bareloop 0.25.1 → 0.27.0

package/types/authoring.d.ts

@@ -431,14 +431,29 @@ export const MAX_STAGES: 12;
  */
 export const DENIED_COMMANDS: readonly string[];
 /**
- * THE FROZEN TYPES GENRE TEMPLATE — prereg addendum 3's six policy points,
- * VERBATIM. The suite reads the prereg and compares BYTES, so a paraphrase here
- * fails the build rather than quietly changing what every future close is
- * authored against. It deliberately carries no repo-specific command, path, env
- * value or regex: round 2 measured that stating the LAW still leaves the model
- * to find the VALUE, and that is the axis the build must keep live.
+ * THE TYPES GENRE TEMPLATE — six policy points, VERBATIM against
+ * `docs/product/ITEM33-BUILD.md`'s own frozen block (PRD item 33 M3 piece 4,
+ * D6 = A ruling, 2026-09-14). This SUPERSEDES the original prereg-frozen
+ * version (`docs/logs/2026-08-08-close-authoring-gate2-poc-prereg.md`,
+ * addendum 3, the closed record — never edited): that version stated the
+ * WORK-stage skeleton (typecheck, typecheck-outside, tests-kept,
+ * suite-green) and the checker's STRICT form as UNCONDITIONAL law, which
+ * conflicted with ruling 6's "a genre never adds a check the goal did not
+ * ask for" — run mtv8jihy's unasked `tsc --strict` stage is the case this
+ * cures. Composing those stages/strictness only for a CONFIRMED check
+ * (never a code matcher over prose, same reasoning as the no-shell law) is
+ * enforced here, in the prompt; the GUARDS (changed-from-seed,
+ * no-suppressions) are enforced separately and structurally
+ * (`classGuards` + `validateDeclaration`'s `guards-absent` red), so making
+ * the WORK stages conditional here changes nothing about their own
+ * always-on status. The suite reads the SIGNED block and compares BYTES, so
+ * a paraphrase here fails the build rather than quietly changing what every
+ * future close is authored against. It deliberately carries no
+ * repo-specific command, path, env value or regex: round 2 measured that
+ * stating the LAW still leaves the model to find the VALUE, and that is the
+ * axis the build must keep live.
  */
-export const TYPES_GENRE_TEMPLATE: "1. The graded instrument is the STRICT form of the language's type checker, regardless of what\n   the repo's own scripts run. If the repo's script omits strictness, the close adds it.\n2. Tools are invoked so their binaries actually resolve \u2014 through the project's own package\n   runner or language module runner, never a bare binary name.\n3. The stage skeleton, in first-red-wins order: changed-from-seed (guard) \u2192 typecheck (error\n   count IN the target scope, baseline 0, lower-is-better) \u2192 typecheck-outside (error count\n   OUTSIDE the target scope, baseline measured at seed, a ceiling \u2014 required whenever the job\n   scopes to a subset of the tree; omitted only for whole-tree jobs) \u2192 tests-kept (a floor on\n   tests that actually EXECUTED, baseline at seed, higher-is-better; a skipped or deselected\n   test did not run and must not count) \u2192 suite-green (the suite exits clean AND reports zero\n   failing tests \u2014 two assertions) \u2192 no-suppressions (guard).\n4. One population per stage \u2014 two structurally different counts never share a stage.\n5. The checker must judge the PATIENT's own tree: if imports could resolve to an installed or\n   editable copy elsewhere, the environment is set so they resolve inside the patient.\n6. A number the tool did not report is unknown, never zero.";
+export const TYPES_GENRE_TEMPLATE: "1. The STRICT form of the language's type checker is used only when a confirmed check \u2014 or,\n   absent a confirm turn, the goal and interview answers \u2014 asks for strict typing; otherwise the\n   checker runs at whatever strictness the repo's own scripts already use.\n2. Tools are invoked so their binaries actually resolve \u2014 through the project's own package\n   runner or language module runner, never a bare binary name.\n3. The WORK stages \u2014 typecheck (error count IN the target scope, baseline 0, lower-is-better),\n   typecheck-outside (error count OUTSIDE the target scope, baseline measured at seed, a\n   ceiling \u2014 required whenever a typecheck stage is scoped to a subset of the tree), tests-kept\n   (a floor on tests that actually EXECUTED, baseline at seed, higher-is-better; a skipped or\n   deselected test did not run and must not count), and suite-green (the suite exits clean AND\n   reports zero failing tests \u2014 two assertions) \u2014 are composed ONLY for the checks a confirmed\n   plan asked for (or, absent a confirm turn, the goal and interview answers). The GUARDS \u2014\n   changed-from-seed and no-suppressions \u2014 are composed always, first-red-wins:\n   changed-from-seed before every WORK stage, no-suppressions last.\n4. One population per stage \u2014 two structurally different counts never share a stage.\n5. The checker must judge the PATIENT's own tree: if imports could resolve to an installed or\n   editable copy elsewhere, the environment is set so they resolve inside the patient.\n6. A number the tool did not report is unknown, never zero.";
 export const GENRE_LANGUAGES: readonly string[];
 /**
  * THE GENRE, as data. The suppression batteries are the hand-written closes'
@@ -457,7 +472,7 @@ export const GENRE_LANGUAGES: readonly string[];
  */
 export const TYPES_GENRE: Readonly<{
     name: "TYPES";
-    template: "1. The graded instrument is the STRICT form of the language's type checker, regardless of what\n   the repo's own scripts run. If the repo's script omits strictness, the close adds it.\n2. Tools are invoked so their binaries actually resolve — through the project's own package\n   runner or language module runner, never a bare binary name.\n3. The stage skeleton, in first-red-wins order: changed-from-seed (guard) → typecheck (error\n   count IN the target scope, baseline 0, lower-is-better) → typecheck-outside (error count\n   OUTSIDE the target scope, baseline measured at seed, a ceiling — required whenever the job\n   scopes to a subset of the tree; omitted only for whole-tree jobs) → tests-kept (a floor on\n   tests that actually EXECUTED, baseline at seed, higher-is-better; a skipped or deselected\n   test did not run and must not count) → suite-green (the suite exits clean AND reports zero\n   failing tests — two assertions) → no-suppressions (guard).\n4. One population per stage — two structurally different counts never share a stage.\n5. The checker must judge the PATIENT's own tree: if imports could resolve to an installed or\n   editable copy elsewhere, the environment is set so they resolve inside the patient.\n6. A number the tool did not report is unknown, never zero.";
+    template: "1. The STRICT form of the language's type checker is used only when a confirmed check — or,\n   absent a confirm turn, the goal and interview answers — asks for strict typing; otherwise the\n   checker runs at whatever strictness the repo's own scripts already use.\n2. Tools are invoked so their binaries actually resolve — through the project's own package\n   runner or language module runner, never a bare binary name.\n3. The WORK stages — typecheck (error count IN the target scope, baseline 0, lower-is-better),\n   typecheck-outside (error count OUTSIDE the target scope, baseline measured at seed, a\n   ceiling — required whenever a typecheck stage is scoped to a subset of the tree), tests-kept\n   (a floor on tests that actually EXECUTED, baseline at seed, higher-is-better; a skipped or\n   deselected test did not run and must not count), and suite-green (the suite exits clean AND\n   reports zero failing tests — two assertions) — are composed ONLY for the checks a confirmed\n   plan asked for (or, absent a confirm turn, the goal and interview answers). The GUARDS —\n   changed-from-seed and no-suppressions — are composed always, first-red-wins:\n   changed-from-seed before every WORK stage, no-suppressions last.\n4. One population per stage — two structurally different counts never share a stage.\n5. The checker must judge the PATIENT's own tree: if imports could resolve to an installed or\n   editable copy elsewhere, the environment is set so they resolve inside the patient.\n6. A number the tool did not report is unknown, never zero.";
     languages: Readonly<{
         js: Readonly<{
             suppressions: readonly (Readonly<{

