@codedology/code-forge 0.3.2 → 0.4.0

package/src/cli/resolve.mjs

@@ -3,6 +3,10 @@
  * (plan §5.2, §10.3 B4 acceptance): `{provider, model, effort, fallback, cli}`, via B1's
  * `resolveLevel` (the per-level `provider` override wins over the top-level `provider`, R5) plus
  * this block's own `cliNameForProvider` (the CLI binary `engine: subprocess` would spawn).
+ * B32: for L2/L3 (closed-book) an openai level gains `closed_book: "refused"` (and each openai
+ * fallback entry the same key), with the refusal text on stderr; the exit code stays 0. With the
+ * opt-in `review.allow_open_book_codex: true` the mark is `"open-book (allowed)"` and stderr carries
+ * the open-book warning instead.
  *
  * **Fix round 1 (isolated per-file review, all MINOR):**
  *  - The result is now written with `redact.writeSafe(process.stdout, ...)` — B0's documented
@@ -19,6 +23,7 @@
  */
 
 import { loadProjectConfig } from '../config/load.mjs';
+import { CLOSED_BOOK_LEVELS, CODEX_CLOSED_BOOK_REFUSAL, isNoClosedBookProvider, OPEN_BOOK_CODEX_WARNING, openBookCodexAllowed } from '../config/closed-book.mjs';
 import { resolveLevel } from '../config/known-ids.mjs';
 import { cliNameForProvider } from '../engines/provider-cli.mjs';
 import { maskSecretTokens } from '../config/secret-patterns.mjs';
@@ -73,7 +78,17 @@ export default async function resolve(args) {
     return 1;
   }
 
-  const output = { provider: resolved.provider, model: resolved.model, effort: resolved.effort ?? null, fallback: resolved.fallback, cli };
+  // B32: L2/L3 run closed-book; an openai level there is marked (and the spawner refuses it), an
+  // openai fallback entry is marked (and the spawner skips it). Other levels print as before.
+  // With `review.allow_open_book_codex: true` the mark is `open-book (allowed)` and the warning
+  // names what that costs.
+  const closedBook = CLOSED_BOOK_LEVELS.includes(parsed.level);
+  const openBook = openBookCodexAllowed(loaded.config);
+  const mark = openBook ? 'open-book (allowed)' : 'refused';
+  const marked = closedBook && isNoClosedBookProvider(resolved.provider);
+  const fallback = closedBook ? resolved.fallback.map((f) => (isNoClosedBookProvider(f.provider) ? { ...f, closed_book: mark } : f)) : resolved.fallback;
+  if (marked || fallback.some((f) => 'closed_book' in f)) log.warn(openBook ? OPEN_BOOK_CODEX_WARNING : CODEX_CLOSED_BOOK_REFUSAL);
+  const output = { provider: resolved.provider, model: resolved.model, effort: resolved.effort ?? null, fallback, cli, ...(marked ? { closed_book: mark } : {}) };
   writeSafe(process.stdout, `${JSON.stringify(output)}\n`);
   return 0;
 }

package/src/cli/review-file.mjs

@@ -3,7 +3,8 @@
  *
  *   review-file <path> --block <id> [--run <id>]   enqueue; prints {ticket, status: queued|done, file}
  *   review-file --wait <ticket> [--max <90s>]      poll; prints {ticket, status: done, result} or
- *                                                  {ticket, status: pending} when --max elapses
+ *                                                  {ticket, status: pending, reason: wait_timeout}
+ *                                                  when --max elapses (the review is still running)
  *
  * The same content enqueued again after an `unavailable` result is a fresh attempt (`retry: true`),
  * not the old result.
@@ -16,7 +17,9 @@
  * path is given relative to the current directory and stored relative to the REPOSITORY ROOT
  * (V4); an absolute path or a `..` segment is refused with `bad-path`. With no live worker the
  * answer is `worker_down` — never approval — and nothing is enqueued; the coder must then print
- * `===BLOCK <id> FAILED: worker down===`. Output is one JSON line on stdout.
+ * `===BLOCK <id> FAILED: worker down===`. While waiting, `worker_down` needs the worker to look
+ * down on two polls in a row, and a worker whose pid is alive with a fresh heartbeat is never down
+ * (`liveWorker`, B30). Output is one JSON line on stdout.
  * Exit codes: 0 queued/done/pending, 1 bad-path or another refusal, 2 usage, 3 worker_down.
  */
 
