bareloop 0.21.0 → 0.23.0

package/bareloop.context.md

@@ -70,6 +70,19 @@ inherited rule carries the green that minted it and the contrast that attributed
   with `anthropic-api` on cost, and budgets don't transfer between them.
   `job.provider === 'clipipe-subscription'` with no `nativeProvider` supplied is
   `interpreter-red`, never a silent fall-back to the metered API (`src/planrun.js:1073`).
+  `provider: 'openai-api'` (PRD item 28) takes the ordinary `Loop` path against an
+  OpenAI-shaped endpoint, reads `OPENAI_API_KEY`, and accepts an optional job-level
+  `baseUrl` (https, or http on loopback only; credentials in the URL are a red). Its one
+  admitted model is `deepseek-chat`, which earned the slot with a real paid green — no
+  endpoint or model enters the menu without its own clean paid probe. The provider table
+  lives in `src/providers.js` (`resolveProvider`/`makeProvider`/`buildRunnerProviders`);
+  an unknown provider name THROWS there, it never falls back to a default. Per-model
+  request-key gating lives in that table: `deepseek-chat` sets bare-agent's
+  `legacyMaxTokens`, because DeepSeek silently ignores `max_completion_tokens` and an
+  output cap that does not bind is a money hazard. The JUDGE stays pinned to
+  `anthropic-api` and `JUDGE_MODEL` whatever the worker's provider is. The bundle runner
+  (`bareloop run`) is `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would
+  have needed, rather than constructing another provider with the wrong key.
 - **Reuse — where a workflow comes from:** a plain `runJob` always drafts cold. Passing
   `bridge` starts from one standalone bridge file (`src/reuse.js`'s envelope, `## The reuse
   ENVELOPE and runReuse` below). The CLI's `--registry <dir>` / library-level `registryDir`
@@ -85,7 +98,7 @@ inherited rule carries the green that minted it and the contrast that attributed
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1', job: 'my-maintainer',
@@ -130,11 +143,12 @@ minting claim, or the shell-owned retry cap — all unknown-field reds.
 |---|---|---|
 | `job` | kebab-case slug | |
 | `description` | non-empty string | |
-| `provider` | `anthropic-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
+| `provider` | `anthropic-api` \| `openai-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-chat` today — see "Worker surface" above for its `baseUrl` field and per-model gating; `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
 | `conditions` | `{ providerPath?, closeVerbosity?, taskFraming?, scaffold? }` | declared keys only, string values — the environment label (consumed by the N3 lineage key; recorded on spines from run one) |
 | `cadence` | `{ unit: hour\|day\|week, every: 1..30 }` | validated now, consumed at N5 (Scheduler) |
 | `budgetUsd` | `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
-| `maxWallMs` | optional integer ms `>= MIN_WALL_MS` (one close timeout) | the run's wall clock. **NO DEFAULT, by ruling** — absent means time-unbounded *by explicit operator choice*, never by fallback (F45: a defaulted cap is a silent second ceiling). Enforcement is a BETWEEN-ROUND deadline, so the honest worst case is `maxWallMs + closeStages × closeTimeoutMs` — every stage of a staged close gets the FULL timeout — and all three numbers are reported (`loop.stop()` cannot cut an in-flight call — F61 measured 500ms→4,018ms). The `MIN_WALL_MS` floor is a ONE-stage number, so a spec with many stages can validate while its overshoot dwarfs its cap: the clock reports that honestly rather than the floor pretending to prevent it (stage-aware floor parked, PRD v1.39). Operator-only, tighten-only; adding or changing it changes the spec hash |
+| `maxWallMs` | optional integer ms `>= MIN_WALL_MS` (one close timeout) | the run's wall clock. **NO DEFAULT, by ruling** — absent means time-unbounded *by explicit operator choice*, never by fallback (F45: a defaulted cap is a silent second ceiling). Enforcement is a BETWEEN-ROUND deadline, so the honest worst case is `maxWallMs + closeStages × closeTimeoutMs` — every stage of a staged close gets the FULL timeout — and all three numbers are reported (`loop.stop()` cannot cut an in-flight call — F61 measured 500ms→4,018ms). The `MIN_WALL_MS` floor is a ONE-stage, un-autoset-default number, so a spec with many stages OR a raised/autoset `closeTimeoutMs` can validate while its overshoot dwarfs its cap: `runPlan` adds a RUN-START check (PRD item 27/M3) that refuses `wall-under-close-timeout` at $0 once the EFFECTIVE per-stage ceiling is known (autoset or signed), rather than a silent clamp. Operator-only, tighten-only; adding or changing it changes the spec hash |
+| `closeTimeoutMs` | optional integer ms `>= CLOSE_TIMEOUT_FLOOR_MS` (120,000 — hamr's arbiter floor, 2026-09-07) | PRD item 27/M3's SIGNED override for the close's own per-stage wall-clock cap. Absent (the normal case): the run autosets it from a $0 seed timing pass — `max(FLOOR, K × slowest measured stage)`, `K = 5` (hamr, 2026-09-07: "2 and 5 are fine"). Present: the operator's own number wins outright and may legally sit ABOVE *or below* the autoset estimate (the rates-passthrough shape, F113 — never tighten-only). Arbiter territory exactly like `budgetUsd`/`maxWallMs`/`close[].sha256`: the authoring pipeline's `assembleSpec` refuses a draft carrying it |
 | `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the judge model stays library-pinned (`JUDGE_MODEL`) pending recalibration |
 | `writeScope` | array of contained globs | the operator's outer fence; the plan's own scopes must fit inside it, same containment code |
 | `steps` | RETIRED | operator-authored `steps[]` was deleted (PRD v1.32); a spec carrying it reds `shape-retired:steps` by name rather than half-running |
@@ -391,7 +405,7 @@ Append-only JSONL event emitter bound to one file. `seq` monotonic per spine, `t
 last. Consumers are pure listeners; nothing reads the file back. Returns each event as
 written.
 
