bareloop 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -5,6 +5,228 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.27.0] — 2026-09-21
+
+### Changed
+
+- **`bare-agent` bumped `^0.42.0` → `^0.43.0`.** Ships BA-27 (bareloop's own corroborating
+  upstream ask, `docs/product/UPSTREAM-ASKS.md`): `OpenAIProvider`/`OllamaProvider.generate` no
+  longer throw a raw `SyntaxError` when a model's tool-call `arguments` string is malformed JSON —
+  the shared `parseToolCalls` helper returns the round priced (real `usage`) with `toolCalls: []`
+  plus its own `malformedToolCall: {name, error}` marker instead, and `Loop.run` surfaces that
+  marker unchanged on its return. No other package changed (`package-lock.json` diff is
+  `bare-agent` only).
+
+### Removed
+
+- **`withMalformedToolCallShim`, bareloop's local F179 stopgap (`src/authorflow.js`, added
+  2026-09-15 commit `96866d5`).** Deleted now that bare-agent 0.43.0 fixes BA-27 upstream —
+  `makeLoopGenerate` calls `loop.run()` directly again, no delegate provider. `askStructured`'s
+  `r?.malformedToolCall` check (`e9e2839`) is unchanged and now reads bare-agent's own field.
+- **`callCasualty`'s SyntaxError admission (`src/text.js`)**, dead code once no provider bareloop
+  constructs (`AnthropicProvider`, `OpenAIProvider`, `GeminiProvider` — `src/providers.js`) can
+  still throw a JSON `SyntaxError` out of `generate()` after a billed round: verified against
+  0.43.0's installed source that Anthropic and Gemini read tool-call arguments as already-parsed
+  objects (nothing to `JSON.parse` in their response paths), and every provider's raw-HTTP-body
+  parse is already try/catch-wrapped inside `_request`. The idle-timeout (ETIMEDOUT/TimeoutError)
+  admission is unchanged.
+
+### Fixed
+
+- **The publish workflow now fails when `package-lock.json`'s version drifts from `package.json`.** npm writes that field on install, so a release that bumps `package.json` without running one leaves it behind — and nothing caught it: `npm ci` fails when the lockfile's *dependency* entries disagree, but never checks the lockfile's copy of the project's own version. `scripts/check-lockfile.mjs` (`npm run check:lockfile`) compares both places npm writes it and runs in the publish workflow. No lockfile is not a failure.
+
+- **F191 — a plain-folder source's confirm turn crashed live (run `mu4hc7sp`), leaving a
+  two-record spine (`author-start`, `author-phase confirm`) with no ending at all.**
+  `confirmProtections` computes protections via `classGuards` (`src/authoring.js`), which is
+  keyed by CODE LANGUAGE and throws on a plain folder's `lang: 'none-detected'` — a plain
+  folder has no language, so a confirm turn cannot honestly show real, code-derived protections
+  for one. `scripts/run-author.mjs` no longer runs a confirm turn over a plain folder at all:
+  the honest "no checks yet" stop now fires immediately after `author-start`, at $0 — no scout,
+  no confirm turn, no model call. The now-unreachable confirm-turn branch (~70 lines) is
+  deleted. Alongside it, the try/catch crash net (which used to start ~300 lines after
+  `author-start`, leaving exactly the gap this crash fell into) now opens immediately after the
+  spine exists, and its crash message reads the run's own metered-call list rather than
+  unconditionally claiming "died inside the paid span". Customer-facing text in
+  `scripts/run-interview.mjs`/`bareloop.context.md` that promised a plain-folder confirm turn
+  is corrected to match. Fail-first proven in tests (each of the three code changes shown red
+  against the prior commit, green after); a new live end-to-end test proves zero provider calls.
+  Three follow-up fixes landed in the same pass: the stop's own text claimed "Nothing was spent
+  and nothing was written," while the same branch writes `authored.json` into `--out` — both this
+  message and `scripts/run-interview.mjs`'s matching install-gap line now read "Nothing was spent.
+  Your source was not changed." (true on both counts: no provider call happens on this path, and
+  the source tree itself is never touched); an F71 regression (`process.exit(1)` right after a
+  `console.log`, which can discard already-queued stdout under a slow reader) was fixed back to
+  `process.exitCode = 1`; and a duplicate `spine <path>` print this exitCode fix's fall-through
+  briefly introduced was removed (the shared tail print already covers this exit path). Not yet
+  re-run against the original crashing patient (`docs/logs/FINDINGS.md` F191).
+- **F190 — fixed properly this pass.** The prior fix (commit 56bbee8) hand-copied
+  `scripts/run-u.mjs`'s same-provider `baseUrl` conditional a second time. Both the author and
+  judge provider constructions in `scripts/run-author.mjs` now go through `buildRunnerProviders`
+  (`src/providers.js`), the one seam `src/cli.js` already used — this file was the one call
+  site that had not adopted it. Not yet re-proven live (`docs/logs/FINDINGS.md` F190).
