bareloop 0.39.0 → 0.41.0

package/src/config.js

@@ -1,17 +1,22 @@
-// PANEL-BUILD.md P4a item 2 — the ONE reader/writer of `~/.config/bareloop/config.json`.
+// rewritten-from: fwdloop src/config.js@f9449e8 (validators `modelsProblem`, `providerFieldProblem`, `cleanBaseUrl`)
+// PANEL-BUILD.md P4a item 2 / P8 — the ONE reader/writer of `~/.config/bareloop/config.json`.
 //
-// Every panel/CLI setting lives in this one file (R5): the monthly $ limit, the
-// Anthropic balance note, and the Providers rows' Name / API shape / Base URL, per key variable.
+// Every panel/CLI setting lives in this one file (R5): the monthly $ limit and the Providers
+// rows' API shape / Base URL / old-max_tokens tick (`keys`) and each row's model lines (`models`).
 // Key VALUES never live here — they live in the keys file (`src/keysfile.js`) and the
 // shell env. The write path refuses a document that carries a secret-shaped string
 // (the ONE inventory: `sweepSecretLiterals`, src/validate.js).
 //
 // Shape (unknown fields are kept, never dropped):
-//   { "monthlyLimitUsd": <number>,          // absent = no limit, no check
-//     "anthropicBalanceNote": <number>,     // a typed note; no check ever reads it
-//     "keys": { "<ENV NAME>": { "name": "<model id>", "shape": "<api shape>", "baseUrl": "<url or blank>" } } }
+//   { "monthlyLimitUsd": <number > 0>,          // absent = no limit, no check
+//     "keys":   { "<ENV NAME>": { "shape": "<shape id>", "baseUrl": "http(s)://…", "legacyMaxTokens": true|false } },
+//     "models": { "<ENV NAME>": [ { "model": "<id>", "use": true|false, "inPerM": n, "outPerM": n } ] } }
+// An older file's `keys.<ENV>.{name,priceInPerM,priceOutPerM}` is tolerated and read as ONE model
+// line (`effectiveModels`, src/providerrows.js); the first write of that row's `models` list removes them.
+// `modelsProblem` is the ONE rule for a row's model lines: a price is a PAIR or neither, a ticked
+// line needs both. Nothing here sniffs a host or a model id.
 //
-// A missing file = defaults. An UNREADABLE file is reported (`problem`), never
+// A missing file = defaults. An UNREADABLE or INVALID file is reported (`problem`), never
 // papered over — the monthly check REFUSES on it rather than silently running with
 // no limit. Written atomically (tmp + rename), mode 600.
 import {
@@ -20,6 +25,7 @@ import {
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { sweepSecretLiterals } from './validate.js';
+import { SHAPE_IDS } from './providershapes.js';
 
 /** A plain-words config failure (bad value, secret-shaped string, unreadable file). */
 export class ConfigError extends Error {}
@@ -55,22 +61,106 @@ export function readConfig(opts = {}) {
   if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
     return { config: {}, exists: true, problem: `${file} must hold a JSON object — fix or remove it` };
   }
+  const bad = docProblem(parsed);
+  if (bad) return { config: {}, exists: true, problem: `${file}: ${bad} — fix or remove it` };
   return { config: parsed, exists: true, problem: null };
 }
 
