bareloop 0.39.0 → 0.41.0

package/src/thinking.js

@@ -0,0 +1,130 @@
+// rewritten-from: fwdloop src/thinking.js@f9449e8
+// PANEL-BUILD.md P8 batch 5 — THE one owner of what a drafting or judging model call sends for thinking. bareloop keeps NO per-model
+// thinking list and NO vendor regex: bare-agent (>=0.52) owns which request shape switches thinking for which model, and
+// `thinkingSupport(kind, model, {baseUrl})` is its own pure lookup (no network): `true` (measured switchable), `false` (measured
+// NOT switchable), `'unverified'` (not measured — the shape ladder is tried at runtime; if every shape fails with a client
+// validation error ONE plain request decides, and the call still runs, reported `thinkingStatus: 'unsupported'`).
+//
+// The tick is the person's, per job ("Thinking on", the signed optional `thinking` field; absent = off). It covers DRAFTING and the
+// rubric JUDGE; the WORKER is never handed a thinking option. PER-CALL options, never constructor options (the drafter's provider is
+// the worker's instance, deliberately left as it was). The raw `thinking` option is never sent (bare-agent throws if both are set).
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { thinkingSupport: baseSupport, AnthropicProvider, OpenAIProvider, GeminiProvider } = require('bare-agent/providers');
+
+/** The words under a greyed "Thinking on" box (the server's `thinking.canChange` decides; the page decides nothing). */
+export const THINKING_FIXED_SAY = "can't change this for this model";
+
+/** API shape id -> bare-agent's thinking-ladder kind. A missing shape (clipipe, a test double) has no kind. */
+const KIND_OF_SHAPE = Object.freeze({ 'anthropic-api': 'anthropic', 'openai-api': 'openai', 'gemini-api': 'gemini' });
+
+/**
+ * What bare-agent knows about switching this model's thinking. A missing kind, a non-function `impl`, or a throw all read
+ * `'unverified'` — never a guess in either direction.
+ * @param {string} shape an API shape id (src/providershapes.js)
+ * @param {string} model
+ * @param {{ baseUrl?: string|null, impl?: Function }} [o] `impl` is a test seam; production uses bare-agent's own
+ * @returns {true|false|'unverified'}
+ */
+export function thinkingSupport(shape, model, { baseUrl, impl = baseSupport } = {}) {
+  const kind = /** @type {Record<string, string>} */ (KIND_OF_SHAPE)[shape];
+  if (kind === undefined || typeof impl !== 'function') return 'unverified';
+  try {
+    const r = impl(kind, model, baseUrl ? { baseUrl } : undefined);
+    return r?.switchable === true ? true : (r?.switchable === false ? false : 'unverified');
+  } catch { return 'unverified'; }
+}
+
+/**
+ * The per-call options for one support answer and one tick (`true` = "Thinking on"). The table (PANEL-BUILD.md P8, ruling Q1):
+ *   tick on : true -> on | false -> {} (the box is greyed, cannot be on) | 'unverified' -> on
+ *   tick off: true -> off | false -> {} (the model thinks as it would) | 'unverified' -> off (bare-agent decides; plain request on failure)
+ * @param {true|false|'unverified'} support
+ * @param {boolean} tick
+ * @returns {{ thinkingMode: 'on'|'off' } | {}}
+ */
+export function thinkingOptions(support, tick) {
+  if (support === false) return {};
+  return { thinkingMode: tick ? 'on' : 'off' };
+}
+
+/** The enumerated operator knob a drafting call is built with: 'on' | 'off' (the tick, spelled as a word). */
+export const THINKING_MODES = Object.freeze(['on', 'off']);
+
+/**
+ * Throw unless `mode` is one of {@link THINKING_MODES} — an operator-param guard, so a typo never silently means a mode.
+ * @param {unknown} mode
+ * @returns {'on'|'off'}
+ */
+export function assertThinkingMode(mode) {
+  if (mode === 'on' || mode === 'off') return mode;
+  throw new Error(`[thinking] draftThinking must be one of ${THINKING_MODES.join(' | ')}, got ${JSON.stringify(mode)}`);
+}
+
+/**
+ * The API shape of a constructed bare-agent provider (the three client classes only); `null` for a test double or a clipipe.