-### `ralph({ middle, close?, judge?, capRuns?, ladder?, emit, redact?, closeTimeoutMs?, cwd?, expect?, judged?, gapKeep?, workerWrites? })` → `'green' | 'escalated'` — `src/ralph.js`
+### `ralph({ middle, close?, judge?, capRuns?, ladder?, emit, redact?, closeTimeoutMs?, cwd?, expect?, judged?, gapKeep?, workerWrites?, closeDir? })` → `'green' | 'escalated'` — `src/ralph.js`
 
 The dumb outer shell: `while close-red and not exhausted: run the middle`. **Exhaustion has
 two alternative rules and you supply exactly one** — `capRuns` (a fixed number of middle runs)
@@ -422,11 +436,23 @@ set the close's `gapKeep` (job-spec, arbiter territory) to a regex like `"^not o
 matching failure lines are preserved in a capped kept-failures block regardless of where
 they print (F28: the first real firing delivered a gap with zero failure names). The gap
 also combines stdout+stderr, so a stdout failure survives stderr noise.
-`closeTimeoutMs` caps the close's wall clock (default 120s) — shell/operator
-territory, inexpressible in any config. A faulted close is asked to leave with SIGTERM and,
-if it is still there 2s later, ended with SIGKILL: SIGTERM is a request a close can decline
-(its own handler, a trapping wrapper), and without a second deadline the wait never resolves.
-The verdict is untouched — the FIRST fault named the outcome and the kill only enforces it.
+`closeTimeoutMs` caps the close's wall clock (default 120s when nothing else supplies a
+value — `runClose`'s own bare default) — shell/operator territory, inexpressible in any
+config. A faulted close is asked to leave with SIGTERM and, if it is still there 2s later,
+ended with SIGKILL: SIGTERM is a request a close can decline (its own handler, a trapping
+wrapper), and without a second deadline the wait never resolves. The verdict is untouched —
+the FIRST fault named the outcome and the kill only enforces it. **As of PRD item 27/M3, a
+direct `ralph`/`runClose`/`runStages` caller still owns this number outright (`closeTimeoutMs
+?? 120_000`); the AUTOSET/override resolution lives one level up, in `runPlan`/`runJob`
+(see `resolveCloseTimeoutMs` below) — `ralph` itself never runs a timing pass.**
+
+`closeDir` (PRD item 27/M3 Part B, optional) is the close's own BOOKS DIRECTORY — pristine
+copies, calibration thresholds, logs — deliberately outside the patient tree (the worker
+must never read the arbiter's books, v1.12). Forwarded to every close invocation as the
+env var `BARELOOP_CLOSE_DIR` (set on a COPY of `process.env`, after `CLOSE_ENV_DENY`
+stripping — a `BARELOOP_` name matches none of that denylist's rules and is never stripped).
+A close script that reads this variable and gets none must instrument-stop itself; nothing
+in the runner invents a fallback directory.
 
 **The close child's environment is stripped of credential-shaped variables before it runs**
 (`CLOSE_ENV_DENY` in `src/ralph.js`: provider keys, `AWS_*`, any name ending
@@ -958,13 +984,33 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, readShim?, scout?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
+
+**`closeTimeoutMs` (PRD item 27/M3) is now OPTIONAL for every real caller.** Omit it (both
+`src/cli.js`'s bundle runner and `scripts/run-u.mjs` do) and the run AUTOSETS the per-stage
+close ceiling from a $0 seed timing pass, or reads the job spec's own signed override —
+"guesstimate + loud sign + customer override", the same shape rates-passthrough already
+uses (F113). Passing an explicit value here still wins outright over both (kept for
+backward compatibility and test control) — see `resolveCloseTimeoutMs` further down.
+
+**`closeDir` (PRD item 27/M3 Part B, optional but effectively required for any
+hand-authored close that reads its own books)** — the close's own directory (pristine
+copies, calibration thresholds, logs), outside the patient tree. `src/cli.js` sets it to
+`<bundleDir>/runs/<runid>/close/`; `scripts/run-u.mjs` sets it to its existing `spineDir`. A
+close script whose source mentions `BARELOOP_CLOSE_DIR` and gets none here refuses the run
+at $0 (`close-dir-required`, before any provider call) — see `checkCloseDirRequired` below.
 
 The last seven are the RESUME fold and are documented under *Resuming a killed run* below; they
 default to `0` / `true` / `0` / `null` / `[]` / `null` / `null`, so a fresh run passes none of them.
 Three of them are folds of a bound the operator SIGNED (money, wall, replans) and one is a
 readout seed (grades) — the distinction matters and is spelled out there.
 
+`resumable` (default `true`, PRD item 27(c)/F130) says whether THIS runner supports
+`--resume` at all — `run-u.mjs` leaves it at the default (byte-identical to before this
+flag existed); the exported bundle CLI (`src/cli.js`) passes `false` so the run's
+escalation tail says "resume is `run-u`-only in v1" instead of naming a flag it does not
+implement.
+
 The runner — the shell's top layer, and the ONE entry. It composes everything below it and
 interprets nothing itself. Sequence: **approval gate** (human-signs-always — refuses an
 unapproved spec before ANY provider call: `unapproved-spec`) → **primitive smoke** (litectx
@@ -975,7 +1021,18 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
 plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
 provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | hitl-pause |
-hitl-decision-red | step-red:<id>`.
+hitl-decision-red | step-red:<id> | runner-drained`.
+
+**`runner-drained` (F140/PRD item 28(c))** is a distinct class from every outcome above: it is
+NOT `runJob`'s own return value, it is a `beforeExit` backstop's terminal, emitted from outside
+the normal control flow the instant node drains with no `job-end` at all — a provider promise
+that never settled (BA-25's class; bare-agent 0.42.0 closed the known drop cases per F141, but
+"an instrument fires on absence" stays a permanent class, not a fixed bug). It means: exits
+non-zero, `spendComplete:false` always (a drained run's in-flight spend is unknowable — the
+floor already banked is honest, an exact-looking total would not be, F6). **It is deliberately
+NOT in the resumable/checkpoint set** (`CHECKPOINT_OUTCOMES`/`RESUMABLE_HALTS`, `src/reuse.js`)
+— an unknown in-flight state, unlike a clean `cap-halt`/`wall-halt`/`provider-red`, is not a
+known-safe resume point.
 
