bareloop 0.39.0 → 0.40.0

package/src/interviewrun.js

@@ -31,7 +31,7 @@
 //     form (PRD item 33 M3 piece 3): Goal / Success / Guardrails, soft-green
 //     adding Judge Examples. Source and Destination are MECHANICAL fields —
 //     proven against the machine rather than typed — and their wording is
-//     ALSO the library's (`SOURCE_FIELD`, `destinationFieldFor`,
+//     ALSO the library's (`INPUTS_FIELD`, `destinationFieldFor`,
 //     `src/authorflow.js`), so this module prints what the library hands it
 //     for all six fields, never re-worded here, never re-ordered, never stored;
 //   - the REFUSALS are the library's (`runInterview`): a locked class refuses at
@@ -89,7 +89,7 @@
 import { keysForDoor } from './keysfile.js';
 import { applyConfiguredKey, rowsForHome } from './providerrows.js';
 import {
-  writeFileSync, mkdirSync, existsSync, readFileSync, statSync,
+  writeFileSync, mkdirSync, readFileSync, statSync,
 } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { spawnSync as realSpawnSync } from 'node:child_process';
@@ -101,13 +101,18 @@ import {
   PLAIN_FOLDER_DEFERRED_FIELDS,
 } from './authorjob.js';
 import {
-  SOURCE_FIELD, destinationFieldFor, labelsFor,
+  INPUTS_FIELD, JOB_BLOCK_HELP, destinationFieldFor, labelsFor, SOFTGREEN_JUDGE_EXAMPLES_KEY,
 } from './authorflow.js';
+import {
+  parseJobBlock, parseInputs, renderJobLines, renderExamples, jobBlockFitsCheck, signedJobLines,
+} from './jobblock.js';
 import { validateJob, validateBaseUrl, PROVIDERS } from './job.js';
 import { resolveProvider, probeWarningLines, apiKeyProblem } from './providers.js';
 import { scanSecrets, redactSecrets } from './validate.js';
 import { detectLanguage } from './detectlang.js';
-import { prepareSource, proveDestination, looksLikeRepoSource, missingDependencies } from './source.js';
+import {
+  prepareSource, proveDestination, looksLikeRepoSource, missingDependencies, proveInputFiles,
+} from './source.js';
 import { parseCeiling, ceilingLine } from './authorreadout.js';
 import { commandFor } from './invoke.js';
 
@@ -353,18 +358,26 @@ export async function main(argv, deps = {}) {
     throw new ExitSignal(1);
   }
 
-  // ── 1. SOURCE — the form's first field (PRD item 33 M3, ruling 2) ────────────
+  // ── 1. INPUTS — the form's first field (P7, docs/product/PANEL-BUILD.md; replaces Source) ───────────────
+  // Line 1 is the repo (the Source this door has always taken); lines 2+ are tracked files inside it, proven at $0
+  // by `proveInputFiles` — the same function the panel calls. A bad line re-asks, naming the line.
   say('');
-  say('── SOURCE ' + '─'.repeat(58));
-  // LIBRARY WORDING (PRD item 33 M3 piece 3, ruling 1) — this script prints what
-  // `src/authorflow.js` hands it and writes none of its own.
-  say(SOURCE_FIELD.prompt);
-  const sourceRaw = await readAnswer('the source',
-    'Source is required — this is what the job reads. Again:');
-  const isUrl = /^https?:\/\//i.test(sourceRaw);
-  const SOURCE = isUrl ? sourceRaw : resolve(sourceRaw);
-  if (!isUrl && !existsSync(SOURCE)) {
-    die(`${SOURCE} does not exist — Source is a folder, subfolder, file, or URL bareloop can actually read.`);
+  say('── INPUTS ' + '─'.repeat(58));
+  // LIBRARY WORDING — this script prints what `src/authorflow.js` hands it and writes none of its own.
+  say(INPUTS_FIELD.prompt);
+  /** @type {import('./jobblock.js').JobInput[]} */
+  let INPUTS = [];
+  /** @type {string} */
+  let SOURCE = '';
+  for (;;) {
+    const raw = await readAnswer('the inputs', 'Inputs is required — line 1 is the repo this job reads. Again:');
+    const parsed = parseInputs(raw);
+    if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+    const proof = await proveInputFiles(parsed.inputs);
+    if (!proof.ok) { say(`  ${proof.error}`); continue; }
+    INPUTS = parsed.inputs;
+    SOURCE = proof.repo;
+    break;
   }
   // the SAME rule `prepareSource` uses to route its own destination check
   // (`looksLikeRepoSource`, `src/source.js`) — never a second, hand-typed copy
@@ -401,7 +414,7 @@ export async function main(argv, deps = {}) {
   //                       ruling 7): a plain-folder job still gets the form; it
   //                       only gets an honest "no checks yet" stop later (M4).
   let LANG = 'none-detected';
-  if (!isUrl && statSync(SOURCE).isDirectory()) {
+  if (statSync(SOURCE).isDirectory()) {
     const langResult = detectLanguage(SOURCE);
     if (langResult.kind === 'ambiguous') {
       // NO LONGER DIES (PRD item 33 M3 piece 4, step S5): `LANG` takes the
@@ -560,25 +573,38 @@ export async function main(argv, deps = {}) {
   say(`  asks     ${REQUIRED.length} frozen question(s) for this class, then the numbers and names the job spec needs`);
 
