nomarmy 0.1.0-alpha.7 → 0.1.0-alpha.8

package/README.md

@@ -6,20 +6,22 @@
   <a href="https://github.com/rayson-tech/nomarmy/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License: Apache 2.0"></a>
 </p>
 
-<p align="center"><em>Tiny coders, big appetites for bounded tickets.</em> 🍪</p>
+<p align="center"><em>Every byte verified.</em> 🍪</p>
 
 **Your coding assistant plans; sandboxed workers build; nothing counts until nomArmy has checked it.**
 
+AI coding workers are confident. Their "done, all tests pass" is a claim, not evidence. nomArmy lets your coding assistant (Claude Code, Codex or Cursor) hand work to workers called **noms**, then checks every change itself before anything is committed: the real diff, your tests run in a fresh sandbox, a check that those tests actually catch the change, and a secret scan.
+
 ## TL;DR
 
-1. **Have** Git, Node 24.16+ (or 26.1+; OpenClaw, which nomArmy installs, needs it) and [Podman](https://podman.io) (on macOS: `brew install podman && podman machine init --memory 8192 && podman machine start`; Podman's 2 GiB default is too small for nomArmy's sandboxes).
+1. **Have** Git, Node 24.16+ (or 26.1+) and [Podman](https://podman.io). On macOS, give Podman 8 GiB: `brew install podman && podman machine init --memory 8192 && podman machine start`.
 2. **Install and set up:**
    ```bash
    npm install -g nomarmy@alpha
    cd your-project
    nomarmy setup
    ```
-   `nomarmy setup` is the playbook. It shows a checklist and runs the next step each time you say yes:
+   `nomarmy setup` is a playbook. It shows a checklist and runs the next step each time you say yes:
    ```text
    ✓ Where models run: hosted
    ✓ Installed: OpenClaw 2026.9.6
@@ -29,34 +31,39 @@
      Check: verify the installation
    Run `nomarmy agents add` now? [Y/n]
    ```
-   In order: pick where models run (API keys and subscriptions for most people), install OpenClaw and the sandbox, add your agents (an API key, or your ChatGPT or Muse Code subscription), put the roles on them, write this repo's `.nomarmy.yml`, then check it all. Stop anytime; `nomarmy setup` picks up where you left off.
-
-   **Want every step spelled out?** [Example setup: Claude Code, Codex and an API key](https://github.com/rayson-tech/nomarmy/blob/main/docs/setup/example.md) walks through a complete setup, command by command.
+   Stop anytime; `nomarmy setup` picks up where you left off. **Want every step spelled out?** [Example setup: Claude Code, Codex and an API key](https://github.com/rayson-tech/nomarmy/blob/main/docs/setup/example.md) goes command by command.
 3. **Use it:** restart Claude Code in the project and ask it to use nomArmy for one small bug that has a test. When that works, try `/feature <what you want built>`.
 
-**Have a GPU or a Mac with plenty of memory?** Choose "a local model" in `nomarmy setup` and workers run on llama.cpp on your own machine: no per-token bill and your code stays home, but you pay in hardware, power and speed, and a model too big for your memory crawls. `nomarmy sizing` tells you what fits; see [Install](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#install). A team GPU server works too: [a shared model server](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#a-shared-model-server). Codex or Cursor as the coordinator: `nomarmy connect codex cursor`.
+Stuck? `nomarmy doctor` checks the machine and `nomarmy health` checks everything nomArmy runs on. Upgrading later? `nomarmy update`.
 
-Stuck? `nomarmy doctor` checks the machine, and `nomarmy health` checks everything nomArmy runs on.
+## How every byte gets verified
 
-## What it is
+1. Your coding assistant, the **General**, briefs a job: a task, acceptance criteria, and the tests that prove it.
+2. nomArmy creates a git worktree from your branch and runs the nom in a Podman sandbox with no network and no host credentials. (One exception, the Claude subscription: see [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md#security-posture).)
+3. The nom edits, runs tests, and ends with a four-line report: `STATUS`, `TESTS`, `NOT_DONE`, `NOTE`.
+4. nomArmy treats that report as a claim and checks the evidence itself:
+   - reads the real diff from git, not the nom's description of it
+   - runs your verification profile in a fresh sandbox
+   - reverts the production change and reruns the tests: a test that still passes proves nothing, so the job goes to review instead of being committed
+   - blocks on secrets, and flags tests made to pass (new skips, stubbed imports) and code nothing calls
+5. Only then does it commit, on the nom's own branch. It never merges into yours: reviewing and integrating stay with the General, and with you.
 
-Your coding assistant (Claude Code, Codex or Cursor) stays in charge as the **General**: it decides what gets built and whether the result is acceptable. The work goes to **noms**, workers that implement, test and repair in their own git worktree and sandbox, on an API key, your own ChatGPT or Muse Code subscription, or a local model. nomArmy owns everything in between: worktrees, git, sandboxes, verification, and the evidence that decides whether work is accepted.
+Failing verification stays failed, unconditionally. A malformed report isn't automatically a failure: if the repository changed, nomArmy verifies independently and may recover the work. And the checks aren't the General's to waive: a repo's `.nomarmy.yml` policy (on by default for new repos) makes verification and the revert check mandatory for every job.
 