 **`readShim` (default `false`) — the capped read seam, per ARM.** The value names which levers
 run — the four arms of the frozen Phase 2 pre-registration:
@@ -1158,17 +1215,36 @@ round of this attempt being priced repairs nothing about the one before it); and
 reporting with the rest end of gate"). Every worker Loop (scout, drafter, each step, the fix
 worker — the ONE seam in `planrun.js`) gets exactly ONE extra attempt, and only for a
 transport-class throw — fetch itself throwing with no HTTP response at all (a TLS fault,
-`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause); an HTTP response
-(4xx/5xx/429) is never retried here and rides bare-agent's own unchanged policy. The budget is
-fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob, tighten-only
-doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase, attempt, error,
-recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw before any usage
-figure came back, so **any** transport retry floors `spendComplete` for the rest of the run even
-when the retry recovers and the run finishes green — the same one-way flag class as `stalled`
-and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
+`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause), OR (bare-agent
+0.42.0, BA-25) a response body cut after headers but before it completed — the provider's own
+`guardResponseSettles` rejects that as a retryable `ProviderError` tagged
+`context.bound:'transport'`, which `isTransportFailure` also recognizes (F141). An HTTP response
+(4xx/5xx generally) is never retried here and rides bare-agent's own unchanged policy. The budget
+is fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob,
+tighten-only doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase,
+attempt, error, recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw
+before any usage figure came back, so **any** transport retry floors `spendComplete` for the rest
+of the run even when the retry recovers and the run finishes green — the same one-way flag class
+as `stalled` and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
 so it stays exact. Both fields are present on all outcomes, so a consumer never branches on
 field presence and never has to launder a missing `spentUsd` into `$0`.
 
+A **rate-limit retry** (PRD item 28's parked a/b ruling, hamr verbatim: "do a/b as a fallback, and
+verify/validate + no regression"; F143/`src/ratelimit.js`) rides the SAME seam as a second,
+INDEPENDENT one-shot budget: an HTTP 429 gets ONE retry that honours the vendor's own stated
+wait, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS` — a longer stated wait is not honoured at all, no
+retry). This is a FALLBACK, not the primary answer — the primary answer (F139) is picking a
+worker model with adequate rate headroom; this only softens the failure mode when that was not
+enough. The wall always wins here too: before sleeping, a retry that would cost more than
+`clock.remainingMs()` is refused and the error rides straight through, exactly like the transport
+ladder's own wall carve-out. Each retry emits a report-only `rate-limit-retry` spine record
+(`{phase, attempt, statedMs, waitedMs, error, recovered}`, no cost field). Unlike the transport
+retry, a rate-limit retry does **not** floor `spendComplete`: a 429 is a REFUSAL — the vendor
+rejected the request before processing it, so nothing can have been billed (a stated assumption,
+not independently measured against a real provider). The two budgets are independent — a
+transport throw and a 429 may both occur, and both retry, across one call's lifetime, but each at
+most once.
+
 **The plan flow (Layer 2).** `job-start` carries `shape: 'plan'` + the goal; plan steps are
 tool-mode by construction. The flow (`runPlan`, also exported for direct callers who own
 their own ledger): **close precheck** (`already-green` is a
@@ -1601,7 +1677,7 @@ package makes). Which runs open one is `doorOpens(job, reviewDoor)`:
   territory.
 
 **Answering one — `answerReviewDoor({ job, workdir, events, decision, text?, closeTimeoutMs?,
-registryDir?, name?, runid?, at?, now?, emit? })`** (`src/reviewdoor.js`). The answer arrives
+closeDir?, registryDir?, name?, runid?, at?, now?, emit? })`** (`src/reviewdoor.js`). The answer arrives
 after the run has ended, possibly days later and from another process, so it cannot ride the
 run's return path. This is that seam. It never throws and never conjures — a fourth door, an
 empty `rerun`, a run that opened no door (`no-door`), an expired one (`door-expired`), a tree
@@ -1612,7 +1688,11 @@ that moved (`door-accept-red`) and a missing registry all come back as named red
   a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
   answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
   stage named and records **nothing**. A pass records the disposition and, over a held judged
-  green, RELEASES the credit through module 6's `applyDoorDecision`.
+  green, RELEASES the credit through module 6's `applyDoorDecision`. `scripts/run-u.mjs` resolves
+  the re-run's ceiling itself via `resolveCloseTimeoutMs` before calling this, and refuses outright
+  (F137) as a named `close-timing-red` door stop — `answerReviewDoor` never called, nothing
+  recorded — if that timing pass itself times out, rather than falling through to `runClose`'s
+  library default.
 - **`rerun`** carries the person's words back as a directive (`next: 'rerun'`) and re-proves
   nothing: the new run's close is what judges. Empty or whitespace text is refused at the same
   seam every other door is.
@@ -2481,7 +2561,9 @@ nothing here to check it against).
 