   // ── 3. the class's own frozen questions, one at a time ───────────────────────
+  // P7: "The job" is ONE multi-line answer — numbered lines with their `~` rules, parsed by `parseJobBlock` (the same
+  // parser the panel uses) and filed under key 1 as the numbered text the drafter reads. A rubric's second answer
+  // (the judge examples) is DERIVED from the `~ PASS:`/`~ FAIL:` lines of that block, never asked a second time.
   /** @type {Record<string, string>} */
   const answers = {};
+  /** @type {import('./jobblock.js').JobLine[]} */
+  let JOB_LINES = [];
+  const ASKED = REQUIRED.filter((n) => !(VERDICT === 'soft-green' && n === SOFTGREEN_JUDGE_EXAMPLES_KEY));
   let asked = 0;
-  for (const n of REQUIRED) {
+  for (const n of ASKED) {
     asked += 1;
     say('');
-    say(`── ${asked} of ${REQUIRED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
-    // the FIELD LABEL, from the signed table (PRD item 33 M3 piece 3's wording
-    // fix) — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
-    // stays byte-identical to what the library holds, which is what the wizard
-    // test suite (`tests/run-interview.test.js`) asserts verbatim and in order.
-    // A key with no signed-table row prints no label.
+    say(`── ${asked} of ${ASKED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
+    // the FIELD LABEL, from the signed table — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
+    // stays byte-identical to what the library holds. A key with no signed-table row prints no label.
     if (LABELS[n]) say(LABELS[n]);
-    // the frozen wording, printed as the library holds it. Numbered by the library's
-    // own key, so the number a person sees is the number their answer is filed under.
+    // the frozen wording, printed as the library holds it. Numbered by the library's own key.
     say(`${n}. ${QUESTIONS[n]}`);
-    answers[n] = await readAnswer(`question ${n}`,
-      'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+    for (const h of JOB_BLOCK_HELP) say(`   ${h}`);
+    for (;;) {
+      const raw = await readAnswer(`question ${n}`,
+        'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+      const parsed = parseJobBlock(raw);
+      if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+      const misfit = jobBlockFitsCheck(parsed.lines, VERDICT === 'soft-green');
+      if (misfit) { say(`  ${misfit}`); continue; }
+      JOB_LINES = parsed.lines;
+      answers[n] = renderJobLines(parsed.lines);
+      break;
+    }
   }
+  if (VERDICT === 'soft-green') answers[SOFTGREEN_JUDGE_EXAMPLES_KEY] = renderExamples(JOB_LINES);
 
