bareloop 0.38.0 → 0.40.0

package/src/authorscout.js

@@ -375,9 +375,9 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider,
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
- *   rates?: {in: number, out: number}|null,
+ *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
  * @returns {Promise<Survey & {raw: string, raws: ReturnType<typeof scrubRaw>[],
  *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
@@ -400,6 +400,8 @@ export async function runAuthorScout({
   onCall = () => {},
   createLoop = defaultLoop,
   rates = null,
+  // the drafter's per-call model options (`draftCallOptions`, src/providers.js; e.g. thinking off) — {} = nothing extra, byte-identical
+  callOptions = {},
   createSurveyor = defaultSurveyor,
 }) {
   const callTimeout = Number.isFinite(Number(callTimeoutMs)) && Number(callTimeoutMs) > 0
@@ -434,7 +436,8 @@ export async function runAuthorScout({
     // metered without the report going out: exactly the pairing invariant the
     // raw already rides. It REPORTS and decides nothing; the ceiling still binds
     // through `capStop` between calls, untouched.
-    onCall({ ...call });
+    // bare-agent's per-run `thinkingApplied` rides the reporting seam only, never the stored entry (see makeCostBook.add)
+    onCall({ ...call, ...(r?.thinkingApplied === undefined ? {} : { thinkingApplied: r.thinkingApplied }) });
     return raws.push(scrubRaw({ label, attempt, text: r?.text })) - 1;
   };
   // TIGHTEN-ONLY: an operator may lower the ceiling, never raise it. A garbage
@@ -526,7 +529,7 @@ export async function runAuthorScout({
         loop = createLoop({ system, policy: surveyor.policy, onLlmResult: metered, provider, ...priced });
 
         const r = await settled(loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
-          { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
         verdictAt = record(label, attempt, r);
         blob = redactSecrets(String(r?.text ?? '')).slice(0, blobMax);
         lastMsgs = Array.isArray(r?.msgs) && r.msgs.length ? r.msgs : null;
@@ -572,7 +575,7 @@ export async function runAuthorScout({
           // backends 400 on it. Strip the leading one before re-running.
           const rMsgs = r.msgs[0]?.role === 'system' ? r.msgs.slice(1) : r.msgs;
           s2 = await settled(recovery.run([...rMsgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
-            { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
+            { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
           const recoveryAt = record('author-scout-recovery', attempt, s2);
           const t = redactSecrets(String(s2?.text ?? '')).slice(0, blobMax);
           // the verdict follows the blob that WON, never the call that came last
@@ -603,7 +606,7 @@ export async function runAuthorScout({
         const askMsgs = lastMsgs[0]?.role === 'system' ? lastMsgs.slice(1) : lastMsgs;
         const rr = await settled(reask.run(
           [...askMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
-          { cacheMessages: true, maxTokens, timeoutMs: callTimeout },
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions },
         ));
         verdictAt = record(label, attempt, rr);
         blob = redactSecrets(String(rr?.text ?? '')).slice(0, blobMax);

package/src/bridges.js

@@ -1,5 +1,5 @@
 // Layer 3 — the REUSE registry (design record:
-// docs/product/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
+// docs/logs/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
 //
 // A BRIDGE is the plan a green actually executed, kept so the next run of the same
 // SHAPE starts from it instead of cold. This module is the box and the label on it:

package/src/calibrate.js

@@ -1,5 +1,5 @@
 // THE CALIBRATION GATE — softgreen module 5 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4.4, the
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4.4, the
 // 2026-08-18 threshold addendum rulings 1–3, and the second same-day addendum's
 // rulings 1 and 3).
 //
@@ -61,10 +61,10 @@
 import { createHash } from 'node:crypto';
 import {
   LOCATE_LABEL, LOCATE_AXES, CALIBRATION_SIZE,
-  runLocate, decide, expectedOf, validateCard, validateCalibrationSet,
+  runLocate, decide, expectedOf, validateCard, validateCalibrationSet, docQuoteInBlock,
 } from './judged.js';
 import { JUDGE_ATTEMPTS } from './kinds.js';
-import { tallyCalls } from './text.js';
+import { tallyCalls, scrubRaw } from './text.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
 
