bareloop 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -5,6 +5,253 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [Unreleased]
+
+## [0.24.0] — 2026-09-10
+
+### Added
+
+- **`gemini-api` on the provider menu, ADMITTED-PENDING-PROBE** (PRD item 31.3;
+  hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for now"*). Reads
+  `GEMINI_API_KEY` and maps two genuinely different tiers — `sonnet` →
+  `gemini-2.5-pro`, `haiku` → `gemini-2.5-flash`. It has **zero runs**: the
+  probe rule (no endpoint in the menu without its own clean paid probe) is not
+  waived for it. `PROBE_STATUS` in `src/providers.js` records that debt per
+  provider and `probeWarningLines` renders the loud `⚠ UNPROVEN PROVIDER`
+  marker `scripts/run-u.mjs` prints at launch, right where money is about to be
+  spent. The table is read to WARN, never to REFUSE — refusing a provider hamr
+  admitted would be a second, invisible ruling.
+- **Per-provider `endpointKey`** — each table entry declares the CONSTRUCTOR
+  option name it reads an endpoint from, instead of a hardcoded `baseUrl`.
+  bare-agent's providers do not agree on one spelling (`baseUrl` for
+  anthropic/openai/gemini, `url` for Ollama) and none of them validate unknown
+  option names, so a mis-spelled endpoint is silently DROPPED, not rejected:
+  measured live, `new OllamaProvider({baseUrl: X}).url` stays
+  `http://localhost:11434` with no error. That is the F149 class (DeepSeek
+  silently ignoring `max_completion_tokens`: asked 64 output tokens, returned
+  665). A job spec still carries ONE field name, `baseUrl`; the translation to
+  each constructor's own spelling happens once, in `makeProvider`.
+
+### Changed
+
+- **The judge is no longer a Claude judge** (PRD item 32; hamr, 2026-09-10:
+  *"what i care about is that judge becomes llm agnostic and not set to one
+  model or provider"*). `JUDGE_MODEL` is no longer read by any grading path.
+  The judge identity is RESOLVED per job by the new exported `resolveJudge`:
+  the spec's signed `judge: {provider, model}` if it names one, else **the
+  job's own worker provider and model** — so a DeepSeek or Gemini job judges on
+  its own provider and needs no second account. There is deliberately no
+  library fall-back: a run that cannot name its judge has not wired one, and
+  the judged stage instrument-STOPS rather than grading under an identity
+  nobody chose. `JUDGE_MODEL` stays exported as the pre-item-32 pin so an
+  adopter's import survives. The judge is now built through the provider
+  factory like every other provider — no `new AnthropicProvider` survives for
+  a judge in `scripts/run-u.mjs`, `scripts/run-author.mjs` or `src/cli.js` —
+  and its key follows the resolved judge provider's own `envKey`, with
+  `JUDGE_API_KEY` as a role-named override in front.
+
+  **BREAKING for direct library callers.** `runCalibration`,
+  `foldJudgedArtifacts` and `prepareSigning`/`authorCloseForJob` now require
+  the resolved `judgeModel` and THROW without it; `runJob`/`runPlan` take a
+  `judgeModel` beside `judgeProvider`, and a judged stage stops as a wiring gap
+  when it is absent. Adding a default would be the silent fall-back this change
+  exists to remove.
+
+  **No threshold moved.** The judge still renders no verdict — it locates facts
+  and a deterministic `decide()` renders; unsure is RED; `CALIBRATION_SIZE` is
+  10 with a 10-of-10 floor and no partial credit. Un-pinning a provider is not
+  a licence to move a bar. Self-grading (a worker's own family reading its
+  work) is licensed by MEASUREMENT: the calibration gate is exactly the
+  instrument that catches a judge which cannot see failures, and its frozen set
+  contains cases that MUST fail.
+- **A new optional signed spec field, `judge: {provider, model}`** — both
+  halves required together, `provider` from the `PROVIDERS` menu, unknown
+  nested keys red. It is part of `jobSpecHash`, so changing the judge kills the
+  signature and forces recalibration — and the recalibration guard now fires
+  across a PROVIDER change, not just a model bump. The drafting agent cannot
+  express it: naming your own examiner is arbiter territory.
+- **The judge's API key is demanded only when a judge is CALLED** (PRD item
+  31.4). `scripts/run-u.mjs` hard-exited on a missing `ANTHROPIC_API_KEY` for
+  every job, so a `verdictType: 'green'` job with a DeepSeek or Gemini worker
+  and a mechanical close could not start without an Anthropic account it would
+  never spend a token against. Now the WORKER's key comes from the provider
+  table's own `envKey` and is always required; the JUDGE's key follows the
+  RESOLVED judge provider's own `envKey` (item 32.1 — the judge is no longer
+  pinned to Anthropic), with `JUDGE_API_KEY` as a role-named override in
+  front, and is required only when the close actually judges. When it does
+  refuse it refuses at $0, before the worker spends anything, naming the
+  judged-stage count and the resolved judge model — a judged run that
+  discovered this at the close would have paid in full for a verdict it
+  cannot render. A green `anthropic-api` job behaves byte-identically to
+  before. `bareloop run` (the bundle runner) is unchanged: `ANTHROPIC_API_KEY`
+  -only by a deliberate, documented contract.
+- **One reading of "does this close judge?"** — `judgedStages()`/`closeJudges()`
+  are exported from `src/kinds.js` and the six open-coded copies of that
+  predicate now share them. The runner's own comment warned against "a second
+  reading of the declaration that can drift from the one the runner actually
+  executes"; 31.4 needed a seventh, to decide a REFUSAL, which is that warning
+  coming true.