+- **F185 — an interview-authored repo job had no code path INTO `scripts/run-u.mjs`: a person
+  finishing the authoring interview was left holding a signed, hash-stable `resolved-spec.json`
+  with no way to run it, only a developer hand-step (`cp` the spec into `jobs/` + hand-add a
+  `JOBS` row).** hamr's ruling (2026-09-16, option A): `scripts/run-u.mjs` now accepts `--spec
+  <path to resolved-spec.json>` as an alternative to `--job <key>` (giving both, or neither, is a
+  loud $0 refusal). It `validateJob`'s the spec explicitly and early, then reads the workdir and
+  seed off the prepared copy's OWN source manifest (`readSourceManifest`, `src/source.js` — the
+  same reader `run-author.mjs` already uses) — the one `source-*/` sibling directory beside the
+  spec that carries a `source.json`; never typed, guessed, or defaulted, and a missing/ambiguous
+  manifest or a gone tree each refuse by name. `scripts/run-author.mjs`'s "SIGNING PREPARED — NOT
+  SIGNED" end screen now prints the exact ready-to-paste run command (real spec path, real
+  `--approve <hash>`, the provider's real env-key name per F187). Every existing arbiter gate —
+  the `--approve` signature, the budget/wall ceilings, coldReset, the close-first precheck —
+  applies unchanged; `--spec` only NAMES the job. Not yet proven live (`docs/logs/FINDINGS.md`
+  F185).
+- **F183 — the confirm turn's model-facing prompt never showed the model the real, code-derived
+  guards or write fence, so `notChecked` could (and twice live did, runs `mu2bjmed` and
+  `mu2qmept`) falsely claim an already-enforced protection was missing** (e.g. "no ts-ignore
+  comments" and "do not edit or delete tests", while `no-suppressions` and the write fence
+  already covered both). hamr's ruling A (2026-09-16): feed the real protections in as facts,
+  never drop the model's list. `confirmProtections`'s existing code-derived list (the same one
+  already shown to the person, `src/authorflow.js`) is now computed once, before the model
+  drafts, and threaded into `confirmPrompt`'s model-facing prompt as an "ALREADY COVERED" block;
+  `CONFIRM_SYSTEM` now orders the model to check that list before naming anything in
+  `notChecked`. The model still authors `notChecked` freely — nothing made deterministic, no
+  second hand-typed guard list. Not yet proven live (`docs/logs/FINDINGS.md` F183).
+- **Item 6 — `src/authoring.js`'s `TYPES_GENRE_TEMPLATE` (model-facing prompt text,
+  interpolated verbatim into the authoring prompt) was missing from `src/
+  promptregisters.js`'s `PROMPT_REGISTERS` inventory entirely.** Added; no other prompt content
+  found in that file. `docs/product/PRD.md`'s item 33 close-out box ticked.
+- **F182 — the interview never waited for the install, so "Run it now?" was unreachable for a
+  repo that needs packages.** `scripts/run-interview.mjs` printed the install-gap message right
+  after `prepareSource` and fell straight through to the class questions, only re-checking
+  `missingDependencies` once, at hand-off — too late for the offer to ever fire. It now pauses
+  right there and loops on the same check (`"Press Enter once it has finished to check again, or
+  type skip to carry on without it: "`), printing `"packages found — carrying on."` on a
+  resolved recheck; `skip` or end of input carries on unresolved, same as before. Also drops the
+  misleading "then rerun this command" wording, which pointed at restarting the whole interview
+  when only the install is needed. Not yet proven live.
+- **F181 — a key with an embedded newline (or other control character, or stray whitespace)
+  read as "set" by every presence-only key check and then crashed Node's own header-encode
+  (`ERR_INVALID_CHAR`) inside the paid span, rather than refusing at $0.** One exported pure
+  helper, `apiKeyProblem(value)` (`src/providers.js`, beside the provider table), reports a
+  plain-English reason (or `null`) for a value carrying CR, LF, TAB, another C0/DEL control
+  character, or leading/trailing whitespace — it never trims or repairs. Wired at every door
+  that already presence-checks a key: `scripts/run-author.mjs` (worker and judge keys),
+  `scripts/run-u.mjs` (worker and judge keys), `src/cli.js`'s `bareloop run`
+  (`ANTHROPIC_API_KEY`), and `scripts/run-interview.mjs`'s `KEYED` offer gate (a malformed key
+  no longer counts as keyed). Every refusal names the env var and the reason class, never the
+  value. Not yet proven live.
+- **F187 — `scripts/run-u.mjs`'s printed invocation hints (the "approve and run" line and the
+  sleep-inhibitor wrapper line, both built through the shared `invoke()` helper) always named
+  `ANTHROPIC_API_KEY`, regardless of the job's actual provider.** A job on `openai-api`
+  (DeepSeek) printed the wrong variable name to set. `invoke()` now reads `providerEntry.envKey`
+  — the same resolved name the real key check at launch already uses. Not yet proven live.
+- **F186 — the printed BEHAVIOUR line (and any replay) counted tool calls from EVERY run that
+  ever touched the patient tree, not just the run being read, because the authoring scout's gate
+  audit is written directly into the patient tree and the tree's `.gitignore` denies `*.jsonl`,
+  so a cold reset never removes it.** Fixed at the source, never by filtering `runBehaviour` on
+  `run_id` (a single run legitimately spans several). `scripts/run-author.mjs` now archives its
+  own gate audit out of the patient tree the moment authoring ends (`archiveGateAudit()`, called
+  from `finally` and once more before the one `process.exit()` path that skips it).
+  `scripts/run-u.mjs` now moves any stale audit aside right after `coldReset`, before its own
+  Gate ever opens (`moveStaleGateAudit`, new export from `scripts/u-patient.mjs`) — never on the
+  resume branch, where the tree's audit is that same run's own prior leg. Not yet proven live.