 /** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
@@ -280,20 +280,87 @@ export function factsResist(facts, gold, artifactText) {
   if (gotNames.join(',') !== wantNames.join(',')) {
     return { ok: false, why: `the located function list moved: expected ${wantNames.join(', ')}, got ${gotNames.join(', ') || '(none)'}` };
   }
-  const lines = new Set(artifactText.split('\n').map((l) => l.trim()).filter(Boolean));
   for (const w of want) {
     const f = got.find((/** @type {any} */ x) => String(x?.name ?? '') === w.name);
     const q = typeof f?.docQuote === 'string' && f.docQuote.trim() !== '' ? f.docQuote : null;
     if (!w.hasDoc && q !== null) {
       return { ok: false, why: `${w.name} has no JSDoc block and the extraction reported one` };
     }
-    if (w.hasDoc && (q === null || !q.includes('/**') || !lines.has(q.trim()))) {
+    // ONE OWNER of "this quote points at the real doc block" (docQuoteInBlock, the same call
+    // `has-doc`'s decide() makes). The judge routinely quotes a worded line inside the block
+    // rather than the `/**` opener, and since ruling A (0f27db5) that is a good pointer; the
+    // declaration it names must be this function's own, so a block above another one still leaks.
+    const decl = typeof f?.declarationQuote === 'string' ? f.declarationQuote : null;
+    if (w.hasDoc && (q === null || decl === null || !decl.includes(w.name) || !docQuoteInBlock(artifactText, decl, q))) {
       return { ok: false, why: `${w.name} IS documented and the extraction did not report its real JSDoc opener` };
     }
   }
   return { ok: true, why: null };
 }
 
+// ── THE DIAGNOSTIC RECORD (F192) ────────────────────────────────────────────
+//
+// A refusal must be diagnosable from its OWN record. `expectedOf` drops `why` and
+// `quote` on purpose (a signer cannot predict the judge's wording, so grading must
+// not pin it), and the judge's raw locate facts used to be written nowhere — so a
+// `has-doc` red could not be told apart as "no docQuote", "not a /** opener" or
+// "a quoted line is not in the artifact". `diag` is a NEW field beside the graded
+// ones: nothing here is read by grading, the compare, the hashes or any verdict.
+// Every string passes through `scrubRaw` — the ONE secret inventory plus the one
+// announced bound — so a quote that carries a key is masked and a long one says
+// how much was withheld rather than silently clipping.
+
+/** the per-string cap on anything the diagnostic keeps (bytes, scrubbed) */
+export const DIAG_STRING_CAP = 400;
+/** the most elements of one array the diagnostic keeps before it says it stopped */
+const DIAG_ARRAY_CAP = 32;
+
+/** @param {unknown} v @returns {string} */
+const diagText = (v) => scrubRaw({ label: 'diag', attempt: 0, text: v, cap: DIAG_STRING_CAP }).text;
+
+/**
+ * A facts tree, deep-copied with every string scrubbed and bounded. Depth is
+ * bounded too: facts are a shallow list of functions, and anything deeper is not
+ * a shape this pipe reads.
+ * @param {any} v @param {number} [depth] @returns {any}
+ */
+function diagFacts(v, depth = 0) {
+  if (typeof v === 'string') return diagText(v);
+  if (v === null || typeof v !== 'object') return v;
+  if (depth >= 4) return diagText(JSON.stringify(v));
+  if (Array.isArray(v)) {
+    const kept = v.slice(0, DIAG_ARRAY_CAP).map((x) => diagFacts(x, depth + 1));
+    if (v.length > DIAG_ARRAY_CAP) kept.push(`[${v.length - DIAG_ARRAY_CAP} more element(s) withheld — the cap is ${DIAG_ARRAY_CAP} per array]`);
+    return kept;
+  }
+  return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, diagFacts(x, depth + 1)]));
+}
+
+/**
+ * What one graded artifact's record KEEPS about how it was judged: every locate
+ * attempt's axis and cause, the judge's facts as returned, and the decision's
+ * full reds per rule.
+ * @param {{diagTries: any[], facts: any, decision: any}} r
+ */
+function diagOf({ diagTries, facts, decision }) {
+  /** @type {{rule: string, fn: string, why: string, quote: string|null}[]} */
+  const reds = [];
+  for (const item of decision?.items ?? []) {
+    for (const x of item?.reds ?? []) {
+      reds.push({
+        rule: String(item?.rule ?? ''), fn: String(x?.fn ?? ''), why: diagText(x?.why),
+        quote: typeof x?.quote === 'string' ? diagText(x.quote) : null,
+      });
+    }
+  }
+  return {
+    attempts: diagTries,
+    facts: facts === null || facts === undefined ? null : diagFacts(facts),
+    reds,
+    reason: typeof decision?.reason === 'string' ? diagText(decision.reason) : null,
+  };
+}
+
 // ── THE GATE ────────────────────────────────────────────────────────────────
 
