bareloop 0.30.0 → 0.32.0

package/CHANGELOG.md

@@ -5,6 +5,160 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.32.0] — 2026-09-29
+
+### Added
+
+- **Panel Settings (P4a)** — `~/.config/bareloop/.env` keys-file loader (shell env wins; keys
+  never reach the page), `config.json` (monthly $ limit, chosen key variables, Anthropic balance
+  note), a monthly $ limit that refuses a run start with `Max $X (monthly limit)` at both
+  `run-u` and the panel Sign & run, and a Settings view with a Money & limits tab and a Providers
+  tab (read, $0 Test, key-name dropdown). Add/edit/remove providers is P4b. There is no monthly
+  time limit. **The monthly limit is checked by `run-u` and the panel only — `bareloop run
+  <bundle>` does not check it.** An unreadable `config.json` refuses a run start; a month whose
+  spend is incomplete reads "at least".
+- **Money & limits tab** — total and this-month spend and tokens as two header tiles ($ and
+  tokens, month first), a monthly $ limit that saves on change, and a per-provider breakdown
+  table ($, wall minutes, tokens; this month and to date). Wall time is job-start to job-end
+  when the run ended, otherwise an "at least" floor; unknown is shown as unknown, never 0. A
+  spine with no recorded provider is labelled "not recorded (model X)", never guessed from the
+  model name.
+- **`replay-live --live-audit`** (`scripts/replay-live.mjs`) — opt-in: a $0 replay keeps its
+  sidecar in a scratch patient dir while it paces, so the panel's live tool-log fallback can be
+  seen on screen. Default replay is unchanged.
+- **Panel Providers tab is the keys file (P4b)** — one Settings row per key in
+  `~/.config/bareloop/.env` that has a value (the file is created with five empty preset lines,
+  `ANTHROPIC_API_KEY` / `DEEPSEEK_API_KEY` / `OPENAI_API_KEY` / `GEMINI_API_KEY` / `LOCAL_API_KEY`,
+  when missing; an existing file is never edited). Each row has an editable Name (the model id Chat
+  uses), API shape (Anthropic / OpenAI-compatible / Gemini), Base URL, a $0 Test at that shape and
+  URL, and a total Tokens used; changes save to `config.json` `keys.<ENV NAME>`. A key value of
+  `null` counts as set and means "no real key" (local servers); the provider gets a placeholder,
+  and local rounds price as an `estimated` guess, never a real $0. Reload keys re-merges the
+  keys file onto the shell environment per request, so edits and removals take effect without a
+  restart. Chat's Model menu is the Settings
+  rows, and one owner (`src/providerrows.js`) resolves model to key + shape + URL for Chat, the
+  author doors and the run doors.
+- **Providers tab names a shell-only key** — a preset key variable exported only in the shell
+  (not in the keys file) gets no row and no Chat model; the tab now says so under the table, by
+  name only (`GET /api/settings/providers` returns `shellOnly: string[]`, never a value).
+
+### Changed
+
+- **Panel: no price is displayed** — the Providers table Price column and the Chat job card's
+  Token price field are removed. Display only: cost recording, the `estimated` provenance, spend
+  sums, caps and the monthly limit are unchanged.
+- The Chat cap row is two equal full-width columns (Cap $ | Time cap) at every width.
+- `config.json` `providers.<row>.key` (P4a key-name dropdown) is replaced by
+  `keys.<ENV NAME> = { name, shape, baseUrl }`; the hardcoded `PROVIDER_ROWS` and the panel's fixed
+  `MODEL_OPTIONS` are gone.
+- **Monthly limit counts running jobs at their full cap** — a run still in flight (no `job-end`,
+  spine written to within the panel's died window) is counted against the limit at its own leg
+  cap, not its spend so far, so two runs cannot both start against a limit only one fits. A died
+  run still counts its floor. The Money tab's "$ month" stays real spend.
+
+### Fixed
+
+- **Monthly limit no longer double-counts a resume** — `run-u --resume` on a leg killed within
+  `DIED_MTIME_MS` reserved the old leg at its full cap AND asked for the remainder, so a resume
+  that fit was refused; the resumed leg now counts its real spend only
+  (`checkMonthlyRoom({ resumingSpine })`).
+- **`POST /api/settings/money` no longer clears the limit on a bad body** — an empty or
+  unparseable body, or JSON without the `monthlyLimitUsd` key, is a 400 and leaves `config.json`
+  alone; only an explicit `null` or blank clears the limit.
+- **A bad `monthlyLimitUsd` no longer reads as "no limit"** — a `monthlyLimitUsd` present in
+  `config.json` but not a number above 0 (`"50"`, `-5`, `0`, `true`, `{}`) now refuses the run
+  start and shows as a config problem on the Money tab, like an unparseable file. Absent or
+  `null` still means no limit.
+- **Panel author routes: `jobsDir` and body size** — the name-collision check's `jobsDir` test
+  seam is now server-side only (it was readable off the client's job card, so any
+  `/api/author/start` body could repoint it), and POST bodies over 1 MiB get 413 and the request
+  is destroyed (the reader had no cap and ran before the click guard).
+- **Providers Test** — a connection failure now reads "nothing answering at <URL>"; the Test
+  cell keeps a fixed width and wraps its result. **Tokens used** counts older model-only spines
+  toward the row whose Name exactly equals the model.
