bareloop 0.21.0 → 0.23.0

package/CHANGELOG.md

@@ -5,6 +5,298 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.23.0] — 2026-09-09
+
+### Added
+
+- **`openai-api` on the provider menu, behind a provider FACTORY** (PRD item 28,
+  F149/F150/F156/F157). `src/providers.js` holds one table — provider name →
+  constructor, env key, tier models, per-model request-key gating — and both
+  runners go through it instead of naming `AnthropicProvider` directly. An
+  unknown provider name THROWS; there is no silent default. `openai-api` takes
+  an optional validated job-level `baseUrl` (https, or http on loopback only)
+  and admits ONE model, `deepseek-chat`, which earned the slot with a real paid
+  green through the shipped runner (run `mtu12vks`: green, $1.64 of $4, 10.3 of
+  30 min). DeepSeek silently ignores `max_completion_tokens`, so its table entry
+  sets bare-agent's `legacyMaxTokens` — an output cap that does not bind is a
+  money hazard. The judge stays PINNED to `anthropic-api` and `JUDGE_MODEL`
+  whatever the worker's provider is. `bareloop run` (the bundle runner) is
+  `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would have
+  needed, rather than building another provider with the wrong key.
+- **`provider` and `baseUrl` on the `job-start` spine record** (F157),
+  report-only. Without them an archive cannot separate anthropic rows from
+  `openai-api` rows, and every pooled cost or duration figure would be a
+  contaminated aggregate.
+- **`stopReason` on every `worker-round`** (BA-13, report-only, null when
+  absent, never invented).
+
+- **`runner-drained` — a `beforeExit` backstop for the absent-`job-end` class**
+  (PRD item 28's ruling (c); F140). A provider promise that never settles
+  (BA-25's class) used to let node drain and exit with NO terminal record at
+  all — no escalation, no outcome, no way to tell a silent drain from an
+  operator kill (F140: 10-of-235 archived spines with no `job-end`, one real
+  silent death). bare-agent 0.42 closed the known drop cases (F141), but the
+  class itself is "an instrument fires on absence," not a specific bug, so
+  the backstop stays needed. `runJob` (`src/run.js`) now registers ONE
+  `process.once('beforeExit', …)` right after `job-start`, tracked via a
+  local `ended` flag every `job-end` site sets; if the process still drains
+  with no `job-end`, it mints one with outcome `runner-drained`,
+  `spendComplete:false` (a drained run's in-flight spend is unknowable — the
+  floor already banked is honest, F6), and sets `process.exitCode` non-zero
+  (never `process.exit()`). The listener is removed in a `finally` so a
+  normal run never leaks it. `runner-drained` is a new terminal outcome,
+  documented in `bareloop.context.md`'s outcomes list — deliberately **not**
+  added to the resumable/checkpoint set (`CHECKPOINT_OUTCOMES`, `src/reuse.js`):
+  an unknown in-flight state is not a known-safe resume point.
+
+- **Bounded 429 retry — a FALLBACK, not the primary answer** (PRD item 28's
+  parked a/b ruling, hamr verbatim: "do a/b as a fallback, and verify/validate
+  + no regression"; F143). A vendor HTTP 429 used to end the whole run as
+  `provider-red`, discarding all completed work, even though the vendor's own
+  response states exactly how long to wait. `src/ratelimit.js` (new,
+  `transport.js`'s sibling) adds ONE bounded retry that honours that stated
+  delay, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS`) — a wait longer than that is
+  not honoured at all. Wired into `src/planrun.js`'s provider-retry seam
+  (`withTransportRetry` renamed `withProviderRetries`) as a SECOND,
+  independent one-shot budget alongside the existing F115 transport retry;
+  the wall always wins (no retry past the deadline); each retry emits a
+  report-only `rate-limit-retry` spine record and does NOT floor
+  `spendComplete` (a 429 is a refusal — nothing was billed — unlike a
+  transport throw). **The primary answer stays the primary answer**: picking
+  a worker model with adequate rate headroom (F139/F143's measured TPM
+  table) — this retry only softens the failure mode when that was not
+  followed or headroom was still exceeded.
