bareloop 0.39.0 → 0.41.0

package/src/job.js

@@ -1,5 +1,5 @@
 // Job-spec validator — the OPERATOR-owned half of the config story (N1,
-// design record: docs/product/2026-07-12-n1-job-close-schema-design.md).
+// design record: docs/logs/2026-07-12-n1-job-close-schema-design.md).
 // A job spec is the arbiter's rulebook: the close chain, the budget, the
 // outer write fence, the escalation route. It is pure declarative data —
 // no freeform code is expressible anywhere in it — and it validates
@@ -167,7 +167,7 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'thinking', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
 /** the exact fields of a signed `judge` override — nested objects red unknown
  * keys too, because no smuggling level exists in a signed spec */
 const JUDGE_FIELDS = ['provider', 'model'];
@@ -329,7 +329,12 @@ export function validateJob(input, { shellCapUsd = 2 } = {}) {
   // on THAT model, not merely on the goal/close it runs against. The judge
   // model stays library-pinned pending recalibration — out of scope here.
   if (spec.model !== undefined && !isNonEmptyString(spec.model)) {
-    red('invalid-value', 'model', 'non-empty string — exact provider model id (e.g. "claude-sonnet-5")');
+    red('invalid-value', 'model', 'non-empty string — the exact model id of a line ticked in Settings > Providers');
+  }
+  // THINKING (P8) — the job's "Thinking on" tick, OPTIONAL: absent means off (and an old spec keeps the hash it always had); present it is
+  // signed like `model`. It covers DRAFTING and the rubric JUDGE only — the worker is never handed a thinking option. A boolean, nothing else.
+  if (spec.thinking !== undefined && typeof spec.thinking !== 'boolean') {
+    red('invalid-value', 'thinking', 'true or false — the job\'s "Thinking on" tick (absent = off)');
   }
 
   // JUDGE — PRD item 32.1 (hamr, 2026-09-10: the judge "defaults to whatever
@@ -717,6 +722,39 @@ function validateStagedClose(stages, red) {
  * @param {Red[]} reds direct access for structured request-reds
  */
 function validatePlanShape(spec, red, reds) {
+  // P7: the person's own words, signed beside the model's goal sentence. Exact fields (no smuggling level), numbered 1..n
+  // in order. Optional: a spec that predates the job block has neither and keeps its hash.
+  if (spec.jobLines !== undefined) {
+    if (!Array.isArray(spec.jobLines) || spec.jobLines.length === 0) red('invalid-value', 'jobLines', 'a non-empty array of {n, text, rule}');
+    else {
+      spec.jobLines.forEach((/** @type {any} */ l, /** @type {number} */ i) => {
+        const at = `jobLines[${i}]`;
+        if (!isObj(l)) { red('invalid-value', at, '{n, text, rule}'); return; }
+        for (const key of Object.keys(l)) if (!['n', 'text', 'rule', 'rules'].includes(key)) red('unknown-field', `${at}.${key}`, 'job line fields: n, text, rule, rules');
+        if (l.n !== i + 1) red('invalid-value', `${at}.n`, `lines are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(l.text)) red('invalid-value', `${at}.text`, 'non-empty text');
+        if (typeof l.rule !== 'string') red('invalid-value', `${at}.rule`, 'a string ("" when the line has no ~ rule)');
+        // optional, beside `rule`: the same `~` lines one by one; it must join back to `rule` exactly
+        if (l.rules !== undefined && (!Array.isArray(l.rules) || l.rules.some((/** @type {any} */ r) => !isNonEmptyString(r)) || l.rules.join('; ') !== l.rule)) {
+          red('invalid-value', `${at}.rules`, 'an array of the ~ lines that joins with "; " to exactly `rule`');
+        }
+      });
+    }
+  }
+  if (spec.inputs !== undefined) {
+    if (!Array.isArray(spec.inputs) || spec.inputs.length === 0) red('invalid-value', 'inputs', 'a non-empty array of {n, label, value}');
+    else {
+      spec.inputs.forEach((/** @type {any} */ x, /** @type {number} */ i) => {
+        const at = `inputs[${i}]`;
+        if (!isObj(x)) { red('invalid-value', at, '{n, label, value}'); return; }
+        for (const key of Object.keys(x)) if (!['n', 'label', 'value'].includes(key)) red('unknown-field', `${at}.${key}`, 'input fields: n, label, value');
+        if (x.n !== i + 1) red('invalid-value', `${at}.n`, `inputs are numbered 1, 2, 3 in order — expected ${i + 1}`);
+        if (!isNonEmptyString(x.label)) red('invalid-value', `${at}.label`, 'non-empty text');
+        if (!isNonEmptyString(x.value)) red('invalid-value', `${at}.value`, 'non-empty text');
+      });
+    }
+  }
+
   if (spec.goal === undefined) red('missing-required', 'goal');
   else if (!isNonEmptyString(spec.goal)) red('invalid-value', 'goal', 'non-empty text — the goal is what the agent plans against');
 