+
+## [0.31.0] — 2026-09-29
+
+### Added
+
+- **Panel Chat authoring (P3)** — the Chat tab now drafts a job from the page: a job card
+  (source, goal, Model, `Cap $` / Time cap), a chat thread, and Send / Revise / **Sign &
+  run** actions, backed by new `POST /api/author/*` routes. Every POST needs the
+  per-server-start token plus an Origin/Host check (the human-click guard); the sign route
+  additionally requires the exact spec hash from the session's own signing file and is the
+  only path that ever spawns `run-u` (argv array, ends in `--approve <hash>`). A single
+  progress indicator (amber cycling dots, green `[done]`, red `[stopped]` with the reason)
+  replaces per-phase chat bubbles; step lines carry no who-label; a pending ask always wins
+  the label ("waiting for your OK" / "install needed" / "waiting for your answer"). The
+  page opens on the Chat tab.
+- **Install-needed pause + Check again** — a repo copy with missing dependencies no longer
+  refuses outright: the session pauses, names the copy and the exact install command, and a
+  **Check again** button re-runs the same check on the same copy (bareloop still never
+  installs anything).
+- **Model check under Model** — one `[✓]`/`[✗]` line: key found/missing/bad-shape/rejected
+  (401/403 reads "key rejected", not "may be flaky") plus a $0 GET-only reachability probe
+  (`GET /api/author/model-check`, `checkProviderReachable` in `src/providers.js`). A missing
+  or bad key blocks Start; an unreachable endpoint shows red but never blocks.
+- **One cap covers drafting + run** — the separate Drafting cap field is gone. Drafting runs
+  under the same signed Cap `$`, and at sign the run's enforced ceiling is Cap minus what
+  drafting already spent. `runJob` takes `draftSpentUsd` and `draftSpendComplete` (carried on
+  `job-start` as their own fields, never `priorSpentUsd`, so a first run never reads as a
+  resume); `run-u` gains `--draft-spent-usd <n>` and `--draft-spend-incomplete` (validated
+  like `--read-shim`/`--scout`, carried in every resume/decide re-invocation tail);
+  `bareloop author` prints its drafting spend and the exact `run-u` command. Spend renders
+  as "$X ($Y drafting) of $Z", and an incomplete drafting fold reads "at least" on both
+  figures.
+- **Plain-question check lines** — the "checks N/M" headline is withdrawn. Run-tab part
+  cards and the Audit tab show "all N checks passed" or the first failing check in plain
+  words, e.g. "check #2 src/checks.js has 0 type errors? — 4 left, need 0"; an expanded
+  attempt row lists every declared check in order, including ones that never ran
+  ("not run"). One server-side owner maps each declared stage to its question ("did it
+  change any file?", "no casts or silencers added?", "does the test suite pass?", "no
+  failing tests?", …); numbers use three closed shapes ("N left, need T" / "N of total" /
+  "N, limit M").
+- Coloured `[✓]`/`[✗]` result glyphs on Run-tab part cards.
+- The fix worker's prompt now carries a facts-only close-grade history: "checks passed
+  N/M -> N/M -> …" (over the DECLARED stage count) and each stage's own number history
+  ("count-stage 12 -> 0"). Nothing generated, no advice.
+
+### Changed
+
+- **Panel money renders at 2 decimals everywhere** (`<$0.01` for a real sub-cent amount, a
+  floor rounds down). The CLI's 4-decimal `--all` output is unchanged.
+- **The "worse than before" confirm-turn question is retired** from both the panel and the
+  CLI — an empty answer always meant "nothing beyond Guardrails"; it now is never asked.
+- Chat tab cap row and labels follow the mockup (`Cap $`, `Token price $`, Time cap);
+  Audit tab Time cells show `HH:MM:SS` (full ISO on hover) instead of overflowing at
+  390px.
+
+### Fixed
+
+- **Live runs show a running floor, not "unknown"** — "$X so far (Y drafting) of $CAP ·
+  running Zm" on the Summary box and on a live run's own card; part-level tool counts on
+  a live run resolve through the same live audit-sidecar reader as the Audit tab.
+- **Job tab was permanently blank** — two elements shared `id="job-card"`; the read-only
+  card is now `job-card-readonly`, with a regression test banning duplicate ids.
+- **A failed or rejected chat POST no longer loses the typed answer** — the input clears only
+  on a proven success and errors persist in their own element instead of being wiped by
+  the 2-second poll.
+- **Fix-loop governor reads a declared close's numbers (F198)** — it fed on text-parsed
+  grades that read `null` for every declared count-not-worse gap; it now reads the close's
+  structured `{stage, value}`, so its progress/strike counting sees real convergence or
+  stalling. No limit or direction change.
+- **Escalated fix-loop exhaustion no longer advertises `--resume` (F197)** — `escalated` is
+  not resumable, so the option states that plainly instead of an unreachable "rerun with
+  --resume".
+- The plan part's wall time no longer reads ~0.0s for a real multi-second call (replay-side
+  fix; display only).
+- "Checks passed N/M" uses the declared stage count, not the count that ran under
+  first-red-wins — in the panel and in the fix worker's prompt (F203).
+
+### Docs
+
+- `bareloop.context.md` documents the `/api/author/*` routes, `draftSpentUsd`,
+  `draftSpendComplete`, `--draft-spent-usd`, `--draft-spend-incomplete` and
+  `moneyWithDraft`; PANEL-BUILD.md and the PRD carry the dated P3 / one-cap addenda.
