Merge main into fix/vacuous-approve

Resolves two doc conflicts with #14 (signer policy), which landed first:

- CHANGELOG.md: both PRs added a `### Fixed` and `### Added` under
  [Unreleased]. Merged into one of each, signer-policy entries first since
  they are already on main.
- README.md: both added a row to the Core concepts table. Kept both.

nda_review_cli.py auto-merged cleanly -- #14 touches the negotiate
red-flag call sites and sign-off, #15 touches the review engine.
200 tests pass and `make smoke` is green on the merged tree.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: DrBaher

.github/workflows/ci.yml

@@ -166,6 +166,9 @@ jobs:
             --out "$STATE"
           ./nda_review_cli.py negotiate counter --base "${RUNNER_TEMP}/neg/b" --state "$STATE" --auto
           ./nda_review_cli.py negotiate accept  --base "${RUNNER_TEMP}/neg/a" --state "$STATE" --as a
+          # Snapshot the converged state: the signer-policy step below needs
+          # status == converged, and by the end of this flow it is finalized.
+          cp "$STATE" "${RUNNER_TEMP}/neg/converged.json"
           ./nda_review_cli.py negotiate sign-off --base "${RUNNER_TEMP}/neg/a" --state "$STATE" --as a --yes
           ./nda_review_cli.py negotiate sign-off --base "${RUNNER_TEMP}/neg/b" --state "$STATE" --as b --yes
           ./nda_review_cli.py negotiate finalize \
@@ -181,6 +184,96 @@ jobs:
           assert 'a' in state['signoffs'] and 'b' in state['signoffs']
           print('finalized state OK')
           "
+      - name: Signer policy gates unattended sign-off
+        run: |
+          CONVERGED="${RUNNER_TEMP}/neg/converged.json"
+          BASE_A="${RUNNER_TEMP}/neg/a"
+          PERMISSIVE="${RUNNER_TEMP}/neg/permissive.json"
+
+          # expect_exit <want> <label> <cmd...>
+          expect_exit() {
+            want="$1"; label="$2"; shift 2
+            rc=0
+            "$@" >/dev/null 2>&1 || rc=$?
+            if [ "$rc" != "$want" ]; then
+              echo "FAIL: $label — expected exit $want, got $rc"
+              exit 1
+            fi
+            echo "ok: $label (exit $rc)"
+          }
+
+          # 1. Deny by default: absent a policy the agent has no signing authority.
+          test ! -f "$BASE_A/config/signer-policy.json"
+          expect_exit 4 "no policy -> MISSING_SIGNER_POLICY" \
+            ./nda_review_cli.py signer policy run --base "$BASE_A" --state "$CONVERGED"
+
+          # 2. The shipped example escalates this negotiation: round 2 was drafted
+          #    by `auto:middleground`, which is not in the default source whitelist.
+          expect_exit 3 "example policy -> escalate" \
+            ./nda_review_cli.py signer policy run --base "$BASE_A" --state "$CONVERGED" \
+              --signer-policy config/signer-policy.json.example
+
+          # 3. Whitelisting `auto` (deterministic, no LLM) reaches allow. If this ever
+          #    starts failing, the gate has stopped discriminating.
+          python3 -c "
+          import json
+          json.dump({
+              'version': '0.1.0',
+              'name': 'ci-trusts-auto',
+              'red_flags': 'introduced',
+              'allowed_amendment_sources': ['initial', 'accept', 'manual', 'auto'],
+          }, open('${RUNNER_TEMP}/neg/permissive.json', 'w'))
+          "
+          expect_exit 0 "permissive policy -> allow" \
+            ./nda_review_cli.py signer policy run --base "$BASE_A" --state "$CONVERGED" \
+              --signer-policy "$PERMISSIVE"
+
+          # 4. `run` is read-only.
+          before=$(sha256sum "$CONVERGED" | cut -d' ' -f1)
+          ./nda_review_cli.py signer policy run --base "$BASE_A" --state "$CONVERGED" \
+            --signer-policy "$PERMISSIVE" >/dev/null 2>&1
+          test "$before" = "$(sha256sum "$CONVERGED" | cut -d' ' -f1)"
+          echo "ok: signer policy run did not mutate the state file"
+
+          # 5. Fail closed: an escalating verdict refuses sign-off even under --yes,
+          #    and leaves the state byte-identical.
+          cp "$CONVERGED" "${RUNNER_TEMP}/neg/failclosed.json"
+          before=$(sha256sum "${RUNNER_TEMP}/neg/failclosed.json" | cut -d' ' -f1)
+          expect_exit 3 "sign-off escalates under --yes (fail closed)" \
+            ./nda_review_cli.py negotiate sign-off --base "$BASE_A" \
+              --state "${RUNNER_TEMP}/neg/failclosed.json" --as a --yes \
+              --signer-policy config/signer-policy.json.example
+          test "$before" = "$(sha256sum "${RUNNER_TEMP}/neg/failclosed.json" | cut -d' ' -f1)"
+          echo "ok: state untouched on escalate"
+
+          # 6. Allow path signs unattended, records the policy digest, and keeps the
+          #    hash chain intact.
+          cp "$CONVERGED" "${RUNNER_TEMP}/neg/allowed.json"
+          ./nda_review_cli.py negotiate sign-off --base "$BASE_A" \
+            --state "${RUNNER_TEMP}/neg/allowed.json" --as a --signer-policy "$PERMISSIVE" >/dev/null
+          python3 -c "
+          import hashlib, json
+          state = json.load(open('${RUNNER_TEMP}/neg/allowed.json'))
+          rec = state['signoffs']['a']
+          assert rec['method'] == 'signer_policy', rec['method']
+          digest = hashlib.sha256(open('${RUNNER_TEMP}/neg/permissive.json','rb').read()).hexdigest()
+          assert rec['signer_policy']['sha256'] == digest, 'recorded digest != policy file bytes'
+          assert rec['signer_policy']['name'] == 'ci-trusts-auto'
+          print('signer_policy sign-off record OK')
+          "
+          ./nda_review_cli.py negotiate validate --state "${RUNNER_TEMP}/neg/allowed.json" \
+            | python3 -c "
+          import json, sys
+          assert json.loads(sys.stdin.read())['hash_chain_verified'] is True
+          print('hash chain intact after policy sign-off')
+          "
+
+          # 7. The bare flag resolves <base>/config/signer-policy.json.
+          cp config/signer-policy.json.example "$BASE_A/config/signer-policy.json"
+          expect_exit 3 "bare --signer-policy uses config/signer-policy.json" \
+            ./nda_review_cli.py negotiate sign-off --base "$BASE_A" \
+              --state "${RUNNER_TEMP}/neg/failclosed.json" --as a --yes --signer-policy
+
       - name: Run negotiate analyze + validate
         run: |
           STATE="${RUNNER_TEMP}/neg/state.json"

