bareloop 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -5,6 +5,224 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.25.0] — 2026-09-12
+
+### Added
+
+- **The source front door** (PRD item 33/M2) — a plain folder, a plain file, or one
+  `http(s)` URL now runs without a `--patient` git checkout: `prepareSource`
+  (`src/source.js`) freezes it into a hidden, scratch git tree bareloop owns (the person
+  never sees the repo), `proveDestination` proves a drop-off file is landable at $0 before
+  any token spends, and `copyOut` delivers the run's own output there once, on a minted
+  green, never overwriting. New CLI `scripts/prep-source.mjs`. `scripts/run-u.mjs` wires
+  both: a manifest-declared destination refuses before any token, and copies out on a
+  green (a refused copy-out never changes the verdict). The destination is a PER-RUN value
+  recorded in the manifest (`<into>/source.json`), never a signed job-spec field — a job
+  spec is a repeatable shape, signed once; nothing was added to `job.js`/`jobSpecHash`.
+  Exported: `prepareSource`, `proveDestination`, `copyOut`, `readSourceManifest`,
+  `frontDoorFromManifest`. `git()` (`src/kinds.js`) is now exported for reuse by this
+  module rather than re-spawned a second way.
+
+### Fixed
+
+- **Source front door (PRD item 33/M2 review):** `output` is now validated the ONE way
+  everywhere it is read or written (new `output-invalid` refusal) — a bare
+  `resolve(tree, output)` previously let a shape like `output/../../x` escape the frozen
+  tree; a hand-edited manifest carrying such a value is now treated as no front door at
+  all by `frontDoorFromManifest`, never handed to `copyOut` unvalidated. `prepareSource`
+  now proves the destination (`proveDestination`) BEFORE creating `into`, so a refused
+  destination leaves nothing on disk. `copyOut` takes an optional `into` (the run's
+  scratch root); `scripts/run-u.mjs`'s two call sites now pass `dirname(wd)` instead of
+  `wd`, so a destination inside the scratch area but outside the frozen tree is caught as
+  `destination-contained` instead of slipping through.
+- **Source front door hard-line defect (PRD item 33/M2, live-proven):** every frozen
+  file's content — a folder, a single file, or a fetched URL body — is now scanned for a
+  known secret shape (the same `scanSecrets` inventory, `src/validate.js`) BEFORE
+  anything is written under `into`; a hit refuses `source-carries-secret`, naming the
+  file(s) and pattern name(s) only, never the matched text, and leaves nothing on disk.
+  Previously the door scanned only the URL string, so a plain folder or file carrying a
+  real API key (e.g. an `.env`) was frozen into the tree and committed to the hidden git
+  seed untouched.
+- **Source front door, M2b review fixes 2–8 (PRD item 33):** `.env`/`.env.*` refused by
+  NAME whatever it contains (`source-env-file`), belt-and-braces beside the content scan;
+  a per-file `MAX_BUFFER` ceiling for folder and single-file sources (`source-file-
+  oversize`; repo sources exempt); the delivered file now carries the date
+  (`profile-2026-09-12.md`, `-2`/`-3` the same day, cap 99) — new exports
+  `datedDestination`/`pickDelivery`, used by both `proveDestination` and `copyOut` so the
+  two can never disagree; `copyOut` returns `{bytes, sha256, path}` and `run-u.mjs`
+  spine-records the real landed path (`destination-written {path, declared, bytes,
+  sha256}`); a URL's redirects are followed but never invisible — the final URL rides in
+  the manifest (`finalUrl`) and is printed by `prep-source`, and is secret-scanned like
+  the typed one; a nested `.git` anywhere below the root refuses `source-nested-repo`,
+  `git add` runs `-f` so a source `.gitignore` cannot drop a file from the seed, and the
+  seed is read back with `git ls-tree` and diffed against the manifest's file list
+  (`source-seed-incomplete` on a shortfall); a git repo root is now an allowed source
+  (`kind: 'repo'`) — copied with its history, working files at the tree root, seed on top
+  of existing history; a `.git` FILE (linked worktree/submodule) refuses
+  `source-is-linked-worktree`; `prep-source` prints a folder-blast-radius note (mirrored
+  in `bareloop.context.md`).
+- **Repo-source hard-line defect (live-proven during the M2b 7 review):** a copied
+  `.git/hooks` carried the SOURCE repo's own `pre-commit`/`commit-msg`/`post-commit`
+  scripts, and `git commit` ran them — arbitrary code from the source repo, executed
+  inside bareloop's own process, before a single token spent. Fixed: the copied hooks
+  directory is stripped after the `.git` copy, and every git call the door makes pins
+  `core.hooksPath` to a path that is never created, so a `core.hooksPath` set in the
+  copied `.git/config` cannot reopen the hole either.
+
+- **Source front door D1/D2/D3 rework (PRD item 33, hamr's rulings, 2026-09-12):**
+  - **D1 — repo sources copy only what git tracks** (hamr, verbatim: "copy only what git
+    tracks"; closes F164/F165): repo sources are enumerated with `git ls-files --stage` in
+    the source, never a filesystem walk; each tracked path's working-tree content is
+    frozen, and nothing untracked or gitignored is ever a candidate (npm
+    `node_modules/.bin/*` symlinks, this repo's own `.claude/`, a gitignored `.env`,
+    none of it reaches the tree or the seed). `git add -A` drops `-f` for repo sources
+    (kept for plain folder/file/URL sources). A gitlink (a real submodule) refuses
+    `source-nested-repo`; a tracked symlink refuses `source-symlink` only when it
+    resolves outside the source root — one staying inside is copied verbatim as a link.
+  - **D2 — secrets scanned inside binary content too** (closes the F166 residual): every
+    frozen file's content is scanned for secrets, binary files included, decoded `latin1`
+    (byte-preserving) instead of `utf8` — the same `SECRET_PATTERNS` inventory, no second
+    pattern list.
