bareloop 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -5,6 +5,258 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.13.0] — 2026-08-23
+
+### Fixed (2026-08-23 — the release round: a pointer that lied, a close with no home, a rule that charged for its own refusal)
+
+- **The pointer no longer lies about a file emptied since it was read.** `src/readshim.js`'s
+  pointer branch tested `start >= total` alone, so `0 >= 0` held with **no ledger entry at all** —
+  the first read of an empty file and a re-read of a file TRUNCATED TO EMPTY since delivery were
+  indistinguishable, and both answered "you already hold all 0 bytes". A worker would have gone on
+  believing in content that was gone. The guard now requires a ledger entry whose hash still
+  matches. This is precisely the untruthful-pointer class the module exists to prevent, found
+  inside the module built to prevent it, and reproduced live before the fix.
+- **`judge-round` carries its rate provenance.** The judged floor made it the first spend a CLOSE
+  has ever had, and `src/ledger.js` documented the write side as forwarding `rateSource` onto it —
+  but the emit never spread the field, so every judge round would have read UNKNOWN forever. NOT
+  rounded up: `src/kinds.js`'s `onJudgeCost` payload still does not carry the field, so it reads
+  UNKNOWN today, and both the emit and the ledger header now say so plainly.
+- **A torn spine line stops reading as exact spend.** `scripts/run-battery-readshim.mjs` marked
+  unparseable lines `__corrupt` "never guessed at", then counted them, dropped them, and reported
+  the row's spend as EXACT while `corruptLines` reached no readout. `spendComplete` now goes false
+  when any line was unreadable (spend renders `>=`) and the audit prints the count per row.
+- **G1's ceiling half is refused at $0 instead of after the drafter is paid.** `validatePlan` reds
+  `read-blind` when a capped step grants `read` without the retrieval pair — but a step cannot
+  grant what the SIGNED CEILING does not offer, so against a spec whose `tools` lack `recall`/`get`
+  **every** draft red identically and the drafter was paid for each doomed cycle. `runPlan` now
+  throws at the same $0 door as the arm guard, in the same class: an operator param-guard
+  `TypeError`, never a model-output red — nothing the agent authored is wrong when the operator
+  asks for a shim the signature cannot satisfy. Tighten-only; the only configuration it rejects
+  already failed 100% of the time, just later and for money. `RETRIEVAL_PAIR` is now exported from
+  `src/plan.js` rather than respelled, so the rule and its pre-flight cannot drift apart.
+
+### Changed (2026-08-23)
+
+- **The aurora close moved to a tree development cannot mutate** (`jobs/aurora-u-spawner-types.json`,
+  F110). Its stages had pointed at a scratch worktree, which was removed during ordinary branch
+  work — every stage silently became `node: cannot find module`. The home before that was a shared
+  working checkout, where a close landing mid-edit dies as an instrument fault rather than a
+  verdict. Neither is a home: a checkout is *supposed* to go dirty and a scratch worktree is
+  *supposed* to be removable. **A close is the arbiter's instrument, so its host must have the
+  arbiter's lifetime.** Now a worktree pinned at a release tag, never edited, with its own
+  dependencies. Re-signing was required and given in-turn.
+
+### Added (2026-08-18 — the read shim, flag-gated OFF)
+
+- **`src/readshim.js` — a per-worker delivery ledger over the read tool**, off unless the new
+  `readShim` flag is set on `runJob`/`runPlan`. A read over 24KB (`READ_SHIM_CAP`) delivers its
+  next unseen slice plus a trusted steer at `ctx_recall`/`ctx_get`; a re-read of a file the
+  worker holds WHOLE and unchanged returns a short pointer instead of the bytes; a re-read of
+  a file it holds only PART of returns the next slice, never a pointer; any content change
+  re-delivers from the start. Measured on a $0 replay of 1,844 real `shell_read` actions from
+  143 archived gate audits: 48% of reads re-read unchanged bytes, and cap+pointer keyed on what
+  was DELIVERED saved 65.6% of read payload with **zero** untruthful responses — where the
+  naive path+hash key saved 8.2 points more by telling **250 lies**, median 73,348 bytes hidden
+  each (BA-17 read-blinding, reproduced).