-**What you get is work you don't have to take on faith**, not cheaper work. Delegating costs the General tokens too: briefing and reviewing. On small, already-diagnosed tickets we measured 4 to 8 times more of the General's tokens than fixing the bug directly, and break-even at roughly 150 lines of context a fix needs to read ([the measurements](https://github.com/rayson-tech/nomarmy/blob/main/docs/experiments/2026-09-20-model-bakeoff-and-economics.md)). It pays off on bigger tickets, on parallel work, and anywhere you'd otherwise have to trust an agent's say-so.
+**Checking without building** costs nothing: `mode: verify` runs a verification profile against any branch, with no worker and no model tokens.
 
-Developed and maintained by Rayson Technologies. This is an alpha (`0.1.0-alpha`).
+## Where the work runs
 
-## How it works
+- **Agents** say where a job can run: an API key, your own ChatGPT or Muse Code subscription, or a local model on llama.cpp.
+- **The army** says which role runs on which agent: Sr and Jr devs build, a security analyst and a data architect review, a PM checks the plan, a PO accepts.
+- **`/feature`** runs a whole feature end to end, from plan through build, review and acceptance, and hands you a branch to merge.
+- **Harnesses** give each repo the right sandbox: Go, Rust, Python and Node (mixed repos too), Playwright browser tests, and fake services like a mock login server, all offline. [Adding one](https://github.com/rayson-tech/nomarmy/blob/main/CONTRIBUTING.md#adding-a-harness) never touches core code.
 
-1. The General briefs a job: a task, acceptance criteria, the tests that prove it.
-2. nomArmy creates a worktree from your branch and runs the worker in a Podman sandbox with no network and no host credentials. (One exception, the Claude subscription: see [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md#security-posture).)
-3. The worker edits, runs tests, and ends with a four-line report: `STATUS`, `TESTS`, `NOT_DONE`, `NOTE`.
-4. nomArmy treats that report as a claim. It reads the real diff from git, runs your verification profile itself in a fresh sandbox, reverts the production change to check the tests actually fail without it, and scans for secrets.
-5. Only then does it commit, on the worker's own branch. It never merges into yours: reviewing and integrating stay with the General, and with you.
+**What you get is work you don't have to take on faith**, not cheaper work. Delegating costs the General tokens too, for briefing and review: on small, already-diagnosed tickets we measured 4 to 8 times more of the General's tokens than fixing the bug directly, with break-even around 150 lines of context a fix needs to read ([the measurements](https://github.com/rayson-tech/nomarmy/blob/main/docs/experiments/2026-09-20-model-bakeoff-and-economics.md)). It pays off on bigger tickets, parallel work, and anywhere you'd otherwise trust an agent's say-so.
 
-A malformed report isn't automatically a failure: if the repository changed, nomArmy verifies independently and may recover the work. Failing verification stays failed, unconditionally. And the checks aren't the General's to waive: a repo's `.nomarmy.yml` policy (on by default for new repos) makes verification and the revert check mandatory for every job.
+**Have a GPU or a Mac with plenty of memory?** Choose "a local model" in `nomarmy setup`: no per-token bill and your code stays home, but you pay in hardware, power and speed. `nomarmy sizing` tells you what fits. A [shared model server](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#a-shared-model-server) works too.
 
-Around that core: **agents** say where a job can run, the **army** says which role runs on which agent, and **`/feature`** runs a whole feature end to end, from plan through build, review and acceptance, handing you a branch to merge.
+Developed and maintained by Rayson Technologies. This is an alpha (`0.1.0-alpha`).
 
 ## Docs
 
@@ -66,7 +73,7 @@ Around that core: **agents** say where a job can run, the **army** says which ro
 | [Example setup](https://github.com/rayson-tech/nomarmy/blob/main/docs/setup/example.md) | Claude Code, Codex and an API key, command by command |
 | [Agents and the army](https://github.com/rayson-tech/nomarmy/blob/main/docs/agents-and-army.md) | Where a job can run, who does what, usage limits, picking an agent |
 | [`/feature` runs](https://github.com/rayson-tech/nomarmy/blob/main/docs/feature-runs.md) | A feature end to end, and watching what nomArmy is doing |
-| [Your repository](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md) | `.nomarmy.yml`, verification, languages and dependencies, what nomArmy checks |
+| [Your repository](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md) | `.nomarmy.yml`, verification, dependencies, private registries, what nomArmy checks |
 | [Harnesses](https://github.com/rayson-tech/nomarmy/blob/main/docs/harnesses.md) | Ecosystem registry, detection, network levels, and requirements |
 | [Configuration](https://github.com/rayson-tech/nomarmy/blob/main/docs/configuration.md) | Settings, swapping the local model, sizing, admission |
 | [Reference](https://github.com/rayson-tech/nomarmy/blob/main/docs/reference.md) | Every CLI command and MCP tool |
@@ -75,23 +82,20 @@ Around that core: **agents** say where a job can run, the **army** says which ro
 