 /**
@@ -320,6 +387,10 @@ async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, m
   let last = null;
   /** @type {any[]} */
   const tries = [];
+  /** the diagnostic twin of `tries` (F192): the same attempts, with the cause text
+   * `tries` never carried. A separate array so `casualty.attempts` is unchanged.
+   * @type {any[]} */
+  const diagTries = [];
   // TIGHTEN-ONLY, FLOOR 1 — the same clamp shape every bound in this pipeline
   // carries. A caller may buy fewer retries than the ladder allows and never
   // more; ZERO is not a cheaper gate, it is a gate that grades nothing and has
@@ -327,7 +398,7 @@ async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, m
   const bound = Math.max(1, Math.min(Math.trunc(Number(attempts)) || 0, JUDGE_ATTEMPTS));
   for (let attempt = 1; attempt <= bound; attempt += 1) {
     const halt = capStop();
-    if (halt) return { ok: false, budget: halt, tries, red: null, facts: null, decision: null };
+    if (halt) return { ok: false, budget: halt, tries, diagTries, red: null, facts: null, decision: null };
     last = await runLocate({
       artifactText,
       card,
@@ -348,11 +419,12 @@ async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, m
       }),
     });
     tries.push({ attempt, ok: last.ok, axis: last.red?.axis ?? null, costUsd: last.costUsd });
+    diagTries.push({ attempt, ok: last.ok, axis: last.red?.axis ?? null, detail: last.red ? diagText(last.red.detail) : null });
     if (last.ok) break;
     if (last.red.axis === LOCATE_AXES.PRICING) break;
   }
-  if (!last.ok) return { ok: false, budget: null, tries, red: last.red, facts: null, decision: null };
-  return { ok: true, budget: null, tries, red: null, facts: last.facts, decision: decide(last.facts, card, { artifactText }) };
+  if (!last.ok) return { ok: false, budget: null, tries, diagTries, red: last.red, facts: null, decision: null };
+  return { ok: true, budget: null, tries, diagTries, red: null, facts: last.facts, decision: decide(last.facts, card, { artifactText }) };
 }
 
 /**
@@ -393,7 +465,7 @@ async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, m
  *   onCost?: (c: any) => void, attempts?: number, battery?: any[], batteryCard?: any,
  *   capStop?: () => 'cap-halt'|'pricing-red'|null}} o
  * @returns {Promise<{ok: boolean, stop: string|null, casualty: any,
- *   graded: {id: string, ok: boolean, got: any, want: any, detail: string|null}[],
+ *   graded: {id: string, ok: boolean, got: any, want: any, detail: string|null, diag: any}[],
  *   injection: {styles: any[], allResisted: boolean, leaks: string[]},
  *   failures: string[], reds: Red[], judgeModel: string,
  *   cardHash: string|null, casesHash: string|null, setHash: string|null,
@@ -517,7 +589,7 @@ export async function runCalibration({
         ...stamped,
         stop: r.red.axis,
         graded,
-        casualty: { at: String(c.id), kind: 'case', axis: r.red.axis, detail: r.red.detail, attempts: r.tries },
+        casualty: { at: String(c.id), kind: 'case', axis: r.red.axis, detail: r.red.detail, attempts: r.tries, diag: diagOf(r) },
         reds: [{
           code: r.red.axis,
           path: `calibration.cases.${c.id}`,
@@ -535,6 +607,7 @@ export async function runCalibration({
       got,
       want: { verdict: c.expect.verdict, reds: (c.expect.reds ?? []).map((/** @type {any} */ x) => ({ rule: x.rule, fn: x.fn })) },
       attempts: r.tries,
+      diag: diagOf(r),
       detail: cmp.ok ? null : [
         cmp.verdictOk ? null : `verdict: signed "${c.expect.verdict}", the pipe rendered "${got.verdict}"`,
         cmp.missing.length ? `expected red(s) the pipe did not raise: ${cmp.missing.join('; ')}` : null,
@@ -562,7 +635,7 @@ export async function runCalibration({
         stop: r.red.axis,
         graded,
         injection: { styles, allResisted: false, leaks: [] },
-        casualty: { at: b.id, kind: 'injection', axis: r.red.axis, detail: r.red.detail, attempts: r.tries },
+        casualty: { at: b.id, kind: 'injection', axis: r.red.axis, detail: r.red.detail, attempts: r.tries, diag: diagOf(r) },
         reds: [{
           code: r.red.axis,
           path: `injection.${b.id}`,
@@ -581,6 +654,7 @@ export async function runCalibration({
       resisted: facts.ok && cmp.ok,
       factsOk: facts.ok,
       decisionOk: cmp.ok,
+      diag: diagOf(r),
       got,
       want: { verdict: b.expect.verdict, reds: b.expect.reds.map((/** @type {any} */ x) => ({ rule: x.rule, fn: x.fn })) },
       detail: facts.ok && cmp.ok ? null : (facts.why ?? `the decision moved: ${[

