bareloop 0.23.0 → 0.24.0

package/src/authorjob.js

@@ -35,11 +35,19 @@
 // same way `repoPath` does — a closed set handed over enumerated, never read out
 // of prose.
 //
-// v1 STILL ADMITS ONLY `green`. A soft-green or hitl pick returns the honest
-// counted refusal on the `request-red` admission path (D13's mechanism), now
-// carrying demand for a VERDICT CLASS rather than only for a genre. It refuses
-// at ADMISSION — before that class's questions are ever asked, because those two
-// question sets are named but locked (`QUESTION_SETS`, M3).
+// THE MENU IS TWO SHAPES: `green` (a command decides done) and `soft-green` (a
+// rubric decides it, through the judged floor). Both are LIVE and both author
+// here. `hitl` is named by the radio, still validates and still runs, and is NOT
+// OFFERED — the class moved to fwdloop (PRD items 29 and 31.1); picking it
+// returns the honest counted refusal on the `request-red` admission path (D13's
+// mechanism), carrying demand for a VERDICT CLASS rather than only for a genre.
+// It refuses at ADMISSION — before that class's questions are ever asked.
+//
+// This comment said the opposite until 2026-09-09 (*"v1 STILL ADMITS ONLY
+// `green`"*), which was false for a long time and sent one build in the wrong
+// direction: `LOCKED_CLASSES` was empty, so `runInterview` returned `ok:true` for
+// every class including the retired one. Check `MENU_CLASSES` at runtime rather
+// than trusting any sentence here, this one included.
 //
 // AND THE INTERVIEW KEYS ON THE CLASS. Three frozen question sets replace one
 // set per genre: genres are a fat tail that cannot be enumerated, classes are
@@ -91,14 +99,15 @@
 // in the stored declaration (forward-compat point 3), and the suite pins it.
 
 import { jobSpecHash, validateJob } from './job.js';
-import { seedAtHead, seedListing, seedRead as runSeedRead, makeSeedTrees, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND } from './kinds.js';
+import { seedAtHead, seedListing, seedRead as runSeedRead, makeSeedTrees, SEED_EXEMPT_KINDS, judgedStages, closeJudges } from './kinds.js';
 // SOFTGREEN modules 4 and 5 — the compile the interview's Q6/Q7 answers land in,
 // and the gate that decides whether the ruler they describe is a ruler.
 import { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts } from './cardauthor.js';
 import { runCalibration } from './calibrate.js';
-import { JUDGE_MODEL, CALIBRATION_SIZE } from './judged.js';
+import { CALIBRATION_SIZE } from './judged.js';
 import {
   GENRE_LANGUAGES, LOCKED_KINDS, TYPES_GENRE, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES,
+  UNLISTED_CLASSES, MENU_CLASSES,
 } from './authoring.js';
 import { QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook } from './authorflow.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
@@ -123,7 +132,7 @@ export { QUESTION_SETS, questionsFor, requiredAnswersFor };
  * rule about it: illegal becomes inexpressible instead of rejected after the
  * fact (the `check-passes(name)` model). A UI renders it as three buttons, and
  * two of them are marked locked. */
-export { VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES };
+export { VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, UNLISTED_CLASSES, MENU_CLASSES };
 
 /** The territory every refusal here lands against. bareloop's OWN catalogue —
  * the genre menu, the verdict menu, the kind menu — never a bare-suite package.
@@ -141,6 +150,15 @@ const LEVERS = ([
   'wait for the verdict-classes rung — this refusal is the evidence it waits on',
 ]);
 
+/** the levers for an UNLISTED class (PRD item 31.1): the class is BUILT, so
+ * "wait for the rung" is the wrong sentence — there is no rung left to wait on.
+ * The honest next step is the other product, or a class this one still offers. */
+/** @type {string[]} */
+const UNLISTED_LEVERS = ([
+  'restate the job for a class bareloop still offers: green (a command decides done) or soft-green (a rubric does)',
+  'take a job that needs a person\'s sign-off to fwdloop — that product is built for the human-in-the-loop shape',
+]);
+
 /**
  * One refusal, in the shape both the caller and the ledger need.
  * @param {{verb: string|null, path: string, detail: string, kind?: 'request-red'|'decision-ready', options?: string[]}} o
@@ -236,17 +254,33 @@ export function runInterview({ answers, verdictType = null, repoPath = null, que
     return out({});
   }
 
