bareloop 0.21.0 → 0.23.0

package/src/providers.js

@@ -0,0 +1,176 @@
+// Provider factory (PRD item 28, shape (1)): ONE seam mapping a job spec's
+// `provider` name to the bare-agent constructor it drives, the env var
+// carrying its key, and the per-tier model table — including any
+// provider-specific request-key gating. Before this module existed, both
+// runners constructed `AnthropicProvider` BY NAME (`src/cli.js`'s
+// `buildProviders`, `scripts/run-u.mjs`'s top-level wiring) and any second
+// provider would have meant scattering `if (provider === …)` across both.
+//
+// hamr's ruling (PRD 30.7, 2026-09-09): `deepseek-chat` is THE secondary
+// provider — "settle on one secondary/replacement for claude … don't
+// pickpocket random models". This table is not a menu of half-tested
+// models; it is exactly the two provider identities the PROVIDERS menu
+// (`src/job.js`) admits.
+//
+// What this module is NOT: it never picks a judge (the judge stays pinned
+// to `anthropic-api`/`JUDGE_MODEL` regardless of the job's worker provider —
+// arbiter territory, PRD item 28), never prices a round (F113: rates
+// passthrough is dead), and never decides a budget. It only constructs the
+// provider objects `bare-agent`'s `Loop` calls.
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { AnthropicProvider, OpenAIProvider } = require('bare-agent/providers');
+
+/**
+ * Today's anthropic-api tier table — EXACTLY the `DEFAULT_TIER_MODELS` both
+ * runners hardcoded before this factory existed. Any change to these two
+ * values is a change to shipped anthropic-api behaviour, not a refactor.
+ */
+export const ANTHROPIC_TIER_MODELS = Object.freeze({
+  sonnet: 'claude-sonnet-5',
+  haiku: 'claude-haiku-4-5-20251001',
+});
+
+/**
+ * DeepSeek (F149/F150) is a SINGLE model, not a tiered family — hamr's
+ * ruling above: one secondary provider, not a menu. Both tiers map to the
+ * same model id ON PURPOSE: `resolveWorkerModel`/a runner's `providerFor
+ * (tier)` only ever LOOK UP a tier's model id (src/job.js:818-827,
+ * scripts/run-u.mjs's `providerFor`) — neither assumes the tiers name
+ * different models — so repeating the one id is the honest representation
+ * of a single-model provider, not a second model masquerading as `haiku`.
+ * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
+ * cheaper tier model, this is where it would earn its own `haiku` id.
+ */
+export const OPENAI_TIER_MODELS = Object.freeze({
+  sonnet: 'deepseek-chat',
+  haiku: 'deepseek-chat',
+});
+
+/**
+ * Per-MODEL request-key gating (F149, live-measured 2026-09-09): DeepSeek
+ * silently IGNORES the modern `max_completion_tokens` key — asked for 64
+ * output tokens, it returned 665/608 — and only honours the legacy
+ * `max_tokens` key. `bare-agent`'s `OpenAIProvider` already exposes the
+ * switch (`legacyMaxTokens`, BA-24; no model-name sniffing inside
+ * bare-agent itself — "the caller declares the dialect"), so THIS table is
+ * bareloop's routing of it, keyed per model, never a global default. An
+ * output cap that does not bind is a money hazard: a reasoning model can
+ * run to its own ceiling on every round, silently, so getting this wrong
+ * for even one model defeats every budget that model's tier sets.
+ *
+ * A model with no entry here gets `{}` — bare-agent's own default
+ * (`max_completion_tokens`, GPT-5-safe) applies, unmodified.
+ */
+const OPENAI_MODEL_OPTIONS = Object.freeze({
+  'deepseek-chat': Object.freeze({ legacyMaxTokens: true }),
+});
+
+/**
+ * @typedef {object} ProviderTableEntry
+ * @property {new (options: any) => any} ctor the bare-agent provider class
+ * @property {string} envKey the environment variable this provider reads its key from
+ * @property {Readonly<Record<string, string>>} tiers tier name -> model id
+ * @property {(model: string|undefined) => Record<string, any>} paramsFor per-model request-key/param gating, applied on TOP of {exposeErrorBody:true, apiKey, model, baseUrl?}
+ */
+
+/** @type {Readonly<Record<string, ProviderTableEntry>>} */
+const PROVIDER_TABLE = Object.freeze({
+  'anthropic-api': Object.freeze({
+    ctor: AnthropicProvider,
+    envKey: 'ANTHROPIC_API_KEY',
+    tiers: ANTHROPIC_TIER_MODELS,
+    // Anthropic has only ever had one request key for the output cap
+    // (`max_tokens`) — nothing to gate here, ever (unlike OpenAI-shaped
+    // backends, which fork on `max_tokens` vs `max_completion_tokens`).
