bareloop 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -5,6 +5,131 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.23.0] — 2026-09-09
+
+### Added
+
+- **`openai-api` on the provider menu, behind a provider FACTORY** (PRD item 28,
+  F149/F150/F156/F157). `src/providers.js` holds one table — provider name →
+  constructor, env key, tier models, per-model request-key gating — and both
+  runners go through it instead of naming `AnthropicProvider` directly. An
+  unknown provider name THROWS; there is no silent default. `openai-api` takes
+  an optional validated job-level `baseUrl` (https, or http on loopback only)
+  and admits ONE model, `deepseek-chat`, which earned the slot with a real paid
+  green through the shipped runner (run `mtu12vks`: green, $1.64 of $4, 10.3 of
+  30 min). DeepSeek silently ignores `max_completion_tokens`, so its table entry
+  sets bare-agent's `legacyMaxTokens` — an output cap that does not bind is a
+  money hazard. The judge stays PINNED to `anthropic-api` and `JUDGE_MODEL`
+  whatever the worker's provider is. `bareloop run` (the bundle runner) is
+  `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would have
+  needed, rather than building another provider with the wrong key.
+- **`provider` and `baseUrl` on the `job-start` spine record** (F157),
+  report-only. Without them an archive cannot separate anthropic rows from
+  `openai-api` rows, and every pooled cost or duration figure would be a
+  contaminated aggregate.
+- **`stopReason` on every `worker-round`** (BA-13, report-only, null when
+  absent, never invented).
+
+- **`runner-drained` — a `beforeExit` backstop for the absent-`job-end` class**
+  (PRD item 28's ruling (c); F140). A provider promise that never settles
+  (BA-25's class) used to let node drain and exit with NO terminal record at
+  all — no escalation, no outcome, no way to tell a silent drain from an
+  operator kill (F140: 10-of-235 archived spines with no `job-end`, one real
+  silent death). bare-agent 0.42 closed the known drop cases (F141), but the
+  class itself is "an instrument fires on absence," not a specific bug, so
+  the backstop stays needed. `runJob` (`src/run.js`) now registers ONE
+  `process.once('beforeExit', …)` right after `job-start`, tracked via a
+  local `ended` flag every `job-end` site sets; if the process still drains
+  with no `job-end`, it mints one with outcome `runner-drained`,
+  `spendComplete:false` (a drained run's in-flight spend is unknowable — the
+  floor already banked is honest, F6), and sets `process.exitCode` non-zero
+  (never `process.exit()`). The listener is removed in a `finally` so a
+  normal run never leaks it. `runner-drained` is a new terminal outcome,
+  documented in `bareloop.context.md`'s outcomes list — deliberately **not**
+  added to the resumable/checkpoint set (`CHECKPOINT_OUTCOMES`, `src/reuse.js`):
+  an unknown in-flight state is not a known-safe resume point.
+
+- **Bounded 429 retry — a FALLBACK, not the primary answer** (PRD item 28's
+  parked a/b ruling, hamr verbatim: "do a/b as a fallback, and verify/validate
+  + no regression"; F143). A vendor HTTP 429 used to end the whole run as
+  `provider-red`, discarding all completed work, even though the vendor's own
+  response states exactly how long to wait. `src/ratelimit.js` (new,
+  `transport.js`'s sibling) adds ONE bounded retry that honours that stated
+  delay, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS`) — a wait longer than that is
+  not honoured at all. Wired into `src/planrun.js`'s provider-retry seam
+  (`withTransportRetry` renamed `withProviderRetries`) as a SECOND,
+  independent one-shot budget alongside the existing F115 transport retry;
+  the wall always wins (no retry past the deadline); each retry emits a
+  report-only `rate-limit-retry` spine record and does NOT floor
+  `spendComplete` (a 429 is a refusal — nothing was billed — unlike a
+  transport throw). **The primary answer stays the primary answer**: picking
+  a worker model with adequate rate headroom (F139/F143's measured TPM
+  table) — this retry only softens the failure mode when that was not
+  followed or headroom was still exceeded.
+
+### Changed
+
