bareloop 0.23.0 → 0.25.0

package/src/validate.js

@@ -147,9 +147,28 @@ export const SECRET_PATTERNS = [
   /(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}/,
   /(?<![A-Za-z0-9_-])AKIA[0-9A-Z]{16}/,
   /(?<![A-Za-z0-9_-])xox[bap]-[A-Za-z0-9-]{10,}/,
+  // Google/Gemini API key: `AIza` + 35 chars of [0-9A-Za-z_-] (39 total, fixed
+  // length by Google's own issuance format). Admitted with the gemini-api
+  // provider (PRD item 31.3, F160) — was missing on this branch until then.
+  /(?<![A-Za-z0-9_-])AIza[0-9A-Za-z_-]{35}/,
 ];
 const SECRET_RE = new RegExp(SECRET_PATTERNS.map((r) => r.source).join('|'));
 
+/** Human-readable name for each entry in `SECRET_PATTERNS`, SAME order, SAME
+ * length — for a caller that must name WHICH shape matched (a refusal
+ * message, an audit line) without ever printing the matched text itself. Kept
+ * beside the inventory it describes rather than hand-typed at each call site,
+ * for the same reason `scanSecrets`/`redactSecrets` are: a second, drifting
+ * copy is how a name and its pattern come apart. */
+export const SECRET_PATTERN_NAMES = [
+  'sk- prefixed API key',
+  'GitHub personal access token (ghp_)',
+  'GitHub fine-grained PAT (github_pat_)',
+  'AWS access key ID (AKIA)',
+  'Slack token (xox)',
+  'Google/Gemini API key (AIza)',
+];
+
 /**
  * Scan a RAW text stream (a spine file, a close's output, a transcript) for
  * known secret shapes and return the literal matches. The ONE spelling of the

package/types/authoring.d.ts

@@ -328,6 +328,36 @@ export const VERDICT_CLASSES: readonly string[];
 export const LOCKED_CLASSES: readonly string[];
 /** the classes v1 actually builds */
 export const LIVE_CLASSES: readonly string[];
+/** OFF THE MENU, but still built — a THIRD state, distinct from both lists above
+ * (PRD item 31.1, hamr 2026-09-09: *"retire hitl from list, keep its code"*, and
+ * *"if it's not on menu, you can't reach it, from menu"*).
+ *
+ * `hitl` was retired by ruling at v1.71 and the class moved to fwdloop (PRD item
+ * 29), but no constant was ever updated, so `runInterview` still returned
+ * `ok:true` for a hitl pick — an authorable job for a class this product no
+ * longer closes.
+ *
+ * Why this is NOT `LOCKED_CLASSES`. Locked means INEXPRESSIBLE: no guard battery
+ * exists, so `validateCloseDecl` cannot check the close and must refuse
+ * (`src/declaredclose.js:306`). hitl's battery, question set, composition rule and
+ * runtime all exist and are tested — locking it would make every one of them
+ * unreachable, which is not "keeping the code", it is abandoning it in place with
+ * its tests deleted. So the split is:
+ *
+ *   LOCKED_CLASSES   — no battery. Cannot be validated, cannot run. (empty today)
+ *   UNLISTED_CLASSES — battery exists, validates and RUNS. Just never OFFERED.
+ *   LIVE_CLASSES     — everything the system can validate and run (locked removed).
+ *
+ * Read by the AUTHORING surface only (`runInterview`, `authorClose`'s precheck).
+ * The spec validator, the close validator and the runtime deliberately do NOT
+ * read it: a hitl spec that already exists still validates and still runs, which
+ * is what keeps the code alive and under test. Nothing can AUTHOR a new one.
+ * @type {readonly string[]} */
+export const UNLISTED_CLASSES: readonly string[];
+/** what the authoring interview actually OFFERS: live, minus unlisted. This is
+ * "the menu" in hamr's sentence, and it is the only list an authoring refusal
+ * should ever name. */
+export const MENU_CLASSES: readonly string[];
 /**
  * The whole vocabulary, as DATA. `shape` and `asserts` are the strings the
  * authoring prompt renders (M3) — the prompt and this validator must judge the

