@codedology/code-forge 0.3.2 → 0.5.0

package/src/cli/review.mjs

@@ -16,7 +16,9 @@
  *    default clause. A generated file lives in this command's temp root, never in the tree.
  * 4. Flow, every step a `code-forge` child with a `GIT_*`-free env: `run start` (launches the
  *    worker) → `block open R-<stamp> --level L2 --base <sha> --owned <files…>` → `review-file`
- *    per file → `review-file --wait` per ticket (`--max`, default 900 s per file) → summary →
+ *    per file (all enqueued first) → one `review-file --wait` per ticket, all together under ONE run
+ *    deadline (`--max`, default 900 s for the whole review; a ticket pending at the deadline is
+ *    reported `stopped: timeout`, exit 1), results announced on stderr as they finish → summary in file order →
  *    `block stop` (a review never closes a block) → `run end` unless `--keep-run`. The cleanup runs
  *    in a `finally`, on SIGINT/SIGTERM and after a timeout, and no worker outlives the command.
  *    Each cleanup step is independent (a failed or throwing step is reported on stderr and the
@@ -42,6 +44,7 @@ import { parseFlags } from '../state/cli-args.mjs';
 import { assertRunId, newRunId, StateError } from '../state/paths.mjs';
 import { processStartTime, readRun } from '../state/run.mjs';
 import { exec } from '../util/exec.mjs';
+import { semaphore } from '../util/locks.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { isAlive, listEntries, readStartTime, UNKNOWN_START_TIME } from '../util/reaper.mjs';
 import { pidsDir, runRoot, setRunRoot, tmpBase } from '../util/tmp.mjs';
@@ -54,6 +57,8 @@ export const USAGE =
   'usage: code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> | --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]\n';
 
 export const DEFAULT_MAX_S = 900;
+/** The most `review-file --wait` children that run at once. */
+export const MAX_WAITERS = 8;
 export const DEFAULT_CLAUSE = 'Review for correctness, security and test quality; no intent was stated.';
 const GIT_TIMEOUT_MS = 30_000;
 const STEP_TIMEOUT_MS = 120_000;
@@ -511,14 +516,40 @@ export async function runReview(args, deps = {}) {
       const answer = lastJSON(res.stdout);
       queued.push({ file, ticket: typeof answer?.ticket === 'string' ? answer.ticket : null, answer });
     }
-    for (const q of queued) {
-      if (q.ticket === null) {
-        outcomes.push(classify(q.file, { status: q.answer?.status ?? 'refused', reason: q.answer?.reason ?? q.answer?.status ?? 'not queued' }));
-        continue;
-      }
-      const res = await cf(['review-file', '--wait', q.ticket, '--max', `${maxS}s`], maxS * 1000 + 60_000);
-      outcomes.push(classify(q.file, lastJSON(res.stdout)));
-    }
+    // Every file is enqueued above before any wait starts. One run deadline (`--max`, measured from
+    // here) covers all the waits, which run together: each `review-file --wait` gets the time still
+    // left, and a ticket still pending at the deadline is reported `stopped: timeout`. A result is
+    // announced on stderr as its file finishes; the table below keeps the file order.
+    // At most MAX_WAITERS `review-file --wait` children at once (a review of many files must not
+    // start one Node process per file); a wait that starts late still counts down to the same
+    // deadline, and one that starts after it is reported pending without a child.
+    const deadline = Date.now() + maxS * 1000;
+    const waiters = semaphore(MAX_WAITERS);
+    /** @type {Array<FileOutcome | undefined>} */
+    const byIndex = new Array(queued.length);
+    const finish = (/** @type {number} */ i, /** @type {FileOutcome} */ o) => {
+      byIndex[i] = o;
+      note(`${o.file}  ${label(o)}`);
+    };
+    const settled = await Promise.allSettled(
+      queued.map(async (q, i) => {
+        if (q.ticket === null) {
+          finish(i, classify(q.file, { status: q.answer?.status ?? 'refused', reason: q.answer?.reason ?? q.answer?.status ?? 'not queued' }));
+          return;
+        }
+        await waiters.run(async () => {
+          const left = deadline - Date.now();
+          if (left <= 0) {
+            finish(i, classify(q.file, { status: 'pending' }));
+            return;
+          }
+          const res = await cf(['review-file', '--wait', q.ticket, '--max', `${Math.ceil(left / 1000)}s`], left + 60_000);
+          finish(i, classify(q.file, lastJSON(res.stdout)));
+        });
+      }),
+    );
+    for (const s of settled) if (s.status === 'rejected') throw s.reason;
+    for (const o of byIndex) outcomes.push(/** @type {FileOutcome} */ (o));
     const allOk = outcomes.every((o) => o.result === 'approved' || o.result === 'unchanged');
     code = allOk ? 0 : 1;
     if (json) out(`${JSON.stringify({ ok: allOk, base: base.sha, base_from: base.from, run: runId, block: blockId, files: outcomes, skipped, totals: totals(outcomes) })}\n`);