.gitignore

@@ -9,6 +9,9 @@ output/*.md
 # Local organization-specific policy; commit default-policy.json only
 config/org-policy.json
 
+# Local signing authority; commit signer-policy.json.example only
+config/signer-policy.json
+
 # Local LLM provider config (API keys, base URLs); commit llm.json.example only
 config/llm.json
 config/quickstart-answers.json

AGENTS.md

@@ -50,7 +50,7 @@ Call `--catalog json` at startup to know what's available. Don't hardcode subcom
 
 - **`review --llm`** — second-pass adjudication. The agent votes on each rule finding, adds findings the rules missed, and proposes replacement clause language for high-severity items. Deterministic findings are never overwritten.
 - **`negotiate counter --agent --llm`** — drafts amendments aligned with your policy + stance + clause priorities. The hash-chained state file is signed by you, not the agent.
-- **`signer policy run`** — a declarative policy spec that gates which clauses the agent can sign off on. (Future scope; today, sign-off is always human.)
+- **`signer policy run`** — a declarative policy spec that gates which clauses the agent can sign off on. Read-only: it emits a verdict (exit `0` allow, `3` escalate) and never mutates state. Pass `--signer-policy` to `negotiate sign-off` to act on that verdict. Deny-by-default — no policy file means no signing authority (exit `4`), and every omitted gate resolves to its most restrictive value. See [docs/reference/signer-policy.md](docs/reference/signer-policy.md).
 
 The state file format is hash-chained: any tampering breaks `negotiate validate` and the next load. A human can audit between agent rounds exactly what was proposed, line by line.
 
@@ -62,6 +62,8 @@ The state file format is hash-chained: any tampering breaks `negotiate validate`
 | `STATE_HASH_MISMATCH` on `negotiate counter` | `nda-review-cli negotiate validate --state <path>` | The state file was tampered with or corrupted in transit. Restore from the last known-good copy; don't continue. |
 | `MISSING_PLAYBOOK` | `nda-review-cli doctor` | Run `setup --quick --yes` to auto-discover ingest sources and build a playbook. |
 | `LLM_DECLINED` | Provider returned a refusal | Try a different model, or fall back to `--auto` (deterministic, no LLM). Don't silently strip `--strict-fidelity`-equivalent guards. |
+| `SIGNER_POLICY_ESCALATED` | `signer policy run --state <path>` for the per-clause reasons | A human must sign this one. Don't retry with `--yes` — the gate fails closed under it by design. Don't widen the policy to make one negotiation pass. |
+| `MISSING_SIGNER_POLICY` | No `config/signer-policy.json` and no `--signer-policy` | Expected when nobody has granted signing authority. Fall back to human sign-off; don't author a permissive policy to unblock yourself. |
 | `STALEMATE_DETECTED` | `negotiate analyze --state <path>` for the stuck clauses | Surface the `block_diagnosis` to a human. Don't auto-resolve; the stalemate exists for a reason. |
 | Counterparty profile unknown | `nda-review-cli profile-learn --counterparty <name> --review-json <path>` | One-shot learning from a saved review. |
 | `decision: needs_review` | Read `coverage.rules_matched` (0) and `coverage.extraction_status` | Rules ran but matched nothing. Either the file isn't an NDA, or extraction failed. Hand it to a human — never re-run until something returns `approve`. |
@@ -93,6 +95,15 @@ nda-review-cli negotiate counter --state negotiation.json \
 