package/types/authorjob.d.ts

@@ -85,13 +85,16 @@ export function refuseLockedKind(kind: string): Refusal;
  *   onPhase?: (phase: string, data?: any) => void,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
- *   authorFn?: Function, authorOpts?: object,
- *   signerFix?: Function|any, proposeFn?: Function, compileOpts?: object}} o
+ *   authorFn?: Function, authorOpts?: object, writeScope?: string[]|null,
+ *   signerFix?: Function|any, proposeFn?: Function, compileOpts?: object,
+ *   ask?: ((step: {kind: string, [k: string]: any}) => Promise<string|null>)|null,
+ *   confirmGenerate?: Function|null, isRepo?: boolean,
+ *   langResult?: {kind: string, candidates?: string[], [k: string]: any}|null}} o
  * @returns {Promise<{ok: boolean, refusal: Refusal|null, verdictType: string|null,
  *   closeDecl: any, seedRef: string|null, authoring: any, judged: any, reds: Red[],
- *   stop: string|null, cost: any, interview: any}>}
+ *   stop: string|null, cost: any, interview: any, confirmed: any}>}
  */
-export function authorCloseForJob({ answers, repoPath, lang, verdictType, questions, generate, provider, seedRef, scout, listing, ceilingUsd, judgeModel, onPhase, onCall, seedFn, scoutFn, listingFn, authorFn, authorOpts, signerFix, proposeFn, compileOpts, }: {
+export function authorCloseForJob({ answers, repoPath, lang, verdictType, questions, generate, provider, seedRef, scout, listing, ceilingUsd, writeScope, judgeModel, onPhase, onCall, seedFn, scoutFn, listingFn, authorFn, authorOpts, signerFix, proposeFn, compileOpts, ask, confirmGenerate, isRepo, langResult, }: {
     answers: Record<string | number, any>;
     repoPath?: string | null;
     lang: string;
@@ -115,9 +118,21 @@ export function authorCloseForJob({ answers, repoPath, lang, verdictType, questi
     listingFn?: Function;
     authorFn?: Function;
     authorOpts?: object;
+    writeScope?: string[] | null;
     signerFix?: Function | any;
     proposeFn?: Function;
     compileOpts?: object;
+    ask?: ((step: {
+        kind: string;
+        [k: string]: any;
+    }) => Promise<string | null>) | null;
+    confirmGenerate?: Function | null;
+    isRepo?: boolean;
+    langResult?: {
+        kind: string;
+        candidates?: string[];
+        [k: string]: any;
+    } | null;
 }): Promise<{
     ok: boolean;
     refusal: Refusal | null;
@@ -130,6 +145,7 @@ export function authorCloseForJob({ answers, repoPath, lang, verdictType, questi
     stop: string | null;
     cost: any;
     interview: any;
+    confirmed: any;
 }>;
 /**
  * Fold an authored close into the OPERATOR's own half of the spec.
@@ -259,6 +275,8 @@ export const REFUSAL_CATEGORY: "close-unauthorable";
  * carry. Named as data so the refusal and the fold can never disagree about
  * which half of the spec is which. */
 export const AUTHORED_SPEC_FIELDS: readonly string[];
+export const CONFIRM_AUTHORED_FIELDS: readonly string[];
+export const PLAIN_FOLDER_DEFERRED_FIELDS: readonly string[];
 export type Red = {
     code: string;
     path: string;