package/src/cli/run.mjs

@@ -4,7 +4,8 @@
  *
  *   run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]
  *   run start --reattach --run <id> [--worker-pid <pid>]
- *   run status --run <id>
+ *   run status --run <id>     (B33: includes spent_usd / budget_usd / unknown_usd_sessions)
+ *   run reload --run <id>
  *   run end --run <id>
  *
  * B11: from the CLI (the default export), `run start` without `--worker-pid` sweeps dead run
@@ -12,18 +13,31 @@
  * queue and pins it; `run start --reattach` without `--worker-pid` re-pins the live worker the
  * queue announces (`repinWorker`). Called as `runRun(args, deps)` without `deps.startWorker` (the
  * state tests), no worker is launched and none is pinned unless `--worker-pid` is given.
+ *
+ * B35 `run reload`: re-read and validate the workspace's `.code-forge.yml` and replace the run's
+ * config snapshot (`reloadRun`) — no `block stop` / `run end` / `run start` cycle. An invalid
+ * config or a change to a key that is fixed for the run is refused with nothing changed. It prints
+ * the changed key PATHS (never values); queued review tickets keep the config they were enqueued
+ * with, new tickets use the new one, and the worker picks it up on its next ticket (it reads the
+ * run record per ticket — no restart).
  */
 
+import { readdirSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
-import { appendRow } from '../ledger/write.mjs';
+import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
+import { loadSeenInCache } from '../config/refresh.mjs';
+import { validateConfig } from '../config/validate.mjs';
+import { budgetUsdOf, runSpend } from '../ledger/spend.mjs';
+import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { endRun, processStartTime, readRun, reattachWorker, startRun, stopPinnedWorker } from '../state/run.mjs';
+import { endRun, processStartTime, readRun, reattachWorker, reloadRun, startRun, stopPinnedWorker } from '../state/run.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { sweepRoots, tmpBase } from '../util/tmp.mjs';
 import { launchWorker, repinWorker } from '../worker/loop.mjs';
-import { repoRootOf } from '../worker/ticket.mjs';
+import { pendingTickets, queueDir } from '../worker/queue.mjs';
+import { repoRootOf, WorkerError } from '../worker/ticket.mjs';
+import { hasCliOnPath } from './validate.mjs';
 
 /**
  * `project.slug` from config, else the workspace directory name as a ledger slug. The configured
@@ -40,6 +54,25 @@ export function slugFor(cfg, workspace) {
   return derived || 'project';
 }
 
+/**
+ * B33: the run's spend so far (estimated USD from its ledger rows, open blocks included) and its
+ * `budget.usd` (read from the workspace config now — the value the next session is checked
+ * against; null when unset or the config does not load).
+ * @param {Record<string, any>} record
+ * @returns {Promise<{spent_usd: number, budget_usd: number | null, unknown_usd_sessions: number}>}
+ */
+async function spendOf(record) {
+  const { usd, unknown } = runSpend(await readAllRows(record.project), record.run_id);
+  let budget = null;
+  try {
+    const loaded = await loadProjectConfig(record.workspace);
+    budget = loaded.ok ? budgetUsdOf(loaded.config) : null;
+  } catch {
+    budget = null;
+  }
+  return { spent_usd: usd, budget_usd: budget, unknown_usd_sessions: unknown };
+}
+
 /** @param {string} slug */
 const ledgerWriter = (slug) => (/** @type {Record<string, any>} */ row) => appendRow(row, { slug });
 