@@ -99,18 +102,20 @@ export async function runReviewFile(args, deps = {}) {
       const ticket = assertTicketId(flags.wait);
       const maxMs = flags.max === undefined ? DEFAULT_WAIT_MS : parseMax(flags.max);
       const deadline = Date.now() + maxMs;
+      let downPolls = 0;
       for (;;) {
         if (isDone(repoRoot, ticket)) {
           const result = doneResult(repoRoot, ticket);
           say({ ticket, status: 'done', result, ...fixList(result) });
           return 0;
         }
-        if (!liveWorker(repoRoot)) {
+        downPolls = liveWorker(repoRoot) ? 0 : downPolls + 1;
+        if (downPolls >= 2 && !isDone(repoRoot, ticket)) {
           say({ ticket, status: 'worker_down' });
           return 3;
         }
-        if (Date.now() >= deadline) {
-          say({ ticket, status: 'pending' });
+        if (Date.now() >= deadline && downPolls === 0) {
+          say({ ticket, status: 'pending', reason: 'wait_timeout' });
           return 0;
         }
         await new Promise((resolve) => setTimeout(resolve, deps.pollMs ?? POLL_MS));

package/src/cli/run.mjs

@@ -4,7 +4,8 @@
  *
  *   run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]
  *   run start --reattach --run <id> [--worker-pid <pid>]
- *   run status --run <id>
+ *   run status --run <id>     (B33: includes spent_usd / budget_usd / unknown_usd_sessions)
+ *   run reload --run <id>
  *   run end --run <id>
  *
  * B11: from the CLI (the default export), `run start` without `--worker-pid` sweeps dead run
@@ -12,18 +13,31 @@
  * queue and pins it; `run start --reattach` without `--worker-pid` re-pins the live worker the
  * queue announces (`repinWorker`). Called as `runRun(args, deps)` without `deps.startWorker` (the
  * state tests), no worker is launched and none is pinned unless `--worker-pid` is given.
+ *
+ * B35 `run reload`: re-read and validate the workspace's `.code-forge.yml` and replace the run's
+ * config snapshot (`reloadRun`) — no `block stop` / `run end` / `run start` cycle. An invalid
+ * config or a change to a key that is fixed for the run is refused with nothing changed. It prints
+ * the changed key PATHS (never values); queued review tickets keep the config they were enqueued
+ * with, new tickets use the new one, and the worker picks it up on its next ticket (it reads the
+ * run record per ticket — no restart).
  */
 
+import { readdirSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
-import { appendRow } from '../ledger/write.mjs';
+import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
+import { loadSeenInCache } from '../config/refresh.mjs';
+import { validateConfig } from '../config/validate.mjs';
+import { budgetUsdOf, runSpend } from '../ledger/spend.mjs';
+import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { endRun, processStartTime, readRun, reattachWorker, startRun, stopPinnedWorker } from '../state/run.mjs';
+import { endRun, processStartTime, readRun, reattachWorker, reloadRun, startRun, stopPinnedWorker } from '../state/run.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { sweepRoots, tmpBase } from '../util/tmp.mjs';
 import { launchWorker, repinWorker } from '../worker/loop.mjs';
-import { repoRootOf } from '../worker/ticket.mjs';
+import { pendingTickets, queueDir } from '../worker/queue.mjs';
+import { repoRootOf, WorkerError } from '../worker/ticket.mjs';
+import { hasCliOnPath } from './validate.mjs';
 
 /**
  * `project.slug` from config, else the workspace directory name as a ledger slug. The configured
@@ -40,6 +54,25 @@ export function slugFor(cfg, workspace) {
   return derived || 'project';
 }
 
