nomarmy 0.1.0-alpha.21 → 0.1.0-alpha.22

package/lib/worktree-pointer.mjs

@@ -0,0 +1,246 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { samePath } from "./same-path.mjs";
+
+// A worker worktree's `.git` is a file nomArmy creates, pointing at the
+// operator repo's `.git/worktrees/<name>`. Host git trusts whatever that file
+// says. Record the exact bytes at creation and refuse to run git unless they
+// are still a regular file (not a symlink) with those bytes, and the gitdir
+// they name is one of this repo's own worktrees pointing back here.
+
+const registry = new Map();
+// Windows: git writes long, forward-slash paths while os.tmpdir() can be an
+// 8.3 short name, and the filesystem ignores case. Only the native realpath
+// expands 8.3 names; comparisons fold case there.
+const fold = (p) => (process.platform === "win32" ? p.toLowerCase() : p);
+function realPath(p) { return fs.realpathSync.native(p); }
+
+const jobsRoots = new Set();
+export function registerJobsRoot(root) {
+  if (root) for (const key of registryKeys(root)) jobsRoots.add(key);
+}
+registerJobsRoot(path.join(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"), "jobs"));
+function within(root, target) {
+  const rel = path.relative(root, target);
+  return !rel || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel));
+}
+function integrity(reason) { return new Error(`worktree Git pointer integrity failure: ${reason}`); }
+
+
+function registryKeys(worktree) {
+  const resolved = path.resolve(worktree);
+  const keys = [fold(resolved)];
+  try {
+    const real = fold(realPath(resolved));
+    if (!keys.includes(real)) keys.push(real);
+  } catch { /* a missing path still registers under its resolved spelling */ }
+  return keys;
+}
+
+export function toPointerBytes(value) {
+  if (Buffer.isBuffer(value)) return value;
+  if (value instanceof Uint8Array) return Buffer.from(value);
+  if (typeof value === "string" && value.length > 0) return Buffer.from(value, "base64");
+  return null;
+}
+
+function readRegularFile(file) {
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+  let fd;
+  try { fd = fs.openSync(file, flags); }
+  catch (error) {
+    if (error.code === "ELOOP" || error.code === "EPERM") return { ok: false, reason: "symlink" };
+    if (error.code === "ENOENT") return { ok: false, reason: "missing" };
+    return { ok: false, reason: `unreadable (${error.code ?? error.message})` };
+  }
+  try {
+    const st = fs.fstatSync(fd);
+    if (st.isSymbolicLink()) return { ok: false, reason: "symlink" };
+    if (!st.isFile()) return { ok: false, reason: "not a regular file" };
+    return { ok: true, bytes: fs.readFileSync(fd) };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function parseGitdir(bytes, worktree) {
+  const text = bytes.toString("utf8").replace(/^\uFEFF/, "");
+  const line = text.split(/\r?\n/).find((item) => item.startsWith("gitdir:"));
+  if (!line) return null;
+  const raw = line.slice("gitdir:".length).trim();
+  if (!raw) return null;
+  return path.resolve(worktree, raw);
+}
+
+function realDir(dir) {
+  try { return realPath(dir); } catch { return path.resolve(dir); }
+}
+
+function insideOperatorWorktrees(repoRoot, gitdir) {
+  const root = realDir(path.resolve(repoRoot, ".git", "worktrees"));
+  let target = path.resolve(gitdir);
+  try { target = realPath(target); } catch { /* compare the spelling git wrote */ }
+  const rel = path.relative(fold(root), fold(target));
+  if (!rel || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) return false;
+  return !rel.includes(path.sep);
+}
+
+/**
+ * Why this worktree's `.git` pointer cannot be trusted, or null.
+ * `expectedBytes` is the Buffer nomArmy read at creation, or its base64 record.
+ */
+export function worktreePointerProblem({ worktree, expectedBytes, repoRoot }) {
