bareloop 0.40.0 → 0.41.0

package/src/userrun.js

@@ -25,7 +25,6 @@
 // authored is preserved from the spine as a reusable artifact, and the next run of
 // this shape reuses and fine-tunes it rather than starting cold.
 import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, rmSync, readdirSync, openSync, readSync, closeSync, fstatSync, unlinkSync } from 'node:fs';
-import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { execFileSync, spawn } from 'node:child_process';
 import { join, resolve, dirname, basename } from 'node:path';
@@ -83,14 +82,11 @@ import { parseJsonl } from './replayio.js';
 import { claimRun, monthlyRefusalText, legSpend, chainSpend } from './monthly.js';
 import { ConfigError } from './config.js';
 import { commandFor } from './invoke.js';
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, priceReadout, ratesFor, rowsForHome } from './providerrows.js';
+import { judgeRatesFor, keyNameFor, keyValueOf, priceReadout, ratesFor, ratesOfLine, resolveWorker, judgeRowFor, rowsForHome, REFUSE_NAME_MODEL } from './providerrows.js';
 // the banner's wall arithmetic, extracted so it is reachable by a test (F83): the
 // end-of-run readout sits past the approval gate, so nothing could ever drive it here
 import { wallLine, doomedResume, deathAtOf, evidencePackage, doorLines, resumeAtLines, reviewDoorPackage, runDoorLines, tokensLine, doorTimingRedLines } from './u-readout.js';
 
-const require = createRequire(import.meta.url);
-const { AnthropicProvider } = require('bare-agent/providers');
-
 const JOBS = {
   'aurora-spawner': {
     spec: 'aurora-u-spawner-types.json',
@@ -174,10 +170,10 @@ const JOBS = {
   },
   // PRD item 28 / 30.9 — the openai-api probe through THIS runner (the shipped
   // one), not poc-run-param.mjs. Same job shape, same seed, its own patient copy.
-  'bareguard-types-deepseek': {
-    spec: 'bareguard-u-types-deepseek.json',
-    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u-deepseek',
-    spine: 'bareguard-u-deepseek-bareloop',
+  'bareguard-types-gateway': {
+    spec: 'bareguard-u-types-gateway.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u-gateway',
+    spine: 'bareguard-u-gateway-bareloop',
     seed: '2ae8fcd37041c186524a6eb5e953b9752cd602fa',
   },
   // N4's hitl PROVING job (build plan §Proving; hamr's ruling, 2026-08-13). The job
@@ -273,7 +269,8 @@ class ExitSignal extends Error {
  * @property {string} [into] the source door's own directory (`source.json`, and the spine directory beside it).
  *   Default `dirname(workdir)` — the copied-tree layout, where the tree is `<into>/tree`. A repo job on a WORKTREE
  *   (P6 item 1) has its tree inside the person's repo, so its `into` is passed explicitly.
- * @property {string|null} [model] the raw `--model` tier name (`sonnet`/`haiku`), or null for the default
+ * @property {string|null} [model] the raw `--model <id>` (a model id of a ticked Settings line), or null
+ * @property {string|null} [providerKey] the raw `--provider <KEY>` (a key's env name), or null
  * @property {string|null} [readShim] the raw `--read-shim` arm name, or null for the default
  * @property {string|null} [scout] the raw `--scout` value (`on`/`off`), or null for the default
  * @property {string|null} [draftSpentUsd] the raw `--draft-spent-usd` value (hamr's
@@ -306,6 +303,7 @@ class ExitSignal extends Error {
  * @property {string} spineName
  * @property {string} [into] see `RunOpts.into`
  * @property {string|null} model
+ * @property {string|null} providerKey
  * @property {string|null} readShim
  * @property {string|null} scout
  * @property {string|null} draftSpentUsd
@@ -389,25 +387,13 @@ async function execute(ctx) {
   /** @type {{workdir: string, seed: string, spine: string}} */
   const target = { workdir: ctx.workdir, seed: ctx.seed, spine: ctx.spineName };
 