+ * @param {any} provider
+ * @returns {string|null}
+ */
+export function shapeOfProvider(provider) {
+  if (provider instanceof AnthropicProvider) return 'anthropic-api';
+  if (provider instanceof OpenAIProvider) return 'openai-api';
+  if (provider instanceof GeminiProvider) return 'gemini-api';
+  return null;
+}
+
+/**
+ * The per-call options every DRAFTING and JUDGING model call on this provider instance carries for this mode. A provider that is
+ * not one of the three client classes (a test double, a clipipe) is never sent the switch.
+ * @param {any} provider a constructed bare-agent provider
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {{ thinkingMode: 'on'|'off' } | {}}
+ */
+export function thinkingCallOptions(provider, mode = 'off') {
+  const m = assertThinkingMode(mode);
+  const shape = shapeOfProvider(provider);
+  if (shape === null) return {};
+  return thinkingOptions(thinkingSupport(shape, String(provider.model), { baseUrl: provider.baseUrl }), m === 'on');
+}
+
+/**
+ * What the drafting calls will carry for a model the caller has only NAMED (shape, model id, Base URL) — no key, no network. The
+ * first drafting row is shown from this, before the key is read.
+ * @param {{providerName: string, model: string, baseUrl?: string|null}} o
+ * @param {unknown} [mode] 'on' | 'off'
+ * @returns {{ support: true|false|'unverified', mode: 'on'|'off', options: {thinkingMode?: 'on'|'off'} }}
+ */
+export function thinkingPlanFor({ providerName, model, baseUrl }, mode = 'off') {
+  const m = assertThinkingMode(mode);
+  const support = thinkingSupport(providerName, model, { baseUrl });
+  return { support, mode: m, options: thinkingOptions(support, m === 'on') };
+}
+
+/**
+ * The server's answer for one Model-menu line: whether the "Thinking on" box can change and the words under it. `false` greys and
+ * unticks the box (the note reads {@link THINKING_FIXED_SAY}); `'unverified'` leaves it enabled with no note.
+ * @param {string} shape @param {string} model @param {string|null|undefined} baseUrl
+ * @returns {{ support: true|false|'unverified', canChange: boolean, say: string }}
+ */
+export function thinkingForLine(shape, model, baseUrl) {
+  const support = thinkingSupport(shape, model, { baseUrl });
+  return { support, canChange: support !== false, say: support === false ? THINKING_FIXED_SAY : '' };
+}
+
+/**
+ * The first drafting row's words — code-owned, ALWAYS starting "thinking on" or "thinking off". `status` is bare-agent's own
+ * `thinkingStatus` for a call that has run ('applied' | 'unsupported' | 'ignored' | 'unknown'); undefined = before any call, read from
+ * the plan (`support`, `mode`).
+ * @param {{ mode: 'on'|'off', support?: true|false|'unverified', status?: string }} s
+ * @returns {string}
+ */
+export function thinkingRowText({ mode, support, status }) {
+  if (status === 'applied') return `thinking ${mode}`;
+  if (status === 'unsupported') return "thinking on (this model can't change it)";
+  if (status === 'ignored') return 'thinking on (the model thought anyway)';
+  if (status === 'unknown') return `thinking ${mode} (not confirmed)`;
+  if (support === false) return "thinking on (this model can't change it)";
+  if (support === 'unverified') return `thinking ${mode} (not verified for this model)`;
+  return `thinking ${mode}`;
+}

package/src/transport.js

@@ -1,5 +1,5 @@
 // hamr's ruling, verbatim: "one retry for transport layer failure and
-// reporting with the rest end of gate." (F115, docs/logs/FINDINGS.md.)
+// reporting with the rest end of gate." (F115, docs/wiki/FINDINGS.md.)