+/**
+ * B33: the run's spend so far (estimated USD from its ledger rows, open blocks included) and its
+ * `budget.usd` (read from the workspace config now — the value the next session is checked
+ * against; null when unset or the config does not load).
+ * @param {Record<string, any>} record
+ * @returns {Promise<{spent_usd: number, budget_usd: number | null, unknown_usd_sessions: number}>}
+ */
+async function spendOf(record) {
+  const { usd, unknown } = runSpend(await readAllRows(record.project), record.run_id);
+  let budget = null;
+  try {
+    const loaded = await loadProjectConfig(record.workspace);
+    budget = loaded.ok ? budgetUsdOf(loaded.config) : null;
+  } catch {
+    budget = null;
+  }
+  return { spent_usd: usd, budget_usd: budget, unknown_usd_sessions: unknown };
+}
+
 /** @param {string} slug */
 const ledgerWriter = (slug) => (/** @type {Record<string, any>} */ row) => appendRow(row, { slug });
 
@@ -82,7 +115,7 @@ export async function runRun(args, deps = {}) {
   const out = (/** @type {string} */ s) => writeSafe(stdout, s);
   const err = (/** @type {string} */ s) => writeSafe(stderr, s);
   const [sub, ...rest] = args;
-  if (!['start', 'status', 'end'].includes(sub)) {
+  if (!['start', 'status', 'reload', 'end'].includes(sub)) {
     err(USAGE);
     return 2;
   }
@@ -133,9 +166,14 @@ export async function runRun(args, deps = {}) {
     if (sub === 'status' && runId) {
       const record = await readRun(runId);
       const { run_id, status, engine, blocks, orphans } = record;
-      out(`${JSON.stringify({ run_id, status, engine, worker_pinned: Boolean(record.worker), blocks, orphans }, null, 2)}\n`);
+      const spend = await spendOf(record);
+      out(`${JSON.stringify({ run_id, status, engine, worker_pinned: Boolean(record.worker), blocks, orphans, ...spend }, null, 2)}\n`);
+      // on stderr, so stdout stays one JSON document
+      const n = spend.unknown_usd_sessions;
+      if (n > 0) err(`${n} session${n === 1 ? ' has' : 's have'} no known price; the budget does not count ${n === 1 ? 'it' : 'them'}\n`);
       return 0;
     }
+    if (sub === 'reload' && runId) return await reloadVerb(runId, { out, err });
     if (sub === 'end' && runId) {
       const { project } = await readRun(runId);
       const record = await endRun({ runId, writeRow: ledgerWriter(project), stopWorker, probe });
@@ -150,8 +188,71 @@ export async function runRun(args, deps = {}) {
   return 2;
 }
 
+/**
+ * `run reload --run <id>`: load + validate the workspace config, pin the queue's pending tickets
+ * to the old snapshot and store the new one (`reloadRun`). Exit 0 on a reload or no change, 1 on a
+ * config that does not load or validate, or on a refused key.
+ * @param {string} runId
+ * @param {{out: (s: string) => void, err: (s: string) => void}} io
+ * @returns {Promise<number>}
+ */
+async function reloadVerb(runId, { out, err }) {
+  const { project, workspace, status } = await readRun(runId);
+  if (status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
+  const loaded = await loadProjectConfig(workspace);
+  if (!loaded.ok || !loaded.config) {
+    // never the parser's message: it can quote a line of the file
+    if (loaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+    else {
+      const line = loaded.error === 'parse-error' ? /\(line (\d+), column \d+\)$/.exec(loaded.message ?? '')?.[1] : undefined;
+      err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${line ? `:${line}` : ''}) — nothing changed\n`);
+    }
+    return 1;
+  }
+  const result = validateConfig(loaded.config, { seenInCache: await loadSeenInCache(), hasCliOnPath });
+  if (!result.valid) {
+    // rule ids and key paths only: a validator message may quote a value
+    const lines = result.errors.map((e) => `  [${e.rule}]${typeof e.path === 'string' && e.path.length > 0 ? ` ${e.path}` : ''}\n`);
+    err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${result.errors.length} error${result.errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
+    return 1;
+  }
+  /** @type {string | null} */
+  let repoRoot = null;
+  try {
+    repoRoot = await repoRootOf(workspace);
+  } catch (thrown) {
+    if (!(thrown instanceof WorkerError && thrown.code === 'no-repo')) throw thrown;
+    // no repository: there is no review queue to pin
+  }
+  const queueRoot = repoRoot;
+  const readPending = () => {
+    if (queueRoot === null) return [];
+    try {
+      readdirSync(queueDir(queueRoot));
+    } catch (thrown) {
+      if (thrown?.code === 'ENOENT') return [];
+      throw new StateError('queue-unreadable', 'cannot read the review queue; nothing changed');
+    }
+    return pendingTickets(queueRoot);
+  };
+  const reloaded = await reloadRun({ runId, config: loaded.config, readPending, effectiveSlug: slugFor(loaded.config, workspace), writeRow: ledgerWriter(project) });
+  if (reloaded.changed !== null && reloaded.changed.length === 0) {
+    out(`run ${runId}: no config change\n`);
+    return 0;
+  }
+  if (reloaded.changed === null) {
+    out(`run ${runId}: config snapshot recorded (the run predates run reload; no earlier snapshot to compare)\n`);
+  } else {
+    out(`run ${runId}: config reloaded · ${reloaded.changed.length} key${reloaded.changed.length === 1 ? '' : 's'} changed\n`);
+    for (const key of reloaded.changed) out(`  ${key}\n`);
+  }
+  out(`queued review tickets (${reloaded.pinned}) keep the config they were enqueued with; new tickets use the new config\n`);
+  if (reloaded.rowError !== null) err(`run reload: WARN the run.reload ledger row could not be written (${reloaded.rowError}); the run record holds the new config\n`);
+  return 0;
+}
+
 const USAGE =
-  'usage: code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>] | start --reattach --run <id> [--worker-pid <pid>] | status --run <id> | end --run <id>\n';
+  'usage: code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>] | start --reattach --run <id> [--worker-pid <pid>] | status --run <id> | reload --run <id> | end --run <id>\n';
 