+  - **D3 — destination is a DIRECTORY, never a filename** (hamr's ruling, 2026-09-12): it
+    may already exist, need not be empty, and may sit inside the source itself
+    (`destination-in-source` is gone). A job may produce more than one file; `copyOut`
+    delivers every non-empty file under `output/` (excluding `output/.gitkeep`), each
+    under its own dated name, and returns `{files: [{path, bytes, sha256}]}` instead of a
+    single object. The single-file `output` manifest field and `output-invalid` validator
+    are removed — the escape vector they guarded is now closed structurally, since
+    `copyOut` reads `tree/output/` itself rather than a manifest-declared path. A repo
+    source's `destination` is recorded as the declared write fence and never proven or
+    copied into (`frontDoorFromManifest` returns `null` for a repo manifest) — wiring it
+    into the signed `writeScope` field is left to a later milestone. New refusal codes:
+    `destination-not-directory`, `destination-not-writable`, `destination-invalid`
+    (repo-destination type guard); retired: `output-invalid`,
+    `destination-output-required`, `destination-in-source`. `scripts/prep-source.mjs`
+    drops `--output`; `scripts/run-u.mjs`'s copy-out call site emits one
+    `destination-written` per delivered file.
+  - **D4 — measured a real 15 MB repo** (`~/PycharmProjects/adaptlearn`, the repo that
+    broke F164): 1296 files, 3.16 MB copied, 0.89s elapsed, ~84 MB maxRSS, no gitignored
+    or untracked content reached the tree or the seed. No size cap added.
+
+## [0.24.0] — 2026-09-10
+
+### Added
+
+- **`gemini-api` on the provider menu, ADMITTED-PENDING-PROBE** (PRD item 31.3;
+  hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for now"*). Reads
+  `GEMINI_API_KEY` and maps two genuinely different tiers — `sonnet` →
+  `gemini-2.5-pro`, `haiku` → `gemini-2.5-flash`. It has **zero runs**: the
+  probe rule (no endpoint in the menu without its own clean paid probe) is not
+  waived for it. `PROBE_STATUS` in `src/providers.js` records that debt per
+  provider and `probeWarningLines` renders the loud `⚠ UNPROVEN PROVIDER`
+  marker `scripts/run-u.mjs` prints at launch, right where money is about to be
+  spent. The table is read to WARN, never to REFUSE — refusing a provider hamr
+  admitted would be a second, invisible ruling.
+- **Per-provider `endpointKey`** — each table entry declares the CONSTRUCTOR
+  option name it reads an endpoint from, instead of a hardcoded `baseUrl`.
+  bare-agent's providers do not agree on one spelling (`baseUrl` for
+  anthropic/openai/gemini, `url` for Ollama) and none of them validate unknown
+  option names, so a mis-spelled endpoint is silently DROPPED, not rejected:
+  measured live, `new OllamaProvider({baseUrl: X}).url` stays
+  `http://localhost:11434` with no error. That is the F149 class (DeepSeek
+  silently ignoring `max_completion_tokens`: asked 64 output tokens, returned
+  665). A job spec still carries ONE field name, `baseUrl`; the translation to
+  each constructor's own spelling happens once, in `makeProvider`.
+
+### Changed
+
+- **The judge is no longer a Claude judge** (PRD item 32; hamr, 2026-09-10:
+  *"what i care about is that judge becomes llm agnostic and not set to one
+  model or provider"*). `JUDGE_MODEL` is no longer read by any grading path.
+  The judge identity is RESOLVED per job by the new exported `resolveJudge`:
+  the spec's signed `judge: {provider, model}` if it names one, else **the
+  job's own worker provider and model** — so a DeepSeek or Gemini job judges on
+  its own provider and needs no second account. There is deliberately no
+  library fall-back: a run that cannot name its judge has not wired one, and
+  the judged stage instrument-STOPS rather than grading under an identity
+  nobody chose. `JUDGE_MODEL` stays exported as the pre-item-32 pin so an
+  adopter's import survives. The judge is now built through the provider
+  factory like every other provider — no `new AnthropicProvider` survives for
+  a judge in `scripts/run-u.mjs`, `scripts/run-author.mjs` or `src/cli.js` —
+  and its key follows the resolved judge provider's own `envKey`, with
+  `JUDGE_API_KEY` as a role-named override in front.
+
+  **BREAKING for direct library callers.** `runCalibration`,
+  `foldJudgedArtifacts` and `prepareSigning`/`authorCloseForJob` now require
+  the resolved `judgeModel` and THROW without it; `runJob`/`runPlan` take a
+  `judgeModel` beside `judgeProvider`, and a judged stage stops as a wiring gap
+  when it is absent. Adding a default would be the silent fall-back this change
+  exists to remove.
+
+  **No threshold moved.** The judge still renders no verdict — it locates facts
+  and a deterministic `decide()` renders; unsure is RED; `CALIBRATION_SIZE` is
+  10 with a 10-of-10 floor and no partial credit. Un-pinning a provider is not
+  a licence to move a bar. Self-grading (a worker's own family reading its
+  work) is licensed by MEASUREMENT: the calibration gate is exactly the
+  instrument that catches a judge which cannot see failures, and its frozen set
+  contains cases that MUST fail.
+- **A new optional signed spec field, `judge: {provider, model}`** — both
+  halves required together, `provider` from the `PROVIDERS` menu, unknown
+  nested keys red. It is part of `jobSpecHash`, so changing the judge kills the
+  signature and forces recalibration — and the recalibration guard now fires
+  across a PROVIDER change, not just a model bump. The drafting agent cannot
+  express it: naming your own examiner is arbiter territory.