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
-/** the API shapes a keys row may name (the `src/providers.js` table names) */
-const SHAPE_IDS = ['anthropic-api', 'openai-api', 'gemini-api'];
+
+/** The fields of a key row this module validates (others are kept untouched). */
+const KEY_FIELDS = Object.freeze(['shape', 'baseUrl', 'legacyMaxTokens']);
+
+/**
+ * One key-row field's value problem in plain words, or null when fine.
+ * @param {string} field `model` | `shape` | `baseUrl` | `legacyMaxTokens`
+ * @param {unknown} v
+ * @returns {string|null}
+ */
+export function providerFieldProblem(field, v) {
+  if (field === 'model') {
+    if (typeof v !== 'string' || v.length === 0 || v.length > 200 || /\s/.test(v)) return 'must be a model id: 1 to 200 characters, no spaces';
+  } else if (field === 'shape') {
+    if (typeof v !== 'string' || !SHAPE_IDS.includes(v)) return `must be one of ${SHAPE_IDS.join(', ')}`;
+  } else if (field === 'legacyMaxTokens') {
+    if (typeof v !== 'boolean') return 'must be true or false';
+  } else if (field === 'baseUrl') {
+    if (typeof v !== 'string' || !(v === '' || /^https?:\/\/\S+$/.test(v))) return 'must be empty or an http(s) address';
+  } else return 'is not a provider field';
+  return null;
+}
+
+/** A Base URL as stored: trailing slashes dropped. @param {string} v @returns {string} */
+export const cleanBaseUrl = (v) => v.replace(/\/+$/, '');
+
+/**
+ * THE one rule for a row's model lines, used by config validation and the Settings routes. A price
+ * is a PAIR (`inPerM` and `outPerM`, each a finite number >= 0 — 0 / 0 typed is a chosen price) or
+ * neither (null / absent). A ticked line (`use`) needs both. Plain words, or null.
+ * @param {unknown} list
+ * @returns {string|null}
+ */
+export function modelsProblem(list) {
+  if (!Array.isArray(list)) return 'The model list must be a list of lines.';
+  const seen = new Set();
+  for (const line of list) {
+    if (line === null || typeof line !== 'object' || Array.isArray(line)) return 'Each model line must be an object.';
+    const l = /** @type {Record<string, any>} */ (line);
+    const bad = providerFieldProblem('model', l.model);
+    if (bad) return `The model name ${bad}.`;
+    if (seen.has(l.model)) return `The model "${l.model}" is listed twice.`;
+    seen.add(l.model);
+    if (typeof l.use !== 'boolean') return 'Use must be on or off.';
+    const has = (/** @type {string} */ f) => l[f] !== undefined && l[f] !== null;
+    const isNum = (/** @type {unknown} */ v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+    if (has('inPerM') !== has('outPerM')) return 'Fill both price boxes or clear both.';
+    if (has('inPerM') && !(isNum(l.inPerM) && isNum(l.outPerM))) return 'A price must be a number, 0 or more.';
+    if (l.use && !has('inPerM')) return 'Fill both prices to tick this model.';
+    for (const k of Object.keys(l)) if (!['model', 'use', 'inPerM', 'outPerM'].includes(k)) return `A model line has no "${k}" field.`;
+  }
+  return null;
+}
+
+/**
+ * The first problem in a document's known fields, in plain words, or null.
+ * @param {Record<string, any>} doc
+ * @returns {string|null}
+ */
+function docProblem(doc) {
+  // monthlyLimitUsd is NOT judged here: `monthlyLimitOf` (src/monthly.js) owns its read-time sentence
+  if (doc.keys !== undefined) {
+    if (doc.keys === null || typeof doc.keys !== 'object' || Array.isArray(doc.keys)) return 'keys must be an object of key variable names';
+    for (const [env, row] of Object.entries(doc.keys)) {
+      if (!ENV_NAME_RE.test(env)) return `"${env}" is not a key variable name`;
+      if (row === null || typeof row !== 'object' || Array.isArray(row)) return `keys.${env} must be an object`;
+      for (const f of KEY_FIELDS) {
+        if (!Object.hasOwn(row, f)) continue;
+        const bad = providerFieldProblem(f, /** @type {Record<string, any>} */ (row)[f]);
+        if (bad) return `keys.${env}.${f} ${bad}`;
+      }
+    }
+  }
+  if (doc.models !== undefined) {
+    if (doc.models === null || typeof doc.models !== 'object' || Array.isArray(doc.models)) return 'models must be an object of key variable names';
+    for (const [env, list] of Object.entries(doc.models)) {
+      if (!ENV_NAME_RE.test(env)) return `models: "${env}" is not a key variable name`;
+      const bad = modelsProblem(list);
+      if (bad) return `models.${env}: ${bad}`;
+    }
+  }
+  return null;
+}
 