+- Bumped `bare-agent` pin from `^0.39.0` to `^0.42.0`. 0.42.0 brings: BA-24 —
+  `OpenAIProvider` now sends `max_completion_tokens` by default (GPT-5-safe),
+  with a new `legacyMaxTokens` option to send the legacy `max_tokens` key
+  instead; BA-25 — a response body cut after headers (peer `'aborted'`,
+  stream `'error'`, or a premature `'close'` before `'end'`) now REJECTS
+  `generate()` with a retryable `ProviderError` (`context.bound:'transport'`)
+  instead of leaving the promise pending forever; a new `loop:truncated`
+  stream event plus `stopReason` on the `onLlmResult` metering payload; and
+  `options.toolChoice` on `OpenAIProvider`.
+
+### Fixed
+
+- **F154** — every provider call bareloop makes now carries a deadline. Seven
+  sites had none: the softgreen judge, the calibration gate, the authoring
+  scout's three rounds, the declaration/revise boundary, and the bridge picker.
+  A silent endpoint HANGS the process (an open socket is an active handle, so
+  the drain backstop cannot see it); a deadline is the only instrument that
+  fires on the absence of events. Tighten-only.
+- **F155** — the judged floor graded whatever LOCATE reported, so a silently
+  omitted function passed on the subset. `decide()` now diffs the artifact's own
+  top-level functions against the reported set and reds, naming what was
+  missing. The declaration shapes live ONCE (`FN_SHAPES`), from which both the
+  locate prompt's prose and the detector are derived.
+- **F153** — a provider's own error sentence now reaches the operator instead of
+  a bare status number, redacted through the one secret inventory and capped.
+- **F151** — the bounded 429 retry, added last release, fired on a real vendor
+  429 for the first time: it parsed the stated wait from prose, waited it, and
+  retried once. Mechanism proven; on a TPM-saturated model the retry is not
+  expected to recover, and did not.
+- **F147** — the F59 scout summary round (and the authoring scout's recovery
+  round, the same shape in `src/authorscout.js`) re-fed a transcript bare-agent
+  had already system-prepended into a new `Loop.run()`, which prepended the
+  persona AGAIN: two identical system messages at index 0/1. Real OpenAI
+  tolerates that; vLLM-class OpenAI-compatible backends reject it (HTTP 400
+  "System message must be at the beginning" — the Qwen death F146 left
+  unexplained). Both sites now strip the leading system message before
+  continuing, as bare-agent's own `Loop.chat()` does. Proven live: the captured
+  failing request goes 400 → 200 with one line removed; deepseek-chat then
+  greened a full job (F149/F150).
+- **F141** — `src/transport.js`'s `isTransportFailure` now also recognizes
+  bare-agent's own BA-25 transport classification
+  (`err.context.bound === 'transport'`), after the existing HTTP-status and
+  `retryable:false` guards. Before this fix, the exact class hamr's F115
+  one-retry ruling names — a call that dies mid-read, no full response —
+  would have ended provider-red with no retry once the 0.42.0 pin landed,
+  because the new rejection shape carried none of the signals the classifier
+  previously looked for (no `status`, `retryable:true`, no matching error
+  code/message). Retry budget unchanged: `TRANSPORT_RETRIES = 1`.
+- **Review door refuses `close-timing-red` instead of defaulting the close timeout**
+  (F137, `docs/product/CLOSE-INTEGRITY-BUILD.md` "Ruled 2026-09-07", found by
+  orchestrator review of M3, run `mtqwmb9l`). `scripts/run-u.mjs`'s `accept` door path
+  resolved the mechanical re-run's close timeout via `resolveCloseTimeoutMs` and, when
+  that timing pass itself timed out, silently fell through to `closeTimeoutMs:
+  undefined` — the library's 120s default — substituting an unauthorized ceiling for a
+  door decision, the exact second silent-default class M3 was built to remove one door
+  up. A door whose own timing pass times out now REFUSES outright as a named
+  `close-timing-red` door stop (same wording/options as the in-run escalation, new pure
+  renderer `doorTimingRedLines` in `scripts/u-readout.mjs`): `answerReviewDoor` is never
+  called, nothing is recorded (no door record), nothing is released, nothing is spent,
+  and the process exits non-zero.
+
 ## [0.22.0] — 2026-09-07
 