package/types/cardauthor.d.ts

@@ -200,8 +200,12 @@ export function proposalTool(box: {
     execute: (args: any) => Promise<string>;
 };
 /**
- * The compile prompt. Q6's and Q7's answers travel VERBATIM — they are the whole
- * input, and paraphrasing a lay answer is how a rubric stops being the person's.
+ * The compile prompt. The Judge Examples answer travels VERBATIM — it is the
+ * whole input, and paraphrasing a lay answer is how a rubric stops being the
+ * person's. PRD item 33 M3 piece 3: this used to be two answers (Q6+Q7);
+ * `SOFTGREEN_JUDGE_EXAMPLES_KEY` is the ONE key both the interview and this
+ * compile now read, so a future renumbering of the form moves both readers
+ * together rather than drifting.
  *
  * The rulebook is rendered from `JUDGE_RULES` itself rather than restated, for
  * the reason the catalogue block is rendered from the catalogue: the prompt and
@@ -288,7 +292,7 @@ export function foldJudgedArtifacts(closeDecl: any, { card, cases, judgeModel }:
     judgeModel: string;
 }): any;
 /**
- * ONE compile call: the person's Q6 and Q7 in, a proposal out.
+ * ONE compile call: the person's Judge Examples answer in, a proposal out.
  *
  * It buys ONE artifact through ONE channel, and the malformed-emission ladder is
  * the SHARED one (`askStructured`) rather than a second copy — a second ladder is

package/types/detectlang.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Detect a code job's language from its repository, $0, no provider.
+ *
+ * @param {string} sourcePath the Source path (a folder, or a file inside one)
+ * @returns {{kind: 'resolved', lang: string, dir: string, manifest: string} | {kind: 'language-unsupported', language: string, dir: string, manifest: string, refusal: LangRefusal} | {kind: 'no-code-job'} | {kind: 'ambiguous', candidates: string[], dir: string}}
+ */
+export function detectLanguage(sourcePath: string): {
+    kind: "resolved";
+    lang: string;
+    dir: string;
+    manifest: string;
+} | {
+    kind: "language-unsupported";
+    language: string;
+    dir: string;
+    manifest: string;
+    refusal: LangRefusal;
+} | {
+    kind: "no-code-job";
+} | {
+    kind: "ambiguous";
+    candidates: string[];
+    dir: string;
+};
+export type Red = {
+    code: string;
+    path: string;
+    detail: string;
+    [k: string]: any;
+};
+export type LangRefusal = {
+    kind: "request-red";
+    verb: string | null;
+    path: string;
+    detail: string;
+    options: string[];
+    red: Red;
+};

