toolroll 0.9.36 → 0.9.38

package/dist/provider.d.ts

@@ -81,6 +81,8 @@ export type Invocation = {
     /** A research step's project tools: only these servers, each offering only
      * these read-only actions (Codex's `enabled_tools`). Others are left out. */
     readOnlyTools?: Readonly<Record<string, readonly string[]>>;
+    /** Why a research step's connected service was left out, by server, when it isn't the usual reason (its grant writes). */
+    researchWithheld?: Readonly<Record<string, string>>;
 };
 export type ProviderRunner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
 /** The harness's own account of how a turn ended. */

package/dist/provider.js

@@ -22,6 +22,7 @@ import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
 import {} from "./exec.js";
 import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
+import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
 export const PROVIDER_IDS = ["claude", "codex", "openrouter", "gemini"];
 export function isProviderId(value) {
@@ -169,22 +170,9 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
                 additionalProperties: false,
             },
         },
-        // The automatic build review's reply (build-review.ts). Shape only;
-        // parseBuildFindings is the validator.
-        findings: {
-            type: "array",
-            items: {
-                type: "object",
-                properties: {
-                    severity: { type: "string", enum: ["HIGH", "MEDIUM", "LOW"] },
-                    file: { type: "string" },
-                    line: { type: "integer", minimum: 1 },
-                    scenario: { type: "string" },
-                },
-                required: ["severity", "file", "line", "scenario"],
-                additionalProperties: false,
-            },
-        },
+        // The automatic build review's reply (build-review.ts), from its one
+        // schema (src/contracts/review-findings.ts); parseBuildFindings reads it.
+        findings: FINDINGS_MODEL_SCHEMA,
         // The read request rides the same structured reply channel and
         // session. The machine validates the exact allowlist/hash/range
         // before supplying bytes; this only shapes the request.

package/dist/result-shots.d.ts

@@ -1,5 +1,5 @@
 import { type Notification, type ResultScreenshots, type Store } from "./store.js";
-import type { ChatContent, ChatState } from "./chat-delivery-state.js";
+import { type ChatContent, type ChatState } from "./chat-delivery-state.js";
 /** "Up to 4": the most screenshots one result ever sends. */
 export declare const RESULT_SHOTS_MAX = 4;
 /** The choices in the order Settings and the CLI show them. */

package/dist/result-shots.js

@@ -21,6 +21,7 @@ import { publicChatText } from "./chat-display.js";
 import { chatTitle } from "./chat-voice.js";
 import { itemCaption, readFlowItems } from "./flow-items.js";
 import { FLOW_SHOTS_KIND, RESULT_SHOTS_KIND } from "./store.js";
+import { savedChatPart } from "./chat-delivery-state.js";
 /** "Up to 4": the most screenshots one result ever sends. */
 export const RESULT_SHOTS_MAX = 4;
 /** The choices in the order Settings and the CLI show them. */
@@ -168,6 +169,6 @@ export function refuseResultShots(state, store, part, content, app, now) {
     const title = chatTitle(store, content.image?.taskId ?? content.task ?? "");
     const line = { text: `Screenshots for ${title} weren't sent: the ${app} app isn't allowed to upload files here.`,
         ...(content.task === undefined ? {} : { task: content.task }), ...(content.run === undefined ? {} : { run: content.run }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE id=?").run(JSON.stringify(line), now.toISOString(), part.id);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE id=?").run(savedChatPart(line), now.toISOString(), part.id);
     state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE event=? AND id<>? AND state='pending'").run(part.event, part.id);
 }