 //
 // A transport failure is fetch THROWING — the request never produced an HTTP
 // response at all (a TLS fault mid-record, a reset socket, a DNS/network

package/src/userrun.js

@@ -25,7 +25,6 @@
 // authored is preserved from the spine as a reusable artifact, and the next run of
 // this shape reuses and fine-tunes it rather than starting cold.
 import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, rmSync, readdirSync, openSync, readSync, closeSync, fstatSync, unlinkSync } from 'node:fs';
-import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { execFileSync, spawn } from 'node:child_process';
 import { join, resolve, dirname, basename } from 'node:path';
@@ -83,14 +82,11 @@ import { parseJsonl } from './replayio.js';
 import { claimRun, monthlyRefusalText, legSpend, chainSpend } from './monthly.js';
 import { ConfigError } from './config.js';
 import { commandFor } from './invoke.js';
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, priceReadout, ratesFor, rowsForHome } from './providerrows.js';
+import { judgeRatesFor, keyNameFor, keyValueOf, priceReadout, ratesFor, ratesOfLine, resolveWorker, judgeRowFor, rowsForHome, REFUSE_NAME_MODEL } from './providerrows.js';
 // the banner's wall arithmetic, extracted so it is reachable by a test (F83): the
 // end-of-run readout sits past the approval gate, so nothing could ever drive it here
 import { wallLine, doomedResume, deathAtOf, evidencePackage, doorLines, resumeAtLines, reviewDoorPackage, runDoorLines, tokensLine, doorTimingRedLines } from './u-readout.js';
 
-const require = createRequire(import.meta.url);
-const { AnthropicProvider } = require('bare-agent/providers');
-
 const JOBS = {
   'aurora-spawner': {
     spec: 'aurora-u-spawner-types.json',
@@ -111,7 +107,7 @@ const JOBS = {
     seed: '92d71a7c1253f8f2430e2d308ecfef01c826b5c2',
   },
   // Bench row G3 (the NEGATIVE row) — the planted contract contradiction
-  // (docs/product/G3-SCOPING.md). A copy of the pulselog-u patient (patients are
+  // (docs/logs/G3-SCOPING.md). A copy of the pulselog-u patient (patients are
   // always copies) with one extra commit: two test/** files that pin
   // assembleEmail's subject to two different strings, unsatisfiable together
   // inside writeScope: src/**. Not frozen, not signed, no run — BUILT ON BRANCH
@@ -153,7 +149,7 @@ const JOBS = {
   // Bench row G2 (the NEGATIVE row) — TESTGEN cold start in plan-v1. The legacy
   // steps[] config went 0-of-43 (F38); this config's rate is UNKNOWN until its
   // establishing run. Same patient/seed/grader as the l2accept battery
-  // (TESTGEN-PREREG); the spec is the cold goal. See docs/product/G2-SCOPING.md.
+  // (TESTGEN-PREREG); the spec is the cold goal. See docs/logs/G2-SCOPING.md.
   'aurora-testgen-cold': {
     spec: 'aurora-testgen-cold.json',
     workdir: '/home/hamr/PycharmProjects/bareloop-patients/aurora-soar',
@@ -174,10 +170,10 @@ const JOBS = {
   },
   // PRD item 28 / 30.9 — the openai-api probe through THIS runner (the shipped
   // one), not poc-run-param.mjs. Same job shape, same seed, its own patient copy.
-  'bareguard-types-deepseek': {
-    spec: 'bareguard-u-types-deepseek.json',
-    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u-deepseek',
-    spine: 'bareguard-u-deepseek-bareloop',
+  'bareguard-types-gateway': {
+    spec: 'bareguard-u-types-gateway.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u-gateway',
+    spine: 'bareguard-u-gateway-bareloop',
     seed: '2ae8fcd37041c186524a6eb5e953b9752cd602fa',
   },
   // N4's hitl PROVING job (build plan §Proving; hamr's ruling, 2026-08-13). The job
@@ -273,7 +269,8 @@ class ExitSignal extends Error {
  * @property {string} [into] the source door's own directory (`source.json`, and the spine directory beside it).
  *   Default `dirname(workdir)` — the copied-tree layout, where the tree is `<into>/tree`. A repo job on a WORKTREE
  *   (P6 item 1) has its tree inside the person's repo, so its `into` is passed explicitly.