package/types/index.d.ts

@@ -1,5 +1,7 @@
 export { makeSpine } from "./spine.js";
 export { runPlan } from "./planrun.js";
+export { workBranchName } from "./workbranch.js";
+export { answerReviewDoor } from "./reviewdoor.js";
 export { main as cliMain } from "./cli.js";
 export { ralph, runClose, runStages, CLOSE_FAULTS } from "./ralph.js";
 export { globToPrefix, scanSecrets } from "./validate.js";
@@ -7,26 +9,24 @@ export { validateJob, jobSpecHash, checkApproval, checkMenu, resolveWorkerModel,
 export { validatePlan, stageClose, EXIT_TYPES, MAX_EXITS_PER_STEP, MAX_PLAN_STEPS, WRITE_VERBS, closeStagesOf } from "./plan.js";
 export { snapshotScope, evalExits } from "./exits.js";
 export { runJob, ACCOUNTED_ROUND_TYPES } from "./run.js";
-export { BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate, mintBridge, appendGreen, appendRed, loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists, QUARANTINED_VERDICTS, QUARANTINED_CODE, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor } from "./bridges.js";
+export { BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate, mintBridge, appendGreen, appendRed, loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists, QUARANTINED_VERDICTS, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor } from "./bridges.js";
 export { renderListing, selectionPrompt } from "./selection.js";
-export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow, shapeForkName } from "./reuse.js";
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow } from "./reuse.js";
 export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASSES, VOUCHED_RATE_SOURCES, rateProvenance, spendProvenance } from "./ledger.js";
-export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE } from "./workbranch.js";
-export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY, READ_SHIM_ARMS } from "./readshim.js";
-export { runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND, normalizeHumanRuling, resolveHumanRuling, JUDGE_ATTEMPTS, MAX_JUDGED_PATHS, REVIEW_DOOR, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages } from "./kinds.js";
-export { answerReviewDoor, doorRecordOf, doorAgeGate } from "./reviewdoor.js";
-export { JUDGE_MODEL, resolveJudge, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL, validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop, CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf } from "./judged.js";
-export { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts, proposalSchema, proposalTool, cardCasesPrompt, PROPOSAL_TOOL_NAME, PROPOSAL_LABEL, MAX_PROPOSAL_RETRIES, COMPILE_SYSTEM } from "./cardauthor.js";
-export { runCalibration, compareExpectation, factsResist, artifactHash, INJECTION_LOCATE_BATTERY, INJECTION_CARD, CALIBRATION_LABEL, CASUALTY_AXES } from "./calibrate.js";
-export { validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS, LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames, genreInstruments, DIRECTIONS, BASELINES, MAX_STAGES, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, classMenu, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";
-export { runAuthorScout, buildSeedListing, seedFileList, classifySurvey, AUTHOR_SCOUT_VERBS, SCOUT_ATTEMPTS, SURVEY_CAUSES, SCOUT_RETRY_CAUSES } from "./authorscout.js";
-export { scrubRaw, RAW_PERSIST_MAX, RAW_TRIM_MARKER } from "./text.js";
-export { authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS, QUESTION_SETS, GREEN_QUESTIONS, SOFTGREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor } from "./authorflow.js";
-export { validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade, DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS, HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS } from "./declaredclose.js";
+export { readShimArm, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY } from "./readshim.js";
+export { runDeclaredClose, runStage, seedRead, seedAtHead, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling, resolveHumanRuling, JUDGE_ATTEMPTS, MAX_JUDGED_PATHS, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages } from "./kinds.js";
+export { JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS, runLocate, decide, CALIBRATION_SIZE, validateCalibrationSet, expectedOf } from "./judged.js";
+export { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts } from "./cardauthor.js";
+export { runCalibration, INJECTION_LOCATE_BATTERY, CASUALTY_AXES } from "./calibrate.js";
+export { validateDeclaration, KIND_CATALOGUE, LOCKED_KINDS, genreEnv, genreInstruments, LOCKED_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";
+export { runAuthorScout, buildSeedListing, AUTHOR_SCOUT_VERBS, SCOUT_ATTEMPTS, SCOUT_RETRY_CAUSES } from "./authorscout.js";
+export { scrubRaw, RAW_PERSIST_MAX } from "./text.js";
+export { authorClose, MAX_REVISIONS, questionsFor, requiredAnswersFor } from "./authorflow.js";
+export { validateCloseDecl, runDeclaredStages, declaredStages, HUMAN_PAUSE } from "./declaredclose.js";
 export { runBehaviour, formatBehaviour } from "./behaviour.js";
 export { replayRun, formatReplay } from "./replay.js";
-export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind, GENRE, REFUSAL_LIB, REFUSAL_CATEGORY, AUTHORED_SPEC_FIELDS } from "./authorjob.js";
+export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind, AUTHORED_SPEC_FIELDS } from "./authorjob.js";
 export { PROMPT_REGISTERS, isPromptFile } from "./promptregisters.js";
 export { exportBundle, bundleHash, readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps } from "./bundle.js";
 export { readCloseScripts, checkCloseAbsolutePaths, absolutePathLiteralsOf, hashCloseScriptBytes, checkCloseByteSignature, checkStageByteSignature, signCloseScripts } from "./close-integrity.js";
-export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest, datedDestination, pickDelivery } from "./source.js";
+export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest, datedDestination, pickDelivery, missingDependencies } from "./source.js";