 /** @param {string[]} args @returns {Promise<number>} */
 export default async function run(args) {

package/src/config/closed-book.mjs

@@ -0,0 +1,75 @@
+/**
+ * Which providers may run a closed-book session (B32, issue #2; security.md §4).
+ *
+ * A closed-book session (reviewer, judge, S2, author) must see the packet and nothing else. Claude
+ * runs it with `--tools ""` and Grok with `--deny "*"`: no tools at all. Codex 0.155.1 has no such
+ * mode. Its `exec` sandbox choices are `read-only | workspace-write | danger-full-access`, and
+ * `read-only` still hands the model a shell that can read any absolute path (the doctor isolation
+ * probe FAILs with an openai L2 reviewer). Its help text documents no flag or `-c` key that removes
+ * every tool, so the openai provider is refused for those roles until one exists.
+ *
+ * Coders keep Codex. The facts delegate keeps it too: it gets read-only shell tools by design.
+ * The scrub pass (`session/scrub.mjs`) runs as role `reviewer` at L1, so it is refused as well.
+ *
+ * Opt-in (default off): `review.allow_open_book_codex: true` lets Codex run those roles with its
+ * read-only argv; every surface then shows {@link OPEN_BOOK_CODEX_WARNING} instead of refusing.
+ */
+
+/** The text every refusal prints: the builder, the spawner, `doctor`, `validate`, `resolve`. */
+export const CODEX_CLOSED_BOOK_REFUSAL = 'codex cannot run closed-book yet: it always has a shell; use anthropic or xai for reviewer, judge, S2 and plan author';
+
+/**
+ * The warning every surface prints when `review.allow_open_book_codex: true` lets Codex run those
+ * roles anyway, with its `-s read-only` argv (B32 opt-in, default off).
+ */
+export const OPEN_BOOK_CODEX_WARNING = 'codex reviewer is not closed-book: it can read files on this machine (review.allow_open_book_codex)';
+
+/**
+ * @param {unknown} cfg - a loaded project config.
+ * @returns {boolean} true only when `review.allow_open_book_codex` is exactly `true`.
+ */
+export function openBookCodexAllowed(cfg) {
+  return /** @type {any} */ (cfg)?.review?.allow_open_book_codex === true;
+}
+
+/** The provider that cannot run closed-book (its CLI is Codex). */
+export const NO_CLOSED_BOOK_PROVIDER = 'openai';
+
+/** Roles that must run with no tools (facts is not one: it has read-only tools by design). */
+export const NO_TOOL_ROLES = Object.freeze(['reviewer', 'judge', 's2', 'author']);
+
+/** Levels whose sessions are closed-book: L2 (reviewers), L3 (judge, S2, author). */
+export const CLOSED_BOOK_LEVELS = Object.freeze(['L2', 'L3']);
+
+/** @param {unknown} value @returns {string} `value` trimmed and lowercased, `''` for a non-string. */
+function norm(value) {
+  return typeof value === 'string' ? value.trim().toLowerCase() : '';
+}
+
+/** @param {unknown} provider @returns {boolean} true when `provider` (any case) is the Codex provider. */
+export function isNoClosedBookProvider(provider) {
+  return norm(provider) === NO_CLOSED_BOOK_PROVIDER;
+}
+
+/** @param {unknown} role @returns {boolean} true when `role` (any case) must run with no tools. */
+export function isNoToolRole(role) {
+  return NO_TOOL_ROLES.includes(norm(role));
+}
+
+/**
+ * @param {unknown} provider @param {unknown} role - compared lowercased and trimmed.
+ * @returns {boolean} true when `provider` cannot run `role` closed-book.
+ */
+export function needsClosedBook(provider, role) {
+  return isNoClosedBookProvider(provider) && isNoToolRole(role);
+}
+
+/**
+ * @param {unknown} provider @param {unknown} role @param {boolean} openBookAllowed - the config's
+ *   opt-in, read once by the caller with {@link openBookCodexAllowed}.
+ * @returns {boolean} true when the session must be refused: `provider` cannot run `role`
+ *   closed-book and the config has not opted in to open-book Codex.
+ */
+export function closedBookRefused(provider, role, openBookAllowed) {
+  return needsClosedBook(provider, role) && openBookAllowed !== true;
+}