+
 ## [0.30.0] — 2026-09-27
 
 ### Added

package/bareloop.context.md

@@ -1160,7 +1160,37 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, draftSpentUsd?, draftSpendComplete?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
+
+**`draftSpentUsd` (hamr's ruling 2026-09-28, "one cap covers drafting + run") — money the
+AUTHORING pipeline already spent on this job before it was signed.** Shrinks THIS run's own
+enforced ceiling (the one place the arithmetic lives: `remainingUsd() => Math.min(shellCapUsd,
+job.budgetUsd - draftFoldUsd - spentUsd)`), never the signed `budgetUsd` itself. Deliberately
+NOT `priorSpentUsd` — that key means "a previous attempt of this run died and folded its spend
+forward," read by `src/replay.js`'s `resumed` flag off the key's bare presence; a drafting fold
+must never make an ordinary first run read as a resume. Belted like `priorSpentUsd` (a
+non-finite or negative value reads as 0). Rides onto `job-start` as its own field,
+`draftSpentUsd`, only when > 0 — never inside `spentUsd`/`engagementSpentUsd`, which stay
+run-only. `bareloop run-u --draft-spent-usd <n>` is the CLI door (validated: finite, ≥ 0, else
+refused); `bareloop author` prints its own known drafting spend floor and the exact `run-u`
+command including the flag; the panel's sign route passes the session's own tracked drafting
+spend the same way. `src/replay.js`'s `moneyWithDraft(spendCore, draftSpentUsd, budgetUsd?, draftSpendComplete?)` is
+the one shared display formatter: `"$3.71 ($0.81 drafting) of $5.00"`, unchanged
+(`spendCore`/`spendCore of $cap`) when a run carries no drafting share. When
+`draftSpendComplete === false` it reads `"at least $3.71 (at least $0.81 drafting) of $5.00"`
+(the core is not double-prefixed if it is already a floor).
+
+**`draftSpendComplete` (default `true`; hamr's ruling 2026-09-28, 2nd addendum) — was the
+`draftSpentUsd` fold EXACT?** The authoring pipeline's metered-call list can go unpriced (F6)
+and the unknown does not heal by folding forward, so a drafting figure that is only a floor
+must say so. A NEW field beside `draftSpentUsd`, never a value inside `spendComplete` or
+`priorSpendComplete` (those answer "is THIS run's own ledger exact"; merging them would let a
+floor drafting spend read as an exact run). Read only when `draftSpentUsd` is emitted: rides
+onto `job-start` as `draftSpendComplete` beside `draftSpentUsd` (only when the fold is > 0);
+only an explicit `false` counts as incomplete — anything else, garbage included, reads `true`,
+so an unreadable flag never manufactures a false floor. `src/replay.js` surfaces it as
+`summary.draftSpendComplete` (`null` when no drafting fold; a job-start lacking the field reads
+`true`) and feeds it to `moneyWithDraft`.
 
 **`closeTimeoutMs` (PRD item 27/M3) is now OPTIONAL for every real caller.** Omit it (both
 `src/cli.js`'s bundle runner and `src/userrun.js` — lifted out of `scripts/run-u.mjs` by
@@ -1276,6 +1306,26 @@ knob, not a product default — the spec names no scout, so the signed hash is u
 `--read-shim`: an unrecognised value exits 2 at argv, and every re-invocation the runner prints
 carries `--scout off` when set, so a resume never silently drops the arm.
 
+**`bareloop run-u --draft-spend-incomplete`** is a boolean presence-flag (no value) that sets
+`runJob`'s `draftSpendComplete: false`, saying the `--draft-spent-usd` figure is a floor. It
+has no guard against being passed without `--draft-spent-usd` — alone it is inert (nothing is
+folded, so no `job-start` field is emitted). Every printed re-invocation tail carries it
+alongside `--draft-spent-usd` (only when drafting spend > 0), so a resumed leg never turns the
+floor back into an exact figure; `bareloop author` and the panel's sign route pass it when the
+session's drafting spend was incomplete.
+
+**`bareloop run-u --draft-spent-usd <n>`** (hamr's ruling 2026-09-28, "one cap covers drafting +
+run") is the same runner-territory class: a non-finite or negative value exits 2 at argv, before
+the approval gate — never coerced, since reading garbage as 0 would silently WIDEN the run's own
+enforced ceiling and reading it as `Infinity` would silently narrow it into "no cap". The spec
+names no drafting spend, so the signed `budgetUsd` is unaffected; this only shrinks THIS leg's
+own enforced remainder (`job.budgetUsd - draftSpentUsd - spentUsd`). Every printed
+resume/decide/door re-invocation carries `--draft-spent-usd` too, mirroring `--read-shim`'s own
+tail — a resumed leg that dropped it would silently widen its ceiling back up. `bareloop author`
+prints the exact `run-u` command including this flag, with its own known drafting spend (a floor,
+never $0 on an unpriced call — F6). The panel's sign route (`src/panel/authorroutes.js`)
+passes the same flag off the authoring session's own tracked spend.