-  // --model picks the DEFAULT worker tier (runner territory — the spec names no model, so
-  // the signed hash is unaffected). Tier names, not model ids. This map is the OPERATOR's
-  // and is deliberately WIDER than the planner's menu: since 2026-08-06 `STEP_MODELS` is
-  // sonnet-only (the haiku attribution probe — see src/plan.js), so a PLAN can no longer
-  // say haiku while `--model haiku` still can. haiku takes no output_config.effort
-  // (provider-gated, battery rule) — nothing to gate yet since neither tier sets effort.
-  // PRD v1.36 floor: the drafter/default tier is sonnet MINIMUM — measured, a haiku
-  // drafter died plan-red twice on the same rejection (ms7gne7s). `--model haiku` runs
-  // BELOW the floor: an explicit operator probe whose rows are probes, never battery
-  // evidence.
-  const DEFAULT_TIER_MODELS = { sonnet: 'claude-sonnet-5', haiku: 'claude-haiku-4-5-20251001' };
-  // `modelFlagArg` is null when --model was never passed at all — distinct from a
-  // flag that happens to resolve to the default tier's own id, because the SPEC
-  // (below, once loaded) needs to know whether a flag was actually given, not just
-  // what it resolved to (build-list #3: spec wins, a mismatched flag is refused).
+  // --model <id> names the Settings line a run works on when the SPEC names no model (an older spec, signed before a job carried its
+  // own); a spec's own `model` still wins and a different --model is refused. --provider <KEY> narrows to one key when two keys tick the
+  // same id. Runner territory: the spec names neither, so the signed hash is unaffected. There are no tier aliases and no built-in model.
+  // `modelFlagArg` is null when --model was never passed — distinct from a flag that happens to equal the spec's model, because the SPEC
+  // (below, once loaded) needs to know whether a flag was actually given (build-list #3: spec wins, a mismatched flag is refused).
   const modelFlagArg = ctx.model ?? null;
-  const tierArg = modelFlagArg ?? 'sonnet';
-  const FLAG_TIER_MODEL = DEFAULT_TIER_MODELS[/** @type {keyof typeof DEFAULT_TIER_MODELS} */ (tierArg)];
-  if (!FLAG_TIER_MODEL) { err(`unknown --model "${tierArg}" — one of: ${Object.keys(DEFAULT_TIER_MODELS).join(', ')}`); throw new ExitSignal(2); }
+  const providerFlagArg = ctx.providerKey ?? null;
   // --read-shim picks the READ SHIM's ARM (src/readshim.js, Phase 2 A0/A1/A2/A3). Runner
   // territory exactly like --model: the spec names no shim, so the signed hash is
   // unaffected. Phase 2 itself never flipped this default — its own "what this
@@ -545,11 +531,12 @@ async function execute(ctx) {
   try {
     modelResolution = resolveWorkerModel({
       specModel: spec.model,
-      flagModel: modelFlagArg === null ? undefined : FLAG_TIER_MODEL,
-      defaultModel: /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet,
+      flagModel: modelFlagArg === null ? undefined : modelFlagArg,
+      // a scripted provider handed in by a test IS the run: it names its own model; a real run has no default
+      suppliedModel: deps.provider ? String(/** @type {any} */ (deps.provider).model ?? 'scripted') : undefined,
     });
   } catch (e) {
-    die(/** @type {Error} */ (e).message);
+    die(spec.model === undefined && modelFlagArg === null ? REFUSE_NAME_MODEL : /** @type {Error} */ (e).message);
   }
   const MODEL = modelResolution.model;
   const MODEL_LABEL = modelResolution.source === 'spec' ? `${MODEL} (spec)` : MODEL;
@@ -1022,16 +1009,20 @@ async function execute(ctx) {
   // spine, then handed down as data (`runJob`'s `rates`) — nothing deep in the run re-reads config. A bad
   // price refuses here; it never falls back to the built-in guess. No price set = `null` = no `rates` key
   // passed anywhere, byte-identical to before. The judge's own row is resolved below, beside its key.
-  const keyCfg = cfgOn ? rowsForHome(cfgHome) : [];
+  const keyCfg = cfgOn ? rowsForHome(cfgHome, env) : [];
   /** @type {ReturnType<typeof ratesFor>} */
   let workerPrice = null;
-  try {
-    workerPrice = ratesFor(spec.provider, spec.baseUrl, keyCfg, spec.model);
-  } catch (e) {
-    if (!(e instanceof ConfigError)) throw e;
-    err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
-    throw new ExitSignal(2);
-  }
+  // WHICH SETTINGS LINE THIS RUN WORKS ON (P8): the row is the key, the Base URL and the old-max_tokens tick; the line is the model
+  // and its price. A scripted provider handed in by a test IS the run (no row). A refusal here is $0, before anything else.
+  const W = deps.provider ? null : resolveWorker(keyCfg, spec, { model: modelFlagArg, provider: providerFlagArg });
+  const refuseWorker = () => { if (W && !W.ok) { err(W.say.includes('Nothing was spent') ? W.say : `${W.say} Nothing was spent.`); throw new ExitSignal(2); } };
+  // the preview cannot name its key without a line: refuse it here. A SIGNED run meets its other gates first (pause door, wall) and
+  // is refused at the key check below — still before anything is spent
+  if ((ctx.approve ?? null) === null) refuseWorker();
+  /** the endpoint the worker talks to: the chosen row's own Base URL (a spec signed before addresses were required carries none) */
+  const baseUrl = W && W.ok ? W.baseUrl : (typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined);
+  const wLine = W && W.ok ? ratesOfLine(W.line) : null;
+  workerPrice = W ? (wLine && W.ok ? { ...wLine, envName: W.row.envName } : null) : ratesFor(spec.provider, spec.baseUrl, keyCfg, spec.model);
 