+  if (!worktree) return "no worktree";
+  if (!repoRoot) return "no operator repository";
+  const expected = toPointerBytes(expectedBytes);
+  if (!expected) return "no recorded pointer bytes";
+  try { if (fs.lstatSync(worktree).isSymbolicLink()) return "symlinked worktree root"; }
+  catch { return "missing worktree"; }
+  const dotGit = path.join(worktree, ".git");
+  let lst;
+  try { lst = fs.lstatSync(dotGit); }
+  catch (error) {
+    if (error.code === "ENOENT") return "missing";
+    return `unreadable (${error.code ?? error.message})`;
+  }
+  if (lst.isSymbolicLink()) return "symlink";
+  if (!lst.isFile()) return lst.isDirectory() ? "directory" : "not a regular file";
+  const read = readRegularFile(dotGit);
+  if (!read.ok) return read.reason;
+  if (!expected.equals(read.bytes)) return "bytes mismatch";
+  const gitdir = parseGitdir(read.bytes, worktree);
+  if (!gitdir) return "pointer is not a gitdir file";
+  if (!insideOperatorWorktrees(repoRoot, gitdir)) return "gitdir is not inside the operator repository worktrees directory";
+  const backFile = path.join(gitdir, "gitdir");
+  let backStat;
+  try { backStat = fs.lstatSync(backFile); }
+  catch { return "worktree back-reference missing"; }
+  if (backStat.isSymbolicLink() || !backStat.isFile()) return "worktree back-reference is not a regular file";
+  const backRead = readRegularFile(backFile);
+  if (!backRead.ok) return `worktree back-reference ${backRead.reason}`;
+  const backPath = path.resolve(gitdir, backRead.bytes.toString("utf8").trim());
+  // Git's back-reference names the worktree by the path of its `.git` file.
+  const namesWorktree = samePath(backPath, worktree) || samePath(backPath, path.join(worktree, ".git"));
+  if (!namesWorktree) return "worktree back-reference does not name this worktree";
+  return null;
+}
+
+export function assertWorktreePointer(options) {
+  const why = worktreePointerProblem(options);
+  if (why) throw new Error(`worktree Git pointer integrity failure: ${why}`);
+}
+
+/** Read the pointer nomArmy just created. Throws if it is not a regular file. */
+export function captureWorktreePointer(worktree) {
+  const dotGit = path.join(worktree, ".git");
+  let lst;
+  try { lst = fs.lstatSync(dotGit); }
+  catch (error) {
+    throw new Error(`worktree Git pointer integrity failure: ${error.code === "ENOENT" ? "missing" : error.message}`);
+  }
+  if (lst.isSymbolicLink()) throw new Error("worktree Git pointer integrity failure: symlink");
+  if (!lst.isFile()) throw new Error("worktree Git pointer integrity failure: not a regular file");
+  const read = readRegularFile(dotGit);
+  if (!read.ok) throw new Error(`worktree Git pointer integrity failure: ${read.reason}`);
+  return read.bytes;
+}
+
+/**
+ * Remember a worktree's creation-time pointer so every later host git command
+ * there can be checked. Returns the serializable record stored on the job.
+ */
+export function sealWorktree(worktree, repoRoot) {
+  const bytes = captureWorktreePointer(worktree);
+  assertWorktreePointer({ worktree, expectedBytes: bytes, repoRoot });
+  const record = { worktree: path.resolve(worktree), expectedBytes: bytes, repoRoot: path.resolve(repoRoot) };
+  for (const key of registryKeys(worktree)) registry.set(key, record);
+  return { applicable: true, exists: true, kind: "file", bytes: bytes.toString("base64") };
+}
+
+export function registerWorktreePointer(worktree, { expectedBytes, repoRoot }) {
+  const bytes = toPointerBytes(expectedBytes);
+  if (!bytes) throw new Error("worktree Git pointer integrity failure: no recorded pointer bytes");
+  const record = { worktree: path.resolve(worktree), expectedBytes: bytes, repoRoot: path.resolve(repoRoot) };
+  for (const key of registryKeys(worktree)) registry.set(key, record);
