bareloop 0.22.0 → 0.23.0

package/src/providers.js

@@ -0,0 +1,176 @@
+// Provider factory (PRD item 28, shape (1)): ONE seam mapping a job spec's
+// `provider` name to the bare-agent constructor it drives, the env var
+// carrying its key, and the per-tier model table — including any
+// provider-specific request-key gating. Before this module existed, both
+// runners constructed `AnthropicProvider` BY NAME (`src/cli.js`'s
+// `buildProviders`, `scripts/run-u.mjs`'s top-level wiring) and any second
+// provider would have meant scattering `if (provider === …)` across both.
+//
+// hamr's ruling (PRD 30.7, 2026-09-09): `deepseek-chat` is THE secondary
+// provider — "settle on one secondary/replacement for claude … don't
+// pickpocket random models". This table is not a menu of half-tested
+// models; it is exactly the two provider identities the PROVIDERS menu
+// (`src/job.js`) admits.
+//
+// What this module is NOT: it never picks a judge (the judge stays pinned
+// to `anthropic-api`/`JUDGE_MODEL` regardless of the job's worker provider —
+// arbiter territory, PRD item 28), never prices a round (F113: rates
+// passthrough is dead), and never decides a budget. It only constructs the
+// provider objects `bare-agent`'s `Loop` calls.
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { AnthropicProvider, OpenAIProvider } = require('bare-agent/providers');
+
+/**
+ * Today's anthropic-api tier table — EXACTLY the `DEFAULT_TIER_MODELS` both
+ * runners hardcoded before this factory existed. Any change to these two
+ * values is a change to shipped anthropic-api behaviour, not a refactor.
+ */
+export const ANTHROPIC_TIER_MODELS = Object.freeze({
+  sonnet: 'claude-sonnet-5',
+  haiku: 'claude-haiku-4-5-20251001',
+});
+
+/**
+ * DeepSeek (F149/F150) is a SINGLE model, not a tiered family — hamr's
+ * ruling above: one secondary provider, not a menu. Both tiers map to the
+ * same model id ON PURPOSE: `resolveWorkerModel`/a runner's `providerFor
+ * (tier)` only ever LOOK UP a tier's model id (src/job.js:818-827,
+ * scripts/run-u.mjs's `providerFor`) — neither assumes the tiers name
+ * different models — so repeating the one id is the honest representation
+ * of a single-model provider, not a second model masquerading as `haiku`.
+ * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
+ * cheaper tier model, this is where it would earn its own `haiku` id.
+ */
+export const OPENAI_TIER_MODELS = Object.freeze({
+  sonnet: 'deepseek-chat',
+  haiku: 'deepseek-chat',
+});
+
+/**
+ * Per-MODEL request-key gating (F149, live-measured 2026-09-09): DeepSeek
+ * silently IGNORES the modern `max_completion_tokens` key — asked for 64
+ * output tokens, it returned 665/608 — and only honours the legacy
+ * `max_tokens` key. `bare-agent`'s `OpenAIProvider` already exposes the
+ * switch (`legacyMaxTokens`, BA-24; no model-name sniffing inside
+ * bare-agent itself — "the caller declares the dialect"), so THIS table is
+ * bareloop's routing of it, keyed per model, never a global default. An
+ * output cap that does not bind is a money hazard: a reasoning model can
+ * run to its own ceiling on every round, silently, so getting this wrong
+ * for even one model defeats every budget that model's tier sets.
+ *
+ * A model with no entry here gets `{}` — bare-agent's own default
+ * (`max_completion_tokens`, GPT-5-safe) applies, unmodified.
+ */
+const OPENAI_MODEL_OPTIONS = Object.freeze({
+  'deepseek-chat': Object.freeze({ legacyMaxTokens: true }),
+});
+
+/**
+ * @typedef {object} ProviderTableEntry
+ * @property {new (options: any) => any} ctor the bare-agent provider class
+ * @property {string} envKey the environment variable this provider reads its key from
+ * @property {Readonly<Record<string, string>>} tiers tier name -> model id
+ * @property {(model: string|undefined) => Record<string, any>} paramsFor per-model request-key/param gating, applied on TOP of {exposeErrorBody:true, apiKey, model, baseUrl?}
+ */
+
+/** @type {Readonly<Record<string, ProviderTableEntry>>} */
+const PROVIDER_TABLE = Object.freeze({
+  'anthropic-api': Object.freeze({
+    ctor: AnthropicProvider,
+    envKey: 'ANTHROPIC_API_KEY',
+    tiers: ANTHROPIC_TIER_MODELS,