 ## Security
 
-A worker gets a writable git worktree inside a Podman sandbox and nothing else: no network, no host credentials, no Podman socket. Every model call is made by OpenClaw on your machine, never from inside the sandbox. **The exception is a Claude subscription**, whose tools run on your machine, so nomArmy refuses build jobs on it unless you allow it. Never hand a worker production credentials, deployment access or SSH keys. Details: [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md); to report a vulnerability, [SECURITY.md](https://github.com/rayson-tech/nomarmy/blob/main/SECURITY.md).
+A nom gets a writable git worktree inside a Podman sandbox and nothing else: no network, no host credentials, no Podman socket. Every model call is made by OpenClaw on your machine, never from inside the sandbox. Verification can climb a network ladder one rung at a time (fake services on a private network, then an allowlist you approve for a test tenant), but noms never leave `network none`. **The exception is a Claude subscription**, whose tools run on your machine, so nomArmy refuses build jobs on it unless you allow it. Never hand a nom production credentials, deployment access or SSH keys. Details: [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md); to report a vulnerability, [SECURITY.md](https://github.com/rayson-tech/nomarmy/blob/main/SECURITY.md).
 
 ## Status
 
 | Capability | Status |
 |---|---|
-| Delegation core: worktrees, nomArmy-owned git, independent verification, kept failed worktrees | Working, end-to-end tested |
-| Local (llama.cpp) and Bedrock profiles | Working |
-| Scout and decompose modes | Unit and live tested |
-| `auto_union`, `verify_regression`, test-selection and unwired-code checks | Unit and live tested; the heuristics are review flags |
-| Secret scanning (secretlint, hard block) | Unit tested against the real dependency |
-| Agents: api keys | Live-verified with xAI; other providers built to OpenClaw's documented interface |
+| Verification core: worktrees, nomArmy-owned git, independent verification, the revert check, kept failed worktrees | Working, end-to-end tested |
+| `mode: verify`, secret scanning (secretlint, hard block), test-workaround and unwired-code checks | Unit and live tested; the heuristics are review flags |
+| Scout and decompose modes, `auto_union` | Unit and live tested |
+| Agents: API keys | Live-verified with xAI; other providers built to OpenClaw's documented interface |
 | Agents: subscriptions | ChatGPT (Codex) and Muse Code sandboxed and live-verified; Claude live-verified, but its tools run on the host (scout and review by default) |
+| Local (llama.cpp) and Bedrock profiles | Working |
 | The army and `/feature` | Driven by a real Claude Code General across three runs, about 18 implement jobs |
-| Go, Rust, Python and Node repos, and mixed ones | Harness images live-verified: Go modules and Rust crates prefetched; npm, pnpm, yarn, bun and workspaces; pip, pyproject, uv and poetry |
-| Fake services beside the app (mock login server, mock APIs) | Live-verified on a private network with no route out (the `services` harness level) |
-| Browser tests (Playwright + Chromium) | Live-verified offline, with screenshots and traces kept as job evidence |
+| Harnesses: Go, Rust, Python, Node and mixed repos; Playwright; fake services | Live-verified offline |
 | Private registries and a verification-only network allowlist | Live-verified; each passed an independent security review |
 
 What we've learned from real runs, including where delegating pays and where it doesn't, is in [docs/findings.md](https://github.com/rayson-tech/nomarmy/blob/main/docs/findings.md).
@@ -99,13 +103,13 @@ What we've learned from real runs, including where delegating pays and where it
 ### Known limitations
 