   // ── 4. the OPERATOR's half of the spec — the part nothing authors for you ────
   say('');
@@ -667,6 +693,9 @@ export async function main(argv, deps = {}) {
     // meaningless fence derived from an output directory.
     ...(writeScope === null ? {} : { writeScope }),
     escalation: { mode: 'decision-ready' },
+    // P7: the person's own words, signed beside the model's goal sentence — what the Job tab and Reuse show back
+    jobLines: signedJobLines(JOB_LINES),
+    inputs: INPUTS,
     // `tools` is deliberately OMITTED: an omitted menu hashes as the concrete current
     // TOOL_MENU (MED-1), which pins WHICH menu was signed and makes a widening flip the
     // hash. Naming one here would freeze today's list into the operator's own half.

package/src/job.js

@@ -1,5 +1,5 @@
 // Job-spec validator — the OPERATOR-owned half of the config story (N1,
-// design record: docs/product/2026-07-12-n1-job-close-schema-design.md).
+// design record: docs/logs/2026-07-12-n1-job-close-schema-design.md).
 // A job spec is the arbiter's rulebook: the close chain, the budget, the
 // outer write fence, the escalation route. It is pure declarative data —
 // no freeform code is expressible anywhere in it — and it validates
@@ -167,7 +167,7 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
 /** the exact fields of a signed `judge` override — nested objects red unknown
  * keys too, because no smuggling level exists in a signed spec */
 const JUDGE_FIELDS = ['provider', 'model'];
@@ -717,6 +717,39 @@ function validateStagedClose(stages, red) {
  * @param {Red[]} reds direct access for structured request-reds
  */
 function validatePlanShape(spec, red, reds) {
+  // P7: the person's own words, signed beside the model's goal sentence. Exact fields (no smuggling level), numbered 1..n
+  // in order. Optional: a spec that predates the job block has neither and keeps its hash.
+  if (spec.jobLines !== undefined) {
+    if (!Array.isArray(spec.jobLines) || spec.jobLines.length === 0) red('invalid-value', 'jobLines', 'a non-empty array of {n, text, rule}');
+    else {
+      spec.jobLines.forEach((/** @type {any} */ l, /** @type {number} */ i) => {
+        const at = `jobLines[${i}]`;
+        if (!isObj(l)) { red('invalid-value', at, '{n, text, rule}'); return; }
+        for (const key of Object.keys(l)) if (!['n', 'text', 'rule', 'rules'].includes(key)) red('unknown-field', `${at}.${key}`, 'job line fields: n, text, rule, rules');
+        if (l.n !== i + 1) red('invalid-value', `${at}.n`, `lines are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(l.text)) red('invalid-value', `${at}.text`, 'non-empty text');
+        if (typeof l.rule !== 'string') red('invalid-value', `${at}.rule`, 'a string ("" when the line has no ~ rule)');
+        // optional, beside `rule`: the same `~` lines one by one; it must join back to `rule` exactly
+        if (l.rules !== undefined && (!Array.isArray(l.rules) || l.rules.some((/** @type {any} */ r) => !isNonEmptyString(r)) || l.rules.join('; ') !== l.rule)) {
+          red('invalid-value', `${at}.rules`, 'an array of the ~ lines that joins with "; " to exactly `rule`');
+        }
+      });
+    }
+  }
+  if (spec.inputs !== undefined) {
+    if (!Array.isArray(spec.inputs) || spec.inputs.length === 0) red('invalid-value', 'inputs', 'a non-empty array of {n, label, value}');
+    else {
+      spec.inputs.forEach((/** @type {any} */ x, /** @type {number} */ i) => {
+        const at = `inputs[${i}]`;
+        if (!isObj(x)) { red('invalid-value', at, '{n, label, value}'); return; }
+        for (const key of Object.keys(x)) if (!['n', 'label', 'value'].includes(key)) red('unknown-field', `${at}.${key}`, 'input fields: n, label, value');
+        if (x.n !== i + 1) red('invalid-value', `${at}.n`, `inputs are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(x.label)) red('invalid-value', `${at}.label`, 'non-empty text');
+        if (!isNonEmptyString(x.value)) red('invalid-value', `${at}.value`, 'non-empty text');
+      });
+    }
+  }
+
   if (spec.goal === undefined) red('missing-required', 'goal');
   else if (!isNonEmptyString(spec.goal)) red('invalid-value', 'goal', 'non-empty text — the goal is what the agent plans against');
 