+    // Anthropic has only ever had one request key for the output cap
+    // (`max_tokens`) — nothing to gate here, ever (unlike OpenAI-shaped
+    // backends, which fork on `max_tokens` vs `max_completion_tokens`).
+    paramsFor: () => ({}),
+  }),
+  'openai-api': Object.freeze({
+    ctor: OpenAIProvider,
+    envKey: 'OPENAI_API_KEY',
+    tiers: OPENAI_TIER_MODELS,
+    paramsFor: (model) => OPENAI_MODEL_OPTIONS[/** @type {string} */ (model)] ?? {},
+  }),
+});
+
+/**
+ * Look up a provider's table entry. Throws a NAMED error on an unrecognized
+ * provider — never a silent default (the `resolveRates`-style-substring-
+ * match lesson: a forward hazard even at zero observed rounds, MEMORY.md).
+ * `src/job.js`'s `PROVIDERS` menu is the one place a spec's `provider`
+ * field is validated; this is the runtime construction seam it feeds.
+ * @param {string} providerName
+ * @returns {ProviderTableEntry}
+ */
+export function resolveProvider(providerName) {
+  const entry = PROVIDER_TABLE[/** @type {keyof typeof PROVIDER_TABLE} */ (providerName)];
+  if (!entry) {
+    throw new Error(
+      `src/providers.js: unknown provider "${providerName}" — no silent default. `
+      + `Known providers: ${Object.keys(PROVIDER_TABLE).join(', ')}`,
+    );
+  }
+  return entry;
+}
+
+/**
+ * Construct ONE provider instance for `providerName`/`model`, applying
+ * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)
+ * and the model's own request-key gating (`paramsFor`). `baseUrl` (PRD item
+ * 28, ruling (d), 2026-09-09: admitted in v1) is forwarded only when given —
+ * every provider constructor here defaults it on its own when absent.
+ * @param {string} providerName
+ * @param {{apiKey?: string, model?: string, baseUrl?: string}} [options]
+ */
+export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
+  const entry = resolveProvider(providerName);
+  return new entry.ctor({
+    exposeErrorBody: true,
+    apiKey,
+    model,
+    ...(baseUrl !== undefined ? { baseUrl } : {}),
+    ...entry.paramsFor(model),
+  });
+}
+
+/**
+ * Build the `{provider, providerFor, judgeProvider}` triple both runners
+ * need (`src/cli.js`'s `buildProviders`, `scripts/run-u.mjs`'s top-level
+ * wiring) — ONE seam instead of two copies of the same construction and
+ * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
+ * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
+ * before this factory existed — that decision stays where each runner's own
+ * `--model` flag/spec precedence lives, not duplicated in here).
+ *
+ * The JUDGE stays pinned to `anthropic-api`/`judgeModel` regardless of
+ * `providerName` — arbiter territory (PRD item 28: "the judge stays PINNED
+ * … regardless of the job's worker provider"). A signed `judge:{provider,
+ * model}` field with its own calibration record is PRD item 28 part (2),
+ * NOT built here; until it lands, the judge always needs its own
+ * `judgeApiKey` (today, always `ANTHROPIC_API_KEY`), independent of which
+ * key the worker used.
+ * @param {object} args
+ * @param {string} args.providerName spec.provider (or the anthropic-api default)
+ * @param {string|undefined} args.apiKey the WORKER's key, read from the provider's own `envKey`
+ * @param {string} args.model the already-resolved worker model id
+ * @param {Readonly<Record<string, string>>} args.tierModels the already-resolved tier -> model map (spec override folded in by the caller)
+ * @param {string|undefined} [args.baseUrl] spec.baseUrl, if any
+ * @param {string|undefined} args.judgeApiKey the judge's own key (today: `ANTHROPIC_API_KEY`)
+ * @param {string} args.judgeModel `JUDGE_MODEL`
+ */
+export function buildRunnerProviders({
+  providerName, apiKey, model, tierModels, baseUrl, judgeApiKey, judgeModel,
+}) {
+  const provider = makeProvider(providerName, { apiKey, model, baseUrl });
+  /** @type {Record<string, any>} */
+  const tierCache = {};
+  const providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= (
+    tierModels[tier] === model
+      ? provider
+      : makeProvider(providerName, { apiKey, model: tierModels[tier], baseUrl })
+  ));
+  const judgeProvider = makeProvider('anthropic-api', { apiKey: judgeApiKey, model: judgeModel });
+  return { provider, providerFor, judgeProvider };
+}