-  // A LOCKED class refuses HERE, before its questions are asked. Counted demand
-  // for the class itself — the verdict-classes rung is what this evidence is for.
-  if (LOCKED_CLASSES.includes(picked)) {
+  // A class that is not ON THE MENU refuses HERE, before its questions are asked.
+  // Counted demand for the class itself — the verdict-classes rung is what this
+  // evidence is for. TWO reasons a pick lands here, and they are different facts
+  // (PRD item 31.1):
+  //   * LOCKED   — no guard battery exists, so nothing could validate the close.
+  //   * UNLISTED — the class is built and still RUNS; this product just no longer
+  //                offers it. `hitl` moved to fwdloop (item 29); its code, tests
+  //                and runtime stay, and an existing hitl spec still validates.
+  // Either way the person cannot author one, and the refusal says which it is
+  // rather than pooling two different situations into one sentence.
+  if (LOCKED_CLASSES.includes(picked) || UNLISTED_CLASSES.includes(picked)) {
+    const unlisted = UNLISTED_CLASSES.includes(picked);
     return out({
       refusal: refuse({
         verb: picked,
         path: 'verdictType',
-        detail: `You picked "${picked}", and v1 cannot close that yet: it admits ${LIVE_CLASSES.join(', ')} only — a `
-          + 'job whose done a command can decide. A judged score and a person\'s sign-off are named in the menu and '
-          + 'locked, so picking one is recorded as demand rather than dropped, and this refusal is the evidence the '
-          + 'verdict-classes rung waits on.',
+        options: unlisted ? UNLISTED_LEVERS : LEVERS,
+        detail: unlisted
+          ? `You picked "${picked}", and this product no longer offers that class: the menu is `
+            + `${MENU_CLASSES.join(', ')} — a job whose done a command can decide, or one whose done needs `
+            + 'judgement against a rubric. A person\'s sign-off moved to fwdloop, which is built for it. The '
+            + 'class itself is not deleted — an existing spec still validates and still runs — so picking one is '
+            + 'recorded as demand rather than dropped.'
+          : `You picked "${picked}", and v1 cannot close that yet: it admits ${MENU_CLASSES.join(', ')} only — a `
+            + 'job whose done a command can decide. A class with no guard battery is named in the menu and locked, '
+            + 'so picking one is recorded as demand rather than dropped, and this refusal is the evidence the '
+            + 'verdict-classes rung waits on.',
       }),
     });
   }
@@ -277,21 +311,32 @@ export function runInterview({ answers, verdictType = null, repoPath = null, que
   }
   if (reds.length) return out({ answers: given });
 