package/types/authorjob.d.ts

@@ -81,7 +81,7 @@ export function refuseLockedKind(kind: string): Refusal;
  * @param {{answers: Record<string|number, any>, repoPath?: string|null, lang: string,
  *   verdictType?: string|null,
  *   questions?: Record<string|number, string>|null, generate?: Function, provider?: any,
- *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null,
+ *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
  *   onPhase?: (phase: string, data?: any) => void,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
@@ -91,7 +91,7 @@ export function refuseLockedKind(kind: string): Refusal;
  *   closeDecl: any, seedRef: string|null, authoring: any, judged: any, reds: Red[],
  *   stop: string|null, cost: any, interview: any}>}
  */
-export function authorCloseForJob({ answers, repoPath, lang, verdictType, questions, generate, provider, seedRef, scout, listing, ceilingUsd, onPhase, onCall, seedFn, scoutFn, listingFn, authorFn, authorOpts, signerFix, proposeFn, compileOpts, }: {
+export function authorCloseForJob({ answers, repoPath, lang, verdictType, questions, generate, provider, seedRef, scout, listing, ceilingUsd, judgeModel, onPhase, onCall, seedFn, scoutFn, listingFn, authorFn, authorOpts, signerFix, proposeFn, compileOpts, }: {
     answers: Record<string | number, any>;
     repoPath?: string | null;
     lang: string;
@@ -103,6 +103,7 @@ export function authorCloseForJob({ answers, repoPath, lang, verdictType, questi
     scout?: any;
     listing?: any;
     ceilingUsd?: number | null;
+    judgeModel?: string | null;
     onPhase?: (phase: string, data?: any) => void;
     onCall?: (call: {
         label: string;
@@ -207,12 +208,12 @@ export function assembleSpec(specDraft: any, { closeDecl, verdictType }: {
  *
  * @param {{spec: any, workdir: string, seedRef?: string|null, shellCapUsd?: number,
  *   timeoutMs?: number, seedFn?: Function, listingFn?: Function, seedReadFn?: Function,
- *   judgeLoop?: Function|null, onJudgeCost?: ((c: any) => void)|null, calibrateFn?: Function,
- *   ceilingUsd?: number|null, priorCalls?: any[]}} o
+ *   judgeLoop?: Function|null, judgeModel?: string|null, onJudgeCost?: ((c: any) => void)|null,
+ *   calibrateFn?: Function, ceilingUsd?: number|null, priorCalls?: any[]}} o
  * @returns {Promise<{ok: boolean, specHash: string|null, seedRef: string|null,
  *   gates: any, work: any[], guards: any[], stops: any[], reds: Red[], refusal: Refusal|null}>}
  */
-export function prepareSigning({ spec, workdir, seedRef, shellCapUsd, timeoutMs, seedFn, listingFn, seedReadFn, judgeLoop, onJudgeCost, calibrateFn, ceilingUsd, priorCalls, }: {
+export function prepareSigning({ spec, workdir, seedRef, shellCapUsd, timeoutMs, seedFn, listingFn, seedReadFn, judgeLoop, judgeModel, onJudgeCost, calibrateFn, ceilingUsd, priorCalls, }: {
     spec: any;
     workdir: string;
     seedRef?: string | null;
@@ -222,6 +223,7 @@ export function prepareSigning({ spec, workdir, seedRef, shellCapUsd, timeoutMs,
     listingFn?: Function;
     seedReadFn?: Function;
     judgeLoop?: Function | null;
+    judgeModel?: string | null;
     onJudgeCost?: ((c: any) => void) | null;
     calibrateFn?: Function;
     ceilingUsd?: number | null;
@@ -277,4 +279,6 @@ import { requiredAnswersFor } from './authorflow.js';
 import { VERDICT_CLASSES } from './authoring.js';
 import { LOCKED_CLASSES } from './authoring.js';
 import { LIVE_CLASSES } from './authoring.js';
-export { QUESTION_SETS, questionsFor, requiredAnswersFor, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES };
+import { UNLISTED_CLASSES } from './authoring.js';
+import { MENU_CLASSES } from './authoring.js';
+export { QUESTION_SETS, questionsFor, requiredAnswersFor, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, UNLISTED_CLASSES, MENU_CLASSES };