 ### Added

package/README.md

@@ -82,7 +82,7 @@ A signed job spec goes in. A verdict comes out.
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1',

package/bareloop.context.md

@@ -70,6 +70,19 @@ inherited rule carries the green that minted it and the contrast that attributed
   with `anthropic-api` on cost, and budgets don't transfer between them.
   `job.provider === 'clipipe-subscription'` with no `nativeProvider` supplied is
   `interpreter-red`, never a silent fall-back to the metered API (`src/planrun.js:1073`).
+  `provider: 'openai-api'` (PRD item 28) takes the ordinary `Loop` path against an
+  OpenAI-shaped endpoint, reads `OPENAI_API_KEY`, and accepts an optional job-level
+  `baseUrl` (https, or http on loopback only; credentials in the URL are a red). Its one
+  admitted model is `deepseek-chat`, which earned the slot with a real paid green — no
+  endpoint or model enters the menu without its own clean paid probe. The provider table
+  lives in `src/providers.js` (`resolveProvider`/`makeProvider`/`buildRunnerProviders`);
+  an unknown provider name THROWS there, it never falls back to a default. Per-model
+  request-key gating lives in that table: `deepseek-chat` sets bare-agent's
+  `legacyMaxTokens`, because DeepSeek silently ignores `max_completion_tokens` and an
+  output cap that does not bind is a money hazard. The JUDGE stays pinned to
+  `anthropic-api` and `JUDGE_MODEL` whatever the worker's provider is. The bundle runner
+  (`bareloop run`) is `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would
+  have needed, rather than constructing another provider with the wrong key.
 - **Reuse — where a workflow comes from:** a plain `runJob` always drafts cold. Passing
   `bridge` starts from one standalone bridge file (`src/reuse.js`'s envelope, `## The reuse
   ENVELOPE and runReuse` below). The CLI's `--registry <dir>` / library-level `registryDir`
@@ -85,7 +98,7 @@ inherited rule carries the green that minted it and the contrast that attributed
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1', job: 'my-maintainer',
@@ -130,7 +143,7 @@ minting claim, or the shell-owned retry cap — all unknown-field reds.
 |---|---|---|
 | `job` | kebab-case slug | |
 | `description` | non-empty string | |
-| `provider` | `anthropic-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
+| `provider` | `anthropic-api` \| `openai-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-chat` today — see "Worker surface" above for its `baseUrl` field and per-model gating; `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
 | `conditions` | `{ providerPath?, closeVerbosity?, taskFraming?, scaffold? }` | declared keys only, string values — the environment label (consumed by the N3 lineage key; recorded on spines from run one) |
 | `cadence` | `{ unit: hour\|day\|week, every: 1..30 }` | validated now, consumed at N5 (Scheduler) |
 | `budgetUsd` | `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
@@ -1008,7 +1021,18 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
 plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
 provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | hitl-pause |
-hitl-decision-red | step-red:<id>`.
+hitl-decision-red | step-red:<id> | runner-drained`.
+
+**`runner-drained` (F140/PRD item 28(c))** is a distinct class from every outcome above: it is
+NOT `runJob`'s own return value, it is a `beforeExit` backstop's terminal, emitted from outside
+the normal control flow the instant node drains with no `job-end` at all — a provider promise
+that never settled (BA-25's class; bare-agent 0.42.0 closed the known drop cases per F141, but
+"an instrument fires on absence" stays a permanent class, not a fixed bug). It means: exits
+non-zero, `spendComplete:false` always (a drained run's in-flight spend is unknowable — the
+floor already banked is honest, an exact-looking total would not be, F6). **It is deliberately
+NOT in the resumable/checkpoint set** (`CHECKPOINT_OUTCOMES`/`RESUMABLE_HALTS`, `src/reuse.js`)
+— an unknown in-flight state, unlike a clean `cap-halt`/`wall-halt`/`provider-red`, is not a
+known-safe resume point.
 
 **`readShim` (default `false`) — the capped read seam, per ARM.** The value names which levers
 run — the four arms of the frozen Phase 2 pre-registration:
@@ -1191,17 +1215,36 @@ round of this attempt being priced repairs nothing about the one before it); and
 reporting with the rest end of gate"). Every worker Loop (scout, drafter, each step, the fix
 worker — the ONE seam in `planrun.js`) gets exactly ONE extra attempt, and only for a
 transport-class throw — fetch itself throwing with no HTTP response at all (a TLS fault,
-`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause); an HTTP response
-(4xx/5xx/429) is never retried here and rides bare-agent's own unchanged policy. The budget is
-fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob, tighten-only
-doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase, attempt, error,
-recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw before any usage
-figure came back, so **any** transport retry floors `spendComplete` for the rest of the run even
-when the retry recovers and the run finishes green — the same one-way flag class as `stalled`
-and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
+`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause), OR (bare-agent
+0.42.0, BA-25) a response body cut after headers but before it completed — the provider's own
+`guardResponseSettles` rejects that as a retryable `ProviderError` tagged
+`context.bound:'transport'`, which `isTransportFailure` also recognizes (F141). An HTTP response
+(4xx/5xx generally) is never retried here and rides bare-agent's own unchanged policy. The budget
+is fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob,
+tighten-only doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase,
+attempt, error, recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw
+before any usage figure came back, so **any** transport retry floors `spendComplete` for the rest
+of the run even when the retry recovers and the run finishes green — the same one-way flag class
+as `stalled` and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
 so it stays exact. Both fields are present on all outcomes, so a consumer never branches on
 field presence and never has to launder a missing `spentUsd` into `$0`.
 