package/dist/review-switch.d.ts

@@ -2,15 +2,10 @@
  * build gets (build-review.ts runs it): tables, and the read-only views every
  * surface shows. No schema version bump. Kept free of heavy imports so the
  * status readers can use it without an import cycle. */
+import type { BuildFinding } from "./contracts/review-findings.js";
 import type { Store } from "./store.js";
-export type FindingSeverity = "HIGH" | "MEDIUM" | "LOW";
-/** One automatic-review finding: how bad, where, and how it fails. */
-export type BuildFinding = {
-    severity: FindingSeverity;
-    file: string;
-    line: number;
-    scenario: string;
-};
+/** One automatic-review finding: how bad, where, and how it fails (src/contracts/review-findings.ts). */
+export type { BuildFinding, FindingSeverity } from "./contracts/review-findings.js";
 export declare const REVIEW_SCHEMA = "\n-- A project's explicit review switch. No row: on while the project is under a hands-off mode, off otherwise.\nCREATE TABLE IF NOT EXISTS review_switch (\n  repo        TEXT PRIMARY KEY,\n  enabled     INTEGER NOT NULL CHECK (enabled IN (0, 1)),\n  changed_by  TEXT NOT NULL,\n  changed_at  TEXT NOT NULL\n);\n-- One row per reviewed build run: pending until its one reviewer run settles it.\nCREATE TABLE IF NOT EXISTS build_review (\n  run           INTEGER PRIMARY KEY,\n  task_id       TEXT NOT NULL,\n  repo          TEXT NOT NULL,\n  state         TEXT NOT NULL CHECK (state IN ('pending', 'reviewed', 'not-reviewed')),\n  request       INTEGER,\n  reviewer_run  INTEGER,\n  findings_json TEXT,\n  reason        TEXT,\n  sent_back_as  TEXT,\n  queued_at     TEXT NOT NULL,\n  finished_at   TEXT\n);\nCREATE INDEX IF NOT EXISTS build_review_pending ON build_review (repo) WHERE state = 'pending';\nCREATE INDEX IF NOT EXISTS build_review_sent_back ON build_review (sent_back_as) WHERE sent_back_as IS NOT NULL;\n";
 export type ReviewSwitch = {
     on: boolean;

package/dist/reviewer.d.ts

@@ -2,7 +2,7 @@
  * automatic build review's findings (build-review.ts runs it). This module
  * cannot launch providers, create runs or retry work. */
 import type { CriterionJudgementWord } from "./proof.js";
-import type { BuildFinding } from "./review-switch.js";
+import { type BuildFinding } from "./contracts/review-findings.js";
 /** The files the pass writes INTO the scratch directory for the agent —
  * the patch always; the rubric, re-serialized proof, check log, and
  * screenshots only when this run actually has one (v40) — a grandfathered
@@ -97,18 +97,14 @@ export declare function parseReview(raw: string, patchPaths: ReadonlySet<string>
     ok: false;
     problems: ReviewProblem[];
 };
-export type { BuildFinding, FindingSeverity } from "./review-switch.js";
-export declare const FINDING_LIMITS: {
-    readonly findings: 40;
-    readonly file: 300;
-    readonly scenario: 500;
-};
+export type { BuildFinding, FindingSeverity } from "./contracts/review-findings.js";
 /**
- * The automatic build review's reply, strict and wholesale like parseReview:
- * `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any
- * invalid finding refuses the whole reply — a review that did not answer
- * what it was asked is "not reviewed", never a partial pass. Text is kept
- * to one line so it can travel in a revision note and a terminal.
+ * The automatic build review's reply, read through its contract (src/contracts/review-findings.ts), with all findings
+ * checked together: `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any invalid
+ * finding refuses the whole reply — a review that did not answer what it was asked is "not reviewed", never a partial
+ * pass — and the refusal names each path (`findings[0].line: at least 1`). The reply shares Claude's review channel
+ * (provider.ts), so only its version and findings are read, as always. Text is kept to one line so it can travel in a
+ * revision note and a terminal; its limits are checked after whitespace collapses, as before.
  */
 export declare function parseBuildFindings(raw: string): {
     ok: true;