package/types/calibrate.d.ts

@@ -80,7 +80,13 @@ export function factsResist(facts: any, gold: any, artifactText: string): {
  * graded one: `ok` is false, the cases nobody bought are absent rather than recorded
  * as failures, and `casualty` stays null — the transport was fine, the operator's own
  * governance stopped the gate.
- * @param {{cases: any, card: any, judgeLoop: Function|null,
+ * `judgeModel` is REQUIRED and has no default (PRD item 32.1). It is the identity
+ * the caller resolved (`resolveJudge`, src/judged.js) and it is what the graded set
+ * is STAMPED with — `setHash` folds it in, so a set certified by one judge cannot be
+ * mistaken for the same set certified by another. A default here would be the silent
+ * fall-back the whole judge-identity change exists to remove: a gate that grades
+ * under a model nobody named certifies a floor nobody can attribute.
+ * @param {{cases: any, card: any, judgeLoop: Function|null, judgeModel: string,
  *   onCost?: (c: any) => void, attempts?: number, battery?: any[], batteryCard?: any,
  *   capStop?: () => 'cap-halt'|'pricing-red'|null}} o
  * @returns {Promise<{ok: boolean, stop: string|null, casualty: any,
@@ -90,10 +96,11 @@ export function factsResist(facts: any, gold: any, artifactText: string): {
  *   cardHash: string|null, casesHash: string|null, setHash: string|null,
  *   costUsd: number|null, knownUsd: number, spendComplete: boolean, calls: any[]}>}
  */
-export function runCalibration({ cases, card, judgeLoop, onCost, attempts, battery, batteryCard, capStop, }: {
+export function runCalibration({ cases, card, judgeLoop, judgeModel, onCost, attempts, battery, batteryCard, capStop, }: {
     cases: any;
     card: any;
     judgeLoop: Function | null;
+    judgeModel: string;
     onCost?: (c: any) => void;
     attempts?: number;
     battery?: any[];

package/types/cardauthor.d.ts

@@ -261,15 +261,16 @@ export function signJudgedArtifacts({ proposal, fix }: {
  *   - THE CASES land beside the stages as `calibration.cases` — a close-level
  *     artifact, because the set calibrates the RULER and not one stage's params,
  *     and because module 5's gate reads it before any stage runs.
- *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`, and it is the
- *     PIN (`JUDGE_MODEL`) rather than anything a caller may name. A calibration set
- *     is only worth the tier that graded it — §4.2's whole safety argument is worth
- *     exactly as much as BA-20's injection evidence, which is haiku-4.5's alone — so
- *     the set has to carry which tier certified it or nothing downstream can tell a
- *     signed floor from a bumped one. Storing it HERE, inside the spec, is what makes
- *     a bump flip `jobSpecHash`: the signature dies, the signer re-signs, and a
- *     re-sign is a re-run of the calibration gate. That is the docstring on
- *     `JUDGE_MODEL` finally given a detector instead of a promise (F45).
+ *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`. Since PRD item
+ *     32.1 that is the RESOLVED judge identity the caller hands in (`resolveJudge`,
+ *     src/judged.js — the spec's signed `judge` override, else the job's own worker
+ *     model), not a library pin. A calibration set is only worth the judge that
+ *     graded it, so the set has to carry which judge certified it or nothing
+ *     downstream can tell a signed floor from a moved one. Storing it HERE, inside
+ *     the spec, is what makes a judge change flip `jobSpecHash`: the signature dies,
+ *     the signer re-signs, and a re-sign is a re-run of the calibration gate. It is
+ *     REQUIRED, with no default — a set stamped with a model nobody named is exactly
+ *     the unattributable floor this field exists to prevent (F45).
  *
  * A card with NOWHERE TO LAND THROWS. It is a caller's own broken input — a
  * signed rubric folded into a close with no judged ruler — and there is no safe
@@ -278,12 +279,13 @@ export function signJudgedArtifacts({ proposal, fix }: {
  * The input is never mutated: a closeDecl is a signed artefact and rewriting a
  * caller's copy in place is how two readers come to disagree about what was
  * signed.
- * @param {any} closeDecl @param {{card: any, cases: any[]}} o
+ * @param {any} closeDecl @param {{card: any, cases: any[], judgeModel: string}} o
  * @returns {any} a new closeDecl
  */
-export function foldJudgedArtifacts(closeDecl: any, { card, cases }: {
+export function foldJudgedArtifacts(closeDecl: any, { card, cases, judgeModel }: {
     card: any;
     cases: any[];
+    judgeModel: string;
 }): any;
 /**
  * ONE compile call: the person's Q6 and Q7 in, a proposal out.