+A **rate-limit retry** (PRD item 28's parked a/b ruling, hamr verbatim: "do a/b as a fallback, and
+verify/validate + no regression"; F143/`src/ratelimit.js`) rides the SAME seam as a second,
+INDEPENDENT one-shot budget: an HTTP 429 gets ONE retry that honours the vendor's own stated
+wait, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS` — a longer stated wait is not honoured at all, no
+retry). This is a FALLBACK, not the primary answer — the primary answer (F139) is picking a
+worker model with adequate rate headroom; this only softens the failure mode when that was not
+enough. The wall always wins here too: before sleeping, a retry that would cost more than
+`clock.remainingMs()` is refused and the error rides straight through, exactly like the transport
+ladder's own wall carve-out. Each retry emits a report-only `rate-limit-retry` spine record
+(`{phase, attempt, statedMs, waitedMs, error, recovered}`, no cost field). Unlike the transport
+retry, a rate-limit retry does **not** floor `spendComplete`: a 429 is a REFUSAL — the vendor
+rejected the request before processing it, so nothing can have been billed (a stated assumption,
+not independently measured against a real provider). The two budgets are independent — a
+transport throw and a 429 may both occur, and both retry, across one call's lifetime, but each at
+most once.
+
 **The plan flow (Layer 2).** `job-start` carries `shape: 'plan'` + the goal; plan steps are
 tool-mode by construction. The flow (`runPlan`, also exported for direct callers who own
 their own ledger): **close precheck** (`already-green` is a
@@ -1645,7 +1688,11 @@ that moved (`door-accept-red`) and a missing registry all come back as named red
   a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
   answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
   stage named and records **nothing**. A pass records the disposition and, over a held judged
-  green, RELEASES the credit through module 6's `applyDoorDecision`.
+  green, RELEASES the credit through module 6's `applyDoorDecision`. `scripts/run-u.mjs` resolves
+  the re-run's ceiling itself via `resolveCloseTimeoutMs` before calling this, and refuses outright
+  (F137) as a named `close-timing-red` door stop — `answerReviewDoor` never called, nothing
+  recorded — if that timing pass itself times out, rather than falling through to `runClose`'s
+  library default.
 - **`rerun`** carries the person's words back as a directive (`next: 'rerun'`) and re-proves
   nothing: the new run's close is what judges. Empty or whitespace text is refused at the same
   seam every other door is.
@@ -2677,7 +2724,7 @@ hash and needs re-approval, exactly like any other semantic edit.
 | `close-sha-mismatch` | `exportBundle` (PRD item 27/M2) | a `close[].sha256` the spec carries does not match the bytes of the script actually being packed into the bundle — the two signatures (this one, and `bundleHash`'s manifest hash over the rewritten script) cover the same bytes by two different paths and must never drift apart silently (N4's own hazard, one layer up). Only fires when a value is PRESENT and wrong; a spec with no sha256 at all reds `missing-required` upstream, at `validateJob` |
 | `close-tampered` | `runPlan` (PRD item 27/M2) | a close script's bytes no longer match its signed `sha256` — checked at run start (alongside `close-absolute-path`, before the close-first precheck and before any provider call) AND before EVERY close run thereafter (`runCloseStages`'s wrapper in `src/planrun.js`, the one seam the precheck/preflight/check-passes/close-fix-loop all share). Distinct from `close-red` (a judged "no" from a working close) and from `close-crashed`/`close-timeout`/`close-killed` (the close ran and hit an instrument fault): this is decided BEFORE the close is even spawned, and it means the close that ran would not have been the one the operator approved. Registered in `CLOSE_FAULTS` (`src/ralph.js`) so it rides out through the same forbidden-zone machinery as every other close fault — never retried, never fed back as a gap |
 | `close-dir-required` | `runPlan` (PRD item 27/M3 Part B) | a close script's source mentions `BARELOOP_CLOSE_DIR` (it reads its own books directory) but the runner was given no `closeDir` at all — `checkCloseDirRequired` (`src/close-integrity.js`) reuses the same `readCloseScripts` reader the other two integrity checks share. $0, run start, before the close-first precheck and before any provider call |
-| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely) |
+| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely). `scripts/run-u.mjs`'s review door hits the SAME red on its own `accept` timing pass (F137) — it refuses the door outright rather than calling `answerReviewDoor` at all, so nothing is recorded |
 | `wall-under-close-timeout` | `runPlan` (PRD item 27/M3) | `job.maxWallMs` is set and is under the EFFECTIVE per-stage close timeout just resolved (autoset or signed) — a budget under one close cannot fund its own close. `validateJob`'s own `MIN_WALL_MS` floor only bounds the un-autoset library default; this run-start check is the honest shape once the real ceiling is known, rather than a silent clamp |
 | `bundle-missing` | `readBundle` | `dir` is not a directory at all |
 | `manifest-invalid` / `spec-invalid` | `readBundle` | `manifest.json`/`spec.json` could not be read or parsed |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",
@@ -26,7 +26,7 @@
     "prepublishOnly": "npm run build:types"
   },
   "dependencies": {
-    "bare-agent": "^0.39.0",
+    "bare-agent": "^0.42.0",
     "bareguard": "^0.13.0",
     "litectx": "^0.32.0"
   },