+- **G1 at the validation gate (`read-blind`)**: under the shim, a plan step granting `read` must
+  also grant `recall` and `get`. Capping a worker with no retrieval verb is BA-17 on purpose —
+  the cap is what makes the pair mandatory. Stated in the drafting prompt as well as enforced
+  (the mailbox precedent).
+- **One flag, four ARMS, default OFF** (the `layerRoot` precedent, F41). `readShim` names which
+  levers run, one value per row of the frozen Phase 2 pre-registration: `false` = A0 (off),
+  `'cap'` = A1 (cap + pointer + next-unseen-slice + G1), `'diff'` = A2 (the diff lever alone — no
+  cap, no pointer, no G1), `true` = A3 (every lever). The two booleans mean exactly what they
+  meant before the arms existed, so nothing written against them changed meaning. With the shim
+  off every observable — validator reds, persona, delivered bytes — is byte-identical to the
+  pre-shim run: the frozen A0 arm has to be exactly today, and a guard firing under a disabled
+  shim would make the baseline a treatment arm. Each arm's persona line describes only the
+  machinery actually installed (A2 is never told about a 24KB limit that is not in force). An
+  unrecognised value THROWS at the entry (`readShimArm`) rather than coercing into a truthy
+  shim — a mis-spelled arm would run one treatment under another's label and be invisible in the
+  results afterwards. The default-flip is not in this change: it waits on a paid contrast.
+- **A stale `ctx_get` pointer serves the requested line range from disk** (2026-08-19), under a
+  CAPPING arm only. The cap's own strategy line steers a capped worker at `ctx_recall` →
+  `ctx_get` for a whole function; `ctx_get` is content-hash gated and throws `StalePointerError`
+  the moment the file changed after indexing — which is the normal case for a worker that just
+  EDITED the file it is working on. Measured on the A1 arm's three green runs: 10 `ctx_get`
+  calls, 5 stale, 0 bytes each, every one a just-written file. A paid round returning nothing,
+  down a path the cap itself chose. The serve hands back the requested 0-based inclusive line
+  range read fresh from disk, under TRUSTED framing that says the pointer was stale, that the
+  range may now hold DIFFERENT code than the symbol asked for, which lines arrived, and that
+  nothing was recorded as delivered. litectx refuses to slice a drifted range itself because an
+  UNLABELLED slice can silently be another symbol's body — the label is what makes it legal.
+  Detection is on the exported `StalePointerError` CLASS, never on message prose. A vanished
+  file or a range now entirely past the end is a refusal RESULT naming what happened, never a
+  throw. It **never touches the delivery ledger**: a slice is not the file, and a ledger that
+  recorded one would answer the next read with "you already have it" to a worker holding 90
+  lines of 900 — the untruthful-pointer failure the shim exists to prevent. The cost of that is
+  a later `shell_read` may re-deliver bytes the serve already showed; the shim over-delivers
+  rather than lies. A0 and A2 are untouched: with no capping arm the hook is not wired and
+  `ctx_get`'s contract is byte-identical.
+- On the native surface the shim REPLACES the `NATIVE_READ_CAP` wrapper rather than layering over
+  it (both bound the same seam at the same 24KB, and a shim outside the native wrapper would
+  ledger already-truncated text as a whole file — the exact lie it exists to prevent). L2
+  (diff-on-change) is deliberately not built: it never fired on the real corpus.
+
+## [0.12.0] — 2026-08-23
+
+### Added (N4 slice 2 — the softgreen rung: a close that JUDGES, and a signer who has the last word)
+
+- **The judged floor is real: LOCATE + DECIDE (`src/judged.js`).** A judge (haiku-4.5, pinned —
+  never a step knob) extracts FACTS from the real artifact with quotes; an arbiter-owned `decide()`
+  renders pass/fail from a signed rubric card; *unsure* is a red, never a pass. The judge never
+  renders a verdict, so the rubric-is-self-consistency gotcha stays closed. Wired as the
+  `judged-floor` close kind — metered from the run's own wallet, `offer:false` by law, and skipping
+  the seed-verdict read (its bar comes from calibration instead).
+- **`soft-green` is ADMITTED as a verdict class** — the class-scoped question set, the inherited
+  green guard battery (hamr: *"battery ties with job type"*), the class-scoped kind menu, and the
+  promise rule: composition stays ≤ the picked class, and exceeding it is an honest red rather than
+  a silent up- or downgrade.