+- **F184 — a malformed tool-call round on the WORKER path (`src/planrun.js`'s Loop-path `ask()`)
+  ended an attempt with nothing on the spine naming it — indistinguishable from the model
+  genuinely producing no useful work.** `ask()` now reads bare-agent 0.43.0's own
+  `r.malformedToolCall` marker (present since BA-27) and emits a distinct `worker-malformed-tool-
+  call` record (`{phase, iteration, name, error}`, scrubbed and length-capped) — visibility only:
+  no retry, no change to strikes/ladder/attempt counting/verdict routing, all arbiter-adjacent and
+  out of scope. Not yet proven live.
+- **F179 — a malformed tool-call JSON on the FIRST authoring call had no earlier sound
+  declaration to fall back to, so 318e066's provider-red stopped the run outright.** hamr's
+  2026-09-15 ruling: retry, never repair. `withMalformedToolCallShim` (`src/authorflow.js`,
+  wired into `makeLoopGenerate`) is a delegate provider (`Object.create`, never a mutation of
+  the shared instance) whose `_request` strips a malformed tool call out of the raw response
+  BEFORE `generate()`'s own `JSON.parse` can throw on it, so the round comes back PRICED on
+  bare-agent's own real usage instead of crashing. `askStructured` reads the resulting round
+  through its EXISTING malformed-emission retry ladder (`MAX_STRUCTURE_RETRIES`, no new cap),
+  tagged with a new `malformed-tool-call-arguments` axis — checked BEFORE the accept path and
+  regardless of how many calls survived the strip, so a reply carrying a malformed call
+  alongside a valid one is never accepted either (follow-up fix, same day, review-caught).
+  Scoped to `makeLoopGenerate` only — the authoring declaration calls and the confirm turn; the
+  scout and the worker path build their own provider wiring and still only get 318e066's stop
+  (an open gap). Not yet proven live.
+- **F179/F180 — bare-agent 0.42.0's OpenAIProvider could throw a raw SyntaxError mid-call (a
+  malformed tool-call `arguments` string, `JSON.parse` with no try/catch), crashing past
+  `askStructured` and discarding an already-sound, already-measured declaration while the
+  billed call went unbooked.** `askStructured` (`src/authorflow.js`) now wraps its `generate`
+  call in try/catch, tested against a new shared predicate, `callCasualty` (`src/text.js`,
+  beside `priceOf`): a `HaltError` still re-raises (a governance exit, never laundered); an
+  ETIMEDOUT/TimeoutError-shaped throw or a JSON-mentioning SyntaxError lands as the same typed
+  `providerError` the resolved-`{error}` path already produced, booked at `costUsd: null`
+  (honest-unknown, never a complete-looking floor); anything else still crashes.
+  `authorscout.js`'s `settled` seam, which already hand-caught its own narrower idle-timeout
+  class, now delegates to the same predicate. No JSON repair, no new retry. Not yet proven live
+  (run `mu2bjmed` is the live crash this fixes; the corroborating upstream ask is BA-27 in
+  `docs/product/UPSTREAM-ASKS.md`).
+- **F178/F177 — a signed fence could name `.git` or `node_modules` directly (or reach a nested
+  `node_modules` through an otherwise-legal fence), letting writes there go invisibly to
+  `changedSet`.** `scopeContained` (`src/validate.js`, the one containment law `validateJob`
+  and `validatePlan` both go through) now refuses any fence/scope whose normalized prefix has a
+  whole path segment equal to `.git` or `node_modules` (hamr's ruling, 2026-09-14, option B) —
+  a look-alike like `.github`/`my.git`/`node_modules_util` stays admitted. The runtime belt for
+  a NESTED `node_modules` a legal fence can still reach uses `tools.denyArgPatterns`
+  (`FORBIDDEN_WRITE_SEGMENT_PATTERN`, `src/planrun.js`), scoped to `write`/`edit` only —
+  bareguard's `fs.deny` was tried first for `.git` and reverted: it blocks ALL fs actions,
+  reads included, which silently over-blocked (caught by the full gate's own drift test,
+  `tests/tools.test.js`); `fs.deny` is never used for either book now. Not yet proven live.
+- **F177 — a repo source whose tracked `.gitignore` did not mention `node_modules` let
+  installed packages read as the worker's own writes.** `changedSet` (`src/kinds.js`) unions
+  the tracked diff with `git ls-files --others --exclude-standard`, so an unignored
+  `node_modules` installed into the copy (live-verified: 247 files on a real copy of pulselog)
+  read as changes the worker made. `prepareSource` now hides `node_modules` in the copy's own
+  PRIVATE `.git/info/exclude` (hamr's ruling, 2026-09-14, option A) — the source repo's tracked
+  files, `.gitignore` included, are never touched. Not yet proven live.
+- **PRD item 33 close-out — `prepareSource` freezes tracked files only, so a JS/TS repo's
+  prepared copy never carried `node_modules`, and every close stage needing a tool (`tsc`, a
+  test runner) instrument-stopped with nothing telling the person why.** bareloop never runs an
+  install itself (hamr's ruling, 2026-09-14, option A): `missingDependencies` (`src/source.js`,
+  exported) is a pure, $0, JS/TS-only detector that names the exact install command.
+  `scripts/run-interview.mjs` prints it right after `prepareSource` succeeds and again at the
+  hand-off, where a still-open gap suppresses the "Run it now?" offer entirely.
+  `scripts/run-author.mjs` refuses `source-deps-missing` at $0, before the scout and before the
+  provider/key are even read. Not yet proven live end to end (the detector and the refusal
+  paths are each proven directly; a real `npm ci` against a real prepared copy of a real repo
+  confirmed the hidden git's seed stays clean when the source's `.gitignore` ignores
+  `node_modules` — see the build report for the gap this does NOT cover, a repo whose
+  `.gitignore` does not ignore `node_modules`).