package/src/ratelimit.js

@@ -0,0 +1,116 @@
+// PRD item 28's parked (a/b) ruling, hamr's verbatim call: "do a/b as a
+// fallback, and verify/validate + no regression." A vendor HTTP 429 is a
+// response — the provider answered, unlike src/transport.js's no-response
+// class — but unlike every other status this repo already declines to retry
+// (4xx/5xx generally, F115's own boundary), a 429 carries the ONE piece of
+// information that turns "retry blindly" into "retry honestly": the vendor's
+// own stated wait. This module is transport.js's SIBLING, not an extension
+// of it — `isTransportFailure` must keep returning FALSE for anything
+// carrying an HTTP status (429 included), and nothing here widens that.
+//
+// This is a FALLBACK, not the primary answer. The primary answer (F139,
+// measured 2026-09-08) is picking a worker model with adequate rate
+// headroom: gpt-4.1 = 30,000 TPM (429s deterministically on our workload,
+// 2 of 2 runs), gpt-4.1-mini = 200,000 TPM, gpt-5-mini/gpt-5 = 500,000 TPM.
+// One bounded retry only softens the failure mode when that primary answer
+// was not followed (or headroom was still exceeded); it does not replace it.
+
+/** The fixed retry budget: ONE extra attempt after a 429. Never read from a
+ * job spec or CLI flag — raising it is arbiter territory, mirroring
+ * transport.js's TRANSPORT_RETRIES exactly (tighten-only doctrine). */
+export const RATE_LIMIT_RETRIES = 1;
+
+/** bare-agent's `Retry.call` (if ever used) counts ATTEMPTS, not retries;
+ * this module's own hand-rolled ladder (src/planrun.js) does the same for
+ * symmetry with TRANSPORT_MAX_ATTEMPTS. */
+export const RATE_LIMIT_MAX_ATTEMPTS = RATE_LIMIT_RETRIES + 1;
+
+/** The hard cap on how long we will ever wait for a vendor-stated 429 delay.
+ * A vendor asking for longer than this is not honoured — we do not retry at
+ * all in that case. Waiting that long is the operator's decision, not ours
+ * (arbiter territory: nothing here escalates the wait past what hamr set). */
+export const RATE_LIMIT_MAX_WAIT_MS = 60_000;
+
+/** Used only when the vendor's message carries no parseable delay at all. */
+export const RATE_LIMIT_DEFAULT_WAIT_MS = 5_000;
+
+/** A parsed delay is the EARLIEST moment the vendor's own window resets, not
+ * a safe one to fire on the dot — this margin is added to any PARSED value
+ * (never to the default) so the retry lands just after the window, not on
+ * its leading edge. Never allowed to push a parsed value over the cap. */
+const PARSED_DELAY_MARGIN_MS = 250;
+
+/**
+ * Is `err` an HTTP 429 (rate-limited) response? True ONLY for an explicit
+ * status of 429 on the error itself. Nothing else qualifies — not message
+ * text (a message merely containing "429" is not this), not `retryable`,
+ * not any other status. Symmetric with `isTransportFailure`'s own status
+ * check (src/transport.js), just reading the opposite branch of it.
+ * @param {any} err
+ * @returns {boolean}
+ */
+export function isRateLimited(err) {
+  if (err == null) return false;
+  const status = err.status ?? err.statusCode;
+  return status === 429;
+}
+
+/**
+ * The vendor's RAW stated wait, in milliseconds, parsed straight from the
+ * error message — no default, no margin, no cap. `null` when nothing in the
+ * message matches a known shape. Exported separately from `rateLimitWaitMs`
+ * so a caller that wants to report the vendor's own number on the spine
+ * (`statedMs`) never has to re-derive it from the margin-adjusted figure.
+ *
+ * bare-agent does not expose the vendor's `retry-after` /
+ * `x-ratelimit-reset-*` response headers on the thrown error (BA-26) — the
+ * delay exists only in the vendor's English message text, so this parses
+ * that text. Verified real shape (OpenAI, run `8ev2sdkn`, 2026-09-08):
+ * "Please try again in 11.996s." This also supports "try again in 1.5
+ * seconds", "try again in 20ms", "retry after 30s", and "retry after 30
+ * seconds" — case-insensitive.
+ * @param {any} err
+ * @returns {number|null}
+ */
+export function statedWaitMs(err) {
+  const message = String(err?.message ?? err ?? '');
+  const match = message.match(/(?:try again in|retry after)\s*([\d.]+)\s*(ms|milliseconds?|s|seconds?)?/i);
+  if (!match) return null;
+
+  const value = Number(match[1]);
+  if (!Number.isFinite(value) || value < 0) return null;
+
+  const unit = (match[2] ?? 's').toLowerCase();
+  const isMs = unit === 'ms' || unit.startsWith('millisecond');
+  return isMs ? value : value * 1000;
+}
+
+/**
+ * How long to wait before retrying a 429, in milliseconds — or `null`
+ * meaning "do not retry at all" (either the parsed wait exceeds
+ * `RATE_LIMIT_MAX_WAIT_MS`, in which case waiting that long is the
+ * operator's decision, not ours).
+ *
+ * A parsed value gets `PARSED_DELAY_MARGIN_MS` added (the vendor's stated
+ * number is the earliest moment its window resets, not a safe one to fire
+ * on), capped so the margin itself can never push a parsed value over
+ * `RATE_LIMIT_MAX_WAIT_MS`. When nothing parses, `RATE_LIMIT_DEFAULT_WAIT_MS`
+ * is returned as-is, with no margin added (there is nothing to add margin
+ * to — it is already a conservative guess, not an earliest-moment reading).
+ * @param {any} err
+ * @returns {number|null}
+ */
+export function rateLimitWaitMs(err) {
+  const parsedMs = statedWaitMs(err);
+  if (parsedMs === null) {
+    return RATE_LIMIT_DEFAULT_WAIT_MS <= RATE_LIMIT_MAX_WAIT_MS ? RATE_LIMIT_DEFAULT_WAIT_MS : null;
+  }
+
+  // The RAW parsed value is what is judged against the cap ("a vendor asking
+  // for longer than this is not honoured") — the margin is added only AFTER
+  // that gate, and clamped so it can never itself push the result past the
+  // cap, but it never turns an already-honoured wait into a refusal.
+  if (parsedMs > RATE_LIMIT_MAX_WAIT_MS) return null;
+  if (parsedMs === 0) return 0;
+  return Math.min(parsedMs + PARSED_DELAY_MARGIN_MS, RATE_LIMIT_MAX_WAIT_MS);
+}