+
 **The review door's two checkpoint terminals (N4 slice 1, doors re-cut 2026-08-18)** are the
 class's whole surface at this layer, and each is a CLEAN exit (`spendComplete` stays true —
 only the two casualties floor). The pause terminal is a
@@ -1554,7 +1604,10 @@ greens harmed — all three historical fix-loop greens converted in ≤ 2 verdic
 case caught, dead flat at 2 errors for 7 verdicts until the wall). It now stops on the same
 2-strike no-progress rule, read off a DIFFERENT signal: the close's own graded numbers, **per
 stage** (`src/trend.js`). A stage's series is the first number on the first red-marked line of
-its output, compared only against that stage's own BEST so far (never last-only, the same
+its output (for a DECLARED close the structured `{stage, value}` its verdict already carries —
+`closeGrade`, F198 — never a re-parse of the gap prose, which reads every declared grade as
+uncomparable; a command close, and a worker-crash's synthetic gap, still read the text),
+compared only against that stage's own BEST so far (never last-only, the same
 oscillator reason the ladder keeps a seen-set); reaching a LATER stage than ever before is
 progress too, since a staged close is first-red-wins. Two consecutive comparable readings with
 nothing improving ends the loop, under the unchanged `cap-halt` terminal and the unchanged
@@ -1578,6 +1631,10 @@ vs `the target files are clean but M error(s) exist outside them`) donates both
 series, and a run crossing that seam can read converging on work that only swapped which wall
 it is behind. Neither is sharpened by teaching the reader to tell prose shapes apart (the F49
 precedent); the second's root fix is a stage split in the close, which is the spec's to change.
+The fix worker's prompt also gains one facts-only line ("The close's own numbers so far, oldest
+first": checks-satisfied counts and each stage's number history, F198) — no advice, omitted when
+nothing was graded. This exhaustion terminal is `escalated`, a graded red that `--resume`
+refuses, so its options say plainly it cannot be resumed (revise the spec and rerun fresh, F197).
 The spine gains a per-iteration `ladder` record here too; every reading names its `governor`
 (`step-ladder` | `close-trend`) so two instruments under one event type can never be averaged
 into one number.
@@ -2553,7 +2610,7 @@ reimplements for the tool-call breakdown. It returns one plain object:
 
 ```
 { runId, job, goal, budgetUsd, specHash, branch, verdictType, model, code,
-  outcome, stopReason, spentUsd, spendComplete, wallMs, chainClock,
+  outcome, stopReason, spentUsd, spendComplete, draftSpentUsd, wallMs, chainClock,
   resumed, resumeSeed, thisFileSpend, spendMismatch,
   timelineKind: 'steps'|'iterations', replans, close,
   steps: [{ id, occurrence, outcome, rounds, toolCalls, checks: {passed, failed},
@@ -2583,6 +2640,13 @@ the model string, or `-`) — `model` is kept FULL, never truncated, unlike the
 column: a wrong or uncertain model reading is exactly the thing a directory-wide scan needs in
 full, not cut.
 
+**`draftSpentUsd`** (hamr's ruling 2026-09-28, "one cap covers drafting + run") reads
+`job-start.draftSpentUsd` — `null` on every run that never drafted through the panel/`bareloop
+author` (the common case, and every spine predating the field), the drafting spend FLOOR
+otherwise. Never `priorSpentUsd` (that key drives `resumed` below — see `runJob`'s own doc) and
+never folded into `spentUsd`. `summarizeForAllLine`'s `spend` column and every panel money
+display route this through `moneyWithDraft` (above).
+
 **`code`** (F118, the run→code direction — the commit→run direction is the prompt-commit
 check's `Failure:` run-reference rule; the two are companion halves of one loop, built the
 same day). `codeVersion()` (`src/codeversion.js`) is a pure, $0, no-shell reader: `version`
@@ -3230,18 +3294,25 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   paged, for the Audit tab's Grouped view); `GET /api/runs/:runid/job` (the signed spec's
   own fields, ONLY when a bundle-layout run's `spec.json` is reachable — a run-u run has
   none on disk, and this reads `resolved:false` with every spec-only field honestly
-  `'unknown'`, never guessed from the spine's own narrower `job-start` record). Every
-  endpoint is GET/HEAD only (anything else — including every write verb — is `405`); a URL
+  `'unknown'`, never guessed from the spine's own narrower `job-start` record). The run
+  detail also carries `draftSpentUsd`/`draftSpendComplete` (the drafting share of the one cap,
+  `null` when none), `spendFloorUsd`/`wallFloorMs` for a died OR still-running spine (a
+  floor, never `unknown`), and — when a spec resolves — per part attempt `declaredStagesTotal`
+  and `declaredStages[{name, question}]` in DECLARED order, plus per stage `kind`/`direction`/
+  `baselineKind`/`question`: the plain-English question is derived in `src/panel/server.js`
+  (`stageQuestionText`) from the signed stage's kind/params only, `null` when no honest
+  wording exists (the client then shows the stage's own name). Every
+  P1 endpoint is GET/HEAD only (anything else — including every write verb — is `405`, outside the
+  two human-click-guarded write families `/api/author/*` and `/api/settings/*` below); a URL
   never joins a path segment into a filesystem read — a runid is looked up in the run list
   first (`RUNID_RE`, `src/panel/server.js` — accepts a `~2`-style backfill-disambiguated
   suffix too, and every endpoint echoes back the LISTED runid, never a filename-derived one
   that can silently drop that suffix), and only the path THAT ROW stores is ever read. A
   taken port fails loudly (names the port, exit `1`) — this command never silently tries a
-  different one. No interview, no author, no run trigger, no key/`.env` ever read on this
-  path. One more caller of `src/replayio.js`/`src/runlist.js`, in-process, per the layering
+  different one. This read path runs no interview, no author and no run, and reads no key
+  value (the write families below do, server-side, and never return one). One more caller of `src/replayio.js`/`src/runlist.js`, in-process, per the layering
   law (`docs/product/PANEL-BUILD.md` §2) — the panel's HTTP handler holds no flow logic of
-  its own. Chat/Settings/authoring (P3/P4) are not built yet; the page says so rather than
-  hiding the gap.