 - **A Claude subscription isn't sandboxed.** Its tools run on your machine, so implement jobs on it are refused unless you set `allow_host_tools: true`. See [Security posture](https://github.com/rayson-tech/nomarmy/blob/main/docs/security.md#security-posture).
-- **A refused model costs one job.** When a vendor refuses a model at run time that OpenClaw lists (gpt-6-sol on a ChatGPT plan), the first job on it fails with `model_not_found`. After that nomArmy refuses to dispatch it until a job or test call on it works. `army assign` tests the job's route and catches this before any job.
-- **Claude subscription token counts** come from the Claude CLI's own session log, since OpenClaw sees only the final reply. Totals include cache reads and writes, which make up most of an agent's prompt; each part is also kept separately.
+- **Your own compose services aren't started yet.** A verification profile that needs a real database from your compose file (`environment: basic` or higher) reports `not_run` rather than running without it (and the compose parser doesn't resolve YAML anchors). Fake services from harnesses, like the mock login server, do run.
+- **Private registries don't cover Poetry or Yarn Berry** yet: Poetry can't guarantee a credentialed install runs no package code, and Yarn Berry doesn't read `.npmrc`. uv, pip wheels, npm, pnpm, Yarn Classic and bun work. See [Private registries](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md#private-registries).
+- **A refused model costs one job.** When a vendor refuses a model at run time that OpenClaw lists (gpt-6-sol on a ChatGPT plan), the first job on it fails with `model_not_found`; after that nomArmy won't dispatch it until a job or test call on it works. `army assign` tests the route and catches this before any job.
+- **Claude subscription token counts** come from the Claude CLI's own session log, since OpenClaw sees only the final reply; totals include cache reads and writes.
 - **Test-workaround detection is a flag, not a verdict**: a legitimate new skip still gets flagged.
 - **Deploy-time failures need your own check.** See [Add a check for what unit tests can't see](https://github.com/rayson-tech/nomarmy/blob/main/docs/your-repo.md#nomarmyyml).
-- **Node private registries are not supported yet**: npm, pnpm, yarn and bun lockfiles and workspaces are supported, but the image build has no credentials for private registries (dependency plan step 8).
-- **Verification needing services** (a database, a mock server) reports `not_run` instead of running without them. The compose parser doesn't resolve YAML anchors.
-- **Same-host sandboxes**: the MCP server, OpenClaw and every job's sandbox run on the machine with the coordinator. Only the model can be elsewhere (an agent, or [a shared model server](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#a-shared-model-server)).
+- **Same-host sandboxes**: the MCP server, OpenClaw and every job's sandbox run on the machine with the coordinator. Only the model can be elsewhere.
 
 ## More
 

package/lib/admission.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { executionMode } from "./execution.mjs";
+import { jobLabel, jobElapsedSeconds } from "./job-format.mjs";
 import { loadConfig } from "./config.mjs";
 import { clampInt } from "./budget-state.mjs";
 import { checkBrief, assessAdmission, describeBudgets } from "./budget.mjs";
@@ -160,7 +161,7 @@ export function createJobRuntime(deps) {
     const who = entry.mode === "verify" ? "verification runner" : entry.agent ? `${entry.agent}${entry.model ? `/${entry.model}` : ""}` : "local model";
     const took = Math.round((Date.now() - Date.parse(entry.startedAt)) / 60000);
     const ok = !error && (result?.ok || m.coordinatorStatus === "complete");
-    notify(`nomArmy: ${entry.role ?? entry.mode ?? "job"} ${ok ? "done" : outcome}`, `${entry.workerId ?? entry.jobId} on ${who}: ${outcome} after ${took}m. ${ok ? "Ready for the General's review." : "Needs a look."}`);
+    notify(`nomArmy: ${entry.role ?? entry.mode ?? "job"} ${ok ? "done" : outcome}`, `${entry.label ? `${entry.label} (${entry.workerId ?? entry.jobId})` : entry.workerId ?? entry.jobId} on ${who}: ${outcome} after ${took}m. ${ok ? "Ready for the General's review." : "Needs a look."}`);
   }
   function admissionHardware() {
     return executionMode(deps.env).managesModelServer ? deps.budgetState.hardwareSnapshot : null;
@@ -349,7 +350,7 @@ export function createJobRuntime(deps) {
   function launch(args) {
     const workerId = args.worker_id || null;
     const jobId = slug(workerId || (args.mode === "scout" ? "scout" : "worker"));
-    return trackInRun(args, track(jobId, { mode: args.mode, workerId: workerId || jobId, lane: jobLane(args), agent: args.agentName ?? null, runId: args.run_id ?? null, role: args.armyRole ?? null, model: args.model ?? null },
+    return trackInRun(args, track(jobId, { mode: args.mode, workerId: workerId || jobId, lane: jobLane(args), agent: args.agentName ?? null, runId: args.run_id ?? null, role: args.armyRole ?? null, model: args.model ?? null, label: jobLabel(args) },
       withAgentSlot(args, jobId, () => executeJob({ ...jobArgs(args, workerId), jobId }))));
   }
   // Best-effort progress signal for a job still mid-run: a plain "phase: worker,
@@ -395,7 +396,7 @@ export function createJobRuntime(deps) {
 
   async function summarize(entry, files, jobDir = null) {
     const status = files.status, meta = files.meta ?? files.failure;
-    const elapsedSeconds = status?.startedAt ? Math.round((Date.now() - Date.parse(status.startedAt)) / 1000) : entry ? Math.round((Date.now() - Date.parse(entry.startedAt)) / 1000) : null;
+    const elapsedSeconds = jobElapsedSeconds({ status, meta, entry });
     const out = { jobId: entry?.jobId ?? status?.jobId ?? meta?.jobId ?? null, workerId: entry?.workerId ?? status?.workerId ?? meta?.workerId ?? null,
       mode: entry?.mode ?? status?.mode ?? meta?.mode ?? null, state: null, phase: status?.phase ?? "starting", elapsedSeconds,
       timeoutSeconds: status?.timeoutSeconds ?? null, coordinatorStatus: meta?.coordinatorStatus ?? null, outcome: meta?.outcome ?? null,

package/lib/diff-checks.mjs

@@ -1,3 +1,5 @@
+import path from "node:path";
+
 // ---------------------------------------------------------------------------
 // Test-change classification (plan 16). One tunable constant, on purpose:
 // every heuristic about what counts as a test file lives here and nowhere else.
@@ -416,3 +418,91 @@ export function mergeUntrackedIntoNameStatus(nameStatus, untrackedFiles) {
   return [...(nameStatus ?? []), ...extra];
 }
 