 /**
  * Apply a patch and write. `null` deletes a field. Top-level fields shallow-merge;
- * `keys` merges per key variable name, then per field. Validated before anything is
- * written; nothing is written on a refusal.
+ * `keys` merges per key variable name, then per field; `models.<ENV>` is REPLACED WHOLE (`null`
+ * clears it). Validated before anything is written; nothing is written on a refusal.
  *
- * Patch fields understood: `monthlyLimitUsd` (finite > 0), `anthropicBalanceNote`
- * (finite >= 0), `keys.<ENV NAME>.{name,shape,baseUrl}` (Name = a model id, shape = a provider table name, baseUrl = blank or http(s)). Any other
- * field is passed through untouched (kept), but the whole document is swept for
- * secret-shaped strings first.
+ * Patch fields understood: `monthlyLimitUsd` (finite > 0), `keys.<ENV>.{shape,baseUrl,legacyMaxTokens}`,
+ * `models.<ENV>` (a list judged by {@link modelsProblem}). The first write of a row's `models` list
+ * removes that row's older `name` / `priceInPerM` / `priceOutPerM` in the SAME write (never two
+ * sources); a retired top-level `anthropicBalanceNote` is dropped on any write. Any other field is
+ * kept, but the whole document is swept for secret-shaped strings first.
  * @param {Record<string, any>} patch
  * @param {{ home?: string }} [opts]
  * @returns {Record<string, any>} the document as written
@@ -81,16 +171,14 @@ export function updateConfig(patch, opts = {}) {
   /** @type {Record<string, any>} */
   const next = { ...cur.config };
   for (const [k, v] of Object.entries(patch)) {
-    if (k === 'keys') continue;
+    if (k === 'keys' || k === 'models') continue;
     if (v === null) { delete next[k]; continue; }
     if (k === 'monthlyLimitUsd' && !(typeof v === 'number' && Number.isFinite(v) && v > 0)) {
       throw new ConfigError('monthlyLimitUsd must be a number above 0 (remove the limit to have none)');
     }
-    if (k === 'anthropicBalanceNote' && !(typeof v === 'number' && Number.isFinite(v) && v >= 0)) {
-      throw new ConfigError('anthropicBalanceNote must be a number, 0 or more');
-    }
     next[k] = v;
   }
+  delete next.anthropicBalanceNote;
   if (patch.keys !== undefined) {
     if (patch.keys === null || typeof patch.keys !== 'object' || Array.isArray(patch.keys)) {
       throw new ConfigError('keys must be an object of key variable names');
@@ -104,21 +192,33 @@ export function updateConfig(patch, opts = {}) {
       const merged = { ...(keys[envName] && typeof keys[envName] === 'object' ? keys[envName] : {}) };
       for (const [fk, fv] of Object.entries(/** @type {Record<string, any>} */ (fields))) {
         if (fv === null) { delete merged[fk]; continue; }
-        if (fk === 'name' && !(typeof fv === 'string' && fv.length <= 100 && !/\s/.test(fv))) {
-          throw new ConfigError(`keys.${envName}.name must be a model id (no spaces, up to 100 characters)`);
-        }
-        if (fk === 'shape' && !SHAPE_IDS.includes(fv)) {
-          throw new ConfigError(`keys.${envName}.shape must be one of ${SHAPE_IDS.join(', ')}`);
-        }
-        if (fk === 'baseUrl' && !(typeof fv === 'string' && (fv === '' || /^https?:\/\/\S+$/.test(fv)))) {
-          throw new ConfigError(`keys.${envName}.baseUrl must be blank or an http(s) URL`);
-        }
-        merged[fk] = fv;
+        merged[fk] = fk === 'baseUrl' && typeof fv === 'string' ? cleanBaseUrl(fv) : fv;
       }
       keys[envName] = merged;
     }
     next.keys = keys;
   }
+  if (patch.models !== undefined) {
+    if (patch.models === null || typeof patch.models !== 'object' || Array.isArray(patch.models)) {
+      throw new ConfigError('models must be an object of key variable names');
+    }
+    /** @type {Record<string, any>} */
+    const models = { ...(next.models && typeof next.models === 'object' ? next.models : {}) };
+    for (const [envName, list] of Object.entries(patch.models)) {
+      if (!ENV_NAME_RE.test(envName)) throw new ConfigError(`"${envName}" is not a key variable name`);
+      if (list === null) { delete models[envName]; continue; }
+      models[envName] = list;
+      const row = next.keys?.[envName];
+      if (row && typeof row === 'object') {
+        // one source: the older single-model fields leave with the first saved list
+        const { name: _n, priceInPerM: _i, priceOutPerM: _o, ...rest } = row;
+        next.keys = { ...next.keys, [envName]: rest };
+      }
+    }
+    next.models = models;
+  }
+  const problem = docProblem(next);
+  if (problem) throw new ConfigError(problem);
   /** @type {string[]} */
   const secretPaths = [];
   sweepSecretLiterals(next, (_code, path) => { secretPaths.push(path); });