package/types/job.d.ts

@@ -4,6 +4,27 @@
  * against the worker-surface package, a locked VERDICT type is demand against
  * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
  * filed as an upstream bug (the BA-2 misattribution class). */
+/**
+ * The `baseUrl` SHAPE rule, standalone (PRD item 28 ruling (d); PRD item 33
+ * close-out, "authoring provider selectable" — a bad `--base-url` used to
+ * refuse only at the end of the interview, through `validateJob`, after every
+ * question had already been asked). ONE spelling of the rule: `validateJob`
+ * below calls this, and so does `scripts/run-interview.mjs`, at flag-parse
+ * time, before it asks anything.
+ *
+ * No network access, so this checks SHAPE only: `https://` for a real
+ * endpoint, or `http://` restricted to a loopback host (a local
+ * OpenAI-compatible server, the only legitimate reason to skip TLS) — and
+ * never a credential embedded IN the URL itself. A URL travels into logs and
+ * spine records far more casually than a header ever would, and secrets never
+ * enter the tree/spine (hard line #3) — a baseUrl carrying `user:pass@host`
+ * is exactly that leak, just spelled differently. The returned message never
+ * echoes the value it judged — it is printed as-is by both callers, and a
+ * value that failed for carrying credentials must not repeat them back.
+ * @param {unknown} value
+ * @returns {string|null} a red `detail`, or `null` when the value is admitted
+ */
+export function validateBaseUrl(value: unknown): string | null;
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
  * JSON text or plain parsed data — the ingest contract; a live object with a
@@ -209,8 +230,9 @@ export const CADENCE_UNITS: readonly string[];
  * rows on the cost axis, and budgets sized for one do not transfer. */
 /** PRD item 28 (2026-09-06/09-09): `openai-api` — an OpenAI-shaped provider,
  * constructed via `src/providers.js`'s factory. hamr's ruling (PRD 30.7):
- * `deepseek-chat` is THE secondary provider (one, not a menu of half-tested
- * models); the factory's tier table is where that lives, not this menu.
+ * `deepseek-flash` is THE secondary provider (one, not a menu of half-tested
+ * models; F171, item 34 L16: swapped from the retired `deepseek-chat`); the
+ * factory's tier table is where that lives, not this menu.
  *
  * PRD item 31.3 (hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for
  * now"*): `gemini-api` joins. That is bareloop matching bare-agent's own

package/types/planrun.d.ts

@@ -73,7 +73,6 @@
  * No gap → the empty string, so the brief renders byte-identically to the pre-F86
  * one. A labelled empty section would be an invitation to explain an absence the
  * run never observed (a stall never judged its exits at all).
- *
  * @param {string | null | undefined} gap the step's last exit gap text
  * @returns {string} the labelled block, or '' when there is nothing to show
  */
@@ -473,6 +472,47 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
     } | null | undefined;
     resumable?: boolean | undefined;
 }): Promise<string>;
+/**
+ * The runtime belt for F178 (`.git`) and F177's follow-up (`node_modules`) —
+ * hamr's option B ruling (2026-09-14): block WRITING to either, never reading.
+ * bareguard's `fs.deny` cannot be used for this: it blocks ALL fs actions,
+ * reads included (node_modules/bareguard/src/primitives/fs.js:43 "paths/
+ * prefixes denied for all fs actions", checked at :62-66 before the read/write
+ * split) — putting `.git` there (the first version of this fix) silently also
+ * blocked READING it, which was never ruled, and the worker's persona never
+ * names `.git`/`node_modules` as a denied book the way it does the gate audit
+ * / `.smoke` / `.litectx` (`tests/tools.test.js`'s persona/fence-drift guard
+ * caught exactly this in the full gate). `fs.deny` is exact prefix-containment
+ * only anyway — no glob, no path-segment match — confirmed by reading
+ * `within()` (node_modules/bareguard/src/primitives/fs.js:26-31): `p === b ||
+ * p.startsWith(b + '/')` against each configured entry, nothing else; it
+ * could not express `node_modules`-at-any-depth even if reads were not a
+ * problem (`node_modules/bareguard/src/glob.js`'s `matchAny`/`globToRegex`
+ * exist in the same package but `fs.js` never imports them).
+ *
+ * `tools.denyArgPatterns` (`node_modules/bareguard/src/primitives/tools.js`,
+ * step 3 of `Gate#_stepEval` — the SAME step `fsCheck` runs at, checked right
+ * after it in the `??` chain, `node_modules/bareguard/src/gate.js`) is the
+ * supported hook used instead: a RegExp tested against
+ * `JSON.stringify(action)`, keyed by `action.type` so it is scoped to
+ * `write`/`edit` ONLY — a `read` action never reaches this pattern at all.
+ * Because `fsCheck` runs first in the same `??` chain, this pattern is
+ * reached only when the path already passed `writeScope`/`deny` — exactly the
+ * residual case (an in-fence write/edit whose path still carries a `.git` or
+ * `node_modules` segment; `.git` itself is never IN a signed fence in the
+ * first place, `scopeContained` in src/validate.js refuses that at
+ * declaration time — this is the belt for a validator regression). Matched
+ * whole-segment (a look-alike like `.github`/`.gitignore`/`my.git`/
+ * `node_modules_util` stays admitted). Safe to match the WHOLE serialized
+ * action (not just the `path` field in isolation) because bareloop's own
+ * action shape (`toolAction`, src/tools.js) never carries a write's byte
+ * CONTENT in the action object — `args.bytes` is a length, not the text — so
+ * there is no written-file-content collision risk the way there would be for
+ * bareguard's own `content.denyPatterns` primitive (which explicitly strips
+ * payload fields for exactly that reason).
+ * @type {RegExp}
+ */
+export const FORBIDDEN_WRITE_SEGMENT_PATTERN: RegExp;
 /**
  * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
  * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a