+- **The judge's API key is demanded only when a judge is CALLED** (PRD item
+  31.4). `scripts/run-u.mjs` hard-exited on a missing `ANTHROPIC_API_KEY` for
+  every job, so a `verdictType: 'green'` job with a DeepSeek or Gemini worker
+  and a mechanical close could not start without an Anthropic account it would
+  never spend a token against. Now the WORKER's key comes from the provider
+  table's own `envKey` and is always required; the JUDGE's key follows the
+  RESOLVED judge provider's own `envKey` (item 32.1 — the judge is no longer
+  pinned to Anthropic), with `JUDGE_API_KEY` as a role-named override in
+  front, and is required only when the close actually judges. When it does
+  refuse it refuses at $0, before the worker spends anything, naming the
+  judged-stage count and the resolved judge model — a judged run that
+  discovered this at the close would have paid in full for a verdict it
+  cannot render. A green `anthropic-api` job behaves byte-identically to
+  before. `bareloop run` (the bundle runner) is unchanged: `ANTHROPIC_API_KEY`
+  -only by a deliberate, documented contract.
+- **One reading of "does this close judge?"** — `judgedStages()`/`closeJudges()`
+  are exported from `src/kinds.js` and the six open-coded copies of that
+  predicate now share them. The runner's own comment warned against "a second
+  reading of the declaration that can drift from the one the runner actually
+  executes"; 31.4 needed a seventh, to decide a REFUSAL, which is that warning
+  coming true.
+
+- **`hitl` leaves the authoring menu; its code stays** (PRD item 31.1; hamr:
+  *"retire hitl from list, keep its code"*). Three distinct class lists replace
+  two: `LOCKED_CLASSES` (no guard battery exists — empty today),
+  `UNLISTED_CLASSES` (`['hitl']` — built, validates and RUNS, simply never
+  offered) and `MENU_CLASSES` (live minus unlisted). Only the AUTHORING surface
+  reads them, which is what keeps hitl's code alive and under test; locking the
+  class instead would have taken `validateCloseDecl`, the guard battery and two
+  whole test files with it. `scripts/run-interview.mjs` no longer advertises
+  `--verdict hitl` in a usage line the library then refuses.
+- **Green-only prose corrected** (PRD item 31.2). `soft-green` was never
+  locked; the source comment claiming *"v1 STILL ADMITS ONLY green"* was false
+  and had already sent one build in the wrong direction, and
+  `bareloop.context.md` — the file that SHIPS — said all three classes were
+  admitted. Fixed, and pinned by tests, because prose drifts when nothing
+  executes it.
+
+### Security
+
+- **`SECRET_PATTERNS` learns the Gemini/Google API key shape** (PRD item
+  31.3, F160). `gemini-api` was admitted to real runs (this file, above)
+  without its own key shape joining the ONE secret-shape inventory
+  (`src/validate.js`) that drives `scanSecrets`, `redactSecrets` and
+  `sweepSecretLiterals` — a `GEMINI_API_KEY`-shaped literal (`AIza` + 35
+  chars) reaching a spine, a close's output, or a signed doc would have gone
+  undetected and unredacted. Fixed with a left-bounded pattern in the same
+  style as the existing shapes; monotonic (detection only added, nothing
+  loosened).
+
+### Notes
+
+- Ollama is deliberately NOT admitted. It takes no key and bills nothing, so
+  every round would price at $0 through machinery that treats $0 as a real
+  price — the honesty violation the `?? 0` rule exists to stop. That question
+  gets answered before a menu entry, not after.
+
 ## [0.23.0] — 2026-09-09
 
 ### Added

package/bareloop.context.md

@@ -79,8 +79,28 @@ inherited rule carries the green that minted it and the contrast that attributed
   an unknown provider name THROWS there, it never falls back to a default. Per-model
   request-key gating lives in that table: `deepseek-chat` sets bare-agent's
   `legacyMaxTokens`, because DeepSeek silently ignores `max_completion_tokens` and an
-  output cap that does not bind is a money hazard. The JUDGE stays pinned to
-  `anthropic-api` and `JUDGE_MODEL` whatever the worker's provider is. The bundle runner
+  output cap that does not bind is a money hazard. `provider: 'gemini-api'` (PRD item 31.3)
+  takes the same `Loop` path, reads `GEMINI_API_KEY`, and maps two real tiers
+  (`sonnet` → `gemini-2.5-pro`, `haiku` → `gemini-2.5-flash`). It is
+  **ADMITTED-PENDING-PROBE**: it has ZERO runs, and the probe rule is not waived for it —
+  `PROBE_STATUS` (`src/providers.js`) is the machine-readable form of that debt, and
+  `probeWarningLines(provider)` renders the loud launch-time marker `scripts/run-u.mjs`
+  prints. That table is read to WARN, never to REFUSE. Each entry also declares its own
+  `endpointKey` — the CONSTRUCTOR option name it reads an endpoint from — because
+  bare-agent's providers do not agree on one spelling (`baseUrl` for anthropic/openai/
+  gemini, `url` for Ollama) and none of them validate unknown option names, so a
+  mis-spelled endpoint is silently DROPPED rather than rejected. Your job spec keeps one
+  field name, `baseUrl`; the translation happens once, inside `makeProvider`. Ollama is
+  deliberately NOT admitted: it takes no key and bills nothing, so every round would price
+  at $0 through machinery that treats $0 as a real price. The JUDGE IS NO LONGER PINNED
+  (PRD item 32): `resolveJudge` (exported) resolves it per job — the spec's signed
+  `judge: {provider, model}` if it names one, else **this job's own worker provider and
+  model**, so a DeepSeek or Gemini job judges on its own provider and needs no second
+  account. There is no library fall-back: a run that cannot name its judge has not wired
+  one, and the judged stage instrument-STOPS rather than grading under an identity nobody
+  chose. `JUDGE_MODEL` stays exported as the pre-item-32 pin — no grading path reads it.
+  The judge's key follows the resolved judge provider's own `envKey`, with `JUDGE_API_KEY`
+  as a role-named override in front of it. The bundle runner
   (`bareloop run`) is `ANTHROPIC_API_KEY`-only and REFUSES at $0, naming the key it would
   have needed, rather than constructing another provider with the wrong key.
