bareloop 0.25.1 → 0.27.0

package/src/detectlang.js

@@ -0,0 +1,200 @@
+// LANGUAGE DETECTION (PRD item 33/M3, ruling 3 — `docs/product/ITEM33-BUILD.md`,
+// "Five detection points"): a code job's checks always run the repo's OWN
+// tools in the repo's own language, so language is a FACT of the repository,
+// never a question asked of the person. This module is that fact-finder —
+// $0, no provider, no model — and it replaces the `--lang` flag (default
+// `js`) `scripts/run-interview.mjs` and `scripts/run-author.mjs` used to
+// carry.
+//
+// ONE DATA TABLE (`MANIFEST_RULES`), not a code path per language: M3b's job
+// is to flip a language from "known but no genre data" to "known and
+// supported" by adding it to `GENRE_LANGUAGES` (`src/authoring.js`) — this
+// module never hardcodes the supported set a second time, it reads
+// `GENRE_LANGUAGES` live, so a language landing in M3b needs no edit here.
+//
+// FOUR OUTCOMES, discriminated by `kind`, never a throw for the ones a caller
+// must act on in the ordinary course of a run:
+//   - `resolved`             — a known, SUPPORTED manifest: 'js' or 'python'.
+//   - `language-unsupported` — a known manifest this catalogue has no genre
+//                               data for yet (go, rust, java, csharp, php...).
+//                               Never a silent fallback to js. Carries a
+//                               `refusal` shaped exactly like the `Refusal`
+//                               `src/authorjob.js` already returns for its own
+//                               language refusal (same `REFUSAL_LIB`,
+//                               `REFUSAL_CATEGORY`, `request-red` shape) —
+//                               reusing that pattern rather than inventing a
+//                               second one, so a caller with a spine can emit
+//                               it through the same `refusalEvents()` either
+//                               already imports.
+//   - `no-code-job`           — no manifest anywhere in the walk. NOT an
+//                               error: PRD item 33 M3 ruling 7 says a
+//                               plain-folder job gets the form and an honest
+//                               "no checks yet" stop later (M4), so this is a
+//                               normal reading, not a refusal.
+//   - `ambiguous`             — two DIFFERENT supported languages' manifests
+//                               at the same (nearest) directory level. The
+//                               confirm-turn UI that would ask a person to
+//                               pick is a later M3 piece; for now this is
+//                               reported so a caller can stop rather than
+//                               guess.
+
+import { readdirSync, statSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { GENRE_LANGUAGES } from './authoring.js';
+import { GENRE, REFUSAL_CATEGORY, REFUSAL_LIB } from './authorjob.js';
+import { nearestGitAncestor } from './source.js';
+
+/** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
+/** @typedef {{kind: 'request-red', verb: string|null, path: string, detail: string,
+ *   options: string[], red: Red}} LangRefusal */
+
+/**
+ * THE MANIFEST TABLE, as data — the whole language vocabulary this module
+ * knows, one entry per manifest shape. `supported` is DERIVED from
+ * `GENRE_LANGUAGES` at lookup time (never stored), so a language M3b adds
+ * there flips from "unsupported stop" to "resolved" by that one edit, never
+ * by adding a new branch here.
+ * @type {ReadonlyArray<{kind: 'exact'|'ext', name?: string, ext?: string, language: string}>}
+ */
+const MANIFEST_RULES = Object.freeze([
+  Object.freeze({ kind: 'exact', name: 'package.json', language: 'js' }),
+  Object.freeze({ kind: 'exact', name: 'pyproject.toml', language: 'python' }),
+  Object.freeze({ kind: 'exact', name: 'setup.py', language: 'python' }),
+  Object.freeze({ kind: 'exact', name: 'go.mod', language: 'go' }),
+  Object.freeze({ kind: 'exact', name: 'Cargo.toml', language: 'rust' }),
+  Object.freeze({ kind: 'exact', name: 'pom.xml', language: 'java' }),
+  Object.freeze({ kind: 'exact', name: 'build.gradle', language: 'java' }),
+  Object.freeze({ kind: 'exact', name: 'build.gradle.kts', language: 'java' }),
+  Object.freeze({ kind: 'exact', name: 'composer.json', language: 'php' }),
+  Object.freeze({ kind: 'ext', ext: '.csproj', language: 'csharp' }),
+  Object.freeze({ kind: 'ext', ext: '.sln', language: 'csharp' }),
+]);
+
+/**
+ * A human label for a matched rule, for messages — `package.json` for an
+ * exact match, `*.csproj` for an extension match.
+ * @param {{kind: 'exact'|'ext', name?: string, ext?: string}} rule
+ * @returns {string}
+ */
+function ruleLabel(rule) {
+  return rule.kind === 'exact' ? /** @type {string} */ (rule.name) : `*${rule.ext}`;
+}
+
+/**
+ * The directory chain to walk, NEAREST first, stopping at the repo root (the
