@foldrun/core 2.4.0 → 2.6.0

package/src/evals.ts

@@ -34,16 +34,21 @@
 import { accountModelEnv, withModelEnv } from "./model-env.ts";
 import type { TranslatorSpec } from "./translator.ts";
 import { sdkEnv } from "./step-exec.ts";
+import { platformModelEnv } from "./runner.ts";
 import fs from "node:fs";
 import path from "node:path";
 import { deployedCommit } from "./deploy.ts";
 import { latestRevisionId } from "./history.ts";
-import matter from "gray-matter";
+import matter from "./matter.ts";
 import { spawn } from "node:child_process";
+import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.ts";
+import { readAgentsMdKeys } from "./agents-md.ts";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import {
   workspaceDir,
+  accountDir,
   readRun,
+  runVerdict,
   writeWorkspaceFile,
   resolveModel,
   resolveEffort,
@@ -145,7 +150,9 @@ function readScalar(
   return { value: [first, ...parts].join(" ").trim(), end: i };
 }
 
-export function parseEval(file: string, raw: string): EvalInfo {
+/** `defaults`: the workspace's `judge:` (AGENTS.md), used where the eval
+ *  names no model or effort of its own. */
+export function parseEval(file: string, raw: string, defaults: { model?: string; effort?: string } = {}): EvalInfo {
   const { data, content } = matter(raw);
   const cases: EvalCase[] = [];
   let current: EvalCase | null = null;
@@ -196,8 +203,8 @@ export function parseEval(file: string, raw: string): EvalInfo {
     file,
     agent: typeof data.agent === "string" ? data.agent : null,
     flow: typeof data.flow === "string" ? data.flow : null,
-    model: resolveModel(data.model ?? "fast"),
-    effort: resolveEffort(data.effort ?? "low"),
+    model: resolveModel(data.model ?? defaults.model ?? "fast"),
+    effort: resolveEffort(data.effort ?? defaults.effort ?? "low"),
     trigger: data.trigger === "manual" ? "manual" : "deploy",
     live: data.live === true,
     inputs: data.inputs === true,
@@ -212,7 +219,18 @@ export function listEvals(tenant: string, workspace: string): EvalInfo[] {
     .readdirSync(dir)
     .filter((f) => f.endsWith(".md"))
     .sort()
-    .map((f) => parseEval(f, fs.readFileSync(path.join(dir, f), "utf8")));
+    .map((f) => parseEval(f, fs.readFileSync(path.join(dir, f), "utf8"), judgeDefaults(tenant, workspace)));
+}
+
+/** `judge:` from AGENTS.md, field by field: the workspace's model (or
+ *  effort), else the account's — so a workspace that sets only an effort
+ *  keeps the account's model (Codex debate: the form says so). */
+export function judgeDefaults(tenant: string, workspace: string): { model?: string; effort?: string } {
+  const ws = parseJudge(readAgentsMdKeys(workspaceDir(tenant, workspace)).judge);
+  const account = parseJudge(readAgentsMdKeys(accountDir(tenant)).judge);
+  const model = ws.model ?? account.model;
+  const effort = ws.effort ?? account.effort;
+  return { ...(model ? { model } : {}), ...(effort ? { effort } : {}) };
 }
 