package/types/cli.d.ts

@@ -3,7 +3,7 @@
  * code, so `bin/bareloop.mjs` can set `process.exitCode` and let node flush
  * queued stdout on its own (F-something: `process.exit()` can discard it).
  * @param {string[]} argv
- * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, now?: () => number, stdin?: any }} deps
+ * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any }} deps
  * @returns {Promise<number>}
  */
 export function main(argv: string[], deps?: {
@@ -14,6 +14,7 @@ export function main(argv: string[], deps?: {
     provider?: any;
     providerFor?: any;
     judgeProvider?: any;
+    judgeModel?: string | null;
     now?: () => number;
     stdin?: any;
 }): Promise<number>;

package/types/declaredclose.d.ts

@@ -110,6 +110,7 @@ export function guardNames(closeDecl: any, verdictType: string): string[];
  *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
  *   humanRuling?: {decision: string, text?: string|null}|null,
  *   judgeLoop?: ((o: {system: string}) => any)|null,
+ *   judgeModel?: string|null,
  *   onJudgeCost?: ((c: any) => void)|null,
  *   callBounds?: (() => {timeoutMs?: number, deadlineMs?: number})|null}} [opts]
  * @returns {Promise<any>}
@@ -129,6 +130,7 @@ export function runDeclaredStages(stages: any[], redact?: (s: string) => string,
     judgeLoop?: ((o: {
         system: string;
     }) => any) | null;
+    judgeModel?: string | null;
     onJudgeCost?: ((c: any) => void) | null;
     callBounds?: (() => {
         timeoutMs?: number;

package/types/index.d.ts

@@ -15,7 +15,7 @@ export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE }
 export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY, READ_SHIM_ARMS } from "./readshim.js";
 export { runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND, normalizeHumanRuling, resolveHumanRuling, JUDGE_ATTEMPTS, MAX_JUDGED_PATHS, REVIEW_DOOR, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages } from "./kinds.js";
 export { answerReviewDoor, doorRecordOf, doorAgeGate } from "./reviewdoor.js";
-export { JUDGE_MODEL, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL, validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop, CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf } from "./judged.js";
+export { JUDGE_MODEL, resolveJudge, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL, validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop, CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf } from "./judged.js";
 export { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts, proposalSchema, proposalTool, cardCasesPrompt, PROPOSAL_TOOL_NAME, PROPOSAL_LABEL, MAX_PROPOSAL_RETRIES, COMPILE_SYSTEM } from "./cardauthor.js";
 export { runCalibration, compareExpectation, factsResist, artifactHash, INJECTION_LOCATE_BATTERY, INJECTION_CARD, CALIBRATION_LABEL, CASUALTY_AXES } from "./calibrate.js";
 export { validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS, LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames, genreInstruments, DIRECTIONS, BASELINES, MAX_STAGES, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, classMenu, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";
@@ -29,3 +29,4 @@ export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalE
 export { PROMPT_REGISTERS, isPromptFile } from "./promptregisters.js";
 export { exportBundle, bundleHash, readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps } from "./bundle.js";
 export { readCloseScripts, checkCloseAbsolutePaths, absolutePathLiteralsOf, hashCloseScriptBytes, checkCloseByteSignature, checkStageByteSignature, signCloseScripts } from "./close-integrity.js";
+export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest } from "./source.js";