package/src/declaredclose.js

@@ -102,7 +102,7 @@ export const DECLARED_GENRES = Object.freeze([TYPES_GENRE.name]);
  * constrained to the names the genre OWNS, so it can never become an environment
  * channel of its own.
  */
-export const CLOSE_DECL_FIELDS = Object.freeze(['genre', 'lang', 'stages', 'notes', 'genreEnv', 'calibration']);
+export const CLOSE_DECL_FIELDS = Object.freeze(['genre', 'lang', 'stages', 'notes', 'refused', 'genreEnv', 'calibration']);
 
 /** what a stored calibration set carries, ENUMERATED: the frozen cases and the judge
  * tier that graded them. Both are inside the spec, so `jobSpecHash` covers both — which
@@ -272,13 +272,13 @@ export function declaredStages(closeDecl) {
  *
  * @param {any} closeDecl
  * @param {{at?: string, listing?: string[]|null, deferListing?: boolean,
- *   catalogue?: Record<string, any>, verdictType?: string|null, writeScope?: string[]|null}} [opts]
+ *   catalogue?: Record<string, any>, verdictType?: string|null, writeScope?: string[]|null, jobLines?: {n: number}[]|null}} [opts]
  * @returns {{ok: boolean, reds: Red[], closeDecl: any, grounded: boolean,
  *   scoped: {scoped: boolean, via: string|null},
  *   ceiling: {class: string, kind: string, stage: string|null, locked: boolean}|null}}
  */
 export function validateCloseDecl(closeDecl, opts = {}) {
-  const { at = 'closeDecl', listing = null, catalogue, verdictType = null, writeScope = null } = opts;
+  const { at = 'closeDecl', listing = null, catalogue, verdictType = null, writeScope = null, jobLines = null } = opts;
   const deferListing = opts.deferListing === true;
   /** @type {Red[]} */
   const reds = [];
@@ -402,6 +402,7 @@ export function validateCloseDecl(closeDecl, opts = {}) {
     guards: classGuards({ verdictType: picked, lang: closeDecl.lang }),
     verdictType: picked,
     writeScope,
+    jobLines,
     envOwned: owned,
     // POST-injection: an owned name is accepted only when its value is EXACTLY
     // the recorded one. `{}` (nothing recorded) keeps the pre-injection rule, so

package/src/draftspend.js

@@ -24,7 +24,10 @@ export const DRAFT_LOG_FILE = 'draft-log.jsonl';
  * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
  *  - `step-start`  {no, id, label, at}
  *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
- *  - `call`        {no, step, label, model, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway" / "can't change it" / "not confirmed")
+ *  - `call`        {no, step, label, model, thinking, thinkingSupport, thinkingStatus?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (`thinking` = the tick's mode: off | on; `thinkingSupport` = bare-agent's lookup for the model: true | false | 'unverified';
+ *    `thinkingStatus` = bare-agent's own verdict for the call's run: applied | unsupported | ignored | unknown, present only when thinkingMode was sent)
  *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
  * @typedef {{kind: string, no: number, at: string, [k: string]: any}} DraftEvent
  */
@@ -148,6 +151,8 @@ export function readDraftSteps(dir) {
       x.status = ev.status === 'failed' ? 'failed' : 'done';
       x.endedAt = ev.at;
       if (typeof ev.label === 'string') x.label = ev.label;
+    } else if (ev.kind === 'step-label' && byNo.has(ev.no)) {
+      if (typeof ev.label === 'string') byNo.get(ev.no).label = ev.label;
     } else if (ev.kind === 'step-reopen' && byNo.has(ev.no)) {
       const x = byNo.get(ev.no);
       x.status = 'running';