 - **Reuse — where a workflow comes from:** a plain `runJob` always drafts cold. Passing
@@ -143,13 +163,14 @@ minting claim, or the shell-owned retry cap — all unknown-field reds.
 |---|---|---|
 | `job` | kebab-case slug | |
 | `description` | non-empty string | |
-| `provider` | `anthropic-api` \| `openai-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-chat` today — see "Worker surface" above for its `baseUrl` field and per-model gating; `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
+| `provider` | `anthropic-api` \| `openai-api` \| `gemini-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-chat` today — see "Worker surface" above for its `baseUrl` field and per-model gating; `gemini-api` (PRD item 31.3) reads `GEMINI_API_KEY` and is ADMITTED-PENDING-PROBE — zero runs, and every launch says so (`PROBE_STATUS`/`probeWarningLines`); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
 | `conditions` | `{ providerPath?, closeVerbosity?, taskFraming?, scaffold? }` | declared keys only, string values — the environment label (consumed by the N3 lineage key; recorded on spines from run one) |
 | `cadence` | `{ unit: hour\|day\|week, every: 1..30 }` | validated now, consumed at N5 (Scheduler) |
 | `budgetUsd` | `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
 | `maxWallMs` | optional integer ms `>= MIN_WALL_MS` (one close timeout) | the run's wall clock. **NO DEFAULT, by ruling** — absent means time-unbounded *by explicit operator choice*, never by fallback (F45: a defaulted cap is a silent second ceiling). Enforcement is a BETWEEN-ROUND deadline, so the honest worst case is `maxWallMs + closeStages × closeTimeoutMs` — every stage of a staged close gets the FULL timeout — and all three numbers are reported (`loop.stop()` cannot cut an in-flight call — F61 measured 500ms→4,018ms). The `MIN_WALL_MS` floor is a ONE-stage, un-autoset-default number, so a spec with many stages OR a raised/autoset `closeTimeoutMs` can validate while its overshoot dwarfs its cap: `runPlan` adds a RUN-START check (PRD item 27/M3) that refuses `wall-under-close-timeout` at $0 once the EFFECTIVE per-stage ceiling is known (autoset or signed), rather than a silent clamp. Operator-only, tighten-only; adding or changing it changes the spec hash |
 | `closeTimeoutMs` | optional integer ms `>= CLOSE_TIMEOUT_FLOOR_MS` (120,000 — hamr's arbiter floor, 2026-09-07) | PRD item 27/M3's SIGNED override for the close's own per-stage wall-clock cap. Absent (the normal case): the run autosets it from a $0 seed timing pass — `max(FLOOR, K × slowest measured stage)`, `K = 5` (hamr, 2026-09-07: "2 and 5 are fine"). Present: the operator's own number wins outright and may legally sit ABOVE *or below* the autoset estimate (the rates-passthrough shape, F113 — never tighten-only). Arbiter territory exactly like `budgetUsd`/`maxWallMs`/`close[].sha256`: the authoring pipeline's `assembleSpec` refuses a draft carrying it |
-| `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the judge model stays library-pinned (`JUDGE_MODEL`) pending recalibration |
+| `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the JUDGE's model comes from the `judge` row below, which DEFAULTS to this same worker model |
+| `judge` | optional `{provider, model}`, both non-empty; `provider` from the `PROVIDERS` menu | the signed JUDGE override (PRD item 32). Absent, the judge resolves to this job's own `provider`/`model` (`resolveJudge`) — which is what lets a non-Anthropic job judge without a second account. Present, it pins a judge deliberately different from the worker (an independent reader). Both halves are required together: a judge with a provider and no model is an identity nobody signed. Part of the signed hash, so changing it kills the signature and forces recalibration. Unknown nested keys red — no smuggling level exists in a signed spec. The drafting agent cannot express it: naming your own examiner is arbiter territory |
 | `writeScope` | array of contained globs | the operator's outer fence; the plan's own scopes must fit inside it, same containment code |
 | `steps` | RETIRED | operator-authored `steps[]` was deleted (PRD v1.32); a spec carrying it reds `shape-retired:steps` by name rather than half-running |
 | `escalation` | `{ mode: "decision-ready" }` | the pain channel is not optional |
@@ -160,7 +181,7 @@ the step plan at run time (gated by `validatePlan`); the human signs only:
 | field | shape | notes |
 |---|---|---|
 | `goal` | non-empty text | what the agent plans against |
-| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). **All three are ADMITTED today** — `LOCKED_VERDICTS` is empty, so nothing reds `request-red` on the class itself. `soft-green` has its judged floor (`judged-floor`, signed rubric card + calibration gate) and is the forward path for a job needing judgement, paired with the end-of-run review door; `hitl` is LEGACY — retired as a design direction (see the direction note at the top) but still admitted and still works exactly as documented here. Every `request-red` (e.g. for a locked TOOL verb, not a verdict class) also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
+| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). **All three still VALIDATE and RUN** — `LOCKED_VERDICTS` is empty, so nothing reds `request-red` on the class itself, and an existing spec of any class executes. **But AUTHORING offers two: `green` and `soft-green` (`MENU_CLASSES`).** `soft-green` has its judged floor (`judged-floor`, signed rubric card + calibration gate) and is the forward path for a job needing judgement, paired with the end-of-run review door; `hitl` is RETIRED and UNLISTED (`UNLISTED_CLASSES`, PRD item 31.1) — the class moved to fwdloop, so `runInterview` refuses a hitl pick as counted demand and no new hitl job can be drafted, while its battery, its runtime and an already-signed hitl spec are untouched and still work exactly as documented here. The three lists are DIFFERENT facts: `LOCKED_CLASSES` (no battery — cannot validate or run; empty today), `UNLISTED_CLASSES` (built and runnable, never offered — `['hitl']`), `MENU_CLASSES` (what authoring offers). Every `request-red` (e.g. for a locked TOOL verb, not a verdict class) also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