package/src/authorflow.js

@@ -82,7 +82,7 @@ import {
   GENRE_LANGUAGES, TYPES_GENRE_TEMPLATE, classGuards, genreEnv, genreOwnedEnvNames, genreInstruments,
   validateDeclaration, envCapableKind, classMenu, VERDICT_CLASSES, LIVE_CLASSES,
 } from './authoring.js';
-import { buildSeedListing, cleanEntry, SURVEY_CAUSES } from './authorscout.js';
+import { buildSeedListing, cleanEntry, SURVEY_CAUSES, AUTHOR_CALL_TIMEOUT_MS } from './authorscout.js';
 import { extractArtifact, priceOf, scrubRaw, tallyCalls, capStop } from './text.js';
 import { redactSecrets } from './validate.js';
 
@@ -1147,7 +1147,12 @@ export function makeLoopGenerate(provider, { system = AUTHOR_SYSTEM, maxTokens =
       ...t,
       execute: async (/** @type {any} */ a) => { const r = await t.execute(a); loop.stop(); return r; },
     }));
-    return loop.run(messages, wired, { cacheMessages: true, maxTokens, ...opts });
+    // F152/PRD 30.4 — the SAME idle bound `authorscout.js` reuses (this pipeline
+    // has no wall clock of its own): a live endpoint that accepts and never
+    // answers hangs the process forever otherwise. `...opts` still spreads AFTER
+    // it, so a caller that ever needs a tighter number for one call may pass it —
+    // tighten-only, and nothing does today.
+    return loop.run(messages, wired, { cacheMessages: true, maxTokens, timeoutMs: AUTHOR_CALL_TIMEOUT_MS, ...opts });
   };
 }
 

package/src/authorscout.js

@@ -55,11 +55,37 @@ import { TOOL_MENU, WRITE_VERBS, STORE_VERBS } from './job.js';
 import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, strategyFor } from './tools.js';
 import { redactSecrets, SECRET_PATTERNS } from './validate.js';
 import { extractArtifact, priceOf, scrubRaw, stampRaw, tallyCalls, capStop } from './text.js';
+import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 const require = createRequire(import.meta.url);
 const { Loop, wireGate } = require('bare-agent');
 const { createShellTools } = require('bare-agent/tools');
 
+/**
+ * F152/PRD 30.4 — the scout's per-call IDLE bound. Every `loop.run()` in this
+ * module carried NO time bound at all: a live endpoint that accepts and never
+ * answers hangs the process forever (measured) — an open socket is an active
+ * handle, so node never drains and no backstop can fire.
+ *
+ * UNLIKE the run path (`callBounds()`, src/planrun.js:1518), this pipeline has
+ * NO wall clock to derive a bound FROM — the authoring pipeline is genuinely
+ * clockless (`src/authorjob.js`/`src/authorflow.js`/`scripts/run-author.mjs`
+ * carry a money ceiling, `ceilingUsd`/`capStop`, and never a `maxWallMs`).
+ * Rather than inventing a fresh number, this reuses the EXACT ceiling the run
+ * path itself falls back to when ITS OWN wall is unbounded
+ * (`PROVIDER_TIMEOUT_MS`, `src/clock.js` — BA-18's idle timeout, already an
+ * approved "no wall present" default one layer up): an authoring-time call is
+ * the identical situation, one call earlier.
+ *
+ * It bounds SOCKET INACTIVITY only (reset by every byte, per BA-18) — a call
+ * that is merely slow keeps streaming and is untouched; only a truly silent
+ * endpoint trips it. TIGHTEN-ONLY, like every cap in this file: this is an
+ * operator-set ceiling fixed here, not a param a caller or a signed spec may
+ * widen (a defaulted cap is a silent second ceiling, and there is no clock
+ * whose narrower reading could ever tighten it further).
+ */
+export const AUTHOR_CALL_TIMEOUT_MS = PROVIDER_TIMEOUT_MS;
+
 /** src/planrun.js:42 — the survey's hard round bound. */
 export const AUTHOR_SCOUT_ROUNDS = 8;
 /** src/planrun.js:44 — the survey is a PROMPT INGREDIENT for the authoring call. */
@@ -348,7 +374,7 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider
  *
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
- *   attempts?: number, ceilingUsd?: number|null,
+ *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any}) => any,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -365,10 +391,18 @@ export async function runAuthorScout({
   ctx = true,
   attempts = SCOUT_ATTEMPTS,
   ceilingUsd = null,
+  // F152/PRD 30.4 — TIGHTEN-ONLY, the same clamp shape `attempts` carries just
+  // below: an operator (a test included) may buy a SHORTER idle bound and never
+  // a longer one. A garbage/absent value floors at the module ceiling
+  // (`AUTHOR_CALL_TIMEOUT_MS`), never at "no bound at all".
+  callTimeoutMs = AUTHOR_CALL_TIMEOUT_MS,
   onCall = () => {},
   createLoop = defaultLoop,
   createSurveyor = defaultSurveyor,
 }) {
+  const callTimeout = Number.isFinite(Number(callTimeoutMs)) && Number(callTimeoutMs) > 0
+    ? Math.min(Math.trunc(Number(callTimeoutMs)), AUTHOR_CALL_TIMEOUT_MS)
+    : AUTHOR_CALL_TIMEOUT_MS;
   const granted = AUTHOR_SCOUT_VERBS;
   const system = SCOUT_SYSTEM + strategyFor([...granted]);
   const surveyor = await createSurveyor({ workdir, granted, ctx });
@@ -404,6 +438,33 @@ export async function runAuthorScout({
   // an ABSENT nobody can act on.
   const allowed = Math.max(1, Math.min(Math.trunc(Number(attempts)) || 1, SCOUT_ATTEMPTS));
 