+ * nearest ancestor carrying a `.git` entry, directory OR file — a submodule's
+ * `.git` is a file). When no `.git` exists anywhere above `start`, the walk
+ * is exactly `[start]` — this module never reads above the folder it was
+ * asked about when there is no repo boundary to stop it honestly.
+ *
+ * The boundary itself is `nearestGitAncestor` (`src/source.js`) — the ONE
+ * walk-up-for-`.git` rule, shared with `looksLikeRepoSource`/`prepareSource`'s
+ * own repo-root routing (PRD item 33 M3 ruling 2 addendum) — this function
+ * only turns that single boundary into the full chain of directories a
+ * manifest search walks.
+ * @param {string} start
+ * @returns {string[]}
+ */
+function walkChain(start) {
+  /** @type {string[]} */
+  const chain = [];
+  let d = resolve(start);
+  for (;;) {
+    chain.push(d);
+    const parent = dirname(d);
+    if (parent === d) break; // filesystem root
+    d = parent;
+  }
+  const boundary = nearestGitAncestor(chain[0]);
+  const repoRootIdx = boundary === null ? -1 : chain.indexOf(boundary.dir);
+  return repoRootIdx === -1 ? [chain[0]] : chain.slice(0, repoRootIdx + 1);
+}
+
+/**
+ * Every manifest rule matched inside `dir`, reading its entries once.
+ * @param {string} dir
+ * @returns {{kind: 'exact'|'ext', name?: string, ext?: string, language: string}[]}
+ */
+function matchesIn(dir) {
+  /** @type {string[]} */
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return []; // an unreadable directory has no manifest, not an error this module raises
+  }
+  return MANIFEST_RULES.filter((r) => (
+    r.kind === 'exact' ? entries.includes(/** @type {string} */ (r.name)) : entries.some((e) => e.endsWith(/** @type {string} */ (r.ext)))
+  ));
+}
+
+/**
+ * The `language-unsupported` refusal, shaped exactly like `src/authorjob.js`'s
+ * own `Refusal` — same `REFUSAL_LIB`, same `request-red` code, so a caller
+ * holding a spine can hand it straight to `refusalEvents()` without this
+ * module inventing a second recording shape.
+ * @param {string} language @param {string} manifest
+ * @returns {LangRefusal}
+ */
+function unsupportedRefusal(language, manifest) {
+  const detail = `We can't run this kind of job yet: the nearest manifest is ${manifest}, which names "${language}" `
+    + `as this repository's language. The catalogue only has ${GENRE} genre data for ${GENRE_LANGUAGES.join(' and ')} `
+    + `today — a language it has no data for must refuse rather than author a close without the guards it cannot `
+    + 'supply.';
+  return {
+    kind: 'request-red',
+    verb: 'language-unsupported',
+    path: 'lang',
+    detail,
+    options: [
+      `wait for a later build to add ${language} (PRD item 33 M3b)`,
+      `restate the job for ${GENRE_LANGUAGES.join(' or ')}, the languages this catalogue currently measures`,
+    ],
+    red: {
+      code: 'request-red', path: 'lang', detail, verb: 'language-unsupported', lib: REFUSAL_LIB, category: REFUSAL_CATEGORY,
+    },
+  };
+}
+
+/**
+ * Detect a code job's language from its repository, $0, no provider.
+ *
+ * @param {string} sourcePath the Source path (a folder, or a file inside one)
+ * @returns {{kind: 'resolved', lang: string, dir: string, manifest: string} | {kind: 'language-unsupported', language: string, dir: string, manifest: string, refusal: LangRefusal} | {kind: 'no-code-job'} | {kind: 'ambiguous', candidates: string[], dir: string}}
+ */
+export function detectLanguage(sourcePath) {
+  const st = statSync(sourcePath);
+  const start = st.isDirectory() ? sourcePath : dirname(sourcePath);
+  const chain = walkChain(start);
+
+  for (const dir of chain) {
+    const matched = matchesIn(dir);
+    if (!matched.length) continue;
+
+    const languages = [...new Set(matched.map((m) => m.language))];
+    if (languages.length > 1) {
+      // Ruling 3, point (3): two manifests at the same level. Named literally
+      // rather than the spec's minimal "two supported languages" example —
+      // ANY two different languages at the nearest level is an unresolved
+      // pick, listed rather than silently narrowed to the supported ones.
+      return { kind: 'ambiguous', candidates: languages.sort(), dir };
+    }
+
+    const language = languages[0];
+    const matchedRule = matched.find((m) => m.language === language);
+    // `matched` was just built from `languages`, so this find always succeeds —
+    // narrowed with a real runtime check rather than an `any`/`!` cast, so a
+    // future refactor that breaks the invariant reds loudly instead of typing
+    // past it.
+    if (!matchedRule) throw new Error(`unreachable: "${language}" matched from its own manifest list`);
+    const manifest = ruleLabel(matchedRule);
+    if (GENRE_LANGUAGES.includes(language)) {
+      return { kind: 'resolved', lang: language, dir, manifest };
+    }
+    return {
+      kind: 'language-unsupported', language, dir, manifest, refusal: unsupportedRefusal(language, manifest),
+    };
+  }
+
+  return { kind: 'no-code-job' };
+}