package/dist/reviewer.js

@@ -1,5 +1,6 @@
 import { citesSuppliedProvenance } from "./review-context.js";
 import { normalizeStructuredJson, REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
+import { readBuildFindings } from "./contracts/review-findings.js";
 /** The files the pass writes INTO the scratch directory for the agent —
  * the patch always; the rubric, re-serialized proof, check log, and
  * screenshots only when this run actually has one (v40) — a grandfathered
@@ -200,13 +201,13 @@ export function parseReview(raw, patchPaths, approvedCriteriaIds = new Set(), pr
         return { ok: false, problems };
     return { ok: true, comments, criteria, ...(payload["learning"] === undefined ? {} : { learning: payload["learning"] }), ...(payload["learningAssessment"] === undefined ? {} : { learningAssessment: payload["learningAssessment"] }) };
 }
-export const FINDING_LIMITS = { findings: 40, file: REVIEW_OUTPUT_LIMITS.path, scenario: REVIEW_OUTPUT_LIMITS.note };
 /**
- * The automatic build review's reply, strict and wholesale like parseReview:
- * `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any
- * invalid finding refuses the whole reply — a review that did not answer
- * what it was asked is "not reviewed", never a partial pass. Text is kept
- * to one line so it can travel in a revision note and a terminal.
+ * The automatic build review's reply, read through its contract (src/contracts/review-findings.ts), with all findings
+ * checked together: `{"version":1,"findings":[{"severity","file","line","scenario"}]}`. Any invalid
+ * finding refuses the whole reply — a review that did not answer what it was asked is "not reviewed", never a partial
+ * pass — and the refusal names each path (`findings[0].line: at least 1`). The reply shares Claude's review channel
+ * (provider.ts), so only its version and findings are read, as always. Text is kept to one line so it can travel in a
+ * revision note and a terminal; its limits are checked after whitespace collapses, as before.
  */
 export function parseBuildFindings(raw) {
     let parsed;
@@ -218,33 +219,8 @@ export function parseBuildFindings(raw) {
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
         return { ok: false, problem: "the reply is not an object" };
-    const payload = parsed;
-    if (payload["version"] !== 1)
-        return { ok: false, problem: "version must be 1" };
-    const list = payload["findings"];
-    if (!Array.isArray(list))
-        return { ok: false, problem: "findings must be an array" };
-    if (list.length > FINDING_LIMITS.findings)
-        return { ok: false, problem: `at most ${FINDING_LIMITS.findings} findings` };
-    const findings = [];
-    const oneLine = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]+/g, " ").replace(/\s+/g, " ").trim();
-    for (const [index, one] of list.entries()) {
-        if (one === null || typeof one !== "object" || Array.isArray(one))
-            return { ok: false, problem: `finding ${index}: not an object` };
-        const finding = one;
-        const severity = finding["severity"];
-        if (severity !== "HIGH" && severity !== "MEDIUM" && severity !== "LOW")
-            return { ok: false, problem: `finding ${index}: severity must be HIGH, MEDIUM or LOW` };
-        const file = typeof finding["file"] === "string" ? oneLine(finding["file"]) : "";
-        if (file.length === 0 || file.length > FINDING_LIMITS.file)
-            return { ok: false, problem: `finding ${index}: file must be a path of 1..${FINDING_LIMITS.file} characters` };
-        const line = finding["line"];
-        if (typeof line !== "number" || !Number.isInteger(line) || line < 1)
-            return { ok: false, problem: `finding ${index}: line must be a positive whole number` };
-        const scenario = typeof finding["scenario"] === "string" ? oneLine(finding["scenario"]) : "";
-        if (scenario.length === 0 || scenario.length > FINDING_LIMITS.scenario)
-            return { ok: false, problem: `finding ${index}: scenario must be one sentence of 1..${FINDING_LIMITS.scenario} characters` };
-        findings.push({ severity, file, line, scenario });
-    }
-    return { ok: true, findings };
+    const read = readBuildFindings(parsed);
+    if (!read.ok)
+        return { ok: false, problem: read.issues.map(issue => issue.line).join("; ") };
+    return { ok: true, findings: read.value.findings };
 }