 Enforcement is **local only** — wired into `npm test` (see `package.json`'s `test`
 script), never into `.github/workflows/*` (CI already runs `npm test`, so the rule is
-enforced there without an ask-first CI edit). The check itself lives outside the
+enforced there without an ask-first CI edit). `npm test` itself now runs `node --test`
+through `scripts/hermetic.mjs`, which strips this machine's `HOME`/git identity so a
+test that leans on either fails locally instead of only on CI (F136). The check itself lives outside the
 published package, at `scripts/prompt-commit-check.mjs` (pure decision logic in
 `scripts/promptcommitlib.mjs`, `scripts/` is not in `package.json`'s `files`, so none of
 this ships):
@@ -2546,11 +2628,77 @@ written by `bareloop run`, step 6 below) is real and live but is not in the froz
 layout table at all. `history.jsonl`'s row also carries `bundleHash` and `approveHash`
 (the POC-fact correction, below) beyond the fields the original layout table named.
 
+#### `src/close-integrity.js` — close-absolute-path (M1) AND close-bytes signature (M2)
+
+Shared by `src/bundle.js` (export time) and a $0 run-start precheck inside `runPlan`
+(`src/planrun.js`) — every job, not only exported bundles, refuses at $0 (before the
+close-first precheck, before any provider call) when a close script's CONTENT bakes in an
+absolute path that exists on disk. Two spellings of the same rule is exactly how F129
+shipped an export-only guard while every non-exported job stayed exposed.
+
+**Scope (widened 2026-09-06, PRD item 27/M2, an orchestrator audit):** a close script is
+addressable — visible to `readCloseScripts`, `checkCloseAbsolutePaths`, the sha256
+fingerprint, and `signCloseScripts` — when its `cmd` is EITHER an interpreter
+(`node`/`sh`/`bash`/`python`/`python3`/`npx`) followed by a non-empty argv[1], OR a bare
+cmd whose argv[0] ITSELF is an absolute path (a `.sh`/other directly-executable close
+script, no interpreter prefix — e.g. `jobs/aurora-testgen-cold.json`'s close). A relative
+bare executable (`true`, `pytest`, `npm test`) names no file at all and stays out of
+scope, on both halves, exactly as before. The shape test itself
+(`closeScriptCandidateToken`, `src/validate.js`) is shared with `src/job.js`'s sha256
+demand so the demand and the detectors can never drift apart about which stages are in
+scope.
+
+| function | args → returns | notes |
+|---|---|---|
+| `absolutePathLiteralsOf(source)` | close script text → `string[]` | the scan itself (moved here from `src/bundle.js`, which now imports it) |
+| `readCloseScripts(spec, cwd)` | resolved job spec + cwd → `{ stage, path, bytes, sha256 }[]` | resolves every addressable `close[].cmd` (see scope above) to its absolute path and bytes off disk; a relative path resolves against `cwd`. Never throws — a missing/unreadable script reports `bytes: null`. `sha256` (M2, additive) is the stage's own signed field verbatim, or `null` |
+| `checkCloseAbsolutePaths(spec, cwd)` | resolved job spec + cwd → `{ ok: true } \| { ok: false, reds: { stage, path, literal }[] }` | the run-start check `runPlan` calls before the close-first precheck |
+| `hashCloseScriptBytes(text)` | script text → sha256 hex | the ONE formula every M2 consumer uses (minting, the run-start check, the runtime re-verify, the export mismatch check) — hashing the utf8-decoded text agrees with hashing the raw file bytes because a close script is always valid UTF-8 |
+| `checkCloseByteSignature(spec, cwd)` | resolved job spec + cwd → `{ ok: true } \| { ok: false, reds: { stage, path, expected, actual }[] }` | the $0 run-start integrity check (PRD item 27): every signed `close[].sha256` must match the script's bytes off disk RIGHT NOW. `runPlan` calls this alongside `checkCloseAbsolutePaths`, before the close-first precheck and before any provider call — a mismatch reds `close-tampered`. An unreadable signed script reads `actual: null` and is STILL a red (never silently "fine") |
+| `checkStageByteSignature(stages, cwd)` | a close stage chain + cwd → same shape as above | the narrower re-verify `runPlan`'s `runCloseStages` wrapper runs before EVERY close execution (precheck, preflight, check-passes, and the close-fix loop all go through this one seam) — a mismatch short-circuits to a `close-tampered` verdict in the same shape `runClose`/`runStages` render, so it rides out through the existing `CLOSE_FAULTS` machinery exactly like `crashed`/`timed-out`/`killed` |