- * @property {string|null} [model] the raw `--model` tier name (`sonnet`/`haiku`), or null for the default
+ * @property {string|null} [model] the raw `--model <id>` (a model id of a ticked Settings line), or null
+ * @property {string|null} [providerKey] the raw `--provider <KEY>` (a key's env name), or null
  * @property {string|null} [readShim] the raw `--read-shim` arm name, or null for the default
  * @property {string|null} [scout] the raw `--scout` value (`on`/`off`), or null for the default
  * @property {string|null} [draftSpentUsd] the raw `--draft-spent-usd` value (hamr's
@@ -306,6 +303,7 @@ class ExitSignal extends Error {
  * @property {string} spineName
  * @property {string} [into] see `RunOpts.into`
  * @property {string|null} model
+ * @property {string|null} providerKey
  * @property {string|null} readShim
  * @property {string|null} scout
  * @property {string|null} draftSpentUsd
@@ -389,25 +387,13 @@ async function execute(ctx) {
   /** @type {{workdir: string, seed: string, spine: string}} */
   const target = { workdir: ctx.workdir, seed: ctx.seed, spine: ctx.spineName };
 
-  // --model picks the DEFAULT worker tier (runner territory — the spec names no model, so
-  // the signed hash is unaffected). Tier names, not model ids. This map is the OPERATOR's
-  // and is deliberately WIDER than the planner's menu: since 2026-08-06 `STEP_MODELS` is
-  // sonnet-only (the haiku attribution probe — see src/plan.js), so a PLAN can no longer
-  // say haiku while `--model haiku` still can. haiku takes no output_config.effort
-  // (provider-gated, battery rule) — nothing to gate yet since neither tier sets effort.
-  // PRD v1.36 floor: the drafter/default tier is sonnet MINIMUM — measured, a haiku
-  // drafter died plan-red twice on the same rejection (ms7gne7s). `--model haiku` runs
-  // BELOW the floor: an explicit operator probe whose rows are probes, never battery
-  // evidence.
-  const DEFAULT_TIER_MODELS = { sonnet: 'claude-sonnet-5', haiku: 'claude-haiku-4-5-20251001' };
-  // `modelFlagArg` is null when --model was never passed at all — distinct from a
-  // flag that happens to resolve to the default tier's own id, because the SPEC
-  // (below, once loaded) needs to know whether a flag was actually given, not just
-  // what it resolved to (build-list #3: spec wins, a mismatched flag is refused).
+  // --model <id> names the Settings line a run works on when the SPEC names no model (an older spec, signed before a job carried its
+  // own); a spec's own `model` still wins and a different --model is refused. --provider <KEY> narrows to one key when two keys tick the
+  // same id. Runner territory: the spec names neither, so the signed hash is unaffected. There are no tier aliases and no built-in model.
+  // `modelFlagArg` is null when --model was never passed — distinct from a flag that happens to equal the spec's model, because the SPEC
+  // (below, once loaded) needs to know whether a flag was actually given (build-list #3: spec wins, a mismatched flag is refused).
   const modelFlagArg = ctx.model ?? null;
-  const tierArg = modelFlagArg ?? 'sonnet';
-  const FLAG_TIER_MODEL = DEFAULT_TIER_MODELS[/** @type {keyof typeof DEFAULT_TIER_MODELS} */ (tierArg)];
-  if (!FLAG_TIER_MODEL) { err(`unknown --model "${tierArg}" — one of: ${Object.keys(DEFAULT_TIER_MODELS).join(', ')}`); throw new ExitSignal(2); }
+  const providerFlagArg = ctx.providerKey ?? null;
   // --read-shim picks the READ SHIM's ARM (src/readshim.js, Phase 2 A0/A1/A2/A3). Runner
   // territory exactly like --model: the spec names no shim, so the signed hash is
   // unaffected. Phase 2 itself never flipped this default — its own "what this
@@ -445,7 +431,7 @@ async function execute(ctx) {
   const SHIM_TAIL = shimArg === null ? '' : ` --read-shim ${shimArg}`;
 
   // --scout picks whether the plan flow pays for the read-only survey at all
-  // (docs/product/SCOUT-CONTRAST.md). Runner territory exactly like --read-shim
+  // (docs/logs/SCOUT-CONTRAST.md). Runner territory exactly like --read-shim
   // and --model: the spec names no scout, so the signed hash is unaffected. An
   // unrecognised value throws at argv, before the approval gate — the same
   // param-guard class as --read-shim above, for the same reason: a silently
@@ -545,11 +531,12 @@ async function execute(ctx) {
   try {
     modelResolution = resolveWorkerModel({
       specModel: spec.model,
-      flagModel: modelFlagArg === null ? undefined : FLAG_TIER_MODEL,
-      defaultModel: /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet,
+      flagModel: modelFlagArg === null ? undefined : modelFlagArg,
+      // a scripted provider handed in by a test IS the run: it names its own model; a real run has no default
+      suppliedModel: deps.provider ? String(/** @type {any} */ (deps.provider).model ?? 'scripted') : undefined,
     });
   } catch (e) {
-    die(/** @type {Error} */ (e).message);
+    die(spec.model === undefined && modelFlagArg === null ? REFUSE_NAME_MODEL : /** @type {Error} */ (e).message);
   }
   const MODEL = modelResolution.model;
   const MODEL_LABEL = modelResolution.source === 'spec' ? `${MODEL} (spec)` : MODEL;
@@ -1022,16 +1009,20 @@ async function execute(ctx) {
   // spine, then handed down as data (`runJob`'s `rates`) — nothing deep in the run re-reads config. A bad
   // price refuses here; it never falls back to the built-in guess. No price set = `null` = no `rates` key
   // passed anywhere, byte-identical to before. The judge's own row is resolved below, beside its key.