+
+### Changed
+
+- Bumped `bare-agent` pin from `^0.39.0` to `^0.42.0`. 0.42.0 brings: BA-24 —
+  `OpenAIProvider` now sends `max_completion_tokens` by default (GPT-5-safe),
+  with a new `legacyMaxTokens` option to send the legacy `max_tokens` key
+  instead; BA-25 — a response body cut after headers (peer `'aborted'`,
+  stream `'error'`, or a premature `'close'` before `'end'`) now REJECTS
+  `generate()` with a retryable `ProviderError` (`context.bound:'transport'`)
+  instead of leaving the promise pending forever; a new `loop:truncated`
+  stream event plus `stopReason` on the `onLlmResult` metering payload; and
+  `options.toolChoice` on `OpenAIProvider`.
+
+### Fixed
+
+- **F154** — every provider call bareloop makes now carries a deadline. Seven
+  sites had none: the softgreen judge, the calibration gate, the authoring
+  scout's three rounds, the declaration/revise boundary, and the bridge picker.
+  A silent endpoint HANGS the process (an open socket is an active handle, so
+  the drain backstop cannot see it); a deadline is the only instrument that
+  fires on the absence of events. Tighten-only.
+- **F155** — the judged floor graded whatever LOCATE reported, so a silently
+  omitted function passed on the subset. `decide()` now diffs the artifact's own
+  top-level functions against the reported set and reds, naming what was
+  missing. The declaration shapes live ONCE (`FN_SHAPES`), from which both the
+  locate prompt's prose and the detector are derived.
+- **F153** — a provider's own error sentence now reaches the operator instead of
+  a bare status number, redacted through the one secret inventory and capped.
+- **F151** — the bounded 429 retry, added last release, fired on a real vendor
+  429 for the first time: it parsed the stated wait from prose, waited it, and
+  retried once. Mechanism proven; on a TPM-saturated model the retry is not
+  expected to recover, and did not.
+- **F147** — the F59 scout summary round (and the authoring scout's recovery
+  round, the same shape in `src/authorscout.js`) re-fed a transcript bare-agent
+  had already system-prepended into a new `Loop.run()`, which prepended the
+  persona AGAIN: two identical system messages at index 0/1. Real OpenAI
+  tolerates that; vLLM-class OpenAI-compatible backends reject it (HTTP 400
+  "System message must be at the beginning" — the Qwen death F146 left
+  unexplained). Both sites now strip the leading system message before
+  continuing, as bare-agent's own `Loop.chat()` does. Proven live: the captured
+  failing request goes 400 → 200 with one line removed; deepseek-chat then
+  greened a full job (F149/F150).
+- **F141** — `src/transport.js`'s `isTransportFailure` now also recognizes
+  bare-agent's own BA-25 transport classification
+  (`err.context.bound === 'transport'`), after the existing HTTP-status and
+  `retryable:false` guards. Before this fix, the exact class hamr's F115
+  one-retry ruling names — a call that dies mid-read, no full response —
+  would have ended provider-red with no retry once the 0.42.0 pin landed,
+  because the new rejection shape carried none of the signals the classifier
+  previously looked for (no `status`, `retryable:true`, no matching error
+  code/message). Retry budget unchanged: `TRANSPORT_RETRIES = 1`.
+- **Review door refuses `close-timing-red` instead of defaulting the close timeout**
+  (F137, `docs/product/CLOSE-INTEGRITY-BUILD.md` "Ruled 2026-09-07", found by
+  orchestrator review of M3, run `mtqwmb9l`). `scripts/run-u.mjs`'s `accept` door path
+  resolved the mechanical re-run's close timeout via `resolveCloseTimeoutMs` and, when
+  that timing pass itself timed out, silently fell through to `closeTimeoutMs:
+  undefined` — the library's 120s default — substituting an unauthorized ceiling for a
+  door decision, the exact second silent-default class M3 was built to remove one door
+  up. A door whose own timing pass times out now REFUSES outright as a named
+  `close-timing-red` door stop (same wording/options as the in-run escalation, new pure
+  renderer `doorTimingRedLines` in `scripts/u-readout.mjs`): `answerReviewDoor` is never
+  called, nothing is recorded (no door record), nothing is released, nothing is spent,
+  and the process exits non-zero.
+
+## [0.22.0] — 2026-09-07
+
+### Added
+
+- **Close integrity M1** (`docs/product/CLOSE-INTEGRITY-BUILD.md`, PRD item 27, F129/F131).
