return out({ saved: true, configPath: saved.configPath, test: test.ok ? "pass" : test.refused ? "refused" : "inconclusive", reason: test.reason });
-    console.log(c.green(`✓ The judge is ${agent}/${model}, in ${saved.configPath}.`));
+    if (json) return out({ saved: true, configPath: saved.configPath, test: test.ok ? "pass" : test.refused ? "refused" : "inconclusive", reason: test.reason, trustJudgment });
+    console.log(c.green(`✓ The judge is ${agent}/${model}, in ${saved.configPath}. ${trustJudgment}`));
     if (dominantBuilderVendor === null) {
       try {
         const roles = loadArmy({ projectDir: repoDir }).army.roles;
@@ -3184,7 +3219,111 @@ function cmdMcp() {
   child.on("exit", (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 1); });
 }
 
-const commands = { stats: cmdStats, validators: cmdValidators, mcp: cmdMcp, scan: cmdScan, validate: cmdValidate, sizing: cmdSizing, init: cmdInit, setup: cmdSetup, install: cmdInstall, model: cmdModel, agents: cmdAgents, army: cmdArmy, jobs: cmdJobs, statusline: cmdStatusline, health: cmdHealth, config: cmdConfig, update: cmdUpdate, connect: cmdConnect, sandbox: cmdSandbox, start: cmdStart, stop: cmdStop, uninstall: cmdUninstall, help: () => usage(0) };
+async function cmdAcceptance() {
+  if (argv[1] === "fill") {
+    const ids = [];
+    for (let i = 2; i < argv.length; i++) {
+      if (argv[i] === "--repo") { i++; continue; }
+      if (["--json", "--dry-run"].includes(argv[i])) continue;
+      if (argv[i].startsWith("--")) throw new Error(`Unknown acceptance option: ${argv[i]}`);
+      ids.push(argv[i]);
+    }
+    if (ids.length !== 1) throw new Error("Usage: nomarmy acceptance fill <run-id|job-id> [--dry-run] [--json]");
+    const proposals = gatherAcceptanceProposals({ id: ids[0], repoDir, jobsRoot: jobsRootDir(), runsRoot: path.join(agentStateRoot(), "runs") });
+    const result = await fillAcceptance({ repoDir, proposals, dryRun: flag("dry-run") });
+    if (json) out(result);
+    else if (!result.criteria.length) console.log("No new acceptance proofs.");
+    else for (const item of result.criteria) {
+      console.log(`${item.criterion}: ${result.dryRun ? "would add" : "added"} ${item.added.length} proof(s) in ${item.file}; status ${item.status}`);
+      for (const ref of item.added) console.log(`  ${ref.file}: ${ref.test}`);
+    }
+    if (!json && result.verificationError) console.log(result.verificationError);
+    return;
+  }
+  if (argv[1] !== "check") throw new Error("Usage: nomarmy acceptance check [file...] [--json] [--strict]");
+  const files = [];
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === "--repo") { i++; continue; }
+    if (["--json", "--strict"].includes(argv[i])) continue;
+    if (argv[i].startsWith("--")) throw new Error(`Unknown acceptance option: ${argv[i]}`);
+    files.push(argv[i]);
+  }
+  const contracts = files.length ? files.map((file) => loadContract(path.resolve(repoDir, file))) : loadContracts(repoDir);
+  const results = contracts.map((contract) => ({
+    file: contractDisplayPath(repoDir, contract.file),
+    feature: contract.feature,
+    criteria: checkContract(contract, { repoDir }),
+  }));
+  const totals = { met: 0, broken: 0, missing: 0, unproven: 0, retired: 0 };
+  for (const result of results) for (const criterion of result.criteria) totals[criterion.status]++;
+  if (json) out({ contracts: results, totals });
+  else {
+    results.forEach((result, index) => {
+      console.log(c.bold(`${result.file}: ${result.feature}`));
+      const idWidth = Math.max(0, ...result.criteria.map((criterion) => criterion.id.length));