+| `signCloseScripts(spec, cwd)` | resolved job spec + cwd → `{ ok, spec, changes: {stage,path,old,new}[], missing: {stage,path}[] }` | the PURE minting helper: fills `close[].sha256` from disk for every addressable stage. Never writes anything itself — `scripts/sign-close.mjs` is the thin CLI wrapper that gates on `--write`. A `closeDecl` spec (no script path to sign) returns `ok:false` unchanged |
+| `checkCloseDirRequired(spec, cwd, closeDir)` | resolved job spec + cwd + the runner's `closeDir` (or `null`) → `{ ok: true } \| { ok: false, reds: { stage, path }[] }` | PRD item 27/M3 Part B: scans the same addressable-script bytes `readCloseScripts` reads for the literal substring `BARELOOP_CLOSE_DIR` — a script that mentions it needs a real `closeDir` or it would run against `undefined`. A script that never mentions it carries no demand |
+| `CLOSE_DIR_ENV_VAR` | `'BARELOOP_CLOSE_DIR'` | the ONE spelling `checkCloseDirRequired`'s scan and `runClose`'s env-set (`src/ralph.js`) both use |
+
+#### `src/closetimeout.js` — close timeout: autoset + signed override (M3)
+
+hamr's ruling (2026-09-06): *"both … autoset and can be override, same like api pricing"*
+— the guesstimate-plus-loud-sign-plus-customer-override shape (F113), never a hidden
+defaulted knob. Arbiter constants, hamr 2026-09-07 verbatim: **floor = 120,000 ms; K = 5
+("2 and 5 are fine")** — never agent- or adopter-settable.
+
+| export | shape | notes |
+|---|---|---|
+| `CLOSE_TIMEOUT_FLOOR_MS` | `120_000` | the floor, hamr's arbiter constant |
+| `CLOSE_TIMEOUT_K` | `5` | the multiplier, hamr's arbiter constant |
+| `LIBRARY_DEFAULT_CLOSE_TIMEOUT_MS` | `120_000` | `runClose`'s own un-autoset default (`src/ralph.js`'s `timeoutMs = 120_000`) — named separately from the floor above even though the two numbers agree today, because they are different claims |
+| `TIMING_PREFLIGHT_CEILING_MS` | `600_000` (library default × K) | the GENEROUS provisional ceiling every stage runs under DURING the timing pass itself — never the autoset/override ceiling the run then uses, which is only known after the pass completes |
+| `timeCloseStages(stages, {cwd, redact})` | → `{ perStage: {name,ms,exitCode,timedOut}[], slowestMs, slowestName, anyTimedOut }` | runs EVERY stage once, ignoring verdicts (first-red-wins stays for the real verdict precheck) — a declared/kind stage (no `.cmd`) is skipped, contributing no reading rather than a false zero. A stage that never finishes within `TIMING_PREFLIGHT_CEILING_MS` reads `timedOut: true` |
+| `computeCloseTimeoutCeiling({slowestMs, overrideMs?})` | → `{ ceilingMs, source: 'estimated'\|'override' }` | `max(FLOOR, K × slowestMs)`, unless `overrideMs` is given, in which case it wins outright (may sit above OR below the estimate — not tighten-only) |
+| `resolveCloseTimeoutMs({job, stages, cwd, redact})` | → `{ closeTimeoutMs, source, timing, timedOut }` | the ONE resolver `src/planrun.js` and `scripts/run-u.mjs` BOTH call (never two independent spellings of this precedence): a signed `job.closeTimeoutMs` wins with NO timing pass run at all; absent, the pass runs and the ceiling autosets. `timedOut: true` means a stage never finished the pass — the caller reds `close-timing-red` rather than trusting any number |
+| `closeTimeoutBanner({ceilingMs, source, slowestMs?, slowestName?})` | → the printed line | ONE spelling for `estimated`/`override`/`explicit` (the last is the pre-M3 shell/test runtime-option escape hatch, never the signed field) — printed on every run so a silent default can never hide behind this feature the way the OLD 120s/900s defaults did |
+
+**`scripts/sign-close.mjs`** — `node scripts/sign-close.mjs <jobs/x.json> [--write]` or
+`--all` for every `jobs/*.json`. Prints the old→new `jobSpecHash` and each stage's
+old→new sha256; NEVER writes unless `--write` is passed (a dry run is the default). The
+agent never runs this with `--write` on its own authority — minting a close-bytes
+signature is arbiter territory exactly like a budget or a wall clock, the same as the
+authoring pipeline's own refusal (`src/authorjob.js`'s `assembleSpec`, which refuses a
+draft carrying `sha256` the same way it refuses `close`/`closeDecl`/`verdictType`).
+
+**`close[].sha256`** — a signed spec field (PRD item 27/M2): hex sha256 of the bytes of
+the script file the stage's `cmd` names (only for an addressable cmd, per the scope
+above). `validateJob` (`src/job.js`) demands it as `missing-required` on every addressable
+stage and shape-checks it (`invalid-value`, 64 lowercase hex chars) even where not
+demanded. It sits INSIDE the signed spec, so `jobSpecHash` covers it with no
+hash-function change — re-signing a job (minting or changing this field) moves the spec
+hash and needs re-approval, exactly like any other semantic edit.
+
 #### `src/bundle.js` — pure, no provider/process calls
 