+  - `src/close-integrity.js`: the ONE `close-absolute-path` detector, shared by
+    `src/bundle.js` (export time) and a new $0 run-start precheck in `runPlan`
+    (`src/planrun.js`) — every job, not only exported bundles, now refuses at $0
+    (before the close-first precheck, before any provider call) when a close
+    script's CONTENT bakes in an absolute path that exists on disk. Exports
+    `readCloseScripts`, `checkCloseAbsolutePaths`, `absolutePathLiteralsOf` from
+    `src/index.js` — `readCloseScripts` is the pure reader M2's sha256 fingerprint
+    will reuse.
+  - `runJob`/`runPlan` gain an optional `resumable` flag (default `true`,
+    `run-u.mjs` unchanged); the bundle CLI (`src/cli.js`) passes `resumable: false`
+    so its escalation tail says "resume is `run-u`-only in v1" instead of naming a
+    `--resume` flag it does not implement (F130).
+
+- **Hermetic test runner** (F136, closed at the runner). `scripts/hermetic.mjs`
+  runs `node --test` with `HOME` redirected to a fresh empty `mkdtemp` dir and
+  `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM`/`GIT_CONFIG_NOSYSTEM` set to neutralise git
+  config, plus any inherited `GIT_AUTHOR_*`/`GIT_COMMITTER_*`/`EMAIL` deleted — the
+  local suite is now blind to this machine's identity the same way CI's runner already
+  is, so a test leaning on either fails here first. `npm test` now runs it in place of
+  a bare `node --test`; not a sandbox (PATH, `node_modules`, shelled-out binaries
+  untouched). See `docs/logs/FINDINGS.md` F136.
+
+### Fixed
+
+- **F129, remaining 8 close scripts**: `scripts/testgen-cold-check-close.mjs`,
+  `testgen-close.mjs`, `types-close.mjs`, `l2poc-check-close.mjs`,
+  `u-bareagent-close.mjs`, `u-bareguard-close.mjs`, `u-litectx-close.mjs`,
+  `u-baremobile-close.mjs` now read `WORKDIR = process.cwd()` instead of a
+  hardcoded absolute patient path, following `u-spawner-close.mjs`'s fix
+  (`3b987d4`). Behaviour-preserving: `run-u` always passes `cwd` = the patient.
+
+- **Close integrity M2 — close-bytes signature** (`docs/product/CLOSE-INTEGRITY-BUILD.md`,
+  PRD item 27, N4). A job's signature now covers its close scripts' CONTENT, not only
+  the path naming them.
+  - New signed spec field `close[].sha256`: hex sha256 of the script file's bytes, for
+    every stage whose `cmd` names an addressable script (an interpreter cmd —
+    `node`/`sh`/`bash`/`python`/`python3`/`npx` — or a bare directly-executable absolute
+    path, e.g. a `.sh` wrapper). It sits inside the signed spec, so `jobSpecHash` covers
+    it with no hash-function change. `validateJob` (`src/job.js`) demands it
+    (`missing-required`) on every addressable stage and shape-checks it
+    (`invalid-value`, 64 lowercase hex chars).
+  - `src/close-integrity.js` gains `hashCloseScriptBytes`, `checkCloseByteSignature`,
+    `checkStageByteSignature`, `signCloseScripts` (all exported from `src/index.js`).
+    `runPlan` verifies the signature at run start (alongside `close-absolute-path`, $0,
+    before the close-first precheck and before any provider call) AND before EVERY
+    close run thereafter (the `runCloseStages` seam the precheck/preflight/check-passes/
+    close-fix-loop all share) — a mismatch reds the new typed fault `close-tampered`
+    (`src/ralph.js`'s `CLOSE_FAULTS`), distinct from `close-red`/`close-crashed`.
+  - `src/bundle.js`'s `exportBundle` reds `close-sha-mismatch` when a spec's signed
+    sha256 disagrees with the script bytes actually being packed — the manifest hash
+    and the spec's own signature must never drift apart.
+  - `scripts/sign-close.mjs`: a thin CLI wrapper around `signCloseScripts` that fills
+    `close[].sha256` from disk and prints the old→new `jobSpecHash`; never writes
+    unless `--write`. The agent never writes this field — `src/authorjob.js`'s
+    `assembleSpec` refuses a draft carrying `sha256` the same way it refuses
+    `close`/`closeDecl`/`verdictType`.