package/types/providers.d.ts

@@ -8,6 +8,34 @@
  * @returns {ProviderTableEntry}
  */
 export function resolveProvider(providerName: string): ProviderTableEntry;
+/**
+ * Report whether a resolved API key VALUE (not its presence — every call
+ * site already presence-checks separately) carries a shape an HTTP header
+ * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
+ * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
+ * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the
+ * FIRST paid call — after the run had already announced itself as spending,
+ * inside the paid span. curl tolerated the same value (HTTP 200 twice), so a
+ * curl probe is a blind instrument for this defect class.
+ *
+ * NEVER TRIMS OR REPAIRS — this reports a reason, it does not fix the value
+ * (hamr's retry-never-repair rule, in spirit: refuse loud, don't guess at
+ * what the operator's secret store meant). Every call site that gets a
+ * non-null reason back refuses at $0, in the SAME place and the SAME way it
+ * already refuses a missing key — this function only adds a second shape of
+ * refusal to a door that already had one.
+ *
+ * The checked shape is deliberately wider than what Node's own header
+ * encoder rejects (Node tolerates a bare tab in a header value): CR, LF, TAB,
+ * every other C0/DEL control character, and leading/trailing whitespace all
+ * refuse, because every one of them is evidence the resolved value is not a
+ * clean single-line secret — the same class of "reads as one plausible thing,
+ * is actually stale/wrong/multi-line" this finding named.
+ * @param {string} value the resolved key value — never logged, never echoed by any caller
+ * @returns {string|null} a plain-English reason class, or `null` when the value is clean
+ */
+export function apiKeyProblem(value: string): string | null;
 /**
  * Construct ONE provider instance for `providerName`/`model`, applying
  * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)
@@ -108,10 +136,17 @@ export const ANTHROPIC_TIER_MODELS: Readonly<{
  * of a single-model provider, not a second model masquerading as `haiku`.
  * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
  * cheaper tier model, this is where it would earn its own `haiku` id.
+ *
+ * MODEL SWAP (F171, item 34 L16, hamr 2026-09-13): `deepseek-chat` is no
+ * longer served — a live `/models` call returned only `deepseek-flash` and
+ * `deepseek-v4-pro`. Switched to `deepseek-flash` (DeepSeek V4.1). F149's
+ * `legacyMaxTokens` measurement (asked 64 output tokens, got 665/608) was
+ * taken on `deepseek-chat` and is UNVERIFIED on `deepseek-flash` — kept on
+ * below as the fail-safe (over-capping direction is safe; see F171).
  */
 export const OPENAI_TIER_MODELS: Readonly<{
-    sonnet: "deepseek-chat";
-    haiku: "deepseek-chat";
+    sonnet: "deepseek-flash";
+    haiku: "deepseek-flash";
 }>;
 /**
  * Gemini (PRD item 31.3, hamr 2026-09-09: "anthropic, openai, gemini drop