@@ -82,7 +115,7 @@ export async function runRun(args, deps = {}) {
   const out = (/** @type {string} */ s) => writeSafe(stdout, s);
   const err = (/** @type {string} */ s) => writeSafe(stderr, s);
   const [sub, ...rest] = args;
-  if (!['start', 'status', 'end'].includes(sub)) {
+  if (!['start', 'status', 'reload', 'end'].includes(sub)) {
     err(USAGE);
     return 2;
   }
@@ -133,9 +166,14 @@ export async function runRun(args, deps = {}) {
     if (sub === 'status' && runId) {
       const record = await readRun(runId);
       const { run_id, status, engine, blocks, orphans } = record;
-      out(`${JSON.stringify({ run_id, status, engine, worker_pinned: Boolean(record.worker), blocks, orphans }, null, 2)}\n`);
+      const spend = await spendOf(record);
+      out(`${JSON.stringify({ run_id, status, engine, worker_pinned: Boolean(record.worker), blocks, orphans, ...spend }, null, 2)}\n`);
+      // on stderr, so stdout stays one JSON document
+      const n = spend.unknown_usd_sessions;
+      if (n > 0) err(`${n} session${n === 1 ? ' has' : 's have'} no known price; the budget does not count ${n === 1 ? 'it' : 'them'}\n`);
       return 0;
     }
+    if (sub === 'reload' && runId) return await reloadVerb(runId, { out, err });
     if (sub === 'end' && runId) {
       const { project } = await readRun(runId);
       const record = await endRun({ runId, writeRow: ledgerWriter(project), stopWorker, probe });
@@ -150,8 +188,71 @@ export async function runRun(args, deps = {}) {
   return 2;
 }
 
+/**
+ * `run reload --run <id>`: load + validate the workspace config, pin the queue's pending tickets
+ * to the old snapshot and store the new one (`reloadRun`). Exit 0 on a reload or no change, 1 on a
+ * config that does not load or validate, or on a refused key.
+ * @param {string} runId
+ * @param {{out: (s: string) => void, err: (s: string) => void}} io
+ * @returns {Promise<number>}
+ */
+async function reloadVerb(runId, { out, err }) {
+  const { project, workspace, status } = await readRun(runId);
+  if (status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
+  const loaded = await loadProjectConfig(workspace);
+  if (!loaded.ok || !loaded.config) {
+    // never the parser's message: it can quote a line of the file
+    if (loaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+    else {
+      const line = loaded.error === 'parse-error' ? /\(line (\d+), column \d+\)$/.exec(loaded.message ?? '')?.[1] : undefined;
+      err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${line ? `:${line}` : ''}) — nothing changed\n`);
+    }
+    return 1;
+  }
+  const result = validateConfig(loaded.config, { seenInCache: await loadSeenInCache(), hasCliOnPath });
+  if (!result.valid) {
+    // rule ids and key paths only: a validator message may quote a value
+    const lines = result.errors.map((e) => `  [${e.rule}]${typeof e.path === 'string' && e.path.length > 0 ? ` ${e.path}` : ''}\n`);
+    err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${result.errors.length} error${result.errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
+    return 1;
+  }
+  /** @type {string | null} */
+  let repoRoot = null;
+  try {
+    repoRoot = await repoRootOf(workspace);
+  } catch (thrown) {
+    if (!(thrown instanceof WorkerError && thrown.code === 'no-repo')) throw thrown;
+    // no repository: there is no review queue to pin
+  }
+  const queueRoot = repoRoot;
+  const readPending = () => {
+    if (queueRoot === null) return [];
+    try {
+      readdirSync(queueDir(queueRoot));
+    } catch (thrown) {
+      if (thrown?.code === 'ENOENT') return [];
+      throw new StateError('queue-unreadable', 'cannot read the review queue; nothing changed');
+    }
+    return pendingTickets(queueRoot);
+  };
+  const reloaded = await reloadRun({ runId, config: loaded.config, readPending, effectiveSlug: slugFor(loaded.config, workspace), writeRow: ledgerWriter(project) });
+  if (reloaded.changed !== null && reloaded.changed.length === 0) {
+    out(`run ${runId}: no config change\n`);
+    return 0;
+  }
+  if (reloaded.changed === null) {
+    out(`run ${runId}: config snapshot recorded (the run predates run reload; no earlier snapshot to compare)\n`);
+  } else {
+    out(`run ${runId}: config reloaded · ${reloaded.changed.length} key${reloaded.changed.length === 1 ? '' : 's'} changed\n`);
+    for (const key of reloaded.changed) out(`  ${key}\n`);
+  }
+  out(`queued review tickets (${reloaded.pinned}) keep the config they were enqueued with; new tickets use the new config\n`);
+  if (reloaded.rowError !== null) err(`run reload: WARN the run.reload ledger row could not be written (${reloaded.rowError}); the run record holds the new config\n`);
+  return 0;
+}
+
 const USAGE =
-  'usage: code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>] | start --reattach --run <id> [--worker-pid <pid>] | status --run <id> | end --run <id>\n';
+  'usage: code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>] | start --reattach --run <id> [--worker-pid <pid>] | status --run <id> | reload --run <id> | end --run <id>\n';
 