 | function | args → returns | notes |
 |---|---|---|
-| `exportBundle(o)` | `{ spec, closeScripts, registryDir, outDir, bareloopVersion }` → `{ ok, reds, dir, bundleHash, manifest }` | mints the directory above. Every check runs before anything touches disk — a red means nothing was written |
+| `exportBundle(o)` | `{ spec, closeScripts, registryDir, outDir, bareloopVersion }` → `{ ok, reds, dir, bundleHash, manifest }` | mints the directory above. Every check runs before anything touches disk — a red means nothing was written. **F132:** a stage carrying a signed `close[].sha256` gets it RE-SIGNED in the written `spec.json` over the RELOCATED bytes (post import-rewrite) it actually packs — not copied verbatim from the source spec. Without this, a script whose import gets rewritten (`../src/x.js` → `'bareloop'`) ships with a signature that covers the wrong bytes, and the bundle refuses itself as `close-tampered` at $0 on its very first run (the manifest hash and the spec signature disagree over two different byte strings for the same file) |
 | `bundleHash(dir)` | `dir` → sha256 hex | recomputes from what is on disk right now; throws only if `dir` itself is not a directory |
 | `readBundle(dir)` | `dir` → `{ ok, reds, spec, manifest, bridges, blessing, history }` | never throws; every failure is a typed red. Runs the tamper check (below) whenever both a manifest and a spec parsed |
 | `resolveBundleSpec(bundle, bundleDir)` | a `readBundle` result + the bundle dir → `{ spec, approveHash }` | the in-memory `$BARELOOP_BUNDLE` → absolute `bundleDir` substitution; `approveHash` is `jobSpecHash` of the *substituted* spec, never the unresolved one |
@@ -2572,7 +2720,12 @@ layout table at all. `history.jsonl`'s row also carries `bundleHash` and `approv
 | `close-script-collision` | `exportBundle` | two different close script paths share one basename — a flat `close/` directory would silently clobber one |
 | `close-import-unparsed` | `exportBundle` | a close script's import is a shape this module cannot verify at all — default import, `* as ns`, mixed default+named/namespace, a bare side-effect import, a dynamic `import()`, or a relative import that does not point into `src/` (a sibling file never ships in `close/`). Fails safe rather than silently accepting what it cannot read |
 | `close-import-unexported` | `exportBundle` | a close script imports a name from bareloop's own `src` that `src/index.js` does not export |
-| `close-absolute-path` | `exportBundle` (F129) | a close script's source bakes in a quoted string literal that is an absolute POSIX path which `existsSync` finds real on the exporting machine and which is not under an allow-listed system prefix (`/usr/`, `/bin/`, `/sbin/`, `/lib/`, `/lib64/`, `/dev/`, `/etc/`, `/proc/`, `/sys/`, `/opt/`). **A close judges `process.cwd()` — the runner's cwd — never a path baked into the script (F8/F129):** the live defect this catches is a hardcoded `WORKDIR` making a close judge the ORIGINAL patient checkout instead of the fresh worktree it was actually pointed at, minting a fake `already-green` at $0. A nonexistent absolute-looking literal is a NAME, not a proven hazard, and is not flagged — the check is deliberately monotone and simple, not clever (see `absolutePathLiteralsOf`'s JSDoc for its named limits: string concatenation and cross-machine-only paths are invisible to it) |
+| `close-absolute-path` | `exportBundle` (F129) AND `runPlan` (PRD item 27, every job) | a close script's source bakes in a quoted string literal that is an absolute POSIX path which `existsSync` finds real on this machine and which is not under an allow-listed system prefix (`/usr/`, `/bin/`, `/sbin/`, `/lib/`, `/lib64/`, `/dev/`, `/etc/`, `/proc/`, `/sys/`, `/opt/`). **A close judges `process.cwd()` — the runner's cwd — never a path baked into the script (F8/F129):** the live defect this catches is a hardcoded `WORKDIR` making a close judge the ORIGINAL patient checkout instead of the fresh worktree it was actually pointed at, minting a fake `already-green` at $0. A nonexistent absolute-looking literal is a NAME, not a proven hazard, and is not flagged — the check is deliberately monotone and simple, not clever (see `absolutePathLiteralsOf`'s JSDoc, `src/close-integrity.js`, for its named limits: string concatenation and cross-machine-only paths are invisible to it). `runPlan` reds this at run start, before the close-first precheck and before any provider call — $0, nothing spent |
+| `close-sha-mismatch` | `exportBundle` (PRD item 27/M2) | a `close[].sha256` the spec carries does not match the bytes of the script actually being packed into the bundle — the two signatures (this one, and `bundleHash`'s manifest hash over the rewritten script) cover the same bytes by two different paths and must never drift apart silently (N4's own hazard, one layer up). Only fires when a value is PRESENT and wrong; a spec with no sha256 at all reds `missing-required` upstream, at `validateJob` |
+| `close-tampered` | `runPlan` (PRD item 27/M2) | a close script's bytes no longer match its signed `sha256` — checked at run start (alongside `close-absolute-path`, before the close-first precheck and before any provider call) AND before EVERY close run thereafter (`runCloseStages`'s wrapper in `src/planrun.js`, the one seam the precheck/preflight/check-passes/close-fix-loop all share). Distinct from `close-red` (a judged "no" from a working close) and from `close-crashed`/`close-timeout`/`close-killed` (the close ran and hit an instrument fault): this is decided BEFORE the close is even spawned, and it means the close that ran would not have been the one the operator approved. Registered in `CLOSE_FAULTS` (`src/ralph.js`) so it rides out through the same forbidden-zone machinery as every other close fault — never retried, never fed back as a gap |
+| `close-dir-required` | `runPlan` (PRD item 27/M3 Part B) | a close script's source mentions `BARELOOP_CLOSE_DIR` (it reads its own books directory) but the runner was given no `closeDir` at all — `checkCloseDirRequired` (`src/close-integrity.js`) reuses the same `readCloseScripts` reader the other two integrity checks share. $0, run start, before the close-first precheck and before any provider call |
+| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely). `scripts/run-u.mjs`'s review door hits the SAME red on its own `accept` timing pass (F137) — it refuses the door outright rather than calling `answerReviewDoor` at all, so nothing is recorded |
+| `wall-under-close-timeout` | `runPlan` (PRD item 27/M3) | `job.maxWallMs` is set and is under the EFFECTIVE per-stage close timeout just resolved (autoset or signed) — a budget under one close cannot fund its own close. `validateJob`'s own `MIN_WALL_MS` floor only bounds the un-autoset library default; this run-start check is the honest shape once the real ceiling is known, rather than a silent clamp |
 | `bundle-missing` | `readBundle` | `dir` is not a directory at all |
 | `manifest-invalid` / `spec-invalid` | `readBundle` | `manifest.json`/`spec.json` could not be read or parsed |
 | `bundle-tampered` | `readBundle` | manifest and spec both parsed, but the recomputed `bundleHash` (from what's really on disk) does not match the stored one — **the load-bearing check, N4 below** |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",
@@ -20,13 +20,13 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node --test && node scripts/prompt-commit-check.mjs --range origin/main..HEAD",
+    "test": "node scripts/hermetic.mjs && node scripts/prompt-commit-check.mjs --range origin/main..HEAD",
     "typecheck": "tsc --noEmit",
     "build:types": "tsc",
     "prepublishOnly": "npm run build:types"
   },
   "dependencies": {
-    "bare-agent": "^0.39.0",
+    "bare-agent": "^0.42.0",
     "bareguard": "^0.13.0",
     "litectx": "^0.32.0"
   },