+  - **Widened scope (orchestrator audit, folded into this build):** the addressable-script
+    shape test (`closeScriptCandidateToken`, `src/validate.js`) now also recognizes a
+    bare directly-executable absolute-path cmd (no interpreter prefix) — previously
+    invisible to BOTH `close-absolute-path` and this fingerprint. Every `jobs/*.json`
+    whose close names a script was re-signed with `scripts/sign-close.mjs --all --write`.
+
+- **Close integrity M3 — close timeout: autoset + signed override** (PRD item 27,
+  hamr 2026-09-06: "both … autoset and can be override, same like api pricing"; arbiter
+  constants set 2026-09-07: floor 120,000ms, K = 5).
+  - New `src/closetimeout.js`: `CLOSE_TIMEOUT_FLOOR_MS`, `CLOSE_TIMEOUT_K`,
+    `TIMING_PREFLIGHT_CEILING_MS`, `timeCloseStages`, `computeCloseTimeoutCeiling`,
+    `resolveCloseTimeoutMs`, `closeTimeoutBanner` (all exported from `src/index.js`). A
+    $0 timing preflight runs every close stage once, ignoring verdicts, before the
+    close-first precheck and before any provider call; the per-stage ceiling every close
+    call in the run then uses is `max(FLOOR, K × slowest measured stage)`, printed on
+    every run (`close timeout: <n>s per stage (estimated from seed timing: …)`).
+  - New OPTIONAL signed spec field `closeTimeoutMs` (`>= CLOSE_TIMEOUT_FLOOR_MS`,
+    `src/job.js`): the operator's own override, which wins outright over the estimate and
+    may legally sit above OR below it (the rates-passthrough shape, F113 — not
+    tighten-only). Skipped when set: the timing pass never runs. Arbiter territory —
+    `src/authorjob.js`'s `assembleSpec` refuses a draft carrying it.
+  - New `runPlan` run-start check `wall-under-close-timeout`: refuses at $0 when
+    `job.maxWallMs` is under the just-resolved EFFECTIVE close timeout — the honest shape
+    once the real (autoset or signed) ceiling is known, never a silent clamp.
+  - `scripts/run-u.mjs`'s hardcoded `CLOSE_TIMEOUT_MS = 900_000` retires; the per-stage
+    ceiling is resolved once (via the same `resolveCloseTimeoutMs`) before the outside
+    watchdog (F67) is even spawned, so its stale/grace windows size off the real number.
+    `src/cli.js`'s bundle runner passes nothing — both runners now go through the
+    identical autoset/override path.
+  - **Part B — `BARELOOP_CLOSE_DIR`.** `runClose` (`src/ralph.js`) accepts an optional
+    `closeDir` and sets it as `BARELOOP_CLOSE_DIR` in the close's (already-stripped) env —
+    a `BARELOOP_` name matches none of `CLOSE_ENV_DENY`'s rules. New
+    `checkCloseDirRequired`/`CLOSE_DIR_ENV_VAR` (`src/close-integrity.js`): a close script
+    whose source mentions the variable and gets no `closeDir` refuses at $0
+    (`close-dir-required`), the same seam as `close-absolute-path`/`close-tampered`. The
+    four hand-authored scripts that hardcoded an external `SPINE_DIR`
+    (`testgen-cold-check-close.mjs`, `testgen-close.mjs`, `l2poc-check-close.mjs`,
+    `types-close.mjs`) now read `process.env.BARELOOP_CLOSE_DIR` and instrument-stop
+    (exit 97) when it is absent — no baked fallback. `scripts/u-pulselog-close.mjs`'s
+    hardcoded `--workdir` DEFAULT (a separate F129 cwd-class hazard — that literal existed
+    on disk and already tripped the shipped `close-absolute-path` guard for
+    `jobs/pulselog-u-types.json`) now falls back to `process.cwd()`, the same M1 template
+    every other close script uses. `src/cli.js` sets `closeDir` to
+    `<bundleDir>/runs/<runid>/close/`; `scripts/run-u.mjs` sets it to its existing
+    `spineDir`. Every `jobs/*.json` whose close bytes changed was re-signed
+    (`scripts/sign-close.mjs --all --write`).
