bareloop 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -7,6 +7,224 @@ feature lands, **patch** = docs, fixes, scaffolding.
 
 ## [Unreleased]
 
+## [0.16.0] — 2026-08-30
+
+### Added
+
+- **`PROMPT_COMMIT_RANGE` covers every commit of a direct push (PRD #2b, #8)**:
+  `scripts/prompt-commit-check.mjs` now honours an env var of that name (`--range` mode
+  only — a commit-msg hook's `--message-file` path is never redirected by a stray env
+  var), which supersedes `--range` and needs no `HEAD~1` fallback of its own.
+  `.github/workflows/ci.yml`'s `npm test` step sets it to `github.event.before..sha` on
+  push events, so a linear multi-commit direct push to `main` is inspected whole instead
+  of the local `HEAD~1..HEAD` fallback re-covering only the last commit. An unresolvable
+  env range (a 40-zero `github.event.before` on a brand-new branch push) is reported and
+  falls back to the `--range` arg's own path, including its existing main-push fallback.
+  Same option-shaped-value guard as `--range` (a value starting with `-` is refused before
+  it reaches `git`). Premise measured on `origin/main`'s own reflog (two 3-commit linear
+  pushes on 2026-08-24, one carrying a prompt-register change the `HEAD~1` fallback would
+  have skipped); 3 new CLI tests, each proven failing before the fix. **CI-proven
+  2026-08-30**: a branch-birth push (40-zero `before`) fell back and checked 5 commits
+  (CI run 33314883771); the next push used the real range `7e975b3..f0c3199` and checked
+  exactly 1 (run 33314899690).
+- **Green-class runs mint a registry row, born released** (PRD open item #16,
+  `src/reuse.js`'s `writeRunGreenRow`): the fourth refusal (`credit-not-held`) is dropped —
+  a mechanical `green` run now mints its registry row at run end exactly like `soft-green`
+  does, but unheld: `greenParts` already keys the hold on `quarantinesCredit(verdictType)`
+  (`src/bridges.js:372`), so no bridge/door code changed. `door accept` on an unheld green
+  row records the disposition and releases nothing — it no longer dies `no-row-for-run`;
+  that terminal is reserved for a run that truly earned no row. `scripts/run-u.mjs`'s
+  registry line now prints `HELD`/`RELEASED` by class instead of `HELD` unconditionally,
+  and its door credit readout distinguishes a genuine release from a repeat `accept` on an
+  already-released row (`recordDoor` returns `released: false` on a same-decision repeat —
+  the wording now branches on `quarantinesCredit(spec.verdictType)` rather than claiming a
+  fresh release every time). 4 new/updated tests (2 proven failing before the fix),
+  including a soft-green regression guard (still born `HELD`) and the still-refusing
+  no-row-for-run case.
+
+### Changed
+
+- **`bareloop.context.md` leads with the shipped design** (PRD #14): the header states the
+  v0.15.0 contract first — `green` + `soft-green`, the judged floor and calibration gate,
+  the review door (`accept`/`rerun`/`pause`) that never changes the loop's own verdict —
+  and demotes `hitl` to a LEGACY block: still admitted in code (`VERDICT_TYPES`,
+  `human-confirms`, `hitl-pause`/`hitl-decision-red`), retired by design (PRD v1.71),
+  removal a future breaking change. Six inner passages that still called `soft-green`
+  "locked" or `hitl` "the forward path" now state the shipped fact.
+- **The authorjob no-repo refusal message** (`src/authorjob.js`) no longer says a judged or
+  human close is "declared-but-locked" — `LOCKED_CLASSES` has been empty since v0.12.0; it
+  now says what is true: this authoring flow drafts code-genre closes against a git seed
+  only.
+- **4 `jobs/*.json` description paths repointed, docs reorg** (PRD #13): the two preregs
+  living under `docs/logs/` (`TESTGEN-PREREG.md`, `REUSE-LIFT-CONTRAST-PREREG.md`) moved to
+  `docs/product/` beside the other eight; `docs/index.md`, the one live `FINDINGS.md` link
+  and `scripts/gen-mutants-testgen.mjs`'s prereg string follow. The four job descriptions
+  that still cited the pre-reorg `docs/02-experiments/*-PREREG.md` path now cite the real
+  files — each job's signed hash flips and re-signs at its next run. `docs/archive/` and
+  CHANGELOG history left as written.