+    paramsFor: () => ({}),
+  }),
+  'openai-api': Object.freeze({
+    ctor: OpenAIProvider,
+    envKey: 'OPENAI_API_KEY',
+    tiers: OPENAI_TIER_MODELS,
+    paramsFor: (model) => OPENAI_MODEL_OPTIONS[/** @type {string} */ (model)] ?? {},
+  }),
+});
+
+/**
+ * Look up a provider's table entry. Throws a NAMED error on an unrecognized
+ * provider — never a silent default (the `resolveRates`-style-substring-
+ * match lesson: a forward hazard even at zero observed rounds, MEMORY.md).
+ * `src/job.js`'s `PROVIDERS` menu is the one place a spec's `provider`
+ * field is validated; this is the runtime construction seam it feeds.
+ * @param {string} providerName
+ * @returns {ProviderTableEntry}
+ */
+export function resolveProvider(providerName) {
+  const entry = PROVIDER_TABLE[/** @type {keyof typeof PROVIDER_TABLE} */ (providerName)];
+  if (!entry) {
+    throw new Error(
+      `src/providers.js: unknown provider "${providerName}" — no silent default. `
+      + `Known providers: ${Object.keys(PROVIDER_TABLE).join(', ')}`,
+    );
+  }
+  return entry;
+}
+
+/**
+ * Construct ONE provider instance for `providerName`/`model`, applying
+ * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)
+ * and the model's own request-key gating (`paramsFor`). `baseUrl` (PRD item
+ * 28, ruling (d), 2026-09-09: admitted in v1) is forwarded only when given —
+ * every provider constructor here defaults it on its own when absent.
+ * @param {string} providerName
+ * @param {{apiKey?: string, model?: string, baseUrl?: string}} [options]
+ */
+export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
+  const entry = resolveProvider(providerName);
+  return new entry.ctor({
+    exposeErrorBody: true,
+    apiKey,
+    model,
+    ...(baseUrl !== undefined ? { baseUrl } : {}),
+    ...entry.paramsFor(model),
+  });
+}
+
+/**
+ * Build the `{provider, providerFor, judgeProvider}` triple both runners
+ * need (`src/cli.js`'s `buildProviders`, `scripts/run-u.mjs`'s top-level
+ * wiring) — ONE seam instead of two copies of the same construction and
+ * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
+ * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
+ * before this factory existed — that decision stays where each runner's own
+ * `--model` flag/spec precedence lives, not duplicated in here).
+ *
+ * The JUDGE stays pinned to `anthropic-api`/`judgeModel` regardless of
+ * `providerName` — arbiter territory (PRD item 28: "the judge stays PINNED
+ * … regardless of the job's worker provider"). A signed `judge:{provider,
+ * model}` field with its own calibration record is PRD item 28 part (2),
+ * NOT built here; until it lands, the judge always needs its own
+ * `judgeApiKey` (today, always `ANTHROPIC_API_KEY`), independent of which
+ * key the worker used.