 // ---------- promoting a run ----------
@@ -266,16 +284,26 @@ export function promoteRunToEval(
   tenant: string,
   workspace: string,
   runId: string,
-  opts: { evalName?: string; caseName?: string; expect?: string[]; by?: string } = {},
+  /** `should`: what a run that went wrong should have done, in a sentence —
+   *  the judge's claim for the case (FOL-72 step 10). */
+  opts: { evalName?: string; caseName?: string; expect?: string[]; should?: string; by?: string } = {},
 ): { file: string; created: boolean; caseName: string } {
   const run = readRun(tenant, workspace, runId);
   if (!run) throw refuse(`run ${runId} not found`, 404);
-  if (run.status !== "completed") {
-    throw refuse(`only a completed run can become an eval — this one is ${run.status}`, 409);
+  if (run.status !== "completed" && run.status !== "failed") {
+    throw refuse(`only a finished run can become an eval — this one is ${run.status}`, 409);
+  }
+  // A run that went wrong is the test worth having most — but its own answer
+  // is the wrong one to hold the next run to, so it needs to be told what
+  // was right (FOL-72 step 10).
+  const should = oneLine(opts.should ?? "");
+  const wentWrong = run.status === "failed" || ["BAD", "BLOCKED"].includes(runVerdict(run) ?? "");
+  if (wentWrong && !should && !(opts.expect && opts.expect.length)) {
+    throw refuse("this run went wrong, so its answer is not the one to keep — say what it should have done (`should`, a sentence for the judge) or give `expect` lines", 409);
   }
   const produced = run.steps.filter((s) => (s.result ?? "").trim());
   const last = produced[produced.length - 1];
-  if (!last) throw refuse("this run produced no result to hold the next one to", 409);
+  if (!last && !should && !(opts.expect && opts.expect.length)) throw refuse("this run produced no result to hold the next one to", 409);
   if (run.steps.length === 0 || !run.steps[0].instruction?.trim()) {
     throw refuse("this run has no task on record", 409);
   }
@@ -310,8 +338,10 @@ export function promoteRunToEval(
       }
       return `${m[1]}: ${m[2]}`;
     });
+  } else if (should) {
+    expect = [`judge: ${should.slice(0, 400)}`];
   } else {
-    const conclusion = oneLine(run.summary?.trim() || (last.result ?? "")).slice(0, 200);
+    const conclusion = oneLine(run.summary?.trim() || (last!.result ?? "")).slice(0, 200);
     expect = [`judge: reaches the same conclusion as the recorded run: ${conclusion}`];
   }
 
@@ -471,9 +501,12 @@ function shell(command: string, cwd: string): Promise<{ code: number | null; out
   });
 }
 
-// The judge gets the rubric and the output, and must answer with one word.
+// The judge gets the rubric and the output, and ends with one word.
 // Constrained output beats asking for a score: "PASS" or "FAIL" can't be
-// misread, where "7/10" needs a threshold nobody agreed on.
+// misread, where "7/10" needs a threshold nobody agreed on. The word comes
+// LAST, after the reasoning: asked for it first, the judge committed before
+// it had looked, then argued the other way — "FAIL … which meets the
+// criterion" (vaza evals, 21 Oct 2026).
 async function judge(
   rubric: string,
   output: string,
@@ -482,8 +515,7 @@ async function judge(
   env: Record<string, string | undefined>,
 ): Promise<AssertionResult["detail"] & string> {
   const prompt =
-    `You are grading one piece of output against one criterion. Answer with exactly ` +
-    `PASS or FAIL on the first line, then one short sentence of reason.\n\n` +
+    `You are grading one piece of output against one criterion. ${JUDGE_VERDICT_INSTRUCTION}\n\n` +
     `Criterion: ${rubric}\n\n<output>\n${output.slice(0, 20000)}\n</output>`;
 
   let text = "";
@@ -510,13 +542,26 @@ async function judge(
   return text.trim();
 }
 
+/**
+ * The judge's environment: this process's, with the platform's model
+ * credential read live. The process's own CLAUDE_CODE_OAUTH_TOKEN is the copy
+ * it was handed at boot; the box refreshes the login every four hours and the
+ * old token is then revoked, so a judge on the boot copy failed with "OAuth
+ * token revoked" from the first refresh until the pod restarted, while the
+ * agent steps (which read the live file) kept working (2026-10-21).
+ */
+export function judgeProcessEnv(): Record<string, string | undefined> {
+  const live = Object.fromEntries(Object.entries(platformModelEnv()).filter(([, v]) => v !== undefined));
+  return sdkEnv({ ...process.env, ...live });
+}
+
 async function checkAssertion(
   assertion: Assertion,
   output: string,
   agentDir: string,
   model: string,
   effort: Effort | null,
-  judgeEnv: () => { env: Record<string, string | undefined>; translator?: TranslatorSpec | null } = () => ({ env: sdkEnv(undefined) }),
+  judgeEnv: () => { env: Record<string, string | undefined>; translator?: TranslatorSpec | null } = () => ({ env: judgeProcessEnv() }),
 ): Promise<AssertionResult> {
   const hay = output.toLowerCase();
   switch (assertion.type) {
@@ -557,9 +602,9 @@ async function checkAssertion(
       } catch (err) {
         return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
       }
-      const verdict = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
-      const passed = /^\s*PASS\b/i.test(verdict);
-      return { assertion, passed, detail: verdict.slice(0, 300) || "judge returned nothing" };
+      const text = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
+      const { passed, detail } = judgeVerdict(text);
+      return { assertion, passed, detail };
     }
   }
 }
@@ -640,7 +685,7 @@ export async function runEval(
       const judges = testCase.expect.filter((a) => a.type === "judge");
       for (const a of cheap) assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort));
       if (assertions.every((r) => r.passed)) {
-        const judgeEnv = () => accountModelEnv(tenant, workspace, () => sdkEnv(undefined));
+        const judgeEnv = () => accountModelEnv(tenant, workspace, judgeProcessEnv);
         for (const a of judges) assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort, judgeEnv));
       } else {
         for (const a of judges) {