+  its own. Chat/authoring (P3) and Settings (P4a/P4b) are built — see below.
 
 - **Panel P2 (live run view, `docs/product/PANEL-BUILD.md` Addendum 2026-09-27)** → the page
   polls, it does not push (no SSE/websocket). One `setInterval` (2s) drives two throttled
@@ -3260,10 +3331,56 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   `resolveAuditPathForRow` (`src/panel/server.js`), the one shared owner the Run tab's tools
   summary and the Audit tab both read through — tried only while the run's own spine has no
   `job-end` yet, so a finished run never risks reading a stale leftover file at that path.
-  `scripts/replay-live.mjs <sourceSpine> <outDir> [--speed N]` is a dev-only, unshipped ($0,
+  `scripts/replay-live.mjs <sourceSpine> <outDir> [--speed N] [--live-audit]` is a dev-only, unshipped ($0,
   no provider call) instrument that paces a real archived spine's records back out under a
   new runid so the panel can be exercised against a "live" run without a paid run — it is not
   a substitute for watching a real run start-to-end, which stays a separately authorized step.
+  `--live-audit` (opt-in) puts the sidecar at a scratch patient dir during the replay so the
+  live-fallback path above is exercised, then moves it to the sibling name at the end.
+
+- **Panel P3 (chat/authoring, `docs/product/PANEL-BUILD.md` Addendum 2026-09-27)** → one of the
+  panel's TWO families of write routes (the other is `/api/settings/*`, see "Settings" below), this
+  one under `/api/author/*` (`src/panel/authorroutes.js`); every other route stays GET/HEAD-only
+  per P1's own rule. A POST body over 1 MiB is refused `413` before it is parsed, and the job
+  card's `jobsDir` (where an existing job name is looked up) is a server-side seam only, never read
+  off the client's card. Every route
+  requires the human-click guard: an `x-bareloop-token` header matching a fresh token minted
+  once per server start (templated into `index.html` like the port) AND an Origin/Host
+  naming this exact `127.0.0.1:<port>` — a request failing either gets `403`, before the
+  route body ever runs. `POST /api/author/start` (one job-card body; `409` while a prior
+  session is still non-terminal — one authoring session at a time) creates a session
+  (`src/panel/authorsession.js`) that runs `prepareSource`/`detectLanguage`/`validateJob`/
+  `authorCloseForJob`/`assembleSpec`/`prepareSigning` in-process, exactly the library calls
+  `bareloop interview`/`bareloop author` already make — never a script's own readline loop,
+  never a reimplementation of any gate. `GET /api/author/model-check?model=<id>` is the $0 readiness probe the job card runs
+  before Start (`checkProviderReachable`, `src/providers.js` — a models-list GET only, never a
+  completion; the page sees the key's NAME and a status word, never the value). `POST
+  /api/author/:id/check-deps` is the install-gap's "Check again" (`phase:'install-needed'`:
+  the session waits on the person's own install, then re-runs `missingDependencies` on the
+  same copy — bareloop never installs). `GET /api/author/:id` polls the session's state
+  (phase, chat messages, cost, `revisesLeft`, `specHash` once prepared). `POST /api/author/
+  :id/send {text}` answers whatever the confirm turn is currently asking (the `language` pick or a plan's
+  own follow-up question — the old `worseThanBefore` ask is retired, 2026-09-28) — refused outright when the pending ask is the
+  plan MENU itself (`{ok:false}`, no route from chat text to a plan decision, ever). `POST
+  /api/author/:id/revise {text}` is the menu's own `fix` pick, with the chat text as the
+  correction (D3: max 2 rounds, `revisesLeft` derived from the confirm turn's own round
+  number, never a second hardcoded cap). `POST /api/author/:id/sign-prepare` is the menu's
+  own `confirm` pick — it runs gates 1–4 and reaches `phase:'prepared'` with a `specHash`; it
+  NEVER signs. `POST /api/author/:id/sign {specHash}` is the ONLY route that spawns a run —
+  it refuses unless `phase==='prepared'` and the posted hash matches the session's own
+  `signing.json` `specHash` exactly, then spawns `setsid systemd-inhibit … node bin/
+  bareloop.mjs run-u --spec <resolved-spec.json> --approve <hash>` (plus `--draft-spent-usd <n>`
+  [`--draft-spend-incomplete`] when the session's drafting spend is > 0 — one cap covers
+  drafting + run) detached (array argv,
+  never a shell string), with its own log file inside the session's own dir, and the
+  server's environment with `~/.config/bareloop/.env` merged in per request (a key is never read
+  into or sent to the page — a missing one refuses the session at $0, naming only the env var). `src/panel/authorsession.js` takes
+  test-only DI seams (`scout`/`generate`/`confirmGenerate`/`authorFn`/`prepareSigningFn`) so
+  a test can drive the real ask()-channel/revise/hash wiring without a live provider call;
+  none of them are reachable from `authorroutes.js`'s real construction path. Sessions live
+  under `~/.config/bareloop/panel-sessions/<id>/` (each one's own `resolved-spec.json` and
+  `signing.json`, the two files `bareloop author` itself already writes). Edit/re-sign, the
+  `~/.config/bareloop/.env` keys-file loader, and Settings have landed (P4a/P4b — see "Settings" below).