+ * @param {object} args
+ * @param {string} args.providerName spec.provider (or the anthropic-api default)
+ * @param {string|undefined} args.apiKey the WORKER's key, read from the provider's own `envKey`
+ * @param {string} args.model the already-resolved worker model id
+ * @param {Readonly<Record<string, string>>} args.tierModels the already-resolved tier -> model map (spec override folded in by the caller)
+ * @param {string|undefined} [args.baseUrl] spec.baseUrl, if any
+ * @param {string|undefined} args.judgeApiKey the judge's own key (today: `ANTHROPIC_API_KEY`)
+ * @param {string} args.judgeModel `JUDGE_MODEL`
+ */
+export function buildRunnerProviders({
+  providerName, apiKey, model, tierModels, baseUrl, judgeApiKey, judgeModel,
+}) {
+  const provider = makeProvider(providerName, { apiKey, model, baseUrl });
+  /** @type {Record<string, any>} */
+  const tierCache = {};
+  const providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= (
+    tierModels[tier] === model
+      ? provider
+      : makeProvider(providerName, { apiKey, model: tierModels[tier], baseUrl })
+  ));
+  const judgeProvider = makeProvider('anthropic-api', { apiKey: judgeApiKey, model: judgeModel });
+  return { provider, providerFor, judgeProvider };
+}

package/src/ralph.js

@@ -208,17 +208,24 @@ export const CLOSE_ENV_DENY = Object.freeze({
  *
  * @param {string[]} close argv, e.g. ['node', '--test', 'close/']
  * @param {(s: string) => string} [redact] source scrubber; identity by default
- * @param {{ timeoutMs?: number, cwd?: string, expect?: number, judged?: {pattern: string, min: number}, gapKeep?: string }} [opts]
+ * @param {{ timeoutMs?: number, cwd?: string, expect?: number, judged?: {pattern: string, min: number}, gapKeep?: string, closeDir?: string|null }} [opts]
  *   close wall-clock cap (operator-set via the runner, never the config's — the
  *   agent must not author its arbiter's clock), the directory the close runs in
  *   (the workdir — the tree it is judging), the exit code the SIGNED spec calls
  *   success, the judgment-rendered signal, and the kept-failures pattern. All
  *   five are arbiter territory: the drafted workflow config cannot express any.
+ *   `closeDir` (PRD item 27/M3 Part B) is the close's OWN books directory —
+ *   pristine copies, calibration thresholds, logs — deliberately outside the
+ *   patient tree (the worker must never read the arbiter's books). Handed to
+ *   the child as `BARELOOP_CLOSE_DIR` (`CLOSE_DIR_ENV_VAR`,
+ *   src/close-integrity.js); a close script that needs one and gets none
+ *   instrument-stops itself, by the script's own contract — this seam only
+ *   ever THREADS the value, it never invents one.
  * @returns {Promise<{verdict: 'satisfied'|'needs_revision'|'failed'|'timed-out'|'killed'|'crashed',
  *   gap?: string, exitCode?: number, signal?: string, detail?: string,
  *   judgedCount?: number|null, unaudited?: boolean}>}
  */
-export async function runClose(close, redact = (s) => s, { timeoutMs = 120_000, cwd, expect = 0, judged, gapKeep } = {}) {
+export async function runClose(close, redact = (s) => s, { timeoutMs = 120_000, cwd, expect = 0, judged, gapKeep, closeDir = null } = {}) {
   const env = { ...process.env };
   delete env.NODE_TEST_CONTEXT; // a `node --test` close inherits this from a test runner and silently no-ops — a fake green
   // …and the operator's credentials go with it (CLOSE_ENV_DENY above). A COPY is
@@ -229,6 +236,13 @@ export async function runClose(close, redact = (s) => s, { timeoutMs = 120_000,
       || CLOSE_ENV_DENY.prefixes.some((p) => name.startsWith(p))
       || CLOSE_ENV_DENY.shape.test(name)) delete env[name];
   }
+  // PRD item 27/M3 Part B — a `BARELOOP_` name, deliberately not matched by
+  // any CLOSE_ENV_DENY rule above (checked: no name/prefix/suffix entry there
+  // touches it), set AFTER the strip loop so it can never be stripped by a
+  // future denylist edit either. Only set when the runner actually has one —
+  // an empty/absent `closeDir` leaves the child's env exactly as it was
+  // before this rung, so a script that never reads the variable is unaffected.