package/types/source.d.ts

@@ -1,3 +1,45 @@
+/**
+ * Walk from `startDir` upward — inclusive — to the NEAREST ancestor whose own
+ * directory carries a `.git` entry, whether that entry is a real repo
+ * directory or a linked-worktree/submodule FILE (the caller decides what a
+ * file means for it). `null` when no ancestor up to the filesystem root has
+ * one. ONE helper for "find the repo boundary walking up", shared by
+ * {@link looksLikeRepoSource} and `prepareSource`'s own authoritative routing
+ * below (PRD item 33 M3 ruling 2 addendum, 2026-09-13: a Source that is a
+ * SUBFOLDER inside a git repo is a repo job, not a plain-folder one — the
+ * boundary is the nearest ancestor's `.git`, never only a `.git` sitting
+ * directly inside Source itself) and reused by `src/detectlang.js`'s own
+ * upward walk (`walkChain`), which only needs the boundary directory, not
+ * which kind of `.git` it is — never three copies of this rule.
+ * @param {string} startDir an absolute directory to start the walk FROM
+ * @returns {{dir: string, isFile: boolean}|null}
+ */
+export function nearestGitAncestor(startDir: string): {
+    dir: string;
+    isFile: boolean;
+} | null;
+/**
+ * A CHEAP peek (a stat, never a read) at whether `source` is going to turn
+ * out to be a REPO source — the ONE rule for that question, shared by
+ * `prepareSource` (which routes the destination check below before the real
+ * walk further down decides authoritatively) and `scripts/run-interview.mjs`
+ * (PRD item 33 M3 ruling 2), which has to know BEFORE Source is even frozen
+ * whether Destination fills the write fence or a delivery directory. Never a
+ * second, hand-typed copy of this test: a URL is never a repo; a local path
+ * is a repo source only when it is a DIRECTORY, and the NEAREST ancestor
+ * (Source itself, or an ancestor above it — ruling 2's 2026-09-13 addendum)
+ * carries a `.git` DIRECTORY. A nearest `.git` that is a FILE (a linked
+ * worktree or a submodule) is NOT repo-like here — the real walk below
+ * refuses `source-is-linked-worktree` for that case, and this peek must
+ * agree closely enough to route the destination question correctly rather
+ * than offer the write-fence wording for a source that is about to be
+ * refused. An unreadable path is reported properly by the real walk; this
+ * peek only has to agree with that walk closely enough to route correctly,
+ * never to replace it.
+ * @param {string} source
+ * @returns {boolean}
+ */
+export function looksLikeRepoSource(source: string): boolean;
 /**
  * Build the frozen source tree — `<into>/tree/input/…` (the copy), `<into>/tree/output/`
  * (empty, where the run writes), `<into>/source.json` (the manifest, OUTSIDE
@@ -46,6 +88,51 @@ export function prepareSource({ source, into, destination, fetchTimeoutMs }: {
     manifestPath: string;
     manifest: object;
 } | SourceRefusal>;
+/**
+ * THE INSTALL-GAP DETECTOR (PRD item 33 close-out, `docs/product/PRD.md:450-452`,
+ * hamr's ruling 2026-09-14, option A): `prepareSource` copies ONLY git-tracked
+ * files (hamr's ruling, `docs/product/ITEM33-BUILD.md:225-239` — unchanged by
+ * this function), so a JS/TS repo's prepared copy never carries `node_modules`,
+ * and every close stage needing a tool (`tsc`, a test runner) instrument-stops
+ * with nothing telling the person why. bareloop NEVER runs an install itself —
+ * it only ever touches gated primitives, and a shell-out to `npm`/etc from
+ * inside this module would be exactly the verb hamr's law reserves for the
+ * worker's own granted tools, never the arbiter-side machinery that decides
+ * whether a run even starts. This is a pure, $0 DETECTOR: it names the gap and
+ * the exact command a person runs THEMSELVES in the copy, then returns.
+ *
+ * JS/TS ONLY for now — a repo in another detected language returns `null`
+ * here unconditionally (no `package.json` to find), which is the correct
+ * "nothing to report" reading, not a gap in this function; per-language
+ * dependency-gap data for other languages is M3b's job
+ * (`docs/product/ITEM33-BUILD.md`, "M3b"), not this one's.
+ *
+ * SUBFOLDER-AS-REPO (ruling 2 addendum, commit 2a020d8): a subfolder job
+ * freezes the WHOLE repo, so `package.json` may sit at the repo root, at the
+ * subfolder itself, or anywhere between — the SAME nearest-manifest-walking-up
+ * rule `detectLanguage` (`src/detectlang.js`) applies, done independently here
+ * (not by importing `detectLanguage`) to avoid a `source.js` ⇄ `detectlang.js`
+ * import cycle, since `detectlang.js` already imports `nearestGitAncestor`
+ * from this module.
+ *
+ * @param {string} treeDir the prepared tree's root (`prepareSource`'s
+ *   returned `tree`, e.g. `<into>/tree` — a REPO source sits directly at this
+ *   root; every other kind sits under `input/` inside it and has no repo
+ *   dependency story yet, so callers only need this for a `kind: 'repo'`
+ *   manifest)
+ * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
+ *   undefined when Source IS the repo root)
+ * @returns {{manager: string, command: string, reason: string}|null} `null`
+ *   when there is nothing to report: no JS/TS manifest found walking up from
+ *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
+ *   `node_modules` is already there, or the manifest cannot even be read as
+ *   JSON (an invalid `package.json` is "cannot tell", never a false alarm).
+ */
+export function missingDependencies(treeDir: string, sourceSubdir?: string): {
+    manager: string;
+    command: string;
+    reason: string;
+} | null;
 /**
  * The delivered name (M2b fix 4, kept under D3): a destination FILE of
  * `/home/me/profile.md` lands as `/home/me/profile-2026-09-12.md`, and a