package/dist/scope.d.ts

@@ -1,4 +1,7 @@
+export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS, type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { type EvidenceKind } from "./contracts/acceptance-terms.js";
+import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
 import type { Store, Mutation } from "./store.js";
 import type { QualityMode } from "./quality.js";
 import type { AuthMode } from "./keys.js";
@@ -176,40 +179,14 @@ export declare function exactKeys(value: object, required: readonly string[], op
 /** Strict re-hydration of a stored snapshot — every field type-proved;
  * anything unexpected is null, never a guess. */
 export declare function profileFromJson(json: string | null): ExecutionProfile | null;
-export type EvidenceKind = "check" | "screenshot" | "changed-path" | "manual-review";
-export declare const EVIDENCE_KINDS: readonly EvidenceKind[];
-export type AcceptanceCriterion = {
-    id: string;
-    /** The signed outcome statement. Restating it differently in a proof is
-     * refuted, not short — the same severity as any other altered term. */
-    statement: string;
-    /** Advisory guidance for HOW to satisfy the statement. Never enters the
-     * digest and is never a term the approval binds — an operator can leave
-     * it, change it, or ignore it without touching what was signed. */
-    how: string | null;
-    /** SIGNED: the evidence kinds a proof must reference, by exact id, to
-     * answer this criterion. Never empty. */
-    evidence: EvidenceKind[];
-};
-export declare const ACCEPTANCE_LIMITS: {
-    readonly criteria: 12;
-    readonly id: 40;
-    readonly statement: 1000;
-    readonly how: 500;
-    readonly evidenceKinds: number;
-};
-export type AcceptanceProblem = {
-    reason: string;
-    message: string;
-};
+export type { AcceptanceCriterion, AcceptanceProblem };
 /**
  * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
  * console form, a routine or template definition): fail closed, every
- * problem reported at once, stable reasons — the same discipline as every
- * other quoted-data parser in this codebase (`plan.ts`, `proof.ts`). An
- * absent or empty `value` parses to `[]` with no problems: whether that is
- * ALLOWED is a question for the caller (`propose` says yes; every authoring
- * road says no), never for this parser.
+ * problem reported at once, each naming its path — the acceptance contract
+ * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
+ * with no problems: whether that is ALLOWED is a question for the caller
+ * (`propose` says yes; every authoring road says no), never for this parser.
  */
 export declare function parseAcceptanceCriteria(value: unknown): {
     criteria: AcceptanceCriterion[];
@@ -257,19 +234,20 @@ export declare function canonicalAcceptance(criteria: readonly AcceptanceCriteri
     statement: string;
     evidence: EvidenceKind[];
 }[];
-export type Scope = {
+/**
+ * A scope's terms, from the scope contract (contracts/scope.ts): what
+ * success looks like in the operator's words (`goal`), what the task is
+ * explicitly not allowed to turn into (`outOfScope`), the paths it expects
+ * to touch (advisory, and worth stating), and the signed acceptance rubric
+ * — `[]` on every scope proposed before v39 and on any legacy road that
+ * still calls `propose` directly: a scope-producing ROAD enforces
+ * non-emptiness, never this type, never `propose`, never the digest.
+ */
+export type SavedScopeTerms = {
+    [K in keyof ScopeTerms]-?: Exclude<ScopeTerms[K], undefined>;
+};
+export type Scope = SavedScopeTerms & {
     taskId: string;
-    /** What success looks like, in the operator's words. */
-    goal: string;
-    /** What this task is explicitly not allowed to turn into. */
-    outOfScope: string | null;
-    /** Paths the work is expected to touch. Advisory, and worth stating. */
-    touches: string[];
-    /** v39: the signed acceptance rubric. `[]` on every scope proposed before
-     * this migration and on any legacy road that still calls `propose`
-     * directly — a scope-producing ROAD enforces non-emptiness, never this
-     * type, never `propose`, never the digest. */
-    acceptance: AcceptanceCriterion[];
     /** v41: evidence policy, signed with the scope. Default is omitted from
      * the digest so every pre-v41 approval remains byte-for-byte valid. */
     qualityMode?: QualityMode;