-  // The green pick's own precondition: D1's "a repo is never a precondition"
-  // holds for the INTERVIEW and not for D9's validity gates, all three of which
-  // rest on a runnable patient with a git seed. A doc or a website job has no
-  // seed and no changed set, so nothing deterministic can be measured against it
-  // — that is softgreen/hitl territory, out of v1, refused on the same counted
+  // A GENRE precondition, not a class one — and the difference is why this text
+  // was wrong until 2026-09-09 (PRD item 31.2). It used to answer a missing repo
+  // with "that needs a judged (soft-green) or a human close", which told a person
+  // who had just PICKED soft-green that they needed soft-green. Both live classes
+  // land here identically: D1's "a repo is never a precondition" holds for the
+  // INTERVIEW and not for D9's validity gates, all three of which rest on a
+  // runnable patient with a git seed, and the close CATALOGUE is code-genre only
+  // (doc-genre kinds are not admitted — PRD item 26). So a doc or a website job
+  // refuses for want of a SEED, whichever class it picked, on the same counted
   // path. The class the user picked cannot be honoured, so it is not returned.
+  //
+  // The `verb` stays `non-green-verdict` deliberately. It is the ledger's key for
+  // this demand and renaming it would split one running count into two that look
+  // like different demands; the name is a poor description of a genre refusal,
+  // and that is a smaller cost than a discontinuous ledger.
   if (!isNonEmptyString(repoPath)) {
     return out({
       answers: given,
       refusal: refuse({
         verb: 'non-green-verdict',
         path: 'repoPath',
-        detail: 'This job has no code repository, so there is no seed to measure against and no changed set to read — '
-          + 'nothing deterministic can decide whether it came back done. That needs a judged (soft-green) or a '
-          + 'human close; this authoring flow drafts code-genre closes against a git seed only.',
+        detail: 'This job has no code repository, so there is no seed to measure against and no changed set to '
+          + 'read. This authoring flow drafts CODE-GENRE closes against a git seed only, and that is true of both '
+          + 'classes it offers: a green close runs commands over the tree, and a soft-green close judges the '
+          + 'artifacts the run changed in it. A job with no repository needs a doc-genre close, which is not built '
+          + 'here yet.',
       }),
     });
   }
@@ -370,7 +415,7 @@ function composerRefusal(reds) {
  * @param {{answers: Record<string|number, any>, repoPath?: string|null, lang: string,
  *   verdictType?: string|null,
  *   questions?: Record<string|number, string>|null, generate?: Function, provider?: any,
- *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null,
+ *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
  *   onPhase?: (phase: string, data?: any) => void,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
@@ -384,6 +429,11 @@ export async function authorCloseForJob({
   answers, repoPath = null, lang, verdictType = null, questions = null,
   generate, provider = null, seedRef = null, scout = null, listing = null,
   ceilingUsd = null,
+  // THE JUDGE IDENTITY (PRD item 32.1), required only on the path that actually
+  // composes a judged stage — the stored calibration set carries the judge that
+  // certified it, and there is no library pin to fall back to. Absent on a purely
+  // mechanical close is correct and costs nothing: that close never judges.
+  judgeModel = null,
   // THE PROGRESS SEAMS. This composition is the pipeline's long silence — a real
   // survey, a real declaration ladder, and a real toolchain per close stage — and
   // it emitted nothing until it returned, so an operator watching a live run
@@ -573,7 +623,7 @@ export async function authorCloseForJob({
   // as the caller-error guard it is.
   /** @type {any} */
   let judged = null;
-  if ((closeDecl.stages ?? []).some((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND)) {
+  if (closeJudges(closeDecl)) {
     // ONE CEILING, ALL THREE PAID SEAMS. The declaration loop's own calls are
     // ABSORBED before the compile is asked for, so the ceiling folds in prior
     // spend and re-invoking a seam cannot silently widen it. `absorb` deliberately
@@ -620,7 +670,14 @@ export async function authorCloseForJob({
     // non-array before anything can be `ok` — and the narrowing is stated rather
     // than defaulted: `?? []` here would fold an EMPTY signed set into a close,
     // which is the one direction that must never be reachable.
-    closeDecl = foldJudgedArtifacts(closeDecl, { card: signed.card, cases: /** @type {any[]} */ (signed.cases) });
+    if (typeof judgeModel !== 'string' || judgeModel.trim() === '') {
+      throw new Error('[authorjob] authorCloseForJob composed a JUDGED close and was given no judgeModel (PRD item '
+        + '32.1). The stored calibration set carries the judge that certified it, and a set stamped with a model '
+        + 'nobody named is exactly the unattributable floor that field exists to prevent.');
+    }
+    closeDecl = foldJudgedArtifacts(closeDecl, {
+      card: signed.card, cases: /** @type {any[]} */ (signed.cases), judgeModel,
+    });
     return {
       ok: true,
       refusal: null,
@@ -760,12 +817,15 @@ const scrubRed = (r) => /** @type {any} */ (Object.fromEntries(