 | `close` | **an ORDERED LIST of named stages** `[{ name, cmd, expect, judged?, gapKeep?, offer?, needs?, direction? }, ...]` (PRD v1.28), or a close object (table below) | the destination, the only thing hand-authored; the check menu DERIVES from it (below). The plan flow executes a staged close directly and adapts a bare `predicate` object into a one-stage list; a `gold`/`rubric`/`hitl` object close still VALIDATES (`CLOSE_TYPES`) but the plan flow refuses all three at runtime as `close-unsupported` — an object close names no command to run. The modern route to a judged or human-decided close is a staged `closeDecl` (`judged-floor` / `human-confirms` stage kinds), not this object form |
 | `closeDecl` | **the AUTHORED close** `{ genre: "TYPES", lang: "js"\|"python", stages: [{ name, kind, params }], notes? }` | the ALTERNATIVE to `close`, and the point of the close-authoring rung: the user answers an interview and an LLM composes a DECLARATION over kinds whose implementations we own — never a script, never a shell fragment, never a new kind. **`close` and `closeDecl` are alternatives**: declaring both reds `close-duplicated` (two closes are two arbiters). It is HARD-class by construction (`CLASS_BY_CLOSE.declared`), so a locked verdict on one reds `close-hierarchy` as well as `request-red`. The declaration is validated by `validateCloseDecl`; the TREE-GROUNDED half of that gate (the path rule, and the scoped-job derivation that arms the F84 one-population law) is DEFERRED at spec-validation time — a job spec is validated with no repository in hand — and the runner re-runs it GROUNDED against the real seed before any stage and before any token. It stores the counting RULE and never a number (D12): there is no seed field, and `baseline: "seed"` is measured at each run's own HEAD |
 | `checks` | **RETIRED** (PRD v1.28/v1.32) | hand-authored checks are gone, not merely discouraged: declaring `checks` reds `checks-derived` by name. The check menu is DERIVED from the close's own stages instead — see **Staged close** below. The hazard this removes is measured, not theoretical: job #5's three hand-written checks were re-implementations of three stages the close already ran, and a hand-carved copy can drift LENIENT (the worker passes the operator's ruler and fails the real inspection) |
@@ -509,7 +530,7 @@ Escalations are decision-ready (category, options, spend); cap-halt is its own
 category, never merged with "wrong". A thrown middle is relayed by its `category`
 property (`cap-halt`, `gate-red`, …); an unnamed throw is `interpreter-red`. Close output
 is scrubbed at capture (an injected `redact`, wired to bareguard by `runPlan` with the
-validators' full secret-shape inventory — Bearer/sk-/ghp_/github_pat_/AKIA/xox) so a
+validators' full secret-shape inventory — Bearer/sk-/ghp_/github_pat_/AKIA/xox/AIza) so a
 secret a checked command echoes never enters the append-only spine or a worker prompt —
 a benign gap is byte-identical (secrets hard line; design law #7 intact).
 
@@ -571,7 +592,7 @@ a step, or test it without a provider.
 
 | step | call | what it is |
 |---|---|---|
-| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), all three LIVE as of softgreen module 3 — nothing is locked today (`LOCKED_CLASSES` is empty) — and the interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost two slots since it was frozen (D13's genre confirm, then the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input and asking for it again invites a second, drifting answer for a fact the machine already holds), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is five questions, answers keyed by number; the LEGACY `hitl` set is those five byte for byte plus one more (what the signer is deciding when they look at the result — `human-confirms`' `ask`), which is the spread's next number and moves with a green-side deletion; the `soft-green` set is likewise those five plus two more — Q6 the signed rubric card (what separates a pass from a fail) and Q7 the frozen calibration set (one example to pass, one to fail) — the judged floor's two required inputs. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
+| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), all three sets still EXIST, but the interview ADMITS only what is on the menu: nothing is locked today (`LOCKED_CLASSES` is empty) and `hitl` is UNLISTED (PRD item 31.1), so `runInterview({verdictType:'hitl'})` returns a refusal rather than `ok:true` — ask `MENU_CLASSES` which classes can be authored, never this sentence. The interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost two slots since it was frozen (D13's genre confirm, then the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input and asking for it again invites a second, drifting answer for a fact the machine already holds), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is five questions, answers keyed by number; the RETIRED, UNLISTED `hitl` set (still readable via `questionsFor`, never authorable) is those five byte for byte plus one more (what the signer is deciding when they look at the result — `human-confirms`' `ask`), which is the spread's next number and moves with a green-side deletion; the `soft-green` set is likewise those five plus two more — Q6 the signed rubric card (what separates a pass from a fail) and Q7 the frozen calibration set (one example to pass, one to fail) — the judged floor's two required inputs. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
 | survey | `runAuthorScout({ workdir, provider, attempts?, ceilingUsd? })` → `{ state, facts, reason, meta, raw, raws, calls, budgetStop }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind. **`ceilingUsd` is the operator's money ceiling** (PRD v1.62) — checked BETWEEN attempts and before F59's reserved round, so no paid call escapes it; `null`/absent is UNBOUNDED, and a non-null non-finite value THROWS (the shared `capStop` seam — see `authorClose` below). When it ends the ladder, `budgetStop` names which stop (`cap-halt` \| `pricing-red`) and a survey that was never asked for carries the typed cause `not-funded` — deliberately OUTSIDE `SCOUT_RETRY_CAUSES`, because a retry is precisely what the cap forbade |
 | listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
 | authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does |
@@ -617,10 +638,13 @@ so it takes no `cmd`, no `timeoutMs` and no `env`; it is `offer: false` BY LAW
 (`NEVER_OFFERED_KINDS` — a paid judge is never an in-run ruler); and it SKIPS the seed-verdict
 read (ruling 8) as a recorded `skipped` row.