+      result.criteria.forEach((criterion, criterionIndex) => {
+        const failed = ["broken", "missing"].includes(criterion.status);
+        const label = failed ? c.red(criterion.status.toUpperCase())
+          : criterion.status === "met" ? c.green("met") : c.yellow(criterion.status);
+        const detail = criterion.failures.map((failure) => failure.command ?? `${failure.file}: ${failure.test}`).join("; ")
+          || (criterion.status === "unproven" ? criterion.note ?? contracts[index].criteria[criterionIndex].note ?? "" : "");
+        const manual = criterion.status === "met" && criterion.manual?.length
+          ? ` (manual: ${criterion.manual.map((ref) => `${ref.checked_by}, ${ref.date}`).join("; ")})` : "";
+        const skipped = criterion.notApplicable?.length ? ` (${criterion.notApplicable.length} proofs not run on ${process.platform})` : "";
+        console.log(`${criterion.id.padEnd(idWidth)}  ${label}${manual}${skipped}${detail ? `  ${detail}` : ""}`);
+      });
+    });
+    console.log(`Total: ${Object.entries(totals).map(([status, count]) => `${count} ${status}`).join(", ")}`);
+  }
+  if (totals.broken || totals.missing || (flag("strict") && totals.unproven)) process.exitCode = 1;
+}
+
+async function cmdTrust() {
+  let result;
+  if (argv[1] === "ack") {
+    if (flag("accept") === flag("reject")) throw new Error("Choose exactly one of --accept or --reject");
+    result = acknowledgeTrust({ jobsRoot: jobsRootDir(), stateDir: agentStateRoot(), operatorDir: repoDir, jobId: argv[2], decision: flag("accept") ? "accept" : "reject", reason: value("reason", "") });
+  } else if (argv[1] === "map") {
+    result = value("from")
+      ? writeTrustProposal(repoDir, parseYaml(fs.readFileSync(path.resolve(repoDir, value("from")), "utf8")), { scoutJobId: value("scout-job") ?? null })
+      : writeTrustScoutBrief({ operatorDir: repoDir, roles: loadArmy({ projectDir: repoDir }).army.roles });
+  } else if (argv[1] === "review") {
+    const learning = { stateDir: agentStateRoot(), operatorDir: repoDir };
+    collectReviewEvidence({ ...learning, records: loadJobRecords(jobsRootDir()) });
+    const stored = loadTrustProposal(repoDir);
+    const suggestions = trustSuggestions(learning);
+    const proposed = [...stored, ...suggestions.map(s => s.entry)];
+    const origins = [...trustProposalOrigins(repoDir, stored), ...suggestions.map(s => ({ writer: "trust learning", status: "evidence-backed", evidence: s.evidence }))];
+    if (json && !flag("accept-all") && !value("decisions")) return out({ status: "pending", entries: proposed, origins });
+    let decisions = value("decisions") ? JSON.parse(value("decisions")) : undefined;
+    if (!flag("accept-all") && decisions === undefined) {
+      if (!input.isTTY) throw new Error("Use --accept-all or --decisions '<JSON array>' for scripted review; --json alone only lists proposals.");
+      decisions = [];
+      const rl = createInterface({ input, output });
+      try {
+        for (const [index, entry] of proposed.entries()) {
+          const origin = origins[index];
+          console.log(`Origin: ${origin.scoutJobId ?? "unknown"} (${origin.writer ?? origin.status})`);
+          if (origin.evidence) console.log(`${origin.evidence.summary}; jobs: ${origin.evidence.jobIds.join(", ")}`);
+          console.log(`${entry.symbol} (${entry.file}:${entry.line}), ${entry.category}: ${entry.reason}`);
+          let action;
+          do { action = (await rl.question("Accept, drop or edit? [a/d/e] ")).trim().toLowerCase(); } while (!["a", "d", "e"].includes(action));
+          if (action !== "e") { decisions.push({ action: action === "a" ? "accept" : "drop" }); continue; }