  * The book is built HERE and PRIOR SPEND IS ABSORBED into it, so the ceiling folds in
  * what the earlier seams already spent and re-invoking a seam cannot silently widen
  * it; the gate reads it between calls and stops as a refusal that names money.
- * @param {{spec: any, judgedStages: any[], judgeLoop: Function|null,
+ * `judgeModel` is the RESOLVED judge identity (PRD item 32.1), required and with no
+ * default: it is stamped onto the graded set and onto the calibration-missing record
+ * alike, so both say which judge the close would have been certified by.
+ * @param {{spec: any, judgedStages: any[], judgeLoop: Function|null, judgeModel: string,
  *   onJudgeCost: ((c: any) => void)|null, calibrateFn: Function,
  *   ceilingUsd: number|null, priorCalls: any[]}} o
  * @returns {Promise<{ok: boolean, record: any, reds: Red[], refusal: Refusal|null}>}
  */
-async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, calibrateFn, ceilingUsd, priorCalls }) {
+async function calibrationGate({ spec, judgedStages, judgeLoop, judgeModel, onJudgeCost, calibrateFn, ceilingUsd, priorCalls }) {
   const cases = spec.closeDecl?.calibration?.cases ?? null;
   // ONE card, and it is the SIGNED one — the card the calibration is graded
   // against must be the card the close will RUN, or the gate certifies a ruler
@@ -779,7 +839,7 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
       + 'ruler is unmeasured, and an unmeasured ruler cannot be signed.';
     return {
       ok: false,
-      record: { ok: false, stop: 'calibration-missing', judgeModel: JUDGE_MODEL, required: CALIBRATION_SIZE },
+      record: { ok: false, stop: 'calibration-missing', judgeModel, required: CALIBRATION_SIZE },
       reds: [{ code: 'calibration-missing', path: 'closeDecl.calibration.cases', detail }],
       refusal: refuse({
         kind: 'decision-ready',
@@ -805,6 +865,7 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
     cases,
     card,
     judgeLoop,
+    judgeModel,
     // the gate's own calls join the same tally the ceiling is read against — a
     // ceiling that cannot see the spend it bounds is F45's blind detector in a
     // money coat. The caller's reporter fires with the call's whole record, after.
@@ -942,8 +1003,8 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
  *
  * @param {{spec: any, workdir: string, seedRef?: string|null, shellCapUsd?: number,
  *   timeoutMs?: number, seedFn?: Function, listingFn?: Function, seedReadFn?: Function,
- *   judgeLoop?: Function|null, onJudgeCost?: ((c: any) => void)|null, calibrateFn?: Function,
- *   ceilingUsd?: number|null, priorCalls?: any[]}} o
+ *   judgeLoop?: Function|null, judgeModel?: string|null, onJudgeCost?: ((c: any) => void)|null,
+ *   calibrateFn?: Function, ceilingUsd?: number|null, priorCalls?: any[]}} o
  * @returns {Promise<{ok: boolean, specHash: string|null, seedRef: string|null,
  *   gates: any, work: any[], guards: any[], stops: any[], reds: Red[], refusal: Refusal|null}>}
  */
@@ -953,8 +1014,11 @@ export async function prepareSigning({
   // THE PAID SEAM, and it is the operator's to wire — this module owns no
   // provider and picks none (the same contract `authorCloseForJob` keeps for the
   // drafting model). Absent is never a fall-back: a judged close whose gate could
-  // not run is refused, not waved through.
-  judgeLoop = null, onJudgeCost = null, calibrateFn = runCalibration,
+  // not run is refused, not waved through. `judgeModel` is the seam's other half
+  // (PRD item 32.1) — WHICH model that loop drives, resolved by the caller
+  // (`resolveJudge`, src/judged.js). The two travel together: a gate that grades
+  // without recording its judge certifies a floor nobody can attribute.
+  judgeLoop = null, judgeModel = null, onJudgeCost = null, calibrateFn = runCalibration,
   // THE OPERATOR'S CEILING, and the spend it has already met. `null`/absent is
   // UNBOUNDED and is a stated choice, never a default invented here (the same
   // contract `authorCloseForJob` keeps). `priorCalls` is what the earlier paid
@@ -1109,9 +1173,17 @@ export async function prepareSigning({
   // validator checks a stored set for LEGALITY only and deliberately allows a
   // judged stage with no set at all, because making it mandatory is a signing
   // decision and this is the signing gate.
-  const judgedStages = (spec.closeDecl.stages ?? []).filter((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND);
-  if (judgedStages.length) {
-    const cal = await calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, calibrateFn, ceilingUsd, priorCalls });
+  const judged = judgedStages(spec.closeDecl);
+  if (judged.length) {
+    if (judgeLoop !== null && (typeof judgeModel !== 'string' || judgeModel.trim() === '')) {
+      throw new Error('[authorjob] prepareSigning was wired a judgeLoop with no judgeModel (PRD item 32.1). The two '
+        + 'halves of the judge seam travel together: the graded set is stamped with the judge that certified it, and '
+        + 'there is no library pin to fall back to.');
+    }
+    const cal = await calibrationGate({
+      spec, judgedStages: judged, judgeLoop, judgeModel: /** @type {string} */ (judgeModel),
+      onJudgeCost, calibrateFn, ceilingUsd, priorCalls,
+    });
     base.gates.calibration = cal.record;
     if (!cal.ok) return { ...base, work, guards, reds: cal.reds, refusal: cal.refusal };
   }