package/src/flow-lint.ts

@@ -91,6 +91,27 @@ const LOOKS_LIKE_SHELL =
  *  prefix, nothing shell-shaped anywhere in it, and enough words to be a
  *  sentence — so a bare `./check.sh` or a one-word command is left alone and
  *  the warning only fires where the author plainly wrote prose. */
+/**
+ * Why a `matches:` pattern will not compile, or null when it does. The
+ * runtime tests it as a JavaScript RegExp with the `i` flag (step-exec.ts,
+ * evals.ts), and a pattern that throws fails its check on every run with
+ * "invalid regular expression". The usual cause is another dialect: on
+ * 2026-10-21 Python's inline `(?m)` broke five eval checks on vaza, and
+ * nothing said so before they ran.
+ */
+export function regexProblem(pattern: string): string | null {
+  try {
+    new RegExp(pattern, "i");
+    return null;
+  } catch (err) {
+    const why = err instanceof Error ? err.message.replace(/^Invalid regular expression: /, "") : String(err);
+    const inline = /\(\?[a-z]+\)/.test(pattern)
+      ? " — JavaScript has no inline flags like (?m); write (^|\\n) for the start of a line"
+      : "";
+    return `is not a valid JavaScript regular expression (${why})${inline}`;
+  }
+}
+
 function looksLikeProse(verify: string): boolean {
   const v = verify.trim();
   if (!v || VERIFY_ASSERTION.test(v)) return false;
@@ -443,6 +464,21 @@ export function lintFlow(flow: FlowInfo, known?: KnownNames): FlowWarning[] {
       });
     }
 
+    // A `verify: matches:` the runtime cannot compile fails the step on
+    // every run, whatever the agent did.
+    const verifyRe = step.verify ? /^matches:\s*(.*)$/.exec(step.verify.trim()) : null;
+    // The same normalisation checkVerify applies (step-exec.ts): one quote
+    // off each end, so the pattern checked is the pattern that runs.
+    const reProblem = verifyRe ? regexProblem(verifyRe[1].trim().replace(/^["']|["']$/g, "")) : null;
+    if (reProblem) {
+      warnings.push({
+        step: i,
+        line: step.line,
+        message: `verify: matches: ${reProblem}`,
+        detail: "The runtime tests matches: as a JavaScript regular expression, case-insensitive. One that does not compile fails this step on every run.",
+      });
+    }
+
     // A step's OTHER agent references — the ones no parser validates,
     // because they are options rather than the step's target. Both fail
     // silently and at the worst possible moment: a misspelled `delegate:`

package/src/flow-patterns.ts

@@ -25,6 +25,7 @@ import { joinGroup, splitToRail, type Groups } from "./arrange.ts";
 import { lintFlow } from "./flow-lint.ts";
 import { toLF, asRaw } from "./eol.ts";
 import { removalImpact, stepLabel, type RemovalImpact } from "./step-removal.ts";
+import { keySpan, InlineBlockError } from "./frontmatter-text.ts";
 
 // ---------- flow files ----------
 
@@ -474,13 +475,15 @@ function splitComment(value: string): { value: string; comment: string } {
   return m ? { value: m[1], comment: m[2] } : { value, comment: "" };
 }
 
+/** Where a key is written — at the top or inside its job block
+ *  (frontmatter-text.ts) — with the text after its colon and its indent. */
 function keyLine(lines: string[], close: number, key: string) {
-  const re = new RegExp(`^${key.replace(/[-]/g, "\\-")}:(.*)$`);
-  for (let i = 1; i < close; i++) {
-    const m = lines[i].match(re);
-    if (m) return { index: i, rest: m[1] };
-  }
-  return null;
+  const where = keySpan(lines.slice(1, close), key);
+  if (!where) return null;
+  const index = where.at + 1;
+  // Quoted or not, as keySpan matched it.
+  const m = lines[index].slice(where.indent.length).match(new RegExp(`^["']?${key.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&")}["']?\\s*:(.*)$`));
+  return m ? { index, rest: m[1], indent: where.indent } : null;
 }
 