+- **PRD item 33 close-out (L17) — the authoring interview never admitted an endpoint, so a
+  DeepSeek draft (`--provider openai-api`) authored against api.openai.com instead.**
+  `scripts/run-interview.mjs` now takes an optional `--base-url <url>` flag (no default; absent
+  leaves the draft's `baseUrl` field out entirely, never `null`/`''`) and validates it through
+  the existing `validateJob` `baseUrl` rule at $0 before writing anything. The interview's
+  header, the hand-off command, and `scripts/run-author.mjs`'s own start banner/`author-start`
+  event now name the endpoint when one is set; the key hint still points at the provider's own
+  env var (`OPENAI_API_KEY` for a DeepSeek endpoint) since there is no separate
+  endpoint-specific key. Not yet proven live.
+- **F176 — the revise ladder kept a later revision even when it measured worse than an earlier
+  one.** `authorClose` (`src/authorflow.js`) now tracks every MEASURED (validated + seed-read)
+  iteration and falls back to the NEWEST SOUND one — a real red/green verdict, never an
+  instrument-stop — when the last measured iteration is unsound and an earlier one is not.
+  `stop` is never changed; the swap is reported via a new `fellBack` return field, an
+  `onPhase('author-fallback', …)` event, and the terminal signing readout. Not yet proven live.
+- **F175 — the confirm turn's own honestly-raised `questions` never reached
+  `accepted.openQuestions`.** `runConfirmTurn` now carries the model's own `questions` from the
+  plan being accepted into `accepted.openQuestions` on every accepting path (confirm, type-goal,
+  the round-2 "fix" terminal), and fixes a related ledger bug where round 1's "fix" text (the
+  answer to round 2's redraft) was carried forward even after round 2 was accepted outright. Not
+  yet proven live.
+- **F175's open half — "Confirm" and "Type the goal yourself" could still accept a plan whose own
+  raised question was never answered, silently confirming a genuinely-missing answer away** (run
+  `mu0voeo4`; only the silent-drop half above was covered by the first F175 fix). hamr's
+  2026-09-16 ruling (option a): `runConfirmTurn`'s `confirm`/`type-goal` paths now force each
+  raised question through a new `kind: 'answer'` step before returning — no extra model call, a
+  blank answer re-asks the same question, `null` abandons like every other `ask`. Answers land in
+  a new `accepted.answeredQuestions` (Q:/A: pairs), kept separate from `openQuestions` (which
+  keeps its "could not resolve" meaning and is honestly empty on these two paths now).
+  `confirmedBlock` renders the answers as binding, and the SIGNING PREPARED readout
+  (`scripts/author-readout.mjs`'s new `answeredQuestionLines`) prints them when non-empty. The
+  `fix` path is unchanged. Not yet proven live.
+
 ## [0.26.0] — 2026-09-14
 
 ### Added

package/bareloop.context.md

@@ -538,6 +538,7 @@ contract); returns the parsed spec on ok, `null` on any red. A spec carrying the
 generic unknown-field. Menus exported: `CLOSE_TYPES`, `CLASS_BY_CLOSE`, `GOLD_COMPARE`,
 `CADENCE_UNITS`, `PROVIDERS`, `CONDITION_KEYS`, `TOOL_MENU`, `LOCKED_TOOLS`, `STORE_VERBS`,
 `VERDICT_TYPES`, `LOCKED_VERDICTS` — plus `checkMenu` itself.
+
 `globToPrefix(scope)` and `scanSecrets(text)` are exported too — the write-scope prefix
 mapping and the one secret-shape sweep `validateJob` itself is built from (`src/validate.js`).
 
@@ -615,7 +616,7 @@ a step, or test it without a provider.
 | interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. The interview ADMITS only what is on the menu (`MENU_CLASSES`): nothing is locked today (`LOCKED_CLASSES` is empty), and any pick off the menu returns a refusal rather than `ok:true` — ask `MENU_CLASSES` which classes can be authored, never this sentence. The interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost several slots since it was frozen (D13's genre confirm; the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input; and, at PRD item 33 M3 piece 3, the old "which files change/read" question, replaced by Source and Destination — MECHANICAL fields, proven against the machine, never a numbered answer), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is THREE questions (Goal, Success, Guardrails); the `soft-green` set is those three plus one more — Judge Examples (one example to pass, one to fail, and why) — the judged floor's one required input, compiled into the signed rubric card and the frozen calibration set. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
 | survey | `runAuthorScout({ workdir, provider, attempts?, ceilingUsd? })` → `{ state, facts, reason, meta, raw, raws, calls, budgetStop }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind. **`ceilingUsd` is the operator's money ceiling** (PRD v1.62) — checked BETWEEN attempts and before F59's reserved round, so no paid call escapes it; `null`/absent is UNBOUNDED, and a non-null non-finite value THROWS (the shared `capStop` seam — see `authorClose` below). When it ends the ladder, `budgetStop` names which stop (`cap-halt` \| `pricing-red`) and a survey that was never asked for carries the typed cause `not-funded` — deliberately OUTSIDE `SCOUT_RETRY_CAUSES`, because a retry is precisely what the cap forbade |
 | listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
-| authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does |
+| authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does. **F176 (fixed):** "kept the last accepted revision" is not the same claim as "kept the best revision" — a later revise round can VALIDATE fine yet MEASURE worse (every stage instrument-stops rather than reading a real red/green verdict). `declaration`/`seedRead`/`finalFrom`/the returned `genreEnv.dropped` are therefore the NEWEST SOUND measured iteration, not simply the last one, when the last one instrument-stopped and an earlier one did not; `stop` itself never changes. The swap is never silent: the return also carries **`fellBack`** — `null` on every run where it never fired, else `{from, to, brokenStages}` naming which iteration was dropped, which now stands, and which of the dropped one's stages instrument-stopped — reported through `onPhase('author-fallback', …)` as it happens and printed at the terminal readout (`fellBackLines`, `scripts/author-readout.mjs`). **F179/F180 (history):** bare-agent 0.42.0's OpenAIProvider used to THROW mid-call on malformed tool-call JSON (a raw SyntaxError, after the billed round), crashing past this function; a 2026-09-15 stopgap caught it as a `provider-red`/`ask.providerError` casualty (booked `costUsd: null`) so a sound prior declaration was kept via the fallback above rather than discarded. **F179 (bare-agent 0.43.0, BA-27 — the real mechanism):** the throw is fixed upstream. `OpenAIProvider`/`OllamaProvider.generate` now return a malformed round PRICED (real `usage`, never `costUsd: null`) with `toolCalls: []` plus their own `malformedToolCall: {name, error}` marker, which `Loop.run` surfaces unchanged on its return. For the authoring declaration and confirm-turn calls, `askStructured` reads that marker and RETRIES through the existing malformed-emission retry ladder (`MAX_STRUCTURE_RETRIES`) instead of stopping the run — nothing is ever repaired, and a malformed FIRST call no longer needs an earlier sound declaration to fall back to. The generic provider-casualty fallback above (idle-timeout, etc.) still applies for every other admitted class. **F184 (fixed, worker path):** the scout and the worker path never joined that retry ladder (still true — retrying is arbiter-adjacent, out of scope), but the worker path's `ask()` (`src/planrun.js`) now at least READS the marker where it already sees it and emits a distinct spine record, `worker-malformed-tool-call` (`{phase, iteration, name, error}`), before returning `r` unexamined exactly as before — no retry, no change to strikes/ladder/attempt counting or verdict routing, purely the same visibility bar this section's authoring-path fix already set |
 | everything above, composed | `authorCloseForJob({ verdictType, answers, repoPath, lang, generate, ceilingUsd?, ... })` → `{ ok, closeDecl, verdictType, refusal, cost, ... }` | refuses at the cheapest gate that can refuse: an interview refusal costs **zero**. THE GENRE REFUSAL LIVES HERE (not in the interview): a language the catalogue owns no data for, and a LOCKED KIND the model reached for, both come back as counted `request-red` demand. **`ceilingUsd` is ONE number handed to BOTH paid seams** (the survey's and the declaration loop's) — the advertised ceiling and the enforced ceiling are the same ceiling. It travels as an EXPLICIT `null` when unset, because unbounded is a stated choice and an absent field read as falsy is that state reached by accident — and anything that is neither a finite number nor `null` throws at the seam rather than becoming that state by typo |
 | assembly | `assembleSpec(specDraft, { closeDecl, verdictType })` | folds the authored half into the OPERATOR's half. Budgets, the fence, cadence, escalation and the provider are never authored by anything here. The GOAL is passed through, not generated. **A draft that ALREADY carries the authored half is REFUSED — it THROWS, never merges and never overwrites.** `AUTHORED_SPEC_FIELDS` (`close`, `closeDecl`, `verdictType`) names the fields this fold WRITES, as data, so the refusal and the fold cannot disagree about which half of the spec is which; the rule is `job.js`'s one step earlier (two closes are two arbiters, and picking one silently is how a signed artefact stops meaning what the signer read). `scripts/run-author.mjs` asks the same question at **$0 BEFORE the scout**, so the answer never arrives after the model has been paid |
 | the three gates | `prepareSigning({ spec, workdir, seedRef? })` → `{ ok, specHash, gates, work, guards, refusal }` | D9, and it NEVER signs |
@@ -875,7 +876,7 @@ is exactly what F87 forbids.
 `scripts/run-interview.mjs` existed the only way in was to hand-write an `answers.json` and a
 spec draft — precisely the SWE tax this product refuses. That script is the half that ASKS
 (`--verdict <class> --provider <anthropic-api|openai-api|gemini-api|clipipe-subscription>
---out <outdir> [--budget <usd>]`), and it is deliberately GLUE: **it
+--out <outdir> [--budget <usd>] [--base-url <url>]`), and it is deliberately GLUE: **it
 calls no provider at all**, so a whole interview costs $0 and no model ever sees it. `--provider`
 is REQUIRED with NO default — bareloop is LLM-agnostic, and defaulting it would silently re-lock
 every interview onto one vendor; missing or empty dies loud, at the door, naming the same menu
@@ -883,6 +884,17 @@ every interview onto one vendor; missing or empty dies loud, at the door, naming
 `scripts/run-author.mjs` needs no flag of its own — it resolves whatever the interview wrote
 down.
