bareloop 0.34.0 → 0.35.0

package/src/job.js

@@ -884,6 +884,43 @@ export function jobSpecHash(job) {
   return createHash('sha256').update(c).digest('hex');
 }
 
+/**
+ * The fields a "Reuse workflow" run may change: where the work lands (the write fence, `writeScope`, and a
+ * `destination`/`source` where a spec ever carries them) and the two ceilings. Everything else in a signed spec is
+ * the WORKFLOW — goal, checks, guardrails, close (the worker model is the third kind, {@link WORKFLOW_KEY_IDENTITY_FIELDS}). ONE list, shared by {@link workflowKey} and by the panel's
+ * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
+ */
+export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs']);
+
+/**
+ * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name
+ * chosen in Settings carries its provider and baseUrl with it). They stay inside {@link jobSpecHash}, so what the person
+ * signs still covers the model the run will use. Kept apart from {@link REUSE_OPEN_SPEC_FIELDS} on purpose: those are the
+ * fields the page's boxes edit directly; these three change together, as one Settings row.
+ */
+export const WORKFLOW_KEY_IDENTITY_FIELDS = Object.freeze(['provider', 'baseUrl', 'model']);
+
+/**
+ * The identity of a WORKFLOW (Reuse workflow, hamr 2026-10-03): sha256 over the signed spec WITHOUT the fields a
+ * reuse may change ({@link REUSE_OPEN_SPEC_FIELDS}) and the worker identity ({@link WORKFLOW_KEY_IDENTITY_FIELDS}). Two runs
+ * share a workflow key iff they ran the same goal, checks, guardrails and close — whatever source they ran on, wherever they wrote, whatever caps they had.
+ * It is NOT a signature: {@link jobSpecHash} (which covers the caps and the fence) stays what the person signs, and
+ * a reuse lands on a NEW jobSpecHash with the SAME workflowKey. Same never-throws contract as `jobSpecHash`, and
+ * the same resolved-`tools` form, so an omitted-`tools` spec and its spelled-out menu share a key.
+ * @param {object} job
+ * @returns {string} sha256 hex
+ */
+export function workflowKey(job) {
+  let c;
+  try {
+    /** @type {any} */
+    const rest = isObj(job) ? { ...job } : job;
+    if (isObj(rest)) for (const f of [...REUSE_OPEN_SPEC_FIELDS, ...WORKFLOW_KEY_IDENTITY_FIELDS]) delete rest[f];
+    c = canon(resolveSpec(rest));
+  } catch { c = '\u0000unhashable'; }
+  return createHash('sha256').update(`workflow-key-v1\n${c}`).digest('hex');
+}
+
 /**
  * Does an approval record cover this exact spec version? Pure predicate — the
  * N2 runner refuses to run without it; nothing here writes or prompts. The

package/src/judged.js

@@ -64,7 +64,7 @@
 // redacts at its emission boundary, the same split `src/kinds.js` documents.
 
 import { createRequire } from 'node:module';
-import { extractArtifact, priceOf, scrubRaw } from './text.js';
+import { extractArtifact, priceOf, scrubRaw, rateSourceFields } from './text.js';
 import { resolveProvider } from './providers.js';
 
 const require = createRequire(import.meta.url);
@@ -872,7 +872,7 @@ export async function runLocate({
     const { costUsd, unpricedRounds } = r === null ? { costUsd: null, unpricedRounds: 0 } : priceOf(r);
     // BA-21: the round's provenance rides beside the cost when the loop carried it (see
     // `defaultJudgeLoop`); a loop that never metered a rate adds no key.
-    onCost({ costUsd, unpricedRounds, ...(r && typeof r === 'object' && 'rateSource' in r ? { rateSource: r.rateSource } : {}) });
+    onCost({ costUsd, unpricedRounds, ...rateSourceFields(r) });
     return {
       ok: red === null, facts, red, costUsd, unpricedRounds, truncated, parseError,
       raw: scrubRaw({

package/src/kinds.js

@@ -67,6 +67,7 @@ import { join, sep } from 'node:path';
 import { globToPrefix, isNonEmptyString } from './validate.js';
 import { CLOSE_ENV_DENY } from './ralph.js';
 import { runLocate, decide, validateCard, LOCATE_AXES, LOCATE_LABEL } from './judged.js';
+import { rateSourceFields } from './text.js';
 