-  const keyCfg = cfgOn ? rowsForHome(cfgHome) : [];
+  const keyCfg = cfgOn ? rowsForHome(cfgHome, env) : [];
   /** @type {ReturnType<typeof ratesFor>} */
   let workerPrice = null;
-  try {
-    workerPrice = ratesFor(spec.provider, spec.baseUrl, keyCfg, spec.model);
-  } catch (e) {
-    if (!(e instanceof ConfigError)) throw e;
-    err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
-    throw new ExitSignal(2);
-  }
+  // WHICH SETTINGS LINE THIS RUN WORKS ON (P8): the row is the key, the Base URL and the old-max_tokens tick; the line is the model
+  // and its price. A scripted provider handed in by a test IS the run (no row). A refusal here is $0, before anything else.
+  const W = deps.provider ? null : resolveWorker(keyCfg, spec, { model: modelFlagArg, provider: providerFlagArg });
+  const refuseWorker = () => { if (W && !W.ok) { err(W.say.includes('Nothing was spent') ? W.say : `${W.say} Nothing was spent.`); throw new ExitSignal(2); } };
+  // the preview cannot name its key without a line: refuse it here. A SIGNED run meets its other gates first (pause door, wall) and
+  // is refused at the key check below — still before anything is spent
+  if ((ctx.approve ?? null) === null) refuseWorker();
+  /** the endpoint the worker talks to: the chosen row's own Base URL (a spec signed before addresses were required carries none) */
+  const baseUrl = W && W.ok ? W.baseUrl : (typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined);
+  const wLine = W && W.ok ? ratesOfLine(W.line) : null;
+  workerPrice = W ? (wLine && W.ok ? { ...wLine, envName: W.row.envName } : null) : ratesFor(spec.provider, spec.baseUrl, keyCfg, spec.model);
 
   if ((ctx.approve ?? null) !== specHash) {
     out(dead ? 'U — RESUME, continuing a halted run, REAL dollars' : 'U — user-mode e2e, ONE run, REAL dollars');
@@ -1192,7 +1183,7 @@ async function execute(ctx) {
     // right key only by accident of the runner's own generic error message,
     // never from this hint. `keyNameFor` is the same resolved name
     // the real key check at launch reads (the person's row variable, else the provider's built-in one).
-    const invoke = (/** @type {string} */ tail) => `  ${keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name}=... ${INVOKE}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL}${tail} --approve ${PRINT_APPROVE}`;
+    const invoke = (/** @type {string} */ tail) => `  ${(W && W.ok ? W.row.envName : null) ?? keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name ?? '<KEY>'}=... ${INVOKE}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL}${tail} --approve ${PRINT_APPROVE}`;
     /** the door the operator has already picked, as flags — hoisted out of the else
      * below so the inhibitor line at the bottom can print the WHOLE command rather
      * than a shape the operator has to assemble. Empty on an ordinary run and on the
@@ -1446,13 +1437,15 @@ async function execute(ctx) {
   let judgePrice = null;
   if (JUDGES) {
     try {
-      judgePrice = judgeRatesFor(judge, spec.provider, spec.baseUrl, workerPrice, keyCfg);
+      judgePrice = judgeRatesFor(judge, spec.provider, baseUrl, workerPrice, keyCfg);
     } catch (e) {
       if (!(e instanceof ConfigError)) throw e;
       err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
       throw new ExitSignal(2);
     }
   }
+  /** the row the judge's key (and endpoint) comes from: the worker's own row when the judge shares its provider, else the judge provider's row */
+  const judgeRow = judgeRowFor(keyCfg, judge, spec.provider, W && W.ok ? W.row : null);
   // undefined, not null: both come straight off `env[...]` lookups below, which
   // (like process.env) never produce null for a missing key.