+
+- **`hitl` leaves the authoring menu; its code stays** (PRD item 31.1; hamr:
+  *"retire hitl from list, keep its code"*). Three distinct class lists replace
+  two: `LOCKED_CLASSES` (no guard battery exists — empty today),
+  `UNLISTED_CLASSES` (`['hitl']` — built, validates and RUNS, simply never
+  offered) and `MENU_CLASSES` (live minus unlisted). Only the AUTHORING surface
+  reads them, which is what keeps hitl's code alive and under test; locking the
+  class instead would have taken `validateCloseDecl`, the guard battery and two
+  whole test files with it. `scripts/run-interview.mjs` no longer advertises
+  `--verdict hitl` in a usage line the library then refuses.
+- **Green-only prose corrected** (PRD item 31.2). `soft-green` was never
+  locked; the source comment claiming *"v1 STILL ADMITS ONLY green"* was false
+  and had already sent one build in the wrong direction, and
+  `bareloop.context.md` — the file that SHIPS — said all three classes were
+  admitted. Fixed, and pinned by tests, because prose drifts when nothing
+  executes it.
+
+### Security
+
+- **`SECRET_PATTERNS` learns the Gemini/Google API key shape** (PRD item
+  31.3, F160). `gemini-api` was admitted to real runs (this file, above)
+  without its own key shape joining the ONE secret-shape inventory
+  (`src/validate.js`) that drives `scanSecrets`, `redactSecrets` and
+  `sweepSecretLiterals` — a `GEMINI_API_KEY`-shaped literal (`AIza` + 35
+  chars) reaching a spine, a close's output, or a signed doc would have gone
+  undetected and unredacted. Fixed with a left-bounded pattern in the same
+  style as the existing shapes; monotonic (detection only added, nothing
+  loosened).
+
+### Notes
+
+- Ollama is deliberately NOT admitted. It takes no key and bills nothing, so
+  every round would price at $0 through machinery that treats $0 as a real
+  price — the honesty violation the `?? 0` rule exists to stop. That question
+  gets answered before a menu entry, not after.
+
+## [0.23.0] — 2026-09-09
+
+### Added
+
+- **`openai-api` on the provider menu, behind a provider FACTORY** (PRD item 28,
+  F149/F150/F156/F157). `src/providers.js` holds one table — provider name →
+  constructor, env key, tier models, per-model request-key gating — and both
+  runners go through it instead of naming `AnthropicProvider` directly. An
+  unknown provider name THROWS; there is no silent default. `openai-api` takes
+  an optional validated job-level `baseUrl` (https, or http on loopback only)
+  and admits ONE model, `deepseek-chat`, which earned the slot with a real paid
+  green through the shipped runner (run `mtu12vks`: green, $1.64 of $4, 10.3 of
+  30 min). DeepSeek silently ignores `max_completion_tokens`, so its table entry
+  sets bare-agent's `legacyMaxTokens` — an output cap that does not bind is a
+  money hazard. The judge stays PINNED to `anthropic-api` and `JUDGE_MODEL`
+  whatever the worker's provider is. `bareloop run` (the bundle runner) is
+  `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would have
+  needed, rather than building another provider with the wrong key.
+- **`provider` and `baseUrl` on the `job-start` spine record** (F157),
+  report-only. Without them an archive cannot separate anthropic rows from
+  `openai-api` rows, and every pooled cost or duration figure would be a
+  contaminated aggregate.
+- **`stopReason` on every `worker-round`** (BA-13, report-only, null when
+  absent, never invented).
+
+- **`runner-drained` — a `beforeExit` backstop for the absent-`job-end` class**
+  (PRD item 28's ruling (c); F140). A provider promise that never settles
+  (BA-25's class) used to let node drain and exit with NO terminal record at
+  all — no escalation, no outcome, no way to tell a silent drain from an
+  operator kill (F140: 10-of-235 archived spines with no `job-end`, one real
+  silent death). bare-agent 0.42 closed the known drop cases (F141), but the
+  class itself is "an instrument fires on absence," not a specific bug, so
+  the backstop stays needed. `runJob` (`src/run.js`) now registers ONE
+  `process.once('beforeExit', …)` right after `job-start`, tracked via a
+  local `ended` flag every `job-end` site sets; if the process still drains
+  with no `job-end`, it mints one with outcome `runner-drained`,
+  `spendComplete:false` (a drained run's in-flight spend is unknowable — the
+  floor already banked is honest, F6), and sets `process.exitCode` non-zero
+  (never `process.exit()`). The listener is removed in a `finally` so a
+  normal run never leaks it. `runner-drained` is a new terminal outcome,
+  documented in `bareloop.context.md`'s outcomes list — deliberately **not**
+  added to the resumable/checkpoint set (`CHECKPOINT_OUTCOMES`, `src/reuse.js`):
+  an unknown in-flight state is not a known-safe resume point.
+
+- **Bounded 429 retry — a FALLBACK, not the primary answer** (PRD item 28's
+  parked a/b ruling, hamr verbatim: "do a/b as a fallback, and verify/validate
+  + no regression"; F143). A vendor HTTP 429 used to end the whole run as
+  `provider-red`, discarding all completed work, even though the vendor's own
+  response states exactly how long to wait. `src/ratelimit.js` (new,
+  `transport.js`'s sibling) adds ONE bounded retry that honours that stated
+  delay, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS`) — a wait longer than that is
+  not honoured at all. Wired into `src/planrun.js`'s provider-retry seam
+  (`withTransportRetry` renamed `withProviderRetries`) as a SECOND,
+  independent one-shot budget alongside the existing F115 transport retry;
+  the wall always wins (no retry past the deadline); each retry emits a
+  report-only `rate-limit-retry` spine record and does NOT floor
+  `spendComplete` (a 429 is a refusal — nothing was billed — unlike a
+  transport throw). **The primary answer stays the primary answer**: picking
+  a worker model with adequate rate headroom (F139/F143's measured TPM
+  table) — this retry only softens the failure mode when that was not
+  followed or headroom was still exceeded.