+          const edited = {};
+          for (const key of ["symbol", "file", "category", "reason"]) edited[key] = (await rl.question(`${key} [${entry[key]}]: `)).trim() || entry[key];
+          decisions.push({ action: "edit", entry: edited });
+        }
+      } finally { rl.close(); }
+    }
+    result = reviewTrustLearning({ ...learning, decisions, acceptAll: flag("accept-all"), expected: proposed });
+  } else throw new Error("Usage: nomarmy trust map [--from scout.yml --scout-job job-id] | trust ack <job-id> --accept|--reject [--reason text] | trust review [--accept-all | --decisions '<JSON array>'] [--json]");
+  if (json) out(result);
+  else if (result.status === "acknowledged") console.log(`${result.jobId}: human review acknowledged (${result.ack.decision}) by ${result.ack.who} at ${result.ack.when}${result.ack.reason ? `: ${result.ack.reason}` : ""}`);
+  else if (result.status === "awaiting-scout") console.log(`Scout brief: ${result.brief}. General must dispatch the read-only review scout, then import its cited YAML with nomarmy trust map --from scout.yml --scout-job job-id. Nothing is active yet.`);
+  else console.log(`${result.status}: ${result.map ?? result.proposal} (${result.entries.length} entries)`);
+}
+
+const commands = { trust: cmdTrust, acceptance: cmdAcceptance, stats: cmdStats, validators: cmdValidators, mcp: cmdMcp, scan: cmdScan, validate: cmdValidate, sizing: cmdSizing, init: cmdInit, setup: cmdSetup, install: cmdInstall, model: cmdModel, agents: cmdAgents, army: cmdArmy, jobs: cmdJobs, statusline: cmdStatusline, health: cmdHealth, config: cmdConfig, update: cmdUpdate, connect: cmdConnect, sandbox: cmdSandbox, start: cmdStart, stop: cmdStop, uninstall: cmdUninstall, help: () => usage(0) };
 // doctor command
 async function cmdDoctor() {
   if (windowsFrontEnd()) {

package/lib/acceptance-fill.mjs

@@ -0,0 +1,180 @@
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+import { loadContracts, contractDisplayPath } from "./acceptance.mjs";
+import { runContractChecks } from "./acceptance-impact.mjs";
+import { isTestPath } from "./diff-checks.mjs";
+import { loadRun } from "./runs.mjs";
+import { samePath } from "./same-path.mjs";
+
+export function criteriaProblems(criteria, repoDir, mode = "implement") {
+  if (!criteria?.length) return [];
+  if (mode !== "implement") return ["criteria is only supported for implement jobs"];
+  try {
+    const contracts = loadContracts(repoDir);
+    const defined = new Set(contracts.flatMap(c => c.criteria.map(c => c.id)));
+    const unknown = [...new Set(criteria)].filter(id => !defined.has(id));
+    return unknown.length ? [`Unknown acceptance criteria: ${unknown.join(", ")}. Contract files searched: ${contracts.map(c => contractDisplayPath(repoDir, c.file)).join(", ") || "acceptance/*.yml (none)"}`] : [];
+  } catch (error) { return [`Could not load acceptance contracts: ${error.message}`]; }
+}
+
+// Tokenize without executing worker source. Comments and quoted text cannot
+// impersonate calls. Full-context diffs let body-only edits select their test.
+function tokens(source) {
+  const re = /\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\[\s\S]|[^"\\])*"|'(?:\\[\s\S]|[^'\\])*'|`(?:\\[\s\S]|[^`\\])*`|[A-Za-z_$][\w$]*|[^\s]/g;
+  return [...source.matchAll(re)].filter(m => !m[0].startsWith("//") && !m[0].startsWith("/*")).map(m => ({ text: m[0], start: m.index, end: m.index + m[0].length }));
+}
+function literalName(raw) {
+  if (!/^["'`]/.test(raw)) return null;
+  let text = raw.slice(1, -1);
+  // Keep the source template for review; checkContract matches only its fixed prefix.