 
 - **`bareloop run-u <flags…>`** (PANEL-BUILD.md P0 task 2/4) → the person-path run flow
   (the JOBS-table/`--spec` runner, resume, the review door — `docs/logs/FINDINGS.md`'s
@@ -3327,6 +3444,15 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   returns a code / throws" rule `src/userrun.js` already keeps. Like `interview`, `src/cli.js`
   hands it raw `stdin`/`stdout`/`stderr` (its one interactive seam is the confirm turn).
 
+  **`--budget` and `--draft-spent-usd` (hamr's ruling 2026-09-28, "one cap covers drafting +
+  run"):** `--budget` still means the AUTHORING ceiling, unchanged — the panel sets it equal to
+  the job card's one `Cap $`. On a SIGNING PREPARED stop, `author` prints its own known
+  drafting spend (a floor, never $0 on an unpriced call — F6) and the exact `run-u` command to
+  run it, now including `--draft-spent-usd <known-floor>` when that floor is > 0 — the SAME
+  signed `budgetUsd` is the run's cap too, and `run-u` enforces the remainder
+  (`Cap $ − drafting spent`) as ITS own ceiling. Nothing here is left for a person to
+  hand-compute or re-type, the same rule F185 set for `--spec`.
+
 **Tighten-only budget/wall.** `--budget`/`--wall` on `bareloop run` may only lower the
 bundle's own signed `budgetUsd`/`maxWallMs` — `checkEnvelope`'s `envelope-widen` red refuses
 anything higher. Raising a ceiling is a re-export (a new signed bundle), never a runner flag.
@@ -3369,6 +3495,75 @@ provider but `anthropic-api`, spine bundling for `formatReplay` on the minting r
 `runid` is noted), and tarball packing — a bundle is a plain directory; use `npm pack` on it
 yourself if you want a tarball.
 
+### Settings — the keys file, `config.json`, the monthly $ limit, the Providers tab (PANEL-BUILD.md P4a, `src/keysfile.js`, `src/config.js`, `src/monthly.js`, `src/providerrows.js`, `src/panel/settingsroutes.js`)
+
+Two files in `~/.config/bareloop/`, outside any repo:
+
+- **`.env` — key VALUES only.** Plain `NAME=value` lines (optional `export `, `#` comments, one pair
+  of quotes). `loadKeysEnv({ env?, home? })` merges it over the environment; **the shell wins** —
+  the file only fills names the shell leaves unset. Mode other than 600 = a `warning` string
+  (printed on CLI start, shown in Settings), never a refusal. Values go only to provider
+  construction; the page and every log get NAMES and found / not set. `keysForDoor(deps)` is the
+  door helper: an injected `env` with no `keysHome` skips the file entirely (tests never read the
+  real one). The CLI (`run-u`, `interview`, `author`) and the panel both use it.
+- **`config.json` — every setting, never a key value.** `readConfig({ home })` /
+  `updateConfig(patch, { home })` (atomic tmp + rename, mode 600, unknown fields kept).
+  Fields: `monthlyLimitUsd` (number above 0; absent or `null` = no limit; any other value present
+  is a `ConfigError`, refused like an unreadable file), `anthropicBalanceNote` (a note the
+  person types; no check ever reads it), `keys.<ENV NAME>` = `{ name, shape, baseUrl }` (the Providers rows' settings). A secret-shaped
+  string anywhere in the document is refused on save. An unreadable file is a `problem` string and
+  a refused run start ($0), never "no limit". There is no monthly TIME limit (dropped).
+
+**Monthly $ limit.** `checkMonthlyRoom({ capUsd, home, now })` → `{ ok, leftUsd, limitUsd,
+atLeast }`; `monthlyRefusalText(room)` is the ONE spelling: `Max $<left, 2 decimals> (monthly
+limit)`. It is called at the run-start seam in `src/userrun.js` `execute` (before any token
+spends; the CLI prints it to stderr, exit 2) and at the panel's Sign & run (`signRun` in
+`src/panel/authorroutes.js`, refused server-side whatever the page shows). The page only echoes the
+same text under `#jf-cap-money` via `GET /api/author/monthly-check?cap=`. "This month" is the local
+calendar month; a died or incomplete-spend run makes the total an "at least" figure. A run still
+IN FLIGHT (`job-start`, no `job-end`, spine file written within `DIED_MTIME_MS`, `src/runlist.js`) is
+counted at its full leg cap (`budgetUsd` less `priorSpentUsd` on its `job-start`), not its spend so
+far (except the run a resume continues, which counts its real spend), so two runs cannot both start against a limit only one fits; a died run counts its floor.
+Only the refusal reserves the cap (`monthSpend().reservedUsd`); the Money tab's month figure is
+real spend.
+
+**Money & limits tab** (`GET/POST /api/settings/money`): two tiles ($ and tokens, this month / to date, a
+`≥` prefix when a figure is a floor) and a per-provider table ($, minutes, tokens; a run is grouped
+by the provider on its `job-start`, an older spine by its model). The limit field auto-saves on
+change (no Save button); blank clears it. `POST` needs an explicit `monthlyLimitUsd` key (a number
+above 0, or `null`/blank to clear) — an empty or key-less body is a `400`, never "clear the limit".