+
+### Changed
+
+- Bumped `bare-agent` pin from `^0.39.0` to `^0.42.0`. 0.42.0 brings: BA-24 —
+  `OpenAIProvider` now sends `max_completion_tokens` by default (GPT-5-safe),
+  with a new `legacyMaxTokens` option to send the legacy `max_tokens` key
+  instead; BA-25 — a response body cut after headers (peer `'aborted'`,
+  stream `'error'`, or a premature `'close'` before `'end'`) now REJECTS
+  `generate()` with a retryable `ProviderError` (`context.bound:'transport'`)
+  instead of leaving the promise pending forever; a new `loop:truncated`
+  stream event plus `stopReason` on the `onLlmResult` metering payload; and
+  `options.toolChoice` on `OpenAIProvider`.
+
+### Fixed
+
+- **F154** — every provider call bareloop makes now carries a deadline. Seven
+  sites had none: the softgreen judge, the calibration gate, the authoring
+  scout's three rounds, the declaration/revise boundary, and the bridge picker.
+  A silent endpoint HANGS the process (an open socket is an active handle, so
+  the drain backstop cannot see it); a deadline is the only instrument that
+  fires on the absence of events. Tighten-only.
+- **F155** — the judged floor graded whatever LOCATE reported, so a silently
+  omitted function passed on the subset. `decide()` now diffs the artifact's own
+  top-level functions against the reported set and reds, naming what was
+  missing. The declaration shapes live ONCE (`FN_SHAPES`), from which both the
+  locate prompt's prose and the detector are derived.
+- **F153** — a provider's own error sentence now reaches the operator instead of
+  a bare status number, redacted through the one secret inventory and capped.
+- **F151** — the bounded 429 retry, added last release, fired on a real vendor
+  429 for the first time: it parsed the stated wait from prose, waited it, and
+  retried once. Mechanism proven; on a TPM-saturated model the retry is not
+  expected to recover, and did not.
+- **F147** — the F59 scout summary round (and the authoring scout's recovery
+  round, the same shape in `src/authorscout.js`) re-fed a transcript bare-agent
+  had already system-prepended into a new `Loop.run()`, which prepended the
+  persona AGAIN: two identical system messages at index 0/1. Real OpenAI
+  tolerates that; vLLM-class OpenAI-compatible backends reject it (HTTP 400
+  "System message must be at the beginning" — the Qwen death F146 left
+  unexplained). Both sites now strip the leading system message before
+  continuing, as bare-agent's own `Loop.chat()` does. Proven live: the captured
+  failing request goes 400 → 200 with one line removed; deepseek-chat then
+  greened a full job (F149/F150).
+- **F141** — `src/transport.js`'s `isTransportFailure` now also recognizes
+  bare-agent's own BA-25 transport classification
+  (`err.context.bound === 'transport'`), after the existing HTTP-status and
+  `retryable:false` guards. Before this fix, the exact class hamr's F115
+  one-retry ruling names — a call that dies mid-read, no full response —
+  would have ended provider-red with no retry once the 0.42.0 pin landed,
+  because the new rejection shape carried none of the signals the classifier
+  previously looked for (no `status`, `retryable:true`, no matching error
+  code/message). Retry budget unchanged: `TRANSPORT_RETRIES = 1`.
+- **Review door refuses `close-timing-red` instead of defaulting the close timeout**
+  (F137, `docs/product/CLOSE-INTEGRITY-BUILD.md` "Ruled 2026-09-07", found by
+  orchestrator review of M3, run `mtqwmb9l`). `scripts/run-u.mjs`'s `accept` door path
+  resolved the mechanical re-run's close timeout via `resolveCloseTimeoutMs` and, when
+  that timing pass itself timed out, silently fell through to `closeTimeoutMs:
+  undefined` — the library's 120s default — substituting an unauthorized ceiling for a
+  door decision, the exact second silent-default class M3 was built to remove one door
+  up. A door whose own timing pass times out now REFUSES outright as a named
+  `close-timing-red` door stop (same wording/options as the in-run escalation, new pure
+  renderer `doorTimingRedLines` in `scripts/u-readout.mjs`): `answerReviewDoor` is never
+  called, nothing is recorded (no door record), nothing is released, nothing is spent,
+  and the process exits non-zero.
+
 ## [0.22.0] — 2026-09-07
 
 ### Added

package/README.md

@@ -82,7 +82,7 @@ A signed job spec goes in. A verdict comes out.
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1',

package/bareloop.context.md

@@ -70,6 +70,39 @@ inherited rule carries the green that minted it and the contrast that attributed
   with `anthropic-api` on cost, and budgets don't transfer between them.
   `job.provider === 'clipipe-subscription'` with no `nativeProvider` supplied is
   `interpreter-red`, never a silent fall-back to the metered API (`src/planrun.js:1073`).