package/src/reuse.js

@@ -60,6 +60,7 @@ import { readGrade } from './trend.js';
 import { HITL_PAUSE, HUMAN_CHECKPOINTS } from './declaredclose.js';
 import { extractArtifact, priceOf } from './text.js';
 import { runJob as shippedRunJob, ACCOUNTED_ROUND_TYPES } from './run.js';
+import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 const require = createRequire(import.meta.url);
 const { Loop } = require('bare-agent');
@@ -416,7 +417,14 @@ export async function selectBridge({ registry, job, ask, provider, pinned = null
   let result;
   try {
     const loop = new Loop({ provider });
-    result = await loop.run([{ role: 'user', content: prompt }], [], { maxTokens: SELECTION_MAX_TOKENS });
+    // F152/PRD 30.4 — the picker's call carried no time bound at all: a live
+    // endpoint that accepts and never answers hangs the process forever
+    // (measured elsewhere in this repo). This runs BETWEEN bridge tries, not
+    // inside any one try's own signed `perTryWallMs`, so there is no wall to
+    // derive a tighter number from — the same "no clock here" reasoning
+    // `authorscout.js` documents, and the same fallback: the idle-timeout
+    // default the run path itself uses when ITS OWN wall is unbounded.
+    result = await loop.run([{ role: 'user', content: prompt }], [], { maxTokens: SELECTION_MAX_TOKENS, timeoutMs: PROVIDER_TIMEOUT_MS });
   } catch (e) {
     // a throw out of the selection call is TRANSPORT — a casualty, and the run stops on
     // it rather than quietly drafting cold on a decision that was never made