+
+### Fixed
+
+- **`--range`-only CLI tests no longer leak an ambient `PROMPT_COMMIT_RANGE`**: the six
+  tests exercising `--range` in isolation now pass `PROMPT_COMMIT_RANGE: ''` explicitly, so
+  a resolvable ambient value (as CI's own `npm test` step now sets on every push) can never
+  silently route them onto the env-range path they don't exist to prove.
+
+### Ruled (no code change)
+
+- **Accept's re-proof wall governance** (PRD #15, hamr, 2026-08-30): the door-accept
+  re-proof runs unclocked, on the condition it stays mechanical
+  (`mechanicalStages()` only, `src/reviewdoor.js:213`) — never a judged floor, never a
+  person. A check is never bounded (W-2); any future non-mechanical re-proof is a new
+  arbiter question.
+- **`hitl` cleanup deferred** (PRD #21, hamr, 2026-08-30): `hitl` stays admitted in code
+  (retired by design only) until hamr decides between finishing the retirement (delete the
+  class, the stage kind, the two terminals, migrate any job using it — a breaking rung with
+  its own release) or keeping it reopenable. Unscheduled either way.
+
+## [0.15.0] — 2026-08-27
+
+### Added
+
+- **Generic run replay** (PRD build-list #6): `replayRun`/`formatReplay` (`src/replay.js`)
+  reconstruct one run's whole story from its spine JSONL + gate-audit sidecar. The single-run
+  report is a signed layout (hamr, 2026-08-25): a header block (`goal:`/`shape:`/`signed:`/
+  `branch:`/`outcome:`/`spent:`, absent fields printing the literal `none recorded`, never
+  blank or a fabricated `0`), a `TIMELINE (steps)` or `TIMELINE (iterations — loop-shape run)`
+  section with its own column-header row and per-row time/cost (wall, `$` — a `null` `costUsd`
+  anywhere in a row's window makes that row's spend `unknown (N unpriced rounds)`, never `0` or
+  a partial sum stamped exact) and a `↳ tripped:`/`↳ close:` line under any row an escalation or
+  close fell inside, a `CLOSE` section (never omitted — `none — the run ended before any close
+  ran` when nothing ever closed; picks the run's REAL final close by seq, never by record type —
+  an early `outer-close` precheck reading red must not shadow a LATER fix-loop close-verdict that
+  went satisfied), `ENDING` (last record + 3 before it, plus an out-of-window escalation), the
+  `BEHAVIOUR` block, and a `MEMORY-CACHE` line always printed (`not armed on this run` when
+  absent — absence is never silent). Stop reason is `category — decision — detail` off the last
+  escalation, so a run's actual failure text (a TLS "bad record mac", a specific mypy error)
+  rides onto the report instead of just the generic per-category decision prose. A step id that
+  recurs after a replan is split per OCCURRENCE, never merged into one pooled row. `--all <dir>`
+  is name-agnostic (a spine is identified by a `job-start`/`run-start` record in its content,
+  never a filename convention) and prints a fixed-column, ALIGNED table (never CSV) — `id job
+  shape outcome spend wall steps reason`, `reason` built from `detail` only (never `decision`,
+  cut at 60 chars) — flagging any non-spine `.jsonl` as `<name> not-a-spine` rather than dropping
+  it. A RESUMED run's `job-end.spentUsd` is a CHAIN total (prior legs folded in) that can never
+  equal this one file's own rounds (measured: `u-msf70nei` header `$5.3389` vs its own 55 rounds
+  summing to `$1.2127`) — the header now prints both, each labelled, plus a `resumed:` line
+  (keyed on `job-start.priorSpentUsd`, never on the narrower `resume-seed` record alone — 4 real
+  archived runs carry a real fold with no resume-seed record at all). A non-resumed run's own
+  spend disagreeing with its summed rounds is a genuine finding and prints as a `MISMATCH`, never
+  hidden (measured: 0 of the archive's non-resumed runs trip it). `--all` marks a resumed row
+  with a trailing `*` and one footnote line when the listing holds any. Reuses `runBehaviour`/the
+  `memory-cache` readout rather than reimplementing either. Reads only, mints no verdict, writes
+  nothing to the spine. `job-start` (`src/run.js`) now also carries `verdictType` (the spec's
+  required verdict class) and `model` (when the shell-owned provider binding itself carries one)
+  — PRD TODO #20, blessed verbatim by hamr the same day. The header prints `class:`/`model:`
+  right after `shape:` (`not recorded (pre-F117 spine)` / `not recorded` on an older archive or
+  a provider with no `.model`), and `--all` gains `class`/`model` columns (`model` kept FULL,
+  never truncated).