+  /**
+   * F152/PRD 30.4 — ONE call seam for every `loop.run()` below, so a REJECTED
+   * call (a `TimeoutError` off `AUTHOR_CALL_TIMEOUT_MS` included — bare-agent
+   * 0.42 rejects every known transport/idle-timeout casualty, F141) lands in the
+   * SAME place a call that merely RESOLVED with an error already did: as an
+   * `{error}` shape, read by `record()` (cost null, same as a `provider-red`
+   * locate call — a rejected call has no knowable cost) and by `classifySurvey`
+   * under the EXISTING `call-failed` cause. Without this seam a rejection would
+   * escape uncaught to `run-author.mjs`'s top-level crash handler instead of the
+   * honest, already-typed terminal this module was built to report through.
+   * @param {Promise<any>} p @returns {Promise<any>}
+   */
+  const settled = async (p) => {
+    try { return await p; } catch (e) {
+      // ONLY the call's own deadline lands here. Swallowing every throw would
+      // launder a budget HaltError, a programming bug, or any other named
+      // terminal into "the survey call failed" — the exact class of dishonesty
+      // this repo refuses (an unknown reported as a known). A timeout is the one
+      // throw this seam exists for: it IS a call that produced nothing, which is
+      // what `call-failed` already means. Everything else re-raises and is
+      // relayed after cleanup, as it was before this seam existed.
+      const err = /** @type {any} */ (e);
+      if (err?.code !== 'ETIMEDOUT' && err?.name !== 'TimeoutError') throw e;
+      return { error: String(err?.message ?? err) };
+    }
+  };
+
   try {
     /** @type {Survey|null} */
     let survey = null;
@@ -455,8 +516,8 @@ export async function runAuthorScout({
         };
         loop = createLoop({ system, policy: surveyor.policy, onLlmResult: metered, provider });
 
-        const r = await loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
-          { cacheMessages: true, maxTokens });
+        const r = await settled(loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
         verdictAt = record(label, attempt, r);
         blob = redactSecrets(String(r?.text ?? '')).slice(0, blobMax);
         lastMsgs = Array.isArray(r?.msgs) && r.msgs.length ? r.msgs : null;
@@ -493,8 +554,16 @@ export async function runAuthorScout({
         if (recoveryHalt) budgetStop = recoveryHalt;
         if (recoveryWanted && !recoveryHalt) {
           const recovery = createLoop({ system, policy: surveyor.policy, onLlmResult: surveyor.onLlmResult, provider });
-          s2 = await recovery.run([...r.msgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
-            { cacheMessages: true, maxTokens });
+          // F147 (second instance; sibling fix: src/planrun.js `askFrom`, commit
+          // 031ffe1): `r.msgs` is a prior `loop.run()`'s returned transcript,
+          // which bare-agent already prepended `system` to (Loop.run, loop.js
+          // ~482-486). `recovery` below is built with the same `system` and
+          // would prepend it again, leaving two identical system messages at
+          // index 0/1 — real OpenAI tolerates it, vLLM-class OpenAI-compatible
+          // backends 400 on it. Strip the leading one before re-running.
+          const rMsgs = r.msgs[0]?.role === 'system' ? r.msgs.slice(1) : r.msgs;
+          s2 = await settled(recovery.run([...rMsgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
+            { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
           const recoveryAt = record('author-scout-recovery', attempt, s2);
           const t = redactSecrets(String(s2?.text ?? '')).slice(0, blobMax);
           // the verdict follows the blob that WON, never the call that came last
@@ -518,10 +587,15 @@ export async function runAuthorScout({
         // THE RE-ASK. Toolless by construction, over the survey's own
         // conversation, naming only what failed mechanically.
         const reask = createLoop({ system, policy: surveyor.policy, onLlmResult: surveyor.onLlmResult, provider });
-        const rr = await reask.run(
-          [...lastMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
-          { cacheMessages: true, maxTokens },
-        );
+        // F147 (second instance; sibling fix: src/planrun.js `askFrom`, commit
+        // 031ffe1): `lastMsgs` is a prior `loop.run()`'s returned transcript
+        // (system already prepended by bare-agent); `reask` is built with the
+        // same `system` and would prepend it again. Strip the leading one.
+        const askMsgs = lastMsgs[0]?.role === 'system' ? lastMsgs.slice(1) : lastMsgs;
+        const rr = await settled(reask.run(
+          [...askMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout },
+        ));
         verdictAt = record(label, attempt, rr);
         blob = redactSecrets(String(rr?.text ?? '')).slice(0, blobMax);
         if (Array.isArray(rr?.msgs) && rr.msgs.length) lastMsgs = rr.msgs;