+}
+
+export function registeredWorktree(cwd) {
+  if (!cwd) return null;
+  // Match the lexical spelling first, so an escaping symlink cannot turn a
+  // worker path into an unchecked operator path.
+  for (const key of registryKeys(cwd)) {
+    const matches = [...registry].filter(([root]) => within(root, key)).sort((a, b) => b[0].length - a[0].length);
+    if (matches.length) return matches[0][1];
+  }
+  return null;
+}
+
+/** Only trusted job records can restore registration, never the live .git. */
+export function registerJobWorktree(record, { worktree = record?.worktree, repoRoot = record?.projectDir } = {}) {
+  if (!worktree || !repoRoot) throw integrity("no recorded worktree or operator repository");
+  const expectedBytes = record?.worktreePointerBefore?.bytes;
+  registerWorktreePointer(worktree, { expectedBytes, repoRoot });
+  assertWorktreePointer({ worktree, expectedBytes, repoRoot });
+  return registeredWorktree(worktree);
+}
+
+export function assertRegisteredWorktree(worktree) {
+  const registered = registeredWorktree(worktree);
+  if (!registered || !registryKeys(worktree).some(key => registryKeys(registered.worktree).includes(key))) throw integrity("unregistered worktree");
+  assertWorktreePointer(registered);
+}
+
+let hooksDir = null;
+export function gitHooksPath() {
+  if (process.platform === "win32") {
+    if (!hooksDir) hooksDir = fs.mkdtempSync(path.join(os.tmpdir(), "nomarmy-hooks-"));
+    return hooksDir;
+  }
+  return "/dev/null";
+}
+
+export function gitSafetyArgs() {
+  return ["-c", `core.hooksPath=${gitHooksPath()}`, "-c", "core.fsmonitor=false"];
+}
+
+export function gitSafetyEnv(env = process.env) {
+  return { ...env, GIT_CONFIG_NOSYSTEM: "1" };
+}
+
+/**
+ * Before a host git command in a registered worker or continuation worktree:
+ * verify the pointer (throw, so the caller runs no git) and return the
+ * defense-in-depth flags. Operator-repo commands are not registered and pass.
+ */
+export function prepareHostGit(cwd = process.cwd(), args = []) {
+  // Removal runs from the operator repo, but its target is worker-controlled.
+  const remove = args.indexOf("worktree");
+  if (remove >= 0 && args[remove + 1] === "remove") {
+    const target = args.slice(remove + 2).find(arg => !arg.startsWith("-"));
+    if (target) {
+      const full = path.resolve(cwd, target);
+      if (registeredWorktree(full) || registryKeys(full).some(key => [...jobsRoots].some(root => within(root, key)))) assertRegisteredWorktree(full);
+    }
+  }
+  const registered = registeredWorktree(cwd);
+  if (!registered) {
+    if (registryKeys(cwd).some(key => [...jobsRoots].some(root => within(root, key)))) throw integrity("unregistered worktree under jobs root");
+    return null;
+  }
+  assertWorktreePointer(registered);
+  const gitdir = parseGitdir(registered.expectedBytes, registered.worktree);
+  if (!gitdir || !insideOperatorWorktrees(registered.repoRoot, gitdir)) throw integrity("recorded gitdir is outside operator worktrees");
+  return { argsPrefix: [...gitSafetyArgs(), `--git-dir=${realPath(gitdir)}`, `--work-tree=${registered.worktree}`,
+    ...(args[0] === "status" ? ["--no-optional-locks"] : [])], env: gitSafetyEnv };
+}
+
+export function execHostGitSync(cwd, args, options = {}) {
+  const prep = prepareHostGit(cwd, args);
+  return execFileSync("git", [...(prep?.argsPrefix ?? []), ...args], { ...options, cwd, env: prep ? prep.env(options.env ?? process.env) : options.env ?? process.env });
+}
+export function spawnHostGitSync(cwd, args, options = {}) {
+  const prep = prepareHostGit(cwd, args);
+  return spawnSync("git", [...(prep?.argsPrefix ?? []), ...args], { ...options, cwd, env: prep ? prep.env(options.env ?? process.env) : options.env ?? process.env });
+}