 /** @param {string[]} args @returns {Promise<number>} */
 export default async function run(args) {

package/src/config/closed-book.mjs

@@ -0,0 +1,75 @@
+/**
+ * Which providers may run a closed-book session (B32, issue #2; security.md §4).
+ *
+ * A closed-book session (reviewer, judge, S2, author) must see the packet and nothing else. Claude
+ * runs it with `--tools ""` and Grok with `--deny "*"`: no tools at all. Codex 0.155.1 has no such
+ * mode. Its `exec` sandbox choices are `read-only | workspace-write | danger-full-access`, and
+ * `read-only` still hands the model a shell that can read any absolute path (the doctor isolation
+ * probe FAILs with an openai L2 reviewer). Its help text documents no flag or `-c` key that removes
+ * every tool, so the openai provider is refused for those roles until one exists.
+ *
+ * Coders keep Codex. The facts delegate keeps it too: it gets read-only shell tools by design.
+ * The scrub pass (`session/scrub.mjs`) runs as role `reviewer` at L1, so it is refused as well.
+ *
+ * Opt-in (default off): `review.allow_open_book_codex: true` lets Codex run those roles with its
+ * read-only argv; every surface then shows {@link OPEN_BOOK_CODEX_WARNING} instead of refusing.
+ */
+
+/** The text every refusal prints: the builder, the spawner, `doctor`, `validate`, `resolve`. */
+export const CODEX_CLOSED_BOOK_REFUSAL = 'codex cannot run closed-book yet: it always has a shell; use anthropic or xai for reviewer, judge, S2 and plan author';
+
+/**
+ * The warning every surface prints when `review.allow_open_book_codex: true` lets Codex run those
+ * roles anyway, with its `-s read-only` argv (B32 opt-in, default off).
+ */
+export const OPEN_BOOK_CODEX_WARNING = 'codex reviewer is not closed-book: it can read files on this machine (review.allow_open_book_codex)';
+
+/**
+ * @param {unknown} cfg - a loaded project config.
+ * @returns {boolean} true only when `review.allow_open_book_codex` is exactly `true`.
+ */
+export function openBookCodexAllowed(cfg) {
+  return /** @type {any} */ (cfg)?.review?.allow_open_book_codex === true;
+}
+
+/** The provider that cannot run closed-book (its CLI is Codex). */
+export const NO_CLOSED_BOOK_PROVIDER = 'openai';
+
+/** Roles that must run with no tools (facts is not one: it has read-only tools by design). */
+export const NO_TOOL_ROLES = Object.freeze(['reviewer', 'judge', 's2', 'author']);
+
+/** Levels whose sessions are closed-book: L2 (reviewers), L3 (judge, S2, author). */
+export const CLOSED_BOOK_LEVELS = Object.freeze(['L2', 'L3']);
+
+/** @param {unknown} value @returns {string} `value` trimmed and lowercased, `''` for a non-string. */
+function norm(value) {
+  return typeof value === 'string' ? value.trim().toLowerCase() : '';
+}
+
+/** @param {unknown} provider @returns {boolean} true when `provider` (any case) is the Codex provider. */
+export function isNoClosedBookProvider(provider) {
+  return norm(provider) === NO_CLOSED_BOOK_PROVIDER;
+}
+
+/** @param {unknown} role @returns {boolean} true when `role` (any case) must run with no tools. */
+export function isNoToolRole(role) {
+  return NO_TOOL_ROLES.includes(norm(role));
+}
+
+/**
+ * @param {unknown} provider @param {unknown} role - compared lowercased and trimmed.
+ * @returns {boolean} true when `provider` cannot run `role` closed-book.
+ */
+export function needsClosedBook(provider, role) {
+  return isNoClosedBookProvider(provider) && isNoToolRole(role);
+}
+
+/**
+ * @param {unknown} provider @param {unknown} role @param {boolean} openBookAllowed - the config's
+ *   opt-in, read once by the caller with {@link openBookCodexAllowed}.
+ * @returns {boolean} true when the session must be refused: `provider` cannot run `role`
+ *   closed-book and the config has not opted in to open-book Codex.
+ */
+export function closedBookRefused(provider, role, openBookAllowed) {
+  return needsClosedBook(provider, role) && openBookAllowed !== true;
+}