@@ -757,7 +795,7 @@ function validatePlanShape(spec, red, reds) {
     // class the user picked (PRD v1.57 §2), so the gate cannot check D5 without
     // it. An unknown or locked class is refused there, on its own axis, beside
     // the counted `request-red` above.
-    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope });
+    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null });
     for (const r of cd.reds) reds.push(r);
     if (demanded !== undefined && !CLASS_BY_CLOSE.declared.includes(demanded)) {
       // the same laundering guard as the close-type hierarchy, one level up: a
@@ -886,11 +924,11 @@ export function jobSpecHash(job) {
 
 /**
  * The fields a "Reuse workflow" run may change: where the work lands (the write fence, `writeScope`, and a
- * `destination`/`source` where a spec ever carries them) and the two ceilings. Everything else in a signed spec is
+ * `destination`/`source` where a spec ever carries them), the `inputs` the person pointed at (P7: Inputs is open on a reuse) and the two ceilings. Everything else in a signed spec is
  * the WORKFLOW — goal, checks, guardrails, close (the worker model is the third kind, {@link WORKFLOW_KEY_IDENTITY_FIELDS}). ONE list, shared by {@link workflowKey} and by the panel's
  * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
  */
-export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs']);
+export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs', 'inputs']);
 
 /**
  * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name
@@ -951,15 +989,15 @@ export function checkApproval(job, approvals) {
  * mismatched flag is a mistake worth stopping on, never a silent swap); the
  * same id from both is not a conflict. Extracted from scripts/run-u.mjs so
  * the decision is testable without running the script or touching a provider.
- * @param {{ specModel?: string, flagModel?: string, defaultModel: string }} args
+ * @param {{ specModel?: string, flagModel?: string, suppliedModel?: string }} args
  *   `specModel` — `job.model` if the signed spec carries one, else undefined.
  *   `flagModel` — the model id an explicit `--model <tier>` resolved to, else
  *   undefined (a flag that was never passed, not merely a default tier name).
- *   `defaultModel` — the runner's own default when neither spec nor flag says.
+ *   `suppliedModel` — a model the CALLER supplies when neither spec nor flag says (bareloop keeps none of its own).
  * @returns {{ model: string, source: 'spec'|'flag'|'default' }}
- * @throws {Error} when the spec names a model and the flag names a different one
+ * @throws {Error} when the spec names a model and the flag names a different one, or when no model is named at all
  */
-export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
+export function resolveWorkerModel({ specModel, flagModel, suppliedModel }) {
   if (specModel !== undefined) {
     if (flagModel !== undefined && flagModel !== specModel) {
       throw new Error(`spec names model "${specModel}" but --model resolved to "${flagModel}" — the signed spec wins; a mismatched --model flag is refused, never silently overridden. Drop --model or point it at the same model.`);
@@ -967,5 +1005,6 @@ export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
     return { model: specModel, source: 'spec' };
   }
   if (flagModel !== undefined) return { model: flagModel, source: 'flag' };
-  return { model: defaultModel, source: 'default' };
+  if (suppliedModel === undefined) throw new Error('no model is named — a job carries its own model, or the run is given --model <id> (one ticked in Settings > Providers with both prices)');
+  return { model: suppliedModel, source: 'default' };
 }