package/lib/worktree-write.mjs

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import path from "node:path";
+
+// Host restores used to call writeFileSync, which follows symlinks. A sandbox
+// can swap the file (or a parent directory) for a symlink to a host path
+// between verify and the restore. Walk from the worktree root with lstat,
+// refuse any symlinked component, and open the final path with O_NOFOLLOW.
+
+export class WorktreeWriteError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorktreeWriteError";
+    this.restoreFailed = true;
+  }
+}
+
+function lexicalInside(root, full) {
+  const rootResolved = path.resolve(root);
+  const target = path.resolve(full);
+  const rel = path.relative(rootResolved, target);
+  if (!rel || (rel === ".." || rel.startsWith(`..${path.sep}`)) || path.isAbsolute(rel)) {
+    throw new WorktreeWriteError(`refusing path outside worktree: ${full}`);
+  }
+  return { rootResolved, parts: rel.split(path.sep) };
+}
+
+function walkParents(root, full, { createParents }) {
+  const { rootResolved, parts } = lexicalInside(root, full);
+  let current = rootResolved;
+  const rootStat = fs.lstatSync(current);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) throw new WorktreeWriteError(`refusing symlinked or non-directory worktree root ${current}`);
+  for (let i = 0; i < parts.length - 1; i++) {
+    current = path.join(current, parts[i]);
+    let st;
+    try { st = fs.lstatSync(current); }
+    catch (error) {
+      if (error.code !== "ENOENT" || !createParents) {
+        throw new WorktreeWriteError(`refusing missing parent ${current}`);
+      }
+      fs.mkdirSync(current);
+      st = fs.lstatSync(current);
+    }
+    if (st.isSymbolicLink()) throw new WorktreeWriteError(`refusing symlinked parent ${current}`);
+    if (!st.isDirectory()) throw new WorktreeWriteError(`refusing non-directory parent ${current}`);
+  }
+  return path.join(current, parts[parts.length - 1]);
+}
+
+function openNoFollow(finalPath, flags, mode) {
+  try { return fs.openSync(finalPath, flags, mode); }
+  catch (error) {
+    if (error.code === "ELOOP" || error.code === "EPERM") {
+      try { if (fs.lstatSync(finalPath).isSymbolicLink()) fs.unlinkSync(finalPath); } catch { /* already gone */ }
+      throw new WorktreeWriteError(`refusing symlink at ${finalPath}; removed without following`);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Write `data` to `full` inside `root`. A symlink at the target is removed
+ * and the write fails; it is never followed. Symlinked parents fail too.
+ */
+export function writeWorktreeFile(root, full, data, { mode } = {}) {
+  if (!root) throw new WorktreeWriteError("refusing worktree write without a root");
+  const finalPath = walkParents(root, full, { createParents: true });
+  let st = null;
+  try { st = fs.lstatSync(finalPath); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (st?.isSymbolicLink()) {
+    fs.unlinkSync(finalPath);
+    throw new WorktreeWriteError(`refusing symlink at ${finalPath}; removed without following`);
+  }
+  if (st && !st.isFile()) throw new WorktreeWriteError(`refusing non-regular file at ${finalPath}`);
+  const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | (fs.constants.O_NOFOLLOW || 0);
+  const fd = openNoFollow(finalPath, flags, mode ?? 0o666);
+  try {
+    const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    let offset = 0;
+    while (offset < buf.length) offset += fs.writeSync(fd, buf, offset);