 
+`--base-url` is OPTIONAL with NO default (PRD item 33 close-out — L17 named the provider but
+never admitted the endpoint): a provider name's table entry (`src/providers.js`) can be reached
+through an OpenAI-compatible gateway other than its own default host — DeepSeek, today's one
+secondary, is reached as `--provider openai-api --base-url https://api.deepseek.com/v1`. Absent,
+the draft carries NO `baseUrl` field at all (never `null`, never `''`) and every provider
+constructor defaults its own endpoint. When given, it lands in the draft's `baseUrl` field
+beside `provider` and passes through the SAME `validateJob` pass every other field takes below,
+at $0: `http://` to a public host, an embedded `user:pass@`, or an unparseable string reds there,
+before anything is written. The key still follows the PROVIDER, not the endpoint — a DeepSeek
+draft's key still loads from `OPENAI_API_KEY`, and the hand-off says so.
+
 **Source and Destination are the interview's own FIRST TWO QUESTIONS, and they REPLACE
 `--patient`** (PRD item 33 M3, ruling 2, `docs/product/ITEM33-BUILD.md`). Source — "a local
 folder, subfolder or file, or one URL the machine can reach" — is asked first and checked
@@ -910,8 +922,10 @@ piece 4 step S6 (D5 = A), the FORM CONTINUES — the class's own questions, job
 wall are all still asked, and the draft is still written, with no `writeScope` field
 (`PLAIN_FOLDER_DEFERRED_FIELDS`, `src/authorjob.js` — Destination there is an output directory,
 never a fence). The honest named stop (bareloop's check catalogue is code-genre only today,
-ruling 7 → M4) no longer lands HERE — it moves to `run-author.mjs`, AFTER a confirm turn over
-the $0 seed listing (no scout — D5's register is code-only). Everything load-bearing in it is
+ruling 7 → M4) no longer lands HERE — it moves to `run-author.mjs`, which now gives it
+IMMEDIATELY, at $0 (D5 amended 2026-09-21, F191: no scout and no confirm turn either — a plain
+folder has no code language, so the confirm turn's own code-derived protections cannot be
+computed for one; see the run-author.mjs section below). Everything load-bearing in it is
 borrowed rather than respelled —
 the QUESTIONS are the library's frozen sets (`questionsFor` / `requiredAnswersFor`), printed as
 handed over and never re-worded, re-ordered or re-numbered by the script; the REFUSALS are
@@ -946,7 +960,9 @@ spends it.
 DIFFERENT PROCESS under its own ceiling; the interview prints its exact command line (with
 `--budget` propagated only when one was given, and a note when the CHOSEN provider's own key —
 `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, resolved through the same provider table
-`run-author.mjs` and `run-u.mjs` share — is unset in this shell)
+`run-author.mjs` and `run-u.mjs` share — is unset in this shell, OR set but MALFORMED: F181 — a
+value carrying a line break/control character/stray whitespace (a two-line secret-store entry,
+e.g.) reads a distinct reason via `apiKeyProblem` (`src/providers.js`), never the value)
 before asking `Run it now? [y/N]`, so declining still leaves a command to paste and two files
 already on disk. Only an explicit yes spends — the answer that costs nothing is the one you get
 by saying nothing, the same lean the pause's doors take. On a yes it releases stdin before
@@ -976,7 +992,10 @@ into a success one process up.
 - `run-author.mjs` — **1** a refusal or a failed gate (this now includes the confirm turn's own
   `confirm-abandoned`/`confirm-restart` stops — input ended, or the person chose to start over,
   both counted through the same generic "not-authored" branch every other authoring refusal
-  uses); **2** operator/config; **3** a leak; **4** a CRASH inside the paid span. **3
+  uses, and `source-deps-missing` — the prepared copy's `package.json` lists dependencies with
+  no `node_modules`, refused at $0 before the scout and before the provider/key are even
+  checked, naming the exact install command); **2** operator/config; **3** a leak; **4** a
+  CRASH inside the paid span. **3
   deliberately OVERRIDES a 4**: a secret sitting in a written file is the harder line of the
   two, and the crash keeps both of its own louder channels — the whole error on stderr and its
   own `author-crash` spine record. **This script is now interactive** (step S4): the confirm
@@ -984,12 +1003,15 @@ into a success one process up.
   who wrote what and lets the person confirm the plan, fix it (up to 2 rounds), type the goal
   themselves, or start over — everything else (the survey, the declaration loop, D9's gates)
   stays unattended. `rl.close()` runs in a `finally` around the whole paid span. **A plain-folder
-  Source (step S6, D5 = A) runs NO scout** — its own confirm turn runs over a $0, no-git
-  directory listing of the frozen tree instead, then the SAME honest "no checks yet" stop this
-  script always gave (`request-red`/`non-code-source`), now given AFTER that confirm turn rather
-  than before the API key is even read. If the confirm turn itself does not reach a signed plan
-  (abandoned, a cap/pricing stop, a provider/artifact red, or "start over"), THAT is the stop —
-  the non-code-source one only fires once a plan was actually confirmed.
+  Source (step S6, D5 amended 2026-09-21, F191) gets NO scout AND NO confirm turn.** D5
+  originally ran the confirm turn over a $0, no-git directory listing of the frozen tree first,
+  THEN gave the honest "no checks yet" stop (`request-red`/`non-code-source`) once a plan was
+  confirmed. Live run `mu4hc7sp` crashed inside that confirm turn instead: `confirmProtections`
+  calls `classGuards` (`src/authoring.js`), which is keyed by CODE LANGUAGE and throws on a
+  plain folder's `lang: 'none-detected'` — a plain folder has no language, so the confirm turn
+  cannot honestly show real, code-derived protections for one, and now never runs one. The stop
+  fires immediately after `author-start`, at $0, no scout, no confirm turn, no model call — the
+  spine is exactly `author-start` → `author-end{outcome:'not-authored', stop:'non-code-source'}`.