+- **The signer's two artifacts are AUTHORED and enumerated in the hash** (`src/cardauthor.js`): the
+  rubric card comes from Q6 and the calibration set from Q7, both handed to the compiler verbatim,
+  both SHOWN to the signer (D5 shown-and-fixed), and what the signer fixed is what is stored —
+  `source: 'proposal'` says *nobody changed this*, which is a different fact from *a person read it
+  and changed nothing*.
+- **The calibration gate — ten graded truths and five resisted lies buy a signature**
+  (`src/calibrate.js`, gate 4 of `prepareSigning`). The whole pipe grades the signer's own ten cases
+  and faces a 5-artifact injection battery adapted to the locate axis; the floor is **10/10 with
+  itemized reds** (hamr, 2026-08-18) and all-or-nothing on both halves. The $0 legality check runs
+  first and buys no calls. A dead judge is a CASUALTY under the transport's name, never a reading of
+  the operator's rubric.
+- **Quarantine: a judged green earns no learning credit until an `accept` releases it.** Minted
+  soft-green bridge rows are held at mint, the release is forward-only, a rerun re-quarantines, and
+  a held entry is never offered by selection — so a soft-green pass cannot feed N3 before the judged
+  floor is proven.
+- **The review door — every run ends at the signer's three doors** (`accept` / `rerun` / `pause`).
+  The door records a DISPOSITION and never touches the loop's own verdict (hamr: *"it's important
+  not to change the loop self verdict"*): `runPlan` returns `green`/`already-green` exactly as
+  before. It opens at all three green sites (precheck `already-green`, the outer close, and the fix
+  loop's green). **Soft-green always** (`REVIEW_DOOR_CLASSES`), **green opt-in** via `reviewDoor:
+  true` / `--review-door` — the flag wins in both directions and is never inferred. An `accept`
+  re-runs the close's MECHANICAL stages (never a judged floor, never a person): a door keeps for 60
+  days and nothing freezes a tree.
+
+- **The judge tier joins the SIGNATURE — a bump flips the hash and the stage refuses the
+  mismatch** (`649d8a5`). `JUDGE_MODEL`'s docstring has always said a judge-model bump forces a
+  full recalibration, and nothing detected one: `closeDecl.calibration` stored only its `cases`,
+  so the tier that graded them sat OUTSIDE the signed bytes, a bump flipped no hash, and the
+  judged stage never compared the model it was about to buy against the model the signer's set
+  was graded by. A rule with no wired detector is prose (F45). The tier now lives beside the
+  cases as **`calibration.judgeModel`** (`CALIBRATION_FIELDS` in `src/declaredclose.js`
+  enumerates a stored set as exactly those two and nothing else), written by
+  `foldJudgedArtifacts` from the PIN itself rather than from anything a caller may name — and
+  because it is inside the spec, `jobSpecHash` covers it by construction: bump the constant,
+  every signed judged spec hashes differently, the signature dies, and the re-sign is what
+  re-runs the calibration gate. `validateCloseDecl` REQUIRES it on any stored set (a set nobody
+  can attribute to a tier is a floor nobody can tell apart from a bumped one).
+  `declaredStages` carries the close-level fact onto the judged stage as
+  `calibrationJudgeModel` — the same seam, and for the same reason, that already stamps
+  `offer: false` — and it carries it from the SIGNED bytes, so a stage can never name a tier the
+  signature does not. `runJudgedFloor` then refuses to grade on a mismatch, naming both models
+  and the two things that fix it (*re-sign* and *recalibrate*), under the same `FAILED` fault the
+  absent judge seam already stops on: nothing is broken, something was never re-done. An ABSENT
+  stamp is deliberately NOT a runtime stop — a signed spec cannot reach a run without a
+  calibration (the signing gate) or without a model on it (the spec gate), so the only runtime
+  question is WHICH model. No signed spec on disk moves: `jobs/*.json` carries zero
+  `judged-floor` stages today.