package/src/config/validate.mjs

@@ -4,7 +4,7 @@
  *
  *  1. **Schema validation** (Ajv, draft 2020-12, `additionalProperties: false` almost everywhere)
  *     catches shape errors: unknown keys, wrong types, missing required fields.
- *  2. **Domain rules** (`DOMAIN_RULES` below, 14 of them as of B1.2/v1.3) catch things no JSON Schema can express:
+ *  2. **Domain rules** (`DOMAIN_RULES` below, 16 of them as of B32) catch things no JSON Schema can express:
  *     cross-field comparisons (two levels resolving to the same tuple), a value that needs a
  *     second config value to be reachable (`second_levels.L2.provider` vs. the effective L2
  *     provider) and rules that reach outside the config object entirely (is a CLI on PATH, is a
@@ -14,7 +14,7 @@
  *     instead of touching `process.env.PATH` themselves, so a unit test never needs a real CLI on
  *     PATH to prove either branch.
  *
- * The 14 rules (B1's original 14 plus B1.1's `caps-coders-exceeds-cap`, minus B1.2's removal of
+ * The 16 rules (B32 added `closed-book-on-openai`, B29 `effort-not-valid-for-provider`; before them: B1's original 14 plus B1.1's `caps-coders-exceeds-cap`, minus B1.2's removal of
  * `proof-tool-absent-for-high-tier` — Q16 answered "cut", so `proof.tiers.high.tool` no longer
  * exists to be absent, plan §10.4 Wave 6), and how the plan's prose bullets map onto them (§1.3's
  * "review.multimodel: true with second_provider empty **or with**
@@ -34,6 +34,8 @@
  *  12  engine-subprocess-no-cli              ERROR
  *  13  shadow-rate-range                     ERROR  ("shadow_rate range")
  *  14  caps-coders-exceeds-cap               WARN   (v1.3/R10/B1.1: caps.coders > 2)
+ *  15  effort-not-valid-for-provider         ERROR  (B29: a level's / fallback's effort vs. its provider)
+ *  16  closed-book-on-openai                 WARN   (B32: Codex has no no-tools mode)
  *
  * **B1.2 (v1.3, Q16 cut) removed rule:** `proof-tool-absent-for-high-tier` (formerly #13) — the
  * key it warned about (`proof.tiers.high.tool`) left the schema in the same amendment, along with
@@ -60,7 +62,9 @@
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import schema from '../../schema/code-forge.schema.json' with { type: 'json' };
 import { redact } from '../util/redact.mjs';
-import { isKnownId } from './known-ids.mjs';
+import { checkEffort, displayEffort } from '../engines/efforts.mjs';
+import { CLOSED_BOOK_LEVELS, CODEX_CLOSED_BOOK_REFUSAL, isNoClosedBookProvider, OPEN_BOOK_CODEX_WARNING, openBookCodexAllowed } from './closed-book.mjs';
+import { isKnownId, resolveLevel } from './known-ids.mjs';
 import { looksLikeSecret, maskSecretTokens, SECRET_MASK, secretTokensIn } from './secret-patterns.mjs';
 