package/src/index.js

@@ -52,7 +52,7 @@ export {
   BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate,
   mintBridge, appendGreen, appendRed,
   loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists,
-  QUARANTINED_VERDICTS, QUARANTINED_CODE, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor,
+  QUARANTINED_VERDICTS, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor,
 } from './bridges.js';
 export { renderListing, selectionPrompt } from './selection.js';
 // Layer 3 modules 4+5 — the D7 envelope and the reuse runner. `runReuse` composes
@@ -81,7 +81,7 @@ export { renderListing, selectionPrompt } from './selection.js';
 // at a review door, and a door with no row to act on can only describe a held learning
 // credit it has no way to release. STORAGE ONLY — nothing here selects, promotes or reuses
 // a bridge; those stay parked on `layer-3-reuse`.
-export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow, shapeForkName } from './reuse.js';
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow } from './reuse.js';
 // BA-21 pricing provenance rides out with the ledger because it is the same job: reading
 // a run's own spend record honestly. `rateProvenance`/`spendProvenance` answer "how much of
 // this was priced by a rate nobody vouched for" — REPORTING ONLY, no halt, no refusal.
@@ -95,7 +95,7 @@ export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASS
 // runner that resumes reads the branch off the dead spine and may want to verify it is
 // still there before spending anything. The runner applies the rule itself either way —
 // neither export is a way to opt out of it.
-export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE } from './workbranch.js';
+export { workBranchName } from './workbranch.js';
 // THE READ SHIM (arm-gated, OFF by default via `runJob`'s `readShim`). The cap is exported
 // because bareloop.context.md names it, and documented-but-unexported is a false contract;
 // the wrapper goes with it so a caller building its own worker seam wraps the SAME ledger
@@ -105,7 +105,7 @@ export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE }
 // `readShimArm` is exported for the same reason the cap is: a battery driver has to be able
 // to name and check the arm it is about to run BEFORE it launches, and the legal set living
 // only inside a runner would leave the driver guessing at spellings the guard will reject.
-export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY, READ_SHIM_ARMS } from './readshim.js';
+export { readShimArm, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY } from './readshim.js';
 // ── CLOSE AUTHORING v1 (gate 4) — the user declares what done means ──────────
 // The public surface is settled ONCE, here, at M4 (M2's header flagged the
 // naming collision and deferred it rather than exporting piecemeal).
@@ -123,12 +123,12 @@ export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_
 // gate (that is what `prepareSigning` does with them), and `seedAtHead` because
 // D8's seed is READ at run start rather than typed into a spec.
 export {
-  runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees,
-  LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP,
+  runDeclaredClose, runStage, seedRead, seedAtHead,
+  LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER,
   // N4 slice 1 — the hitl surface an adopting runner needs: the three doors, the
   // gate that reads a signer's answer (and refuses an empty one), and the seed
   // exemption ruling 8 states.
-  HUMAN_DECISIONS, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND, normalizeHumanRuling, resolveHumanRuling,
+  HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling, resolveHumanRuling,
   // SOFTGREEN module 2 — the judged stage's own arbiter-owned bounds. An adopter
   // wiring `judgeProvider` needs both numbers to reason about what a judged close
   // can cost: one paid call per artifact, at most one retry each.
@@ -136,7 +136,7 @@ export {
   // SOFTGREEN module 8 — the REVIEW DOOR's vocabulary: the record type a run
   // writes when it ends at the door, which terminals open one, which classes open
   // one unasked, and the mechanical-only rule an `accept` re-proves against.
-  REVIEW_DOOR, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages,
+  DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages,
 } from './kinds.js';
 // SOFTGREEN module 8 — the door's ANSWERING half. A run OPENS the door on its own
 // spine and ends; a person answers minutes or days later, from another process, so
@@ -144,7 +144,7 @@ export {
 // it re-proves the tree for an `accept`, releases a held judged green through
 // module 6's registry half, and refuses an expired door under the same 60-day TTL a
 // hitl checkpoint keeps. It never returns, writes or implies a verdict.
-export { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
+export { answerReviewDoor } from './reviewdoor.js';
 // SOFTGREEN module 1 — the judged floor's core. The pieces an adopter (and an
 // integrating UI) genuinely needs: `resolveJudge` (PRD item 32.1 — WHICH model
 // grades a job: the spec's signed `judge` override, else the job's own worker
@@ -157,13 +157,13 @@ export { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
 // runner reaches it through `runPlan`'s `judgeProvider`, and it is exported so a
 // caller building its own harness does not spell a second one.
 export {
-  JUDGE_MODEL, resolveJudge, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL,