package/src/run.js

@@ -228,6 +228,14 @@ async function primitiveSmoke(workdir) {
  *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'branch-red' | 'pricing-red' | 'provider-red' |
  *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' |
  *   'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
+ *   NOTE: `job-end` can ALSO land with outcome 'runner-drained' (F140/PRD item
+ *   28(c)) — the `beforeExit` backstop's own terminal, emitted from OUTSIDE this
+ *   function's normal control flow when the process drains with no `job-end` at
+ *   all (a provider promise that never settled). It never appears as this
+ *   function's own RETURN value (nothing is left to receive it), only as the
+ *   spine's terminal record. Non-zero exit, `spendComplete:false` always, and
+ *   deliberately NOT in the resumable/checkpoint set (`src/reuse.js`) — an
+ *   unknown in-flight state is not a known-safe resume point.
  */
 export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
   // THE READ SHIM's ARM, resolved at the door — the FIRST thing this entry does,
@@ -345,6 +353,15 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     // than guessing.
     verdictType: job.verdictType,
     ...(typeof provider?.model === 'string' ? { model: provider.model } : {}),
+    // PRD item 28 / F156 — WHICH provider actually ran, and against which
+    // endpoint. Report-only, but without it an archived spine cannot be
+    // segmented by provider at all: every cost, duration and outcome row from
+    // the day openai-api joined the menu would pool anthropic and non-anthropic
+    // runs into one contaminated aggregate, which is the reading error this repo
+    // has already paid for once. `baseUrl` rides along only when the job set one
+    // (an absent baseUrl is the vendor's own host, not an unknown).
+    provider: typeof job.provider === 'string' ? job.provider : null,
+    ...(typeof job.baseUrl === 'string' ? { baseUrl: job.baseUrl } : {}),
     // F118: replay reads this; report-only. `dirty` is deliberately omitted —
     // it can't be known without a shell, and null = unknown, never faked.
     code: (() => { const { version, sha } = codeVersion(); return { version, sha }; })(),
@@ -380,12 +397,46 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
       : {}),
   });
 
+  // F140/PRD item 28 (c) — the backstop that fires on the ABSENCE of a
+  // `job-end`. A provider promise that never settles (BA-25's class; 0.42.0
+  // closed the known drop cases per F141 but the class itself is "an
+  // instrument fires on absence", not a specific bug) lets node drain with
+  // nothing else holding the event loop, and the process exits with no
+  // terminal record at all — no escalation, no outcome, no way to tell a
+  // silent drain from an operator kill. `ended` is the one flag every
+  // job-end site sets via the local `end()` helper below (never a second
+  // spelling of "did we finish" that could fall out of sync with the real
+  // emits). One `beforeExit` listener per call, removed in the `finally` so
+  // multiple runs in one process (tests included) never leak listeners.
+  let ended = false;
+  /** @type {(outcome: string, extra?: object) => object} */
+  const end = (outcome, extra = {}) => {
+    ended = true;
+    return emit('job-end', { outcome, ...extra });
+  };
+  const onBeforeExit = () => {
+    if (ended) return;
+    // A drained run's in-flight spend is unknowable — the floor already
+    // accumulated is honest, an exact-looking total would not be (F6).
+    end('runner-drained', {
+      ...spend(),
+      spendComplete: false,
+      detail: 'process drained with no job-end — a provider call never settled (F140)',
+    });
+    // Never process.exit() (can discard queued stdout) — set the code and
+    // let node exit on its own; preserve a more specific code if one is
+    // already set.
+    process.exitCode = process.exitCode || 1;
+  };
+  process.once('beforeExit', onBeforeExit);
+
+  try {
   // 2. known-answer smoke before tokens (A3: silent degradation throws nothing)
   const smoke = await primitiveSmoke(workdir);
   emit('primitive-smoke', smoke);
   if (!smoke.ok) {
     emit('escalation', { category: 'smoke-red', decisionReady: true, decision: `The ${smoke.primitive} primitive failed its known-answer check — no run verdict is trustworthy on a degraded primitive.`, options: ['fix the primitive/store', 'abandon the run'], detail: smoke.detail });
-    emit('job-end', { outcome: 'smoke-red', ...spend() });
+    end('smoke-red', spend());
     return 'smoke-red';
   }
 
@@ -426,7 +477,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   };
   const pricingRed = () => {
     emit('escalation', { category: 'pricing-red', decisionReady: true, decision: 'A provider result carried no priced cost — the hard cap cannot govern spend it cannot see (unpriced is never free, F6).', options: ['bind a priced provider/model', 'abandon the run'], spentUsd });
-    emit('job-end', { outcome: 'pricing-red', ...spend() });
+    end('pricing-red', spend());
     return 'pricing-red';
   };
 