+- **The U runner mints the row its review door promises to release** (`e01d0af`). The door tells
+  a person that `accept` *"releases this run's learning credit"*; for every run
+  `scripts/run-u.mjs` has driven that sentence was false by construction — a cold green wrote a
+  standalone `bridge-<job>-<runid>.json` FILE and never a registry ROW, so
+  `--registry --workflow --decide accept` reached `recordDoor`, found no green row for the runid
+  and died `no-row-for-run`. The held credit could be described and never released. **STORAGE
+  ONLY:** nothing here selects, promotes or reuses a bridge — that rung stays parked on
+  `layer-3-reuse` (F88) — and exactly one thing reads the row back, the door. `writeGreenRow` is
+  `runReuse`'s own cold-leg green write LIFTED out of its closure unchanged (the
+  fork-on-a-different-close-shape rule, both collision refusals, the `appendGreen` leg), so the
+  two runners mint a green through ONE spelling; a second spelling of what a green writes is the
+  two-transforms class applied to the ledger itself. **`writeRunGreenRow`** (newly exported) is
+  the U runner's terminal policy on top of it, and every guard is a NAMED refusal rather than a
+  silence: no `--registry` (`no-registry`), an already-green run (`green-predates-run` — accept
+  confirms a verdict, it never mints one), a green with no executed plan (`no-plan-executed`), a
+  class whose credit is not held (`credit-not-held` — `green`-class runs mint nothing here,
+  which is what this runner has always done), and a spine leak blocks the row exactly as it
+  already blocks the bridge file. The row is born HELD because `greenParts` reads the SIGNED
+  class off the record — nothing new sets a flag — and `applyDoorDecision` releases it through
+  the path that already existed. `src/index.js`'s claim that `runReuse` is the only registry
+  writer is CORRECTED rather than left standing.
+### Fixed
+
+- **F102 — a pending human decision now survives a wall-halt → resume** (`a6f62c9`). Two records
+  answering two different questions: `human-decision` (the door, the words, and by whom, with
+  `source: 'operator'|'checkpoint'` and the moment the PERSON spoke) and `human-decision-spent`
+  (what actually bought it). The spend marker fires on the **WORK** — a fix round bought, an accept
+  that greened, a pause honoured — **not on the fix loop opening**, which is precisely the shape of
+  the incident (`iterationsUsed: 0`). A resume carrying one re-enters the fix loop through the same
+  seam a fresh answer uses; the ask is never re-rendered. Two answers to one question are REFUSED
+  (`hitl-decision-red` naming what is held), never merged.
+- **F103 — a rerun buys its own clock** (`a6f62c9`). Two counters that never do each other's job:
+  CHAIN (`chainWallMs`/`chainSpentUsd`, `job-end.spentUsd`) is every leg added up and is what the
+  halt readout reports; ENGAGEMENT (`priorElapsedMs`, `job-end.engagementSpentUsd`) is what bounds
+  THIS leg. Money is deliberately not symmetric — the signed budget stays the CHAIN's ceiling,
+  because a refilled wallet is the failure F45 measured. W-2 is untouched where it was designed for:
+  an ordinary resume folds exactly as it always has, and so does an `accept`.
+- **F106 (HIGH, review) — the calibration gate now meets the one ceiling** (`0ae7693`). The run's
+  third and largest paid seam (up to 10 locate calls plus the 5-artifact battery, each under its own
+  retry ladder) ran with no bound while the scout and the declaration loop were both stopped by
+  `run-author --budget` — the advertised budget and the enforced budget were two different numbers.
+  `prepareSigning`/`calibrationGate` take `ceilingUsd` + `priorCalls`, a cost book absorbs prior
+  spend so the gate reads the REMAINING balance, `capStop` is asked before each paid call inside the
+  pipe (retries included), and a ceiling stop returns as an operator refusal naming money
+  (`cap-halt` / `pricing-red`) — never a casualty, and never a part-graded set presented as graded.
+- **A review door's rerun is a fresh engagement too** (`0ae7693`): `resolveHumanRuling` takes
+  `doorRerun` as a third input, OR'd and never merged, so *"is this leg a fresh engagement"* keeps
+  ONE spelling and a door-rerun leg cannot inherit the rejected leg's wall.
+- **`scripts/run-u.mjs` wires `judgeProvider`** (pinned to the judge model, never a step knob) — a
+  live soft-green run no longer instrument-stops at the judged stage.
+- **Two mutation-blind gaps in `src/kinds.js` covered by tests** (found by the same review).