package/src/index.js

@@ -148,16 +148,14 @@ export { answerReviewDoor } from './reviewdoor.js';
 // SOFTGREEN module 1 — the judged floor's core. The pieces an adopter (and an
 // integrating UI) genuinely needs: `resolveJudge` (PRD item 32.1 — WHICH model
 // grades a job: the spec's signed `judge` override, else the job's own worker
-// model, and no library fall-back), `JUDGE_MODEL` (the pre-item-32 pin, kept
-// exported for adopters and still the right default for an anthropic-api job,
-// but no longer read by any grading path), the rulebook a card SELECTS from,
+// model, and no library fall-back; the old pinned-model constant is gone), the rulebook a card SELECTS from,
 // the card gate, and the two halves themselves so a calibration harness can
 // grade the whole pipe without running a close.
 // `defaultJudgeLoop` (src/judged.js) is the one spelling of how this repo drives a
 // judge; the runner reaches it through `runPlan`'s `judgeProvider`. It is internal:
 // the package root does not export it.
 export {
-  JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
+  resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
   runLocate, decide,
   // SOFTGREEN module 4 — what a legal SIGNED calibration set is. The SIZE is
   // hamr's own ruling and a size change is a spec-level threshold change;

package/src/interviewrun.js

@@ -31,7 +31,7 @@
 //     form (PRD item 33 M3 piece 3): Goal / Success / Guardrails, soft-green
 //     adding Judge Examples. Source and Destination are MECHANICAL fields —
 //     proven against the machine rather than typed — and their wording is
-//     ALSO the library's (`SOURCE_FIELD`, `destinationFieldFor`,
+//     ALSO the library's (`INPUTS_FIELD`, `destinationFieldFor`,
 //     `src/authorflow.js`), so this module prints what the library hands it
 //     for all six fields, never re-worded here, never re-ordered, never stored;
 //   - the REFUSALS are the library's (`runInterview`): a locked class refuses at
@@ -87,9 +87,9 @@
 // non-repo source gets the form up to here and then an honest named stop:
 // bareloop has no checks for that kind of job yet (ruling 7 → M4).
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, rowsForHome } from './providerrows.js';
+import { keyValueOf, namedRowsForHome, resolveWorker } from './providerrows.js';
 import {
-  writeFileSync, mkdirSync, existsSync, readFileSync, statSync,
+  writeFileSync, mkdirSync, readFileSync, statSync,
 } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { spawnSync as realSpawnSync } from 'node:child_process';
@@ -101,13 +101,18 @@ import {
   PLAIN_FOLDER_DEFERRED_FIELDS,
 } from './authorjob.js';
 import {
-  SOURCE_FIELD, destinationFieldFor, labelsFor,
+  INPUTS_FIELD, JOB_BLOCK_HELP, destinationFieldFor, labelsFor, SOFTGREEN_JUDGE_EXAMPLES_KEY,
 } from './authorflow.js';
+import {
+  parseJobBlock, parseInputs, renderJobLines, renderExamples, jobBlockFitsCheck, signedJobLines,
+} from './jobblock.js';
 import { validateJob, validateBaseUrl, PROVIDERS } from './job.js';
 import { resolveProvider, probeWarningLines, apiKeyProblem } from './providers.js';
 import { scanSecrets, redactSecrets } from './validate.js';
 import { detectLanguage } from './detectlang.js';
-import { prepareSource, proveDestination, looksLikeRepoSource, missingDependencies } from './source.js';
+import {
+  prepareSource, proveDestination, looksLikeRepoSource, missingDependencies, proveInputFiles,
+} from './source.js';
 import { parseCeiling, ceilingLine } from './authorreadout.js';
 import { commandFor } from './invoke.js';
 