package/src/cardauthor.js

@@ -1,5 +1,5 @@
 // THE TWO SIGNED ARTIFACTS — softgreen module 4 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4.3 and §4.4,
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4.3 and §4.4,
 // plus the 2026-08-18 threshold addendum).
 //
 // Module 1 built the judged floor's core, module 2 wired the stage into a close,
@@ -228,7 +228,7 @@ export const COMPILE_SYSTEM = 'You compile a person\'s own words into a rubric a
 export function cardCasesPrompt({ answers, questions = {} }) {
   const qKey = SOFTGREEN_JUDGE_EXAMPLES_KEY;
   const q = questions[qKey] ?? JUDGE_EXAMPLES_QUESTION;
-  const rules = JUDGE_RULE_IDS.map((id) => `- ${id}\n    the facts it reads: ${JUDGE_RULES[id].ask.trim().split('\n')[0].trim()}`);
+  const rules = JUDGE_RULE_IDS.map((id) => `- ${id}\n    what it can check: ${JUDGE_RULES[id].means}\n    the facts it reads: ${JUDGE_RULES[id].ask.trim().split('\n')[0].trim()}`);
 
   return `You are compiling ONE person's answers into the two artifacts a judged close is signed with.
 
@@ -240,6 +240,9 @@ THEIR ANSWER — verbatim, and the only input you have
 Q${qKey}. ${q}
 A${qKey}. ${answers?.[qKey] ?? '(no answer given)'}
 
+Each example is kept with the number of the job line the person wrote it under. Never attach an example to a different
+line than the one it names (run mv1j01sl guessed which example belonged to which part of the goal).
+
 ---
 
 THE RULEBOOK — the only rules that exist. You SELECT from it; a rule that is not here cannot be asked for.
@@ -266,6 +269,9 @@ at — plus what the arbiter must decide about it.
 
 AT LEAST ONE PASS AND AT LEAST ONE RED. A set that can only fail one way measures nothing.
 Every rule you name in a case must be a rule your card carries.
+A case may expect a red only where the rule's "what it can check" line says it can raise one on that artifact: a
+function with any doc block above it never breaks has-doc, and "the doc only restates the function name" is a
+says-what red, never a has-doc one.
 
 HOW TO ANSWER
 

package/src/declaredclose.js

@@ -102,7 +102,7 @@ export const DECLARED_GENRES = Object.freeze([TYPES_GENRE.name]);
  * constrained to the names the genre OWNS, so it can never become an environment
  * channel of its own.
  */
-export const CLOSE_DECL_FIELDS = Object.freeze(['genre', 'lang', 'stages', 'notes', 'genreEnv', 'calibration']);
+export const CLOSE_DECL_FIELDS = Object.freeze(['genre', 'lang', 'stages', 'notes', 'refused', 'genreEnv', 'calibration']);
 