 /** the close's two judgment exits — a stage's verdict, in the shape the
  * hand-written closes already spoke (exit code is truth) */
@@ -1871,7 +1872,7 @@ async function runJudgedFloor(stage, ctx) {
           ctx.onJudgeCost({
             stage: stage?.name ?? null, kind: stage?.kind ?? null, path: rel, attempt,
             label: LOCATE_LABEL, model: judgeModel, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
-            ...('rateSource' in c ? { rateSource: c.rateSource } : {}),
+            ...rateSourceFields(c),
           });
         },
       });

package/src/ledger.js

@@ -23,6 +23,7 @@ import { readFileSync, appendFileSync, existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import { createHash } from 'node:crypto';
 import { HITL_PAUSE, HITL_DECISION_RED } from './declaredclose.js';
+import { legsOf } from './legs.js';
 
 /** severity order, worst-first (the fold's display order; frequency ranks within) */
 export const LEDGER_CLASSES = Object.freeze([
@@ -67,6 +68,7 @@ const QUOTED_VERB_RE = /"([a-z0-9-]+)"/;
 const EXCLUDED_ESCALATIONS = new Set([
   'cap-halt',           // a budget story, not a lib bug
   'wall-halt',          // the TIME budget's version of the same story (T, PRD v1.27)
+  'stopped',            // the PERSON's stop (P5 item 5) — a checkpoint, never a lib bug
   // A stall is the ABSENCE of beats, not an observed provider failure: nothing
   // saw the transport fail, so the typed-lib route rendered a live ask reading
   // "bare-agent: the provider path failed — worker stalled…" and aimed a bug at
@@ -408,7 +410,7 @@ export function updateLedger({ ledgerFile, spineFiles }) {
 // ── BA-21 pricing provenance: the READ side (REPORTING ONLY) ─────────────────
 // bare-agent >=0.37 rides `rateSource` beside `pricing` on every metering payload,
 // and the plan flow forwards it verbatim onto `worker-round`/`judge-round`/`worker-turn`
-// (`rateSourceFields`, src/planrun.js — the write side).
+// (`rateSourceFields`, src/text.js — the write side).
 //
 // `judge-round`'s payload (src/kinds.js's `onJudgeCost({...})`) forwards `rateSource` from the
 // judge Loop's per-call metering (`defaultJudgeLoop`, src/judged.js); a judge round whose loop
@@ -525,9 +527,103 @@ export function floorsFromRecords(records) {
   }
   const spendFloorUsd = pricedCount > 0 ? spendSum : null;
 