package/src/jobblock.js

@@ -0,0 +1,140 @@
+// The "job" block's parser (P7, docs/product/PANEL-BUILD.md "Addendum 2026-10-10"): ONE owner of how the person's
+// own multi-line words become numbered job lines and numbered inputs. The panel server AND the CLI interview both
+// call these two functions, so the two doors can never read the same text two ways.
+//
+// Both are pure and $0: a malformed block is a named red `{ok: false, error}`, never a throw and never a guess.
+
+/** @typedef {{verdict: 'PASS'|'FAIL', text: string}} JobExample a `~ PASS:` / `~ FAIL:` line (rubric only), kept with its job line */
+/** @typedef {{n: number, text: string, rule: string, rules: string[], examples: JobExample[]}} JobLine one numbered job line; `rule` = its `~` lines joined with '; ' ('' when none), `rules` = those same `~` lines one by one (so an example's own '; ' survives) */
+/** @typedef {{n: number, label: string, value: string}} JobInput one numbered `label: value` input line */
+
+/** the joiner for consecutive `~` lines (fwd's joinGuardrails) */
+export const RULE_JOINER = '; ';
+
+/**
+ * Parse "The job" box. A plain line is a numbered job line (1, 2, 3...). A line starting `~` has no number and belongs
+ * to the numbered line above; consecutive `~` lines become ONE rule joined with `'; '`. A `~` line starting `PASS:` or
+ * `FAIL:` is also a judge example (kept with its line number); any other `~` line is a guardrail. Empty lines are
+ * ignored. A `~` before line 1 is a red.
+ * @param {unknown} text the box's raw text
+ * @returns {{ok: true, lines: JobLine[]}|{ok: false, error: string}}
+ */
+export function parseJobBlock(text) {
+  if (typeof text !== 'string') return { ok: false, error: 'The job is required' };
+  /** @type {JobLine[]} */
+  const lines = [];
+  /** @type {string[]} */
+  let rule = [];
+  const flush = () => { if (lines.length) { lines[lines.length - 1].rule = rule.join(RULE_JOINER); lines[lines.length - 1].rules = rule; } rule = []; };
+  let row = 0;
+  for (const raw of text.split(/\r?\n/)) {
+    const t = raw.trim();
+    if (t === '') continue;
+    row += 1;
+    if (t.startsWith('~')) {
+      if (lines.length === 0) return { ok: false, error: `The job, line ${row}: a "~" line belongs to the numbered line above it, and there is none yet` };
+      const body = t.slice(1).trim();
+      if (body === '') continue;
+      rule.push(body);
+      const m = /^(PASS|FAIL):\s*(.*)$/i.exec(body);
+      if (m) {
+        if (m[2].trim() === '') return { ok: false, error: `The job, line ${row}: "${m[1].toUpperCase()}:" needs an example after it` };
+        lines[lines.length - 1].examples.push({ verdict: /** @type {'PASS'|'FAIL'} */ (m[1].toUpperCase()), text: m[2].trim() });
+      }
+      continue;
+    }
+    flush();
+    lines.push({ n: lines.length + 1, text: t, rule: '', rules: [], examples: [] });
+  }
+  flush();
+  if (lines.length === 0) return { ok: false, error: 'The job is required' };
+  return { ok: true, lines };
+}
+
+/** a label: a word or two, no colon */
+const LABEL_RE = /^[A-Za-z][A-Za-z0-9_ -]{0,39}$/;
+
+/**
+ * Parse the "Inputs" box: one `label: value` per line, numbered 1, 2, 3 in the order written. Empty lines are ignored.
+ * This only checks the SHAPE — what a value must point at (line 1 an absolute repo, lines 2+ tracked files inside it)
+ * is proven by the panel at $0.
+ * @param {unknown} text
+ * @returns {{ok: true, inputs: JobInput[]}|{ok: false, error: string}}
+ */
+export function parseInputs(text) {
+  if (typeof text !== 'string') return { ok: false, error: 'Inputs is required' };
+  /** @type {JobInput[]} */
+  const inputs = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const t = raw.trim();
+    if (t === '') continue;
+    const n = inputs.length + 1;
+    const i = t.indexOf(':');
+    const label = i < 0 ? '' : t.slice(0, i).trim();
+    const value = i < 0 ? '' : t.slice(i + 1).trim();
+    if (!LABEL_RE.test(label) || value === '') return { ok: false, error: `Inputs, line ${n}: write it as "label: value"` };
+    inputs.push({ n, label, value });
+  }
+  if (inputs.length === 0) return { ok: false, error: 'Inputs is required' };
+  return { ok: true, inputs };
+}
+
+/**
+ * The person's job lines as the drafter reads them (answer 1 of the interview): each numbered line, then its rule
+ * (the `~` lines joined) indented under it. One spelling, so the number the person typed beside a line is the number a
+ * stage's `fromLine` names.
+ * @param {JobLine[]} lines
+ * @returns {string}
+ */
+export function renderJobLines(lines) {
+  return lines.map((l) => `${l.n}. ${l.text}${l.rule ? `\n   rule: ${l.rule}` : ''}`).join('\n');
+}
+
+/**
+ * The PASS:/FAIL: examples the person wrote, each kept with its line number (answer 2 of a rubric interview — what the
+ * calibration compile reads). Empty string when there are none.
+ * @param {JobLine[]} lines
+ * @returns {string}
+ */
+export function renderExamples(lines) {
+  return lines.flatMap((l) => l.examples.map((e) => `line ${l.n} ${e.verdict}: ${e.text}`)).join('\n');
+}
+
+/**
+ * The inputs as the drafter is told about them: "the person pointed at these inputs: N label path".
+ * @param {JobInput[]} inputs
+ * @returns {string}
+ */
+export function renderInputs(inputs) {
+  return `the person pointed at these inputs: ${inputs.map((i) => `${i.n} ${i.label} ${i.value}`).join(' · ')}`;
+}
+
+/**
+ * The two cross-checks between a parsed job block and the Check type: a RUBRIC job needs at least one `PASS:` and one
+ * `FAIL:` example (the calibration compile reads them); a DETERMINISTIC job has no judge, so an example line would be
+ * silently dropped — a red instead.
+ * @param {JobLine[]} lines
+ * @param {boolean} rubric
+ * @returns {string|null} the plain red, or null when the block fits the Check type
+ */
+export function jobBlockFitsCheck(lines, rubric) {
+  const all = lines.flatMap((l) => l.examples.map((e) => ({ n: l.n, ...e })));
+  if (!rubric) {
+    return all.length ? `The job, line ${all[0].n}: PASS:/FAIL: examples are for a Rubric check — a Deterministic job has no judge to read them` : null;
+  }
+  if (!all.some((e) => e.verdict === 'PASS') || !all.some((e) => e.verdict === 'FAIL')) {
+    return 'The job: a Rubric check needs at least one "~ PASS:" line and one "~ FAIL:" line under a job line';
+  }
+  return null;
+}
+
+/**
+ * The signed `jobLines` field from parsed lines: the person's own words, `{n, text, rule, rules}` (examples stay inside the
+ * rule text, where the person wrote them). `rules` is the same `~` lines as an array, BESIDE the joined `rule` (never
+ * replacing it); it is omitted on a line with no `~` line, and an older spec lacks it entirely.
+ * @param {JobLine[]} lines
+ * @returns {{n: number, text: string, rule: string, rules?: string[]}[]}
+ */
+export function signedJobLines(lines) {
+  return lines.map((l) => ({ n: l.n, text: l.text, rule: l.rule, ...(l.rules.length ? { rules: [...l.rules] } : {}) }));
+}