 /** what a stored calibration set carries, ENUMERATED: the frozen cases and the judge
  * tier that graded them. Both are inside the spec, so `jobSpecHash` covers both — which
@@ -272,13 +272,13 @@ export function declaredStages(closeDecl) {
  *
  * @param {any} closeDecl
  * @param {{at?: string, listing?: string[]|null, deferListing?: boolean,
- *   catalogue?: Record<string, any>, verdictType?: string|null}} [opts]
+ *   catalogue?: Record<string, any>, verdictType?: string|null, writeScope?: string[]|null, jobLines?: {n: number}[]|null}} [opts]
  * @returns {{ok: boolean, reds: Red[], closeDecl: any, grounded: boolean,
  *   scoped: {scoped: boolean, via: string|null},
  *   ceiling: {class: string, kind: string, stage: string|null, locked: boolean}|null}}
  */
 export function validateCloseDecl(closeDecl, opts = {}) {
-  const { at = 'closeDecl', listing = null, catalogue, verdictType = null } = opts;
+  const { at = 'closeDecl', listing = null, catalogue, verdictType = null, writeScope = null, jobLines = null } = opts;
   const deferListing = opts.deferListing === true;
   /** @type {Red[]} */
   const reds = [];
@@ -401,6 +401,8 @@ export function validateCloseDecl(closeDecl, opts = {}) {
     ...(deferListing ? { deferListing: true } : {}),
     guards: classGuards({ verdictType: picked, lang: closeDecl.lang }),
     verdictType: picked,
+    writeScope,
+    jobLines,
     envOwned: owned,
     // POST-injection: an owned name is accepted only when its value is EXACTLY
     // the recorded one. `{}` (nothing recorded) keeps the pre-injection rule, so
@@ -678,14 +680,19 @@ export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
  *    recommend a top-up on a dying run — the one direction trend.js names as
  *    dangerous. F6's answer applies: unknown, never a number that means the
  *    opposite of what it says.
- *  - a stage with no measurement at all donates nothing, for the same reason.
+ *  - a JUDGED stage (no measurement) donates its distinct red COUNT, always 'down';
+ *  - any other stage with no measurement at all donates nothing, for the same reason.
  * The stage POSITION still travels either way, so "the run got further than it
  * ever had" is readable on every declared close.
  * @param {any} stage @param {any} r the M1 StageResult
  * @returns {number|null}
  */
 function trendValueOf(stage, r) {
-  if (typeof r?.value !== 'number' || !Number.isFinite(r.value)) return null;
+  if (typeof r?.value !== 'number' || !Number.isFinite(r.value)) {
+    // a JUDGED stage has no measurement: its number is how many DISTINCT reds it itemizes
+    // (F192 e), lower-is-better, compared to its best-so-far like any deterministic count
+    return Number.isInteger(r?.detail?.redCount) ? r.detail.redCount : null;
+  }
   return stage?.params?.direction === 'lower-is-better' ? r.value : null;
 }
 

package/src/draftspend.js

@@ -24,7 +24,10 @@ export const DRAFT_LOG_FILE = 'draft-log.jsonl';
  * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
  *  - `step-start`  {no, id, label, at}
  *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
- *  - `call`        {no, step, label, model, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway")
+ *  - `call`        {no, step, label, model, thinking, thinkingApplied?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (`thinking` = what was asked and sent: off | on | not-switchable | unverified; `thinkingApplied` = bare-agent's own verdict for the
+ *    call's run (true | false | null), present only when thinkingMode was sent)
  *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
  * @typedef {{kind: string, no: number, at: string, [k: string]: any}} DraftEvent
  */
@@ -148,6 +151,8 @@ export function readDraftSteps(dir) {
       x.status = ev.status === 'failed' ? 'failed' : 'done';
       x.endedAt = ev.at;
       if (typeof ev.label === 'string') x.label = ev.label;
+    } else if (ev.kind === 'step-label' && byNo.has(ev.no)) {
+      if (typeof ev.label === 'string') byNo.get(ev.no).label = ev.label;
     } else if (ev.kind === 'step-reopen' && byNo.has(ev.no)) {
       const x = byNo.get(ev.no);
       x.status = 'running';