+
+// ---------------------------------------------------------------------------
+// Verification inputs: .nomarmy.yml is read from the operator's checkout so a
+// worker can't weaken its own checks, but the files its commands run come
+// from the worker's worktree. Found live: a worker whose verification ran
+// `node check.js` rewrote check.js to print PASS and exit 0, and the job
+// committed as done. The revert check can't see it: reverting check.js along
+// with the code makes verification fail, which reads as coverage.
+//
+// Blocking (the diff changes what a command runs): a changed non-test file a
+// command names (`node check.js`, `bash scripts/verify.sh`), a changed
+// Makefile or justfile under `make`/`just`, or a changed package.json script
+// that `npm test`/`pnpm run x`/`yarn x`/`bun run x` calls. Test files named by
+// a command are left to the test-change review, since adding cases is normal.
+// Flagged only: test-runner configuration, which is often a legitimate edit.
+// ---------------------------------------------------------------------------
+
+const RUNNER_CONFIG_RE = /(^|\/)(conftest\.py|pytest\.ini|tox\.ini|setup\.cfg|\.coveragerc|(jest|vitest|vite|playwright|karma|cypress)\.config\.[cm]?[jt]s|\.mocharc(\.[a-z]+)?|phpunit\.xml(\.dist)?|\.rspec)$/;
+const TASK_FILES = { make: ["Makefile", "makefile", "GNUmakefile"], just: ["justfile", "Justfile", ".justfile"] };
+
+function shellWords(segment) {
+  return (segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^["']|["']$/g, ""));
+}
+
+// Which package.json script a package-manager command runs, if any.
+function packageScript(words) {
+  const [tool, first, second] = words;
+  if (!["npm", "pnpm", "yarn", "bun"].includes(tool) || !first) return null;
+  if (["run", "run-script"].includes(first)) return second && !second.startsWith("-") ? second : null;
+  if (tool === "npm") return ["test", "t", "tst"].includes(first) ? "test" : ["start", "stop", "restart"].includes(first) ? first : null;
+  if (tool === "bun") return null; // `bun test` is bun's own runner, not a script
+  return first.startsWith("-") || ["install", "add", "remove", "exec", "dlx", "x"].includes(first) ? null : first;
+}
+
+function scriptsOf(text) {
+  try { return JSON.parse(text ?? "")?.scripts ?? {}; } catch { return {}; }
+}
+
+function pytestSection(text) {
+  const match = /^\[tool\.pytest[^\]]*\]\s*$([\s\S]*?)(?=^\[|(?![\s\S]))/m.exec(String(text ?? ""));
+  return match ? match[1].trim() : null;
+}
+
+/**
+ * @param {{ commands: string[], changedFiles: string[], readBase: (file: string) => string|null|Promise<string|null>,
+ *   readHead: (file: string) => string|null|Promise<string|null>, isTestPathFn?: (file: string) => boolean }} input
+ * @returns {Promise<{ blocked: {file: string, command: string, why: string}[], flagged: {file: string, why: string}[] } | null>}
+ */
+export async function detectVerificationInputChanges({ commands = [], changedFiles = [], readBase = () => null, readHead = () => null, isTestPathFn = isTestPath } = {}) {
+  const changed = new Set(changedFiles.map((f) => path.posix.normalize(f)));
+  if (!changed.size) return null;
+  const blocked = [], flagged = [], seen = new Set();
+  const block = (file, command, why) => { if (!seen.has(file)) { seen.add(file); blocked.push({ file, command, why }); } };
+  for (const command of commands) {
+    let dir = "";
+    for (const segment of String(command ?? "").split(/\s*(?:&&|\|\||;|\|)\s*/)) {
+      const all = shellWords(segment);
+      let lead = 0;
+      while (lead < all.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(all[lead])) lead++; // FOO=1 cmd ...
+      const words = all.slice(lead);
+      if (!words.length) continue;
+      const at = (p) => path.posix.normalize(path.posix.join(dir, p));
+      if (words[0] === "cd" && words[1]) { dir = at(words[1]); continue; }
+      for (const word of words) {
+        if (word.startsWith("-") || word.includes("$")) continue;
+        const file = at(word);
+        if (changed.has(file) && !isTestPathFn(file)) block(file, command, `run by \`${command}\``);
+      }
+      for (const name of TASK_FILES[words[0]] ?? []) {
+        const file = at(name);
+        if (changed.has(file)) block(file, command, `read by \`${command}\``);
+      }
+      const script = packageScript(words);
+      const manifest = at("package.json");
+      if (script && changed.has(manifest)) {
+        const before = scriptsOf(await readBase(manifest)), after = scriptsOf(await readHead(manifest));
+        const touched = [script, `pre${script}`, `post${script}`].filter((s) => before[s] !== after[s]);
+        if (touched.length) block(manifest, command, `its script${touched.length > 1 ? "s" : ""} ${touched.map((s) => `"${s}"`).join(", ")} changed, and \`${command}\` runs it`);
+      }
+    }
+  }
+  for (const file of changed) {
+    if (seen.has(file)) continue;
+    if (RUNNER_CONFIG_RE.test(file)) flagged.push({ file, why: "test-runner configuration" });
+    else if (/(^|\/)pyproject\.toml$/.test(file) && pytestSection(await readBase(file)) !== pytestSection(await readHead(file))) flagged.push({ file, why: "its [tool.pytest] settings changed" });
+  }
+  return blocked.length || flagged.length ? { blocked, flagged } : null;
+}