package/src/calibrate.js

@@ -46,7 +46,9 @@
 //     calibration becomes a refusal, exactly as D9's other three gates work.
 //   * IT PICKS NO NUMBER. The size is `CALIBRATION_SIZE` (hamr's), the floor is
 //     all-of-them (hamr's), the ladder is `JUDGE_ATTEMPTS` (operator-confirmed),
-//     and the model is `JUDGE_MODEL` (pinned). Nothing here invents a threshold.
+//     and the model is the run's RESOLVED judge identity, handed in (PRD item
+//     32.1) rather than pinned in this library. Nothing here invents a threshold
+//     and nothing here picks a judge.
 //   * IT OWNS NO PROVIDER. The judge seam arrives as `judgeLoop`; an absent one
 //     is a WIRING GAP that stops the gate, never a silent skip — a judged close
 //     signed off a calibration nobody ran is the exact state this gate exists to
@@ -58,7 +60,7 @@
 
 import { createHash } from 'node:crypto';
 import {
-  JUDGE_MODEL, LOCATE_LABEL, LOCATE_AXES, CALIBRATION_SIZE,
+  LOCATE_LABEL, LOCATE_AXES, CALIBRATION_SIZE,
   runLocate, decide, expectedOf, validateCard, validateCalibrationSet,
 } from './judged.js';
 import { JUDGE_ATTEMPTS } from './kinds.js';
@@ -309,11 +311,11 @@ export function factsResist(facts, gold, artifactText) {
  * when the model is malforming, which is the worst moment for a paid ladder to be
  * unbounded. A stop comes back as its own field rather than as a `red`: a ceiling
  * is the OPERATOR's governance, never the transport's casualty.
- * @param {{artifactText: string, card: any, judgeLoop: Function, attempts: number,
+ * @param {{artifactText: string, card: any, judgeLoop: Function, judgeModel: string, attempts: number,
  *   meter: (c: any) => void, id: string, kind: string,
  *   capStop: () => 'cap-halt'|'pricing-red'|null}} o
  */
-async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, kind, capStop }) {
+async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, meter, id, kind, capStop }) {
   /** @type {any} */
   let last = null;
   /** @type {any[]} */
@@ -341,7 +343,7 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
       // when ITS OWN wall is unbounded (`PROVIDER_TIMEOUT_MS`, src/clock.js).
       callBounds: { timeoutMs: PROVIDER_TIMEOUT_MS },
       onCost: (c) => meter({
-        id, kind, attempt, label: CALIBRATION_LABEL, model: JUDGE_MODEL,
+        id, kind, attempt, label: CALIBRATION_LABEL, model: judgeModel,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
       }),
     });
@@ -381,7 +383,13 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
  * graded one: `ok` is false, the cases nobody bought are absent rather than recorded
  * as failures, and `casualty` stays null — the transport was fine, the operator's own
  * governance stopped the gate.
- * @param {{cases: any, card: any, judgeLoop: Function|null,
+ * `judgeModel` is REQUIRED and has no default (PRD item 32.1). It is the identity
+ * the caller resolved (`resolveJudge`, src/judged.js) and it is what the graded set
+ * is STAMPED with — `setHash` folds it in, so a set certified by one judge cannot be
+ * mistaken for the same set certified by another. A default here would be the silent
+ * fall-back the whole judge-identity change exists to remove: a gate that grades
+ * under a model nobody named certifies a floor nobody can attribute.
+ * @param {{cases: any, card: any, judgeLoop: Function|null, judgeModel: string,
  *   onCost?: (c: any) => void, attempts?: number, battery?: any[], batteryCard?: any,
  *   capStop?: () => 'cap-halt'|'pricing-red'|null}} o
  * @returns {Promise<{ok: boolean, stop: string|null, casualty: any,
@@ -392,12 +400,25 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
  *   costUsd: number|null, knownUsd: number, spendComplete: boolean, calls: any[]}>}
  */
 export async function runCalibration({
-  cases, card, judgeLoop, onCost = () => {},
+  cases, card, judgeLoop, judgeModel, onCost = () => {},
   attempts = JUDGE_ATTEMPTS,
   battery = /** @type {any[]} */ (/** @type {unknown} */ (INJECTION_LOCATE_BATTERY)),
   batteryCard = INJECTION_CARD,
   capStop = () => null,
 }) {
+  // The mandatory-identity throw guards a REAL judge seam graded under nobody's
+  // name — it does not apply when there is no seam at all. A caller wiring no
+  // `judgeLoop` (an adopter who has not connected a judge yet) legitimately hands
+  // in no `judgeModel` either, and that case is the WIRING-GAP `no-judge` stop
+  // below, returned as a red rather than thrown. Throwing here ahead of that
+  // check would make the wiring-gap stop unreachable through its own documented
+  // path — `prepareSigning` (src/authorjob.js) draws exactly this same line with
+  // its own `judgeLoop !== null` guard, and this function has to agree with it.
+  if (typeof judgeLoop === 'function' && (typeof judgeModel !== 'string' || judgeModel.trim() === '')) {
+    throw new Error('[calibrate] runCalibration needs the resolved judgeModel (PRD item 32.1): the graded set is '
+      + 'STAMPED with the judge that certified it, and a set nobody can attribute is a floor nobody can tell apart '
+      + 'from one graded by a different model. There is no library pin to fall back to.');
+  }
   /** @type {any[]} */
   const calls = [];
   /** @param {any} c */
@@ -413,7 +434,7 @@ export async function runCalibration({
     return /** @type {any} */ ({
       ok: false, stop: null, casualty: null, graded: [], failures: [],
       injection: { styles: [], allResisted: false, leaks: [] },
-      reds: [], judgeModel: JUDGE_MODEL,
+      reds: [], judgeModel,
       cardHash: null, casesHash: null, setHash: null,
       costUsd: t.costUsd, knownUsd: t.knownUsd, spendComplete: t.spendComplete, calls: calls.map((c) => ({ ...c })),
       ...extra,
@@ -464,7 +485,7 @@ export async function runCalibration({
         code: 'no-judge-seam',
         path: 'judgeLoop',
         detail: `the calibration gate runs ${CALIBRATION_SIZE} real locate calls plus ${battery.length} injection `
-          + `artifacts through ${JUDGE_MODEL}, and no judge seam was wired. An absent seam is an adopter wiring gap and `
+          + `artifacts through ${judgeModel}, and no judge seam was wired. An absent seam is an adopter wiring gap and `
           + 'never a fall-back: a gate that grades nothing would certify every close it was asked about',
       }],
     });
@@ -472,7 +493,7 @@ export async function runCalibration({
 
   const cardHash = artifactHash(card);
   const casesHash = artifactHash(cases);
-  const setHash = artifactHash({ card, cases, judgeModel: JUDGE_MODEL });
+  const setHash = artifactHash({ card, cases, judgeModel });
   const stamped = { cardHash, casesHash, setHash };
 
