nomarmy 0.1.0-alpha.21 → 0.1.0-alpha.22

package/lib/trust.mjs

@@ -0,0 +1,227 @@
+// The repository's deterministic trust floor. No model can lower this result.
+import fs from "node:fs";
+import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { globToRegex } from "./repo-query.mjs";
+import { parseYaml, CONFIG_FILENAMES } from "./config.mjs";
+
+export const CODEOWNERS_FILES = Object.freeze([".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"]);
+const normalize = (file) => path.posix.normalize(file.replace(/\\/g, "/")).replace(/^(?:\.\/|\/)+/, "");
+const sentence = (text) => text.replace(/\s+/g, " ").trim();
+
+export const MAX_TRUST_FILE_BYTES = 16 * 1024 * 1024;
+export const UNCHECKABLE_TRUST_FILE = "is not a regular file or symlink";
+
+/** Read Git's representation without following worktree symlinks or opening special files. */
+export function readTrustWorktreeFile(cwd, file) {
+  const empty = Buffer.alloc(0);
+  const blocked = (problem) => ({ bytes: empty, problem });
+  const parts = file.split(path.sep === "\\" ? /[\\/]/ : "/");
+  if (path.isAbsolute(file) || parts.some((part) => !part || part === "." || part === "..")) {
+    return blocked("is not a path inside the worktree");
+  }
+  let full = cwd;
+  try {
+    for (const part of parts.slice(0, -1)) {
+      full = path.join(full, part);
+      const parent = fs.lstatSync(full);
+      if (parent.isSymbolicLink()) return blocked("has a symlinked parent directory");
+      if (!parent.isDirectory()) return blocked(UNCHECKABLE_TRUST_FILE);
+    }
+    full = path.join(full, parts.at(-1));
+    const stat = fs.lstatSync(full);
+    if (stat.isSymbolicLink()) return { bytes: fs.readlinkSync(full, { encoding: "buffer" }), problem: null };
+    if (!stat.isFile()) return blocked(UNCHECKABLE_TRUST_FILE);
+    const oversized = `exceeds the ${MAX_TRUST_FILE_BYTES}-byte content limit`;
+    if (stat.size > MAX_TRUST_FILE_BYTES) return blocked(oversized);
+    // Recheck the opened descriptor and bound the actual read as well as stat's
+    // size, in case the file changes. NOFOLLOW/NONBLOCK guard leaf replacements.
+    const fd = fs.openSync(full, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+    try {
+      const opened = fs.fstatSync(fd);
+      if (!opened.isFile()) return blocked(UNCHECKABLE_TRUST_FILE);
+      if (opened.size > MAX_TRUST_FILE_BYTES) return blocked(oversized);
+      const chunks = [];
+      let total = 0;
+      while (total <= MAX_TRUST_FILE_BYTES) {
+        const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, MAX_TRUST_FILE_BYTES + 1 - total));
+        const count = fs.readSync(fd, chunk, 0, chunk.length, null);
+        if (!count) return { bytes: Buffer.concat(chunks, total), problem: null, regular: true };
+        total += count;
+        if (total > MAX_TRUST_FILE_BYTES) return blocked(oversized);
+        chunks.push(chunk.subarray(0, count));
+      }
+    } finally { fs.closeSync(fd); }
+  } catch (error) {
+    if (error.code === "ENOENT") return { bytes: empty, problem: null };
+    return blocked(`could not be read (${error.code ?? "I/O error"})`);
+  }
+}
+
+/** GitHub uses the last matching line, including ownerless overrides. */
+export function parseCodeowners(text) {
+  const rules = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const [pattern, ...rest] = line.split(/\s+/);
+    // Unlike gitignore, GitHub does not support negation, character ranges,
+    // or escaping a leading #. Braces are literal, not glob alternation.
+    if (pattern.startsWith("!") || pattern.startsWith("\\#") || /[\[\]]/.test(pattern)) continue;
+    const comment = rest.findIndex((part) => part.startsWith("#"));
+    const owners = comment < 0 ? rest : rest.slice(0, comment);
+    const normalized = normalize(pattern).toLowerCase();
+    const body = normalized.replace(/\/$/, "");
+    if (!body) continue;
+    const anchored = pattern.startsWith("/") || body.includes("/");
+    // CODEOWNERS treats a matching directory as covering its descendants;
+    // a trailing slash specifically requires a directory, not a same-name file.
+    const directory = normalized.endsWith("/");