-  const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
-  const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
-  const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
-  const wallFloorMs = Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs ? lastMs - firstMs : null;
+  // P5-R: a resumed run is one spine of several legs — the wall floor is the sum of each leg's own
+  // first -> last window, the quiet time between legs excluded (hamr 2026-10-02, 2A). One leg (every spine
+  // before P5-R) reads exactly as it always did.
+  const legs = legsOf(records.filter((r) => r && typeof r === 'object'));
+  let wallFloorMs = null;
+  let sum = 0;
+  let known = 0;
+  for (const l of legs) {
+    const withTs = l.records.filter((r) => typeof r.ts === 'string');
+    const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
+    const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
+    if (Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs) { sum += lastMs - firstMs; known += 1; }
+  }
+  if (known > 0) wallFloorMs = sum;
   return { spendFloorUsd, wallFloorMs };
 }
+
+/**
+ * One run's own spend, off its spine records: this LEG's figure (never the chain fold),
+ * plus the drafting spend the run was signed with (counted once — on the first leg only).
+ * @param {any[]} records ONE leg's records
+ * @param {{ withDraft?: boolean }} [o] `withDraft: false` leaves the drafting spend out (a caller folding the CHAIN's own spend, which never held it)
+ * @returns {{ usd: number, complete: boolean }}
+ */
+export function legSpend(records, { withDraft = true } = {}) {
+  const jobStart = records.find((r) => r && r.type === 'job-start') ?? null;
+  const jobEnd = records.findLast((r) => r && r.type === 'job-end') ?? null;
+  const rounds = records.filter((r) => r && SPEND_RECORD_TYPES.includes(r.type));
+  const pricedSum = rounds.reduce((a, r) => (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd) ? a + r.costUsd : a), 0);
+  const unpriced = rounds.filter((r) => !(typeof r.costUsd === 'number' && Number.isFinite(r.costUsd))).length;
+  let usd = pricedSum;
+  let complete = false;
+  if (jobEnd) {
+    const eng = jobEnd.engagementSpentUsd;
+    usd = typeof eng === 'number' && Number.isFinite(eng) ? eng : pricedSum;
+    complete = jobEnd.spendComplete === true && unpriced === 0;
+  }
+  // drafting spend: a RESUMED / door-rerun leg carries the flag again but the first leg already counted it
+  const resumed = !!jobStart && 'priorSpentUsd' in jobStart;
+  if (withDraft && jobStart && !resumed && typeof jobStart.draftSpentUsd === 'number' && Number.isFinite(jobStart.draftSpentUsd) && jobStart.draftSpentUsd > 0) {
+    usd += jobStart.draftSpentUsd;
+    if (jobStart.draftSpendComplete === false) complete = false;
+  }
+  return { usd, complete };
+}
+
+/**
+ * A WHOLE RUN's own spend (P5-R: a resumed run is one spine of several legs): the sum of each leg's own
+ * figure ({@link legSpend}), never the declared chain fold. ONE basis — every leg's own rounds — so a leg is
+ * counted once: the last leg's `job-end.spentUsd` also carries the earlier legs, and adding it to the
+ * earlier legs' own figures would count them twice. A leg with no terminal (it died) is a floor, so the run
+ * is `complete: false`. A spine with no marker is one leg and reads exactly as {@link legSpend} always did.
+ * @param {any[]} records one spine's records
+ * @param {{ withDraft?: boolean }} [o]
+ * @returns {{ usd: number, complete: boolean, lastLegUsd: number }} `lastLegUsd`: the latest leg's own share (what a claim still held for it is measured against)
+ */
+export function runSpend(records, o = {}) {
+  const legs = legsOf(records);
+  if (legs.length === 0) return { usd: 0, complete: false, lastLegUsd: 0 };
+  let usd = 0;
+  let complete = true;
+  let lastLegUsd = 0;
+  for (const l of legs) {
+    const s = legSpend(l.records, o);
+    usd += s.usd;
+    if (!s.complete) complete = false;
+    lastLegUsd = s.usd;
+  }
+  return { usd, complete, lastLegUsd };
+}
+
+/**
+ * What a FINISHED run's whole chain spent, for a caller that folds it forward (the review door's rerun opens a
+ * new run under the same signed ceiling). One basis per shape: a spine of ONE leg is read by its terminal's own
+ * chain total (`job-end.spentUsd`, which already carries whatever fold that leg inherited — what every door has
+ * always read); a resumed run's several legs are the first leg's own inherited fold (spend the file does not
+ * hold) plus each leg's OWN spend, so a later leg's terminal total — which also carries the earlier legs — is
+ * never added on top of them. Not finite / no terminal = `usd: 0, complete: false` (never an exact-looking 0).
+ * @param {any[]} records one spine's records
+ * @returns {{ usd: number, complete: boolean }}
+ */
+export function chainSpend(records) {
+  const legs = legsOf(records);
+  const num = (/** @type {unknown} */ v) => typeof v === 'number' && Number.isFinite(v);
+  if (legs.length <= 1) {
+    const je = legs[0]?.jobEnd ?? null;
+    const known = num(je?.spentUsd);
+    return { usd: known ? je.spentUsd : 0, complete: known && je?.spendComplete !== false };
+  }
+  const head = legs[0].jobStart;
+  let usd = num(head?.priorSpentUsd) && head.priorSpentUsd > 0 ? head.priorSpentUsd : 0;
+  let complete = head?.priorSpendComplete !== false;
+  for (const l of legs) {
+    const s = legSpend(l.records, { withDraft: false });
+    usd += s.usd;
+    if (!s.complete) complete = false;
+  }
+  return { usd, complete };
+}
+