+  `provider: 'openai-api'` (PRD item 28) takes the ordinary `Loop` path against an
+  OpenAI-shaped endpoint, reads `OPENAI_API_KEY`, and accepts an optional job-level
+  `baseUrl` (https, or http on loopback only; credentials in the URL are a red). Its one
+  admitted model is `deepseek-chat`, which earned the slot with a real paid green — no
+  endpoint or model enters the menu without its own clean paid probe. The provider table
+  lives in `src/providers.js` (`resolveProvider`/`makeProvider`/`buildRunnerProviders`);
+  an unknown provider name THROWS there, it never falls back to a default. Per-model
+  request-key gating lives in that table: `deepseek-chat` sets bare-agent's
+  `legacyMaxTokens`, because DeepSeek silently ignores `max_completion_tokens` and an
+  output cap that does not bind is a money hazard. `provider: 'gemini-api'` (PRD item 31.3)
+  takes the same `Loop` path, reads `GEMINI_API_KEY`, and maps two real tiers
+  (`sonnet` → `gemini-2.5-pro`, `haiku` → `gemini-2.5-flash`). It is
+  **ADMITTED-PENDING-PROBE**: it has ZERO runs, and the probe rule is not waived for it —
+  `PROBE_STATUS` (`src/providers.js`) is the machine-readable form of that debt, and
+  `probeWarningLines(provider)` renders the loud launch-time marker `scripts/run-u.mjs`
+  prints. That table is read to WARN, never to REFUSE. Each entry also declares its own
+  `endpointKey` — the CONSTRUCTOR option name it reads an endpoint from — because
+  bare-agent's providers do not agree on one spelling (`baseUrl` for anthropic/openai/
+  gemini, `url` for Ollama) and none of them validate unknown option names, so a
+  mis-spelled endpoint is silently DROPPED rather than rejected. Your job spec keeps one
+  field name, `baseUrl`; the translation happens once, inside `makeProvider`. Ollama is
+  deliberately NOT admitted: it takes no key and bills nothing, so every round would price
+  at $0 through machinery that treats $0 as a real price. The JUDGE IS NO LONGER PINNED
+  (PRD item 32): `resolveJudge` (exported) resolves it per job — the spec's signed
+  `judge: {provider, model}` if it names one, else **this job's own worker provider and
+  model**, so a DeepSeek or Gemini job judges on its own provider and needs no second
+  account. There is no library fall-back: a run that cannot name its judge has not wired
+  one, and the judged stage instrument-STOPS rather than grading under an identity nobody
+  chose. `JUDGE_MODEL` stays exported as the pre-item-32 pin — no grading path reads it.
+  The judge's key follows the resolved judge provider's own `envKey`, with `JUDGE_API_KEY`
+  as a role-named override in front of it. The bundle runner
+  (`bareloop run`) is `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would
+  have needed, rather than constructing another provider with the wrong key.
 - **Reuse — where a workflow comes from:** a plain `runJob` always drafts cold. Passing
   `bridge` starts from one standalone bridge file (`src/reuse.js`'s envelope, `## The reuse
   ENVELOPE and runReuse` below). The CLI's `--registry <dir>` / library-level `registryDir`
@@ -85,7 +118,7 @@ inherited rule carries the green that minted it and the contrast that attributed
 
 ```js
 import { runJob, jobSpecHash, makeSpine } from 'bareloop';
-import { AnthropicProvider } from 'bare-agent';
+import { AnthropicProvider } from 'bare-agent/providers';
 
 const spec = {
   schema: 'job-v1', job: 'my-maintainer',
@@ -130,13 +163,14 @@ minting claim, or the shell-owned retry cap — all unknown-field reds.
 |---|---|---|
 | `job` | kebab-case slug | |
 | `description` | non-empty string | |
-| `provider` | `anthropic-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
+| `provider` | `anthropic-api` \| `openai-api` \| `gemini-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-chat` today — see "Worker surface" above for its `baseUrl` field and per-model gating; `gemini-api` (PRD item 31.3) reads `GEMINI_API_KEY` and is ADMITTED-PENDING-PROBE — zero runs, and every launch says so (`PROBE_STATUS`/`probeWarningLines`); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
 | `conditions` | `{ providerPath?, closeVerbosity?, taskFraming?, scaffold? }` | declared keys only, string values — the environment label (consumed by the N3 lineage key; recorded on spines from run one) |
 | `cadence` | `{ unit: hour\|day\|week, every: 1..30 }` | validated now, consumed at N5 (Scheduler) |
 | `budgetUsd` | `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
 | `maxWallMs` | optional integer ms `>= MIN_WALL_MS` (one close timeout) | the run's wall clock. **NO DEFAULT, by ruling** — absent means time-unbounded *by explicit operator choice*, never by fallback (F45: a defaulted cap is a silent second ceiling). Enforcement is a BETWEEN-ROUND deadline, so the honest worst case is `maxWallMs + closeStages × closeTimeoutMs` — every stage of a staged close gets the FULL timeout — and all three numbers are reported (`loop.stop()` cannot cut an in-flight call — F61 measured 500ms→4,018ms). The `MIN_WALL_MS` floor is a ONE-stage, un-autoset-default number, so a spec with many stages OR a raised/autoset `closeTimeoutMs` can validate while its overshoot dwarfs its cap: `runPlan` adds a RUN-START check (PRD item 27/M3) that refuses `wall-under-close-timeout` at $0 once the EFFECTIVE per-stage ceiling is known (autoset or signed), rather than a silent clamp. Operator-only, tighten-only; adding or changing it changes the spec hash |
 | `closeTimeoutMs` | optional integer ms `>= CLOSE_TIMEOUT_FLOOR_MS` (120,000 — hamr's arbiter floor, 2026-09-07) | PRD item 27/M3's SIGNED override for the close's own per-stage wall-clock cap. Absent (the normal case): the run autosets it from a $0 seed timing pass — `max(FLOOR, K × slowest measured stage)`, `K = 5` (hamr, 2026-09-07: "2 and 5 are fine"). Present: the operator's own number wins outright and may legally sit ABOVE *or below* the autoset estimate (the rates-passthrough shape, F113 — never tighten-only). Arbiter territory exactly like `budgetUsd`/`maxWallMs`/`close[].sha256`: the authoring pipeline's `assembleSpec` refuses a draft carrying it |
-| `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the judge model stays library-pinned (`JUDGE_MODEL`) pending recalibration |