package/types/job.d.ts

@@ -210,7 +210,28 @@ export const CADENCE_UNITS: readonly string[];
 /** PRD item 28 (2026-09-06/09-09): `openai-api` — an OpenAI-shaped provider,
  * constructed via `src/providers.js`'s factory. hamr's ruling (PRD 30.7):
  * `deepseek-chat` is THE secondary provider (one, not a menu of half-tested
- * models); the factory's tier table is where that lives, not this menu. */
+ * models); the factory's tier table is where that lives, not this menu.
+ *
+ * PRD item 31.3 (hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for
+ * now"*): `gemini-api` joins. That is bareloop matching bare-agent's own
+ * adapter surface rather than curating a shorter list — bare-agent exports four
+ * real HTTP backends (Anthropic, OpenAI, Gemini, Ollama) plus CLIPipe and the
+ * FallbackProvider composite; `provider-http.js`, `provider-stop-reason.js`,
+ * `provider-temperature.js` and `provider-usage.js` are shared HELPERS, not
+ * backends, and were miscounted as providers once — the export list, never the
+ * filenames, is the source of truth.
+ *
+ * Ollama is deliberately NOT here. Beyond hamr's word, it is the one entry
+ * whose economics differ in kind: it takes no API key and bills nothing, so
+ * every round would price at $0 through machinery that treats $0 as a real
+ * price. An unpriced round reported as free is the exact honesty violation the
+ * `?? 0` rule exists to stop, and admitting it needs that question answered
+ * first, not a menu entry.
+ *
+ * `gemini-api` is ADMITTED-PENDING-PROBE: the probe rule stands (item 28
+ * ruling (d)) and gemini has zero runs. See `PROBE_STATUS` in
+ * `src/providers.js` — a spec may name it, and the runner says out loud that
+ * nothing has proven it. */
 export const PROVIDERS: readonly string[];
 /** V3 environment label: declared keys only — every field is a lineage-key
  * candidate at N3. `provider` is part of the key by definition (top-level,