 /**
@@ -637,11 +641,126 @@ function checkCapsCodersExceedsCap(cfg) {
   return [];
 }
 
+// ── 15. effort-not-valid-for-provider (ERROR, B29) ──────────────────────────
+
+/**
+ * A provider name for an effort message: bare (`openai`) only when it is one of the schema's
+ * closed provider words, `(unknown provider)` otherwise — never an unchecked config string.
+ * @param {unknown} provider
+ * @returns {string}
+ */
+function effortProvider(provider) {
+  return typeof provider === 'string' && PROVIDER_NAMES.includes(provider) ? provider : '(unknown provider)';
+}
+
+/**
+ * One effort issue for the effort at `keyPath` on `provider`, or `null` when it is fine. The
+ * builders throw for exactly the efforts `checkEffort` refuses, so this rule moves that spawn-time
+ * failure to config time. The effort is shown only through `displayEffort` (a closed-list word,
+ * else `(unrecognised value)`), the provider only through `effortProvider`. A non-string effort is
+ * left to the schema layer; an unknown provider is skipped (the schema layer reports it).
+ * @param {string} keyPath
+ * @param {unknown} provider
+ * @param {unknown} effort
+ * @returns {ValidationIssue | null}
+ */
+function effortIssue(keyPath, provider, effort) {
+  if (typeof effort !== 'string') return null;
+  const result = checkEffort(provider, effort);
+  const who = effortProvider(provider);
+  /** @type {string} */
+  let message;
+  switch (result.kind) {
+    case 'invalid':
+      message = `${keyPath} ${displayEffort(effort)} is not valid for provider ${who}; use one of: ${result.allowed.join(', ')}`;
+      break;
+    case 'unsupported':
+      message = `${keyPath} is set but provider ${who} takes no effort; remove it`;
+      break;
+    case 'empty':
+      message = `${keyPath} is empty; provider ${who} needs a non-empty effort or none at all`;
+      break;
+    default: // 'ok', 'unknown-provider'
+      return null;
+  }
+  return { rule: 'effort-not-valid-for-provider', severity: 'error', message };
+}
+
+/**
+ * Checks each level's effort against its effective provider, and each fallback entry's effort
+ * against that entry's own provider (the spawner hands a fallback step's effort to that provider's
+ * builder). Both efforts are read from the SAME raw source the spawner uses — `cfg.levels.<Lx>` as
+ * written (`resolveLevel` in `known-ids.mjs` copies `level.effort` and `level.fallback` verbatim,
+ * and no loader merges provider defaults into a config, see `load.mjs`), so every value checked
+ * here was set in `levels.<Lx>` itself and the message names exactly that key.
+ * @param {Record<string, any>} cfg
+ */
+function checkEffortNotValidForProvider(cfg) {
+  /** @type {ValidationIssue[]} */
+  const issues = [];
+  for (const name of LEVEL_NAMES) {
+    const level = effectiveLevel(cfg, name);
+    if (level) {
+      const issue = effortIssue(`levels.${name}.effort`, level.provider, level.effort);
+      if (issue) issues.push(issue);
+    }
+    const rawFallback = cfg?.levels?.[name]?.fallback;
+    const fallbackList = Array.isArray(rawFallback) ? rawFallback : [];
+    for (const [i, fb] of fallbackList.entries()) {
+      if (fb === null || typeof fb !== 'object') continue;
+      const issue = effortIssue(`levels.${name}.fallback[${i}].effort`, fb.provider, fb.effort);
+      if (issue) issues.push(issue);
+    }
+  }
+  return issues;
+}
+
+// ── 16. closed-book-on-openai (WARN, B32) ──────────────────────────────────
+
+/**