 Always pair `--agent` with `--dry-run` first in non-interactive contexts; the dry-run output lets you inspect what the LLM proposed before the round is signed and added to the chain.
 
+Once converged, check whether you're allowed to sign it at all before trying:
+
+```bash
+nda-review-cli signer policy run --state negotiation.json    # exit 0 = allowed, 3 = escalate
+nda-review-cli negotiate sign-off --state negotiation.json --as b --signer-policy
+```
+
+Note the default `allowed_amendment_sources` excludes `agent`, so a round *you* drafted with `--agent --llm` escalates unless a human explicitly whitelisted that source. That is the intended posture: an agent should not be the one authorising its own prose.
+
 ## LLM safety
 
 - **NDA text leaving the box.** `--llm` is opt-in per call. Without `--llm`, no contract text leaves the machine. With `--llm`, the CLI prints the destination (provider + base URL + model) and asks for consent unless `--yes-llm-send` or `NDA_LLM_NO_CONFIRM=1` is set.
@@ -111,6 +122,8 @@ Always pair `--agent` with `--dry-run` first in non-interactive contexts; the dr
 | `tutorial` | Interactive primer; runs a sandboxed sample review. |
 | `doctor` | Diagnose first-run issues. Add `--check-llm` to verify LLM provider reachability. |
 | `doctor --check-llm` | 1-token round-trip to the configured LLM provider. Confirms reachability + auth + model name. |
+| `signer policy validate --file <path>` | Schema-checks a signer policy and prints its **effective gates** after restrictive defaults are applied. |
+| `signer policy run --state <path>` | Read-only verdict on whether a converged negotiation may be signed unattended. Exit `0` allow, `3` escalate. |
 
 ## Library use (Python)
 

CHANGELOG.md

@@ -4,6 +4,24 @@
 
 ### Fixed
 
+- **Red-flag detection was inert on every negotiation path.** `rule_engine.red_flag_hits(clause, text)`
+  takes the clause *key* first, but three call sites passed the clause *text* first, so the
+  `RED_FLAG_PATTERNS` lookup always missed and the function always returned `[]`. Consequences,
+  all silent:
+  - `negotiate sign-off` never surfaced an active red flag. A final text reading "the obligations
+    shall survive indefinitely" was presented to the reviewer as clean, and `--yes` signed it.
+  - `negotiate counter --auto` never fired its red-flag branch, so the **middleground** and
+    **compromising** stances never countered a red-flagged clause, and always accepted the
+    counterparty's red-flagged amendments — the `not proposed_red_flags` guard was permanently true.
+    Only `conservative` (which counters on any textual difference) behaved as documented.
+
+  Fixing the argument order also unmasked a latent `TypeError`: the interactive sign-off display
+  joined `red_flags_active` as strings, but the entries are `{pattern, match}` dicts. That branch
+  had never executed. It now renders the matched text.
+- **`make smoke` never ran its negotiation flow.** The target aborted at `negotiate counter` with
+  "Could not auto-detect which party you are" because it never set `org_name` on the two
+  workspaces — the CI job does, so the drift went unnoticed. The Makefile now mirrors CI.
+
 **`review` reported `approve, risk_score 0, findings []` on documents that score `block`.**
 Two independent defects each zeroed out the review, and the fail-open design reported
 "nothing was evaluated" as "nothing was wrong."
@@ -39,6 +57,36 @@ and the fixture's `approve` case is a genuinely clean NDA.
 