package/src/legs.js

@@ -0,0 +1,171 @@
+// P5-R (hamr 2026-10-02: "one run, one id, one file ... never two") — a RESUMED run is the SAME run.
+// Its spine is one append-only file; each resume appends a `leg-resume` marker and then the new
+// leg's own records. This module is the ONE owner of "where does a leg start and end": every reader
+// that needs a leg (the resume reader, replay, the monthly limit, the panel, the readout) asks
+// `legsOf` and never re-derives a boundary on its own — two spellings of one boundary is how a
+// money figure counts leg 1 twice.
+//
+// Pure: no imports, no file IO. The text-level torn-line rule lives in `parseSpineText` below, beside
+// the boundary rule it depends on (a torn line is tolerated exactly where the writer leaves one).
+//
+// A spine with NO marker (every run written before P5-R, and every run nobody resumed) is ONE leg:
+// `legsOf` over it returns that file's records, unchanged.
+
+/** The marker record's `type`. */
+export const LEG_RESUME = 'leg-resume';
+
+/**
+ * @typedef {object} Leg
+ * @property {number} leg 1-based position in file order (the marker's own `leg` field is never trusted over the order)
+ * @property {any|null} start the leg's first record (the `leg-resume` marker for leg 2+; the file's first record for leg 1)
+ * @property {any|null} end the leg's last record
+ * @property {any[]} records every record of the leg, in file order, marker included
+ * @property {any|null} jobStart the leg's own `job-start` (null: it ended before runJob wrote one)
+ * @property {any|null} jobEnd the leg's own LAST `job-end` (null: it died, or it is still running)
+ * @property {string|null} outcome the leg's terminal: its `job-end` outcome, else a `run-end` outcome (a $0 refusal), else null
+ * @property {string|null} after leg 1: null. Leg 2+: how the PREVIOUS leg ended, as the marker declares it
+ *   (else derived from that leg's own terminal), `'died'` when it recorded none
+ * @property {number|null} startMs `Date.parse` of the start record's `ts`
+ * @property {number|null} endMs `Date.parse` of the end record's `ts`
+ */
+
+/** @param {any} r @returns {number|null} */
+function tsOf(r) {
+  const t = typeof r?.ts === 'string' ? Date.parse(r.ts) : NaN;
+  return Number.isFinite(t) ? t : null;
+}
+
+/**
+ * Split one spine's parsed records into its legs. Pure.
+ * @param {any[]} events one spine's parsed records, in file order
+ * @returns {Leg[]} always at least one leg for a non-empty list; `[]` for an empty one
+ */
+export function legsOf(events) {
+  const list = Array.isArray(events) ? events.filter((e) => e && typeof e === 'object') : [];
+  if (list.length === 0) return [];
+  /** @type {any[][]} */
+  const groups = [[]];
+  for (const e of list) {
+    // a marker opens a new leg — but never an EMPTY leg 1: a file whose first record IS a marker
+    // (a spine somebody truncated) still reads as leg 1 = the marker, not an invented empty leg
+    if (e.type === LEG_RESUME && groups[groups.length - 1].length > 0) groups.push([]);
+    groups[groups.length - 1].push(e);
+  }
+  /** @type {Leg[]} */
+  const legs = [];
+  groups.forEach((records, i) => {
+    const jobStart = records.find((r) => r.type === 'job-start') ?? null;
+    const jobEnd = records.findLast((r) => r.type === 'job-end') ?? null;
+    const runEnd = records.findLast((r) => r.type === 'run-end') ?? null;
+    const outcome = typeof jobEnd?.outcome === 'string' ? jobEnd.outcome
+      : (typeof runEnd?.outcome === 'string' ? runEnd.outcome : null);
+    const marker = records[0].type === LEG_RESUME ? records[0] : null;
+    const prev = i > 0 ? legs[i - 1] : null;
+    /** @type {string|null} */
+    let after = null;
+    if (i > 0) after = typeof marker?.after === 'string' && marker.after !== '' ? marker.after : (prev?.outcome ?? 'died');
+    legs.push({
+      leg: i + 1,
+      start: records[0],
+      end: records[records.length - 1],
+      records,
+      jobStart,
+      jobEnd,
+      outcome,
+      after,
+      startMs: tsOf(records[0]),
+      endMs: tsOf(records[records.length - 1]),
+    });
+  });
+  return legs;
+}
+
+/**
+ * The legs' WORKING time, gap excluded (hamr 2026-10-02, 2A: only working time charges the wall). Each leg