package/lib/execute.mjs

@@ -17,7 +17,7 @@ import { describeRecoveryChanges, reportRecoveryPrompt } from "./worker-prompt.m
 import { parseWorkerReport } from "./report.mjs";
 import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "./outcomes.mjs";
 import { resolveOutcome, finalText, workerMetadata, applyRefactorContract, applyVerificationPolicy } from "./outcome.mjs";
-import { isTestPath, isDocumentationPath, detectScopedTestSelectionRisk, detectUnwiredNewDefinitions, detectMislabeledTestNames, detectPossibleSecrets } from "./diff-checks.mjs";
+import { isTestPath, isDocumentationPath, detectScopedTestSelectionRisk, detectUnwiredNewDefinitions, detectMislabeledTestNames, detectPossibleSecrets, detectVerificationInputChanges } from "./diff-checks.mjs";
 
 // ---------------------------------------------------------------------------
 // Job status for polling. `status.json` is written at every phase transition
@@ -250,7 +250,7 @@ export function createExecutor(deps) {
         // which reads as evidence about work that never happened.
         independentVerification = normalizeVerification({ status: "not_run", basis: "not-applicable", reason: "the worker changed nothing, so there was none of its work to verify" }, verification ?? null);
       } else if (verificationFlow.verificationRunner || !reportValidation.valid) {
-        independentVerification = await runIndependentVerification({ profile: verification ?? null, cwd, jobId, baseSha: base.sha, branch, mode, record: preCommit });
+        independentVerification = await runIndependentVerification({ profile: verification ?? null, cwd, jobId, baseSha: base.sha, branch, mode, record: preCommit, logFile: path.join(jobDir, "verification.log") });
       }
 
       // verify_regression: on by default whenever there's a verification
@@ -299,12 +299,19 @@ export function createExecutor(deps) {
       // Cheap, always-on, additive: never changes commitAllowed/commitBlockedReason
       // on its own (unlike the regression-check override above), only flags for
       // review -- see detectScopedTestSelectionRisk's own doc comment for why.
-      let selectionRisk = null;
+      let selectionRisk = null, verificationInputs = null;
       if (mode === "implement" && verification) {
         try {
           const loaded = loadConfig(projectDir); // the operator's contract; see registerVerificationRunner's call
           const profileCommands = loaded.found ? (loaded.config?.verification?.[verification]?.commands ?? []) : [];
           selectionRisk = detectScopedTestSelectionRisk({ commands: profileCommands, testChanges: preCommit.testChanges });
+          // A diff that changes what those commands run (see
+          // detectVerificationInputChanges): applied below, after the others.
+          verificationInputs = await detectVerificationInputChanges({
+            commands: profileCommands, changedFiles: preCommit.changedFiles ?? [],
+            readBase: (file) => gitRaw(["show", `${base.sha}:${file}`], cwd).catch(() => null),
+            readHead: (file) => { try { return fs.readFileSync(path.join(cwd, file), "utf8"); } catch { return null; } },
+          });
         } catch { /* a config load failure here is the verification runner's own problem to report, not this check's */ }
       }
       const afterSelectionRisk = selectionRisk
@@ -399,7 +406,21 @@ export function createExecutor(deps) {
             commitBlockedReason: `possible secret detected: ${possibleSecrets.reason}`,
             reasons: [...afterHostInstalls.reasons, `POSSIBLE SECRET DETECTED: ${possibleSecrets.reason}`] }
         : afterHostInstalls;
-      const finalOutcome = applyRefactorContract(applyVerificationPolicy(afterSecrets, independentVerification.status, repoPolicy()),
+      // A worker must not be judged by a check it rewrote: a changed script,
+      // Makefile or package.json script that a verification command runs
+      // blocks the commit; changed test-runner config only asks for review.
+      const blockedInputs = verificationInputs?.blocked ?? [], flaggedInputs = verificationInputs?.flagged ?? [];
+      const inputLine = blockedInputs.map((b) => `${b.file} (${b.why})`).join("; ");
+      const afterInputs = blockedInputs.length
+        ? { ...afterSecrets, outcome: afterSecrets.commitAllowed || afterSecrets.outcome === OUTCOMES.WORKER_DONE ? OUTCOMES.NEEDS_REVIEW : afterSecrets.outcome,
+            reviewRequired: true, commitAllowed: false,
+            commitBlockedReason: afterSecrets.commitAllowed ? `the diff changes what verification runs: ${inputLine}` : afterSecrets.commitBlockedReason,
+            reasons: [...afterSecrets.reasons, `VERIFICATION INPUT CHANGED: the diff changes what profile '${verification}' runs, so its result can't be trusted: ${inputLine}`] }
+        : afterSecrets;
+      const afterConfig = flaggedInputs.length
+        ? { ...afterInputs, reviewRequired: true, reasons: [...afterInputs.reasons, `TEST CONFIG CHANGED: ${flaggedInputs.map((c) => `${c.file} (${c.why})`).join("; ")}`] }
+        : afterInputs;
+      const finalOutcome = applyRefactorContract(applyVerificationPolicy(afterConfig, independentVerification.status, repoPolicy()),
         { refactor, verificationStatus: independentVerification.status, testChanges: preCommit.testChanges });
 