+    const matcher = globToRegex(directory ? `${body}/**` : body,
+      { anchored, descendants: !directory, literalBraces: true });
+    rules.push({ pattern, owners, matcher });
+  }
+  return rules;
+}
+
+/** First existing CODEOWNERS wins, even if it is empty. Read errors propagate. */
+export function codeownersPaths(repoDir) {
+  for (const file of CODEOWNERS_FILES) {
+    try { return parseCodeowners(fs.readFileSync(path.join(repoDir, file), "utf8")); }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+  return [];
+}
+
+/** Decode raw blobs without allowing binary classification or attributes to hide text. */
+export function decodeTrustBytes(bytes) {
+  if (typeof bytes === "string") return bytes;
+  try { return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes); }
+  catch { return Buffer.from(bytes).toString("latin1"); }
+}
+
+function linesOf(text) {
+  if (!text) return [];
+  const lines = text.split(/\r?\n/);
+  if (lines.at(-1) === "") lines.pop();
+  return lines;
+}
+
+// Multiset subtraction preserves duplicate additions/removals and source lines.
+function changedLines(source, other) {
+  const counts = new Map();
+  for (const line of other) counts.set(line, (counts.get(line) ?? 0) + 1);
+  return source.flatMap((content, index) => {
+    const count = counts.get(content) ?? 0;
+    if (count) { counts.set(content, count - 1); return []; }
+    return [{ content, line: index + 1 }];
+  });
+}
+
+function trustDiffers(before, after) {
+  try { return !isDeepStrictEqual(parseYaml(before)?.trust, parseYaml(after)?.trust); }
+  catch { return true; } // An unreadable edited contract cannot relax the floor.
+}
+
+// Strip format controls before whitespace normalization. Also scan a boundary
+// view: an invisible separator between words (DROP\u200bTABLE) must not hide SQL.
+const contentSentence = (text) => sentence(text.replace(/\p{Cf}/gu, ""));
+const boundaryView = (text) => text.replace(/\p{Cf}/gu, " ");
+function occurrences(text, literal) {
+  const offsets = [];
+  if (!literal) return offsets;
+  for (let offset = text.indexOf(literal); offset >= 0; offset = text.indexOf(literal, offset + 1)) offsets.push(offset);
+  return offsets;
+}
+function contentLines(text, normalizeContent) {
+  return linesOf(text).map((content, index) => ({ content: normalizeContent(content), line: index + 1 })).filter(({ content }) => content);
+}
+function sourceLine(pieces, offset) {
+  let start = 0, index = 0;
+  while (index < pieces.length - 1 && start + pieces[index].content.length <= offset) start += pieces[index++].content.length + 1;
+  return pieces[index]?.line ?? 1;
+}
+
+/** Snapshots include both raw worktree bytes and Git's converted blob bytes. */
+export function evaluateTrust({ rules = [], changedFiles = [], fileChanges = [], codeowners = [] }) {
+  const reasons = [];
+  const snapshots = fileChanges.map(({ file, before, after, problem }) => ({
+    file: normalize(file), before: decodeTrustBytes(before), after: decodeTrustBytes(after), problem,
+  }));
+  const files = [...new Set([...changedFiles.map(normalize), ...snapshots.map((change) => change.file)])];
+  for (const file of files) {
+    const folded = file.toLowerCase();
+    for (const snapshot of snapshots.filter((change) => change.file === file && change.problem)) {
+      reasons.push({ rule: "trust", reason: `changes ${file}, which ${snapshot.problem}, so its content can't be checked`, file });
+    }
+    if ([".nomarmy/trust-map.yml", ".nomarmy/trust-map.proposed.yml", ".nomarmy/trust-map.provenance.json"].includes(folded) || CODEOWNERS_FILES.some((name) => name.toLowerCase() === folded)) reasons.push({ rule: "trust", reason: "changes the repository's trust rules", file });
+    if (CONFIG_FILENAMES.some((name) => name.toLowerCase() === folded)) {
+      const snapshot = snapshots.find((change) => change.file === file);
+      // Missing or unreadable snapshots must never relax the floor.
+      if (!snapshot || snapshots.some((change) => change.file === file && trustDiffers(change.before, change.after))) {