 
-**Wiring a judged close, and what it costs.** The judge is PINNED (`JUDGE_MODEL`, exported) and
-is never a step knob: the runner supplies `runJob({ judgeProvider })` — its own seam, not
-`provider`/`providerFor` — and a judged stage with none instrument-STOPS as a wiring gap rather
-than grading on whatever binding was at hand. Each locate call is metered per call and emitted
+**Wiring a judged close, and what it costs.** The judge is RESOLVED per job (`resolveJudge`,
+PRD item 32) and is never a step knob or agent-selectable — naming your own examiner is arbiter
+territory, and `judge` is a field the human SIGNS into the hash. The runner supplies BOTH halves,
+`runJob({ judgeProvider, judgeModel })` — its own seam, not `provider`/`providerFor` — and they
+travel together: a judged stage missing EITHER instrument-STOPS as a wiring gap (two distinct
+messages, identity checked first) rather than grading on whatever binding was at hand or under a
+name nobody wrote. Each locate call is metered per call and emitted
 as a distinct `judge-round` spine record, which `runJob`'s ONE ledger accounts exactly like a
 `worker-round` (`ACCOUNTED_ROUND_TYPES`, and `readResume`'s fold reads that same list, so a
 resumed leg cannot silently widen a signed budget by the close's own spend). A budget funds the
@@ -690,8 +714,9 @@ null rather than an exact-looking floor.
 carrying a `judged-floor` stage is refused when no set is stored, when no `judgeLoop` seam is
 wired (a wiring gap, never a silent pass), when the gate is a casualty, and when anything short
 of all-of-them grades. It runs **after** gates 1–3, so no $0 refusal is ever paid for. The
-signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers
-`JUDGE_MODEL`), the graded rows and the battery — beside `judgeModel` itself.
+signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers the
+resolved judge identity), the graded rows and the battery — beside `judgeModel` itself.
+`runCalibration` takes `judgeModel` as a REQUIRED argument and throws without one.
 
 **D9.3 for a judged-ONLY close** (ruling 3, hamr: *"fix it now, we are delivering softgreen"*).
 A judged stage skips the seed read (ruling 8), so a close whose only work stage is judged has no
@@ -705,10 +730,12 @@ bump forces a full recalibration"* used to be an operator-side rule with nothing
 which makes it prose (F45); it now has both halves of a detector. The tier the signer's set was
 graded by is stored beside the cases as **`calibration.judgeModel`** — `CALIBRATION_FIELDS`
 enumerates a stored set as exactly `cases` and `judgeModel` and nothing else — written by
-`foldJudgedArtifacts` from the PIN (`JUDGE_MODEL`) rather than from anything a caller may name.
-Because it is INSIDE the spec, `jobSpecHash` covers it by construction: bump the constant and
-every signed judged spec hashes differently, the signature dies, and the re-sign is what re-runs
-the calibration gate. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
+`foldJudgedArtifacts` from the RESOLVED judge identity the caller hands in (required; it throws
+without one). Because it is INSIDE the spec, `jobSpecHash` covers it by construction: change the
+judge — its model OR its provider — and every signed judged spec hashes differently, the
+signature dies, and the re-sign is what re-runs the calibration gate. `runJudgedFloor` refuses to
+grade when the stored identity is not the one about to grade, naming both, and it does not
+degrade in either direction. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
 on `…calibration.judgeModel`) — a set nobody can attribute to a tier is a floor nobody can tell
 apart from a bumped one. **`declaredStages` stamps it onto the judged stage** as
 `calibrationJudgeModel`, from the SIGNED bytes and through the one seam that already turns a
@@ -2880,6 +2907,183 @@ provider but `anthropic-api`, spine bundling for `formatReplay` on the minting r
 `runid` is noted), and tarball packing — a bundle is a plain directory; use `npm pack` on it
 yourself if you want a tarball.
 
+### The source front door — a plain folder/file/URL, no `--patient` (PRD item 33/M2, `src/source.js`)
+
+A repo job still gives `runJob` a `--patient` checkout it owns. A NON-code job (a resume, a
+CSV, a page) has no repo to point at — this door is what lets it run anyway, WITHOUT the
+person ever seeing a git repo (H1's fix): the source is frozen into a hidden, scratch git
+tree bareloop creates and owns, before any token spends, so the run and its close judge the
+SAME bytes.
+
+```js
+import { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest } from 'bareloop';
+
+const prepared = await prepareSource({
+  source: '/home/me/resume.md',           // an http(s) URL, an existing file, or an existing plain folder/repo
+  into: '/home/me/.bareloop-jobs/j1',     // must NOT already exist — fresh, never reused
+  destination: '/home/me/profile-drafts', // optional — a DIRECTORY (D3), need not exist or be empty
+});
+// prepared.tree === '/home/me/.bareloop-jobs/j1/tree' — hand THIS to runJob as `workdir`
+// prepared.manifest.seed — the commit `seedAtHead` will read at run start
+```
+
+Or the CLI: `node scripts/prep-source.mjs --source <path-or-url> --into <dir> [--destination
+<absolute-directory>]` — prints the tree path, the seed, and the exact next command.
+
+> **If your source is a folder, read this first (hamr's ruling):** make a new folder, put
+> only the file(s) this job needs in it, point bareloop at that — never your original
+> folder. Everything in the folder you name is frozen, read, and paid for. `prep-source`
+> prints the same line on every folder prep, and the panel (N6) shows it beside the Source
+> field.
+
+**Layout.** `<into>/tree/input/…` is the frozen copy; `<into>/tree/output/` is empty (a
+`.gitkeep` seeds it) and is where the run writes; `<into>/source.json` is the manifest,
+OUTSIDE the tree — no worker verb can ever read or edit it. One hidden commit, authored
+`bareloop <bareloop@localhost>` with `commit.gpgsign` pinned off — never the operator's
+identity, never global git config (this repo's own tests run with an empty `HOME`).