package/types/text.d.ts

@@ -100,6 +100,41 @@ export function capStop({ ceilingUsd, knownUsd, spendComplete }: {
     knownUsd: number;
     spendComplete: boolean;
 }): "cap-halt" | "pricing-red" | null;
+/**
+ * THE ONE SPELLING of "was this throw a call casualty, or something else" —
+ * F179/F180's seam. `authorscout.js`'s `settled` narrows a rejected
+ * `loop.run()` to this one class: swallowing every throw would launder a
+ * budget `HaltError`, a programming bug, or any other named terminal into
+ * "the call failed" — the exact class of dishonesty this repo refuses (an
+ * unknown reported as a known).
+ *
+ * bare-agent 0.42.0's `OpenAIProvider.generate` used to throw a raw
+ * `SyntaxError` from an unguarded `JSON.parse(tc.function.arguments)` after
+ * a billed HTTP round (F179/BA-27) — this predicate used to admit that class
+ * too. bare-agent 0.43.0 fixed it upstream (`parseToolCalls`, shared by
+ * OpenAIProvider and Ollama): a malformed tool-call arguments string now
+ * returns a priced round with `toolCalls: []` plus its own `malformedToolCall`
+ * marker instead of throwing. Verified against 0.43.0's installed source that
+ * no provider bareloop constructs (`AnthropicProvider`, `OpenAIProvider`,
+ * `GeminiProvider` — `src/providers.js`) can still throw a JSON `SyntaxError`
+ * out of `generate()` after a billed round: Anthropic and Gemini read tool-call
+ * arguments as already-parsed objects off their own response shape (nothing to
+ * `JSON.parse`), and every provider's raw-HTTP-body parse is already
+ * try/catch-wrapped inside `_request`, converted to a plain `Error` before it
+ * can reach here. bareloop never streams a provider response. So the
+ * SyntaxError branch this predicate used to carry is dead code and was
+ * removed in the same change that bumped to bare-agent 0.43.0 — re-add it (or
+ * a narrower successor) only if a real provider is found to reintroduce the
+ * class.
+ *
+ * A `HaltError` is deliberately excluded — it is bare-agent's own governance
+ * exit (a budget/turn cap), never a transport casualty, and this predicate
+ * must never launder one into a mere "the call failed".
+ * @param {any} err
+ * @returns {string|null} a short reason when `err` is an admitted casualty class,
+ *   `null` for everything else (including `HaltError`) — the caller re-throws on `null`.
+ */
+export function callCasualty(err: any): string | null;
 /**
  * ONE raw model emission, ready to persist.
  *

package/types/validate.d.ts

@@ -13,6 +13,8 @@ export function globToPrefix(scope: string): string;
  * resolve to a PROPER subdirectory of the run directory. Absolute paths and
  * ".." segments escape it; "." / "./**" cover the whole run directory — where
  * the close suite lives. Windows spellings ("..\", "C:\") count as escapes.
+ * A `.git` or `node_modules` segment anywhere in the prefix is refused too
+ * (F178/F177, see {@link FORBIDDEN_SCOPE_SEGMENTS}).
  * Exported for the job validator: the operator's outer fence obeys the SAME
  * law through the same code — two containment transforms would be the F9
  * red-class one level up.
@@ -205,6 +207,26 @@ export function hasNestedQuantifier(src: string): boolean;
  * @param {(code: string, path: string, detail?: string) => void} red
  */
 export function sweepNestedQuantifiers(root: any, red: (code: string, path: string, detail?: string) => void): void;
+/**
+ * Path segments a fence/scope may never contain, checked WHOLE-SEGMENT
+ * (`prefix.split('/')`), never substring — a look-alike (`.github`,
+ * `.gitignore`, `my.git`, `node_modules_util`) is a DIFFERENT name and stays
+ * admitted. hamr's ruling (option B, 2026-09-14, block both): F178 — a
+ * signed fence naming `.git` could let a worker write git's own files (refs,
+ * the seed, `info/exclude`) and hide those writes from `changedSet`. F177's
+ * follow-up — a signed fence naming `node_modules` directly is the same class
+ * of gap (an installed/worker-written file inside it is invisible to
+ * `changedSet` the same way, and installs are the person's job now, F177).
+ * This catches only a fence that NAMES one of these directly; a fence like
+ * `packages/api/**` that later reaches a NESTED `node_modules` beneath it is a
+ * distinct, only partially closeable gap — see the runtime belt in
+ * planrun.js for `node_modules` (`.git` has no such gap: there is exactly one
+ * `.git` per repo, always at the workdir root, so its own runtime belt is a
+ * single `fs.deny` entry). Both are inexpressible at declaration time, the
+ * same law #1 already applies to `..`.
+ * @type {readonly string[]}
+ */
+export const FORBIDDEN_SCOPE_SEGMENTS: readonly string[];
 /**
  * PRD item 27/M2 close-bytes signature, orchestrator-flagged gap
  * (2026-09-06): a close stage's `cmd` can name an addressable script TWO