+        reasons.push({ rule: "trust", reason: "changes the repository's trust rules", file });
+      }
+    }
+    for (const [index, rule] of rules.entries()) {
+      if (rule.paths?.some((glob) => globToRegex(normalize(glob).toLowerCase(), { anchored: true, literalBraces: true }).test(folded))) {
+        reasons.push({ rule: index, reason: `changes ${file}, which the repo marks sensitive: ${sentence(rule.reason)}`, file });
+      }
+    }
+    const owner = codeowners.findLast((rule) => rule.matcher.test(folded));
+    if (owner?.owners.length) reasons.push({ rule: "codeowners", reason: `changes ${file}, owned in CODEOWNERS by ${owner.owners.join(" ")}`, file });
+  }
+  // Keep the original view too: normalization must never lower the floor.
+  const contentSnapshots = snapshots.flatMap((snapshot) => [
+    { ...snapshot, normalizeContent: sentence },
+    { ...snapshot, normalizeContent: contentSentence },
+    { ...snapshot, before: boundaryView(snapshot.before), after: boundaryView(snapshot.after), normalizeContent: contentSentence },
+  ]);
+  for (const snapshot of contentSnapshots) {
+    const normalizeContent = snapshot.normalizeContent;
+    const reported = new Set();
+    const report = (index, rule, verb, line) => {
+      reported.add(`${index}:${verb}`);
+      reasons.push({ rule: index, reason: `${verb} sensitive content at ${snapshot.file}:${line}, which the repo marks sensitive: ${sentence(rule.reason)}`, file: snapshot.file, line });
+    };
+    const literals = (rule) => (rule.content ?? []).map(normalizeContent);
+    const before = linesOf(snapshot.before), after = linesOf(snapshot.after);
+    for (const [verb, lines] of [["removes", changedLines(before, after)], ["adds", changedLines(after, before)]]) {
+      // Collapse whitespace across changed lines as well as within each line.
+      const nonempty = lines.filter(({ content }) => normalizeContent(content));
+      if (!nonempty.length) continue;
+      const pieces = nonempty.map(({ content }) => normalizeContent(content));
+      const text = pieces.join(" ");
+      for (const [index, rule] of rules.entries()) {
+        const matches = literals(rule).map((literal) => text.indexOf(literal)).filter((offset) => offset >= 0);
+        if (!matches.length || !lines.length) continue;
+        const offset = Math.min(...matches);
+        let start = 0, lineIndex = 0;
+        while (lineIndex < pieces.length - 1 && start + pieces[lineIndex].length < offset) start += pieces[lineIndex++].length + 1;
+        const line = nonempty[lineIndex].line;
+        report(index, rule, verb, line);
+      }
+    }
+    const oldPieces = contentLines(snapshot.before, normalizeContent), newPieces = contentLines(snapshot.after, normalizeContent);
+    const oldText = normalizeContent(snapshot.before), newText = normalizeContent(snapshot.after);
+    for (const [index, rule] of rules.entries()) {
+      for (const literal of literals(rule)) {
+        const oldMatches = occurrences(oldText, literal), newMatches = occurrences(newText, literal);
+        if (oldMatches.length === newMatches.length) continue;
+        const verb = newMatches.length > oldMatches.length ? "adds" : "removes";
+        if (reported.has(`${index}:${verb}`)) continue;
+        const pieces = verb === "adds" ? newPieces : oldPieces;
+        const matches = verb === "adds" ? newMatches : oldMatches;
+        // Prefer an occurrence spanning an edited line, even when its start
+        // (such as DROP) is unchanged. Existing earlier matches are context.
+        const edited = changedLines(verb === "adds" ? after : before, verb === "adds" ? before : after);
+        const offset = matches.find((match) => {
+          const start = sourceLine(pieces, match), end = sourceLine(pieces, match + literal.length - 1);
+          return edited.some(({ line }) => line >= start && line <= end);
+        }) ?? matches[0];
+        report(index, rule, verb, sourceLine(pieces, offset));
+      }
+    }
+  }
+  const unique = [...new Map(reasons.map((reason) => [JSON.stringify(reason), reason])).values()];
+  return { level: unique.length ? "human" : "normal", reasons: unique };
+}