package/dist/scope.js

@@ -1,3 +1,5 @@
+// The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
+export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
 import { passwordGuardOf } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -29,9 +31,11 @@ import { claimActor, currentActor, parseLeadToken } from "./actor.js";
  * glance is the whole safety property.
  */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-import { hasForbiddenControls } from "./decision.js";
-import { TEXT_LIMITS } from "./text-limits.js";
-import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeWords, } from "./phase-routing.js";
+import { z } from "zod";
+import {} from "./contracts/acceptance-terms.js";
+import { parseContract } from "./contracts/contract.js";
+import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
     return randomBytes(32).toString("base64url");
@@ -248,13 +252,18 @@ export function exactAcceptance(value) {
     }
     if (!Array.isArray(parsed))
         return { ok: false, problem: "the rubric is not a JSON list" };
-    for (const [index, entry] of parsed.entries()) {
-        if (entry === null || typeof entry !== "object" || Array.isArray(entry))
-            return { ok: false, problem: `rubric entry ${index + 1} is not an object` };
-        if (!exactKeys(entry, ["id", "statement", "evidence"], ["how"]))
-            return { ok: false, problem: `rubric entry ${index + 1} carries a key this code never writes` };
+    // Stored, a criterion carries exactly the keys this code writes: the saved rubric schema is strict about them.
+    const strict = parseContract(z.object({ acceptance: storedRubricSchema }), { acceptance: parsed });
+    for (const issue of strict.ok ? [] : strict.issues) {
+        const entry = /^acceptance\[(\d+)\]$/.exec(issue.path);
+        if (entry === null)
+            continue;
+        if (issue.kind === "wrong-type" || issue.kind === "required")
+            return { ok: false, problem: `rubric entry ${Number(entry[1]) + 1} is not an object` };
+        if (issue.kind === "unknown-key")
+            return { ok: false, problem: `rubric entry ${Number(entry[1]) + 1} carries a key this code never writes` };
     }
-    const read = parseAcceptanceCriteria(parsed);
+    const read = readAcceptance(parsed);
     if (read.problems.length > 0)
         return { ok: false, problem: `the rubric does not parse: ${read.problems.map(one => one.message).join("; ")}` };
     return { ok: true, criteria: read.criteria };
@@ -397,126 +406,28 @@ export function profileFromJson(json) {
     }
     return null;
 }
-export const EVIDENCE_KINDS = ["check", "screenshot", "changed-path", "manual-review"];
-export const ACCEPTANCE_LIMITS = {
-    criteria: 12,
-    id: TEXT_LIMITS.acceptanceIdBytes,
-    // A statement is one testable outcome; three hundred bytes forced people to
-    // drop the qualifying clause that made it testable.
-    statement: TEXT_LIMITS.acceptanceStatementBytes,
-    how: TEXT_LIMITS.acceptanceHowBytes,
-    evidenceKinds: EVIDENCE_KINDS.length,
-};
-function acceptanceDescribe(value) {
-    if (value === undefined)
-        return "nothing";
-    if (value === null)
-        return "null";
-    if (typeof value === "string")
-        return `a ${value.length}-char string`;
-    return `a ${Array.isArray(value) ? "array" : typeof value}`;
-}
-function acceptanceProse(value, field, cap, required, problems) {
-    if (value === undefined || value === null || value === "") {
-        if (required)
-            problems.push({ reason: `missing-${field}`, message: `${field} is required` });
-        return null;
-    }
-    if (typeof value !== "string") {
-        problems.push({ reason: `bad-${field}`, message: `${field} must be a string (got ${acceptanceDescribe(value)})` });
-        return null;
-    }
-    if (Buffer.byteLength(value, "utf8") > cap) {
-        problems.push({ reason: `${field}-too-long`, message: `${field} is over ${cap} bytes` });
-        return null;
-    }
-    if (hasForbiddenControls(value)) {
-        problems.push({ reason: `${field}-controls`, message: `${field} carries control characters that could become terminal escapes` });
-        return null;
-    }
-    return value;
-}
 /**
  * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
  * console form, a routine or template definition): fail closed, every
- * problem reported at once, stable reasons — the same discipline as every
- * other quoted-data parser in this codebase (`plan.ts`, `proof.ts`). An
- * absent or empty `value` parses to `[]` with no problems: whether that is
- * ALLOWED is a question for the caller (`propose` says yes; every authoring
- * road says no), never for this parser.
+ * problem reported at once, each naming its path — the acceptance contract
+ * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
+ * with no problems: whether that is ALLOWED is a question for the caller
+ * (`propose` says yes; every authoring road says no), never for this parser.
  */
 export function parseAcceptanceCriteria(value) {
-    const problems = [];
-    if (value === undefined || value === null)
-        return { criteria: [], problems };
-    if (!Array.isArray(value)) {
-        problems.push({ reason: "bad-acceptance", message: `acceptance must be an array (got ${acceptanceDescribe(value)})` });
-        return { criteria: [], problems };
-    }
-    if (value.length > ACCEPTANCE_LIMITS.criteria) {
-        problems.push({ reason: "acceptance-too-many", message: `acceptance lists ${value.length} — cap is ${ACCEPTANCE_LIMITS.criteria}` });
-        return { criteria: [], problems };
-    }
-    const criteria = [];
-    const seen = new Set();