package/src/authorflow.js

@@ -82,7 +82,7 @@ import {
   GENRE_LANGUAGES, TYPES_GENRE_TEMPLATE, classGuards, genreEnv, genreOwnedEnvNames, genreInstruments,
   validateDeclaration, envCapableKind, classMenu, VERDICT_CLASSES, LIVE_CLASSES,
 } from './authoring.js';
-import { buildSeedListing, cleanEntry, SURVEY_CAUSES } from './authorscout.js';
+import { buildSeedListing, cleanEntry, SURVEY_CAUSES, AUTHOR_CALL_TIMEOUT_MS } from './authorscout.js';
 import { extractArtifact, priceOf, scrubRaw, tallyCalls, capStop } from './text.js';
 import { redactSecrets } from './validate.js';
 
@@ -1147,7 +1147,12 @@ export function makeLoopGenerate(provider, { system = AUTHOR_SYSTEM, maxTokens =
       ...t,
       execute: async (/** @type {any} */ a) => { const r = await t.execute(a); loop.stop(); return r; },
     }));
-    return loop.run(messages, wired, { cacheMessages: true, maxTokens, ...opts });
+    // F152/PRD 30.4 — the SAME idle bound `authorscout.js` reuses (this pipeline
+    // has no wall clock of its own): a live endpoint that accepts and never
+    // answers hangs the process forever otherwise. `...opts` still spreads AFTER
+    // it, so a caller that ever needs a tighter number for one call may pass it —
+    // tighten-only, and nothing does today.
+    return loop.run(messages, wired, { cacheMessages: true, maxTokens, timeoutMs: AUTHOR_CALL_TIMEOUT_MS, ...opts });
   };
 }
 

package/src/authorjob.js

@@ -654,7 +654,21 @@ export async function authorCloseForJob({
 /** The fields `assembleSpec` writes, and therefore the fields a DRAFT must not
  * carry. Named as data so the refusal and the fold can never disagree about
  * which half of the spec is which. */
-export const AUTHORED_SPEC_FIELDS = Object.freeze(['close', 'closeDecl', 'verdictType']);
+// `sha256` (PRD item 27/M2) rides alongside `close`/`closeDecl`/`verdictType`:
+// it is arbiter territory exactly like a budget or a wall clock — the agent
+// never mints a close-bytes signature (only `signCloseScripts`/hamr's own
+// re-sign does), so a draft carrying the field at all is refused the same
+// way one carrying a raw `close` array is. A `closeDecl` spec has no script
+// path to sign in the first place (M1's own kind executor, never a shipped
+// script), so this can only ever fire on a smuggled/legacy-shaped draft —
+// named here anyway, because "arbiter fields are refused by name" is the
+// rule, not "arbiter fields that are currently reachable are refused".
+// `closeTimeoutMs` (PRD item 27/M3) joins the same list for the same reason:
+// it is arbiter territory exactly like the timeout floor/multiplier
+// themselves — the agent never mints a close-timeout override (only the
+// operator's own signed spec edit does), so a draft carrying it is refused
+// the same way one carrying a raw `close` array is.
+export const AUTHORED_SPEC_FIELDS = Object.freeze(['close', 'closeDecl', 'verdictType', 'sha256', 'closeTimeoutMs']);
 
 /**
  * Fold an authored close into the OPERATOR's own half of the spec.

package/src/authorscout.js

@@ -55,11 +55,37 @@ import { TOOL_MENU, WRITE_VERBS, STORE_VERBS } from './job.js';
 import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, strategyFor } from './tools.js';
 import { redactSecrets, SECRET_PATTERNS } from './validate.js';
 import { extractArtifact, priceOf, scrubRaw, stampRaw, tallyCalls, capStop } from './text.js';
+import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 const require = createRequire(import.meta.url);
 const { Loop, wireGate } = require('bare-agent');
 const { createShellTools } = require('bare-agent/tools');
 
+/**
+ * F152/PRD 30.4 — the scout's per-call IDLE bound. Every `loop.run()` in this
+ * module carried NO time bound at all: a live endpoint that accepts and never
+ * answers hangs the process forever (measured) — an open socket is an active
+ * handle, so node never drains and no backstop can fire.
+ *
+ * UNLIKE the run path (`callBounds()`, src/planrun.js:1518), this pipeline has
+ * NO wall clock to derive a bound FROM — the authoring pipeline is genuinely
+ * clockless (`src/authorjob.js`/`src/authorflow.js`/`scripts/run-author.mjs`
+ * carry a money ceiling, `ceilingUsd`/`capStop`, and never a `maxWallMs`).
+ * Rather than inventing a fresh number, this reuses the EXACT ceiling the run
+ * path itself falls back to when ITS OWN wall is unbounded
+ * (`PROVIDER_TIMEOUT_MS`, `src/clock.js` — BA-18's idle timeout, already an
+ * approved "no wall present" default one layer up): an authoring-time call is
+ * the identical situation, one call earlier.
+ *
+ * It bounds SOCKET INACTIVITY only (reset by every byte, per BA-18) — a call
+ * that is merely slow keeps streaming and is untouched; only a truly silent
+ * endpoint trips it. TIGHTEN-ONLY, like every cap in this file: this is an
+ * operator-set ceiling fixed here, not a param a caller or a signed spec may
+ * widen (a defaulted cap is a silent second ceiling, and there is no clock
+ * whose narrower reading could ever tighten it further).
+ */
+export const AUTHOR_CALL_TIMEOUT_MS = PROVIDER_TIMEOUT_MS;
+
 /** src/planrun.js:42 — the survey's hard round bound. */
 export const AUTHOR_SCOUT_ROUNDS = 8;
 /** src/planrun.js:44 — the survey is a PROMPT INGREDIENT for the authoring call. */
@@ -348,7 +374,7 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider
  *
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
- *   attempts?: number, ceilingUsd?: number|null,
+ *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any}) => any,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -365,10 +391,18 @@ export async function runAuthorScout({
   ctx = true,
   attempts = SCOUT_ATTEMPTS,
   ceilingUsd = null,
+  // F152/PRD 30.4 — TIGHTEN-ONLY, the same clamp shape `attempts` carries just
+  // below: an operator (a test included) may buy a SHORTER idle bound and never
+  // a longer one. A garbage/absent value floors at the module ceiling
+  // (`AUTHOR_CALL_TIMEOUT_MS`), never at "no bound at all".
+  callTimeoutMs = AUTHOR_CALL_TIMEOUT_MS,
   onCall = () => {},
   createLoop = defaultLoop,
   createSurveyor = defaultSurveyor,
 }) {
+  const callTimeout = Number.isFinite(Number(callTimeoutMs)) && Number(callTimeoutMs) > 0
+    ? Math.min(Math.trunc(Number(callTimeoutMs)), AUTHOR_CALL_TIMEOUT_MS)
+    : AUTHOR_CALL_TIMEOUT_MS;
   const granted = AUTHOR_SCOUT_VERBS;
   const system = SCOUT_SYSTEM + strategyFor([...granted]);
   const surveyor = await createSurveyor({ workdir, granted, ctx });
@@ -404,6 +438,33 @@ export async function runAuthorScout({
   // an ABSENT nobody can act on.
   const allowed = Math.max(1, Math.min(Math.trunc(Number(attempts)) || 1, SCOUT_ATTEMPTS));
 