package/types/judged.d.ts

@@ -1,3 +1,102 @@
+/**
+ * RESOLVE WHICH MODEL GRADES THIS JOB (PRD item 32.1).
+ *
+ * hamr, 2026-09-10: *"what i care about is that judge becomes llm agnostic and
+ * not set to one model or provider"* — and the shape he named: *"defaults to
+ * whatever llm is used and can be overriden"*.
+ *
+ * So, in precedence order:
+ *   1. `spec.judge` — an explicit, SIGNED `{provider, model}`. This is how a run
+ *      pins a judge deliberately different from its worker (an independent
+ *      reader, or a judge whose calibration a job wants to keep while the worker
+ *      moves). It is a spec field the HUMAN signs, part of `jobSpecHash` like
+ *      every other; the drafting agent cannot express it, because naming your
+ *      own examiner is arbiter territory.
+ *   2. otherwise the job's OWN worker provider and model. A DeepSeek job judges
+ *      on DeepSeek and needs no second account — which is the whole point: after
+ *      item 31.4 a green job runs on its own key alone, and this is what lets a
+ *      JUDGED one do the same.
+ *
+ * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * say which model will grade has not wired a judge, and the grading path stops
+ * as a wiring gap rather than grading under an identity nobody chose — the same
+ * answer an absent `judgeLoop` already gets. A silent default here would be the
+ * exact silent-ignore class that `endpointKey` and F149 exist to prevent, except
+ * pointed at the arbiter.
+ *
+ * SELF-GRADING is licensed by measurement, not by this function: the judge
+ * renders no verdict (it locates facts; `decide()` is deterministic), and the
+ * calibration gate — 10 cases, a 10-of-10 floor, no partial credit, cases that
+ * MUST fail — is exactly the instrument that catches a judge which cannot see
+ * failures. If a worker-family judge cannot pass its own calibration, that is
+ * the finding, and the gate refuses to sign.
+ *
+ * @param {{specJudge?: any, workerProvider?: string, workerModel?: string}} o
+ * @returns {{provider: string, model: string}}
+ */
+export function resolveJudge({ specJudge, workerProvider, workerModel }?: {
+    specJudge?: any;
+    workerProvider?: string;
+    workerModel?: string;
+}): {
+    provider: string;
+    model: string;
+};
+/**
+ * `resolveJudge` needs a worker MODEL already resolved, and an authoring
+ * pipeline has to compute one identity at TWO different moments — once at
+ * compose time, to STAMP `closeDecl.calibration.judgeModel` into the spec it
+ * is about to sign, and again at the calibration gate that grades against
+ * that stamp — from a value that is not yet a validated spec (the operator's
+ * draft) the first time and is one (the assembled spec) the second. Two
+ * hand-spelled compositions of `resolveWorkerModel` + `resolveJudge` is
+ * exactly the kind of pair that drifts (PRD F45's "a rule with no detector is
+ * prose" applies to a rule spelled TWICE just as much as to one spelled
+ * nowhere) — this is the one spelling both calls make, and it mirrors the
+ * SAME composition `scripts/run-u.mjs` applies at launch time: the named
+ * provider's own `tiers.sonnet` defaults an absent model, and a signed
+ * `judge` override wins over the worker default.
+ *
+ * `source` is read for `provider`/`model`/`judge` only, so a draft and the
+ * spec `assembleSpec` folds it into resolve identically — `assembleSpec`
+ * spreads the draft into the spec untouched on those three fields — and any
+ * draft that goes on to validate and sign therefore stamps and grades under
+ * the exact same identity `scripts/run-u.mjs` will resolve at run time.
+ *
+ * `source.provider` absent, or unresolvable, or `source.judge` malformed all
+ * THROW here exactly as `resolveProvider`/`resolveJudge` already do on their
+ * own — a caller composing this from a pre-validation draft is expected to
+ * catch that and use a placeholder, because a draft that cannot resolve here
+ * is a draft `validateJob` reds a few lines later regardless, before anything
+ * gets signed under the placeholder.
+ *
+ * `resolveWorkerModelFn` is taken as a PARAMETER rather than imported — this
+ * module cannot import `./job.js` directly: `job.js` imports
+ * `./declaredclose.js`, which imports `resolveJudge` from THIS module, and a
+ * `judged.js` → `job.js` edge would close that into a cycle. `resolveProvider`
+ * has no such conflict (`./providers.js` imports nothing local) and is
+ * imported directly.
+ *
+ * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
+ * @param {string} fallbackProviderName used only when `source.provider` is absent
+ * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @returns {{provider: string, model: string}}
+ */
+export function resolveJobJudge(source: {
+    provider?: string;
+    model?: string;
+    judge?: any;
+}, fallbackProviderName: string, resolveWorkerModelFn: (o: {
+    specModel?: string;
+    flagModel?: string;
+    defaultModel: string;
+}) => {
+    model: string;
+    source: string;
+}): {
+    provider: string;
+    model: string;
+};
 /**
  * The rubric card: Q6's answer compiled into enumerated items, signed by the
  * person and enumerated in the spec hash. `rule` selects from `JUDGE_RULES`;
@@ -201,25 +300,35 @@ export function decide(facts: any, card: any, { artifactText }?: {
     reason: string | null;
 };
 /**
- * THE JUDGE MODEL, PINNED. Never agent-selectable and never a step knob: it is
- * the only tier with established injection resistance upstream (BA-20's
- * INJECTION_BATTERY is haiku-4.5 only), and §4.2's whole safety argument is
- * worth exactly as much as that evidence. A judge-model bump forces a full
- * recalibration — mandatory, per the model-bump dead-weight replay rule.
+ * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
+ * the judge: every grading path imported it, so bareloop could run a worker on
+ * any provider and still judge only on Claude.
+ *
+ * It is no longer read by any grading path. The judge identity is now RESOLVED
+ * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
+ * `runJudgedFloor`, an explicit argument into the calibration gate, and
+ * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
+ * Keeping the export is deliberate: it is part of the public API
+ * (`src/index.js`) and an adopter importing it should not break on a minor.
+ * What it means now is "the judge bareloop pinned before item 32", which is
+ * still the right DEFAULT for an anthropic-api job and still the only tier with
+ * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
+ * haiku-4.5 only).
  *
- * THAT IS ENFORCED, not asked for, and it is enforced in three places because a
- * rule with no wired detector is prose (F45):
- *   1. the value here is STORED with the set it graded — `foldJudgedArtifacts`
+ * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
+ * rule with no detector is prose (F45) — only the value being compared moved
+ * from this constant to the resolved identity:
+ *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
  *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Bump this constant and every
+ *      `jobSpecHash` covers it by construction. Change the judge and every
  *      signed judged spec hashes differently: the signature dies, and re-signing
  *      is what re-runs the calibration gate.
  *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a tier is a floor nobody can tell apart from a bumped one.
- *   3. `runJudgedFloor` refuses to grade when the stored tier is not this one,
- *      naming both models. It does not degrade in either direction: grading on
- *      the new tier judges against a floor nobody calibrated, and the old tier is
- *      not on offer.
+ *      attribute to a judge is a floor nobody can tell apart from a moved one.
+ *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
+ *      about to grade, naming both. It does not degrade in either direction:
+ *      grading on the new judge judges against a floor nobody calibrated, and
+ *      the old judge is not on offer.
  */
 export const JUDGE_MODEL: "claude-haiku-4-5";
 /**