+ * L2 (reviewers) and L3 (judge, S2, author) run closed-book, and Codex has no no-tools mode
+ * (`closed-book.mjs`): the spawner refuses an openai level there and skips an openai fallback.
+ * One warning per place that resolves to openai — the level itself, each of its fallbacks, and
+ * the second reviewer's effective L2 provider when multimodel is on. WARN, not ERROR: the
+ * `provider: openai` default writes openai on every level, and the coders still run on Codex.
+ * With `review.allow_open_book_codex: true` the warnings name the opt-in's cost instead.
+ * @param {Record<string, any>} cfg
+ */
+function checkClosedBookOnOpenai(cfg) {
+  /** @type {string[]} */
+  const where = [];
+  for (const name of CLOSED_BOOK_LEVELS) {
+    // The level and its fallbacks exactly as the spawner's ladder sees them (fix round 1):
+    // `resolveLevel` is what `spawnSession` and `resolve` call. A level it cannot resolve is
+    // `level-missing`'s to report; the spawner cannot run it either.
+    let resolved;
+    try {
+      resolved = resolveLevel(cfg, /** @type {"L2"|"L3"} */ (name));
+    } catch {
+      continue;
+    }
+    if (isNoClosedBookProvider(resolved.provider)) where.push(`levels.${name}`);
+    resolved.fallback.forEach((fb, i) => {
+      if (isNoClosedBookProvider(fb?.provider)) where.push(`levels.${name}.fallback[${i}]`);
+    });
+  }
+  if (cfg?.review?.multimodel === true && isNoClosedBookProvider(effectiveSecondL2Provider(cfg))) {
+    where.push('review.second_levels.L2 (else review.second_provider)');
+  }
+  // B32 opt-in: the same places, but the text says what the opt-in costs instead of "refused".
+  const text = openBookCodexAllowed(cfg) ? OPEN_BOOK_CODEX_WARNING : CODEX_CLOSED_BOOK_REFUSAL;
+  return where.map((key) => ({
+    rule: 'closed-book-on-openai',
+    severity: /** @type {const} */ ('warning'),
+    message: `${key} resolves to openai — ${text}`,
+  }));
+}
+
 /**
- * The 14 domain rules paired with the exact `rule` id string each one emits — the single source
+ * The 16 domain rules paired with the exact `rule` id string each one emits — the single source
  * of truth both `DOMAIN_RULES` (below, what `validateConfig` runs) and the exported
  * `DOMAIN_RULE_IDS` are built from. `'schema'` (the ajv layer's own issues) is deliberately not
- * one of these 14. (B1.2/v1.3, Q16 cut: `proof-tool-absent-for-high-tier` removed, 15 -> 14.)
+ * one of these 16 (B29 added rule 15, B32 rule 16). (B1.2/v1.3, Q16 cut: `proof-tool-absent-for-high-tier` removed, 15 -> 14.)
  * @type {ReadonlyArray<{fn: (cfg: Record<string, any>, opts?: object) => ValidationIssue[], id: string}>}
  */
 const RULE_TABLE = Object.freeze([
@@ -659,12 +778,14 @@ const RULE_TABLE = Object.freeze([
   { fn: checkEngineSubprocessNoCli, id: 'engine-subprocess-no-cli' },
   { fn: checkShadowRateRange, id: 'shadow-rate-range' },
   { fn: checkCapsCodersExceedsCap, id: 'caps-coders-exceeds-cap' },
+  { fn: checkEffortNotValidForProvider, id: 'effort-not-valid-for-provider' },
+  { fn: checkClosedBookOnOpenai, id: 'closed-book-on-openai' },
 ]);
 
-/** The 14 domain rules, in the order documented above. */
+/** The 16 domain rules, in the order documented above. */
 const DOMAIN_RULES = Object.freeze(RULE_TABLE.map((entry) => entry.fn));
 
-/** The 14 rule ids `validateConfig` can emit, in `DOMAIN_RULES` order (see `RULE_TABLE`). */
+/** The 16 rule ids `validateConfig` can emit, in `DOMAIN_RULES` order (see `RULE_TABLE`). */
 export const DOMAIN_RULE_IDS = Object.freeze(RULE_TABLE.map((entry) => entry.id));
 
 /**