package/src/interviewrun.js

@@ -31,7 +31,7 @@
 //     form (PRD item 33 M3 piece 3): Goal / Success / Guardrails, soft-green
 //     adding Judge Examples. Source and Destination are MECHANICAL fields —
 //     proven against the machine rather than typed — and their wording is
-//     ALSO the library's (`SOURCE_FIELD`, `destinationFieldFor`,
+//     ALSO the library's (`INPUTS_FIELD`, `destinationFieldFor`,
 //     `src/authorflow.js`), so this module prints what the library hands it
 //     for all six fields, never re-worded here, never re-ordered, never stored;
 //   - the REFUSALS are the library's (`runInterview`): a locked class refuses at
@@ -89,7 +89,7 @@
 import { keysForDoor } from './keysfile.js';
 import { applyConfiguredKey, rowsForHome } from './providerrows.js';
 import {
-  writeFileSync, mkdirSync, existsSync, readFileSync, statSync,
+  writeFileSync, mkdirSync, readFileSync, statSync,
 } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { spawnSync as realSpawnSync } from 'node:child_process';
@@ -101,13 +101,18 @@ import {
   PLAIN_FOLDER_DEFERRED_FIELDS,
 } from './authorjob.js';
 import {
-  SOURCE_FIELD, destinationFieldFor, labelsFor,
+  INPUTS_FIELD, JOB_BLOCK_HELP, destinationFieldFor, labelsFor, SOFTGREEN_JUDGE_EXAMPLES_KEY,
 } from './authorflow.js';
+import {
+  parseJobBlock, parseInputs, renderJobLines, renderExamples, jobBlockFitsCheck, signedJobLines,
+} from './jobblock.js';
 import { validateJob, validateBaseUrl, PROVIDERS } from './job.js';
 import { resolveProvider, probeWarningLines, apiKeyProblem } from './providers.js';
 import { scanSecrets, redactSecrets } from './validate.js';
 import { detectLanguage } from './detectlang.js';
-import { prepareSource, proveDestination, looksLikeRepoSource, missingDependencies } from './source.js';
+import {
+  prepareSource, proveDestination, looksLikeRepoSource, missingDependencies, proveInputFiles,
+} from './source.js';
 import { parseCeiling, ceilingLine } from './authorreadout.js';
 import { commandFor } from './invoke.js';
 
@@ -353,18 +358,26 @@ export async function main(argv, deps = {}) {
     throw new ExitSignal(1);
   }
 
-  // ── 1. SOURCE — the form's first field (PRD item 33 M3, ruling 2) ────────────
+  // ── 1. INPUTS — the form's first field (P7, docs/product/PANEL-BUILD.md; replaces Source) ───────────────
+  // Line 1 is the repo (the Source this door has always taken); lines 2+ are tracked files inside it, proven at $0
+  // by `proveInputFiles` — the same function the panel calls. A bad line re-asks, naming the line.
   say('');
-  say('── SOURCE ' + '─'.repeat(58));
-  // LIBRARY WORDING (PRD item 33 M3 piece 3, ruling 1) — this script prints what
-  // `src/authorflow.js` hands it and writes none of its own.
-  say(SOURCE_FIELD.prompt);
-  const sourceRaw = await readAnswer('the source',
-    'Source is required — this is what the job reads. Again:');
-  const isUrl = /^https?:\/\//i.test(sourceRaw);
-  const SOURCE = isUrl ? sourceRaw : resolve(sourceRaw);
-  if (!isUrl && !existsSync(SOURCE)) {
-    die(`${SOURCE} does not exist — Source is a folder, subfolder, file, or URL bareloop can actually read.`);
+  say('── INPUTS ' + '─'.repeat(58));
+  // LIBRARY WORDING — this script prints what `src/authorflow.js` hands it and writes none of its own.
+  say(INPUTS_FIELD.prompt);
+  /** @type {import('./jobblock.js').JobInput[]} */
+  let INPUTS = [];
+  /** @type {string} */
+  let SOURCE = '';
+  for (;;) {
+    const raw = await readAnswer('the inputs', 'Inputs is required — line 1 is the repo this job reads. Again:');
+    const parsed = parseInputs(raw);
+    if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+    const proof = await proveInputFiles(parsed.inputs);
+    if (!proof.ok) { say(`  ${proof.error}`); continue; }
+    INPUTS = parsed.inputs;
+    SOURCE = proof.repo;
+    break;
   }
   // the SAME rule `prepareSource` uses to route its own destination check
   // (`looksLikeRepoSource`, `src/source.js`) — never a second, hand-typed copy
@@ -401,7 +414,7 @@ export async function main(argv, deps = {}) {
   //                       ruling 7): a plain-folder job still gets the form; it
   //                       only gets an honest "no checks yet" stop later (M4).
   let LANG = 'none-detected';
-  if (!isUrl && statSync(SOURCE).isDirectory()) {
+  if (statSync(SOURCE).isDirectory()) {
     const langResult = detectLanguage(SOURCE);
     if (langResult.kind === 'ambiguous') {
       // NO LONGER DIES (PRD item 33 M3 piece 4, step S5): `LANG` takes the
@@ -560,25 +573,38 @@ export async function main(argv, deps = {}) {
   say(`  asks     ${REQUIRED.length} frozen question(s) for this class, then the numbers and names the job spec needs`);
 