package/lib/validators.mjs

@@ -28,6 +28,13 @@ export const VALIDATORS_FILE = "validators.yml";
 export const JEV_CHECKS = Object.freeze(["scout-citations", "report-claims"]);
 export const JEV_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
 
+/** The same disclosure before saving, in the saved result, and in listings. */
+export function validatorTrustDisclosure(validator, vendor) {
+  vendor = ({ "claude-cli": "Anthropic", anthropic: "Anthropic", openai: "OpenAI", "openai-codex": "OpenAI", xai: "xAI", meta: "Meta" })[vendor] ?? vendor;
+  return `Adding ${validator} also turns on nomArmy's trust judgment in every repository: each implement job's diff, and its brief at dispatch, is sent to ${vendor} to check for security-sensitive changes (access control, removed checks, personal data, secrets, money). It can only raise a job's review level. Turn it off for a repository with trust: { judgment: false } in its .nomarmy.yml.`;
+}
+
+
 const jevSchema = z.object({
   enabled: z.boolean().default(true),
   key_file: z.string().min(1).optional(),

package/lib/verification-flow.mjs

@@ -1,8 +1,9 @@
-import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { collectVerificationArtifacts } from "./verification-artifacts.mjs";
+import { execHostGitSync, sealWorktree } from "./worktree-pointer.mjs";
+import { removeWorktreeEntry, writeWorktreeFile, readWorktreeFile } from "./worktree-write.mjs";
 
 // ---------------------------------------------------------------------------
 // Production-file revert/restore helpers. These operate on plain
@@ -22,11 +23,14 @@ import { collectVerificationArtifacts } from "./verification-artifacts.mjs";
 // Only needed for D-status files (base content must be restored to revert
 // a deletion); M/A files only ever need the CURRENT worktree bytes, which
 // fs.readFileSync already returns as a Buffer -- no risk there.
+function hostGit(cwd, args, extra = {}) {
+  return execHostGitSync(cwd, args, extra);
+}
 export function gitShowBuffer(cwd, sha, relPath) {
-  return execFileSync("git", ["show", `${sha}:${relPath}`], { cwd, maxBuffer: 64 * 1024 * 1024, timeout: 30000 });
+  return hostGit(cwd, ["show", `${sha}:${relPath}`], { maxBuffer: 64 * 1024 * 1024, timeout: 30000 });
 }
 export function gitModeAtBase(cwd, sha, relPath) {
-  const out = execFileSync("git", ["ls-tree", sha, "--", relPath], { cwd, encoding: "utf8", timeout: 30000 });
+  const out = hostGit(cwd, ["ls-tree", sha, "--", relPath], { encoding: "utf8", timeout: 30000 });
   return out.split(/\s+/, 1)[0] === "100755" ? 0o755 : 0o644;
 }
 
@@ -36,7 +40,7 @@ export function gitModeAtBase(cwd, sha, relPath) {
 export function planProductionRevert({ cwd, baseSha, entries }) {
   return entries.map(e => {
     const full = path.join(cwd, e.path);
-    const current = fs.existsSync(full) ? { content: fs.readFileSync(full), mode: fs.statSync(full).mode & 0o777 } : null;
+    const current = readWorktreeFile(cwd, full);
     const letter = e.status[0];
     let base = null;
     if (letter === "M" || letter === "D" || letter === "R" || letter === "C") {
@@ -44,23 +48,22 @@ export function planProductionRevert({ cwd, baseSha, entries }) {
       try { base = { content: gitShowBuffer(cwd, baseSha, basePath), mode: gitModeAtBase(cwd, baseSha, basePath) }; }
       catch { base = null; }
     }
-    return { path: e.path, letter, full, current, base };
+    return { path: e.path, letter, full, current, base, root: cwd };
   });
 }
 
 // "How this file looked before the worker touched it."
 export function revertToBase(item) {
-  if (item.letter === "A") { fs.rmSync(item.full, { force: true }); return; }
+  if (item.letter === "A") { removeWorktreeEntry(item.root, item.full); return; }
   if (item.letter === "M" || item.letter === "D") {
     if (!item.base) throw new Error(`no base content resolvable for ${item.path}`);
-    fs.mkdirSync(path.dirname(item.full), { recursive: true });
-    fs.writeFileSync(item.full, item.base.content, { mode: item.base.mode });
+    writeWorktreeFile(item.root, item.full, item.base.content, { mode: item.base.mode });
     return;
   }
   // R/C: remove the new path (its "A" half). Practically unreachable
   // pre-commit -- git diff --name-status never rename-pairs an untracked
   // path, and workers never run git add -- but handled for completeness.
-  fs.rmSync(item.full, { force: true });
+  removeWorktreeEntry(item.root, item.full);
 }
 