-  validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop,
+  JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
+  runLocate, decide,
   // SOFTGREEN module 4 — what a legal SIGNED calibration set is. The SIZE is
   // hamr's own ruling and a size change is a spec-level threshold change;
   // `expectedOf` is the ONE reduction of a `decide()` result to the shape a case
   // stores, so a calibration harness compares one shape rather than two.
-  CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf,
+  CALIBRATION_SIZE, validateCalibrationSet, expectedOf,
 } from './judged.js';
 // SOFTGREEN module 4 — the COMPILE. Q6 becomes the rubric card and Q7 becomes the
 // frozen calibration set, both on the D5 shown-and-fixed path: the LLM proposes
@@ -173,8 +173,6 @@ export {
 // line or a case is a re-sign like every other spec edit.
 export {
   proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts,
-  proposalSchema, proposalTool, cardCasesPrompt,
-  PROPOSAL_TOOL_NAME, PROPOSAL_LABEL, MAX_PROPOSAL_RETRIES, COMPILE_SYSTEM,
 } from './cardauthor.js';
 // SOFTGREEN module 5 — THE CALIBRATION GATE. `runCalibration` grades the whole
 // pipe (locate + decide) over the signed ten and the five arbiter-owned injection
@@ -185,22 +183,21 @@ export {
 // on trust. `INJECTION_LOCATE_BATTERY` and `INJECTION_CARD` are ARBITER-OWNED
 // constants: no signer authors them and nothing stores them in a spec.
 export {
-  runCalibration, compareExpectation, factsResist, artifactHash,
-  INJECTION_LOCATE_BATTERY, INJECTION_CARD, CALIBRATION_LABEL, CASUALTY_AXES,
+  runCalibration,
+  INJECTION_LOCATE_BATTERY, CASUALTY_AXES,
 } from './calibrate.js';
 // M2 — what a declaration may SAY, and whether one said it legally. The
 // catalogue and the genre are DATA an integrating UI renders (the kind menu, the
 // guard batteries it must show the user under D5 and cannot let them remove).
 export {
-  validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS,
-  LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames,
+  validateDeclaration, KIND_CATALOGUE,
+  LOCKED_KINDS, genreEnv,
   // how the genre's own tools PRINT — genre property for the same reason the
   // suppression battery is (2026-08-09, run msmbpjk6)
   genreInstruments,
-  DIRECTIONS, BASELINES, MAX_STAGES,
   // the verdict-class surface (PRD v1.57 §1–§2): the radio's own menu, the guard
   // battery keyed off it, and the ceiling that makes the pick a promise
-  VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, classMenu, closeCeiling,
+  LOCKED_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling,
   // ruling 5 as data: the kinds no agent may ever be offered as an in-run ruler
   NEVER_OFFERED_KINDS,
 } from './authoring.js';
@@ -208,27 +205,26 @@ export {
 // loop; `runAuthorScout`/`buildSeedListing` are exported because a caller that
 // already paid for a survey passes it back in rather than buying a second one.
 export {
-  runAuthorScout, buildSeedListing, seedFileList, classifySurvey, AUTHOR_SCOUT_VERBS,
+  runAuthorScout, buildSeedListing, AUTHOR_SCOUT_VERBS,
   // the malformed-class retry ladder: the hardcoded ceiling, the typed causes it
   // reads, and the closed set of causes that may fire it (2026-08-09, PRD v1.58)
-  SCOUT_ATTEMPTS, SURVEY_CAUSES, SCOUT_RETRY_CAUSES,
+  SCOUT_ATTEMPTS, SCOUT_RETRY_CAUSES,
 } from './authorscout.js';
 /** the ONE scrubbed-persist boundary for a model's raw output, and its announced
  * bound — exported because every future writer of a raw must reach for this one
  * rather than spell a second scrub (PRD v1.58) */
-export { scrubRaw, RAW_PERSIST_MAX, RAW_TRIM_MARKER } from './text.js';
+export { scrubRaw, RAW_PERSIST_MAX } from './text.js';
 export {
-  authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS,
-  QUESTION_SETS, GREEN_QUESTIONS, SOFTGREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor,
+  authorClose, MAX_REVISIONS,
+  questionsFor, requiredAnswersFor,
 } from './authorflow.js';
 // M4a — the runtime bridge. `validateCloseDecl` is the spec-level gate (the job
 // validator's own branch calls it); `runDeclaredStages` is the executor seam a
 // runner other than `runPlan` would need; `closeStagesOf` is the ONE staging
 // every close consumer reads, widened to both fields.
 export {
-  validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade,
-  DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS,
-  HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS,
+  validateCloseDecl, runDeclaredStages, declaredStages,
+  HUMAN_PAUSE,
 } from './declaredclose.js';
 export { closeStagesOf } from './plan.js';
 // Build-list item 2 (2026-08-23) — the run behaviour summary: a report-only
@@ -247,7 +243,7 @@ export { replayRun, formatReplay } from './replay.js';
 // never signs — the approvals array and the human's word are unchanged.
 export {
   runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind,
-  GENRE, REFUSAL_LIB, REFUSAL_CATEGORY, AUTHORED_SPEC_FIELDS,
+  AUTHORED_SPEC_FIELDS,
 } from './authorjob.js';
 // PRD build-list item 5 (TODO #8) — the prompt-register inventory: every file
 // known to carry model-facing prompt/instruction text, and the predicate a
@@ -295,5 +291,5 @@ export { main as cliMain } from './cli.js';
 // module, not a re-derivation of it.
 export {
   prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest,
-  datedDestination, pickDelivery,
+  datedDestination, pickDelivery, missingDependencies,
 } from './source.js';