package/src/calibrate.js

@@ -63,6 +63,7 @@ import {
 } from './judged.js';
 import { JUDGE_ATTEMPTS } from './kinds.js';
 import { tallyCalls } from './text.js';
+import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 /** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
 
@@ -330,6 +331,15 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
       card,
       loopFactory: /** @type {any} */ (judgeLoop),
       attempt,
+      // F152/PRD 30.4 — this module's own header already names the hazard ("a
+      // dead socket") as one of its three CASUALTY readings, but with no bound
+      // at all a truly silent judge endpoint never reaches that reading — it
+      // hangs the authoring process forever instead (measured). The gate runs
+      // at draft/sign time, which has no wall clock to derive a bound from (the
+      // authoring pipeline's only ceiling is money, `ceilingUsd`/`capStop`), so
+      // this reuses the same idle-timeout default the run path falls back to
+      // when ITS OWN wall is unbounded (`PROVIDER_TIMEOUT_MS`, src/clock.js).
+      callBounds: { timeoutMs: PROVIDER_TIMEOUT_MS },
       onCost: (c) => meter({
         id, kind, attempt, label: CALIBRATION_LABEL, model: JUDGE_MODEL,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,

package/src/cli.js

@@ -19,7 +19,6 @@
 // run, never the unresolved bundleHash. `history.jsonl` records both hashes
 // side by side (POC fact 2) so the pairing can never drift silently.
 
-import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline/promises';
 import { hostname } from 'node:os';
 import { execFileSync } from 'node:child_process';
@@ -34,15 +33,13 @@ import {
   exportBundle, readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps,
   runJob, makeSpine, loadRegistry, listingRow, jobSpecHash, resolveWorkerModel, JUDGE_MODEL,
 } from './index.js';
+import { resolveProvider, buildRunnerProviders } from './providers.js';
 
-const require = createRequire(import.meta.url);
-
-// The runner's own tier menu, the same spelling `scripts/run-u.mjs` uses (not
-// exported from `src/` — the tier->model mapping is runner territory, not the
-// library's). A `bareloop run` has no `--model` flag (not in the frozen
-// spec), so `flagModel` is always undefined and only the spec's own `model`
-// (if signed) or this default is ever in play.
-const DEFAULT_TIER_MODELS = { sonnet: 'claude-sonnet-5', haiku: 'claude-haiku-4-5-20251001' };
+// The tier->model tables live in `src/providers.js` now (PRD item 28's
+// factory) — one seam instead of a copy hardcoded in each runner. A
+// `bareloop run` has no `--model` flag (not in the frozen spec), so
+// `flagModel` is always undefined below and only the spec's own `model`
+// (if signed) or the resolved provider's default tier is ever in play.
 