+| `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the JUDGE's model comes from the `judge` row below, which DEFAULTS to this same worker model |
+| `judge` | optional `{provider, model}`, both non-empty; `provider` from the `PROVIDERS` menu | the signed JUDGE override (PRD item 32). Absent, the judge resolves to this job's own `provider`/`model` (`resolveJudge`) — which is what lets a non-Anthropic job judge without a second account. Present, it pins a judge deliberately different from the worker (an independent reader). Both halves are required together: a judge with a provider and no model is an identity nobody signed. Part of the signed hash, so changing it kills the signature and forces recalibration. Unknown nested keys red — no smuggling level exists in a signed spec. The drafting agent cannot express it: naming your own examiner is arbiter territory |
 | `writeScope` | array of contained globs | the operator's outer fence; the plan's own scopes must fit inside it, same containment code |
 | `steps` | RETIRED | operator-authored `steps[]` was deleted (PRD v1.32); a spec carrying it reds `shape-retired:steps` by name rather than half-running |
 | `escalation` | `{ mode: "decision-ready" }` | the pain channel is not optional |
@@ -147,7 +181,7 @@ the step plan at run time (gated by `validatePlan`); the human signs only:
 | field | shape | notes |
 |---|---|---|
 | `goal` | non-empty text | what the agent plans against |
-| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). **All three are ADMITTED today** — `LOCKED_VERDICTS` is empty, so nothing reds `request-red` on the class itself. `soft-green` has its judged floor (`judged-floor`, signed rubric card + calibration gate) and is the forward path for a job needing judgement, paired with the end-of-run review door; `hitl` is LEGACY — retired as a design direction (see the direction note at the top) but still admitted and still works exactly as documented here. Every `request-red` (e.g. for a locked TOOL verb, not a verdict class) also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
+| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). **All three still VALIDATE and RUN** — `LOCKED_VERDICTS` is empty, so nothing reds `request-red` on the class itself, and an existing spec of any class executes. **But AUTHORING offers two: `green` and `soft-green` (`MENU_CLASSES`).** `soft-green` has its judged floor (`judged-floor`, signed rubric card + calibration gate) and is the forward path for a job needing judgement, paired with the end-of-run review door; `hitl` is RETIRED and UNLISTED (`UNLISTED_CLASSES`, PRD item 31.1) — the class moved to fwdloop, so `runInterview` refuses a hitl pick as counted demand and no new hitl job can be drafted, while its battery, its runtime and an already-signed hitl spec are untouched and still work exactly as documented here. The three lists are DIFFERENT facts: `LOCKED_CLASSES` (no battery — cannot validate or run; empty today), `UNLISTED_CLASSES` (built and runnable, never offered — `['hitl']`), `MENU_CLASSES` (what authoring offers). Every `request-red` (e.g. for a locked TOOL verb, not a verdict class) also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
 | `close` | **an ORDERED LIST of named stages** `[{ name, cmd, expect, judged?, gapKeep?, offer?, needs?, direction? }, ...]` (PRD v1.28), or a close object (table below) | the destination, the only thing hand-authored; the check menu DERIVES from it (below). The plan flow executes a staged close directly and adapts a bare `predicate` object into a one-stage list; a `gold`/`rubric`/`hitl` object close still VALIDATES (`CLOSE_TYPES`) but the plan flow refuses all three at runtime as `close-unsupported` — an object close names no command to run. The modern route to a judged or human-decided close is a staged `closeDecl` (`judged-floor` / `human-confirms` stage kinds), not this object form |
 | `closeDecl` | **the AUTHORED close** `{ genre: "TYPES", lang: "js"\|"python", stages: [{ name, kind, params }], notes? }` | the ALTERNATIVE to `close`, and the point of the close-authoring rung: the user answers an interview and an LLM composes a DECLARATION over kinds whose implementations we own — never a script, never a shell fragment, never a new kind. **`close` and `closeDecl` are alternatives**: declaring both reds `close-duplicated` (two closes are two arbiters). It is HARD-class by construction (`CLASS_BY_CLOSE.declared`), so a locked verdict on one reds `close-hierarchy` as well as `request-red`. The declaration is validated by `validateCloseDecl`; the TREE-GROUNDED half of that gate (the path rule, and the scoped-job derivation that arms the F84 one-population law) is DEFERRED at spec-validation time — a job spec is validated with no repository in hand — and the runner re-runs it GROUNDED against the real seed before any stage and before any token. It stores the counting RULE and never a number (D12): there is no seed field, and `baseline: "seed"` is measured at each run's own HEAD |
 | `checks` | **RETIRED** (PRD v1.28/v1.32) | hand-authored checks are gone, not merely discouraged: declaring `checks` reds `checks-derived` by name. The check menu is DERIVED from the close's own stages instead — see **Staged close** below. The hazard this removes is measured, not theoretical: job #5's three hand-written checks were re-implementations of three stages the close already ran, and a hand-carved copy can drift LENIENT (the worker passes the operator's ruler and fails the real inspection) |
@@ -496,7 +530,7 @@ Escalations are decision-ready (category, options, spend); cap-halt is its own
 category, never merged with "wrong". A thrown middle is relayed by its `category`
 property (`cap-halt`, `gate-red`, …); an unnamed throw is `interpreter-red`. Close output
 is scrubbed at capture (an injected `redact`, wired to bareguard by `runPlan` with the
-validators' full secret-shape inventory — Bearer/sk-/ghp_/github_pat_/AKIA/xox) so a
+validators' full secret-shape inventory — Bearer/sk-/ghp_/github_pat_/AKIA/xox/AIza) so a
 secret a checked command echoes never enters the append-only spine or a worker prompt —
 a benign gap is byte-identical (secrets hard line; design law #7 intact).