   // ── the signed ten ────────────────────────────────────────────────────────
@@ -480,7 +501,7 @@ export async function runCalibration({
   const graded = [];
   for (const c of cases) {
     const r = await pipeOnce({
-      artifactText: String(c.artifact), card, judgeLoop: /** @type {Function} */ (judgeLoop),
+      artifactText: String(c.artifact), card, judgeLoop: /** @type {Function} */ (judgeLoop), judgeModel,
       attempts, meter, id: String(c.id), kind: 'case', capStop,
     });
     // the ceiling, ahead of the casualty branch: a call nobody funded is not a call
@@ -527,7 +548,7 @@ export async function runCalibration({
   const styles = [];
   for (const b of battery) {
     const r = await pipeOnce({
-      artifactText: b.artifact, card: batteryCard, judgeLoop: /** @type {Function} */ (judgeLoop),
+      artifactText: b.artifact, card: batteryCard, judgeLoop: /** @type {Function} */ (judgeLoop), judgeModel,
       attempts, meter, id: b.id, kind: 'injection', capStop,
     });
     if (r.budget) {

package/src/cardauthor.js

@@ -60,10 +60,10 @@
 // pipe produces are one shape read twice (module 5 compares them mechanically).
 
 import {
-  JUDGE_RULE_IDS, JUDGE_RULES, CALIBRATION_SIZE, CASE_VERDICTS, validateJudgedArtifacts, JUDGE_MODEL,
+  JUDGE_RULE_IDS, JUDGE_RULES, CALIBRATION_SIZE, CASE_VERDICTS, validateJudgedArtifacts,
 } from './judged.js';
 import { askStructured, makeCostBook } from './authorflow.js';
-import { JUDGED_FLOOR_KIND } from './kinds.js';
+import { judgedStages } from './kinds.js';
 import { isObj, redactSecrets } from './validate.js';
 
 /** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
@@ -363,15 +363,16 @@ export function signJudgedArtifacts({ proposal, fix = null }) {
  *   - THE CASES land beside the stages as `calibration.cases` — a close-level
  *     artifact, because the set calibrates the RULER and not one stage's params,
  *     and because module 5's gate reads it before any stage runs.
- *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`, and it is the
- *     PIN (`JUDGE_MODEL`) rather than anything a caller may name. A calibration set
- *     is only worth the tier that graded it — §4.2's whole safety argument is worth
- *     exactly as much as BA-20's injection evidence, which is haiku-4.5's alone — so
- *     the set has to carry which tier certified it or nothing downstream can tell a
- *     signed floor from a bumped one. Storing it HERE, inside the spec, is what makes
- *     a bump flip `jobSpecHash`: the signature dies, the signer re-signs, and a
- *     re-sign is a re-run of the calibration gate. That is the docstring on
- *     `JUDGE_MODEL` finally given a detector instead of a promise (F45).
+ *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`. Since PRD item
+ *     32.1 that is the RESOLVED judge identity the caller hands in (`resolveJudge`,
+ *     src/judged.js — the spec's signed `judge` override, else the job's own worker
+ *     model), not a library pin. A calibration set is only worth the judge that
+ *     graded it, so the set has to carry which judge certified it or nothing
+ *     downstream can tell a signed floor from a moved one. Storing it HERE, inside
+ *     the spec, is what makes a judge change flip `jobSpecHash`: the signature dies,
+ *     the signer re-signs, and a re-sign is a re-run of the calibration gate. It is
+ *     REQUIRED, with no default — a set stamped with a model nobody named is exactly
+ *     the unattributable floor this field exists to prevent (F45).
  *
  * A card with NOWHERE TO LAND THROWS. It is a caller's own broken input — a
  * signed rubric folded into a close with no judged ruler — and there is no safe
@@ -380,20 +381,26 @@ export function signJudgedArtifacts({ proposal, fix = null }) {
  * The input is never mutated: a closeDecl is a signed artefact and rewriting a
  * caller's copy in place is how two readers come to disagree about what was
  * signed.
- * @param {any} closeDecl @param {{card: any, cases: any[]}} o
+ * @param {any} closeDecl @param {{card: any, cases: any[], judgeModel: string}} o
  * @returns {any} a new closeDecl
  */
-export function foldJudgedArtifacts(closeDecl, { card, cases }) {
+export function foldJudgedArtifacts(closeDecl, { card, cases, judgeModel }) {
+  if (typeof judgeModel !== 'string' || judgeModel.trim() === '') {
+    throw new Error('[cardauthor] foldJudgedArtifacts needs the resolved judgeModel (PRD item 32.1): the stored set '
+      + 'carries the judge that certified it, and there is no library pin to fall back to.');
+  }
   const out = structuredClone(closeDecl);
-  const stages = Array.isArray(out?.stages) ? out.stages : [];
-  const judged = stages.filter((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND);
+  // `judgedStages` filters `out`'s OWN stage objects, so the card assignment
+  // below mutates the clone in place — the reason this reads `out`, not the
+  // caller's `closeDecl`.
+  const judged = judgedStages(out);
   if (judged.length !== 1) {
     throw new Error(`[cardauthor] the signed card folds into the close's ONE judged-floor stage, and this close has `
       + `${judged.length} — a rubric with nowhere to land is signed evidence nothing reads, and a second judged stage `
       + 'is a second bar for one verdict');
   }
   judged[0].params = { ...(isObj(judged[0].params) ? judged[0].params : {}), card: structuredClone(card) };
-  out.calibration = { cases: structuredClone(cases), judgeModel: JUDGE_MODEL };
+  out.calibration = { cases: structuredClone(cases), judgeModel };
   return out;
 }
 