package/types/kinds.d.ts

@@ -1,3 +1,35 @@
+/**
+ * The judged stages of a close declaration, and whether it has any — the ONE
+ * spelling of "does this close ask a model to render anything?".
+ *
+ * The comment above `JUDGED_FLOOR_KIND` says five literals is how the readers
+ * come to disagree, and by PRD item 31.4 there were SIX open-coded
+ * `stages.filter(s => s.kind === JUDGED_FLOOR_KIND)` across the tree
+ * (`src/authorjob.js` twice, `src/cardauthor.js`, `src/declaredclose.js`,
+ * `scripts/run-author.mjs`, `scripts/author-readout.mjs`). 31.4 needed a
+ * seventh, in the runner, to decide whether a judge KEY is demanded — and a
+ * seventh spelling deciding a REFUSAL is the drift `scripts/run-u.mjs`'s own
+ * judge-provider comment warns about ("a second reading of the declaration
+ * that can drift from the one the runner actually executes"). So there is one
+ * reading now, and every caller shares it.
+ *
+ * Defensive on shape ON PURPOSE: callers pass raw specs read off disk and
+ * half-built drafts, not validated declarations. An absent/!object `closeDecl`
+ * or `stages` is "no judged stages", never a throw — the close VALIDATOR is
+ * what rejects a malformed declaration, and this predicate answering a
+ * question about one is not the place to re-litigate it.
+ * @param {any} closeDecl a close declaration (or anything, including undefined)
+ * @returns {any[]} the judged-floor stages, in declaration order
+ */
+export function judgedStages(closeDecl: any): any[];
+/**
+ * Does this close declaration judge — i.e. will a judge model be CALLED?
+ * The question `scripts/run-u.mjs` asks before demanding a judge key (PRD item
+ * 31.4): a job that never judges must run on its own provider's key alone.
+ * @param {any} closeDecl
+ * @returns {boolean}
+ */
+export function closeJudges(closeDecl: any): boolean;
 /**
  * Does this run end at a review door? The operator's flag WINS in both
  * directions and is never inferred: `true` opens it for any class, `false` shuts
@@ -17,6 +49,30 @@ export function doorOpens(job: any, reviewDoor?: boolean | null): boolean;
  * @returns {any[]}
  */
 export function mechanicalStages(stages: any[] | null | undefined): any[];
+/**
+ * git, read-only, in a repository. Faults come back as `ok:false` with the
+ * stderr — a caller decides whether that is a stop.
+ *
+ * Exported (PRD item 33/M2, `src/source.js`) so the hidden-git seed a plain
+ * folder/file/URL job runs against goes through the SAME spawn primitive as
+ * every other git read in this file — a second `spawn('git', …)` for the
+ * source front door would be a second instrument with its own timeout and
+ * buffer ceiling to keep in sync with this one.
+ * @param {string} cwd @param {string[]} args
+ */
+export function git(cwd: string, args: string[]): Promise<{
+    ok: boolean;
+    out: string;
+    err: string;
+    code: null;
+    fault: string;
+} | {
+    ok: boolean;
+    out: string;
+    err: string;
+    code: number;
+    fault: "failed";
+}>;
 /**
  * D8's seed, READ rather than typed: HEAD at run start. A close stores the
  * counting rule and never the number (D12), so which commit the run is measured
@@ -531,10 +587,16 @@ export type Red = {
  * runner — never authored, never defaulted, and absent on every ordinary run.
  * `judgeLoop` is the PAID seam the judged stage runs its locate call through, and
  * it is operator territory for the same reason the worker's provider is: this
- * module owns no provider and never picks one, and the judge tier is PINNED
- * (`JUDGE_MODEL`) rather than chosen. Absent is not a fall-back to some other
- * model — the stage stops as a wiring gap, the same answer `runPlan` gives a
+ * module owns no provider and never picks one. Absent is not a fall-back to some
+ * other model — the stage stops as a wiring gap, the same answer `runPlan` gives a
  * native job with no native factory.
+ * `judgeModel` is the seam's other half (PRD item 32.1): WHICH model that loop
+ * drives, resolved by the runner (`resolveJudge`, src/judged.js — the spec's signed
+ * `judge` override, else the job's own worker model) rather than pinned in this
+ * library. It is required whenever `judgeLoop` is, and for the same reason: a
+ * verdict whose grader cannot be named is a floor nobody can attribute, and the
+ * signed calibration record has nothing to compare against. The two travel
+ * together or the stage stops.
  * `onJudgeCost` is the METER, and it is the only reason a judged stage can be
  * funded honestly: this executor cannot reach the run's ledger, so every locate
  * call's cost is reported OUT through it, once per call, on every route including
@@ -566,6 +628,7 @@ export type Ctx = {
     judgeLoop?: (o: {
         system: string;
     }) => any;
+    judgeModel?: string;
     onJudgeCost?: (c: {
         stage: string | null;
         kind: string | null;