+  /**
+   * F152/PRD 30.4 — ONE call seam for every `loop.run()` below, so a REJECTED
+   * call (a `TimeoutError` off `AUTHOR_CALL_TIMEOUT_MS` included — bare-agent
+   * 0.42 rejects every known transport/idle-timeout casualty, F141) lands in the
+   * SAME place a call that merely RESOLVED with an error already did: as an
+   * `{error}` shape, read by `record()` (cost null, same as a `provider-red`
+   * locate call — a rejected call has no knowable cost) and by `classifySurvey`
+   * under the EXISTING `call-failed` cause. Without this seam a rejection would
+   * escape uncaught to `run-author.mjs`'s top-level crash handler instead of the
+   * honest, already-typed terminal this module was built to report through.
+   * @param {Promise<any>} p @returns {Promise<any>}
+   */
+  const settled = async (p) => {
+    try { return await p; } catch (e) {
+      // ONLY the call's own deadline lands here. Swallowing every throw would
+      // launder a budget HaltError, a programming bug, or any other named
+      // terminal into "the survey call failed" — the exact class of dishonesty
+      // this repo refuses (an unknown reported as a known). A timeout is the one
+      // throw this seam exists for: it IS a call that produced nothing, which is
+      // what `call-failed` already means. Everything else re-raises and is
+      // relayed after cleanup, as it was before this seam existed.
+      const err = /** @type {any} */ (e);
+      if (err?.code !== 'ETIMEDOUT' && err?.name !== 'TimeoutError') throw e;
+      return { error: String(err?.message ?? err) };
+    }
+  };
+
   try {
     /** @type {Survey|null} */
     let survey = null;
@@ -455,8 +516,8 @@ export async function runAuthorScout({
         };
         loop = createLoop({ system, policy: surveyor.policy, onLlmResult: metered, provider });
 
-        const r = await loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
-          { cacheMessages: true, maxTokens });
+        const r = await settled(loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
         verdictAt = record(label, attempt, r);
         blob = redactSecrets(String(r?.text ?? '')).slice(0, blobMax);
         lastMsgs = Array.isArray(r?.msgs) && r.msgs.length ? r.msgs : null;
@@ -493,8 +554,16 @@ export async function runAuthorScout({
         if (recoveryHalt) budgetStop = recoveryHalt;
         if (recoveryWanted && !recoveryHalt) {
           const recovery = createLoop({ system, policy: surveyor.policy, onLlmResult: surveyor.onLlmResult, provider });
-          s2 = await recovery.run([...r.msgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
-            { cacheMessages: true, maxTokens });
+          // F147 (second instance; sibling fix: src/planrun.js `askFrom`, commit
+          // 031ffe1): `r.msgs` is a prior `loop.run()`'s returned transcript,
+          // which bare-agent already prepended `system` to (Loop.run, loop.js
+          // ~482-486). `recovery` below is built with the same `system` and
+          // would prepend it again, leaving two identical system messages at
+          // index 0/1 — real OpenAI tolerates it, vLLM-class OpenAI-compatible
+          // backends 400 on it. Strip the leading one before re-running.
+          const rMsgs = r.msgs[0]?.role === 'system' ? r.msgs.slice(1) : r.msgs;
+          s2 = await settled(recovery.run([...rMsgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
+            { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
           const recoveryAt = record('author-scout-recovery', attempt, s2);
           const t = redactSecrets(String(s2?.text ?? '')).slice(0, blobMax);
           // the verdict follows the blob that WON, never the call that came last
@@ -518,10 +587,15 @@ export async function runAuthorScout({
         // THE RE-ASK. Toolless by construction, over the survey's own
         // conversation, naming only what failed mechanically.
         const reask = createLoop({ system, policy: surveyor.policy, onLlmResult: surveyor.onLlmResult, provider });
-        const rr = await reask.run(
-          [...lastMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
-          { cacheMessages: true, maxTokens },
-        );
+        // F147 (second instance; sibling fix: src/planrun.js `askFrom`, commit
+        // 031ffe1): `lastMsgs` is a prior `loop.run()`'s returned transcript
+        // (system already prepended by bare-agent); `reask` is built with the
+        // same `system` and would prepend it again. Strip the leading one.
+        const askMsgs = lastMsgs[0]?.role === 'system' ? lastMsgs.slice(1) : lastMsgs;
+        const rr = await settled(reask.run(
+          [...askMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout },
+        ));
         verdictAt = record(label, attempt, rr);
         blob = redactSecrets(String(rr?.text ?? '')).slice(0, blobMax);
         if (Array.isArray(rr?.msgs) && rr.msgs.length) lastMsgs = rr.msgs;