 
@@ -558,7 +592,7 @@ a step, or test it without a provider.
 
 | step | call | what it is |
 |---|---|---|
-| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), all three LIVE as of softgreen module 3 — nothing is locked today (`LOCKED_CLASSES` is empty) — and the interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost two slots since it was frozen (D13's genre confirm, then the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input and asking for it again invites a second, drifting answer for a fact the machine already holds), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is five questions, answers keyed by number; the LEGACY `hitl` set is those five byte for byte plus one more (what the signer is deciding when they look at the result — `human-confirms`' `ask`), which is the spread's next number and moves with a green-side deletion; the `soft-green` set is likewise those five plus two more — Q6 the signed rubric card (what separates a pass from a fail) and Q7 the frozen calibration set (one example to pass, one to fail) — the judged floor's two required inputs. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
+| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), all three sets still EXIST, but the interview ADMITS only what is on the menu: nothing is locked today (`LOCKED_CLASSES` is empty) and `hitl` is UNLISTED (PRD item 31.1), so `runInterview({verdictType:'hitl'})` returns a refusal rather than `ok:true` — ask `MENU_CLASSES` which classes can be authored, never this sentence. The interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost two slots since it was frozen (D13's genre confirm, then the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input and asking for it again invites a second, drifting answer for a fact the machine already holds), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is five questions, answers keyed by number; the RETIRED, UNLISTED `hitl` set (still readable via `questionsFor`, never authorable) is those five byte for byte plus one more (what the signer is deciding when they look at the result — `human-confirms`' `ask`), which is the spread's next number and moves with a green-side deletion; the `soft-green` set is likewise those five plus two more — Q6 the signed rubric card (what separates a pass from a fail) and Q7 the frozen calibration set (one example to pass, one to fail) — the judged floor's two required inputs. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
 | survey | `runAuthorScout({ workdir, provider, attempts?, ceilingUsd? })` → `{ state, facts, reason, meta, raw, raws, calls, budgetStop }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind. **`ceilingUsd` is the operator's money ceiling** (PRD v1.62) — checked BETWEEN attempts and before F59's reserved round, so no paid call escapes it; `null`/absent is UNBOUNDED, and a non-null non-finite value THROWS (the shared `capStop` seam — see `authorClose` below). When it ends the ladder, `budgetStop` names which stop (`cap-halt` \| `pricing-red`) and a survey that was never asked for carries the typed cause `not-funded` — deliberately OUTSIDE `SCOUT_RETRY_CAUSES`, because a retry is precisely what the cap forbade |
 | listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
 | authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does |
@@ -604,10 +638,13 @@ so it takes no `cmd`, no `timeoutMs` and no `env`; it is `offer: false` BY LAW
 (`NEVER_OFFERED_KINDS` — a paid judge is never an in-run ruler); and it SKIPS the seed-verdict
 read (ruling 8) as a recorded `skipped` row.
 
-**Wiring a judged close, and what it costs.** The judge is PINNED (`JUDGE_MODEL`, exported) and
-is never a step knob: the runner supplies `runJob({ judgeProvider })` — its own seam, not
-`provider`/`providerFor` — and a judged stage with none instrument-STOPS as a wiring gap rather
-than grading on whatever binding was at hand. Each locate call is metered per call and emitted
+**Wiring a judged close, and what it costs.** The judge is RESOLVED per job (`resolveJudge`,
+PRD item 32) and is never a step knob or agent-selectable — naming your own examiner is arbiter
+territory, and `judge` is a field the human SIGNS into the hash. The runner supplies BOTH halves,
+`runJob({ judgeProvider, judgeModel })` — its own seam, not `provider`/`providerFor` — and they
+travel together: a judged stage missing EITHER instrument-STOPS as a wiring gap (two distinct
+messages, identity checked first) rather than grading on whatever binding was at hand or under a
+name nobody wrote. Each locate call is metered per call and emitted
 as a distinct `judge-round` spine record, which `runJob`'s ONE ledger accounts exactly like a
 `worker-round` (`ACCOUNTED_ROUND_TYPES`, and `readResume`'s fold reads that same list, so a
 resumed leg cannot silently widen a signed budget by the close's own spend). A budget funds the
@@ -677,8 +714,9 @@ null rather than an exact-looking floor.
 carrying a `judged-floor` stage is refused when no set is stored, when no `judgeLoop` seam is
 wired (a wiring gap, never a silent pass), when the gate is a casualty, and when anything short
 of all-of-them grades. It runs **after** gates 1–3, so no $0 refusal is ever paid for. The
-signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers
-`JUDGE_MODEL`), the graded rows and the battery — beside `judgeModel` itself.
+signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers the
+resolved judge identity), the graded rows and the battery — beside `judgeModel` itself.
+`runCalibration` takes `judgeModel` as a REQUIRED argument and throws without one.