       progress("commit");
@@ -411,6 +432,7 @@ export function createExecutor(deps) {
       let coordinatorStatus = COORDINATOR_STATUS_BY_OUTCOME[finalOutcome.outcome] ?? "incomplete";
       const issues = [...finalOutcome.reasons, ...(preCommit.issues ?? [])];
       if (workerError) issues.push(`worker error: ${String(workerError).split("\n")[0]}`);
+      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the worker's report was recovered from the run's transcript`);
       if (workerFailed || workerTimedOut) { const restarted = vmRestartIssue(vmStartedBefore, deps.podmanVmStartedAt?.() ?? null); if (restarted) issues.unshift(restarted); }
       if (repositoryChanged && !commit.created) {
         if (coordinatorStatus === "complete") coordinatorStatus = "incomplete";
@@ -575,6 +597,7 @@ export function createExecutor(deps) {
       const worker = workerMetadata(result ?? attempted);
       const issues = [...outcome.reasons];
       if (workerError) issues.push(`scout error: ${String(workerError).split("\n")[0]}`);
+      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the scout's report was recovered from the run's transcript`);
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`scout recorded ${failures} tool failure(s)`);
       if (dirty) issues.push(`snapshot changed: ${record.repoStatusFiles.join(", ")}`);
       if (reportRecoveryAttempted) {
@@ -706,6 +729,7 @@ export function createExecutor(deps) {
       const worker = workerMetadata(result ?? attempted);
       const issues = [...outcome.reasons];
       if (workerError) issues.push(`decompose error: ${String(workerError).split("\n")[0]}`);
+      if ((result ?? attempted)?.salvaged) issues.push(`runner cleanup failed after the run (${(result ?? attempted).salvagedFrom}); the decomposer's report was recovered from the run's transcript`);
       const failures = worker.toolSummary?.failures ?? 0; if (failures > 0) issues.push(`decomposer recorded ${failures} tool failure(s)`);
       if (dirty) issues.push(`snapshot changed: ${record.repoStatusFiles.join(", ")}`);
       if (overlaps.length) issues.push(`${overlaps.length} subtask pair(s) claim overlapping files; not safe to dispatch as independent jobs as proposed`);

package/lib/job-format.mjs

@@ -124,3 +124,27 @@ export function formatUnion(union) {
   const artifacts = union.worktree ? `\n\nUnion artifacts: ${path.dirname(union.worktree)}\nWorktree retained for review: ${union.worktree}\nBranch retained for review: ${union.branch}` : "";
   return `${banner}--- UNION RECORD ---\n${JSON.stringify(union, null, 2)}${artifacts}`;
 }
+
+/**
+ * What a person calls a job: its commit subject, else the task's first
+ * sentence, capped. Two jobs on one agent and model differ here even with no
+ * role, so a notification can tell them apart.
+ */
+export function jobLabel(args) {
+  const text = String(args?.commit_subject || args?.task || "").split("\n")[0].split(/(?<=\.)\s/)[0].trim();
+  return text.length > 60 ? `${text.slice(0, 57)}...` : text || null;
+}
+
+/**
+ * Seconds a job has run: to its finish once it has one, not to whenever it's
+ * asked about. The record's total_elapsed covers the whole job; an implement
+ * job's finishedAt marks only the worker's end, before verification and commit.
+ */
+export function jobElapsedSeconds({ status = null, meta = null, entry = null, now = Date.now() } = {}) {
+  const total = meta?.metrics?.total_elapsed;
+  if (Number.isFinite(total)) return Math.round(total / 1000);
+  const startedMs = Date.parse(status?.startedAt ?? entry?.startedAt ?? meta?.startedAt ?? "");
+  if (!Number.isFinite(startedMs)) return null;
+  const finishedMs = Date.parse((status?.state === "finished" ? status.updatedAt : null) ?? meta?.finishedAt ?? "");
+  return Math.round(((Number.isFinite(finishedMs) ? finishedMs : now) - startedMs) / 1000);
+}