 
 **The protections a person is shown in the confirm turn come from CODE, never the model**
 (fix #1, live run mu0voeo4, 2026-09-14 — a run once showed a model-invented "behavior-
@@ -1005,6 +1027,26 @@ silently dropped. It is shown under its own heading in the menu (`scripts/run-au
 and threaded through to `accepted.notChecked` and `confirmedBlock`'s own "THE PERSON ASKED
 FOR THESE, BUT NOTHING CHECKS THEM" section for the composer.
 
+**The model drafting `notChecked` is now shown the SAME code-derived protections list before
+it drafts** (F183, ruling A, 2026-09-16 — live runs `mu2bjmed` and `mu2qmept` both had the
+model falsely claim an already-enforced guard or the write fence was missing, because it was
+never told what was actually enforced). `confirmProtections`'s output is computed once, before
+the paid round loop, and threaded into `confirmPrompt`'s model-facing prompt as an "ALREADY
+COVERED" block; `CONFIRM_SYSTEM` orders the model to check that list before naming anything in
+`notChecked`. The model still authors `notChecked` freely — this never makes the list
+deterministic, and it is still never a hand-typed second spelling of the guards. Not yet
+proven live.
+
+**`accepted.openQuestions` is the model's OWN honest `questions`, from the plan being
+ACCEPTED** (F175, fixed 2026-09-14) — never a prior, superseded round's, and never limited to
+a person's typed "fix" text as it used to be. On the round-2 "fix" terminal path (D3: there is
+no 3rd call) the model's own questions come first, then the person's still-pending fix text.
+Shown to the composer by `confirmedBlock` ("state these in your notes, never decide them
+silently") and at the terminal signing readout (`openQuestionLines`, `scripts/author-readout.mjs`).
+**Not fully closed:** the confirm menu still lets a person pick "Confirm" without being forced
+to resolve a raised question first — only the silent-drop-from-the-signed-record half of F175
+is fixed; the menu-bypass half stays open.
+
 **A crash inside the paid span leaves a BODY.** The fallible span — from just after
 `author-start` to the end of the main flow — sits in ONE try/catch that RETRIES NOTHING and
 SWALLOWS NOTHING. The operator's copy goes first and verbatim (it must not depend on the two
@@ -2438,6 +2480,20 @@ objects will not be caught by this. `scripts/behaviour-readout.mjs <gate-audit.j
 prints the block for one run or every run_id found in the file, skipping malformed lines with
 a count rather than throwing.
 
+**F186 (2026-09-15) — the "run's own gate-audit JSONL" claim above was FALSE for a while, at the
+file-hygiene layer, never inside `runBehaviour` itself.** The authoring scout's gate audit
+(`src/authorscout.js`'s `defaultSurveyor`) writes directly into the patient tree at its root
+(`<workdir>/gate-audit.jsonl`), and the tree's own `.gitignore` denies `*.jsonl`, so
+`scripts/run-u.mjs`'s cold reset (`git clean -fd`, no `-x`) never removed it — the file
+accreted rows from every authoring scout AND every worker run that had ever touched the tree,
+and `run-u.mjs`'s end-of-run rename claimed the WHOLE accreted file as "this run's own audit"
+with no filtering. The fix is at the source, never a `run_id` filter bolted onto `runBehaviour`
+(a single run legitimately spans several run_ids): `scripts/run-author.mjs` archives its own
+audit out of the tree the moment authoring ends; `scripts/run-u.mjs` moves any stale audit
+aside right after `coldReset`, before its own Gate ever opens (never on a resume, where the
+tree's audit is that same run's own prior leg). With both halves in place, the file this
+section describes really is scoped to the one run reading it, restoring the claim above.
+
 ```js
 import { runBehaviour, formatBehaviour } from 'bareloop';
 const events = fs.readFileSync(auditFile, 'utf8').trim().split('\n').map(JSON.parse);
@@ -3202,6 +3258,37 @@ freeze loop never trusts a buffer read a moment earlier), `into-exists`,
 refusal never throws, never overwrites a person's file, and never lands a destination inside
 the run's own scratch tree.
 
+**`prepareSource` copies ONLY git-tracked files** (hamr's ruling, unchanged) — a JS/TS repo's
+prepared copy therefore never carries `node_modules`, and every close stage that needs a tool
+(`tsc`, a test runner) would instrument-stop with nothing telling the person why. bareloop
+NEVER runs an install itself — it only ever touches gated primitives, never a shell-out to
+`npm`/`pnpm`/`yarn`/`bun` on the person's behalf. `missingDependencies` is exported ($0,
+JS/TS only for now — other languages return `null`, M3b's job): it takes `(treeDir,
+sourceSubdir?)` and walks from `sourceSubdir` up to `treeDir` (the same nearest-manifest rule
+`detectLanguage` uses, done independently to avoid a `source.js` ⇄ `detectlang.js` import
+cycle), and when the nearest `package.json` names a non-empty `dependencies`/`devDependencies`
+with no sibling `node_modules`, it returns `{manager, command, reason}` — the exact install
+line (`npm ci`/`pnpm install --frozen-lockfile`/`yarn install --frozen-lockfile`/`bun install
+--frozen-lockfile` by lockfile, else `npm install`), `cd`-prefixed for a subfolder job. An
+invalid `package.json`, no manifest found, or `node_modules` already present all return `null`
+— "cannot tell" is never a fabricated gap. `run-interview.mjs` prints the gap and the exact
+command right after `prepareSource` succeeds, and now PAUSES there (F182 fix, 2026-09-15):
+"Press Enter once it has finished to check again, or type skip to carry on without it" —
+Enter re-runs `missingDependencies` on the spot ("packages found — carrying on." or "still
+missing (…) — try again, or type skip to carry on without it.", looping), `skip` (or end of
+input, treated the same) carries on unresolved. It re-checks once more at the hand-off: a
+still-open gap suppresses the "Run it now?" offer entirely (the same shape the unkeyed-shell
+gate already uses) rather than spending on a run that would only instrument-stop — this is
+what the pause makes reachable: before the fix the interview fell straight through to the
+class questions and only ever re-checked once, too late for the offer to ever fire.