package/types/planrun.d.ts

@@ -196,8 +196,15 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   `false` → the drafter has no tools, so a native session would report NO cost — return a
  *   metered claude-json TEXT provider (`--output-format json`, `parse:'claude-json'`) instead,
  *   so its spend is never invisible. The Loop path (`anthropic-api`) never touches this.
+ * @param {string|null} [opts.judgeModel] softgreen — WHICH model that judge provider drives
+ *   (PRD item 32.1). Resolved by the CALLER (`resolveJudge`, src/judged.js: the spec's signed
+ *   `judge` override, else the job's own worker model), never pinned in this library. It
+ *   travels with `judgeProvider` or the judged stage stops as a wiring gap: a verdict whose
+ *   grader cannot be named is a floor nobody can attribute.
  * @param {any} [opts.judgeProvider] softgreen — the provider a JUDGED close stage runs its
- *   locate call through, pinned by the operator to `JUDGE_MODEL` (src/judged.js). Separate
+ *   locate call through, built by the CALLER from the RESOLVED judge identity (PRD item
+ *   32.1: `resolveJudge`, src/judged.js — the spec's signed `judge` override, else the job's
+ *   own worker provider and model), never pinned in this library. Separate
  *   from `provider`/`providerFor` on purpose: the judge tier is not a step knob and never
  *   agent-selectable, and the worker's binding is not a legal stand-in for it. Absent is not
  *   a fall-back — a judged stage with no seam instrument-STOPS as a wiring gap, the same
@@ -410,7 +417,7 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
  *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, judgeProvider, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, closeDir, maxStepRounds, layerRoot, readShim, scout, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, priorSpentUsd, reviewDoor, doorRerun, resumable }: {
+export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, closeDir, maxStepRounds, layerRoot, readShim, scout, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, priorSpentUsd, reviewDoor, doorRerun, resumable }: {
     workdir: string;
     provider: any;
     nativeProvider?: ((o: {
@@ -419,6 +426,7 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
         maxTurns: number;
         hasTools: boolean;
     }) => any) | undefined;
+    judgeModel?: string | null | undefined;
     judgeProvider?: any;
     emit: (type: string, data?: object) => object;
     remainingUsd: () => number;