+  if (typeof closeDir === 'string' && closeDir.length > 0) env.BARELOOP_CLOSE_DIR = closeDir;
   const r = await spawnClose(close[0], close.slice(1), { env, cwd, timeoutMs });
 
   // ── forbidden zone, before any exit code is believed ──────────────────────
@@ -322,17 +336,17 @@ export const stageGap = (name, gap) => `close stage "${name}" failed:\n${gap}`;
  *
  * @param {any[]} stages the stage list (already validated by validateJob)
  * @param {(s: string) => string} [redact] scrub, applied at capture on EVERY stage
- * @param {{timeoutMs?: number, cwd?: string}} [opts]
+ * @param {{timeoutMs?: number, cwd?: string, closeDir?: string|null}} [opts]
  * @returns {Promise<any>} runClose's verdict shape, plus `stage` and `stages`
  */
-export async function runStages(stages, redact = (s) => s, /** @type {{timeoutMs?: number, cwd?: string}} */ { timeoutMs, cwd } = {}) {
+export async function runStages(stages, redact = (s) => s, /** @type {{timeoutMs?: number, cwd?: string, closeDir?: string|null}} */ { timeoutMs, cwd, closeDir } = {}) {
   const ran = [];
   let last;
   for (const st of stages) {
     // Sequential by construction (F68): stages run one at a time under a single
     // await, so nothing here ever has two closes in flight against one tree.
     const r = await runClose(st.cmd.trim().split(/\s+/), redact, {
-      timeoutMs, cwd, expect: st.expect, judged: st.judged, gapKeep: st.gapKeep,
+      timeoutMs, cwd, expect: st.expect, judged: st.judged, gapKeep: st.gapKeep, closeDir,
     });
     ran.push({ name: st.name, verdict: r.verdict, ...(r.exitCode !== undefined ? { exitCode: r.exitCode } : {}) });
     last = r;
@@ -443,6 +457,21 @@ export const CLOSE_FAULTS = Object.freeze({
     decision: 'The close exited without judging anything — it crashed rather than failed. Its exit code is NOT a verdict, in either direction.',
     options: ['fix what makes the close crash at startup', 'fix the close argv', 'lower the declared judgment floor if the suite legitimately shrank', 'abandon the task'],
   },
+  // PRD item 27/M2 (`docs/product/CLOSE-INTEGRITY-BUILD.md`) — a close
+  // script's bytes no longer match what was signed. Distinct from every row
+  // above: those are read off HOW THE CHILD PROCESS TERMINATED, and this one
+  // is decided BEFORE the process is even spawned (`runCloseStages`,
+  // `src/planrun.js`, re-verifies before every close run and short-circuits
+  // to this verdict on a mismatch, the same forbidden-zone shape as a
+  // crash). Never `close-red` (a judged "no" from a working close) and never
+  // `close-crashed` (an instrument fault the close itself hit) — this is a
+  // THIRD thing: the close that ran would not have been the one the operator
+  // approved.
+  'close-tampered': {
+    category: 'close-tampered',
+    decision: "A close script's bytes no longer match its signed sha256 — it would run something other than what was approved, so no verdict from it can be trusted.",
+    options: ['restore the close script to its signed bytes', 're-sign the close if the change is intentional (a new spec hash needs re-approval)', 'abandon the task'],
+  },
 });
 
 /**
@@ -529,9 +558,13 @@ export const CLOSE_FAULTS = Object.freeze({
  *   it to the gate audit's allow-decision writes. Injected like `redact` so the shell
  *   stays stdlib-only and dumb; consulted ONLY at a crashed verdict. With no seam, or
  *   with zero writes, a crash stays what it always was: an instrument stop.
+ * @param {string|null} [opts.closeDir] the close's own books directory
+ *   (PRD item 27/M3 Part B), forwarded to the raw `close` path's `runClose`
+ *   call unchanged; a caller supplying `judge` instead already closed over
+ *   its own `closeDir` and this param does nothing for it.
  * @returns {Promise<'green'|'escalated'>}
  */
-export async function ralph({ middle, close, judge, capRuns, ladder, emit, redact, closeTimeoutMs, cwd, expect, judged, gapKeep, workerWrites }) {
+export async function ralph({ middle, close, judge, capRuns, ladder, emit, redact, closeTimeoutMs, cwd, expect, judged, gapKeep, workerWrites, closeDir }) {
   // PARAM GUARD (the BA-4 class — a caller's malformed argument, which is the one
   // thing this shell throws for; a WORKER's bad reach comes back as a refusal
   // RESULT instead, and that rule is about feedback, not about the API contract).