   // ── 3. the class's own frozen questions, one at a time ───────────────────────
+  // P7: "The job" is ONE multi-line answer — numbered lines with their `~` rules, parsed by `parseJobBlock` (the same
+  // parser the panel uses) and filed under key 1 as the numbered text the drafter reads. A rubric's second answer
+  // (the judge examples) is DERIVED from the `~ PASS:`/`~ FAIL:` lines of that block, never asked a second time.
   /** @type {Record<string, string>} */
   const answers = {};
+  /** @type {import('./jobblock.js').JobLine[]} */
+  let JOB_LINES = [];
+  const ASKED = REQUIRED.filter((n) => !(VERDICT === 'soft-green' && n === SOFTGREEN_JUDGE_EXAMPLES_KEY));
   let asked = 0;
-  for (const n of REQUIRED) {
+  for (const n of ASKED) {
     asked += 1;
     say('');
-    say(`── ${asked} of ${REQUIRED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
-    // the FIELD LABEL, from the signed table (PRD item 33 M3 piece 3's wording
-    // fix) — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
-    // stays byte-identical to what the library holds, which is what the wizard
-    // test suite (`tests/run-interview.test.js`) asserts verbatim and in order.
-    // A key with no signed-table row prints no label.
+    say(`── ${asked} of ${ASKED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
+    // the FIELD LABEL, from the signed table — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
+    // stays byte-identical to what the library holds. A key with no signed-table row prints no label.
     if (LABELS[n]) say(LABELS[n]);
-    // the frozen wording, printed as the library holds it. Numbered by the library's
-    // own key, so the number a person sees is the number their answer is filed under.
+    // the frozen wording, printed as the library holds it. Numbered by the library's own key.
     say(`${n}. ${QUESTIONS[n]}`);
-    answers[n] = await readAnswer(`question ${n}`,
-      'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+    for (const h of JOB_BLOCK_HELP) say(`   ${h}`);
+    for (;;) {
+      const raw = await readAnswer(`question ${n}`,
+        'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+      const parsed = parseJobBlock(raw);
+      if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+      const misfit = jobBlockFitsCheck(parsed.lines, VERDICT === 'soft-green');
+      if (misfit) { say(`  ${misfit}`); continue; }
+      JOB_LINES = parsed.lines;
+      answers[n] = renderJobLines(parsed.lines);
+      break;
+    }
   }
+  if (VERDICT === 'soft-green') answers[SOFTGREEN_JUDGE_EXAMPLES_KEY] = renderExamples(JOB_LINES);
 
   // ── 4. the OPERATOR's half of the spec — the part nothing authors for you ────
   say('');
@@ -667,6 +693,9 @@ export async function main(argv, deps = {}) {
     // meaningless fence derived from an output directory.
     ...(writeScope === null ? {} : { writeScope }),
     escalation: { mode: 'decision-ready' },
+    // P7: the person's own words, signed beside the model's goal sentence — what the Job tab and Reuse show back
+    jobLines: signedJobLines(JOB_LINES),
+    inputs: INPUTS,
     // `tools` is deliberately OMITTED: an omitted menu hashes as the concrete current
     // TOOL_MENU (MED-1), which pins WHICH menu was signed and makes a widening flip the
     // hash. Naming one here would freeze today's list into the operator's own half.