 /** Block-style item lines under a key: `  - name`, until anything else. */
@@ -502,7 +505,15 @@ export function frontmatterList(raw: string, key: string): string[] {
   const lines = raw.split(eolOf(raw));
   const b = frontBounds(lines);
   if (!b) return [];
-  const k = keyLine(lines, b.close, key);
+  let k: ReturnType<typeof keyLine>;
+  try {
+    k = keyLine(lines, b.close, key);
+  } catch (err) {
+    // A block these text edits do not handle (frontmatter-text.ts) is the
+    // writer's to refuse; a read of it is empty, not an error.
+    if (err instanceof InlineBlockError) return [];
+    throw err;
+  }
   if (!k) return [];
   const v = splitComment(k.rest).value.trim();
   if (v.startsWith("[")) return v.replace(/^\[|\]$/g, "").split(",").map(itemName).filter(Boolean);
@@ -523,9 +534,11 @@ export function editFrontmatterList(raw: string, key: string, name: string, acti
   const lines = raw.split(eol);
   const b = frontBounds(lines);
   if (!b) return action === "remove" ? raw : ["---", `${key}: [${name}]`, "---", ...lines].join(eol);
+  // Located first, so a key in a block these edits do not handle is refused
+  // (InlineBlockError) rather than read as an empty list.
+  const k = keyLine(lines, b.close, key);
   const has = frontmatterList(raw, key).includes(name);
   if ((action === "add") === has) return raw;
-  const k = keyLine(lines, b.close, key);
   if (!k) {
     lines.splice(b.close, 0, `${key}: [${name}]`);
     return lines.join(eol);
@@ -536,18 +549,18 @@ export function editFrontmatterList(raw: string, key: string, name: string, acti
     // Flow style, or a lone scalar (read as a one-item list): that one line.
     const tokens = v.startsWith("[") ? v.replace(/^\[|\]$/g, "").split(",").map((t) => t.trim()).filter(Boolean) : [v];
     const next = action === "add" ? [...tokens, name] : tokens.filter((t) => itemName(t) !== name);
-    lines[k.index] = `${key}: [${next.join(", ")}]${comment}`;
+    lines[k.index] = `${k.indent}${key}: [${next.join(", ")}]${comment}`;
     return lines.join(eol);
   }
   const items = blockItems(lines, k.index, b.close);
   if (action === "add") {
-    const indent = items.length ? lines[items[0]].match(/^(\s*)-/)![1] : "  ";
+    const indent = items.length ? lines[items[0]].match(/^(\s*)-/)![1] : `${k.indent}  `;
     lines.splice(items.length ? items[items.length - 1] + 1 : k.index + 1, 0, `${indent}- ${name}`);
     return lines.join(eol);
   }
   const drop = items.filter((i) => blockItemName(lines[i]) === name);
   for (const i of [...drop].reverse()) lines.splice(i, 1);
-  if (drop.length === items.length) lines[k.index] = `${key}: []${comment}`;
+  if (drop.length === items.length) lines[k.index] = `${k.indent}${key}: []${comment}`;
   return lines.join(eol);
 }
 
@@ -577,9 +590,9 @@ export function setFrontmatterScalar(raw: string, key: string, value: string): s
     const { value: v, comment } = splitComment(k.rest);
     let end = k.index + 1;
     if (/^\s*[|>][-+]?\d*\s*$/.test(v) || !v.trim()) {
-      while (end < b.close && /^\s+\S/.test(lines[end])) end++;
+      while (end < b.close && (lines[end].match(/^\s*/)?.[0].length ?? 0) > k.indent.length && /\S/.test(lines[end])) end++;
     }
-    lines.splice(k.index, end - k.index, `${line}${comment}`);
+    lines.splice(k.index, end - k.index, `${k.indent}${line}${comment}`);
     return lines.join(eol);
   }
   const name = keyLine(lines, b.close, "name");

package/src/frontmatter-fields.ts

@@ -34,8 +34,33 @@ export interface FieldSpec {
   legacy?: boolean;
   /** One line: what it is. The completion's hint. */
   help: string;
+  /** Which of the four jobs it does, when it does one (set from JOB_FIELDS
+   *  below, not by hand): the block it may also be written in. */
+  job?: Job;
 }
 