+ * counts first record → last record; the quiet time between one leg's end and the next leg's marker is
+ * nobody's. `null` = unknown (no leg carries two parseable stamps) — never 0. A leg whose stamps are
+ * unreadable adds nothing, so the figure is a FLOOR, `complete: false`.
+ * @param {Leg[]} legs
+ * @returns {{ ms: number|null, complete: boolean }}
+ */
+export function legsWallMs(legs) {
+  let ms = 0;
+  let known = 0;
+  let complete = legs.length > 0;
+  for (const l of legs) {
+    if (l.startMs !== null && l.endMs !== null && l.endMs >= l.startMs) { ms += l.endMs - l.startMs; known += 1; } else complete = false;
+  }
+  return { ms: known === 0 ? null : ms, complete: complete && known > 0 };
+}
+
+/**
+ * Parse a spine's TEXT, tolerant exactly where the writer leaves damage. A kill mid-append leaves a torn
+ * line; a resume never edits it (the spine is append-only forever) — it writes one `\n` and starts a fresh
+ * line, so the torn bytes end up alone on their own line, immediately BEFORE a `leg-resume` marker. That
+ * line, and the file's own last two lines (the older tail rule: a kill mid-append of the file's final
+ * record), are tolerated and named. An unparseable line anywhere else is `corrupt`: a reconstruction from
+ * it would invent a history.
+ * @param {string} raw
+ * @returns {{ records: any[], tolerated: {line: number, why: 'tail'|'before-leg-resume'}[], corrupt: {line: number, message: string}|null }}
+ *   `line` is 1-based. Only the FIRST corrupt line is reported.
+ */
+export function parseSpineText(raw) {
+  const lines = String(raw).split('\n');
+  /** @type {any[]} */
+  const records = [];
+  /** @type {{line: number, why: 'tail'|'before-leg-resume'}[]} */
+  const tolerated = [];
+  /** @type {{line: number, message: string}|null} */
+  let corrupt = null;
+  const BAD = Symbol('torn');
+  /** @type {any[]} undefined = blank line, BAD = unparseable */
+  const parsed = lines.map((l) => {
+    if (!l.trim()) return undefined;
+    try { return JSON.parse(l); } catch { return BAD; }
+  });
+  /** the next non-blank line's parse result after index i, skipping blanks */
+  const nextOf = (/** @type {number} */ i) => {
+    for (let j = i + 1; j < lines.length; j += 1) if (parsed[j] !== undefined) return parsed[j];
+    return undefined;
+  };
+  lines.forEach((line, i) => {
+    const p = parsed[i];
+    if (p === undefined) return;
+    if (p !== BAD) { records.push(p); return; }
+    if (i >= lines.length - 2) { tolerated.push({ line: i + 1, why: 'tail' }); return; }
+    // EXACTLY one torn line directly before a marker: the shape a resume leaves. Two in a row is not that
+    // shape — the first of them has a corrupt line (not a marker) after it, and is reported.
+    const next = nextOf(i);
+    if (next && next.type === LEG_RESUME) { tolerated.push({ line: i + 1, why: 'before-leg-resume' }); return; }
+    if (corrupt === null) {
+      let message = 'unparseable';
+      try { JSON.parse(line); } catch (/** @type {any} */ e) { message = e.message; }
+      corrupt = { line: i + 1, message };
+    }
+  });
+  return { records, tolerated, corrupt };
+}
+
+/**
+ * Where leg `leg`'s watchdog kill note lives. Leg 1 keeps the name every run has always had
+ * (`<spine>.watchdog.json`); a resumed leg's note sits beside it (`<spine>.leg<N>.watchdog.json`) so one
+ * leg never overwrites another's evidence of how it died.
+ * @param {string} spineFile
+ * @param {number} leg 1-based
+ * @returns {string}
+ */
+export function watchdogNotePath(spineFile, leg) {
+  return leg <= 1 ? `${spineFile}.watchdog.json` : `${spineFile}.leg${leg}.watchdog.json`;
+}
+
+/**
+ * P5 item 5 (Stop) — where a run's STOP REQUEST lives: a file beside its spine. The panel's stop route writes it;
+ * the engine reads it at the between-steps seam (src/planrun.js) and consumes it. One spelling, here, so the route
+ * and the engine can never name two files. A request belongs to ONE leg: the engine deletes it when it honours it,
+ * when the leg ends, and again at the start of the next leg (src/userrun.js).
+ * @param {string} spineFile
+ * @returns {string}
+ */
+export function stopFilePath(spineFile) {
+  return `${spineFile}.stop`;
+}