+  return text.replace(/\\(u\{[0-9a-f]+\}|u[0-9a-f]{4}|x[0-9a-f]{2}|\r?\n|.)/gi, (_, escape) => {
+    if (/^u\{/.test(escape)) return String.fromCodePoint(parseInt(escape.slice(2, -1), 16));
+    if (/^[ux]/.test(escape)) return String.fromCharCode(parseInt(escape.slice(1), 16));
+    return ({ n: "\n", r: "\r", t: "\t", b: "\b", f: "\f", v: "\v", "0": "\0", "\n": "", "\r\n": "" })[escape] ?? escape;
+  });
+}
+export function proposalsFromDiff(diff, criteria) {
+  const files = [];
+  let file = null;
+  for (const line of String(diff).split("\n")) {
+    if (line.startsWith("diff --git ")) { file = null; continue; }
+    if (!file && line.startsWith("+++ ")) {
+      let name = line.slice(4).split("\t", 1)[0];
+      if (name.startsWith('"')) { try { name = JSON.parse(name); } catch { continue; } }
+      name = name.replace(/^b\//, "");
+      file = { name, source: "", changes: [] };
+      files.push(file);
+    } else if (file && /^[ +\-]/.test(line)) {
+      if (line[0] !== " ") file.changes.push({ offset: file.source.length, removed: line[0] === "-" });
+      if (line[0] !== "-") file.source += line.slice(1) + "\n";
+    }
+  }
+  const proposals = [];
+  for (const f of files.filter(f => isTestPath(f.name) && /\.[cm]?[jt]sx?$/.test(f.name))) {
+    const ts = tokens(f.source);
+    for (let i = 0; i < ts.length - 3; i++) {
+      if (!["test", "it"].includes(ts[i].text) || ts[i - 1]?.text === "." || ts[i + 1].text !== "(") continue;
+      const name = literalName(ts[i + 2].text);
+      if (!name || ts[i + 3].text !== ",") continue;
+      let depth = 1, end = i + 2;
+      for (; end < ts.length; end++) {
+        if (ts[end].text === "(") depth++;
+        if (ts[end].text === ")" && --depth === 0) break;
+      }
+      if (!ts[end] || !f.changes.some(({ offset, removed }) => (removed ? offset > ts[i].start : offset >= f.source.lastIndexOf("\n", ts[i].start - 1) + 1) && offset < ts[end].end)) continue;
+      for (const criterion of criteria ?? []) {
+        const proposal = { criterion, file: f.name, test: name };
+        if (!proposals.some(p => JSON.stringify(p) === JSON.stringify(proposal))) proposals.push(proposal);
+      }
+    }
+  }
+  return proposals;
+}
+
+export async function jobAcceptanceProposals({ criteria, commit, regressionCheck, diff }) {
+  if (!criteria?.length || !commit?.created || regressionCheck?.status !== "pass") return undefined;
+  return proposalsFromDiff(await diff(), criteria);
+}
+
+export function gatherAcceptanceProposals({ id, repoDir, jobsRoot, runsRoot }) {
+  if (!/^[A-Za-z0-9_-]+$/.test(id ?? "")) throw new Error("Expected a run ID or job ID");
+  const run = id.startsWith("run-") ? loadRun(runsRoot, id) : null;
+  if (run && !samePath(run.repo, repoDir)) throw new Error(`Run ${id} belongs to another repository`);
+  const ids = run ? run.jobs.map(j => j.jobId) : [id];
+  return ids.flatMap(jobId => {
+    if (!/^[A-Za-z0-9_-]+$/.test(jobId)) throw new Error("Invalid job ID in run");
+    let job;
+    try { job = JSON.parse(fs.readFileSync(path.join(jobsRoot, jobId, "metadata.json"), "utf8")); }
+    catch (error) {
+      // Failed jobs may have only failure.json, with no proposal record.
+      if (run && error.code === "ENOENT") return [];
+      throw error;
+    }
+    if (!samePath(job.projectDir, repoDir)) throw new Error(`Job ${jobId} belongs to another repository`);
+    return job.acceptanceProposals ?? [];
+  });
+}
+
+/** Edit only insertion points and an eligible status scalar, never stringify a contract. */
+export async function fillAcceptance({ repoDir, proposals, dryRun = false, verify }) {
+  const contracts = loadContracts(repoDir);
+  const owners = new Map();
+  for (const contract of contracts) for (const criterion of contract.criteria) {
+    if (owners.has(criterion.id)) throw new Error(`Ambiguous acceptance criterion ${criterion.id}`);
+    owners.set(criterion.id, contract);
+  }
+  for (const p of proposals) if (!owners.has(p.criterion)) throw new Error(`Unknown acceptance criterion ${p.criterion}`);
+  // Snapshot proposed proofs read-only beside the working tree. Even a dry-run
+  // verifies inside the sandbox, never by spawning repository tests on the host.