package/src/judged.js

@@ -1,5 +1,5 @@
 // THE JUDGED FLOOR'S CORE — softgreen module 1 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4, plus the
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4, plus the
 // 2026-08-18 threshold addendum). POC: poc/softgreen-judge/poc.mjs — validated
 // logic, rewritten here, never copied (graduation is a rewrite).
 //
@@ -66,43 +66,11 @@
 import { quoteIn } from 'bareguard';
 import { createRequire } from 'node:module';
 import { extractArtifact, priceOf, scrubRaw, rateSourceFields } from './text.js';
-import { resolveProvider, judgeCallOptions } from './providers.js';
+import { resolveProvider } from './providers.js';
+import { thinkingCallOptions } from './thinking.js';
 
 const require = createRequire(import.meta.url);
 
-/**
- * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
- * the judge: every grading path imported it, so bareloop could run a worker on
- * any provider and still judge only on Claude.
- *
- * It is no longer read by any grading path. The judge identity is now RESOLVED
- * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
- * `runJudgedFloor`, an explicit argument into the calibration gate, and
- * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
- * Keeping the export is deliberate: it is part of the public API
- * (`src/index.js`) and an adopter importing it should not break on a minor.
- * What it means now is "the judge bareloop pinned before item 32", which is
- * still the right DEFAULT for an anthropic-api job and still the only tier with
- * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
- * haiku-4.5 only).
- *
- * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
- * rule with no detector is prose (F45) — only the value being compared moved
- * from this constant to the resolved identity:
- *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
- *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Change the judge and every
- *      signed judged spec hashes differently: the signature dies, and re-signing
- *      is what re-runs the calibration gate.
- *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a judge is a floor nobody can tell apart from a moved one.
- *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
- *      about to grade, naming both. It does not degrade in either direction:
- *      grading on the new judge judges against a floor nobody calibrated, and
- *      the old judge is not on offer.
- */
-export const JUDGE_MODEL = 'claude-haiku-4-5';
-
 /**
  * RESOLVE WHICH MODEL GRADES THIS JOB (PRD item 32.1).
  *
@@ -122,7 +90,7 @@ export const JUDGE_MODEL = 'claude-haiku-4-5';
  *      item 31.4 a green job runs on its own key alone, and this is what lets a
  *      JUDGED one do the same.
  *
- * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * There is deliberately NO third fallback to a library-pinned model. A caller that cannot
  * say which model will grade has not wired a judge, and the grading path stops
  * as a wiring gap rather than grading under an identity nobody chose — the same
  * answer an absent `judgeLoop` already gets. A silent default here would be the
@@ -198,15 +166,13 @@ export function resolveJudge({ specJudge, workerProvider, workerModel } = {}) {
  *
  * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
  * @param {string} fallbackProviderName used only when `source.provider` is absent
- * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @param {(o: {specModel?: string, flagModel?: string, suppliedModel?: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
  * @returns {{provider: string, model: string}}
  */
 export function resolveJobJudge(source, fallbackProviderName, resolveWorkerModelFn) {
   const providerName = source?.provider ?? fallbackProviderName;
-  const providerEntry = resolveProvider(providerName);
-  const { model } = resolveWorkerModelFn({
-    specModel: source?.model, flagModel: undefined, defaultModel: providerEntry.tiers.sonnet,
-  });
+  resolveProvider(providerName); // an unknown shape is the named throw, never a silent default
+  const { model } = resolveWorkerModelFn({ specModel: source?.model, flagModel: undefined });
   return resolveJudge({ specJudge: source?.judge, workerProvider: providerName, workerModel: model });
 }
 