@@ -660,7 +693,7 @@ export async function ralph({ middle, close, judge, capRuns, ladder, emit, redac
     emit('middle-done', { iteration });
     const v = judge
       ? await judge()
-      : await runClose(/** @type {string[]} */ (close), redact, { timeoutMs: closeTimeoutMs ?? 120_000, cwd, expect, judged, gapKeep });
+      : await runClose(/** @type {string[]} */ (close), redact, { timeoutMs: closeTimeoutMs ?? 120_000, cwd, expect, judged, gapKeep, closeDir });
     // Worker-crash attribution (F32, measured in F31: 4 of 7 battery rows). A crash is
     // still not a verdict (F17) — but a crash that FOLLOWS worker writes, on a run whose
     // precheck proved the close judged at baseline (run.js escalates a crash-at-precheck

package/src/ratelimit.js

@@ -0,0 +1,116 @@
+// PRD item 28's parked (a/b) ruling, hamr's verbatim call: "do a/b as a
+// fallback, and verify/validate + no regression." A vendor HTTP 429 is a
+// response — the provider answered, unlike src/transport.js's no-response
+// class — but unlike every other status this repo already declines to retry
+// (4xx/5xx generally, F115's own boundary), a 429 carries the ONE piece of
+// information that turns "retry blindly" into "retry honestly": the vendor's
+// own stated wait. This module is transport.js's SIBLING, not an extension
+// of it — `isTransportFailure` must keep returning FALSE for anything
+// carrying an HTTP status (429 included), and nothing here widens that.
+//
+// This is a FALLBACK, not the primary answer. The primary answer (F139,
+// measured 2026-09-08) is picking a worker model with adequate rate
+// headroom: gpt-4.1 = 30,000 TPM (429s deterministically on our workload,
+// 2 of 2 runs), gpt-4.1-mini = 200,000 TPM, gpt-5-mini/gpt-5 = 500,000 TPM.
+// One bounded retry only softens the failure mode when that primary answer
+// was not followed (or headroom was still exceeded); it does not replace it.
+
+/** The fixed retry budget: ONE extra attempt after a 429. Never read from a
+ * job spec or CLI flag — raising it is arbiter territory, mirroring
+ * transport.js's TRANSPORT_RETRIES exactly (tighten-only doctrine). */
+export const RATE_LIMIT_RETRIES = 1;
+
+/** bare-agent's `Retry.call` (if ever used) counts ATTEMPTS, not retries;
+ * this module's own hand-rolled ladder (src/planrun.js) does the same for
+ * symmetry with TRANSPORT_MAX_ATTEMPTS. */
+export const RATE_LIMIT_MAX_ATTEMPTS = RATE_LIMIT_RETRIES + 1;
+
+/** The hard cap on how long we will ever wait for a vendor-stated 429 delay.
+ * A vendor asking for longer than this is not honoured — we do not retry at
+ * all in that case. Waiting that long is the operator's decision, not ours
+ * (arbiter territory: nothing here escalates the wait past what hamr set). */
+export const RATE_LIMIT_MAX_WAIT_MS = 60_000;
+
+/** Used only when the vendor's message carries no parseable delay at all. */
+export const RATE_LIMIT_DEFAULT_WAIT_MS = 5_000;
+
+/** A parsed delay is the EARLIEST moment the vendor's own window resets, not
+ * a safe one to fire on the dot — this margin is added to any PARSED value
+ * (never to the default) so the retry lands just after the window, not on
+ * its leading edge. Never allowed to push a parsed value over the cap. */
+const PARSED_DELAY_MARGIN_MS = 250;
+
+/**
+ * Is `err` an HTTP 429 (rate-limited) response? True ONLY for an explicit
+ * status of 429 on the error itself. Nothing else qualifies — not message
+ * text (a message merely containing "429" is not this), not `retryable`,
+ * not any other status. Symmetric with `isTransportFailure`'s own status
+ * check (src/transport.js), just reading the opposite branch of it.