+    if (mode != null && process.platform !== "win32") fs.fchmodSync(fd, mode);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** Remove a worktree path without following a symlink at the target or any parent. */
+export function removeWorktreeEntry(root, full) {
+  if (!root) throw new WorktreeWriteError("refusing worktree remove without a root");
+  const finalPath = walkParents(root, full, { createParents: false });
+  let st;
+  try { st = fs.lstatSync(finalPath); }
+  catch (error) { if (error.code === "ENOENT") return; throw error; }
+  if (st.isSymbolicLink() || st.isFile()) {
+    fs.unlinkSync(finalPath);
+    return;
+  }
+  if (st.isDirectory()) {
+    fs.rmSync(finalPath, { recursive: true, force: true });
+    return;
+  }
+  throw new WorktreeWriteError(`refusing to remove non-file ${finalPath}`);
+}
+
+/** Check every component, including the leaf, before host filesystem access. */
+export function assertWorktreePath(root, full, { allowMissing = false } = {}) {
+  const finalPath = walkParents(root, full, { createParents: false });
+  try {
+    if (fs.lstatSync(finalPath).isSymbolicLink()) throw new WorktreeWriteError(`refusing symlink at ${finalPath}`);
+  } catch (error) { if (!(allowMissing && error.code === "ENOENT")) throw error; }
+  return finalPath;
+}
+
+/** Capture contents and mode through one no-follow descriptor. Missing is null. */
+export function readWorktreeFile(root, full) {
+  if (!root) throw new WorktreeWriteError("refusing worktree read without a root");
+  let fd;
+  try {
+    const finalPath = assertWorktreePath(root, full, { allowMissing: true });
+    fd = fs.openSync(finalPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) throw new WorktreeWriteError(`refusing non-regular file at ${finalPath}`);
+    return { content: fs.readFileSync(fd), mode: st.mode & 0o777 };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  } finally { if (fd !== undefined) fs.closeSync(fd); }
+}

package/mcp/server.mjs

@@ -1,3 +1,6 @@
+import { criterionIdSchema } from "../lib/acceptance.mjs";
+import { registerJobWorktree, assertRegisteredWorktree } from "../lib/worktree-pointer.mjs";
+import { removeWorktreeEntry } from "../lib/worktree-write.mjs";
 import { createJobRuntime, jobLane, currentMaxPoolWorkers, splitJobsByLane, toolText, refusalText } from "../lib/admission.mjs";
 export { jobLane, currentMaxPoolWorkers, splitJobsByLane, refusalText };
 import { createExecutor, sleep } from "../lib/execute.mjs";
@@ -37,9 +40,9 @@ import { modelRefusals } from "../lib/health.mjs";
 import { retryRefusedModelsInBackground } from "../lib/refusal-retry.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
 import { restartNotice } from "../lib/install-freshness.mjs";
-import { requestJobStop } from "../lib/openclaw-run.mjs";
-import { loadJobRecords, computeStats, formatStats, formatStatsSummary, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
-import { shareMarkdown } from "../lib/share.mjs";
+import { requestJobStop, JOB_ID_RE } from "../lib/openclaw-run.mjs";
+import { loadJobRecords, gatedJobs, computeStats, formatStats, formatStatsSummary, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
+import { acceptanceSummary, shareMarkdown } from "../lib/share.mjs";
 import { recentSuggestions } from "../lib/suggestions.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { jevSettings, judgeSettings } from "../lib/validators.mjs";
@@ -308,6 +311,8 @@ const { executeJob, executeImplement, executeScout, executeDecompose } = createE
 export { executeJob };
 