   /** @type {string|undefined} */
@@ -1468,13 +1461,10 @@ async function execute(ctx) {
     // row = the built-in. Names only — values come from the
     // env / keys file. The judge follows the worker's choice when it is the same provider
     // (the same rule that gives it the worker's baseUrl below).
-    const workerEnv = applyConfiguredKey(env, spec.provider, spec.baseUrl, keyCfg, spec.model);
-    const judgeEnv = judge.provider === spec.provider ? workerEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model);
-    /** the variable NAME this worker's key is read from (the person's pick, else built-in) — for messages only */
-    const workerKeyName = keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name;
-    // A green anthropic-api job's behaviour is byte-identical to before: its
-    // worker key IS `ANTHROPIC_API_KEY`, demanded as ever.
-    workerApiKey = workerEnv[providerEntry.envKey];
+    refuseWorker();
+    const workerKeyName = /** @type {NonNullable<typeof W> & {ok: true}} */ (W).row.envName;
+    // A job's worker key is its Settings row's own variable — there is no built-in name.
+    workerApiKey = keyValueOf(env, workerKeyName);
     if (!workerApiKey) { err(`${workerKeyName} not set (secrets load from the environment — never the tree)`); throw new ExitSignal(2); }
     // F181 — a key that reads as "set" above can still carry a line break/
     // control char/stray whitespace (a two-line secret-store entry, e.g.) and
@@ -1487,10 +1477,10 @@ async function execute(ctx) {
     // override matters most in the case this item exists for: a job whose worker and
     // judge are the SAME provider but different accounts, and the anthropic case
     // where one variable used to do two jobs.
-    judgeApiKey = env.JUDGE_API_KEY ?? judgeEnv[judgeEntry.envKey];
+    judgeApiKey = env.JUDGE_API_KEY ?? keyValueOf(env, judgeRow?.envName);
     if (JUDGES && !judgeApiKey) {
       err(`This job's close JUDGES (${judgedStages(spec.closeDecl).length} judged stage(s)) and its judge is ${judge.model} on ${judge.provider}${spec.judge ? ' (signed override)' : " (this job's own worker model — no `judge` override signed)"}.`);
-      err(`Neither JUDGE_API_KEY nor ${judgeEntry.envKey} is set — secrets load from the environment, never the tree.`);
+      err(`Neither JUDGE_API_KEY nor ${judgeRow?.envName ?? `a key row for ${judge.provider}`} is set — secrets load from the environment, never the tree.`);
       err('Refused at $0, BEFORE the worker spends anything: a judged run that discovers this at the close has paid for a verdict it cannot render.');
       throw new ExitSignal(2);
     }
@@ -1500,7 +1490,7 @@ async function execute(ctx) {
     if (JUDGES) {
       const judgeKeyProblem = apiKeyProblem(/** @type {string} */ (judgeApiKey));
       if (judgeKeyProblem) {
-        const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : judgeEntry.envKey;
+        const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : (judgeRow?.envName ?? judge.provider);
         err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
         throw new ExitSignal(2);
       }
@@ -1640,7 +1630,7 @@ async function execute(ctx) {
   // OpenAI-compatible gateway/endpoint. Undefined for anthropic-api jobs and
   // for an openai-api job that names none (bare-agent's OpenAIProvider then
   // defaults to api.openai.com/v1 on its own).
-  const baseUrl = typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined;
+  // (`baseUrl` — the worker row's Base URL — was resolved above with the Settings line)
   // TEST SEAM — same shape as the bundle door (src/bundlerun.js): a caller that supplies
   // `deps.provider` skips the real-key check above entirely and this
   // construction never runs (a scripted provider IS the run).