package/src/config/validate.mjs

@@ -4,7 +4,7 @@
  *
  *  1. **Schema validation** (Ajv, draft 2020-12, `additionalProperties: false` almost everywhere)
  *     catches shape errors: unknown keys, wrong types, missing required fields.
- *  2. **Domain rules** (`DOMAIN_RULES` below, 14 of them as of B1.2/v1.3) catch things no JSON Schema can express:
+ *  2. **Domain rules** (`DOMAIN_RULES` below, 16 of them as of B32) catch things no JSON Schema can express:
  *     cross-field comparisons (two levels resolving to the same tuple), a value that needs a
  *     second config value to be reachable (`second_levels.L2.provider` vs. the effective L2
  *     provider) and rules that reach outside the config object entirely (is a CLI on PATH, is a
@@ -14,7 +14,7 @@
  *     instead of touching `process.env.PATH` themselves, so a unit test never needs a real CLI on
  *     PATH to prove either branch.
  *
- * The 14 rules (B1's original 14 plus B1.1's `caps-coders-exceeds-cap`, minus B1.2's removal of
+ * The 16 rules (B32 added `closed-book-on-openai`, B29 `effort-not-valid-for-provider`; before them: B1's original 14 plus B1.1's `caps-coders-exceeds-cap`, minus B1.2's removal of
  * `proof-tool-absent-for-high-tier` — Q16 answered "cut", so `proof.tiers.high.tool` no longer
  * exists to be absent, plan §10.4 Wave 6), and how the plan's prose bullets map onto them (§1.3's
  * "review.multimodel: true with second_provider empty **or with**
@@ -34,6 +34,8 @@
  *  12  engine-subprocess-no-cli              ERROR
  *  13  shadow-rate-range                     ERROR  ("shadow_rate range")
  *  14  caps-coders-exceeds-cap               WARN   (v1.3/R10/B1.1: caps.coders > 2)
+ *  15  effort-not-valid-for-provider         ERROR  (B29: a level's / fallback's effort vs. its provider)
+ *  16  closed-book-on-openai                 WARN   (B32: Codex has no no-tools mode)
  *
  * **B1.2 (v1.3, Q16 cut) removed rule:** `proof-tool-absent-for-high-tier` (formerly #13) — the
  * key it warned about (`proof.tiers.high.tool`) left the schema in the same amendment, along with
@@ -60,7 +62,9 @@
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import schema from '../../schema/code-forge.schema.json' with { type: 'json' };
 import { redact } from '../util/redact.mjs';
-import { isKnownId } from './known-ids.mjs';
+import { checkEffort, displayEffort } from '../engines/efforts.mjs';
+import { CLOSED_BOOK_LEVELS, CODEX_CLOSED_BOOK_REFUSAL, isNoClosedBookProvider, OPEN_BOOK_CODEX_WARNING, openBookCodexAllowed } from './closed-book.mjs';
+import { isKnownId, resolveLevel } from './known-ids.mjs';
 import { looksLikeSecret, maskSecretTokens, SECRET_MASK, secretTokensIn } from './secret-patterns.mjs';
 