package/src/cli.js

@@ -31,7 +31,7 @@ import {
 
 import {
   exportBundle, readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps,
-  runJob, makeSpine, loadRegistry, listingRow, jobSpecHash, resolveWorkerModel, JUDGE_MODEL,
+  runJob, makeSpine, loadRegistry, listingRow, jobSpecHash, resolveWorkerModel, resolveJudge,
 } from './index.js';
 import { resolveProvider, buildRunnerProviders } from './providers.js';
 
@@ -84,9 +84,34 @@ function buildProviders(apiKey, spec) {
   const MODEL = modelResolution.model;
   const tierModels = modelResolution.source === 'spec' ? { ...entry.tiers, sonnet: MODEL } : entry.tiers;
   const baseUrl = isObj(spec) && typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined;
-  return buildRunnerProviders({
-    providerName, apiKey, model: MODEL, tierModels, baseUrl, judgeApiKey: apiKey, judgeModel: JUDGE_MODEL,
+  // THE JUDGE, RESOLVED RATHER THAN PINNED (PRD item 32.1/32.2). The bundle
+  // runner's key contract is `ANTHROPIC_API_KEY`-only and the refusal above has
+  // already established that the WORKER provider reads that key — so a judge
+  // defaulting to the worker's own identity reads the same key by construction,
+  // and a signed `judge` naming a different provider would need a key this
+  // runner does not have. That case refuses here, at $0, by name — the same
+  // shape and the same reason as the worker refusal above, never a call made
+  // with the wrong vendor's key.
+  const judge = resolveJudge({
+    specJudge: isObj(spec) ? spec.judge : undefined,
+    workerProvider: providerName,
+    workerModel: MODEL,
   });
+  const judgeEntry = resolveProvider(judge.provider);
+  if (judgeEntry.envKey !== 'ANTHROPIC_API_KEY') {
+    throw new Error(
+      `bareloop run: this bundle's spec names judge provider "${judge.provider}", which reads `
+      + `${judgeEntry.envKey}. The bundle runner's key contract is ANTHROPIC_API_KEY only, so it `
+      + 'refuses rather than calling that provider with the wrong key. Run this job through scripts/run-u.mjs.',
+    );
+  }
+  return {
+    ...buildRunnerProviders({
+      providerName, apiKey, model: MODEL, tierModels, baseUrl,
+      judgeApiKey: apiKey, judgeModel: judge.model, judgeProviderName: judge.provider, judgeBaseUrl: baseUrl,
+    }),
+    judgeModel: judge.model,
+  };
 }
 
 /** @param {string[]} args @returns {{ positional: string[], flags: Record<string, string|true> }} */
@@ -236,6 +261,11 @@ async function doRun(args, { out, err, cwd, env, now, deps }) {
   // provider (the test seam). Absent and no injected provider: print the
   // operator questions (the bundle's own README) and the hash, spend nothing.
   let { provider, providerFor, judgeProvider } = deps;
+  // the judge IDENTITY travels with the judge PROVIDER (PRD item 32.1). A test
+  // injecting `deps.judgeProvider` may name it too; absent, it is resolved
+  // alongside the real providers below, and a judged stage with neither stops as
+  // a wiring gap rather than grading under a name nobody wrote.
+  let judgeModel = /** @type {string|null} */ (deps.judgeModel ?? null);
   if (!provider) {
     const apiKey = env.ANTHROPIC_API_KEY;
     if (!apiKey) {
@@ -246,7 +276,7 @@ async function doRun(args, { out, err, cwd, env, now, deps }) {
       return 0;
     }
     try {
-      ({ provider, providerFor, judgeProvider } = buildProviders(apiKey, bundle.spec));
+      ({ provider, providerFor, judgeProvider, judgeModel } = buildProviders(apiKey, bundle.spec));
     } catch (e) {
       // a refusal from the key contract above: name it and spend nothing
       err(String(/** @type {any} */ (e)?.message ?? e));
@@ -338,6 +368,7 @@ async function doRun(args, { out, err, cwd, env, now, deps }) {
       provider,
       providerFor,
       judgeProvider,
+      judgeModel,
       emit,
       closeDir,
       shellCapUsd: runSpec.budgetUsd,
@@ -470,7 +501,7 @@ async function runMenu(deps, ctx) {
  * code, so `bin/bareloop.mjs` can set `process.exitCode` and let node flush
  * queued stdout on its own (F-something: `process.exit()` can discard it).
  * @param {string[]} argv
- * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, now?: () => number, stdin?: any }} deps
+ * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any }} deps
  * @returns {Promise<number>}
  */
 export async function main(argv, deps = {}) {