   if ((ctx.approve ?? null) !== specHash) {
     out(dead ? 'U — RESUME, continuing a halted run, REAL dollars' : 'U — user-mode e2e, ONE run, REAL dollars');
@@ -1192,7 +1183,7 @@ async function execute(ctx) {
     // right key only by accident of the runner's own generic error message,
     // never from this hint. `keyNameFor` is the same resolved name
     // the real key check at launch reads (the person's row variable, else the provider's built-in one).
-    const invoke = (/** @type {string} */ tail) => `  ${keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name}=... ${INVOKE}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL}${tail} --approve ${PRINT_APPROVE}`;
+    const invoke = (/** @type {string} */ tail) => `  ${(W && W.ok ? W.row.envName : null) ?? keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name ?? '<KEY>'}=... ${INVOKE}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL}${tail} --approve ${PRINT_APPROVE}`;
     /** the door the operator has already picked, as flags — hoisted out of the else
      * below so the inhibitor line at the bottom can print the WHOLE command rather
      * than a shape the operator has to assemble. Empty on an ordinary run and on the
@@ -1446,13 +1437,15 @@ async function execute(ctx) {
   let judgePrice = null;
   if (JUDGES) {
     try {
-      judgePrice = judgeRatesFor(judge, spec.provider, spec.baseUrl, workerPrice, keyCfg);
+      judgePrice = judgeRatesFor(judge, spec.provider, baseUrl, workerPrice, keyCfg);
     } catch (e) {
       if (!(e instanceof ConfigError)) throw e;
       err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
       throw new ExitSignal(2);
     }
   }
+  /** the row the judge's key (and endpoint) comes from: the worker's own row when the judge shares its provider, else the judge provider's row */
+  const judgeRow = judgeRowFor(keyCfg, judge, spec.provider, W && W.ok ? W.row : null);
   // undefined, not null: both come straight off `env[...]` lookups below, which
   // (like process.env) never produce null for a missing key.
   /** @type {string|undefined} */
@@ -1468,13 +1461,10 @@ async function execute(ctx) {
     // row = the built-in. Names only — values come from the
     // env / keys file. The judge follows the worker's choice when it is the same provider
     // (the same rule that gives it the worker's baseUrl below).
-    const workerEnv = applyConfiguredKey(env, spec.provider, spec.baseUrl, keyCfg, spec.model);
-    const judgeEnv = judge.provider === spec.provider ? workerEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model);
-    /** the variable NAME this worker's key is read from (the person's pick, else built-in) — for messages only */
-    const workerKeyName = keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name;
-    // A green anthropic-api job's behaviour is byte-identical to before: its
-    // worker key IS `ANTHROPIC_API_KEY`, demanded as ever.
-    workerApiKey = workerEnv[providerEntry.envKey];
+    refuseWorker();
+    const workerKeyName = /** @type {NonNullable<typeof W> & {ok: true}} */ (W).row.envName;
+    // A job's worker key is its Settings row's own variable — there is no built-in name.
+    workerApiKey = keyValueOf(env, workerKeyName);
     if (!workerApiKey) { err(`${workerKeyName} not set (secrets load from the environment — never the tree)`); throw new ExitSignal(2); }
     // F181 — a key that reads as "set" above can still carry a line break/
     // control char/stray whitespace (a two-line secret-store entry, e.g.) and
@@ -1487,10 +1477,10 @@ async function execute(ctx) {
     // override matters most in the case this item exists for: a job whose worker and
     // judge are the SAME provider but different accounts, and the anthropic case
     // where one variable used to do two jobs.
-    judgeApiKey = env.JUDGE_API_KEY ?? judgeEnv[judgeEntry.envKey];
+    judgeApiKey = env.JUDGE_API_KEY ?? keyValueOf(env, judgeRow?.envName);
     if (JUDGES && !judgeApiKey) {
       err(`This job's close JUDGES (${judgedStages(spec.closeDecl).length} judged stage(s)) and its judge is ${judge.model} on ${judge.provider}${spec.judge ? ' (signed override)' : " (this job's own worker model — no `judge` override signed)"}.`);
-      err(`Neither JUDGE_API_KEY nor ${judgeEntry.envKey} is set — secrets load from the environment, never the tree.`);
+      err(`Neither JUDGE_API_KEY nor ${judgeRow?.envName ?? `a key row for ${judge.provider}`} is set — secrets load from the environment, never the tree.`);