 
 **D9.3 for a judged-ONLY close** (ruling 3, hamr: *"fix it now, we are delivering softgreen"*).
 A judged stage skips the seed read (ruling 8), so a close whose only work stage is judged has no
@@ -692,10 +730,12 @@ bump forces a full recalibration"* used to be an operator-side rule with nothing
 which makes it prose (F45); it now has both halves of a detector. The tier the signer's set was
 graded by is stored beside the cases as **`calibration.judgeModel`** — `CALIBRATION_FIELDS`
 enumerates a stored set as exactly `cases` and `judgeModel` and nothing else — written by
-`foldJudgedArtifacts` from the PIN (`JUDGE_MODEL`) rather than from anything a caller may name.
-Because it is INSIDE the spec, `jobSpecHash` covers it by construction: bump the constant and
-every signed judged spec hashes differently, the signature dies, and the re-sign is what re-runs
-the calibration gate. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
+`foldJudgedArtifacts` from the RESOLVED judge identity the caller hands in (required; it throws
+without one). Because it is INSIDE the spec, `jobSpecHash` covers it by construction: change the
+judge — its model OR its provider — and every signed judged spec hashes differently, the
+signature dies, and the re-sign is what re-runs the calibration gate. `runJudgedFloor` refuses to
+grade when the stored identity is not the one about to grade, naming both, and it does not
+degrade in either direction. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
 on `…calibration.judgeModel`) — a set nobody can attribute to a tier is a floor nobody can tell
 apart from a bumped one. **`declaredStages` stamps it onto the judged stage** as
 `calibrationJudgeModel`, from the SIGNED bytes and through the one seam that already turns a
@@ -1008,7 +1048,18 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
 plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
 provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | hitl-pause |
-hitl-decision-red | step-red:<id>`.
+hitl-decision-red | step-red:<id> | runner-drained`.
+
+**`runner-drained` (F140/PRD item 28(c))** is a distinct class from every outcome above: it is
+NOT `runJob`'s own return value, it is a `beforeExit` backstop's terminal, emitted from outside
+the normal control flow the instant node drains with no `job-end` at all — a provider promise
+that never settled (BA-25's class; bare-agent 0.42.0 closed the known drop cases per F141, but
+"an instrument fires on absence" stays a permanent class, not a fixed bug). It means: exits
+non-zero, `spendComplete:false` always (a drained run's in-flight spend is unknowable — the
+floor already banked is honest, an exact-looking total would not be, F6). **It is deliberately
+NOT in the resumable/checkpoint set** (`CHECKPOINT_OUTCOMES`/`RESUMABLE_HALTS`, `src/reuse.js`)
+— an unknown in-flight state, unlike a clean `cap-halt`/`wall-halt`/`provider-red`, is not a
+known-safe resume point.
 
 **`readShim` (default `false`) — the capped read seam, per ARM.** The value names which levers
 run — the four arms of the frozen Phase 2 pre-registration:
@@ -1191,17 +1242,36 @@ round of this attempt being priced repairs nothing about the one before it); and
 reporting with the rest end of gate"). Every worker Loop (scout, drafter, each step, the fix
 worker — the ONE seam in `planrun.js`) gets exactly ONE extra attempt, and only for a
 transport-class throw — fetch itself throwing with no HTTP response at all (a TLS fault,
-`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause); an HTTP response
-(4xx/5xx/429) is never retried here and rides bare-agent's own unchanged policy. The budget is
-fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob, tighten-only
-doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase, attempt, error,
-recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw before any usage
-figure came back, so **any** transport retry floors `spendComplete` for the rest of the run even
-when the retry recovers and the run finishes green — the same one-way flag class as `stalled`
-and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
+`ECONNRESET`/`EPIPE`/`ETIMEDOUT`, `fetch failed` wrapping a network cause), OR (bare-agent
+0.42.0, BA-25) a response body cut after headers but before it completed — the provider's own
+`guardResponseSettles` rejects that as a retryable `ProviderError` tagged
+`context.bound:'transport'`, which `isTransportFailure` also recognizes (F141). An HTTP response
+(4xx/5xx generally) is never retried here and rides bare-agent's own unchanged policy. The budget
+is fixed (`TRANSPORT_MAX_ATTEMPTS` in `src/transport.js`) — never a job-spec or CLI knob,
+tighten-only doctrine. Each retry emits a report-only `transport-retry` spine record (`{phase,
+attempt, error, recovered}`, no cost field — the ledger is unaffected); the FIRST attempt threw
+before any usage figure came back, so **any** transport retry floors `spendComplete` for the rest
+of the run even when the retry recovers and the run finishes green — the same one-way flag class
+as `stalled` and `cutMidCall`. A wall stop read BETWEEN iterations or steps has no call in flight,
 so it stays exact. Both fields are present on all outcomes, so a consumer never branches on
 field presence and never has to launder a missing `spentUsd` into `$0`.
 
+A **rate-limit retry** (PRD item 28's parked a/b ruling, hamr verbatim: "do a/b as a fallback, and
+verify/validate + no regression"; F143/`src/ratelimit.js`) rides the SAME seam as a second,
+INDEPENDENT one-shot budget: an HTTP 429 gets ONE retry that honours the vendor's own stated
+wait, capped at 60s (`RATE_LIMIT_MAX_WAIT_MS` — a longer stated wait is not honoured at all, no
+retry). This is a FALLBACK, not the primary answer — the primary answer (F139) is picking a
+worker model with adequate rate headroom; this only softens the failure mode when that was not
+enough. The wall always wins here too: before sleeping, a retry that would cost more than
+`clock.remainingMs()` is refused and the error rides straight through, exactly like the transport
+ladder's own wall carve-out. Each retry emits a report-only `rate-limit-retry` spine record
+(`{phase, attempt, statedMs, waitedMs, error, recovered}`, no cost field). Unlike the transport
+retry, a rate-limit retry does **not** floor `spendComplete`: a 429 is a REFUSAL — the vendor
+rejected the request before processing it, so nothing can have been billed (a stated assumption,
+not independently measured against a real provider). The two budgets are independent — a
+transport throw and a 429 may both occur, and both retry, across one call's lifetime, but each at
+most once.