+`run-author.mjs` refuses
+`source-deps-missing` (a `request-red`, routed through the same `refusalEvents()` channel
+`language-unsupported` uses) at $0, before the scout and before the provider/key are even
+read. Once the person installs packages into the copy themselves, `prepareSource` has already
+hidden `node_modules` from `changedSet` via the copy's own PRIVATE `.git/info/exclude` (F177),
+so those installed files never read as the worker's own writes — the source repo's tracked
+`.gitignore` is never touched.
+
 **Destination is a DIRECTORY, never a filename** (D3 rework, hamr's ruling, 2026-09-12,
 condensed in `docs/product/ITEM33-BUILD.md`). It may already exist and need not be empty; it
 may sit inside the source itself (the same-dir case: "i can limit your actions to a certain
@@ -3269,6 +3356,22 @@ Not wired yet, named rather than silently absent: `bareloop run` (the exported b
 33/M5. The intake form that lets a person fill in Source/Destination through the authoring
 interview (rather than the CLI above) is item 33/M3, not yet built.
 
+**Running an authored spec needs no developer hand-step any more (F185, fixed 2026-09-16).**
+`scripts/run-u.mjs --spec <path to resolved-spec.json>` is an alternative to `--job <key>`
+(both, or neither, is a loud $0 refusal): it `validateJob`'s the spec on disk explicitly and
+early, then finds the ONE `source-*/` sibling directory beside it that carries a
+`source.json` (`run-interview.mjs` prepares the source door and invokes `run-author.mjs`
+against the same `--out`, so `resolved-spec.json` and `source-<runid>/{source.json,tree/}`
+are always siblings) and reads the workdir (`<that dir>/tree`) and seed off that SAME
+manifest `readSourceManifest` already serves elsewhere — never typed, guessed, or defaulted.
+No sibling, more than one, a missing seed, or a gone tree each refuse by name. Everything
+past that resolution — the `--approve <jobSpecHash>` signature, budget/wall ceilings,
+coldReset, the close-first precheck — is untouched: `--spec` only NAMES the job, exactly as
+a `--job` row does. `scripts/run-author.mjs`'s "SIGNING PREPARED — NOT SIGNED" screen now
+prints the ready-to-paste `--spec` command (real path, real `--approve <hash>`, the
+provider's real env-key per F187) — a person finishing the interview alone can reach a
+running job with no `jobs/` edit and no JOBS-table row.
+
 ## Architecture
 
 Three layers. An **outer shell** (dumb, permanent): per-run budget cap via bareguard,
@@ -3337,6 +3440,18 @@ under it — this is a passthrough, not a jail.
   denies the gate audit path and every `ARBITER_BOOK_STORES` path under the workdir
   (`src/authorscout.js:295`); a plan step's read scope is the workdir alone
   (`src/planrun.js:1894`).
+- **A signed fence can never name `.git` or `node_modules` (F178/F177).** `scopeContained`
+  (`src/validate.js`, design law #1's own function — `validateJob`'s `writeScope` and
+  `validatePlan`'s step `scope`/exit `target`/`path` all go through it) refuses any fence/scope
+  whose normalized prefix has a whole path segment equal to `.git` or `node_modules` — not a
+  look-alike like `.github/**`, `my.git/**`, or `node_modules_util/**`. That alone cannot catch
+  a NESTED `node_modules` reachable through an otherwise-legal fence (a monorepo package scope,
+  or one a worker creates fresh during the run) — bareguard's `fs.deny` is exact
+  prefix-containment only, no glob, so it cannot express "at any depth" even if it were used
+  here. **`fs.deny` is deliberately NOT used for either book**: it blocks ALL fs actions,
+  reads included, and hamr's ruling blocks WRITING only — reading stays allowed. The runtime
+  belt is `tools.denyArgPatterns` (`FORBIDDEN_WRITE_SEGMENT_PATTERN`, `src/planrun.js`): keyed
+  to `write`/`edit` ONLY, matched against the serialized action's `path` field, whole-segment.
 
 **What it does not guarantee:** no network egress control and no container/VM isolation —
 this repo has neither built nor documented either. `CLOSE_ENV_DENY`'s deny rule matches

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",
@@ -23,10 +23,11 @@
     "test": "node scripts/hermetic.mjs && node scripts/prompt-commit-check.mjs --range origin/main..HEAD",
     "typecheck": "tsc --noEmit",
     "build:types": "tsc",
-    "prepublishOnly": "npm run build:types"
+    "prepublishOnly": "npm run build:types",
+    "check:lockfile": "node scripts/check-lockfile.mjs"
   },
   "dependencies": {
-    "bare-agent": "^0.42.0",
+    "bare-agent": "^0.43.0",
     "bareguard": "^0.13.0",
     "litectx": "^0.32.0"
   },