       err('Refused at $0, BEFORE the worker spends anything: a judged run that discovers this at the close has paid for a verdict it cannot render.');
       throw new ExitSignal(2);
     }
@@ -1500,7 +1490,7 @@ async function execute(ctx) {
     if (JUDGES) {
       const judgeKeyProblem = apiKeyProblem(/** @type {string} */ (judgeApiKey));
       if (judgeKeyProblem) {
-        const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : judgeEntry.envKey;
+        const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : (judgeRow?.envName ?? judge.provider);
         err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
         throw new ExitSignal(2);
       }
@@ -1640,7 +1630,7 @@ async function execute(ctx) {
   // OpenAI-compatible gateway/endpoint. Undefined for anthropic-api jobs and
   // for an openai-api job that names none (bare-agent's OpenAIProvider then
   // defaults to api.openai.com/v1 on its own).
-  const baseUrl = typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined;
+  // (`baseUrl` — the worker row's Base URL — was resolved above with the Settings line)
   // TEST SEAM — same shape as the bundle door (src/bundlerun.js): a caller that supplies
   // `deps.provider` skips the real-key check above entirely and this
   // construction never runs (a scripted provider IS the run).
@@ -1648,26 +1638,11 @@ async function execute(ctx) {
   let providerFor = deps.providerFor;
   let judgeProvider = deps.judgeProvider ?? null;
   if (!provider) {
-    provider = makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: MODEL, baseUrl });
-    // P: the per-step model-tier factory. The TIER menu a PLAN may name is signed in the
-    // plan schema (STEP_MODELS — sonnet-only since the 2026-08-06 haiku attribution probe);
-    // the tier->model mapping is the RUNNER's territory, here, and keeps haiku for the
-    // operator's own --model knob. haiku takes no output_config.effort (provider-gated,
-    // battery rule) - nothing to gate yet since neither tier sets effort params.
-    // `sonnet` maps to the RESOLVED worker model (MODEL — spec/flag/default), not the
-    // bare provider-table id, so a spec-named model reaches every plan step's own
-    // provider (STEP_MODELS is sonnet-only), not just the top-level `provider` above.
-    // ONLY when the SPEC named it: a `--model haiku` probe keeps its old reach (the
-    // top-level provider), never silently widening into every step's tier. The tier
-    // table itself comes from `providerEntry` (src/providers.js) — for openai-api
-    // today that means BOTH tiers resolve to the same `deepseek-flash` id (hamr's
-    // ruling, PRD 30.7: one secondary provider, not a menu; swapped from the
-    // retired `deepseek-chat`, F171), so a `--model haiku` probe against an
-    // openai-api job harmlessly re-resolves to the same model.
-    const TIER_MODELS = modelResolution.source === 'spec' ? { ...providerEntry.tiers, sonnet: MODEL } : providerEntry.tiers;
-    /** @type {Record<string, any>} */
-    const tierCache = {};
-    providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)] === MODEL ? provider : makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)], baseUrl }));
+    const legacyMaxTokens = W && W.ok ? W.row.legacyMaxTokens : false;
+    provider = makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: MODEL, baseUrl, legacyMaxTokens });
+    // P: the per-step model factory. The ONLY tier a plan may name is the schema token `sonnet` (STEP_MODELS, src/plan.js — a
+    // documented schema token, not a model id); it means THIS job's worker model, so every step's provider is the one above.
+    providerFor = () => provider;
     // SOFTGREEN — the JUDGED stage's own provider. Since PRD item 32.1 its identity is
     // RESOLVED (`judge` above), not pinned: the spec's signed `judge` override, else this
     // job's own worker model. It is still never a step knob and never agent-selectable —
@@ -1684,7 +1659,7 @@ async function execute(ctx) {
     // every live softgreen run would have done: run-author wired this seam and this
     // runner never did.
     judgeProvider = judgeApiKey
-      ? makeProvider(judge.provider, { apiKey: /** @type {string} */ (judgeApiKey), model: judge.model, baseUrl: judge.provider === spec.provider ? baseUrl : undefined })
+      ? makeProvider(judge.provider, { apiKey: /** @type {string} */ (judgeApiKey), model: judge.model, baseUrl: judge.provider === spec.provider ? baseUrl : (judgeRow && judgeRow.baseUrl.trim() !== '' ? judgeRow.baseUrl.trim() : undefined), legacyMaxTokens: judgeRow ? judgeRow.legacyMaxTokens : false })
       : null;
   }
 