+
+**Providers tab (P4b, `src/providerrows.js`).** One row per key in `.env` that HAS A VALUE — nothing is
+hardcoded; an empty line is no row, a removed line drops its row on Reload keys. A missing `.env` is
+created (mode 600) on the first Providers read with five empty preset lines (`ANTHROPIC_API_KEY`,
+`DEEPSEEK_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `LOCAL_API_KEY`); an existing file is never
+edited. A value of `null` counts as SET and means "no real key" (the provider is handed the
+placeholder `no-key-needed`, never the word `null`). Each row: the env NAME (read-only) + found,
+**Name** (the model id Chat uses), **API shape** (Anthropic / OpenAI-compatible / Gemini), **Base
+URL** (blank = the shape's own host), **Test**, **Tokens used** (total, display only), and Balance
+(DeepSeek fetched, Anthropic a typed note). Saves on change to `config.json`
+`keys.<ENV NAME> = { name, shape, baseUrl }`. Defaults for a key with no saved entry:
+`ANTHROPIC_API_KEY` claude-sonnet-5 / Anthropic; `DEEPSEEK_API_KEY` deepseek-flash /
+OpenAI-compatible / `https://api.deepseek.com/v1`; `OPENAI_API_KEY` OpenAI-compatible;
+`GEMINI_API_KEY` Gemini; `LOCAL_API_KEY` OpenAI-compatible / `http://127.0.0.1:11434/v1` (Ollama, LM
+Studio, llama.cpp: change the URL); any other name OpenAI-compatible; Name blank until typed. **No
+price is shown anywhere** (display only — cost recording, the estimated provenance, spend sums, caps
+and the monthly limit are unchanged; a local model has no known rate, so its rounds come out as a
+non-zero loud guess, never a real $0).
+
+`providerrows.js` is the ONE owner of "model → key + shape + URL": `keyRows`, `findRow` (rows on the
+same shape + endpoint; the Name breaks a tie), `modelChoiceFor` / `chatModels` (Chat's Model menu IS
+the rows; a blank Name is not offered), `keyNameFor` / `applyConfiguredKey` (a job on `(provider,
+baseUrl[, model])` reads the matching row's variable, else the provider's built-in one). All doors
+(`run-u`, `interview`, `author`, the panel's drafting) use it. Routes (all behind the per-start token
+and Origin check; the chat can never reach them): `GET /api/settings/providers`, `POST .../row`
+(`{envName, name, shape, baseUrl}`), `POST .../balance-note`, `POST .../test` (one
+`checkProviderReachable` models-list GET at the row's shape + URL, $0; a refused connection reads
+`nothing answering at <URL>`), `GET .../balance?env=`
+(DeepSeek-hosted row, server-side), and `GET /api/author/models` (Chat's Model menu). The old
+`providers.<row>.key` config field and the key dropdown are gone. Like the authoring routes, a POST
+body over 1 MiB is refused `413`.
+
 ### The source front door — a plain folder/file/URL, no `--patient` (PRD item 33/M2, `src/source.js`)
 
 A repo job still gives `runJob` a `--patient` checkout it owns. A NON-code job (a resume, a

package/bin/bareloop.mjs

@@ -15,7 +15,6 @@ process.stdout.on('error', (e) => {
 });
 
 const code = await main(process.argv.slice(2), {
-  env: process.env,
   stdout: process.stdout,
   stderr: process.stderr,
   cwd: process.cwd(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/authorflow.js

@@ -425,32 +425,18 @@ export function labelsFor(verdictType) { return questionSet(verdictType).labels;
 
 // ── CONFIRM TURN — person-facing wording (PRD item 33 M3 piece 4) ──────────
 //
-// These three are the $0, no-provider half of the confirm turn (D7): asked
-// before the scout ever runs, so a missing person at end of input stops at
-// $0 rather than after a paid call. FROZEN wording, exactly like SOURCE_FIELD
+// These are the $0, no-provider half of the confirm turn (D7): asked before
+// the scout ever runs, so a missing person at end of input stops at $0
+// rather than after a paid call. FROZEN wording, exactly like SOURCE_FIELD
 // and DESTINATION_FIELD_* above — a caller prints these verbatim, never
 // rewords or reorders them.
-
-/**
- * Asked ONLY for a repo source (ruling 2 addendum's D7) — a plain folder or a
- * URL has no "before" a repo's own history gives it to compare against. This
- * is the OLD Q5 wording, verbatim ("What would make you say this came back
- * worse than before?"), which M3 piece 3's reshape folded into Guardrails —
- * it survives here as its OWN field because the confirm turn (ruling 5's
- * 2026-09-13 addendum) includes it as a constraint only when the person
- * actually gave one, and folding it silently into the Guardrails free-text
- * slot would lose that "present or absent" distinction. An empty answer is
- * "nothing beyond what Guardrails already said" and is not required — see
- * the frozen-wording test below: this phrase appears NOWHERE in
- * {@link questionsFor}'s own sets, so a caller cannot double-ask it by
- * reading the wrong table.