 // "Put back exactly what the worker actually produced." A deterministic
@@ -69,10 +72,9 @@ export function revertToBase(item) {
 // worker's real bytes, which is the correct outcome.
 export function restoreWorkerVersion(item) {
   if (item.current) {
-    fs.mkdirSync(path.dirname(item.full), { recursive: true });
-    fs.writeFileSync(item.full, item.current.content, { mode: item.current.mode });
+    writeWorktreeFile(item.root, item.full, item.current.content, { mode: item.current.mode });
   } else {
-    fs.rmSync(item.full, { force: true }); // worker had deleted it (letter === "D"); keep it deleted
+    removeWorktreeEntry(item.root, item.full); // worker had deleted it (letter === "D"); keep it deleted
   }
 }
 
@@ -86,8 +88,9 @@ export function blobHash(buf) {
   h.update(buf);
   return h.digest("hex");
 }
-export function currentBlobHash(full) {
-  return fs.existsSync(full) ? blobHash(fs.readFileSync(full)) : blobHash(null);
+export function currentBlobHash(full, root = path.dirname(full)) {
+  try { return blobHash(readWorktreeFile(root, full)?.content ?? null); }
+  catch { return "UNSAFE"; }
 }
 
 // Selects which jobs from a local_workers batch are eligible to be
@@ -177,7 +180,7 @@ export function createVerificationFlow(deps) {
     // Fingerprint the expected post-restore state BEFORE any mutation -- this
     // is the ground truth "worker's real edit" that must exist again,
     // byte-for-byte, no matter what happens below.
-    const expectedAfterRestore = new Map(plan.map(item => [item.full, currentBlobHash(item.full)]));
+    const expectedAfterRestore = new Map(plan.map(item => [item.full, currentBlobHash(item.full, cwd)]));
 
     const revertErrors = [];
     for (const item of plan) { try { revertToBase(item); } catch (error) { revertErrors.push({ path: item.path, error: error.message }); } }
@@ -205,10 +208,11 @@ export function createVerificationFlow(deps) {
       }
     }
     const rerunEvidence = rerun.network ? { network: rerun.network, log: rerun.log, issues: rerun.issues } : {};
-    const mismatches = [...expectedAfterRestore].filter(([full, hash]) => currentBlobHash(full) !== hash).map(([full]) => full);
+    const mismatches = [...expectedAfterRestore].filter(([full, hash]) => currentBlobHash(full, cwd) !== hash).map(([full]) => full);
     if (restoreErrors.length > 0 || mismatches.length > 0) {
+      const listed = [...restoreErrors.map(e => `${e.path} (${e.error})`), ...mismatches];
       return { ...rerunEvidence, status: "restore_failed", rawRerunStatus: rerun.status, basis: "restore-error",
-        reason: `production files may not be fully restored after regression check: ${[...restoreErrors.map(e => e.path), ...mismatches].join(", ")}`, detail: null };
+        reason: `production files may not be fully restored after regression check: ${listed.join(", ")}`, detail: null };
     }
     if (revertErrors.length > 0) {
       return { status: "not_run", rawRerunStatus: null, basis: "revert-error", reason: `failed to revert ${revertErrors.length} file(s): ${revertErrors.map(e => e.path).join(", ")}`, detail: null };
@@ -232,6 +236,7 @@ export function createVerificationFlow(deps) {
       status, profile: value?.profile ?? profile ?? null,
       basis: value?.basis ?? (verificationRunner ? "registered-runner" : "none"),
       reason: value?.reason ?? null, detail: value?.detail ?? null,
+      ...(value?.acceptanceResult ? { acceptanceResult: value.acceptanceResult } : {}),
       ...(value?.network ? { network: value.network, issues: value.issues ?? [] } : {})
     };
   }
@@ -325,6 +330,8 @@ export function createVerificationFlow(deps) {
     fs.mkdirSync(jobDir, { recursive: true });
     await run("git", ["worktree", "add", "-b", branch, worktree, baseSha], { cwd: projectDir });
 