package/src/job.js

@@ -1,5 +1,5 @@
 // Job-spec validator — the OPERATOR-owned half of the config story (N1,
-// design record: docs/product/2026-07-12-n1-job-close-schema-design.md).
+// design record: docs/logs/2026-07-12-n1-job-close-schema-design.md).
 // A job spec is the arbiter's rulebook: the close chain, the budget, the
 // outer write fence, the escalation route. It is pure declarative data —
 // no freeform code is expressible anywhere in it — and it validates
@@ -167,7 +167,7 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
 /** the exact fields of a signed `judge` override — nested objects red unknown
  * keys too, because no smuggling level exists in a signed spec */
 const JUDGE_FIELDS = ['provider', 'model'];
@@ -717,6 +717,39 @@ function validateStagedClose(stages, red) {
  * @param {Red[]} reds direct access for structured request-reds
  */
 function validatePlanShape(spec, red, reds) {
+  // P7: the person's own words, signed beside the model's goal sentence. Exact fields (no smuggling level), numbered 1..n
+  // in order. Optional: a spec that predates the job block has neither and keeps its hash.
+  if (spec.jobLines !== undefined) {
+    if (!Array.isArray(spec.jobLines) || spec.jobLines.length === 0) red('invalid-value', 'jobLines', 'a non-empty array of {n, text, rule}');
+    else {
+      spec.jobLines.forEach((/** @type {any} */ l, /** @type {number} */ i) => {
+        const at = `jobLines[${i}]`;
+        if (!isObj(l)) { red('invalid-value', at, '{n, text, rule}'); return; }
+        for (const key of Object.keys(l)) if (!['n', 'text', 'rule', 'rules'].includes(key)) red('unknown-field', `${at}.${key}`, 'job line fields: n, text, rule, rules');
+        if (l.n !== i + 1) red('invalid-value', `${at}.n`, `lines are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(l.text)) red('invalid-value', `${at}.text`, 'non-empty text');
+        if (typeof l.rule !== 'string') red('invalid-value', `${at}.rule`, 'a string ("" when the line has no ~ rule)');
+        // optional, beside `rule`: the same `~` lines one by one; it must join back to `rule` exactly
+        if (l.rules !== undefined && (!Array.isArray(l.rules) || l.rules.some((/** @type {any} */ r) => !isNonEmptyString(r)) || l.rules.join('; ') !== l.rule)) {
+          red('invalid-value', `${at}.rules`, 'an array of the ~ lines that joins with "; " to exactly `rule`');
+        }
+      });
+    }
+  }
+  if (spec.inputs !== undefined) {
+    if (!Array.isArray(spec.inputs) || spec.inputs.length === 0) red('invalid-value', 'inputs', 'a non-empty array of {n, label, value}');
+    else {
+      spec.inputs.forEach((/** @type {any} */ x, /** @type {number} */ i) => {
+        const at = `inputs[${i}]`;
+        if (!isObj(x)) { red('invalid-value', at, '{n, label, value}'); return; }
+        for (const key of Object.keys(x)) if (!['n', 'label', 'value'].includes(key)) red('unknown-field', `${at}.${key}`, 'input fields: n, label, value');
+        if (x.n !== i + 1) red('invalid-value', `${at}.n`, `inputs are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(x.label)) red('invalid-value', `${at}.label`, 'non-empty text');
+        if (!isNonEmptyString(x.value)) red('invalid-value', `${at}.value`, 'non-empty text');
+      });
+    }
+  }
+
   if (spec.goal === undefined) red('missing-required', 'goal');
   else if (!isNonEmptyString(spec.goal)) red('invalid-value', 'goal', 'non-empty text — the goal is what the agent plans against');
 
@@ -757,7 +790,7 @@ function validatePlanShape(spec, red, reds) {
     // class the user picked (PRD v1.57 §2), so the gate cannot check D5 without
     // it. An unknown or locked class is refused there, on its own axis, beside
     // the counted `request-red` above.
-    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType });
+    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null });
     for (const r of cd.reds) reds.push(r);
     if (demanded !== undefined && !CLASS_BY_CLOSE.declared.includes(demanded)) {
       // the same laundering guard as the close-type hierarchy, one level up: a
@@ -886,11 +919,11 @@ export function jobSpecHash(job) {
 
 /**
  * The fields a "Reuse workflow" run may change: where the work lands (the write fence, `writeScope`, and a
- * `destination`/`source` where a spec ever carries them) and the two ceilings. Everything else in a signed spec is
+ * `destination`/`source` where a spec ever carries them), the `inputs` the person pointed at (P7: Inputs is open on a reuse) and the two ceilings. Everything else in a signed spec is
  * the WORKFLOW — goal, checks, guardrails, close (the worker model is the third kind, {@link WORKFLOW_KEY_IDENTITY_FIELDS}). ONE list, shared by {@link workflowKey} and by the panel's
  * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
  */
-export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs']);
+export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs', 'inputs']);
 
 /**
  * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name