@@ -187,6 +192,9 @@ export async function main(argv, deps = {}) {
   // way an empty `--verdict`/`--provider` value already does elsewhere in this
   // file.
   const baseUrlArg = arg('base-url');
+  // `--model <id>`: the model id of a line ticked in Settings > Providers (with both prices). Written into the draft as `model`, so the
+  // job carries its own model; absent when never given (run-author then stops at $0 asking for one).
+  const modelArg = arg('model');
   // `--lang` IS GONE (PRD item 33 M3, ruling 3): language is a FACT of the
   // repository, read off its own manifest, never a flag a person sets. A
   // `--lang` on the command line now is an operator error, stopped loud rather
@@ -353,18 +361,26 @@ export async function main(argv, deps = {}) {
     throw new ExitSignal(1);
   }
 
-  // ── 1. SOURCE — the form's first field (PRD item 33 M3, ruling 2) ────────────
+  // ── 1. INPUTS — the form's first field (P7, docs/product/PANEL-BUILD.md; replaces Source) ───────────────
+  // Line 1 is the repo (the Source this door has always taken); lines 2+ are tracked files inside it, proven at $0
+  // by `proveInputFiles` — the same function the panel calls. A bad line re-asks, naming the line.
   say('');
-  say('── SOURCE ' + '─'.repeat(58));
-  // LIBRARY WORDING (PRD item 33 M3 piece 3, ruling 1) — this script prints what
-  // `src/authorflow.js` hands it and writes none of its own.
-  say(SOURCE_FIELD.prompt);
-  const sourceRaw = await readAnswer('the source',
-    'Source is required — this is what the job reads. Again:');
-  const isUrl = /^https?:\/\//i.test(sourceRaw);
-  const SOURCE = isUrl ? sourceRaw : resolve(sourceRaw);
-  if (!isUrl && !existsSync(SOURCE)) {
-    die(`${SOURCE} does not exist — Source is a folder, subfolder, file, or URL bareloop can actually read.`);
+  say('── INPUTS ' + '─'.repeat(58));
+  // LIBRARY WORDING — this script prints what `src/authorflow.js` hands it and writes none of its own.
+  say(INPUTS_FIELD.prompt);
+  /** @type {import('./jobblock.js').JobInput[]} */
+  let INPUTS = [];
+  /** @type {string} */
+  let SOURCE = '';
+  for (;;) {
+    const raw = await readAnswer('the inputs', 'Inputs is required — line 1 is the repo this job reads. Again:');
+    const parsed = parseInputs(raw);
+    if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+    const proof = await proveInputFiles(parsed.inputs);
+    if (!proof.ok) { say(`  ${proof.error}`); continue; }
+    INPUTS = parsed.inputs;
+    SOURCE = proof.repo;
+    break;
   }
   // the SAME rule `prepareSource` uses to route its own destination check
   // (`looksLikeRepoSource`, `src/source.js`) — never a second, hand-typed copy
@@ -401,7 +417,7 @@ export async function main(argv, deps = {}) {
   //                       ruling 7): a plain-folder job still gets the form; it
   //                       only gets an honest "no checks yet" stop later (M4).
   let LANG = 'none-detected';
-  if (!isUrl && statSync(SOURCE).isDirectory()) {
+  if (statSync(SOURCE).isDirectory()) {
     const langResult = detectLanguage(SOURCE);
     if (langResult.kind === 'ambiguous') {
       // NO LONGER DIES (PRD item 33 M3 piece 4, step S5): `LANG` takes the
@@ -560,25 +576,38 @@ export async function main(argv, deps = {}) {
   say(`  asks     ${REQUIRED.length} frozen question(s) for this class, then the numbers and names the job spec needs`);
 