+
 **The plan flow (Layer 2).** `job-start` carries `shape: 'plan'` + the goal; plan steps are
 tool-mode by construction. The flow (`runPlan`, also exported for direct callers who own
 their own ledger): **close precheck** (`already-green` is a
@@ -1645,7 +1715,11 @@ that moved (`door-accept-red`) and a missing registry all come back as named red
   a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
   answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
   stage named and records **nothing**. A pass records the disposition and, over a held judged
-  green, RELEASES the credit through module 6's `applyDoorDecision`.
+  green, RELEASES the credit through module 6's `applyDoorDecision`. `scripts/run-u.mjs` resolves
+  the re-run's ceiling itself via `resolveCloseTimeoutMs` before calling this, and refuses outright
+  (F137) as a named `close-timing-red` door stop — `answerReviewDoor` never called, nothing
+  recorded — if that timing pass itself times out, rather than falling through to `runClose`'s
+  library default.
 - **`rerun`** carries the person's words back as a directive (`next: 'rerun'`) and re-proves
   nothing: the new run's close is what judges. Empty or whitespace text is refused at the same
   seam every other door is.
@@ -2677,7 +2751,7 @@ hash and needs re-approval, exactly like any other semantic edit.
 | `close-sha-mismatch` | `exportBundle` (PRD item 27/M2) | a `close[].sha256` the spec carries does not match the bytes of the script actually being packed into the bundle — the two signatures (this one, and `bundleHash`'s manifest hash over the rewritten script) cover the same bytes by two different paths and must never drift apart silently (N4's own hazard, one layer up). Only fires when a value is PRESENT and wrong; a spec with no sha256 at all reds `missing-required` upstream, at `validateJob` |
 | `close-tampered` | `runPlan` (PRD item 27/M2) | a close script's bytes no longer match its signed `sha256` — checked at run start (alongside `close-absolute-path`, before the close-first precheck and before any provider call) AND before EVERY close run thereafter (`runCloseStages`'s wrapper in `src/planrun.js`, the one seam the precheck/preflight/check-passes/close-fix-loop all share). Distinct from `close-red` (a judged "no" from a working close) and from `close-crashed`/`close-timeout`/`close-killed` (the close ran and hit an instrument fault): this is decided BEFORE the close is even spawned, and it means the close that ran would not have been the one the operator approved. Registered in `CLOSE_FAULTS` (`src/ralph.js`) so it rides out through the same forbidden-zone machinery as every other close fault — never retried, never fed back as a gap |
 | `close-dir-required` | `runPlan` (PRD item 27/M3 Part B) | a close script's source mentions `BARELOOP_CLOSE_DIR` (it reads its own books directory) but the runner was given no `closeDir` at all — `checkCloseDirRequired` (`src/close-integrity.js`) reuses the same `readCloseScripts` reader the other two integrity checks share. $0, run start, before the close-first precheck and before any provider call |
-| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely) |
+| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely). `scripts/run-u.mjs`'s review door hits the SAME red on its own `accept` timing pass (F137) — it refuses the door outright rather than calling `answerReviewDoor` at all, so nothing is recorded |
 | `wall-under-close-timeout` | `runPlan` (PRD item 27/M3) | `job.maxWallMs` is set and is under the EFFECTIVE per-stage close timeout just resolved (autoset or signed) — a budget under one close cannot fund its own close. `validateJob`'s own `MIN_WALL_MS` floor only bounds the un-autoset library default; this run-start check is the honest shape once the real ceiling is known, rather than a silent clamp |
 | `bundle-missing` | `readBundle` | `dir` is not a directory at all |
 | `manifest-invalid` / `spec-invalid` | `readBundle` | `manifest.json`/`spec.json` could not be read or parsed |
@@ -2930,8 +3004,18 @@ blast radius.
 
 ## Gotchas
 
-*TBD from real adopter friction; recorded here as they're found (repo-side friction goes
-to `docs/logs/FINDINGS.md`).*
+*Recorded here as they're found (repo-side friction goes to `docs/logs/FINDINGS.md`).*
+
+- **`non-green-verdict` is a misleading refusal verb, and it is kept on purpose.** When
+  `runInterview` refuses a job for having no git repository (`repoPath` absent), the refusal
+  carries `verb: 'non-green-verdict'` and `path: 'repoPath'`. The name is wrong: the refusal
+  is about the GENRE — this authoring flow drafts code-genre closes against a git seed, and
+  that is true of BOTH classes it offers — not about the verdict class, and it fires for a
+  `soft-green` pick exactly as it does for `green`. **Read `path`, never `verb`, to know what
+  was refused.** The verb is kept because it is the demand ledger's key for this refusal:
+  renaming it would split one running count into two that read as different demands. Named
+  rather than fixed (PRD item 31.2); say so if you would rather have the accurate name and
+  accept the discontinuity.
 
 ## Constraints
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",
@@ -26,7 +26,7 @@
     "prepublishOnly": "npm run build:types"
   },
   "dependencies": {
-    "bare-agent": "^0.39.0",
+    "bare-agent": "^0.42.0",
     "bareguard": "^0.13.0",
     "litectx": "^0.32.0"
   },