+/**
+ * The four jobs of running agents — governance, guardrail, observability,
+ * evaluation (the owner's choice of words, 21 Oct 2026). A field that does
+ * one may be written flat, as always, or inside a block of that name:
+ *
+ *   guardrail:
+ *     limits: {repeat: 5}
+ *     network: [api.example.com]
+ *
+ * reads exactly as `limits:` and `network:` at the top. matter.ts folds the
+ * blocks as it parses, so every reader sees flat keys; check reports a key
+ * set both ways (config/conflict) or in the wrong block.
+ */
+export type Job = "governance" | "guardrail" | "observability" | "evaluation";
+
+export const JOBS: readonly { name: Job; title: string; what: string }[] = [
+  { name: "governance", title: "Governance", what: "who answers for it and what it may spend, decide and ship" },
+  { name: "guardrail", title: "Guardrail", what: "what it may reach and call, and what stops it" },
+  { name: "observability", title: "Observability", what: "what is recorded, and who is told" },
+  { name: "evaluation", title: "Evaluation", what: "how its work is judged" },
+];
+
 export type SchemaKind = "agent" | "agents-md" | "flow" | "tool" | "skill" | "eval" | "hook";
 
 /** What can start a flow. store.ts re-exports it; parseFlow and the editor
@@ -50,6 +75,7 @@ const LOCALE = { validated: true } as const;
 const AGENT: FieldSpec[] = [
   { key: "name", type: "string", help: "kebab-case; the folder is the identity" },
   { key: "description", type: "string", help: "what it does and when — other agents and people read it" },
+  { key: "owner", type: "string", help: "the person accountable for it — an email or a name; else the workspace's, else the account's" },
   { key: "model", type: "string", help: "fast | default | max, an alias, or a full model id" },
   { key: "effort", type: "string", values: EFFORT_LEVELS, help: "how long it thinks" },
   { key: "size", type: "string", values: ["small", "large", "heavy"], help: "the sandbox it rents; anything else becomes large" },
@@ -86,6 +112,7 @@ const AGENTS_MD: FieldSpec[] = [
   { key: "mdagent_version", type: ["string", "number"], legacy: true, help: "older spelling of foldrun_version" },
   { key: "name", type: "string", help: "the workspace's name" },
   { key: "description", type: "string", help: "shown in the workspace list" },
+  { key: "owner", type: "string", help: "the person accountable for every agent and flow here that names none" },
   { key: "provider", type: "object", help: "the model endpoint every agent here uses unless it names its own" },
   { key: "runtime", type: "object", help: "packages for agents that declare none" },
   { key: "web", type: "object", validated: true, help: "web.browse defaults" },
@@ -102,18 +129,26 @@ const AGENTS_MD: FieldSpec[] = [
   { key: "budget", type: ["number", "string"], help: "USD per month, or N/day | N/week | N/month" },
   { key: "priority", type: "string", values: ["high", "normal", "low"], help: "account: where its runs stand in the queue" },
   { key: "concurrency", type: ["number", "string"], help: "account: runs at once" },
+  { key: "alerts", type: "object", validated: true, help: "thresholds that tell notify: — failure_rate (30%), min_runs, credits_day, run_minutes, stale_days, cost_spike, runs_per_hour, new_host" },
+  { key: "capture", type: "string", values: ["full", "metadata"], help: "what runs record of each tool call: full (its input and output, secrets masked) or metadata (name, size and time only)" },
+  { key: "network_enforce", type: "boolean", help: "true: a site off a step's network: list is refused, not only named in the trace. The account's or the workspace's true is enough" },
+  { key: "telemetry", type: "object", validated: true, help: "send each run as an OpenTelemetry trace — otlp: <https …/v1/traces>, headers: { authorization: ${SECRET} }" },
+  { key: "deploy_block", type: "string", values: ["none", "secrets", "security"], help: "refuse a deploy on scanner findings: secrets (a key written in) or security (any security warning)" },
+  { key: "judge", type: "object", validated: true, help: "the model every judge: here grades with — {model: fast | default | max, effort}; an eval's own model: wins" },
   { key: "schedule", type: ["string", "object"], validated: true, legacy: true, help: "refused: only a flow has a clock" },
 ];
 