+
+**What is admitted today (hamr: "start with already supported files").** A URL is fetched
+ONCE with plain `fetch` — no credentials, no cookies, no custom headers — under
+`PROVIDER_TIMEOUT_MS` and capped at `MAX_BUFFER`, both reused from elsewhere in this library,
+never a second number. Content-type must be `text/*`, `application/json`, or
+`application/xml`. A local file or folder must be plain text (a NUL byte in the first 8KB of
+any file refuses the whole prep, naming every offending file) and must contain no symlinks
+(named, never followed). Each file has its OWN `MAX_BUFFER` ceiling (`source-file-oversize`)
+— there is no folder TOTAL cap, hamr's call. A file named `.env` or `.env.*` is refused by
+NAME whatever it contains (`source-env-file`), belt-and-braces beside the content scan below.
+A `.git` found anywhere BELOW the root is a nested repo and refuses (`source-nested-repo`):
+its objects are a second history nobody declared, and the seed could not hold them honestly.
+PDF and Word input have no reader here (hole H7, PRD item 33) — logged, not built.
+
+**A git repo IS an allowed source** (hamr: yes — the PR-review job). It is COPIED with its
+history, never used in place (the patients-are-copies rule): the working files land at the
+TREE ROOT rather than under `input/`, `.git` is copied verbatim, `output/` is added, and the
+seed commit goes on TOP of the existing history — so `manifest.kind === 'repo'` and the
+worker gets a real repo to review. Its guards (the input stays untouched) arrive with M4. A
+`.git` that is a FILE, not a directory — a linked worktree or a submodule — refuses
+`source-is-linked-worktree`: its real git directory lives elsewhere, and a copy would
+silently commit into the original. Text-only and the per-file ceiling do not apply to a repo
+source (a real repo legitimately carries binaries).
+
+**A repo source copies only what git tracks** (D1 rework, hamr's ruling verbatim: "copy only
+what git tracks" — closes F164/F165). Files are enumerated with `git ls-files --stage` in the
+SOURCE, never a filesystem walk: each tracked path's WORKING-TREE content is frozen (so
+uncommitted edits to a tracked file come along), and nothing untracked or gitignored is ever a
+candidate — real npm `node_modules/.bin/*` symlinks, this repo's own `.claude/`, a gitignored
+`.env`, none of it is read or written. `git add -A` drops `-f` for a repo source (kept for a
+plain folder/file/URL, where a `.gitignore` has no honest meaning yet). A gitlink entry (a real
+submodule) refuses `source-nested-repo`; a tracked symlink refuses `source-symlink` only when
+it resolves OUTSIDE the source root — one that stays inside is legal tracked content, copied
+verbatim as a link, never dereferenced. Measured live against a real 15 MB repo carrying
+`node_modules` (`~/PycharmProjects/adaptlearn`, the repo that broke F164): 1296 files, 3.16 MB,
+0.89s elapsed, ~84 MB maxRSS — no gitignored or untracked content reached the tree or the seed.
+
+**Every frozen file's content is secret-scanned, binary files included** (D2, closes the F166
+residual). A binary file (a NUL byte in its first 8KB) used to be hashed but never scanned —
+now it runs through the SAME `SECRET_PATTERNS` inventory, decoded `latin1` (byte-preserving)
+instead of `utf8`, so an ASCII key embedded in a compiled artifact is still found. This only
+matters where binaries are admitted at all (a repo source today; a plain folder/file still
+refuses binary content outright via `source-not-text`, unchanged).
+
+**A URL's redirects are followed but never invisible.** The URL the body actually came from
+rides into the manifest as `finalUrl` and is printed by `prep-source` whenever it differs
+from what was typed, so a link that quietly lands on a login or error page is something a
+person can see before a token spends. The final URL is secret-scanned the same way the typed
+one is.
+
+**The seed holds every frozen file, and that is CHECKED, not hoped.** `git add` runs with
+`-f`, so a `.gitignore` inside the source cannot drop files from the seed (a file present on
+disk but absent from the seed would read to a close as the worker having written it); then
+the seed is read back with `git ls-tree -r --name-only HEAD` and diffed against the manifest's
+own file list by name. A shortfall refuses `source-seed-incomplete`.
+
+**Every frozen file's content is scanned for a known secret shape before anything is
+written under `into`** (a folder, a single file, or a fetched URL body — the SAME inventory
+`scanSecrets` reads, `src/validate.js`; live-proven fix — the door used to scan only the URL
+string, so a plain `.env` with a real API key was frozen into the tree and committed to the
+hidden git seed untouched). A hit refuses `source-carries-secret`, naming the file path(s)
+and the pattern name(s) only — the matched text itself never appears in the refusal, the
+manifest, or any file, and nothing is written to disk (`into` does not exist afterward). This
+is a shape-based check, not a filename denylist: a secret whose shape is not in the inventory
+(a plain database password in a `.env`, say) still passes through — a named, accepted
+residual, not this fix's job to close.
+
+**Every refusal is a named `{stop, code}`, never a throw and never silent:** `source-
+unreadable`, `source-symlink`, `source-env-file`, `source-file-oversize`,
+`source-nested-repo`, `source-is-linked-worktree`, `source-seed-incomplete`, `source-git-failed`, `source-not-text`, `source-fetch-failed`,
+`source-fetch-timeout`, `source-fetch-oversize`, `source-carries-secret`, `into-exists`,
+`destination-invalid`, `destination-not-absolute`, `destination-not-directory`,
+`destination-not-writable`, `destination-contained`, `destination-parent-missing`,
+`destination-parent-unwritable`, `destination-exists`, `destination-output-missing`,
+`destination-write-failed`, `source-manifest-unreadable`, `source-manifest-invalid`. A
+refusal never throws, never overwrites a person's file, and never lands a destination inside
+the run's own scratch tree.