@@ -1089,9 +1055,11 @@ function topLevelFunctionNames(artifactText) {
  * so the priced seam is the only legal one.
  * `rates` is the customer's own price for the judge's row (USD per 1K, `ratesFor`'s
  * `rates`); null/absent = bare-agent's built-in guess, exactly as before.
- * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o
+ * `thinking` is the job's SIGNED "Thinking on" tick (false/absent = off): the judge follows the signed value — so the calibration gate
+ * (10/10) and the later grading run with the SAME tick — and bare-agent decides what each model can switch (src/thinking.js).
+ * @param {{provider: any, system: string, rates?: {in: number, out: number}|null, thinking?: boolean}} o
  * @returns {{run: (msgs: any[], tools: any[], opts?: any) => Promise<any>}} */
-export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
+export const defaultJudgeLoop = ({ provider, system, rates = null, thinking = false }) => {
   const { Loop } = require('bare-agent');
   // BA-21: the Loop's run RESULT carries no `rateSource` — only the per-call metering event
   // does (`onLlmResult`). Capture it there and ride it on the result, so `runLocate` can
@@ -1107,7 +1075,7 @@ export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
   return {
     run: async (/** @type {any[]} */ msgs, /** @type {any[]} */ tools, /** @type {any} */ opts) => {
       seen = null;
-      const res = await loop.run(msgs, tools, { ...judgeCallOptions(provider), ...opts });
+      const res = await loop.run(msgs, tools, { ...thinkingCallOptions(provider, thinking === true ? 'on' : 'off'), ...opts });
       return res && typeof res === 'object' && seen ? { ...res, rateSource: /** @type {any} */ (seen).rateSource } : res;
     },
   };

package/src/keysfile.js

@@ -76,18 +76,24 @@ export function filledKeyNames(home) {
 }
 
 /**
- * Create the keys file with the five empty preset lines when — and only when — it does not
- * exist (mode 600). An existing file is never touched.
- * @param {readonly string[]} presetNames the names to seed, in order
+ * The two comment lines a fresh keys file is created with — no provider name, no preset key.
+ * Each key the person types becomes a row in Settings > Providers.
+ */
+export const KEYS_FILE_BODY = '# bareloop keys — type NAME=value by hand; this file is never shown or written by bareloop.\n'
+  + '# One line per provider key, e.g. MY_PROVIDER_API_KEY=... ; each key becomes a row in Settings > Providers.\n';
+
+/**
+ * Create the keys file with {@link KEYS_FILE_BODY} when — and only when — it does not
+ * exist (mode 600, dir 700). An existing file is never touched.
  * @param {string} [home]
  * @returns {boolean} true if it was created
  */
-export function ensureKeysFile(presetNames, home) {
+export function ensureKeysFile(home) {
   const file = keysFilePath(home);
   if (existsSync(file)) return false;
-  mkdirSync(keysHome(home), { recursive: true });
+  mkdirSync(keysHome(home), { recursive: true, mode: 0o700 });
   try {
-    writeFileSync(file, presetNames.map((n) => `${n}=\n`).join(''), { mode: 0o600, flag: 'wx' });
+    writeFileSync(file, KEYS_FILE_BODY, { mode: 0o600, flag: 'wx' });
   } catch (/** @type {any} */ e) {
     if (e?.code === 'EEXIST') return false; // lost a race: the file is there, untouched
     throw e;
@@ -101,6 +107,8 @@ export function ensureKeysFile(presetNames, home) {
  * @property {string[]} names the NAMES the file defines (sorted; never values)
  * @property {string|null} warning a plain-words warning (file readable by others, or
  *   unreadable), else null — a warning, never a refusal
+ * @property {boolean} [unreadable] true only when the file is there but could not be read (the Settings row then
+ *   reads "refused — see above"); absent otherwise
  * @property {Record<string,string|undefined>} env shell env with the file filling the
  *   names the shell does not set. THE ONLY place values leave this module.
  */
@@ -127,7 +135,7 @@ export function loadKeysEnv(opts = {}) {
   try {
     parsed = parseKeysText(readFileSync(file, 'utf8'));
   } catch (/** @type {any} */ e) {
-    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, env: { ...base } };
+    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, unreadable: true, env: { ...base } };
   }
   /** @type {Record<string,string|undefined>} */
   const env = { ...base };