 const FLOW: FieldSpec[] = [
   { key: "name", type: "string", help: "the flow's name" },
   { key: "description", type: "string", help: "what it is for" },
+  { key: "owner", type: "string", help: "the person accountable for it — an email or a name; else the workspace's, else the account's" },
   { key: "trigger", type: "string", values: FLOW_TRIGGERS, help: "what starts it; any other value never fires" },
   { key: "schedule", type: "string", help: "cron, when trigger: schedule" },
   { key: "timezone", type: "string", validated: true, help: "the zone its schedule reads in" },
   { key: "model", type: "string", help: "every step's model unless the step says" },
   { key: "effort", type: "string", values: EFFORT_LEVELS, help: "every step's effort unless the step says" },
   { key: "overlap", type: "string", validated: true, help: "skip | queue" },
+  { key: "issues", type: "string", values: ["stay-open", "auto-close"], help: "what a good run does to this flow's open issues: stay-open (the default — a person resolves them) or auto-close" },
   { key: "priority", type: "string", validated: true, help: "high | normal | low" },
   { key: "catchup", type: "string", validated: true, help: "last | none" },
   { key: "on", type: "string", validated: true, help: "trigger: flow — completed | failed | blocked | any" },
@@ -200,10 +235,55 @@ const SAID_WHAT_IT_IS: FieldSpec[] = [
   { key: "type", type: "string", validated: true, legacy: true, help: "no longer read — the path says what this is" },
 ];
 
+/** Which fields each job holds, per kind of file. One table: the blocks'
+ *  help, the fold, the editor's completions and check all read it. */
+const JOB_FIELDS: Partial<Record<SchemaKind, Partial<Record<Job, readonly string[]>>>> = {
+  agent: {
+    governance: ["owner", "budget"],
+    guardrail: ["limits", "network", "hooks", "disallowedTools", "permissionMode", "secrets"],
+  },
+  flow: {
+    governance: ["owner", "approvers", "approve_within", "budget", "priority"],
+    guardrail: ["throttle", "debounce", "overlap", "disable_after", "live"],
+    observability: ["issues", "sla"],
+  },
+  "agents-md": {
+    governance: ["owner", "budget", "priority", "concurrency", "deploy_block"],
+    guardrail: ["limits", "network", "network_enforce", "hooks"],
+    observability: ["alerts", "telemetry", "notify", "capture"],
+    evaluation: ["judge"],
+  },
+};
+
+/** The fields of one kind that do this job, in schema order. */
+export function fieldsOfJob(kind: SchemaKind, job: Job): string[] {
+  return [...(JOB_FIELDS[kind]?.[job] ?? [])];
+}
+
+/** Every key any kind lets a block hold, per job — what matter.ts may lift
+ *  out of a block without knowing which kind of file it is reading. */
+export const FOLDABLE: Readonly<Record<Job, ReadonlySet<string>>> = Object.fromEntries(
+  JOBS.map(({ name }) => [name, new Set(Object.values(JOB_FIELDS).flatMap((byJob) => byJob?.[name] ?? []))]),
+) as unknown as Record<Job, ReadonlySet<string>>;
+
+/** A kind's fields with their jobs set, and a block field per job it has. */
+function withJobs(kind: SchemaKind, fields: FieldSpec[]): FieldSpec[] {
+  const byJob = JOB_FIELDS[kind] ?? {};
+  const jobOf = new Map<string, Job>();
+  for (const [job, keys] of Object.entries(byJob) as [Job, readonly string[]][]) for (const k of keys) jobOf.set(k, job);
+  const tagged = fields.map((f) => (jobOf.has(f.key) ? { ...f, job: jobOf.get(f.key)! } : f));
+  const blocks: FieldSpec[] = JOBS.filter((j) => (byJob[j.name]?.length ?? 0) > 0).map((j) => ({
+    key: j.name,
+    type: "object",
+    help: `${j.title} — ${j.what}: ${byJob[j.name]!.join(", ")}, as one block`,
+  }));
+  return [...tagged, ...blocks];
+}
+
 export const FRONTMATTER: Readonly<Record<SchemaKind, readonly FieldSpec[]>> = {
-  agent: [...AGENT, ...SAID_WHAT_IT_IS],
-  "agents-md": AGENTS_MD,
-  flow: [...FLOW, ...SAID_WHAT_IT_IS],
+  agent: withJobs("agent", [...AGENT, ...SAID_WHAT_IT_IS]),
+  "agents-md": withJobs("agents-md", AGENTS_MD),
+  flow: withJobs("flow", [...FLOW, ...SAID_WHAT_IT_IS]),
   tool: [...TOOL, ...SAID_WHAT_IT_IS.filter((f) => f.key !== "type")],
   skill: [...SKILL, ...SAID_WHAT_IT_IS],
   eval: [...EVAL, ...SAID_WHAT_IT_IS],