+ * @param {any} err
+ * @returns {boolean}
+ */
+export function isRateLimited(err) {
+  if (err == null) return false;
+  const status = err.status ?? err.statusCode;
+  return status === 429;
+}
+
+/**
+ * The vendor's RAW stated wait, in milliseconds, parsed straight from the
+ * error message — no default, no margin, no cap. `null` when nothing in the
+ * message matches a known shape. Exported separately from `rateLimitWaitMs`
+ * so a caller that wants to report the vendor's own number on the spine
+ * (`statedMs`) never has to re-derive it from the margin-adjusted figure.
+ *
+ * bare-agent does not expose the vendor's `retry-after` /
+ * `x-ratelimit-reset-*` response headers on the thrown error (BA-26) — the
+ * delay exists only in the vendor's English message text, so this parses
+ * that text. Verified real shape (OpenAI, run `8ev2sdkn`, 2026-09-08):
+ * "Please try again in 11.996s." This also supports "try again in 1.5
+ * seconds", "try again in 20ms", "retry after 30s", and "retry after 30
+ * seconds" — case-insensitive.
+ * @param {any} err
+ * @returns {number|null}
+ */
+export function statedWaitMs(err) {
+  const message = String(err?.message ?? err ?? '');
+  const match = message.match(/(?:try again in|retry after)\s*([\d.]+)\s*(ms|milliseconds?|s|seconds?)?/i);
+  if (!match) return null;
+
+  const value = Number(match[1]);
+  if (!Number.isFinite(value) || value < 0) return null;
+
+  const unit = (match[2] ?? 's').toLowerCase();
+  const isMs = unit === 'ms' || unit.startsWith('millisecond');
+  return isMs ? value : value * 1000;
+}
+
+/**
+ * How long to wait before retrying a 429, in milliseconds — or `null`
+ * meaning "do not retry at all" (either the parsed wait exceeds
+ * `RATE_LIMIT_MAX_WAIT_MS`, in which case waiting that long is the
+ * operator's decision, not ours).
+ *
+ * A parsed value gets `PARSED_DELAY_MARGIN_MS` added (the vendor's stated
+ * number is the earliest moment its window resets, not a safe one to fire
+ * on), capped so the margin itself can never push a parsed value over
+ * `RATE_LIMIT_MAX_WAIT_MS`. When nothing parses, `RATE_LIMIT_DEFAULT_WAIT_MS`
+ * is returned as-is, with no margin added (there is nothing to add margin
+ * to — it is already a conservative guess, not an earliest-moment reading).
+ * @param {any} err
+ * @returns {number|null}
+ */
+export function rateLimitWaitMs(err) {
+  const parsedMs = statedWaitMs(err);
+  if (parsedMs === null) {
+    return RATE_LIMIT_DEFAULT_WAIT_MS <= RATE_LIMIT_MAX_WAIT_MS ? RATE_LIMIT_DEFAULT_WAIT_MS : null;
+  }
+
+  // The RAW parsed value is what is judged against the cap ("a vendor asking
+  // for longer than this is not honoured") — the margin is added only AFTER
+  // that gate, and clamped so it can never itself push the result past the
+  // cap, but it never turns an already-honoured wait into a refusal.
+  if (parsedMs > RATE_LIMIT_MAX_WAIT_MS) return null;
+  if (parsedMs === 0) return 0;
+  return Math.min(parsedMs + PARSED_DELAY_MARGIN_MS, RATE_LIMIT_MAX_WAIT_MS);
+}

package/src/reuse.js

@@ -60,6 +60,7 @@ import { readGrade } from './trend.js';
 import { HITL_PAUSE, HUMAN_CHECKPOINTS } from './declaredclose.js';
 import { extractArtifact, priceOf } from './text.js';
 import { runJob as shippedRunJob, ACCOUNTED_ROUND_TYPES } from './run.js';
+import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 const require = createRequire(import.meta.url);
 const { Loop } = require('bare-agent');
@@ -416,7 +417,14 @@ export async function selectBridge({ registry, job, ask, provider, pinned = null
   let result;
   try {
     const loop = new Loop({ provider });
-    result = await loop.run([{ role: 'user', content: prompt }], [], { maxTokens: SELECTION_MAX_TOKENS });
+    // F152/PRD 30.4 — the picker's call carried no time bound at all: a live
+    // endpoint that accepts and never answers hangs the process forever
+    // (measured elsewhere in this repo). This runs BETWEEN bridge tries, not
+    // inside any one try's own signed `perTryWallMs`, so there is no wall to
+    // derive a tighter number from — the same "no clock here" reasoning
+    // `authorscout.js` documents, and the same fallback: the idle-timeout
+    // default the run path itself uses when ITS OWN wall is unbounded.