package/src/job.js

@@ -135,8 +135,9 @@ export const CADENCE_UNITS = Object.freeze(['hour', 'day', 'week']);
  * rows on the cost axis, and budgets sized for one do not transfer. */
 /** PRD item 28 (2026-09-06/09-09): `openai-api` — an OpenAI-shaped provider,
  * constructed via `src/providers.js`'s factory. hamr's ruling (PRD 30.7):
- * `deepseek-chat` is THE secondary provider (one, not a menu of half-tested
- * models); the factory's tier table is where that lives, not this menu.
+ * `deepseek-flash` is THE secondary provider (one, not a menu of half-tested
+ * models; F171, item 34 L16: swapped from the retired `deepseek-chat`); the
+ * factory's tier table is where that lives, not this menu.
  *
  * PRD item 31.3 (hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for
  * now"*): `gemini-api` joins. That is bareloop matching bare-agent's own
@@ -191,6 +192,42 @@ const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
  * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
  * filed as an upstream bug (the BA-2 misattribution class). */
 
+/**
+ * The `baseUrl` SHAPE rule, standalone (PRD item 28 ruling (d); PRD item 33
+ * close-out, "authoring provider selectable" — a bad `--base-url` used to
+ * refuse only at the end of the interview, through `validateJob`, after every
+ * question had already been asked). ONE spelling of the rule: `validateJob`
+ * below calls this, and so does `scripts/run-interview.mjs`, at flag-parse
+ * time, before it asks anything.
+ *
+ * No network access, so this checks SHAPE only: `https://` for a real
+ * endpoint, or `http://` restricted to a loopback host (a local
+ * OpenAI-compatible server, the only legitimate reason to skip TLS) — and
+ * never a credential embedded IN the URL itself. A URL travels into logs and
+ * spine records far more casually than a header ever would, and secrets never
+ * enter the tree/spine (hard line #3) — a baseUrl carrying `user:pass@host`
+ * is exactly that leak, just spelled differently. The returned message never
+ * echoes the value it judged — it is printed as-is by both callers, and a
+ * value that failed for carrying credentials must not repeat them back.
+ * @param {unknown} value
+ * @returns {string|null} a red `detail`, or `null` when the value is admitted
+ */
+export function validateBaseUrl(value) {
+  if (!isNonEmptyString(value)) {
+    return 'non-empty string — an https:// URL (http:// admitted only to 127.0.0.1/localhost/::1)';
+  }
+  /** @type {URL|null} */
+  let u = null;
+  try { u = new URL(value); } catch { /* u stays null — caught below */ }
+  if (!u) return 'must be a parseable URL';
+  if (u.username !== '' || u.password !== '') return 'no embedded credentials (user:pass@host) — secrets never enter a signed spec';
+  if (u.protocol === 'https:') return null; // admitted
+  if (u.protocol === 'http:' && (u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '::1')) {
+    return null; // admitted — a local OpenAI-compatible endpoint, the one case that legitimately skips TLS
+  }
+  return 'https:// required (http:// admitted only to 127.0.0.1/localhost/::1)';
+}
+
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
  * JSON text or plain parsed data — the ingest contract; a live object with a
@@ -328,33 +365,13 @@ export function validateJob(input, { shellCapUsd = 2 } = {}) {
 
   // BASE URL — PRD item 28, ruling (d), 2026-09-09: admitted in v1 of
   // openai-api (an OpenAI-compatible gateway/endpoint), OPTIONAL and part of
-  // the signed hash like `model` above. This validator has no network
-  // access, so it checks SHAPE only: `https://` for a real endpoint, or
-  // `http://` restricted to a loopback host (a local OpenAI-compatible
-  // server, the only legitimate reason to skip TLS) — and never a
-  // credential embedded IN the URL itself. A URL travels into logs and
-  // spine records far more casually than a header ever would, and secrets
-  // never enter the tree/spine (hard line #3) — a bareUrl carrying
-  // `user:pass@host` is exactly that leak, just spelled differently.
+  // the signed hash like `model` above. `validateBaseUrl` (below) is the ONE
+  // spelling of the shape rule — `scripts/run-interview.mjs` calls it too, at
+  // flag-parse time, before the interview asks a single question, rather than
+  // this file's copy being the only one that ever ran it.
   if (spec.baseUrl !== undefined) {
-    if (!isNonEmptyString(spec.baseUrl)) {
-      red('invalid-value', 'baseUrl', 'non-empty string — an https:// URL (http:// admitted only to 127.0.0.1/localhost/::1)');
-    } else {
-      /** @type {URL|null} */
-      let u = null;
-      try { u = new URL(spec.baseUrl); } catch { /* u stays null — caught below */ }
-      if (!u) {
-        red('invalid-value', 'baseUrl', 'must be a parseable URL');
-      } else if (u.username !== '' || u.password !== '') {
-        red('invalid-value', 'baseUrl', 'no embedded credentials (user:pass@host) — secrets never enter a signed spec');
-      } else if (u.protocol === 'https:') {
-        // admitted
-      } else if (u.protocol === 'http:' && (u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '::1')) {
-        // admitted — a local OpenAI-compatible endpoint, the one case that legitimately skips TLS
-      } else {
-        red('invalid-value', 'baseUrl', 'https:// required (http:// admitted only to 127.0.0.1/localhost/::1)');
-      }
-    }
+    const err = validateBaseUrl(spec.baseUrl);
+    if (err) red('invalid-value', 'baseUrl', err);
   }
 
   // 3. the outer write fence — operator law (interview decision #4), same

package/src/planrun.js

@@ -11,7 +11,14 @@
 // absolute repo root, its target, prior steps' artifacts labeled by id, its
 // gap, and a cut-off notice. It NEVER sees the budget, the close command, a
 // check's command, the validator, other steps' grants, or the arbiter's books
-// (fs.deny on the gate audit / .smoke / .litectx, unchanged).
+// (fs.deny on the gate audit / .smoke / .litectx, unchanged). `.git` and
+// `node_modules` are a DIFFERENT law (F178/F177): WRITES there are blocked
+// (tools.denyArgPatterns on write/edit, FORBIDDEN_WRITE_SEGMENT_PATTERN,
+// below), but READS are not — fs.deny blocks ALL fs actions including reads
+// (bareguard node_modules/bareguard/src/primitives/fs.js:43,62-66), and
+// hamr's ruling was to block WRITING, never reading; the worker's persona
+// also never names `.git`/`node_modules` as denied books (tests/tools.test.js),
+// which putting either in fs.deny would silently contradict.
 