+- **Prompt-commit shape — a check, not convention** (PRD build-list #5, TODO #8, Q9 answered
+  by hamr 2026-08-25): a commit that changes a prompt register (a model-facing
+  system/strategy/instruction string a worker or judge reads) must now say, in its own
+  message, three labelled things — `Failure:` what caused the change, `Addresses:` what it
+  addresses, `Corrects:` what it corrects. `src/promptregisters.js` (`PROMPT_REGISTERS`,
+  `isPromptFile`, both exported from `bareloop`'s root) is the ONE inventory: 7 files carry
+  real prompt content (`src/authorscout.js`, `src/authorflow.js`, `src/judged.js`,
+  `src/cardauthor.js`, `src/readshim.js`, `src/tools.js`, `src/planrun.js`) — more than double
+  the 8 named consts a first grep found, once module-private consts and inline
+  template-literal prompt builders (`scoutPrompt()`, `cardCasesPrompt()`, `locatePrompt()`,
+  `strategyFor()`) are counted; the check is file-scoped precisely because a const-scoped one
+  would have silently missed those. Enforcement is LOCAL ONLY — wired into `npm test`
+  (`scripts/prompt-commit-check.mjs --range origin/main..HEAD`), never into any
+  `.github/workflows/*` file (ask-first, untouched); an unresolvable range (no `origin`, no
+  fetch) is a printed SKIP at exit 0, never a violation. Pure decision logic lives in
+  `scripts/promptcommitlib.mjs`, neither of which ships (`scripts/` is outside
+  `package.json`'s `files`). hamr's same-day addition: the `Failure:` line must also cite
+  the RUN that caused the change (`run <id>` / `run u-<id>`, `\brun\s+(u-)?[a-z0-9]{6,12}\b`
+  — alphabet/length measured against 231 real archived spine ids, every one exactly 8
+  lowercase-alnum chars), failing with a distinct message
+  (`FAILURE_NEEDS_RUN_REF`) when absent; format only, never checked against a real spine
+  file.
+- **Run→code stamp** (F118, the parked half of the same day's prompt-commit build, closed
+  same day on hamr's go): the prompt-commit check closes commit→run; this closes run→code.
+  `src/codeversion.js`'s `codeVersion()` is a pure, $0, no-shell reader — `version` from
+  bareloop's own `package.json`, `sha` from `.git/HEAD` (loose ref, falling back to
+  `packed-refs`) ONLY when a `.git` directory exists at the package root (a dev checkout;
+  an npm install has none), `dirty` always `null` (uncommitted-changes state cannot be
+  known without a shell — reported as unknown, never faked as `false`). `job-start`
+  (`src/run.js`) now also carries `code: {version, sha}`. `replayRun`/`formatReplay`
+  (`src/replay.js`) read it: a `code:` line right after `model:` — `bareloop 0.14.0 @
+  43f2812` / `@ sha unknown` / `not recorded (pre-F118 spine)`; no new `--all` column
+  (hamr's index is already full). The library never grows a shell seam to answer this —
+  `run` stays the one locked verb.
+- **Replay surfaces transport retries and floor reasons** (F119, live-proven the same day
+  a real run — `u-mt8yk53k` — fired the retry seam twice): `replayRun`/`formatReplay`
+  window `transport-retry` records into the step/iteration occurrence they fell inside
+  (same `seq` windowing as `worker-round`), printing `↳ transport retry ×N (recovered|not
+  recovered|partially recovered) — <error>` under that row; a retry outside every window
+  prints as `transport retries outside steps: N` under the `TIMELINE` header instead. The
+  header's `spent:` line, whenever `spendComplete:false`, now appends `· floor because:
+  <reason(s)>` — derived from the spine, never guessed: `transport retry ×N`, `unpriced
+  round(s)`, `cut mid-call`, `stall`, `prior leg floor`, every cause that shows real
+  evidence, or `floor (reason not in spine)` when none can be derived. `--all` adds no
+  column: a run carrying any retry gets ` ⟲N` appended to its outcome word (same posture
+  as the resumed `*`), with one footnote when the listing holds any. Report-only — reads
+  existing `transport-retry`/`wall-halt`/`stall`/`job-start` records, writes nothing.