+  const pending = contracts.map(contract => ({
+    ...contract,
+    criteria: contract.criteria.filter(c => c.status === "unproven" && proposals.some(p => p.criterion === c.id)).map(c => ({
+      ...c,
+      proven_by: [...c.proven_by, ...proposals.filter(p => p.criterion === c.id)
+        .map(({ file, test }) => ({ file, test }))
+        .filter((ref, i, refs) => !c.proven_by.some(r => r.file === ref.file && r.test === ref.test)
+          && refs.findIndex(r => r.file === ref.file && r.test === ref.test) === i)],
+    })),
+  })).filter(c => c.criteria.length);
+  const met = new Set();
+  let verificationError;
+  if (pending.length) {
+    try {
+      const checked = await runContractChecks({ contracts: pending, worktree: repoDir, projectDir: repoDir, verify });
+      for (const contract of checked) for (const criterion of contract.results) {
+        if (criterion.status === "met") met.add(criterion.id);
+      }
+    } catch (error) { verificationError = `couldn't verify: ${error.message}`; }
+  }
+  const results = [], writes = [];
+  for (const contract of contracts) {
+    const source = fs.readFileSync(contract.file, "utf8");
+    const doc = YAML.parseDocument(source);
+    const edits = [];
+    const newline = source.includes("\r\n") ? "\r\n" : "\n";
+    for (const [index, criterion] of contract.criteria.entries()) {
+      const proposed = proposals.filter(p => p.criterion === criterion.id);
+      if (!proposed.length) continue;
+      const added = [];
+      for (const p of proposed) {
+        const ref = { file: p.file, test: p.test };
+        if (!criterion.proven_by.concat(added).some(r => r.file === ref.file && r.test === ref.test)) added.push(ref);
+      }
+      if (!added.length && criterion.status !== "unproven") continue;
+      const node = doc.get("criteria").items[index];
+      const seq = node.get("proven_by");
+      if (!YAML.isSeq(seq)) throw new Error(`${criterion.id}: proven_by must be a literal YAML sequence`);
+      const refs = added.map(r => `{ file: ${JSON.stringify(r.file)}, test: ${JSON.stringify(r.test)} }`);
+      if (added.length && seq.flow) {
+        const pos = seq.range[1] - 1;
+        edits.push({ start: pos, end: pos, text: `${seq.items.length && !source.slice(seq.items.at(-1).range[1], pos).trimStart().startsWith(",") ? "," : ""} ${refs.join(", ")}` });
+      } else if (added.length) {
+        const pos = seq.range[2];
+        const indent = seq.range[0] - source.lastIndexOf("\n", seq.range[0] - 1) - 1;
+        edits.push({ start: pos, end: pos, text: `${pos && source[pos - 1] !== "\n" ? newline : ""}${refs.map(r => " ".repeat(indent) + "- " + r + newline).join("")}` });
+      }
+      const status = criterion.status === "unproven" && met.has(criterion.id) ? "met" : criterion.status;
+      if (status !== criterion.status) {
+        const scalar = node.get("status", true);
+        edits.push({ start: scalar.range[0], end: scalar.range[1], text: status });
+      }
+      if (!added.length && status === criterion.status) continue;
+      results.push({ criterion: criterion.id, file: contractDisplayPath(repoDir, contract.file), added, status });
+    }
+    if (edits.length) {
+      let text = source;
+      for (const edit of edits.sort((a, b) => b.start - a.start)) text = text.slice(0, edit.start) + edit.text + text.slice(edit.end);
+      // Validate our surgical insertion before touching any file.
+      const actual = YAML.parse(text);
+      for (const result of results.filter(r => r.file === contractDisplayPath(repoDir, contract.file))) {
+        const before = contract.criteria.find(c => c.id === result.criterion);
+        const after = actual.criteria.find(c => c.id === result.criterion);
+        if (JSON.stringify(after.proven_by) !== JSON.stringify([...before.proven_by, ...result.added])) throw new Error(`${result.criterion}: could not safely append proofs`);
+      }
+      writes.push({ file: contract.file, text });
+    }
+  }
+  if (!dryRun) for (const write of writes) fs.writeFileSync(write.file, write.text);
+  return { dryRun, criteria: results, ...(verificationError ? { verificationError } : {}) };
+}