   // ── 3. the class's own frozen questions, one at a time ───────────────────────
+  // P7: "The job" is ONE multi-line answer — numbered lines with their `~` rules, parsed by `parseJobBlock` (the same
+  // parser the panel uses) and filed under key 1 as the numbered text the drafter reads. A rubric's second answer
+  // (the judge examples) is DERIVED from the `~ PASS:`/`~ FAIL:` lines of that block, never asked a second time.
   /** @type {Record<string, string>} */
   const answers = {};
+  /** @type {import('./jobblock.js').JobLine[]} */
+  let JOB_LINES = [];
+  const ASKED = REQUIRED.filter((n) => !(VERDICT === 'soft-green' && n === SOFTGREEN_JUDGE_EXAMPLES_KEY));
   let asked = 0;
-  for (const n of REQUIRED) {
+  for (const n of ASKED) {
     asked += 1;
     say('');
-    say(`── ${asked} of ${REQUIRED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
-    // the FIELD LABEL, from the signed table (PRD item 33 M3 piece 3's wording
-    // fix) — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
-    // stays byte-identical to what the library holds, which is what the wizard
-    // test suite (`tests/run-interview.test.js`) asserts verbatim and in order.
-    // A key with no signed-table row prints no label.
+    say(`── ${asked} of ${ASKED.length} ${'─'.repeat(Math.max(0, 56 - String(asked).length))}`);
+    // the FIELD LABEL, from the signed table — printed on its own line so the literal `${n}. ${QUESTIONS[n]}` below
+    // stays byte-identical to what the library holds. A key with no signed-table row prints no label.
     if (LABELS[n]) say(LABELS[n]);
-    // the frozen wording, printed as the library holds it. Numbered by the library's
-    // own key, so the number a person sees is the number their answer is filed under.
+    // the frozen wording, printed as the library holds it. Numbered by the library's own key.
     say(`${n}. ${QUESTIONS[n]}`);
-    answers[n] = await readAnswer(`question ${n}`,
-      'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+    for (const h of JOB_BLOCK_HELP) say(`   ${h}`);
+    for (;;) {
+      const raw = await readAnswer(`question ${n}`,
+        'that one is required — every question in this class\'s set has to be answered before a close can be authored from it. Again:');
+      const parsed = parseJobBlock(raw);
+      if (!parsed.ok) { say(`  ${parsed.error}`); continue; }
+      const misfit = jobBlockFitsCheck(parsed.lines, VERDICT === 'soft-green');
+      if (misfit) { say(`  ${misfit}`); continue; }
+      JOB_LINES = parsed.lines;
+      answers[n] = renderJobLines(parsed.lines);
+      break;
+    }
   }
+  if (VERDICT === 'soft-green') answers[SOFTGREEN_JUDGE_EXAMPLES_KEY] = renderExamples(JOB_LINES);
 