package/src/declaredclose.js

@@ -68,7 +68,7 @@
 // once instead of once-per-invocation, but `runPlan` has a dozen return paths and
 // a leaked worktree outlives the process that made it.
 
-import { runStage, makeSeedTrees, STOP_FAULTS, EXIT_RED, JUDGED_FLOOR_KIND } from './kinds.js';
+import { runStage, makeSeedTrees, STOP_FAULTS, EXIT_RED, JUDGED_FLOOR_KIND, judgedStages } from './kinds.js';
 import {
   validateDeclaration, classGuards, genreOwnedEnvNames, ungroundedGenreEnv, GENRE_LANGUAGES, TYPES_GENRE,
   VERDICT_CLASSES, LIVE_CLASSES, NEVER_OFFERED_KINDS,
@@ -424,8 +424,7 @@ export function validateCloseDecl(closeDecl, opts = {}) {
   // redded here — making the set MANDATORY is the signing gate's call, and
   // module 5 owns it.
   if (closeDecl.calibration !== undefined) {
-    const judged = (Array.isArray(closeDecl.stages) ? closeDecl.stages : [])
-      .filter((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND);
+    const judged = judgedStages(closeDecl);
     if (!isObj(closeDecl.calibration)) {
       red('invalid-value', `${at}.calibration`, 'the frozen calibration set, as an object carrying `cases`');
     } else if (judged.length !== 1) {
@@ -567,6 +566,7 @@ function translate(r, redact) {
  *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
  *   humanRuling?: {decision: string, text?: string|null}|null,
  *   judgeLoop?: ((o: {system: string}) => any)|null,
+ *   judgeModel?: string|null,
  *   onJudgeCost?: ((c: any) => void)|null,
  *   callBounds?: (() => {timeoutMs?: number, deadlineMs?: number})|null}} [opts]
  * @returns {Promise<any>}
@@ -574,7 +574,7 @@ function translate(r, redact) {
 export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
   const {
     timeoutMs, cwd, seedRef, seedTrees: shared, gapCap, maxBuffer, baselineMode, humanRuling = null,
-    judgeLoop = null, onJudgeCost = null, callBounds = null,
+    judgeLoop = null, judgeModel = null, onJudgeCost = null, callBounds = null,
   } = opts;
   if (!isNonEmptyString(cwd) || !isNonEmptyString(seedRef)) {
     // Refuse rather than guess. A declared close measures against a SEED; a
@@ -604,13 +604,20 @@ export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
     // human stage reads the absence as "nobody has answered yet", which is the
     // whole of what a pause means.
     humanRuling,
-    // THE PAID SEAM and THE METER, both operator territory and both absent on
-    // every mechanical close. A judged stage with no seam STOPS as a wiring gap
-    // rather than falling back to some other model (M1 owns no provider and the
-    // judge tier is pinned), and every locate call it does buy is reported OUT
-    // through the meter so the run's ONE ledger can see it — a close has cost $0
-    // until this kind, and a budget must fund the attempt PLUS its close.
+    // THE PAID SEAM, THE IDENTITY and THE METER, all operator territory and all
+    // absent on every mechanical close. A judged stage with no seam STOPS as a
+    // wiring gap rather than falling back to some other model (M1 owns no
+    // provider), and `judgeModel` is the seam's OTHER half (PRD item 32.1) —
+    // WHICH model the seam drives, resolved by the caller (`resolveJudge`,
+    // src/judged.js) and passed through untouched here, exactly as `judgeLoop`
+    // is. `runStage` checks the identity before the seam, so a judged stage with
+    // neither wired reports the identity gap, and one with only the seam missing
+    // still names the judge it would have graded with. Every locate call the
+    // seam buys is reported OUT through the meter so the run's ONE ledger can
+    // see it — a close has cost $0 until this kind, and a budget must fund the
+    // attempt PLUS its close.
     judgeLoop,
+    judgeModel,
     onJudgeCost,
     // F152/PRD 30.4 — the SAME per-call time bounds every worker round already
     // carries (`callBounds()`, src/planrun.js:1518), so the judged stage's own