 /**
@@ -637,11 +641,126 @@ function checkCapsCodersExceedsCap(cfg) {
   return [];
 }
 
+// ── 15. effort-not-valid-for-provider (ERROR, B29) ──────────────────────────
+
+/**
+ * A provider name for an effort message: bare (`openai`) only when it is one of the schema's
+ * closed provider words, `(unknown provider)` otherwise — never an unchecked config string.
+ * @param {unknown} provider
+ * @returns {string}
+ */
+function effortProvider(provider) {
+  return typeof provider === 'string' && PROVIDER_NAMES.includes(provider) ? provider : '(unknown provider)';
+}
+
+/**
+ * One effort issue for the effort at `keyPath` on `provider`, or `null` when it is fine. The
+ * builders throw for exactly the efforts `checkEffort` refuses, so this rule moves that spawn-time
+ * failure to config time. The effort is shown only through `displayEffort` (a closed-list word,
+ * else `(unrecognised value)`), the provider only through `effortProvider`. A non-string effort is
+ * left to the schema layer; an unknown provider is skipped (the schema layer reports it).
+ * @param {string} keyPath
+ * @param {unknown} provider
+ * @param {unknown} effort
+ * @returns {ValidationIssue | null}
+ */
+function effortIssue(keyPath, provider, effort) {
+  if (typeof effort !== 'string') return null;
+  const result = checkEffort(provider, effort);
+  const who = effortProvider(provider);
+  /** @type {string} */
+  let message;
+  switch (result.kind) {
+    case 'invalid':
+      message = `${keyPath} ${displayEffort(effort)} is not valid for provider ${who}; use one of: ${result.allowed.join(', ')}`;
+      break;
+    case 'unsupported':
+      message = `${keyPath} is set but provider ${who} takes no effort; remove it`;
+      break;
+    case 'empty':
+      message = `${keyPath} is empty; provider ${who} needs a non-empty effort or none at all`;
+      break;
+    default: // 'ok', 'unknown-provider'
+      return null;
+  }
+  return { rule: 'effort-not-valid-for-provider', severity: 'error', message };
+}
+
+/**
+ * Checks each level's effort against its effective provider, and each fallback entry's effort
+ * against that entry's own provider (the spawner hands a fallback step's effort to that provider's
+ * builder). Both efforts are read from the SAME raw source the spawner uses — `cfg.levels.<Lx>` as
+ * written (`resolveLevel` in `known-ids.mjs` copies `level.effort` and `level.fallback` verbatim,
+ * and no loader merges provider defaults into a config, see `load.mjs`), so every value checked
+ * here was set in `levels.<Lx>` itself and the message names exactly that key.
+ * @param {Record<string, any>} cfg
+ */
+function checkEffortNotValidForProvider(cfg) {
+  /** @type {ValidationIssue[]} */
+  const issues = [];
+  for (const name of LEVEL_NAMES) {
+    const level = effectiveLevel(cfg, name);
+    if (level) {
+      const issue = effortIssue(`levels.${name}.effort`, level.provider, level.effort);
+      if (issue) issues.push(issue);
+    }
+    const rawFallback = cfg?.levels?.[name]?.fallback;
+    const fallbackList = Array.isArray(rawFallback) ? rawFallback : [];
+    for (const [i, fb] of fallbackList.entries()) {
+      if (fb === null || typeof fb !== 'object') continue;
+      const issue = effortIssue(`levels.${name}.fallback[${i}].effort`, fb.provider, fb.effort);
+      if (issue) issues.push(issue);
+    }
+  }
+  return issues;
+}
+
+// ── 16. closed-book-on-openai (WARN, B32) ──────────────────────────────────
+
+/**