@@ -757,7 +790,7 @@ function validatePlanShape(spec, red, reds) {
     // class the user picked (PRD v1.57 §2), so the gate cannot check D5 without
     // it. An unknown or locked class is refused there, on its own axis, beside
     // the counted `request-red` above.
-    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope });
+    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null });
     for (const r of cd.reds) reds.push(r);
     if (demanded !== undefined && !CLASS_BY_CLOSE.declared.includes(demanded)) {
       // the same laundering guard as the close-type hierarchy, one level up: a
@@ -886,11 +919,11 @@ export function jobSpecHash(job) {
 
 /**
  * The fields a "Reuse workflow" run may change: where the work lands (the write fence, `writeScope`, and a
- * `destination`/`source` where a spec ever carries them) and the two ceilings. Everything else in a signed spec is
+ * `destination`/`source` where a spec ever carries them), the `inputs` the person pointed at (P7: Inputs is open on a reuse) and the two ceilings. Everything else in a signed spec is
  * the WORKFLOW — goal, checks, guardrails, close (the worker model is the third kind, {@link WORKFLOW_KEY_IDENTITY_FIELDS}). ONE list, shared by {@link workflowKey} and by the panel's
  * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
  */
-export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs']);
+export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs', 'inputs']);
 
 /**
  * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name

package/src/jobblock.js

@@ -0,0 +1,140 @@
+// The "job" block's parser (P7, docs/product/PANEL-BUILD.md "Addendum 2026-10-10"): ONE owner of how the person's
+// own multi-line words become numbered job lines and numbered inputs. The panel server AND the CLI interview both
+// call these two functions, so the two doors can never read the same text two ways.
+//
+// Both are pure and $0: a malformed block is a named red `{ok: false, error}`, never a throw and never a guess.
+
+/** @typedef {{verdict: 'PASS'|'FAIL', text: string}} JobExample a `~ PASS:` / `~ FAIL:` line (rubric only), kept with its job line */
+/** @typedef {{n: number, text: string, rule: string, rules: string[], examples: JobExample[]}} JobLine one numbered job line; `rule` = its `~` lines joined with '; ' ('' when none), `rules` = those same `~` lines one by one (so an example's own '; ' survives) */
+/** @typedef {{n: number, label: string, value: string}} JobInput one numbered `label: value` input line */
+
+/** the joiner for consecutive `~` lines (fwd's joinGuardrails) */
+export const RULE_JOINER = '; ';
+
+/**
+ * Parse "The job" box. A plain line is a numbered job line (1, 2, 3...). A line starting `~` has no number and belongs
+ * to the numbered line above; consecutive `~` lines become ONE rule joined with `'; '`. A `~` line starting `PASS:` or
+ * `FAIL:` is also a judge example (kept with its line number); any other `~` line is a guardrail. Empty lines are
+ * ignored. A `~` before line 1 is a red.
+ * @param {unknown} text the box's raw text
+ * @returns {{ok: true, lines: JobLine[]}|{ok: false, error: string}}
+ */
+export function parseJobBlock(text) {
+  if (typeof text !== 'string') return { ok: false, error: 'The job is required' };
+  /** @type {JobLine[]} */
+  const lines = [];
+  /** @type {string[]} */
+  let rule = [];
+  const flush = () => { if (lines.length) { lines[lines.length - 1].rule = rule.join(RULE_JOINER); lines[lines.length - 1].rules = rule; } rule = []; };
+  let row = 0;
+  for (const raw of text.split(/\r?\n/)) {
+    const t = raw.trim();
+    if (t === '') continue;
+    row += 1;
+    if (t.startsWith('~')) {
+      if (lines.length === 0) return { ok: false, error: `The job, line ${row}: a "~" line belongs to the numbered line above it, and there is none yet` };
+      const body = t.slice(1).trim();
+      if (body === '') continue;
+      rule.push(body);
+      const m = /^(PASS|FAIL):\s*(.*)$/i.exec(body);
+      if (m) {
+        if (m[2].trim() === '') return { ok: false, error: `The job, line ${row}: "${m[1].toUpperCase()}:" needs an example after it` };
+        lines[lines.length - 1].examples.push({ verdict: /** @type {'PASS'|'FAIL'} */ (m[1].toUpperCase()), text: m[2].trim() });