+
+**Destination is a DIRECTORY, never a filename** (D3 rework, hamr's ruling, 2026-09-12,
+condensed in `docs/product/ITEM33-BUILD.md`). It may already exist and need not be empty; it
+may sit inside the source itself (the same-dir case: "i can limit your actions to a certain
+fix in a certain dir and your output will also be there" — `destination-in-source` is gone). A
+job may produce MORE THAN ONE file (his example: a flight search producing one sheet for
+"SFO→LAX red-eye" and another for "SFO under $700"); the agent names them, and there is no
+`output` field in the manifest any more — `copyOut` always reads `tree/output/` itself, never
+a manifest-declared path, which closes the old escape vector (`output/../../x`) structurally
+rather than by validation.
+
+**Destination is proven at prepare time, not just in-run** (hamr's ruling: source AND
+destination are proven at job start, $0): when `destination` is given, `prepareSource` calls
+`proveDestination` BEFORE creating `into` — a refused destination leaves nothing on disk.
+`proveDestination` only proves the directory is USABLE (exists as a directory and is writable,
+or its parent exists and is writable so it can be created) — it cannot foresee individual
+delivered FILE names, since those are not known until the run actually produces them.
+`copyOut` takes an optional `into` (the run's scratch root, `<into>`, of which `tree` is the
+`tree/` subdirectory; defaults to `tree` for direct callers with no `into`) so a destination
+sitting inside the scratch area but outside the frozen tree — e.g. `<into>/profile.md` — is
+also caught as `destination-contained`, not just one strictly inside `tree`. `run-u.mjs`'s two
+call sites pass `dirname(wd)` (`wd` IS `<into>/tree`) as `into` for exactly this reason.
+
+**A `kind: 'repo'` source's destination is a DIFFERENT thing** (hamr: "destination if for code
+on a green then that would be the place agent allowed to do changes") — it names the WRITE
+FENCE inside the copied repo, the signed `writeScope` field's job (`src/job.js:363`), never a
+filesystem drop-off point. It is recorded as declared, never proven by `proveDestination` and
+never handed to `copyOut` (`frontDoorFromManifest` returns `null` for a repo manifest).
+Wiring it into `writeScope` is M3/M4's job, not this door's.
+
+**Every non-empty file under `output/` is delivered, each under its OWN dated name, and
+nothing is ever overwritten.** A file named `profile.md` LANDS as `profile-2026-09-12.md`
+inside the destination directory; a second delivery of the same name the same day lands as
+`profile-2026-09-12-2.md`, then `-3` (the work-branch collision rule), up to `-99` before
+`destination-exists`. An empty file is silently skipped (not a delivered result); the batch
+refuses `destination-output-missing` only when NOTHING non-empty exists under `output/` at
+all (excluding the `output/.gitkeep` seed placeholder). `datedDestination(destination, now,
+n)` and `pickDelivery(destination, now?)` are exported and unchanged from M2b — `copyOut`
+calls them per file now, at delivery time, rather than once against a single declared path.
+`copyOut` returns `{files: [{path, bytes, sha256}]}` and `run-u.mjs` spine-records ONE
+`destination-written` per delivered file — the declared directory is not the path anything
+wrote.
+
+**The destination is a PER-RUN value, never a signed job-spec field.** A job spec is a
+repeatable SHAPE (goal, checks, judge rules), signed once; source and destination vary per
+run — the same way `bareloop run <bundle> --repo <path>` varies the repo instance without
+touching the bundle's own signature. So `job.js`/`jobSpecHash` carry nothing about it: the
+run's own instance lives entirely in the manifest `prepareSource` writes.
+
+`scripts/run-u.mjs` reads that manifest via `readSourceManifest(dirname(workdir))` (`workdir`
+IS `<into>/tree`, so its parent is `<into>`) and reduces it with `frontDoorFromManifest`. No
+manifest → no front-door behaviour at all — every existing repo-patient job is untouched. A
+manifest that exists but cannot be read or parsed is a named stop, never a silent skip. When
+a manifest declares a destination, `proveDestination` runs BEFORE any token spends (a job
+that cannot land its output should never buy a worker turn first), and `copyOut` runs once,
+on a minted `green` — the ONE outcome string a graded close ever mints; `soft-green` jobs
+mint the same string, since the class lives on `spec.verdictType`, never on `runJob`'s
+return value. A refused copy-out is spine-recorded (`destination-refused {code, detail}`)
+beside the green it could not deliver and NEVER changes that verdict — a delivery failure is
+not a grading failure.
+
+Not wired yet, named rather than silently absent: `bareloop run` (the exported bundle CLI,
+`src/cli.js`) still requires `--repo`; a bundled front-door job is parked past PRD item
+33/M5. The intake form that lets a person fill in Source/Destination through the authoring
+interview (rather than the CLI above) is item 33/M3, not yet built.
+
 ## Architecture
 
 Three layers. An **outer shell** (dumb, permanent): per-run budget cap via bareguard,
@@ -2977,8 +3181,18 @@ blast radius.
 
 ## Gotchas
 
-*TBD from real adopter friction; recorded here as they're found (repo-side friction goes
-to `docs/logs/FINDINGS.md`).*
+*Recorded here as they're found (repo-side friction goes to `docs/logs/FINDINGS.md`).*
+
+- **`non-green-verdict` is a misleading refusal verb, and it is kept on purpose.** When
+  `runInterview` refuses a job for having no git repository (`repoPath` absent), the refusal
+  carries `verb: 'non-green-verdict'` and `path: 'repoPath'`. The name is wrong: the refusal
+  is about the GENRE — this authoring flow drafts code-genre closes against a git seed, and
+  that is true of BOTH classes it offers — not about the verdict class, and it fires for a
+  `soft-green` pick exactly as it does for `green`. **Read `path`, never `verb`, to know what
+  was refused.** The verb is kept because it is the demand ledger's key for this refusal:
+  renaming it would split one running count into two that read as different demands. Named
+  rather than fixed (PRD item 31.2); say so if you would rather have the accurate name and
+  accept the discontinuity.
 
 ## Constraints
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",