@@ -443,7 +494,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     });
     if (unpriced) return pricingRed();
     if (outcome.startsWith('step-red:')) {
-      emit('job-end', { outcome: 'step-red', step: outcome.slice('step-red:'.length), ...spend() });
+      end('step-red', { step: outcome.slice('step-red:'.length), ...spend() });
     } else if (outcome === 'provider-red' || outcome === 'step-stalled') {
       // F44: a transport-throw provider-red never returned a usage figure for the
       // failed call, so the priced sum is a FLOOR, not the total — spendComplete
@@ -453,10 +504,13 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
       // the known cost of self-heal — and an unbilled reissue is indistinguishable
       // from a billed one from here. Reporting the priced sum as exact would be F6
       // in a self-heal coat.
-      emit('job-end', { outcome, ...spend(), spendComplete: false });
+      end(outcome, { ...spend(), spendComplete: false });
     } else {
-      emit('job-end', { outcome, ...spend() });
+      end(outcome, spend());
     }
     return outcome;
   }
+  } finally {
+    process.removeListener('beforeExit', onBeforeExit);
+  }
 }

package/src/transport.js

@@ -3,14 +3,18 @@
 //
 // A transport failure is fetch THROWING — the request never produced an HTTP
 // response at all (a TLS fault mid-record, a reset socket, a DNS/network
-// failure). That is a DIFFERENT unknown from an HTTP response the provider
-// DID send (4xx/5xx/429): a response means the provider answered, so
-// bare-agent's own retry policy for those stays exactly what it is — this
-// module never widens that. Retrying only the no-response case is the whole
-// point: a call that dies mid-read may already have been billed (retry can
-// pay twice), so the retry budget stays as tight as hamr authorized it —
-// exactly one extra attempt, never configurable upward from a job spec or
-// argv (tighten-only doctrine).
+// failure) — OR bare-agent's own BA-25 `guardResponseSettles` rejecting a
+// response cut after headers but before the body completed (a peer
+// `'aborted'`/`'error'`/premature `'close'`), tagged `context.bound:
+// 'transport'` (bare-agent 0.42.0, node_modules/bare-agent/src/provider-http.js).
+// That is a DIFFERENT unknown from an HTTP response the provider DID send
+// (4xx/5xx/429): a response means the provider answered, so bare-agent's own
+// retry policy for those stays exactly what it is — this module never widens
+// that. Retrying only the no-response case is the whole point: a call that
+// dies mid-read may already have been billed (retry can pay twice), so the
+// retry budget stays as tight as hamr authorized it — exactly one extra
+// attempt, never configurable upward from a job spec or argv (tighten-only
+// doctrine).
 //
 // Scope: this module wires ONE seam — the worker Loop built in
 // src/planrun.js's `newLoop` (~line 2239), which is the ONE factory behind
@@ -31,11 +35,17 @@ export const TRANSPORT_MAX_ATTEMPTS = TRANSPORT_RETRIES + 1;
  * Is `err` a transport-class failure — the request never produced an HTTP
  * response? True for: a TLS fault mid-record ("bad record mac" and kin), a
  * reset/broken/timed-out socket (ECONNRESET, EPIPE, ETIMEDOUT, ECONNREFUSED,
- * ENETUNREACH — by code on the error itself or on `err.cause`), and
- * `fetch failed` wrapping a network `cause`. False for anything carrying an
- * HTTP status (`err.status`/`err.statusCode`, 4xx/5xx/429) or an explicit
+ * ENETUNREACH — by code on the error itself or on `err.cause`), `fetch
+ * failed` wrapping a network `cause`, and — as of bare-agent 0.42.0 (BA-25)
+ * — a `ProviderError` whose `err.context.bound === 'transport'`: the
+ * response stream ended (`'aborted'`/`'error'`/premature `'close'`) after
+ * headers but before the body completed, which bare-agent itself rejects as
+ * retryable with no HTTP status. False for anything carrying an HTTP status
+ * (`err.status`/`err.statusCode`, 4xx/5xx/429) or an explicit
  * `err.retryable === false` — those are provider RESPONSES, not transport
- * casualties, and bare-agent's own policy governs them unchanged.
+ * casualties, and bare-agent's own policy governs them unchanged; both
+ * guards run BEFORE the `context.bound` check, so a status or an explicit
+ * `retryable:false` wins even if `bound` says 'transport'.
  * @param {any} err
  * @returns {boolean}
  */
@@ -47,6 +57,13 @@ export function isTransportFailure(err) {
   if (typeof status === 'number') return false;
   if (err.retryable === false) return false;
 