+    const worktreePointerBefore = sealWorktree(worktree, projectDir);
+    fs.writeFileSync(path.join(jobDir, "status.json"), JSON.stringify({ worktree, projectDir, worktreePointerBefore }));
     const merged = [], failed = [];
     for (const job of accepted) {
       try {
@@ -348,7 +355,7 @@ export function createVerificationFlow(deps) {
 
     const status = verification.status === "fail" ? "union_verification_failed" : failed.length > 0 ? "union_partial" : "unioned";
     const manifest = { version: VERSION, jobId: unionJobId, mode: "union", batchId, createdAt: new Date().toISOString(),
-      status, baseSha, branch, worktree,
+      status, baseSha, branch, worktree, worktreePointerBefore,
       jobsUnioned: merged.map(j => ({ jobId: j.jobId, workerId: j.workerId, branch: j.branch, commit: j.commit })),
       jobsMergeFailed: failed, verification, git: record };
     fs.writeFileSync(path.join(jobDir, "metadata.json"), JSON.stringify(manifest, null, 2));

package/lib/verification-network.mjs

@@ -1,6 +1,6 @@
+import { spawnHostGitSync } from "./worktree-pointer.mjs";
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { parseYaml } from './config.mjs';
 import { target } from './egress-proxy.mjs';
 
@@ -23,7 +23,7 @@ export function validateVerificationNetwork(value) {
 
 // Never call this on a job worktree. Only the coordinator supplies projectDir.
 // Fail closed if Git cannot establish both untracked and ignored provenance.
-export function loadVerificationNetwork(projectDir, { check = (args) => spawnSync('git', args, { cwd: projectDir, encoding: 'utf8', timeout: 5000 }) } = {}) {
+export function loadVerificationNetwork(projectDir, { check = (args) => spawnHostGitSync(projectDir, args, { cwd: projectDir, encoding: 'utf8', timeout: 5000 }) } = {}) {
   if (!projectDir) return null;
   const filename = '.nomarmy.local.yml', file = path.join(projectDir, filename);
   let stat;

package/lib/verify.mjs

@@ -22,6 +22,7 @@
 // is spawned with an argv array and `shell: false`. A command string is handed
 // to `/bin/sh -c` *inside* the container, which is inside the sandbox boundary.
 
+import { parseAcceptanceResult } from "./acceptance-result.mjs";
 import { randomUUID, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import fs from "node:fs";
@@ -31,6 +32,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadVerificationNetwork, redactCredentials } from "./verification-network.mjs";
 
+import { isAcceptanceContractPath } from "./diff-checks.mjs";
 import { loadConfig as defaultLoadConfig } from "./config.mjs";
 import { resolveSandboxImage, sandboxHarnesses, nodeDependencyFiles, linkNodePackages, SANDBOX_NPM_ENV } from "./sandbox-images.mjs";
 
@@ -261,6 +263,8 @@ export function buildPodmanArgs({
   user = DEFAULT_CONTAINER_USER,
   workdir = DEFAULT_WORKDIR,
   nodeModulesSource = null,
+  acceptanceToolDir = null,
+  acceptanceContractsDir = null,
   env = {},
   secretEnv = [],
   shmMb = null,
@@ -303,6 +307,14 @@ export function buildPodmanArgs({
   if (nodeModulesSource) {
     args.push("--mount", `type=bind,source=${nodeModulesSource},target=${workdir}/node_modules,readonly`);
   }
+  if (acceptanceToolDir) {
+    // Only the installed checker and its dependencies, never the operator's
+    // repository or credentials. Worker changes cannot replace this checker.
+    for (const dir of ["bin", "lib", "node_modules"]) {
+      args.push("--mount", `type=bind,source=${path.join(acceptanceToolDir, dir)},target=/nomarmy-acceptance/${dir},readonly`);
+    }
+  }
+  if (acceptanceContractsDir) args.push("--mount", `type=bind,source=${acceptanceContractsDir},target=/nomarmy-contracts,readonly`);
   if (shmMb > 0) args.push(`--shm-size=${shmMb}m`);
   if (jobId) args.push("--label", `nomarmy.job=${jobId}`);
   args.push("--entrypoint", "/bin/sh", image, "-c", command);
@@ -513,8 +525,8 @@ export function createPodmanExecutor({ podman = "podman", collect = spawnCollect
     },
 