+    result = await loop.run([{ role: 'user', content: prompt }], [], { maxTokens: SELECTION_MAX_TOKENS, timeoutMs: PROVIDER_TIMEOUT_MS });
   } catch (e) {
     // a throw out of the selection call is TRANSPORT — a casualty, and the run stops on
     // it rather than quietly drafting cold on a decision that was never made
@@ -1353,6 +1361,7 @@ export function resumeTreeGate({ head, seed, dirty }) {
  * @param {number} [opts.capRuns] forwarded
  * @param {number} [opts.strikeLimit] forwarded (a plan step's strike ceiling)
  * @param {number} [opts.closeTimeoutMs] forwarded
+ * @param {string} [opts.closeDir] forwarded (PRD item 27/M3 Part B)
  * @param {boolean} [opts.layerRoot] forwarded
  * @param {boolean|'cap'|'diff'} [opts.readShim] the read shim's ARM (A0/A1/A2/A3), forwarded verbatim
  * @param {any} [opts.resume] RESUME (module C) — a `readResume` reading of the KILLED
@@ -1371,7 +1380,7 @@ export async function runReuse(opts) {
   const {
     job, approvals, registryDir, patient, workdir, provider, selectionProvider,
     emit, ask, pinned = null, shortlist = null, forceCold = false,
-    providerFor, nativeProvider, capRuns, strikeLimit, closeTimeoutMs, layerRoot, readShim,
+    providerFor, nativeProvider, capRuns, strikeLimit, closeTimeoutMs, closeDir, layerRoot, readShim,
     runJob = shippedRunJob, now = () => Date.now(),
   } = opts;
   const runid = opts.runid ?? Date.now().toString(36);
@@ -1538,6 +1547,7 @@ export async function runReuse(opts) {
         ...(capRuns !== undefined ? { capRuns } : {}),
         ...(strikeLimit !== undefined ? { strikeLimit } : {}),
         ...(closeTimeoutMs !== undefined ? { closeTimeoutMs } : {}),
+        ...(closeDir !== undefined ? { closeDir } : {}),
         ...(layerRoot !== undefined ? { layerRoot } : {}),
         ...(readShim !== undefined ? { readShim } : {}),
         // the fold, and whether the fold is EXACT. `priorSpendComplete` used to stop at

package/src/reviewdoor.js

@@ -38,6 +38,7 @@ import { isDeclaredClose, runDeclaredStages, HITL_DECISION_RED } from './declare
 import { runStages } from './ralph.js';
 import { redactSecrets } from './validate.js';
 import { applyDoorDecision, PAUSE_TTL_MS } from './reuse.js';
+import { checkStageByteSignature } from './close-integrity.js';
 
 /** the door's own record, off the run's spine — the LAST one, because a run that
  * ends at a door writes exactly one and a reader that guesses which is which is a
@@ -92,6 +93,7 @@ const red = (code, detail, path = 'decision') => [{ code, path, detail }];
  * @param {string} opts.decision one of the three doors
  * @param {string|null} [opts.text] the rerun's words — the gap, and refused when empty
  * @param {number} [opts.closeTimeoutMs] the per-stage bound for the accept's re-run
+ * @param {string|null} [opts.closeDir] the close's own books directory (PRD item 27/M3 Part B), forwarded to the accept's re-run
  * @param {string|null} [opts.registryDir] the workflow registry, when the runner keeps one
  * @param {string|null} [opts.name] the workflow this run wrote its row against
  * @param {string|null} [opts.runid] the RUN's id, exactly as the bridge row records it
@@ -104,7 +106,7 @@ const red = (code, detail, path = 'decision') => [{ code, path, detail }];
  *   options: string[], ttlMs: number, note: string|null}>}
  */
 export async function answerReviewDoor({
-  job, workdir, events, decision, text = null, closeTimeoutMs,
+  job, workdir, events, decision, text = null, closeTimeoutMs, closeDir = null,
   registryDir = null, name = null, runid = null, at = null,
   now = Date.now, ttlMs = PAUSE_TTL_MS, emit = null,
 }) {
@@ -149,7 +151,7 @@ export async function answerReviewDoor({
   // this is the only branch that runs anything, and it runs the close's own
   // mechanical stages — never a second, weaker spelling of "is it still green".