 /** @param {unknown} v @returns {v is Record<string, any>} */
 const isObj = (v) => typeof v === 'object' && v !== null;
@@ -58,20 +55,38 @@ const isObj = (v) => typeof v === 'object' && v !== null;
  * @param {any} spec the (already `$BARELOOP_BUNDLE`-resolved) bundle spec
  */
 function buildProviders(apiKey, spec) {
-  const { AnthropicProvider } = require('bare-agent/providers');
+  // `bareloop run`'s frozen key contract (module header above) is
+  // ANTHROPIC_API_KEY only — this `apiKey` is always that key. A bundle
+  // whose spec names a provider that reads a DIFFERENT env key therefore
+  // has no seam into this flow yet, and the one thing this must never do is
+  // construct that provider with the Anthropic key: the run would fail at
+  // the first call with a vendor 401, which reads as a credential problem
+  // rather than as the unbuilt seam it actually is. So it REFUSES here, at
+  // $0, naming the key it would have needed. Widening the contract (a
+  // signed per-provider key story) is PRD item 28 part (2)/(3), the
+  // arbiter's, not this factory rewire's — the runner that actually fires
+  // openai-api jobs today is `scripts/run-u.mjs`, which IS key-aware.
+  const providerName = isObj(spec) && typeof spec.provider === 'string' ? spec.provider : 'anthropic-api';
+  const entry = resolveProvider(providerName);
+  if (entry.envKey !== 'ANTHROPIC_API_KEY') {
+    throw new Error(
+      `bareloop run: this bundle's spec names provider "${providerName}", which reads `
+      + `${entry.envKey}. The bundle runner's key contract is ANTHROPIC_API_KEY only, so it `
+      + 'refuses rather than calling that provider with the wrong key (PRD item 28 part 2 — '
+      + 'a signed per-provider key story is not built). Run this job through scripts/run-u.mjs.',
+    );
+  }
   const modelResolution = resolveWorkerModel({
     specModel: isObj(spec) && typeof spec.model === 'string' ? spec.model : undefined,
     flagModel: undefined,
-    defaultModel: DEFAULT_TIER_MODELS.sonnet,
+    defaultModel: entry.tiers.sonnet,
   });
   const MODEL = modelResolution.model;
-  const provider = new AnthropicProvider({ apiKey, model: MODEL });
-  const TIER_MODELS = modelResolution.source === 'spec' ? { ...DEFAULT_TIER_MODELS, sonnet: MODEL } : DEFAULT_TIER_MODELS;
-  /** @type {Record<string, any>} */
-  const tierCache = {};
-  const providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= (TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)] === MODEL ? provider : new AnthropicProvider({ apiKey, model: TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)] })));
-  const judgeProvider = new AnthropicProvider({ apiKey, model: JUDGE_MODEL });
-  return { provider, providerFor, judgeProvider };
+  const tierModels = modelResolution.source === 'spec' ? { ...entry.tiers, sonnet: MODEL } : entry.tiers;
+  const baseUrl = isObj(spec) && typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined;
+  return buildRunnerProviders({
+    providerName, apiKey, model: MODEL, tierModels, baseUrl, judgeApiKey: apiKey, judgeModel: JUDGE_MODEL,
+  });
 }
 
 /** @param {string[]} args @returns {{ positional: string[], flags: Record<string, string|true> }} */
@@ -230,7 +245,13 @@ async function doRun(args, { out, err, cwd, env, now, deps }) {
       out(`bundleHash: ${bundle.manifest.bundleHash}`);
       return 0;
     }
-    ({ provider, providerFor, judgeProvider } = buildProviders(apiKey, bundle.spec));
+    try {
+      ({ provider, providerFor, judgeProvider } = buildProviders(apiKey, bundle.spec));
+    } catch (e) {
+      // a refusal from the key contract above: name it and spend nothing
+      err(String(/** @type {any} */ (e)?.message ?? e));
+      return 1;
+    }
   }
 
   // 4. blessing.

package/src/declaredclose.js

@@ -567,13 +567,14 @@ function translate(r, redact) {
  *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
  *   humanRuling?: {decision: string, text?: string|null}|null,
  *   judgeLoop?: ((o: {system: string}) => any)|null,
- *   onJudgeCost?: ((c: any) => void)|null}} [opts]
+ *   onJudgeCost?: ((c: any) => void)|null,
+ *   callBounds?: (() => {timeoutMs?: number, deadlineMs?: number})|null}} [opts]
  * @returns {Promise<any>}
  */
 export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
   const {
     timeoutMs, cwd, seedRef, seedTrees: shared, gapCap, maxBuffer, baselineMode, humanRuling = null,
-    judgeLoop = null, onJudgeCost = null,
+    judgeLoop = null, onJudgeCost = null, callBounds = null,
   } = opts;
   if (!isNonEmptyString(cwd) || !isNonEmptyString(seedRef)) {
     // Refuse rather than guess. A declared close measures against a SEED; a
@@ -611,6 +612,12 @@ export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
     // until this kind, and a budget must fund the attempt PLUS its close.
     judgeLoop,
     onJudgeCost,
+    // F152/PRD 30.4 — the SAME per-call time bounds every worker round already
+    // carries (`callBounds()`, src/planrun.js:1518), so the judged stage's own
+    // locate call cannot hang the process on a live silent endpoint. `null` is
+    // the honest absence (an adopter/test that wires no clock through), never a
+    // defaulted number invented here.
+    callBounds,
     seedTrees,
   };
   try {