     /** Run one command inside the sandbox. Never throws. */
-    async run({ command, cwd, image, jobId, network, user, workdir, timeoutMs, maxOutputBytes, nodeModulesSource, env, secretEnv, shmMb }) {
-      const args = buildPodmanArgs({ image, cwd, command, jobId, network, user, workdir, nodeModulesSource, env, secretEnv, shmMb });
+    async run({ command, cwd, image, jobId, network, user, workdir, timeoutMs, maxOutputBytes, nodeModulesSource, acceptanceToolDir, acceptanceContractsDir, env, secretEnv, shmMb }) {
+      const args = buildPodmanArgs({ image, cwd, command, jobId, network, user, workdir, nodeModulesSource, acceptanceToolDir, acceptanceContractsDir, env, secretEnv, shmMb });
       const started = Date.now();
       const outcome = await collect(podman, args, { timeoutMs, maxOutputBytes, env: { ...process.env, ...Object.fromEntries((secretEnv ?? []).filter(name => Object.hasOwn(env ?? {}, name)).map(name => [name, env[name]])) } });
       const durationMs = Date.now() - started;
@@ -750,7 +762,27 @@ export function createVerificationRunner(options = {}) {
     }
 
     // --- resolve what to run -------------------------------------------
-    const resolved = resolveProfile({ config, profile: profile ?? null });
+    const acceptanceFiles = context.acceptanceFiles;
+    if (acceptanceFiles !== undefined && (!Array.isArray(acceptanceFiles) || !acceptanceFiles.length
+      || !acceptanceFiles.every(isAcceptanceContractPath))) {
+      return notRun("invalid changed acceptance contract paths", "config-error");
+    }
+    // Use the same async sandbox executor, command timeout and overall budget
+    // as profile commands. Explicit files prevent checking unrelated contracts.
+    const quote = value => "'" + value.replace(/'/g, "'\\''") + "'";
+    const acceptanceCheck = context.acceptanceCheck === true || Boolean(context.acceptanceContractsDir);
+    const snapshotFiles = context.acceptanceContractsDir
+      ? fs.readdirSync(context.acceptanceContractsDir).sort().map(name => {
+        if (!/^\d+\.yml$/.test(name)) throw new Error("invalid acceptance snapshot filename");
+        return `/nomarmy-contracts/${name}`;
+      }) : null;
+    if (snapshotFiles && !snapshotFiles.length) return notRun("empty acceptance snapshot", "config-error");
+    const checkFiles = snapshotFiles ?? acceptanceFiles ?? [];
+    const resolved = acceptanceFiles || acceptanceCheck ? {
+      found: true, name: "acceptance-contracts", environment: EXECUTABLE_ENVIRONMENT,
+      // Official node:bookworm base installs Node here; never resolve it through dependency PATH.
+      commands: [`/usr/local/bin/node /nomarmy-acceptance/bin/nomarmy.mjs acceptance check --json${acceptanceFiles ? " --strict" : ""}${checkFiles.length ? " " + checkFiles.map(quote).join(" ") : ""}`],
+    } : resolveProfile({ config, profile: profile ?? null });
     if (!resolved.found) {
       const basis = !profile ? "no-profile-requested" : !config ? "no-config" : "unknown-profile";
       return notRun(resolved.reason, basis);
@@ -861,6 +893,8 @@ export function createVerificationRunner(options = {}) {
               timeoutMs,
               maxOutputBytes,
               nodeModulesSource,
+              ...(acceptanceFiles || acceptanceCheck ? { acceptanceToolDir: fileURLToPath(new URL("../", import.meta.url)) } : {}),
+              ...(context.acceptanceContractsDir ? { acceptanceContractsDir: context.acceptanceContractsDir } : {}),
               env: { ...harnessEnv, ...verificationEnv, ...credentialEnv, ...proxyEnv },
               secretEnv: [...Object.keys(credentialEnv), ...["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"]],
               shmMb,
@@ -922,7 +956,16 @@ export function createVerificationRunner(options = {}) {
         return notRun(verdict.detail, verdict.basis ?? "sandbox-unavailable", { ...networkInfo, output: renderOutput() });
       }
 
+      let acceptanceResult;
+      if (acceptanceCheck) {
+        const result = results[0];
+        if (result?.timedOut) return notRun(`timed out after ${result.timeoutMs}ms`, "acceptance-timeout", { ...networkInfo, output: renderOutput() });
+        if (!result?.started || ![0, 1].includes(result.exitCode)) return notRun(verdict.detail, "acceptance-error", { ...networkInfo, output: renderOutput() });
+        try { acceptanceResult = parseAcceptanceResult(result.stdout); }
+        catch (error) { return notRun(error.message, "acceptance-error", { ...networkInfo, output: renderOutput() }); }
+      }
       return {
+        ...(acceptanceResult ? { acceptanceResult } : {}),
         ...networkInfo,
         // No evidence files are kept while credentials or a proxy token are in
         // use: a scan can't catch every encoding (UTF-16, wrapped, compressed).