@@ -2433,6 +2408,7 @@ function buildCtx(mode, opts) {
     spineName: /** @type {string} */ (opts.spineName),
     ...(opts.into === undefined ? {} : { into: opts.into }),
     model: opts.model ?? null,
+    providerKey: opts.providerKey ?? null,
     readShim: opts.readShim ?? null,
     scout: opts.scout ?? null,
     draftSpentUsd: opts.draftSpentUsd ?? null,
@@ -2661,6 +2637,7 @@ export async function main(argv, deps = {}) {
       spineName: target.spine,
       ...(target.into === undefined ? {} : { into: target.into }),
       model: argFlag('model'),
+      providerKey: argFlag('provider'),
       readShim: argFlag('read-shim'),
       scout: argFlag('scout'),
       draftSpentUsd: argFlag('draft-spent-usd'),

package/types/authorflow.d.ts

@@ -619,7 +619,7 @@ export function resolveSourcePrefixes({ workdir, sourcePaths, seedFiles }: {
  */
 /**
  * @param {{ceilingUsd?: number|null,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void}} [o]
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void}} [o]
  *   `ceilingUsd` is the OPERATOR's ceiling; `null`/absent is UNBOUNDED.
  *   `onCall` is a REPORTING seam fired as each metered call lands — the shell's
  *   only chance to know what has been spent while the run is still alive. It is
@@ -635,7 +635,7 @@ export function makeCostBook({ ceilingUsd, onCall }?: {
         label: string;
         costUsd: number | null;
         unpricedRounds: number;
-        thinkingApplied?: boolean | null;
+        thinkingStatus?: string;
     }) => void;
 }): {
     /** @param {string} label @param {any} r a bare-agent run result @param {number} [attempt] */
@@ -700,7 +700,7 @@ export function makeCostBook({ ceilingUsd, onCall }?: {
  * `cacheMessages` (F18) and `maxTokens` (F30) are not optional on this stack.
  * `rates` is the customer's own price for this provider's key row (USD per 1K, `ratesFor`);
  * absent = bare-agent's built-in guess, exactly as before.
- * `draftThinking` ('on' | 'off', operator knob; default 'off') adds the drafter's per-call thinking option via `draftCallOptions`.
+ * `draftThinking` ('on' | 'off', the job's "Thinking on" tick spelled as a word; default 'off') adds the drafter's per-call thinking option via `thinkingCallOptions` (src/thinking.js, the one owner).
  * @param {any} provider @param {{system?: string, maxTokens?: number, rates?: {in: number, out: number}|null, draftThinking?: string}} [o]
  * @returns {(messages: any[], tools: any[], opts?: any) => Promise<any>}
  */
@@ -936,7 +936,7 @@ export function runConfirmTurn({ verdictType, answers, questions, labels, facts,
  *   generate: Function, seedReadFn?: Function, closeCtx?: any,
  *   ceilingUsd?: number|null,
  *   onPhase?: (phase: string, data?: any) => void,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   maxRevisions?: number, structureRetries?: number,
  *   structuredMode?: 'tool'|'text', catalogue?: Record<string, any>, writeScope?: string[]|null,
  *   priorCalls?: {label: string, costUsd: number|null, unpricedRounds: number}[]|null,
@@ -976,7 +976,7 @@ export function authorClose({ workdir, seedRef, lang, verdictType, answers, ques
         label: string;
         costUsd: number | null;
         unpricedRounds: number;
-        thinkingApplied?: boolean | null;
+        thinkingStatus?: string;
     }) => void;
     maxRevisions?: number;
     structureRetries?: number;