- */
-export const WORSE_THAN_BEFORE_FIELD = Object.freeze({
-  id: 'worseThanBefore',
-  kind: 'mechanical',
-  label: 'Worse than before',
-  prompt: 'What would make you say this came back worse than before?',
-});
+//
+// RETIRED (hamr's ruling, 2026-09-28): the old Q5 "worse than before" field
+// and ask are gone — it was optional, and an EMPTY answer already meant
+// "nothing beyond Guardrails", so it never earned its own turn. `worseThanBefore`
+// downstream (confirmPrompt, `accepted.worseThanBefore`) is kept and always
+// resolves to `''` — the same value an empty answer always produced — so
+// nothing downstream needed to change shape, only the ask itself is gone.
 
 /**
  * Asked ONLY when `src/detectlang.js`'s `detectLanguage` reports its
@@ -1832,7 +1818,10 @@ async function askConfirmPlan({ convo, generate, mode, book, label }) {
  *   generate: Function, book: ReturnType<typeof makeCostBook>,
  *   ask: (step: {kind: string, [k: string]: any}) => Promise<string|null>,
  *   onPhase?: (phase: string, data?: any) => void, mode?: 'tool'|'text',
- *   worseThanBefore?: string}} o
+ *   worseThanBefore?: string}} o retired field (hamr's ruling 2026-09-28):
+ *   `worseThanBefore` is never asked any more and defaults to `''` — a
+ *   caller may still pass a string through (kept for a future, non-ask
+ *   source of the same constraint), it just never comes from an ask() step.
  * @returns {Promise<{ok: boolean,
  *   stop: null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart',
  *   rounds: number,
@@ -1843,13 +1832,12 @@ async function askConfirmPlan({ convo, generate, mode, book, label }) {
 export async function runConfirmTurn({
   verdictType, answers, questions, labels = {}, facts = null, listing = null, writeScope = null,
   isRepo, lang, generate, book, ask, onPhase = () => {}, mode = 'tool',
-  // `undefined` (the default) means "ask me" — every S2 caller (nothing
-  // pre-resolves this). A caller that already asked worseThanBefore itself
-  // (`authorCloseForJob`'s own $0 phase, run BEFORE the scout per D7) passes
-  // the resolved string straight through, and this turn asks nothing a
-  // second time. `''` is a legal resolved answer ("nothing beyond
-  // Guardrails") and is NOT the same as "ask me" — only `undefined` is.
-  worseThanBefore: presetWorseThanBefore = undefined,
+  // RETIRED ASK (hamr's ruling 2026-09-28): this turn never asks
+  // "worseThanBefore" any more — an absent value always resolves to `''`,
+  // byte-identical to what an empty answer always produced. A caller may
+  // still pass a resolved string through (kept as a plain pass-through, not
+  // an ask trigger).
+  worseThanBefore: presetWorseThanBefore = '',
 }) {
   /** @typedef {null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart'} ConfirmStop */
   /** @returns {{ok: boolean, stop: ConfirmStop, rounds: number, accepted: null, reds: Red[], cost: any}} */
@@ -1858,16 +1846,8 @@ export async function runConfirmTurn({
   const abandon = (rounds) => ({ ...base(), stop: /** @type {ConfirmStop} */ ('confirm-abandoned'), rounds, cost: book.report() });
 
   // ── the $0 half, entirely before any token spends (D7) ────────────────────
-  /** @type {string} */
-  let worseThanBefore = '';
-  if (presetWorseThanBefore !== undefined) {
-    worseThanBefore = presetWorseThanBefore;
-  } else if (isRepo) {
-    onPhase('confirm-worse-than-before');
-    const wtb = await ask({ kind: 'worseThanBefore', field: WORSE_THAN_BEFORE_FIELD });
-    if (wtb === null) return abandon(0);
-    worseThanBefore = redactSecrets(String(wtb).trim());
-  }
+  // no ask here any more — see the retirement note above.
+  const worseThanBefore = typeof presetWorseThanBefore === 'string' ? presetWorseThanBefore : '';
 
   /** @type {string} */
   let resolvedLang = typeof lang === 'string' ? lang : '';

package/src/authorjob.js

@@ -111,7 +111,7 @@ import {
 } from './authoring.js';
 import {
   QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook,
-  runConfirmTurn, WORSE_THAN_BEFORE_FIELD, LANGUAGE_PICK_FIELD,
+  runConfirmTurn, LANGUAGE_PICK_FIELD,
 } from './authorflow.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
 import {
@@ -498,14 +498,11 @@ export async function authorCloseForJob({
   // paid survey. `ask` ABSENT is the whole confirm turn's off switch — every
   // caller that predates this piece (or a caller that never wires an
   // interactive seam) reaches the genre check below exactly as it always did.
-  let worseThanBefore = '';
+  // RETIRED (hamr's ruling 2026-09-28): the "worse than before" ask is gone —
+  // it was optional and an empty answer already meant "nothing beyond
+  // Guardrails", so `worseThanBefore` always resolves to `''` now, never asked.
+  const worseThanBefore = '';
   if (ask) {
-    if (isRepo) {
-      onPhase('confirm-worse-than-before', {});
-      const wtb = await ask({ kind: 'worseThanBefore', field: WORSE_THAN_BEFORE_FIELD });
-      if (wtb === null) return { ...base, interview, reds: [], stop: 'confirm-abandoned' };
-      worseThanBefore = redactSecrets(String(wtb).trim());
-    }
     if (langResult?.kind === 'ambiguous') {
       onPhase('confirm-language-pick', { candidates: langResult.candidates });
       const pick = await ask({ kind: 'language', field: LANGUAGE_PICK_FIELD, candidates: langResult.candidates });