+  // BA-25 (bare-agent 0.42.0): bare-agent's own transport classification —
+  // `guardResponseSettles` tags a body-cut-after-headers rejection with
+  // `context.bound: 'transport'`. Only 'transport' qualifies here — a
+  // sibling bound like 'idle' (BA-19's deadline-idle guard) already
+  // qualifies via its ETIMEDOUT code below, never by bound alone.
+  if (err.context && err.context.bound === 'transport') return true;
+
   const codeOf = (e) => (e && typeof e.code === 'string' ? e.code : null);
   const TRANSPORT_CODES = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'ECONNREFUSED', 'ENETUNREACH', 'EAI_AGAIN']);
   const code = codeOf(err) ?? codeOf(err.cause);

package/types/authorscout.d.ts

@@ -91,7 +91,7 @@ export function defaultSurveyor({ workdir, granted, auditPath, ctx }: {
  *
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
- *   attempts?: number, ceilingUsd?: number|null,
+ *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any}) => any,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -99,7 +99,7 @@ export function defaultSurveyor({ workdir, granted, auditPath, ctx }: {
  *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
  *   budgetStop: 'cap-halt'|'pricing-red'|null}>}
  */
-export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, maxTokens, ctx, attempts, ceilingUsd, onCall, createLoop, createSurveyor, }: {
+export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, maxTokens, ctx, attempts, ceilingUsd, callTimeoutMs, onCall, createLoop, createSurveyor, }: {
     workdir: string;
     provider?: any;
     rounds?: number;
@@ -109,6 +109,7 @@ export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, m
     ctx?: boolean;
     attempts?: number;
     ceilingUsd?: number | null;
+    callTimeoutMs?: number;
     onCall?: (call: {
         label: string;
         costUsd: number | null;
@@ -205,6 +206,30 @@ export function buildSeedListing({ workdir, seedRef, sourcePaths, testPaths, lis
         tier: string;
     };
 }>;
+/**
+ * F152/PRD 30.4 — the scout's per-call IDLE bound. Every `loop.run()` in this
+ * module carried NO time bound at all: a live endpoint that accepts and never
+ * answers hangs the process forever (measured) — an open socket is an active
+ * handle, so node never drains and no backstop can fire.
+ *
+ * UNLIKE the run path (`callBounds()`, src/planrun.js:1518), this pipeline has
+ * NO wall clock to derive a bound FROM — the authoring pipeline is genuinely
+ * clockless (`src/authorjob.js`/`src/authorflow.js`/`scripts/run-author.mjs`
+ * carry a money ceiling, `ceilingUsd`/`capStop`, and never a `maxWallMs`).
+ * Rather than inventing a fresh number, this reuses the EXACT ceiling the run
+ * path itself falls back to when ITS OWN wall is unbounded
+ * (`PROVIDER_TIMEOUT_MS`, `src/clock.js` — BA-18's idle timeout, already an
+ * approved "no wall present" default one layer up): an authoring-time call is
+ * the identical situation, one call earlier.
+ *
+ * It bounds SOCKET INACTIVITY only (reset by every byte, per BA-18) — a call
+ * that is merely slow keeps streaming and is untouched; only a truly silent
+ * endpoint trips it. TIGHTEN-ONLY, like every cap in this file: this is an
+ * operator-set ceiling fixed here, not a param a caller or a signed spec may
+ * widen (a defaulted cap is a silent second ceiling, and there is no clock
+ * whose narrower reading could ever tighten it further).
+ */
+export const AUTHOR_CALL_TIMEOUT_MS: 600000;
 /** src/planrun.js:42 — the survey's hard round bound. */
 export const AUTHOR_SCOUT_ROUNDS: 8;
 /** src/planrun.js:44 — the survey is a PROMPT INGREDIENT for the authoring call. */