 const { WORKER_START_STAGGER_MS, activeJobs, runningCount, agentMaxConcurrent, withAgentSlot, track, notifyJobFinished, capacitySnapshot, displayedCapacity, admit, refusal, runBrief, recordJobInRun, trackInRun, launch, liveProgress, summarize } = createJobRuntime({
+  jevSettings: () => jevSettings(),
+  judgeSettings: () => judgeSettings({ agents: agentsConfig().agents, providerOf: agentProviderId, runsOnHost: agentRunsToolsOnHost }),
   projectDir, stateRoot, jobsRoot, runsRoot, leasesRoot, slotsRoot, run, currentMaxWorkers, slug, agentsConfig, modelCatalogReady, budgetsForJob, resolveSubscriptionSelection, executeJob, subscriptionJobFieldProblems, repoPolicy, jobArgs,
   env: process.env, budgetState, getActiveRunId: () => activeRunId,
   sandboxProblem: () => podmanChecks?.problem() ?? null,
@@ -319,6 +324,7 @@ export const jobSchema = z.object({
   task: z.string().min(1).max(maxTaskChars,
     `Objective exceeds the ${maxTaskChars}-character worker context budget. This length limit does not by itself mean the job is too broad: a single-purpose objective that inlines file contents can hit it just from being verbose. If that's the case here, reference exact paths and line ranges instead (the worker can read them, or use \`evidence\` to hand it the answer already resolved) rather than pasting the file into the brief. If the objective genuinely covers multiple files or concerns, split it into separate jobs.`
   ).describe("implement: the OBJECTIVE the worker must achieve, not the edit it should make. scout: the QUESTION to answer from the repository. decompose: the broad OBJECTIVE to propose a split for."),
+  criteria: z.array(criterionIdSchema).optional().describe("implement: contract IDs from acceptance/*.yml served by this job."),
   acceptance: z.array(z.string().min(1).max(maxAcceptanceItemChars,
     `Acceptance item exceeds ${maxAcceptanceItemChars} characters. Keep each criterion to one concrete, checkable statement.`
   )).max(20).optional().describe("implement: acceptance criteria the worker must satisfy. scout: points a complete answer must cover. decompose: constraints a good split must respect."),
@@ -385,10 +391,10 @@ export function repoPolicy(loadConfigFn = () => loadConfig(projectDir)) {
 // `pool` or `subscription_worker`.
 function jobArgs(args, workerId) {
   const subscriptionWorker = args.subscription_worker;
-  return { task: args.task, acceptance: args.acceptance, verification: args.verification, mode: args.mode, baseRef: args.base_ref,
+  return { task: args.task, acceptance: args.acceptance, criteria: args.criteria, verification: args.verification, mode: args.mode, baseRef: args.base_ref,
     timeoutSeconds: args.timeout_seconds, profile: args.profile, reasoning: args.reasoning, pool: args.pool,
     subscriptionWorker, onBehalfOf: args.on_behalf_of, model: args.model ?? null, reportSize: args.report ?? null, evidence: args.evidence,
-    verifyRegression: resolveVerifyRegression(args), commitSubject: args.commit_subject ?? null, refactor: Boolean(args.refactor), continueFrom: args.continue_from ?? null, stakes: args.stakes ?? null, reviews: args.reviews ?? null, workerId };
+    verifyRegression: resolveVerifyRegression(args), commitSubject: args.commit_subject ?? null, refactor: Boolean(args.refactor), continueFrom: args.continue_from ?? null, stakes: args.stakes ?? null, trustAdmission: args.trustAdmission ?? null, reviews: args.reviews ?? null, workerId };
 }
 server.tool("local_worker", "Run one isolated local worker and wait for it. mode=implement edits in its own worktree and the coordinator commits only on a valid done report (or a recovered job that passed independent verification); failed or incomplete worktrees are retained. mode=scout answers a question from a read-only snapshot with mandatory [path:line] citations that nomArmy verifies and expands. mode=decompose (also read-only) proposes 2+ independent subtasks for a broad objective instead of one worker turn trying to do too much; the proposal is never auto-dispatched, review it and make a separate call with the subtasks you choose. Refuses under memory pressure or over capacity; use local_worker_start + local_worker_status to avoid blocking.", jobSchema.shape,
   async rawArgs => {
@@ -398,7 +404,7 @@ server.tool("local_worker", "Run one isolated local worker and wait for it. mode
     const { problems, admission } = await admit([args]);
     if (problems.length) return refusal(problems);
     const r = await launch(args).promise;
-    const refreshed = (admission.reasons ?? []).filter((line) => line.startsWith("stale usage reading "));
+    const refreshed = (admission.reasons ?? []).filter((line) => (line.startsWith("stale usage reading ") || line.startsWith("Brief trust:")));
     return toolText(refreshed.length ? `${coordinatorResult(r)}\n\n${refreshed.join("\n")}` : coordinatorResult(r), !r.ok);
   });
 server.tool("local_worker_start", "Start one worker or scout in the background and return immediately with a job_id. Poll it with local_worker_status (optionally long-polling with wait_seconds). Same admission rules as local_worker: refuses under memory pressure or when NOMARMY_MAX_WORKERS jobs are already running.", jobSchema.shape,
@@ -486,7 +492,7 @@ server.tool("stats", "What nomArmy's own job records show for this repository (o
 });
 