   if (out.decision === 'accept') {
-    const proof = await proveMechanically({ job, workdir, events, closeTimeoutMs });
+    const proof = await proveMechanically({ job, workdir, events, closeTimeoutMs, closeDir });
     out.mechanical = proof.reading;
     if (!proof.ok) {
       out.reds = red('door-accept-red', proof.detail, proof.reading.stage ? `stage.${proof.reading.stage}` : 'close');
@@ -200,16 +202,24 @@ export async function answerReviewDoor({
 
 /**
  * The accept's re-proof: the close's MECHANICAL stages, run against the tree as it
- * stands now, through the SAME executors the run itself was judged by.
+ * stands now, through the SAME executors the run itself was judged by — the
+ * scripts' own bytes are verified against their signed sha256 FIRST (F135).
  *
  * The declared path measures against the run's OWN seed (`close-decl.seedRef` off
  * the spine), never a fresh one: re-basing the baseline onto today's HEAD would
  * compare the tree to itself and turn "nothing has changed since the run" into a
  * green for a `files-changed` stage that means the opposite. A run whose seed is
  * not on its spine is refused rather than guessed at.
- * @param {{job: any, workdir: string, events: any[], closeTimeoutMs?: number}} o
+ *
+ * F135 — the script BYTES are verified (`checkStageByteSignature`, PRD item 27/M2)
+ * BEFORE any stage runs, exactly the re-verify every other close execution in this
+ * runner already goes through (`runCloseStages`, `src/planrun.js`). Without it, a
+ * close script swapped on disk after the run ended but before the signer's accept
+ * would be re-run unchecked — a mismatch here never reaches the executor, and
+ * reads the same `close-tampered` shape the run-start/mid-run checks already use.
+ * @param {{job: any, workdir: string, events: any[], closeTimeoutMs?: number, closeDir?: string|null}} o
  */
-async function proveMechanically({ job, workdir, events, closeTimeoutMs }) {
+async function proveMechanically({ job, workdir, events, closeTimeoutMs, closeDir = null }) {
   const stages = mechanicalStages(closeStagesOf(job) ?? []);
   if (!stages.length) {
     // Honest, and named: a close with no mechanical stage has nothing a machine
@@ -217,6 +227,16 @@ async function proveMechanically({ job, workdir, events, closeTimeoutMs }) {
     // dressed as a re-run.
     return { ok: true, detail: '', reading: { ran: 0, verdict: null, stage: null, stages: [], note: 'this close has no mechanical stage — there is nothing a machine can re-prove, so the accept rests on the person' } };
   }
+  const sig = checkStageByteSignature(stages, workdir);
+  if (!sig.ok) {
+    const r = sig.reds[0];
+    const detail = sig.reds.map((rr) => `${rr.stage}: expected ${rr.expected.slice(0, 12)}… got ${rr.actual ? `${rr.actual.slice(0, 12)}…` : '<unreadable>'}`).join('; ');
+    return {
+      ok: false,
+      reading: { ran: 0, verdict: 'close-tampered', stage: r?.stage ?? null, stages: [] },
+      detail: `the close script's bytes no longer match its signed sha256 (close-tampered) — the accept is refused rather than re-run against a script nobody vouched for. ${detail}`,
+    };
+  }
   /** @type {any} */
   let v;
   if (isDeclaredClose(job)) {
@@ -226,7 +246,7 @@ async function proveMechanically({ job, workdir, events, closeTimeoutMs }) {
     }
     v = await runDeclaredStages(stages, redactSecrets, { timeoutMs: closeTimeoutMs, cwd: workdir, seedRef });
   } else {
-    v = await runStages(stages, redactSecrets, { timeoutMs: closeTimeoutMs, cwd: workdir });
+    v = await runStages(stages, redactSecrets, { timeoutMs: closeTimeoutMs, cwd: workdir, closeDir });
   }
   const reading = {
     ran: stages.length,