+
+### Fixed
+
+- **Leaked tmp dirs from `npm test`** (same class that filled `/tmp` tmpfs on 2026-08-25 and
+  blocked a build): `tests/codeversion.test.js`'s real-worktree test tracked only the `wt`
+  subdirectory passed to `git worktree remove`, never the `mkdtemp`-created parent, so every run
+  left an empty `codeversion-worktree-*` dir behind; its `after()` now also prunes stale worktree
+  metadata when `remove` fails and `rmSync`s the tracked dir unconditionally, plus the mkdtemp
+  parent is now itself tracked and removed. `tests/ralph.test.js`'s cwd-threading test created a
+  `ralph-cwd-*` repo with no cleanup at all, and its cwd-relative-close test likewise leaked a
+  `close-cwd-*` and a `close-cwd-other-*` dir per run; added a per-test `after(() => rmSync(...))`
+  for each, matching the file's existing top-level cleanup pattern.
+- **`codeversion.test.js` false-red on PR checkouts** (F118 addendum): the HEAD-sha test's own
+  precondition assumed a symbolic ref, but `actions/checkout` leaves a PR checkout's HEAD
+  DETACHED at the merge commit, so the precondition threw before the module under test ever
+  ran — `src/codeversion.js` itself already handled the detached case correctly. Test-only fix:
+  the precondition now resolves a bare 40-hex `.git/HEAD` the same way `codeVersion()` does, plus
+  a new deterministic fake-package-root test that exercises the detached case without depending
+  on the checkout's own HEAD state.
+- **Review of PR #23 (2026-08-26), 7 items fixed**: (1) `replayRun`'s spend totals
+  (`src/replay.js`) counted only `worker-round`, silently dropping a close's own `judge-round`
+  spend and native `worker-turn` attribution out of every total — now filters on the canonical
+  `SPEND_RECORD_TYPES` (newly exported from `src/ledger.js`), including the per-step window,
+  which no longer requires a `.phase` match for records (like `judge-round`) that never carry
+  one. (2) `scripts/promptcommitlib.mjs`'s run-reference regex accepted plain prose ("run
+  failed" satisfied its `{6,12}` margin outright) — tightened to the measured exact shape
+  (`{8}`); a proposed additional per-id digit requirement was investigated and REJECTED (23 of
+  130 re-sampled real archived ids carry no digit, `msdsmkid` among them). (3)
+  `src/codeversion.js` read `sha: null` inside any real git worktree (`.git` there is a FILE,
+  `gitdir: <path>`, not a directory) — now resolves the pointer file and the worktree's
+  `commondir` to find HEAD/refs correctly. (4) `replayRun`'s `resumed` flag missed a genuine
+  $0-floor resume (`priorSpentUsd: 0` is still a real fold per `src/run.js:328`'s own doctrine)
+  — now keys on the field's presence, not `> 0`. (5) `scripts/run-replay.mjs --all` opened
+  every run's gate-audit sidecar despite never using the fields it feeds — no longer opens it
+  in `--all` mode (`--all` output on `aurora-u-bareloop` confirmed byte-identical before/after).
+  (6) the steps/iterations windowing logic in `replayRun` was duplicated inline twice — extracted
+  into one shared `buildOccurrenceMetrics` helper (replay output on `u-msdsmkid`, `u-msf70nei`,
+  `u-mt8yk53k` confirmed byte-identical before/after). (7) `npm test`'s prompt-commit check
+  (`origin/main..HEAD`) inspects NOTHING after a direct push to main, because the push itself
+  advances `origin/main` to match `HEAD` — `scripts/prompt-commit-check.mjs` now falls back to
+  `HEAD~1..HEAD` on that exact condition and prints that it did; a multi-commit direct push
+  still only re-covers the last commit (needs `github.event.before`, a `.github/` edit — out of
+  scope here, ask-first).
+- **Release-gate findings (2026-08-27)**: `scripts/prompt-commit-check.mjs`'s `--range` value
+  was passed to `git rev-list` positionally with no way to disambiguate it from an option — an
+  option-shaped value (e.g. `--output=<path>`) was parsed by git as its own flag (verified: a
+  `--` separator does NOT fix `rev-list`, unlike `show`/`diff-tree`, since it treats everything
+  after it as a path filter, not a revision range); the script now rejects any `--range` value
+  starting with `-` up front, before any git call runs. Also corrected the fallback's printed
+  limitation and code comment: on a MERGE commit, `HEAD~1` is the first parent, so
+  `HEAD~1..HEAD` covers the merge PLUS every commit unique to the merged branch (measured on
+  this repo's own `4904d76`: 10 commits, not 1) — the prior wording ("only re-covers the last
+  commit") was only accurate for a LINEAR multi-commit push, which is now stated explicitly.
+  (`src/replay.js`'s phase-less step-window filter was also reviewed and confirmed correct by a
+  new adversarial synthetic test — no code change there.)
+
 ## [0.14.0] — 2026-08-25
 
 ### Added