+
+- **F132 — a real paid fire of an exported bundle refused itself `close-tampered`
+  at $0** (run `mtqwmb9l` → export → `mtqwydl4`). `exportBundle`'s import rewrite
+  (`../src/x.js` → `'bareloop'`) changes a close script's bytes, but the written
+  bundle's `spec.json` kept the SOURCE spec's `close[].sha256` unchanged — two
+  signatures over two different byte strings, so the run-start
+  `checkCloseByteSignature` correctly refused a bundle that was never actually
+  tampered with. `exportBundle` (`src/bundle.js`) now re-signs `close[].sha256`
+  in the written spec over the RELOCATED bytes it actually packs, for every
+  stage that already carries a signature — the export-time `close-sha-mismatch`
+  check against the SOURCE spec/bytes is unchanged (it still guards a tampered
+  source).
+
+- **F133 — double/mislabelled close-timeout banner** (run `mtqwmb9l`). `runPlan`
+  printed/emitted "estimated from seed timing" (`scripts/run-u.mjs`'s own
+  resolution, needed early to size the outside watchdog, F67) AND, on the same
+  run, "explicit runner override" (the library's own print, because run-u also
+  fed the resolved number back in as a bare `closeTimeoutMs`) — two lines for
+  one number, the second lying about its source. `scripts/run-u.mjs` no longer
+  passes `closeTimeoutMs` into `runJob` at all; `runJob`/`runPlan` resolve
+  (autoset, or the spec's own signed field) and announce the ceiling themselves
+  — the ONE banner/spine record per run. The runtime `closeTimeoutMs` option on
+  `runJob`/`runPlan` stays, test/backward-compat only. Same fire, second (real)
+  catch: run-u's own pre-fix early `emit('close-timing', …)` landed BEFORE
+  `job-start` on the spine (`runJob` is what emits `job-start`, and run-u called
+  it before ever calling `runJob`) — every spine reader assumes `job-start`
+  opens the file. Fixed by the same change (run-u no longer emits it early);
+  `tests/readshim-battery.test.js`'s archive check now tolerates `job-start`
+  within the first 3 records (the archived `u-mtqwmb9l.jsonl` is real and never
+  rewritten), and a new test pins `job-start` as literally the first record on
+  a fresh scripted run.
+
+- **F135 — review-door accept re-run bypassed the close byte signature**. Every
+  other close execution goes through `checkStageByteSignature` before running
+  a stage (`runCloseStages`, `src/planrun.js`); the review door's `accept`
+  re-proof (`proveMechanically`, `src/reviewdoor.js`) called
+  `runStages`/`runDeclaredStages` directly and skipped it — a close script
+  swapped on disk after the run ended but before the signer's accept ran
+  unchecked and could mint a false accept. Fixed: `proveMechanically` now
+  verifies the mechanical stages' bytes against their signed `sha256` first,
+  refusing through the existing `door-accept-red` path on a mismatch
+  (`tests/reviewdoor-tamper.test.js`).
+
+- **F134 — live re-fire validation, no code change**. Two real paid fires of the
+  same exported bundle (`mtr0icky` cap-halt, `mtr4t1u1` green re-fire) confirmed
+  M2's relocated-bytes signature and M3's close-timing banner both hold under a
+  second real fire, not just the one that motivated each fix; the cap-halt
+  itself read as a cap-shaped negative (an `Any`-suppression cheat correctly
+  caught by `no-suppressions`, not an instrument defect). See
+  `docs/logs/FINDINGS.md` F134.
+
+- **F136 — CI-only red: patient test fixtures committed without the neutralised
+  git identity**. `tests/close-integrity.test.js` and `tests/close-timeout.test.js`
+  each added a second commit on top of `initPatientRepo`'s seed via a raw
+  `execFileSync('git', ...)` with no env, so it depended on the host's own git
+  identity — green on hamr's machine (a global config papers over it), red on
+  CI (none). `tests/helpers.js` now exports `patientGitEnv`/`gitInPatient`
+  reusing `initPatientRepo`'s identity env; both files' `makePatient` go through
+  it. See `docs/logs/FINDINGS.md` F136.
+
 ## [0.21.0] — 2026-09-06
 
 ### Added

package/README.md

@@ -82,7 +82,7 @@ A signed job spec goes in. A verdict comes out.
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1',