+
+- **The medium whole-branch code review's five findings** (`e0c87d3`). An absent `job-end` in
+  `scripts/run-u.mjs` (a crash between the door record and `job-end`, or a legacy spine) no
+  longer launders into an exact complete `$0` that folds into the rerun ceiling — unknown is
+  reported unknown (F6), regression test watched failing first. One name per kind and per code:
+  the `'judged-floor'` literal at 7 sites becomes **`JUDGED_FLOOR_KIND`** (`src/kinds.js`,
+  exported) and the `'quarantined'` code at 3 sites becomes **`QUARANTINED_CODE`**
+  (`src/bridges.js` — deliberately not `reuse.js`, which would cycle reuse ↔ selection). One
+  `threeDoors()` builder replaces the copy-pasted door lines in `scripts/u-readout.mjs` (output
+  byte-identical against HEAD), and a `changedEvidence()` helper in `src/planrun.js` replaces
+  the duplicated evidence block and the double `verdictType` default, with `doorOpens`'
+  signature untouched. Two findings were ESCALATED rather than decided — the judge-model bump
+  with no detector, and the U runner's door promising to release credit it never minted — and
+  both are the `1A`/`2B` entries above.
+- **The tail review's six findings over `1A`+`2B`** (`493b2ce`). The door PREVIEW path now
+  checks row-EXISTS before promising a credit release, and its printed commands carry
+  `--registry`/`--workflow` forward — the `e01d0af` fix had landed at the end-of-run readout and
+  not at this sibling site, so the operator's next invocation would have rediscovered
+  `no-row-for-run` one hop later. The registry row records **`rounds` + `roundsComplete`**: a
+  resume leg writes a fresh spine and the halted leg's restart record declares money and wall
+  but never rounds, so on a resume that count is a FLOOR and now says so the way the money
+  beside it already does (F6). A NAMED `--registry` that attempted no row prints the reason
+  rather than staying silent. The two near-identical record builders in `src/reuse.js`
+  consolidate into `commitWrite`, and the duplicated `worker-round` scan is hoisted to one
+  spelling.
+- **The release gate's two findings** (`a5a4731`). `docs/UPSTREAM-ASKS.md`'s BA-21 carries a
+  dated CORRECTION note: the retracted 2.0–2.5× figure was a clipipe-surface number (F48 — a
+  provider-billed surface that never pools with `anthropic-api`), and the measured API-side
+  numbers are ~5.7% / 1.586×; the acceptance criteria are unaffected. In `src/judged.js`, two
+  literal NUL bytes inside composite-key template strings are spelled `\x00` — byte-identical
+  at runtime, but the literal made `grep`/`file` treat the source as binary (the documented git
+  binary-detector trap).
+
+### Docs (2026-08-23)
+
+- **`docs/FINDINGS.md`: F102 and F103 move from NOT FIXED / NOT BUILT to FIXED**, each cited to
+  the commit that did it — `a6f62c9` for both, plus `0ae7693` for F103's extension (the review
+  door's rerun as `resolveHumanRuling`'s third input, OR'd and never merged). **F106 is minted**
+  from the 3-lens review's HIGH: F45's class in a money coat with the direction reversed — the
+  ENFORCED number was the looser one, which is the failure that leaves a bill instead of a red
+  (`cce3ce5`).
+- **PRD Addendum v1.76** (this release): the three doors restated, the green-class review door
+  kept OPT-IN, rerun named as *not a replay*, the `1A`+`2B` escalations ruled, and the one
+  remaining door hole named and left deliberately.
+- **`bareloop.context.md`**: the judge-tier paragraph rewritten from DEFERRED to the live
+  detector it now describes.
+
 ## [0.11.0] — 2026-08-18
 
 ### Changed (2026-08-18 — the review door's third button)

package/README.md

@@ -48,8 +48,9 @@ finds in the real work, and fixed rules — not the judge — render the verdict
 
 ## You have the last word
 
-Every run ends at a **review door**: here is what changed, here is what every check said, here
-is what I'm asking you. **Accept** it, **rerun** it — what you type is the feedback the next
+Every judged run ends at a **review door** (a purely mechanical green finishes on its own —
+ask for the door with `--review-door`): here is what changed, here is what every check said,
+here is what I'm asking you. **Accept** it, **rerun** it — what you type is the feedback the next
 attempt works from, funded fresh — or **pause** it and decide another day. A pause costs
 nothing, keeps everything, and picks up from the start of the last step whenever you come back.
 Never come back, and it quietly expires on its own.