package/src/kinds.js

@@ -1776,7 +1776,7 @@ async function runJudgedFloor(stage, ctx) {
       + `${MAX_JUDGED_PATHS} — a judged stage buys one call per artifact, and a runaway list is a bill`, {}, STOP_FAULTS.CRASHED);
   }
   // 1b. THE TIER THE SIGNED SET WAS GRADED BY, against the tier this run would buy.
-  //     `JUDGE_MODEL` has always SAID a bump forces a full recalibration; this is the
+  //     the judge model has always SAID a bump forces a full recalibration; this is the
   //     detector, because a rule with no wired detector is prose (F45). The stamp comes
   //     off the SIGNED calibration (`calibration.judgeModel`, carried across by
   //     `declaredStages`), so a mismatch means exactly one thing: the pin moved under a
@@ -1799,7 +1799,7 @@ async function runJudgedFloor(stage, ctx) {
   // model). The IDENTITY is checked before the seam and before the stamp, because
   // an unwired identity makes both of the messages below unwritable: neither
   // "would grade with X" nor "the judge is X" can be said by a stage that cannot
-  // name X. There is deliberately NO fall-back to `JUDGE_MODEL` here — a run that
+  // name X. There is deliberately NO library-pinned fall-back here — a run that
   // cannot say which model grades has not wired a judge, and grading under an
   // identity nobody chose is exactly the silent-ignore class this repo refuses
   // everywhere else.

package/src/ledger.js

@@ -1,5 +1,5 @@
 // The upstream ledger (module 4) — reactive lib/primitive incident monitoring.
-// Design record: docs/product/2026-07-11-upstream-ledger-design.md (adaptlearn
+// Design record: docs/logs/2026-07-11-upstream-ledger-design.md (adaptlearn
 // POC'd spec) + its 2026-07-13 addendum: the bareloop event mapping. One
 // append-only JSONL both the consumer (the panel, N6) and the maintainer read;
 // the A1/A2/A3 upstream-ask flow, mechanized — evidence in, human judgment out.

package/src/modellist.js

@@ -0,0 +1,84 @@
+// rewritten-from: fwdloop src/panel/settings.js@f9449e8 (`authHeaders`, `getWithKey`, `idsOf`, `listModels`)
+// PANEL-BUILD.md P8 — the ONE `<baseUrl>/models` GET. Settings > Providers' Test and Refresh and the
+// New job card's model-readiness check (`checkProviderReachable`, src/providers.js) all call it; no
+// second copy of the probe exists. It is a GET of a models LIST, never a completion, so it spends
+// no token and writes no spend row. The key goes in a header only and is never returned or logged.
+// A redirect is NOT followed (`redirect:'manual'`), so the key is never sent on to another host.
+// There is no default host: a blank Base URL makes no call.
+
+/** The default deadline for the one GET. */
+export const LIST_TIMEOUT_MS = 4000;
+
+/**
+ * The key goes only in a header, in the form each shape expects.
+ * @param {string} shape an API shape id (src/providershapes.js)
+ * @param {string} key
+ * @returns {Record<string, string>}
+ */
+export function authHeaders(shape, key) {
+  if (shape === 'anthropic-api') return { 'x-api-key': key, 'anthropic-version': '2023-06-01' };
+  if (shape === 'gemini-api') return { 'x-goog-api-key': key };
+  return { Authorization: `Bearer ${key}` };
+}
+
+/**
+ * The model ids a provider's list answer holds, per API shape (`data[].id` for two shapes;
+ * `models[].name` minus its `models/` prefix for the third). Sorted, de-duplicated.
+ * @param {string} shape
+ * @param {any} body
+ * @returns {string[]}
+ */
+export function idsOf(shape, body) {
+  const list = shape === 'gemini-api' ? body?.models : body?.data;
+  const key = shape === 'gemini-api' ? 'name' : 'id';
+  const ids = (Array.isArray(list) ? list : [])
+    .map((/** @type {any} */ m) => (typeof m?.[key] === 'string' ? m[key].replace(/^models\//, '') : ''))
+    .filter((id) => id !== '');
+  return [...new Set(ids)].sort();
+}
+
+/**
+ * @typedef {{ ok: true, models: string[], ms: number }
+ *   | { ok: false, why: string, status: string, detail?: string }} ListResult
+ */
+
+/**
+ * One free GET of `<baseUrl>/models` with the key in the header only and a deadline.
+ * Failure is data, never a throw: `why` is a plain sentence, `status` a short machine word
+ * (`no-base-url`, `redirect`, `HTTP <n>`, `timeout`, `unreachable`) for callers that need it.
+ * @param {object} o
+ * @param {string} o.shape an API shape id
+ * @param {string} o.baseUrl the row's Base URL ('' = no call)
+ * @param {string} o.key the key value (header only)
+ * @param {typeof fetch} [o.fetchImpl] test seam; defaults to the global `fetch`
+ * @param {number} [o.timeoutMs]
+ * @returns {Promise<ListResult>}
+ */
+export async function listModels({ shape, baseUrl, key, fetchImpl = fetch, timeoutMs = LIST_TIMEOUT_MS }) {
+  const base = typeof baseUrl === 'string' ? baseUrl.trim().replace(/\/+$/, '') : '';
+  if (base === '') return { ok: false, why: 'Type a Base URL.', status: 'no-base-url' };
+  const url = `${base}/models`;
+  const started = Date.now();
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(url, { method: 'GET', headers: authHeaders(shape, key), signal: ctl.signal, redirect: 'manual' });
+    if (res.status >= 300 && res.status < 400) {
+      return { ok: false, why: 'The provider answered with a redirect; the key was not sent on. Check the Base URL.', status: 'redirect' };
+    }
+    if (res.status === 401 || res.status === 403) return { ok: false, why: 'The provider refused the key.', status: `HTTP ${res.status}` };
+    if (!res.ok) return { ok: false, why: 'The provider answered with an error.', status: `HTTP ${res.status}` };
+    /** @type {any} */
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { ok: true, models: idsOf(shape, body), ms: Date.now() - started };
+  } catch (/** @type {any} */ e) {
+    if (e?.name === 'AbortError') return { ok: false, why: 'The provider did not answer in 4 seconds.', status: 'timeout' };
+    const cls = e?.code || e?.name || 'network-error';
+    // connection refused surfaces as fetch's bare TypeError ("fetch failed")
+    const refused = e?.name === 'TypeError' || e?.code === 'ECONNREFUSED' || e?.cause?.code === 'ECONNREFUSED';
+    return { ok: false, why: 'Could not reach the provider.', status: String(cls), detail: refused ? `nothing answering at ${url}` : `request failed: ${cls}` };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/monthly.js