 import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
@@ -465,7 +472,6 @@ const REPLAN_GAP_KEEP = '\\S';
  * No gap → the empty string, so the brief renders byte-identically to the pre-F86
  * one. A labelled empty section would be an invitation to explain an absence the
  * run never observed (a stall never judged its exits at all).
- *
  * @param {string | null | undefined} gap the step's last exit gap text
  * @returns {string} the labelled block, or '' when there is nothing to show
  */
@@ -480,6 +486,48 @@ export function closeGapBlock(gap) {
     + (scrubbed.length > CHECK_GAP_MAX ? boundGap(scrubbed, REPLAN_GAP_KEEP) : scrubbed);
 }
 
+/**
+ * The runtime belt for F178 (`.git`) and F177's follow-up (`node_modules`) —
+ * hamr's option B ruling (2026-09-14): block WRITING to either, never reading.
+ * bareguard's `fs.deny` cannot be used for this: it blocks ALL fs actions,
+ * reads included (node_modules/bareguard/src/primitives/fs.js:43 "paths/
+ * prefixes denied for all fs actions", checked at :62-66 before the read/write
+ * split) — putting `.git` there (the first version of this fix) silently also
+ * blocked READING it, which was never ruled, and the worker's persona never
+ * names `.git`/`node_modules` as a denied book the way it does the gate audit
+ * / `.smoke` / `.litectx` (`tests/tools.test.js`'s persona/fence-drift guard
+ * caught exactly this in the full gate). `fs.deny` is exact prefix-containment
+ * only anyway — no glob, no path-segment match — confirmed by reading
+ * `within()` (node_modules/bareguard/src/primitives/fs.js:26-31): `p === b ||
+ * p.startsWith(b + '/')` against each configured entry, nothing else; it
+ * could not express `node_modules`-at-any-depth even if reads were not a
+ * problem (`node_modules/bareguard/src/glob.js`'s `matchAny`/`globToRegex`
+ * exist in the same package but `fs.js` never imports them).
+ *
+ * `tools.denyArgPatterns` (`node_modules/bareguard/src/primitives/tools.js`,
+ * step 3 of `Gate#_stepEval` — the SAME step `fsCheck` runs at, checked right
+ * after it in the `??` chain, `node_modules/bareguard/src/gate.js`) is the
+ * supported hook used instead: a RegExp tested against
+ * `JSON.stringify(action)`, keyed by `action.type` so it is scoped to
+ * `write`/`edit` ONLY — a `read` action never reaches this pattern at all.
+ * Because `fsCheck` runs first in the same `??` chain, this pattern is
+ * reached only when the path already passed `writeScope`/`deny` — exactly the
+ * residual case (an in-fence write/edit whose path still carries a `.git` or
+ * `node_modules` segment; `.git` itself is never IN a signed fence in the
+ * first place, `scopeContained` in src/validate.js refuses that at
+ * declaration time — this is the belt for a validator regression). Matched
+ * whole-segment (a look-alike like `.github`/`.gitignore`/`my.git`/
+ * `node_modules_util` stays admitted). Safe to match the WHOLE serialized
+ * action (not just the `path` field in isolation) because bareloop's own
+ * action shape (`toolAction`, src/tools.js) never carries a write's byte
+ * CONTENT in the action object — `args.bytes` is a length, not the text — so
+ * there is no written-file-content collision risk the way there would be for