@@ -1648,26 +1638,11 @@ async function execute(ctx) {
   let providerFor = deps.providerFor;
   let judgeProvider = deps.judgeProvider ?? null;
   if (!provider) {
-    provider = makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: MODEL, baseUrl });
-    // P: the per-step model-tier factory. The TIER menu a PLAN may name is signed in the
-    // plan schema (STEP_MODELS — sonnet-only since the 2026-08-06 haiku attribution probe);
-    // the tier->model mapping is the RUNNER's territory, here, and keeps haiku for the
-    // operator's own --model knob. haiku takes no output_config.effort (provider-gated,
-    // battery rule) - nothing to gate yet since neither tier sets effort params.
-    // `sonnet` maps to the RESOLVED worker model (MODEL — spec/flag/default), not the
-    // bare provider-table id, so a spec-named model reaches every plan step's own
-    // provider (STEP_MODELS is sonnet-only), not just the top-level `provider` above.
-    // ONLY when the SPEC named it: a `--model haiku` probe keeps its old reach (the
-    // top-level provider), never silently widening into every step's tier. The tier
-    // table itself comes from `providerEntry` (src/providers.js) — for openai-api
-    // today that means BOTH tiers resolve to the same `deepseek-flash` id (hamr's
-    // ruling, PRD 30.7: one secondary provider, not a menu; swapped from the
-    // retired `deepseek-chat`, F171), so a `--model haiku` probe against an
-    // openai-api job harmlessly re-resolves to the same model.
-    const TIER_MODELS = modelResolution.source === 'spec' ? { ...providerEntry.tiers, sonnet: MODEL } : providerEntry.tiers;
-    /** @type {Record<string, any>} */
-    const tierCache = {};
-    providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)] === MODEL ? provider : makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)], baseUrl }));
+    const legacyMaxTokens = W && W.ok ? W.row.legacyMaxTokens : false;
+    provider = makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: MODEL, baseUrl, legacyMaxTokens });
+    // P: the per-step model factory. The ONLY tier a plan may name is the schema token `sonnet` (STEP_MODELS, src/plan.js — a
+    // documented schema token, not a model id); it means THIS job's worker model, so every step's provider is the one above.
+    providerFor = () => provider;
     // SOFTGREEN — the JUDGED stage's own provider. Since PRD item 32.1 its identity is
     // RESOLVED (`judge` above), not pinned: the spec's signed `judge` override, else this
     // job's own worker model. It is still never a step knob and never agent-selectable —
@@ -1684,7 +1659,7 @@ async function execute(ctx) {
     // every live softgreen run would have done: run-author wired this seam and this
     // runner never did.
     judgeProvider = judgeApiKey
-      ? makeProvider(judge.provider, { apiKey: /** @type {string} */ (judgeApiKey), model: judge.model, baseUrl: judge.provider === spec.provider ? baseUrl : undefined })
+      ? makeProvider(judge.provider, { apiKey: /** @type {string} */ (judgeApiKey), model: judge.model, baseUrl: judge.provider === spec.provider ? baseUrl : (judgeRow && judgeRow.baseUrl.trim() !== '' ? judgeRow.baseUrl.trim() : undefined), legacyMaxTokens: judgeRow ? judgeRow.legacyMaxTokens : false })
       : null;
   }
 
@@ -2433,6 +2408,7 @@ function buildCtx(mode, opts) {
     spineName: /** @type {string} */ (opts.spineName),
     ...(opts.into === undefined ? {} : { into: opts.into }),
     model: opts.model ?? null,
+    providerKey: opts.providerKey ?? null,
     readShim: opts.readShim ?? null,
     scout: opts.scout ?? null,
     draftSpentUsd: opts.draftSpentUsd ?? null,
@@ -2661,6 +2637,7 @@ export async function main(argv, deps = {}) {
       spineName: target.spine,
       ...(target.into === undefined ? {} : { into: target.into }),
       model: argFlag('model'),
+      providerKey: argFlag('provider'),
       readShim: argFlag('read-shim'),
       scout: argFlag('scout'),
       draftSpentUsd: argFlag('draft-spent-usd'),