package/src/frontmatter-guard.ts

@@ -0,0 +1,70 @@
+// The last word on every frontmatter edit made as text (agents-md.ts
+// patchFrontmatter, network.ts setNetworkSetting, the canvas's list and
+// scalar edits): the result is read back the way a run reads it, and the
+// edit is refused — the file left as it was — unless it parses, set what it
+// said it set, left everything else as it was, and made no key both flat and
+// in its block. The text writers handle the shapes people write; this makes
+// a shape they do not handle a refusal, never a broken or doubled file
+// (Codex debate, 21 Oct 2026).
+
+import { isDeepStrictEqual } from "node:util";
+import { configMatter, jobFold } from "./matter.ts";
+
+/** A write the guard refused. 409: the file is fine, this edit is not. */
+export class UnsafeEditError extends Error {
+  status = 409;
+  constructor(why: string) {
+    super(`not saved — ${why}. Edit the file itself, or write its blocks one key per line`);
+  }
+}
+
+const front = (text: string) => configMatter(text).data as Record<string, unknown>;
+
+/** What a changed key must read back as: a value (null: absent), or a test
+ *  of what it reads as, for a writer whose output form is its own (a canvas
+ *  list, a scalar YAML may type). */
+export type Expect = unknown | ((value: unknown) => boolean);
+
+/**
+ * `after` if it is `before` with only `changed` keys different and each
+ * `expect`ed key reading back as expected; throws UnsafeEditError otherwise.
+ * Checked on every call — an edit that changed nothing must still have done
+ * what it said — and refused when `before` cannot be read, since nothing
+ * then could be compared.
+ */
+export function guardEdit(before: string, after: string, changed: readonly string[], expect: Record<string, Expect> = {}): string {
+  let was: Record<string, unknown>;
+  try {
+    was = front(before);
+  } catch {
+    throw new UnsafeEditError("the frontmatter does not parse as it is, so this edit could not be checked — fix the file first");
+  }
+  let now: Record<string, unknown>;
+  try {
+    now = front(after);
+  } catch (err) {
+    throw new UnsafeEditError(`the result would not parse (${err instanceof Error ? err.message.split("\n")[0] : String(err)})`);
+  }
+  const conflictsBefore = jobFold(was)?.conflicts ?? new Map();
+  for (const [k, block] of jobFold(now)?.conflicts ?? new Map()) {
+    if (!conflictsBefore.has(k)) throw new UnsafeEditError(`\`${k}\` would be written both at the top and inside \`${block}:\``);
+  }
+  for (const [k, want] of Object.entries(expect)) {
+    const ok = typeof want === "function" ? (want as (v: unknown) => boolean)(now[k]) : isDeepStrictEqual(now[k], want === null ? undefined : want);
+    if (!ok) throw new UnsafeEditError(`\`${k}\` would not read back as written`);
+  }
+  for (const k of new Set([...Object.keys(was), ...Object.keys(now)])) {
+    if (changed.includes(k)) continue;
+    if (!isDeepStrictEqual(was[k], now[k])) throw new UnsafeEditError(`\`${k}\` would change too`);
+  }
+  return after;
+}
+
+/** The front of `text` as a run reads it, or null when it does not parse. */
+export function readFront(text: string): Record<string, unknown> | null {
+  try {
+    return front(text);
+  } catch {
+    return null;
+  }
+}

package/src/frontmatter-schema.ts

@@ -2,10 +2,12 @@
 // the names. Node-side (it reads store's parsers); the browser takes the
 // field list alone from frontmatter-fields.ts.
 
-import { FRONTMATTER, type FieldType, type SchemaKind } from "./frontmatter-fields.ts";
+import { FRONTMATTER, JOBS, type FieldType, type SchemaKind } from "./frontmatter-fields.ts";
+import { jobFold } from "./matter.ts";
 import { resolveEffort, parseDuration, parseInstant, parseRate, STEP_OPTION_KEYS } from "./store.ts";
 import { budgetProblem } from "./budget.ts";
 import { cronProblem } from "./cron.ts";
+import { modelSecretCollision } from "./model-credential.ts";
 
 export { FRONTMATTER, schemaKindOf, type FieldSpec, type FieldType, type SchemaKind } from "./frontmatter-fields.ts";
 