package/lib/outcome.mjs

@@ -7,6 +7,16 @@ import { parseWorkerReport } from "./report.mjs";
 // failed. Recovery exists so that a mangled REPORT cannot destroy correct WORK.
 // It does not exist to launder a failure into a success.
 // ---------------------------------------------------------------------------
+// A failed verification's own detail (the command, its exit code, the end of
+// its output), capped so an issue line stays readable; the full output is in
+// the job's verification.log.
+const FAILURE_DETAIL_CHARS = 600;
+function failureDetail(independentVerification) {
+  const detail = String(independentVerification?.detail ?? independentVerification?.reason ?? "").trim();
+  if (!detail) return "";
+  return `: ${detail.length > FAILURE_DETAIL_CHARS ? `${detail.slice(0, FAILURE_DETAIL_CHARS)}...` : detail}`;
+}
+
 export function resolveOutcome({ report, repositoryChanged = false, independentVerification = null, regressionCheck = null, workerFailed = false, workerTimedOut = false, mode = "implement" }) {
   const verification = independentVerification?.status ?? "not_run";
   const parsed = report ?? parseWorkerReport("");
@@ -34,7 +44,7 @@ export function resolveOutcome({ report, repositoryChanged = false, independentV
     if (verification === "fail") {
       return { ...base, outcome: OUTCOMES.NEEDS_REVIEW, reviewRequired: true,
         commitBlockedReason: "independent verification failed despite a clean done/pass report",
-        reasons: ["worker claimed done/pass but independent verification failed"] };
+        reasons: [`worker claimed done/pass but independent verification failed${failureDetail(independentVerification)}`] };
     }
     // verify_regression: reverting just the production files and re-running
     // the SAME verification profile still passed (or came back genuinely
@@ -92,7 +102,7 @@ export function resolveOutcome({ report, repositoryChanged = false, independentV
   if (verification === "fail") {
     return { ...recovery, outcome: OUTCOMES.WORKER_REPORT_INVALID,
       commitBlockedReason: "independent verification failed; recovery cannot promote a failure",
-      reasons: [...recovery.reasons, "independent verification FAILED"] };
+      reasons: [...recovery.reasons, `independent verification FAILED${failureDetail(independentVerification)}`] };
   }
   if (verification === "pass") {
     // A leniently recovered `done` plus a passing independent check is the

package/mcp/server.mjs

@@ -37,7 +37,7 @@ import { modelRefusals } from "../lib/health.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
 import { restartNotice } from "../lib/install-freshness.mjs";
 import { createBuildMetrics, resolveOutcome, finalText, workerMetadata, usageMetrics, policyAdmissionProblems, applyRefactorContract, applyVerificationPolicy, resolveVerifyRegression } from "../lib/outcome.mjs";
-import { compactJobRecord, formatResult, formatUnion, testChangeBanner, regressionCheckBanner, decomposeOverlapBanner } from "../lib/job-format.mjs";
+import { jobLabel, compactJobRecord, formatResult, formatUnion, testChangeBanner, regressionCheckBanner, decomposeOverlapBanner } from "../lib/job-format.mjs";
 
 export { run, mapLimit };
 export { readsMeasurable, measureReads };
@@ -582,7 +582,7 @@ server.tool("local_workers", "Run independent jobs (implement or scout) with bou
       // so it was invisible to both ceilings while it ran.
       // A batch job waits for its agent's slot (up to its own timeout) rather
       // than failing because an earlier job in the same batch holds it.
-      return trackInRun(j, track(jobId, { mode: j.mode, workerId, lane: jobLane(j), agent: j.agentName ?? null, runId: j.run_id ?? null, role: j.armyRole ?? null, model: j.model ?? null },
+      return trackInRun(j, track(jobId, { mode: j.mode, workerId, lane: jobLane(j), agent: j.agentName ?? null, runId: j.run_id ?? null, role: j.armyRole ?? null, model: j.model ?? null, label: jobLabel(j) },
         withAgentSlot(j, jobId, () => executeJob({ ...jobArgs(effectiveJob, workerId), jobId }), { waitMs: (j.timeout_seconds ?? 600) * 1000 }))).promise;
     }, { staggerMs: WORKER_START_STAGGER_MS });
     indices.forEach((i, laneI) => { results[i] = laneResults[laneI]; });

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "nomarmy",
-  "description": "A harness for AI coding workers whose claims are never trusted: your coding assistant stays in charge while workers implement and test in sandboxes, on local models, API keys or your own subscriptions.",
+  "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.8",
   "private": false,
   "type": "module",
   "engines": {