 server.tool("local_worker_stop", "Stop a running job's worker, for example one burning a frontier model's usage on the wrong track. Its worker ends within about 15 seconds, without the report-recovery call a timeout gets and without running verification; its worktree is kept uncommitted, so a new job with continue_from: <job_id> (and a cheaper model if you like) can finish the work. Works for a job started by any session. Refuses a job that isn't running or is already past its worker.", {
-  job_id: z.string().regex(/^[A-Za-z0-9._-]{1,120}$/),
+  job_id: z.string().regex(JOB_ID_RE),
   reason: z.string().max(300).optional().describe("Why it's being stopped; recorded in the job's issues."),
 }, async ({ job_id, reason }) => {
   const r = requestJobStop({ jobsRoot, jobId: job_id, reason: reason ?? null });
@@ -571,8 +577,14 @@ server.tool("run_finish", "Close a /feature run as complete or stopped, with a o
     if (activeRunId === run_id) activeRunId = null;
     // What nomArmy verified in this run, ready for the pull request's description (lib/share.mjs).
     let prBlock = null;
-    try { prBlock = shareMarkdown(computeStats(loadJobRecords(jobsRoot), { runId: run_id }), { scope: "this feature run" }); } catch { /* the totals stand without it */ }
-    return toolText(JSON.stringify({ id: run.id, status: run.status, ...runTotals(run), ...(prBlock ? { prBlock, prBlockNote: "Put prBlock in the pull request's description as it is: every number is from nomArmy's verified records." } : {}) }, null, 2));
+    let gated = [];
+    try {
+      const records = loadJobRecords(jobsRoot);
+      gated = gatedJobs(records, run_id);
+      const acceptance = await acceptanceSummary(projectDir);
+      prBlock = shareMarkdown(computeStats(records, { runId: run_id }), { scope: "this feature run", acceptance });
+    } catch { /* the totals stand without it */ }
+    return toolText(JSON.stringify({ id: run.id, status: run.status, ...runTotals(run), ...(gated.length ? { gated } : {}), ...(prBlock ? { prBlock, prBlockNote: "Put prBlock in the pull request's description as it is: every number is from nomArmy's verified records." } : {}) }, null, 2));
   } catch (error) { return toolText(error.message, true); }
 });
 server.tool("army", "Who you, the General, are and who you call for what in this repository: your fixed charter and the agent you're defined as, the army's workflow, then each role's description, phase (build, review, acceptance), suggested mode, and the agent it runs on, with which config layer set each value (global, project .nomarmy.yml, local .nomarmy.local.yml). Flags roles with no usable agent, and roles that share your model or subscription (not an independent review). Dispatch a role with `army_role`, or an agent directly with `agent`. Read-only, re-read on every call.", {}, async () => {
@@ -703,7 +715,7 @@ server.tool("local_workers", "Run independent jobs (implement or scout) with bou
     jobs: results.map(r => ({ jobId: r.manifest.jobId, workerId: r.manifest.workerId, mode: r.manifest.mode, outcome: r.manifest.outcome || OUTCOMES.WORKER_FAILED, recovered: Boolean(r.manifest.recovered), status: r.manifest.coordinatorStatus || "failed", branch: r.manifest.branch, commit: r.manifest.commit?.sha || null, worktree: r.manifest.worktree, jobDir: r.jobDir })),
     ...(union ? { union } : {}) };
   const unionSection = union ? `UNION\n\n${formatUnion(withWindowsPaths(union))}\n\n` : "";
-  const refreshed = (admission?.reasons ?? []).filter((line) => line.startsWith("stale usage reading "));
+  const refreshed = (admission?.reasons ?? []).filter((line) => (line.startsWith("stale usage reading ") || line.startsWith("Brief trust:")));
   const text = `BATCH EXECUTION RECORD\n${coordinatorJson(summary)}\n\n${unionSection}WORKER RESULTS\n\n${results.map((r, i) => `===== WORKER ${i + 1} =====\n${coordinatorResult(r)}`).join("\n\n")}${refreshed.length ? `\n\n${refreshed.join("\n")}` : ""}`;
   return toolText(text, results.some(r => !r.ok) || union?.status === "union_verification_failed" || union?.status === "union_error");
 });
@@ -770,7 +782,7 @@ export async function stripRuntimeJunk(worktree) {
   try {
     const statusOut = await gitRaw(["status", "--porcelain=v1", "-z", "--untracked-files=all"], worktree);
     for (const entry of parseStatusPorcelainZ(statusOut)) {
-      if (isRuntimeJunk(entry.file)) fs.rmSync(path.join(worktree, entry.file), { recursive: true, force: true });
+      if (isRuntimeJunk(entry.file)) removeWorktreeEntry(worktree, path.join(worktree, entry.file));
     }
   } catch { /* best-effort; falls through to the normal remove attempt */ }
 }
@@ -828,6 +840,8 @@ server.tool("local_worker_sweep", "Bulk-reap job worktrees/branches that are PRO
     const target = resolveCleanupTarget({ jobDir, jobId, meta, status: meta ? null : readJson(path.join(jobDir, "status.json")) });
     if (!target?.worktree || !fs.existsSync(target.worktree)) continue; // nothing here to reap at all
     const { worktree, branch } = target;
+    try { registerJobWorktree(meta?.worktreePointerBefore ? meta : readJson(path.join(jobDir, "status.json")), { worktree, repoRoot: projectDir }); }
+    catch (error) { skipped.push({ jobId, reason: error.message }); continue; }
     let finishedAtMs;
     try { finishedAtMs = meta?.finishedAt ? Date.parse(meta.finishedAt) : fs.statSync(jobDir).mtimeMs; }
     catch { finishedAtMs = Date.now(); }
@@ -848,6 +862,7 @@ server.tool("local_worker_sweep", "Bulk-reap job worktrees/branches that are PRO
     try {
       await releaseSandboxLocks(worktree);
       await stripRuntimeJunk(worktree);
+      assertRegisteredWorktree(worktree);
       await run("git", ["worktree", "remove", worktree], { cwd: projectDir });
       let branchDeleted = false;
       if (delete_branches && branch) {
@@ -876,8 +891,10 @@ server.tool("local_worker_cleanup", "Remove a retained worker worktree and optio
   if (!target) throw new Error(`Unknown job: ${job_id}`);
   const { worktree, branch } = target;
   if (worktree && fs.existsSync(worktree)) {
+    registerJobWorktree(meta?.worktreePointerBefore ? meta : readJson(path.join(jobDir, "status.json")), { worktree, repoRoot: projectDir });
     await releaseSandboxLocks(worktree);
     if (!force) await stripRuntimeJunk(worktree);
+    assertRegisteredWorktree(worktree);
     await run("git", ["worktree", "remove", ...(force ? ["--force"] : []), worktree], { cwd: projectDir });
   }
   let branchDeleteMode = null;