@@ -31,6 +33,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
     apis: apisProblem,
     budget: (v) => budgetProblem(v, ["run"]),
     ask: (v) => askProblem(v),
+    secrets: modelSecretCollision,
   },
   "agents-md": {
     budget: (v) => budgetProblem(v, ["day", "week", "month"]),
@@ -54,6 +57,7 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
     transport: (v) => (["http", "script", "mcp"].includes(String(v).toLowerCase()) ? null : `"${String(v)}" is not a transport — http, script or mcp`),
     methods: methodsProblem,
     rate: (v) => (parseRate(v) ? null : `"${shown(v)}" is not a rate — N/s, N/minute, N/hour, or a number per second, above 0`),
+    secrets: modelSecretCollision,
   },
   "eval": {
     effort: (v) => (resolveEffort(v) ? null : `"${String(v)}" is not an effort — low, medium, high, xhigh or max; the judge runs at none`),
@@ -62,8 +66,8 @@ const CHECKS: Partial<Record<SchemaKind, Record<string, (value: unknown) => stri
 
 export interface FieldProblem {
   key: string;
-  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field";
-  level: "warn" | "info";
+  rule: "config/unknown-field" | "config/wrong-type" | "config/invalid-value" | "config/missing-field" | "config/conflict" | "config/misplaced";
+  level: "error" | "warn" | "info";
   message: string;
 }
 
@@ -94,7 +98,31 @@ export function frontmatterProblems(
   const fields = FRONTMATTER[kind];
   const known = fields.map((f) => f.key);
   const out: FieldProblem[] = [];
+  // The four job blocks (matter.ts folds them): a key set both ways, and a
+  // key left in a block that does not hold it.
+  const fold = jobFold(data);
+  for (const [key, job] of fold?.conflicts ?? []) {
+    out.push({ key, rule: "config/conflict", level: "error", message: `\`${key}:\` is set twice — at the top and inside \`${job}:\`. Only the top one would be read; keep one` });
+  }
+  for (const { name: job } of JOBS) {
+    const block = data[job];
+    if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+    for (const inner of Object.keys(block as Record<string, unknown>)) {
+      const spec = fields.find((f) => f.key === inner);
+      const message = spec?.job
+        ? `\`${inner}:\` is a ${spec.job} field, not a ${job} one — move it into \`${spec.job}:\` or to the top. Inside \`${job}:\` it is not read`
+        : spec
+          ? `\`${inner}:\` belongs to none of the four jobs — write it at the top. Inside \`${job}:\` it is not read`
+          : `\`${inner}:\` inside \`${job}:\` is not a field foldrun reads${belongsIn(inner, kind) ? ` here — it is read in ${belongsIn(inner, kind)}` : ""}; it is ignored`;
+      // A real setting in the wrong block is a setting silently not applied
+      // — a guardrail written under governance: guards nothing — so it is an
+      // error (Codex debate). A word foldrun does not read at all is a note.
+      out.push({ key: inner, rule: "config/misplaced", level: spec ? "error" : "info", message });
+    }
+  }
   for (const [key, value] of Object.entries(data)) {
+    // A block holding only misplaced keys is reported above, key by key.
+    if (JOBS.some((j) => j.name === key) && value && typeof value === "object" && !Array.isArray(value)) continue;
     const spec = fields.find((f) => f.key === key);
     const check = CHECKS[kind]?.[key];
     if (!spec) {
@@ -107,7 +135,8 @@ export function frontmatterProblems(
         // it is an option of a flow's step.
         out.push({ key, rule: "config/unknown-field", level: "warn", message: `\`${key}:\` is not read on an agent — it is a step option: indent it under the step in the flow (\`   ${key}: ${shown(value)}\`). Here it is ignored` });
       } else if (home) {
-        out.push({ key, rule: "config/unknown-field", level: "warn", message: `\`${key}:\` is read in ${home}, not in ${kind === "agents-md" ? "AGENTS.md" : kind === "eval" ? "an eval" : `a ${kind}`} — here it is ignored` });
+        const where = fold?.folded.get(key);
+        out.push({ key, rule: "config/unknown-field", level: "warn", message: `\`${key}:\`${where ? ` (inside \`${where}:\`)` : ""} is read in ${home}, not in ${kind === "agents-md" ? "AGENTS.md" : kind === "eval" ? "an eval" : `a ${kind}`} — here it is ignored` });
       } else {
         out.push({ key, rule: "config/unknown-field", level: "info", message: `\`${key}:\` is not a field foldrun reads; it is ignored` });
       }