@@ -33,37 +33,10 @@ import { readOrphanDraftSpends } from './draftspend.js';
 // the per-leg / per-run spend readers live with the ledger (one home, no import cycle through the replay reader)
 export { legSpend, runSpend, chainSpend };
 
-// The Money tab's per-provider breakdown groups a run by the endpoint it ran on and names
-// the groups it knows the vendor of. This is HISTORY labelling for spend already recorded
-// (an archived run keeps its provider whatever Settings holds today) — not the Providers
-// rows, which come from the keys file (src/providerrows.js).
-/** @type {readonly {id: string, name: string}[]} */
-const MONEY_LABELS = Object.freeze([
-  { id: 'anthropic', name: 'Anthropic' }, { id: 'openai', name: 'OpenAI' },
-  { id: 'gemini', name: 'Gemini' }, { id: 'deepseek', name: 'DeepSeek' },
-]);
-
-/**
- * Which known vendor a run's `(provider, baseUrl)` belongs to. `openai-api` with no override
- * is OpenAI; with DeepSeek's host it is DeepSeek; with any OTHER override it is none (null —
- * never silently pooled into OpenAI's figures).
- * @param {string|null|undefined} provider
- * @param {string|null|undefined} baseUrl
- * @returns {string|null} a MONEY_LABELS id, or null
- */
-function rowIdFor(provider, baseUrl) {
-  if (provider === 'anthropic-api') return 'anthropic';
-  if (provider === 'gemini-api') return 'gemini';
-  if (provider === 'openai-api') {
-    if (!baseUrl) return 'openai';
-    try {
-      const host = new URL(baseUrl).hostname;
-      if (host === 'api.deepseek.com') return 'deepseek';
-    } catch { /* an unparseable override is no known vendor */ }
-    return null;
-  }
-  return null;
-}
+// The Money tab's per-provider breakdown groups a run by the Providers ROW that served it (its
+// key variable name, `src/providerrows.js` `findRow`); a run no row claims lands under its own
+// `<shape> @ <baseUrl>`. This is HISTORY labelling for spend already recorded (an archived run
+// keeps its provider whatever Settings holds today). No vendor name or host is known here.
 