 ### Added
 
+- **`signer policy` — declarative signing authority.** A deterministic, read-only gate answering
+  whether a converged negotiation may be signed off without a human. Previously documented in
+  `AGENTS.md` as future scope.
+  - `signer policy validate --file <path>` — schema-check a spec and print its **effective gates**
+    after defaults are applied.
+  - `signer policy run --state <path>` — emit a per-clause verdict. Exit `0` allow, `3` escalate.
+    Never mutates state.
+  - `negotiate sign-off --signer-policy [PATH]` — act on the verdict. On `allow`, sign-off proceeds
+    unattended and records `method: signer_policy` with the policy's name, version, and **SHA-256
+    digest**. On `escalate` it refuses with exit `3` and leaves the state file untouched —
+    **including under `--yes`**. The flag can only ever reduce what gets signed.
+  - Deny-by-default throughout: a missing policy is `MISSING_SIGNER_POLICY` (exit `4`), not
+    permission; every omitted gate resolves to its most restrictive value; and `auto:` / `agent:`
+    amendment sources are excluded from the default whitelist, so machine-drafted clause text needs
+    an explicit human opt-in.
+  - Gates: `require_status`, `max_rounds`, `red_flags`, `allow_fatigue_concessions`,
+    `allow_non_negotiable_changes`, `allowed_amendment_sources`, `never_autosign_clauses`.
+    The hash chain is deliberately **not** a knob — `_negotiate_load_typed` verifies it on every
+    load, so integrity is unconditional and there is no opt-out to misconfigure.
+  - `red_flags` is three-valued (`any` / `introduced` / `ignore`) rather than a boolean, because
+    `RED_FLAG_PATTERNS` are topic triggers, not confirmed defects — `courts of` matches every
+    governing-law clause ever written. Gating on bare presence would escalate every real NDA.
+    `introduced` escalates only on patterns the negotiation *added* relative to round 1, which is
+    the right reading when round 1 is your own template. Default is `any`.
+  - Verdicts report `unevaluated_clauses`: policy clauses whose text `_negotiate_extract_clause_text`
+    couldn't locate, and whose gates are therefore vacuous. Without it, `allow` would read as full
+    coverage when it isn't.
+  - New: `config/signer-policy.json.example`, `docs/reference/signer-policy.md`, and
+    `tests/test_signer_policy.py` (46 tests).
+
 - **Fail-closed review contract.** A review can no longer report `approve` for a document it
   never inspected.
   - Every result carries a **`coverage`** block: `rules_evaluated`, `rules_matched`,
@@ -60,6 +108,7 @@ and the fixture's `approve` case is a genuinely clean NDA.
 - `tests/test_review_coverage.py` (24 tests) and `tests/test_review_golden.py::ClauseRulesPlaybookTests`
   (3 tests). 22 of the 24 fail against the previous source.
 
+
 ## [0.5.4] - 2026-06-03
 
 Security/robustness fixes from a follow-up source audit.

Makefile

@@ -30,13 +30,24 @@ smoke:
 	@echo "=== negotiate smoke ==="
 	./nda_review_cli.py quickstart --base /tmp/nda-make-na --no-prompt --yes >/dev/null
 	./nda_review_cli.py quickstart --base /tmp/nda-make-nb --no-prompt --yes >/dev/null
+	@# `negotiate` auto-detects which party you are by matching org_name against
+	@# the negotiation's parties. quickstart seeds a generic name, so without this
+	@# every counter/accept below aborts. CI does the same in its negotiate-smoke job.
+	@python3 -c "import json; \
+	  [ (lambda p, n: json.dump({**json.load(open(p)), 'org_name': n}, open(p, 'w')))( \
+	      f'/tmp/nda-make-n{d}/config/org-policy.json', n) \
+	    for d, n in (('a', 'Acme'), ('b', 'Beta')) ]"
 	./nda_review_cli.py negotiate init --base /tmp/nda-make-na --template mutual \
 	  --party-a-name "Acme" --party-a-address "1 Main" \
 	  --party-b-name "Beta" --party-b-address "2 Side" \
 	  --purpose "smoke" --effective-date "2026-01-01" \
 	  --out /tmp/nda-make-state.json
 	./nda_review_cli.py negotiate counter --base /tmp/nda-make-nb --state /tmp/nda-make-state.json --auto
 	./nda_review_cli.py negotiate accept --base /tmp/nda-make-na --state /tmp/nda-make-state.json --as a
+	@echo "--- signer policy: the shipped example must escalate an auto-drafted round ---"
+	@! ./nda_review_cli.py signer policy run --base /tmp/nda-make-na \
+	  --state /tmp/nda-make-state.json \
+	  --signer-policy config/signer-policy.json.example >/dev/null 2>&1
 	./nda_review_cli.py negotiate sign-off --base /tmp/nda-make-na --state /tmp/nda-make-state.json --as a --yes
 	./nda_review_cli.py negotiate sign-off --base /tmp/nda-make-nb --state /tmp/nda-make-state.json --as b --yes
 	./nda_review_cli.py negotiate finalize --base /tmp/nda-make-na --state /tmp/nda-make-state.json \