-    for (const [index, entry] of value.entries()) {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            problems.push({ reason: `acceptance[${index}]-shape`, message: `acceptance[${index}] must be an object` });
-            continue;
-        }
-        const one = entry;
-        const id = acceptanceProse(one["id"], `acceptance[${index}].id`, ACCEPTANCE_LIMITS.id, true, problems);
-        if (id !== null && seen.has(id)) {
-            problems.push({ reason: `acceptance[${index}]-duplicate-id`, message: `criterion id "${id}" appears twice` });
-        }
-        else if (id !== null) {
-            seen.add(id);
-        }
-        const statement = acceptanceProse(one["statement"], `acceptance[${index}].statement`, ACCEPTANCE_LIMITS.statement, true, problems);
-        const how = acceptanceProse(one["how"], `acceptance[${index}].how`, ACCEPTANCE_LIMITS.how, false, problems);
-        const rawEvidence = one["evidence"];
-        let evidence = null;
-        if (!Array.isArray(rawEvidence)) {
-            problems.push({
-                reason: `acceptance[${index}]-bad-evidence`,
-                message: `acceptance[${index}].evidence must be a non-empty array of evidence kinds (got ${acceptanceDescribe(rawEvidence)})`,
-            });
-        }
-        else if (rawEvidence.length === 0 || rawEvidence.length > ACCEPTANCE_LIMITS.evidenceKinds) {
-            problems.push({
-                reason: `acceptance[${index}]-evidence-count`,
-                message: `acceptance[${index}].evidence must name 1-${ACCEPTANCE_LIMITS.evidenceKinds} evidence kinds`,
-            });
-        }
-        else {
-            const kinds = [];
-            const seenKinds = new Set();
-            let bad = false;
-            for (const k of rawEvidence) {
-                if (typeof k !== "string" || !EVIDENCE_KINDS.includes(k)) {
-                    problems.push({
-                        reason: `acceptance[${index}]-bad-evidence-kind`,
-                        message: `acceptance[${index}].evidence must draw from ${EVIDENCE_KINDS.join(", ")} (got ${acceptanceDescribe(k)})`,
-                    });
-                    bad = true;
-                    continue;
-                }
-                if (seenKinds.has(k)) {
-                    problems.push({ reason: `acceptance[${index}]-duplicate-evidence-kind`, message: `evidence kind "${k}" appears twice` });
-                    bad = true;
-                    continue;
-                }
-                seenKinds.add(k);
-                kinds.push(k);
-            }
-            if (!bad)
-                evidence = kinds;
-        }
-        if (id === null || statement === null || evidence === null)
-            continue;
-        criteria.push({ id, statement, how, evidence });
-    }
-    return { criteria, problems };
+    const read = readAcceptance(value);
+    // Keep the prose shape plan.ts's existing acceptanceLine consumes. Validation stays in the contract; only this
+    // compatibility boundary formats messages. That mapping takes a field followed by a space, not a colon, and
+    // evidence-array indices belong in the detail because it recognizes only the criterion's index.
+    return {
+        ...read,
+        problems: read.problems.map(problem => ({
+            ...problem,
+            message: problem.message
+                .replace(/^(acceptance\[\d+\]\.evidence)\[(\d+)\]: /, (_, path, index) => `${path} entry ${Number(index) + 1}: `)
+                .replace(/^(acceptance(?:\[\d+\])?(?:\.[A-Za-z]+)?): /, "$1 "),
+        })),
+    };
 }
 /** The exact bytes a rubric's SIGNED terms reduce to for the digest: sorted
  * by id, `how` dropped (advisory, never signed), evidence kinds sorted so
@@ -710,15 +621,18 @@ export function propose(store, input) {
  */
 export function proposeGuarded(store, input) {
     const touches = [...(input.touches ?? [])].map(one => one.trim()).filter(one => one !== "");
+    // Plain words first for what a person typed (lengths, bytes, hidden text), then the scope contract.
     const badText = validateScopeText({ goal: input.goal, outOfScope: input.outOfScope ?? null, touches });
     if (badText !== null)
         return badText;
     const goal = input.goal.trim();
     const outOfScope = input.outOfScope?.trim() || null;
-    const acceptanceParse = parseAcceptanceCriteria(input.acceptance);
-    if (acceptanceParse.problems.length > 0) {
-        return { ok: false, reason: "bad-acceptance" };
+    const terms = readScopeTerms({ goal, outOfScope, touches, acceptance: input.acceptance });
+    if (!terms.ok) {
+        const reason = terms.field === "acceptance" ? "bad-acceptance" : terms.field === "touches" ? "bad-touches" : terms.field === "outOfScope" ? "bad-out-of-scope" : "bad-goal";
+        return { ok: false, reason, message: terms.problems.map(one => one.message).join("; ") };
     }
+    const acceptanceParse = { criteria: terms.terms.acceptance };
     if (acceptanceParse.criteria.length === 0) {
         return { ok: false, reason: "acceptance-required" };
     }
@@ -1070,7 +984,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const routeJson = scope.proposedRouteJson ?? null;
     const route = routeFromJson(routeJson);
     if (route === null) {
-        return { ok: false, reason: "route", problem: routeJson === null ? "the scope was filed under agent routing but carries no route" : "the scope's agent route cannot be read exactly" };
+        return { ok: false, reason: "route", problem: routeJson === null ? "the scope was filed under agent routing but carries no route" : `the scope's agent route cannot be read exactly (${routeJsonProblem(routeJson)})` };
     }
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)