 /**
  * One run's wall time off its spine: job-start -> job-end when the run ended (exact), else the
@@ -289,11 +262,11 @@ export function monthSpend(opts = {}) {
 
 /**
  * The Money tab's figures: all-time and this-month spend, and per-provider breakdown
- * (rows from `rowIdFor`; a run on no known row lands under its own provider name, never
- * pooled into another row). Any leg with unknown spend makes the figure it belongs to
+ * (grouped by the matched Providers row's key variable name; a run on no row lands under its
+ * own provider name, never pooled into another row). Any leg with unknown spend makes the figure it belongs to
  * an "at least".
  * @param {{ home?: string, sessionsRoot?: string, now?: () => number, rows?: readonly import('./providerrows.js').KeyRow[] }} [opts] `rows` = the Providers rows: when given, `tokensByRow` sums each row's tokens
- * @returns {{ tokensByRow: Record<string, number>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
+ * @returns {{ tokensByRow: Record<string, number>, tokensByModel: Record<string, Record<string, number>>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
  *   byProvider: Record<string, {label: string, monthUsd: number, monthAtLeast: boolean, totalUsd: number, totalAtLeast: boolean, tokens: number, vouchedRounds: number, otherRounds: number, monthWallMs: number|null, monthWallAtLeast: boolean, totalWallMs: number|null, totalWallAtLeast: boolean}> }}
  */
 export function spendSummary(opts = {}) {
@@ -307,22 +280,29 @@ export function spendSummary(opts = {}) {
   const wallSeen = {};
   /** total tokens of the runs each Providers row served (matched by shape + endpoint + model) @type {Record<string, number>} */
   const tokensByRow = {};
+  /** tokens per model line of each row, from the spend rows that NAME the model; absent = no row names it (never 0) @type {Record<string, Record<string, number>>} */
+  const tokensByModel = {};
   for (const leg of readLegs({ home: opts.home, sessionsRoot: opts.sessionsRoot })) {
     let served = opts.rows ? findRow(opts.rows, { provider: leg.provider, baseUrl: leg.baseUrl, model: leg.model }) : null;
-    // an older spine records a model but no provider: it counts toward the row whose Name EXACTLY
-    // equals that model. Two rows sharing the Name make it ambiguous, so it counts toward neither.
+    // an older spine records a model but no provider: it counts toward the row with a model line EXACTLY
+    // named that model. Two rows naming it make it ambiguous, so it counts toward neither.
     if (opts.rows && leg.provider === null && leg.model !== null) {
-      const named = opts.rows.filter((r) => r.name === leg.model);
+      const named = opts.rows.filter((r) => r.models.some((l) => l.model === leg.model));
       served = named.length === 1 ? named[0] : null;
     }
-    if (served) tokensByRow[served.envName] = (tokensByRow[served.envName] ?? 0) + leg.tokens;
+    if (served) {
+      tokensByRow[served.envName] = (tokensByRow[served.envName] ?? 0) + leg.tokens;
+      if (typeof leg.model === 'string' && leg.model !== '') {
+        const own = (tokensByModel[served.envName] ??= {});
+        own[leg.model] = (own[leg.model] ?? 0) + leg.tokens;
+      }
+    }
     const inMonth = Number.isNaN(leg.at.getTime()) ? true : sameLocalMonth(leg.at, nowDate);
-    const id = rowIdFor(leg.provider, leg.baseUrl);
     // an older spine carries a model but no provider: say so honestly, one row per model —
     // never a provider guessed from the model's name
-    const notRecorded = id === null && leg.provider === null;
-    const key = id ?? (notRecorded ? `not-recorded:${leg.model ?? ''}` : `other:${leg.provider}${leg.baseUrl ? ` @ ${leg.baseUrl}` : ''}`);
-    const label = id ? (MONEY_LABELS.find((r) => r.id === id)?.name ?? id)
+    const notRecorded = !served && leg.provider === null;
+    const key = served ? served.envName : (notRecorded ? `not-recorded:${leg.model ?? ''}` : `other:${leg.provider}${leg.baseUrl ? ` @ ${leg.baseUrl}` : ''}`);
+    const label = served ? served.envName
       : (notRecorded ? (leg.model ? `not recorded (model ${leg.model})` : 'not recorded') : key.slice('other:'.length));
     const p = (byProvider[key] ??= { label, monthUsd: 0, monthAtLeast: false, totalUsd: 0, totalAtLeast: false, tokens: 0, vouchedRounds: 0, otherRounds: 0, monthWallMs: 0, monthWallAtLeast: false, totalWallMs: 0, totalWallAtLeast: false });
     const w = (wallSeen[key] ??= { monthRuns: 0, monthKnown: 0, totalKnown: 0 });
@@ -349,7 +329,7 @@ export function spendSummary(opts = {}) {
     if (w.totalKnown === 0) p.totalWallMs = null;
     if (w.monthRuns > 0 && w.monthKnown === 0) p.monthWallMs = null;
   }
-  return { tokensByRow, total, month, byProvider };
+  return { tokensByRow, tokensByModel, total, month, byProvider };
 }
 
 /**