package/types/authorjob.d.ts

@@ -85,7 +85,7 @@ export function refuseLockedKind(kind: string): Refusal;
  *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
  *   rates?: {in: number, out: number}|null, draftThinking?: 'on'|'off',
  *   onPhase?: (phase: string, data?: any) => void,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
  *   authorFn?: Function, authorOpts?: object, writeScope?: string[]|null,
  *   signerFix?: Function|any, proposeFn?: Function, compileOpts?: object,
@@ -130,7 +130,7 @@ export function authorCloseForJob({ answers, repoPath, lang, verdictType, questi
         label: string;
         costUsd: number | null;
         unpricedRounds: number;
-        thinkingApplied?: boolean | null;
+        thinkingStatus?: string;
     }) => void;
     seedFn?: Function;
     scoutFn?: Function;

package/types/authorscout.d.ts

@@ -92,7 +92,7 @@ export function defaultSurveyor({ workdir, granted, auditPath, ctx }: {
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingApplied?: boolean|null}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
  *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
@@ -115,7 +115,7 @@ export function runAuthorScout({ workdir, provider, rounds, minBytes, blobMax, m
         label: string;
         costUsd: number | null;
         unpricedRounds: number;
-        thinkingApplied?: boolean | null;
+        thinkingStatus?: string;
     }) => void;
     createLoop?: (o: {
         system: string;

package/types/config.d.ts

@@ -16,15 +16,31 @@ export function configPath(home?: string): string;
 export function readConfig(opts?: {
     home?: string;
 }): ConfigRead;
+/**
+ * One key-row field's value problem in plain words, or null when fine.
+ * @param {string} field `model` | `shape` | `baseUrl` | `legacyMaxTokens`
+ * @param {unknown} v
+ * @returns {string|null}
+ */
+export function providerFieldProblem(field: string, v: unknown): string | null;
+/**
+ * THE one rule for a row's model lines, used by config validation and the Settings routes. A price
+ * is a PAIR (`inPerM` and `outPerM`, each a finite number >= 0 — 0 / 0 typed is a chosen price) or
+ * neither (null / absent). A ticked line (`use`) needs both. Plain words, or null.
+ * @param {unknown} list
+ * @returns {string|null}
+ */
+export function modelsProblem(list: unknown): string | null;
 /**
  * Apply a patch and write. `null` deletes a field. Top-level fields shallow-merge;
- * `keys` merges per key variable name, then per field. Validated before anything is
- * written; nothing is written on a refusal.
+ * `keys` merges per key variable name, then per field; `models.<ENV>` is REPLACED WHOLE (`null`
+ * clears it). Validated before anything is written; nothing is written on a refusal.
  *
- * Patch fields understood: `monthlyLimitUsd` (finite > 0), `anthropicBalanceNote`
- * (finite >= 0), `keys.<ENV NAME>.{name,shape,baseUrl}` (Name = a model id, shape = a provider table name, baseUrl = blank or http(s)). Any other
- * field is passed through untouched (kept), but the whole document is swept for
- * secret-shaped strings first.
+ * Patch fields understood: `monthlyLimitUsd` (finite > 0), `keys.<ENV>.{shape,baseUrl,legacyMaxTokens}`,
+ * `models.<ENV>` (a list judged by {@link modelsProblem}). The first write of a row's `models` list
+ * removes that row's older `name` / `priceInPerM` / `priceOutPerM` in the SAME write (never two
+ * sources); a retired top-level `anthropicBalanceNote` is dropped on any write. Any other field is
+ * kept, but the whole document is swept for secret-shaped strings first.
  * @param {Record<string, any>} patch
  * @param {{ home?: string }} [opts]
  * @returns {Record<string, any>} the document as written
@@ -35,6 +51,7 @@ export function updateConfig(patch: Record<string, any>, opts?: {
 /** A plain-words config failure (bad value, secret-shaped string, unreadable file). */
 export class ConfigError extends Error {
 }
+export function cleanBaseUrl(v: string): string;
 export type ConfigRead = {
     /**
      * the parsed document ({} when missing/unreadable)