+ * bareguard's own `content.denyPatterns` primitive (which explicitly strips
+ * payload fields for exactly that reason).
+ * @type {RegExp}
+ */
+export const FORBIDDEN_WRITE_SEGMENT_PATTERN = /"path":"(?:(?:[^"\\]|\\.)*\/)?(?:\.git|node_modules)(?:\/|")/;
+
 /**
  * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
  * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a
@@ -2250,6 +2298,13 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         readScope: [workdir],
         deny: [auditPath, ...ARBITER_BOOK_STORES.map((s) => join(workdir, s))],
       },
+      // F178/F177's runtime belt: `.git` and `node_modules` WRITES only — never
+      // fs.deny, which blocks reads too (see FORBIDDEN_WRITE_SEGMENT_PATTERN's
+      // own doc). Reached only when a write/edit path already cleared
+      // fs.writeScope/deny above (step 3's fsCheck runs first in the SAME `??`
+      // chain, node_modules/bareguard/src/gate.js) — i.e. only the residual
+      // case of an in-fence path that still carries one of these segments.
+      tools: { denyArgPatterns: { write: [FORBIDDEN_WRITE_SEGMENT_PATTERN], edit: [FORBIDDEN_WRITE_SEGMENT_PATTERN] } },
       budget: { maxCostUsd: Math.max(remainingUsd(), 0.0001) },
       limits: { maxTurns },
       audit: { path: auditPath },
@@ -2756,6 +2811,30 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         err.lib = 'bare-agent';
         throw err;
       }
+      // F184 — bare-agent 0.43.0 (BA-27) returns a malformed final-turn tool
+      // call PRICED rather than throwing: `toolCalls: []`, `text: ''`,
+      // `error: null`, and its own `malformedToolCall: {name, error}`
+      // marker. Nothing below this point can tell that apart from the model
+      // genuinely producing no useful work — `middle()` reads `r.text` into
+      // `lastText`, which comes back empty either way, and the ordinary
+      // `needs_revision`/`exit-eval` gap is what reaches the spine. That is
+      // NOT changed here — no retry, no new cause on `attemptBounded`, no
+      // effect on strike/ladder/attempt counting or verdict routing (all
+      // arbiter-adjacent, none of this finding's scope). What was missing is
+      // VISIBILITY: this is the one place bareloop code ever sees the
+      // marker before `ask()` returns it unexamined, so a distinct spine
+      // record names the transport class here — the same honesty bar
+      // F179/F180 set for the authoring path, applied to the worker path.
+      if (r.malformedToolCall) {
+        const rawErr = String(r.malformedToolCall.error ?? '');
+        const scrubbedErr = scrub(rawErr);
+        const shownErr = scrubbedErr.length > BOUND_REASON_MAX
+          ? `${scrubbedErr.slice(0, BOUND_REASON_MAX)} [${GAP_TRIM_MARKER} ${scrubbedErr.length - BOUND_REASON_MAX} of ${scrubbedErr.length} characters withheld — the cap is ${BOUND_REASON_MAX}]`
+          : scrubbedErr;
+        emit('worker-malformed-tool-call', {
+          phase, iteration: roundIteration, name: scrub(String(r.malformedToolCall.name ?? '')), error: shownErr,
+        });
+      }
       return r;
     };
     return { ask, askFrom, workerWrites, writeCount, setIteration, wasBounded: () => attemptBounded };