package/types/declaredclose.d.ts

@@ -110,7 +110,8 @@ export function guardNames(closeDecl: any, verdictType: string): string[];
  *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
  *   humanRuling?: {decision: string, text?: string|null}|null,
  *   judgeLoop?: ((o: {system: string}) => any)|null,
- *   onJudgeCost?: ((c: any) => void)|null}} [opts]
+ *   onJudgeCost?: ((c: any) => void)|null,
+ *   callBounds?: (() => {timeoutMs?: number, deadlineMs?: number})|null}} [opts]
  * @returns {Promise<any>}
  */
 export function runDeclaredStages(stages: any[], redact?: (s: string) => string, opts?: {
@@ -129,6 +130,10 @@ export function runDeclaredStages(stages: any[], redact?: (s: string) => string,
         system: string;
     }) => any) | null;
     onJudgeCost?: ((c: any) => void) | null;
+    callBounds?: (() => {
+        timeoutMs?: number;
+        deadlineMs?: number;
+    }) | null;
 }): Promise<any>;
 /**
  * The trend reader's input for ONE close verdict, whichever executor produced

package/types/job.d.ts

@@ -207,6 +207,10 @@ export const CADENCE_UNITS: readonly string[];
  * subscription — its costUsd axis is NOTIONAL (API-equivalent value, not
  * billed), so it is a DISTINCT condition: rows never pool with anthropic-api
  * rows on the cost axis, and budgets sized for one do not transfer. */
+/** PRD item 28 (2026-09-06/09-09): `openai-api` — an OpenAI-shaped provider,
+ * constructed via `src/providers.js`'s factory. hamr's ruling (PRD 30.7):
+ * `deepseek-chat` is THE secondary provider (one, not a menu of half-tested
+ * models); the factory's tier table is where that lives, not this menu. */
 export const PROVIDERS: readonly string[];
 /** V3 environment label: declared keys only — every field is a lineage-key
  * candidate at N3. `provider` is part of the key by definition (top-level,

package/types/judged.d.ts

@@ -130,12 +130,13 @@ export function locatePrompt(card: any): string;
  * On every route out, red or clean, `onCost` fires exactly once with the honest
  * read: a paid call that leaves no meter record is F12 wearing a judge's coat.
  * @param {{artifactText: string, card: any, loopFactory: (o: {provider?: any, system: string}) => any,
- *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void}} o
+ *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void,
+ *   callBounds?: {timeoutMs?: number, deadlineMs?: number}}} o
  * @returns {Promise<{ok: boolean, facts: any|null, red: {axis: string, detail: string}|null,
  *   costUsd: number|null, unpricedRounds: number, truncated: boolean, parseError: boolean,
  *   raw: ReturnType<typeof scrubRaw>}>}
  */
-export function runLocate({ artifactText, card, loopFactory, maxTokens, attempt, onCost }: {
+export function runLocate({ artifactText, card, loopFactory, maxTokens, attempt, onCost, callBounds, }: {
     artifactText: string;
     card: any;
     loopFactory: (o: {
@@ -148,6 +149,10 @@ export function runLocate({ artifactText, card, loopFactory, maxTokens, attempt,
         costUsd: number | null;
         unpricedRounds: number;
     }) => void;
+    callBounds?: {
+        timeoutMs?: number;
+        deadlineMs?: number;
+    };
 }): Promise<{
     ok: boolean;
     facts: any | null;

package/types/kinds.d.ts

@@ -539,6 +539,11 @@ export type Red = {
  * funded honestly: this executor cannot reach the run's ledger, so every locate
  * call's cost is reported OUT through it, once per call, on every route including
  * the red ones — a paid call that leaves no meter record is F12 in a judge's coat.
+ * `callBounds` is F152/PRD 30.4's per-call TIME bound, read fresh before every
+ * locate attempt — the same derivation the run's own worker rounds carry
+ * (`callBounds()`, src/planrun.js). Absent is the honest unbounded default:
+ * an adopter or test that wires no clock through behaves exactly as before
+ * this field existed.
  * `onStage` is a REPORTING seam and nothing else: the seed read spawns a real
  * toolchain per stage (a suite is the slow one) and a whole read is one opaque
  * await, so the shell gets told as each stage lands. It decides nothing, it is
@@ -571,6 +576,10 @@ export type Ctx = {
         costUsd: number | null;
         unpricedRounds: number;
     }) => void;
+    callBounds?: () => {
+        timeoutMs?: number;
+        deadlineMs?: number;
+    };
     onStage?: (row: {
         stage: string | null;
         kind: string | null;