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.21",
+  "version": "0.1.0-alpha.22",
   "private": false,
   "type": "module",
   "engines": {

package/playbooks/feature.md

@@ -13,17 +13,17 @@ You are the General. Build this feature end to end with nomArmy's army and come
 Follow the army's workflow, calling only the roles the work needs:
 
 0. **Routing.** The `army` tool's `suggestions` come from this repo's recent jobs (a role that keeps failing, a cheaper model doing as well, unreviewed high-stakes work). Tell the operator about any at the start and in your final summary; change routing only if they say so.
-1. **Plan.** Scout the repo as needed (`repo_evidence` first; a scout only for research that would pull many files into your context). Write the plan into the run log: the outcome, acceptance criteria, the pieces, and which role gets each.
-2. **Build.** Dispatch with `army_role` (and `on_behalf_of` when the role's agent is a subscription). The Sr Dev takes the core and harder work; the Jr Dev takes simple, fully specified pieces; UI/UX takes UI. For a role on `auto`, pick the model from the agent's list in the `army` tool: the lighter model for routine work, the frontier one for subtle work. Mark a job `stakes: high` when a mistake would be costly (security or access control, personal or tenant data, data loss, money, anything irreversible), however small the change: that's separate from how hard it is.
-3. **Review.** When the build is in, call the specialists that apply (data architect for data work, security analyst for anything touching auth, input, secrets or data exposure), then the PM against the plan. Every `stakes: high` build job gets an independent review before you accept it: a scout on a different vendor than its worker, with `reviews: <that job id>`. Send what they find back to the builders as new, bounded jobs. A build job that comes back partial, blocked or failing verification is finished with `continue_from: <its job id>` and a brief of just the correction, never by fixing its files yourself: only verified work lands.
+1. **Plan.** Scout the repo as needed (`repo_evidence` first; a scout only for research that would pull many files into your context). Write the plan into the run log: the outcome, acceptance criteria, the pieces, and which role gets each. In the operator checkout, write `acceptance/<feature>.yml` with the feature name, run ID, and durable criteria: stable IDs (such as `ACC-8`), text, `proven_by: []`, and `status: unproven`. Keep job hygiene such as formatting and full-suite checks in the job brief, not the feature contract. Assign the stable IDs to pieces in the plan and each job brief before dispatch; parallel jobs must not choose the next free ID themselves.
+2. **Build.** If this repository has no trust map, suggest `nomarmy trust map` once to the operator; its scout proposal only becomes active through `nomarmy trust review`. Dispatch with `army_role` (and `on_behalf_of` when the role's agent is a subscription). Give each implement job `criteria: ["ACC-8"]` naming the contract IDs it serves; admission refuses IDs not yet defined in the operator checkout. The Sr Dev takes the core and harder work; the Jr Dev takes simple, fully specified pieces; UI/UX takes UI. For a role on `auto`, pick the model from the agent's list in the `army` tool: the lighter model for routine work, the frontier one for subtle work. Mark a job `stakes: high` when a mistake would be costly (security or access control, personal or tenant data, data loss, money, anything irreversible), however small the change: that's separate from how hard it is.
+3. **Review.** When the build is in, call the specialists that apply (data architect for data work, security analyst for anything touching auth, input, secrets or data exposure), then the PM against the plan. Every `stakes: high` build job, and every job with `trust.level: review` or `trust.level: human`, gets an independent review before you accept it: a scout on a different vendor than its worker, with `reviews: <that job id>`. Send what they find back to the builders as new, bounded jobs. A build job that comes back partial, blocked or failing verification is finished with `continue_from: <its job id>` and a brief of just the correction, never by fixing its files yourself: only verified work lands.
 4. **Acceptance.** PO and stakeholder test end to end. Checks that only run existing tests use mode: verify; writing new e2e checks is still an implement job. Fix what they find the same way.
-5. **Integrate.** Review every diff against nomArmy's verified record -- a worker's report is a claim, not evidence -- and bring the accepted work together on one branch. **Never merge into the developer's branch, and never push.** The finished state is a branch ready for the operator to review and merge.
+5. **Integrate.** A job whose record has `trust.level: human` is **not integrated until the operator explicitly says so**. After the operator decides, record it with `nomarmy trust ack <job> --accept|--reject --reason ...`; rejection does not permit integration. Stop before integration, show the operator every `trust.reasons` entry on its own line, and wait. Never choose the conservative option and continue through this gate. Review every diff against nomArmy's verified record -- a worker's report is a claim, not evidence -- and bring the accepted work together on one branch. **Never merge into the developer's branch, and never push.** After integrating the accepted jobs, run `nomarmy acceptance fill <run-id> --dry-run`, review the proposed test-to-criterion mapping, then run `nomarmy acceptance fill <run-id>`. Every new or changed test is proposed for every criterion its job carries; prune unrelated mappings yourself in the contract after filling. Run `nomarmy acceptance check`, keep genuinely unproven criteria visible, and commit the contract with the feature on the review branch. A `CONTRACT BROKEN:` issue means either the change is wrong or the contract must intentionally change in the same pull request. The finished state is a branch ready for the operator to review and merge.
 
 ## Decisions along the way
 
 When you hit a choice you'd normally ask the operator about, don't stop: pick the conservative option (the smaller change, the existing pattern, the reversible path), write the decision and the alternative you didn't take into the run log, and keep going. They'll see every such decision in your final report.
 
-Stop and ask only for something irreversible or outside this repository: merging or pushing, deploying, anything needing cloud or production credentials, deleting data, or changing another repository.
+Stop and ask for any `trust.level: human` gate before integrating its job, or for something irreversible or outside this repository: merging or pushing, deploying, anything needing cloud or production credentials, deleting data, or changing another repository.
 
 A gate's result is not yours to reinterpret. When a check the plan or the operator set (an exact expected output, a count, a checksum, a contract) doesn't match, that's a failure, even when the difference looks cosmetic: whitespace from BSD versus GNU `wc`, line endings, ordering, a trailing newline. Don't judge it "equivalent" and pass it. Either fix the check so it compares what was meant (normalize both sides, and write that change into the run log as a decision), or send the mismatch back as a failed job. A gate the General can wave through is no gate.