+      }
+      continue;
+    }
+    flush();
+    lines.push({ n: lines.length + 1, text: t, rule: '', rules: [], examples: [] });
+  }
+  flush();
+  if (lines.length === 0) return { ok: false, error: 'The job is required' };
+  return { ok: true, lines };
+}
+
+/** a label: a word or two, no colon */
+const LABEL_RE = /^[A-Za-z][A-Za-z0-9_ -]{0,39}$/;
+
+/**
+ * Parse the "Inputs" box: one `label: value` per line, numbered 1, 2, 3 in the order written. Empty lines are ignored.
+ * This only checks the SHAPE — what a value must point at (line 1 an absolute repo, lines 2+ tracked files inside it)
+ * is proven by the panel at $0.
+ * @param {unknown} text
+ * @returns {{ok: true, inputs: JobInput[]}|{ok: false, error: string}}
+ */
+export function parseInputs(text) {
+  if (typeof text !== 'string') return { ok: false, error: 'Inputs is required' };
+  /** @type {JobInput[]} */
+  const inputs = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const t = raw.trim();
+    if (t === '') continue;
+    const n = inputs.length + 1;
+    const i = t.indexOf(':');
+    const label = i < 0 ? '' : t.slice(0, i).trim();
+    const value = i < 0 ? '' : t.slice(i + 1).trim();
+    if (!LABEL_RE.test(label) || value === '') return { ok: false, error: `Inputs, line ${n}: write it as "label: value"` };
+    inputs.push({ n, label, value });
+  }
+  if (inputs.length === 0) return { ok: false, error: 'Inputs is required' };
+  return { ok: true, inputs };
+}
+
+/**
+ * The person's job lines as the drafter reads them (answer 1 of the interview): each numbered line, then its rule
+ * (the `~` lines joined) indented under it. One spelling, so the number the person typed beside a line is the number a
+ * stage's `fromLine` names.
+ * @param {JobLine[]} lines
+ * @returns {string}
+ */
+export function renderJobLines(lines) {
+  return lines.map((l) => `${l.n}. ${l.text}${l.rule ? `\n   rule: ${l.rule}` : ''}`).join('\n');
+}
+
+/**
+ * The PASS:/FAIL: examples the person wrote, each kept with its line number (answer 2 of a rubric interview — what the
+ * calibration compile reads). Empty string when there are none.
+ * @param {JobLine[]} lines
+ * @returns {string}
+ */
+export function renderExamples(lines) {
+  return lines.flatMap((l) => l.examples.map((e) => `line ${l.n} ${e.verdict}: ${e.text}`)).join('\n');
+}
+
+/**
+ * The inputs as the drafter is told about them: "the person pointed at these inputs: N label path".
+ * @param {JobInput[]} inputs
+ * @returns {string}
+ */
+export function renderInputs(inputs) {
+  return `the person pointed at these inputs: ${inputs.map((i) => `${i.n} ${i.label} ${i.value}`).join(' · ')}`;
+}
+
+/**
+ * The two cross-checks between a parsed job block and the Check type: a RUBRIC job needs at least one `PASS:` and one
+ * `FAIL:` example (the calibration compile reads them); a DETERMINISTIC job has no judge, so an example line would be
+ * silently dropped — a red instead.
+ * @param {JobLine[]} lines
+ * @param {boolean} rubric
+ * @returns {string|null} the plain red, or null when the block fits the Check type
+ */
+export function jobBlockFitsCheck(lines, rubric) {
+  const all = lines.flatMap((l) => l.examples.map((e) => ({ n: l.n, ...e })));
+  if (!rubric) {
+    return all.length ? `The job, line ${all[0].n}: PASS:/FAIL: examples are for a Rubric check — a Deterministic job has no judge to read them` : null;
+  }
+  if (!all.some((e) => e.verdict === 'PASS') || !all.some((e) => e.verdict === 'FAIL')) {
+    return 'The job: a Rubric check needs at least one "~ PASS:" line and one "~ FAIL:" line under a job line';
+  }
+  return null;
+}
+
+/**
+ * The signed `jobLines` field from parsed lines: the person's own words, `{n, text, rule, rules}` (examples stay inside the
+ * rule text, where the person wrote them). `rules` is the same `~` lines as an array, BESIDE the joined `rule` (never
+ * replacing it); it is omitted on a line with no `~` line, and an older spec lacks it entirely.
+ * @param {JobLine[]} lines
+ * @returns {{n: number, text: string, rule: string, rules?: string[]}[]}
+ */
+export function signedJobLines(lines) {
+  return lines.map((l) => ({ n: l.n, text: l.text, rule: l.rule, ...(l.rules.length ? { rules: [...l.rules] } : {}) }));
+}