+ * L2 (reviewers) and L3 (judge, S2, author) run closed-book, and Codex has no no-tools mode
+ * (`closed-book.mjs`): the spawner refuses an openai level there and skips an openai fallback.
+ * One warning per place that resolves to openai — the level itself, each of its fallbacks, and
+ * the second reviewer's effective L2 provider when multimodel is on. WARN, not ERROR: the
+ * `provider: openai` default writes openai on every level, and the coders still run on Codex.
+ * With `review.allow_open_book_codex: true` the warnings name the opt-in's cost instead.
+ * @param {Record<string, any>} cfg
+ */
+function checkClosedBookOnOpenai(cfg) {
+  /** @type {string[]} */
+  const where = [];
+  for (const name of CLOSED_BOOK_LEVELS) {
+    // The level and its fallbacks exactly as the spawner's ladder sees them (fix round 1):
+    // `resolveLevel` is what `spawnSession` and `resolve` call. A level it cannot resolve is
+    // `level-missing`'s to report; the spawner cannot run it either.
+    let resolved;
+    try {
+      resolved = resolveLevel(cfg, /** @type {"L2"|"L3"} */ (name));
+    } catch {
+      continue;
+    }
+    if (isNoClosedBookProvider(resolved.provider)) where.push(`levels.${name}`);
+    resolved.fallback.forEach((fb, i) => {
+      if (isNoClosedBookProvider(fb?.provider)) where.push(`levels.${name}.fallback[${i}]`);
+    });
+  }
+  if (cfg?.review?.multimodel === true && isNoClosedBookProvider(effectiveSecondL2Provider(cfg))) {
+    where.push('review.second_levels.L2 (else review.second_provider)');
+  }
+  // B32 opt-in: the same places, but the text says what the opt-in costs instead of "refused".
+  const text = openBookCodexAllowed(cfg) ? OPEN_BOOK_CODEX_WARNING : CODEX_CLOSED_BOOK_REFUSAL;
+  return where.map((key) => ({
+    rule: 'closed-book-on-openai',
+    severity: /** @type {const} */ ('warning'),
+    message: `${key} resolves to openai — ${text}`,
+  }));
+}
+
 /**
- * The 14 domain rules paired with the exact `rule` id string each one emits — the single source
+ * The 16 domain rules paired with the exact `rule` id string each one emits — the single source
  * of truth both `DOMAIN_RULES` (below, what `validateConfig` runs) and the exported
  * `DOMAIN_RULE_IDS` are built from. `'schema'` (the ajv layer's own issues) is deliberately not
- * one of these 14. (B1.2/v1.3, Q16 cut: `proof-tool-absent-for-high-tier` removed, 15 -> 14.)
+ * one of these 16 (B29 added rule 15, B32 rule 16). (B1.2/v1.3, Q16 cut: `proof-tool-absent-for-high-tier` removed, 15 -> 14.)
  * @type {ReadonlyArray<{fn: (cfg: Record<string, any>, opts?: object) => ValidationIssue[], id: string}>}
  */
 const RULE_TABLE = Object.freeze([
@@ -659,12 +778,14 @@ const RULE_TABLE = Object.freeze([
   { fn: checkEngineSubprocessNoCli, id: 'engine-subprocess-no-cli' },
   { fn: checkShadowRateRange, id: 'shadow-rate-range' },
   { fn: checkCapsCodersExceedsCap, id: 'caps-coders-exceeds-cap' },
+  { fn: checkEffortNotValidForProvider, id: 'effort-not-valid-for-provider' },
+  { fn: checkClosedBookOnOpenai, id: 'closed-book-on-openai' },
 ]);
 
-/** The 14 domain rules, in the order documented above. */
+/** The 16 domain rules, in the order documented above. */
 const DOMAIN_RULES = Object.freeze(RULE_TABLE.map((entry) => entry.fn));
 
-/** The 14 rule ids `validateConfig` can emit, in `DOMAIN_RULES` order (see `RULE_TABLE`). */
+/** The 16 rule ids `validateConfig` can emit, in `DOMAIN_RULES` order (see `RULE_TABLE`). */
 export const DOMAIN_RULE_IDS = Object.freeze(RULE_TABLE.map((entry) => entry.id));
 
 /**