   // ── 4. the OPERATOR's half of the spec — the part nothing authors for you ────
   say('');
@@ -660,6 +689,7 @@ export async function main(argv, deps = {}) {
     // written as `null`/`''`; every provider constructor defaults its own
     // endpoint on its own in that case (PRD item 28 ruling (d)).
     ...(baseUrlArg === null ? {} : { baseUrl: baseUrlArg }),
+    ...(modelArg === null ? {} : { model: modelArg }),
     cadence: { unit: 'day', every: 1 },
     budgetUsd,
     ...(wallMin === null ? {} : { maxWallMs: Math.round(wallMin * 60_000) }),
@@ -667,6 +697,9 @@ export async function main(argv, deps = {}) {
     // meaningless fence derived from an output directory.
     ...(writeScope === null ? {} : { writeScope }),
     escalation: { mode: 'decision-ready' },
+    // P7: the person's own words, signed beside the model's goal sentence — what the Job tab and Reuse show back
+    jobLines: signedJobLines(JOB_LINES),
+    inputs: INPUTS,
     // `tools` is deliberately OMITTED: an omitted menu hashes as the concrete current
     // TOOL_MENU (MED-1), which pins WHICH menu was signed and makes a widening flip the
     // hash. Naming one here would freeze today's list into the operator's own half.
@@ -753,29 +786,17 @@ export async function main(argv, deps = {}) {
   // anything this script itself let through; the try/catch is only for the
   // off-menu case `validateJob` reds but does not stop the write for (an
   // admitted-but-uncrafted table entry would otherwise crash this print).
-  let providerEntry = null;
-  try { providerEntry = resolveProvider(PROVIDER); } catch { providerEntry = null; }
-  const providerEnvKey = providerEntry?.envKey ?? null;
-  say(`  ${providerEnvKey ?? 'YOUR_PROVIDER_API_KEY'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
-  // An `openai-api` + `baseUrl` draft (DeepSeek, today's one secondary, reached
-  // this way) still reads its key from `OPENAI_API_KEY` — there is no separate
-  // "DeepSeek key" env var, and a person pointed only at the command above could
-  // reasonably miss that. Said once, plainly, never a key VALUE.
-  if (draft.baseUrl !== undefined && providerEnvKey) {
-    say(`  (the endpoint above is reached through the "${PROVIDER}" table entry, so its key still goes in ${providerEnvKey} — there is no separate endpoint-specific key variable)`);
-  }
-  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own
-  // door, before a spine exists — so with the shell unkeyed this question has
-  // exactly one possible outcome for the person, and putting it anyway spends
-  // their attention on a choice they do not have. What is actionable instead is
-  // the command above and the one line that says how to make it work.
-  // F181 — a key that IS set can still carry a shape run-author will refuse
-  // (a line break/control char/stray whitespace, e.g. a two-line secret-store
-  // entry). A malformed key must not count as KEYED: this offer must read the
-  // same "will it actually run" question run-author itself asks at its door.
-  // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
-  const keyEnv = keys.home !== undefined ? applyConfiguredKey(env, PROVIDER, draft.baseUrl, rowsForHome(keys.home)) : env;
-  const rawKeyValue = providerEnvKey ? keyEnv[providerEnvKey] : undefined;
+  // The key is the Settings row's own variable (P8: no built-in name). The worker is the draft's API shape + Base URL + model line.
+  const keyRowsNow = keys.home !== undefined ? namedRowsForHome(keys.home) : [];
+  const worker = resolveWorker(keyRowsNow, { provider: PROVIDER, baseUrl: draft.baseUrl, model: modelArg });
+  const providerEnvKey = worker.ok ? worker.row.envName : null;
+  say(`  ${providerEnvKey ?? 'YOUR_KEY_NAME'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
+  if (!worker.ok) say(`  (${worker.say.replace(' Nothing was spent.', '')} — bareloop author stops at $0 until it is)`);
+  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own door, before a spine exists — so with the shell
+  // unkeyed this question has exactly one possible outcome for the person, and putting it anyway spends their attention on a choice
+  // they do not have. F181 — a key that IS set can still carry a shape run-author will refuse (a line break/control char/stray
+  // whitespace). A malformed key must not count as KEYED: this offer reads the same "will it actually run" question run-author asks.
+  const rawKeyValue = providerEnvKey ? keyValueOf(env, providerEnvKey) : undefined;
   const keyProblem = rawKeyValue ? apiKeyProblem(rawKeyValue) : null;
   const KEYED = providerEnvKey !== null && Boolean(rawKeyValue) && !keyProblem;
   if (!KEYED) {
@@ -785,7 +806,7 @@ export async function main(argv, deps = {}) {
     } else {
       say(providerEnvKey
         ? `  (${providerEnvKey} is not set in this shell — bareloop author refuses without it; secrets load from the environment, never the tree)`
-        : `  (provider "${PROVIDER}" is not in the runnable table — bareloop author will refuse it loud; this is not a key problem)`);
+        : '  (no key row serves this model yet — bareloop author refuses it at $0; this is not a key problem)');
     }
     // The repair, in plain words and WITHOUT a command: which secret store a person
     // keeps their key in is theirs, and printing one specific incantation would be