package/src/promptregisters.js

@@ -45,6 +45,12 @@ export const PROMPT_REGISTERS = Object.freeze([
   Object.freeze({ file: 'src/authorflow.js', name: 'STRUCTURE_INSTRUCTION_TOOL' }),
   Object.freeze({ file: 'src/authorflow.js', name: 'STRUCTURE_INSTRUCTION_TEXT' }),
 
+  // src/authorflow.js — the confirm turn (PRD item 33 M3 piece 4)
+  Object.freeze({ file: 'src/authorflow.js', name: 'CONFIRM_SYSTEM' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'confirmPrompt() (inline template, not a const)' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'CONFIRM_STRUCTURE_INSTRUCTION' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'confirmedBlock() (inline template, not a const — feeds authorPrompt)' }),
+
   // src/judged.js — the softgreen judge's locate prompt (spine + per-rule asks)
   Object.freeze({ file: 'src/judged.js', name: 'PROMPT_HEAD' }),
   Object.freeze({ file: 'src/judged.js', name: 'PROMPT_TAIL' }),
@@ -70,6 +76,14 @@ export const PROMPT_REGISTERS = Object.freeze([
 
   // src/planrun.js — the native-surface read-truncation strategy line
   Object.freeze({ file: 'src/planrun.js', name: 'NATIVE_READ_STRATEGY' }),
+
+  // src/authoring.js — the types-genre close template, interpolated verbatim
+  // into the authoring prompt (src/authorflow.js's assembled system message,
+  // "THE GENRE TEMPLATE" block) — model-facing law for a types-genre
+  // declaration, not merely internal genre-table data. Found missing from
+  // this inventory 2026-09-15 (item 6 close-out); no other exported const or
+  // inline template literal in this file carries prompt/instruction text.
+  Object.freeze({ file: 'src/authoring.js', name: 'TYPES_GENRE_TEMPLATE' }),
 ]);
 
 /** The distinct file paths carrying prompt registers, repo-root-relative with