package/src/judged.js

@@ -1,5 +1,5 @@
 // THE JUDGED FLOOR'S CORE — softgreen module 1 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4, plus the
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4, plus the
 // 2026-08-18 threshold addendum). POC: poc/softgreen-judge/poc.mjs — validated
 // logic, rewritten here, never copied (graduation is a rewrite).
 //

package/src/ledger.js

@@ -1,5 +1,5 @@
 // The upstream ledger (module 4) — reactive lib/primitive incident monitoring.
-// Design record: docs/product/2026-07-11-upstream-ledger-design.md (adaptlearn
+// Design record: docs/logs/2026-07-11-upstream-ledger-design.md (adaptlearn
 // POC'd spec) + its 2026-07-13 addendum: the bareloop event mapping. One
 // append-only JSONL both the consumer (the panel, N6) and the maintainer read;
 // the A1/A2/A3 upstream-ask flow, mechanized — evidence in, human judgment out.

package/src/panel/authorroutes.js

@@ -23,6 +23,8 @@ import { openSync } from 'node:fs';
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { createSession, validateJobCard, validateReuseCard, lockedFieldChanged, buildReuseSpec, cardFields, STEP_LABELS } from './authorsession.js';
+import { parseInputs } from '../jobblock.js';
+import { proveInputFiles } from '../source.js';
 import { validateJob } from '../job.js';
 import { checkMonthlyRoom, monthlyRefusalText } from '../monthly.js';
 import { ConfigError } from '../config.js';
@@ -274,11 +276,19 @@ export function createAuthorRoutes(opts) {
         const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows });
         if (!v.ok) { send(400, { ok: false, error: v.error }); return true; }
       }
-      const session = createSession(cardFields(card), {
-        env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}), ...(reuse ? { reuse } : {}),
-      });
-      sessions.set(session.id, session);
-      send(200, { ok: true, sessionId: session.id, reuse: reuse !== null, state: session.state });
+      // P7: the Inputs are proven at $0 before a session (so before any token): line 1 the repo, lines 2+ tracked files inside it.
+      // A miss is a plain 400 naming the line, shown under the card exactly like every other refused start.
+      const ip = parseInputs(card.inputs);
+      if (!ip.ok) { send(400, { ok: false, error: ip.error }); return true; }
+      proveInputFiles(ip.inputs).then((proof) => {
+        if (!proof.ok) { send(400, { ok: false, error: proof.error }); return; }
+        if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return; }
+        const session = createSession(cardFields(card), {
+          env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}), ...(reuse ? { reuse } : {}),
+        });
+        sessions.set(session.id, session);
+        send(200, { ok: true, sessionId: session.id, reuse: reuse !== null, state: session.state });
+      }).catch((e) => { send(500, { ok: false, error: `could not check the inputs: ${/** @type {Error} */ (e)?.message ?? e}` }); });
       return true;
     }