package/types/draftspend.d.ts

@@ -2,10 +2,10 @@
  * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
  *  - `step-start`  {no, id, label, at}
  *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
- *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway")
- *  - `call`        {no, step, label, model, thinking, thinkingApplied?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
- *    (`thinking` = what was asked and sent: off | on | not-switchable | unverified; `thinkingApplied` = bare-agent's own verdict for the
- *    call's run (true | false | null), present only when thinkingMode was sent)
+ *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway" / "can't change it" / "not confirmed")
+ *  - `call`        {no, step, label, model, thinking, thinkingSupport, thinkingStatus?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (`thinking` = the tick's mode: off | on; `thinkingSupport` = bare-agent's lookup for the model: true | false | 'unverified';
+ *    `thinkingStatus` = bare-agent's own verdict for the call's run: applied | unsupported | ignored | unknown, present only when thinkingMode was sent)
  *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
  * @typedef {{kind: string, no: number, at: string, [k: string]: any}} DraftEvent
  */
@@ -108,10 +108,10 @@ export const DRAFT_LOG_FILE: "draft-log.jsonl";
  * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
  *  - `step-start`  {no, id, label, at}
  *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
- *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway")
- *  - `call`        {no, step, label, model, thinking, thinkingApplied?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
- *    (`thinking` = what was asked and sent: off | on | not-switchable | unverified; `thinkingApplied` = bare-agent's own verdict for the
- *    call's run (true | false | null), present only when thinkingMode was sent)
+ *  - `step-label`  {no, label, at}   (the step reads `label` from now on, status and times untouched: the thinking row's "the model thought anyway" / "can't change it" / "not confirmed")
+ *  - `call`        {no, step, label, model, thinking, thinkingSupport, thinkingStatus?, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (`thinking` = the tick's mode: off | on; `thinkingSupport` = bare-agent's lookup for the model: true | false | 'unverified';
+ *    `thinkingStatus` = bare-agent's own verdict for the call's run: applied | unsupported | ignored | unknown, present only when thinkingMode was sent)
  *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
  */
 export type DraftEvent = {

package/types/index.d.ts

@@ -15,7 +15,7 @@ export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBr
 export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASSES, VOUCHED_RATE_SOURCES, rateProvenance, spendProvenance } from "./ledger.js";
 export { readShimArm, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY } from "./readshim.js";
 export { runDeclaredClose, runStage, seedRead, seedAtHead, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling, resolveHumanRuling, JUDGE_ATTEMPTS, MAX_JUDGED_PATHS, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages } from "./kinds.js";
-export { JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS, runLocate, decide, CALIBRATION_SIZE, validateCalibrationSet, expectedOf } from "./judged.js";
+export { resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS, runLocate, decide, CALIBRATION_SIZE, validateCalibrationSet, expectedOf } from "./judged.js";
 export { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts } from "./cardauthor.js";
 export { runCalibration, INJECTION_LOCATE_BATTERY, CASUALTY_AXES } from "./calibrate.js";
 export { validateDeclaration, KIND_CATALOGUE, LOCKED_KINDS, genreEnv, genreInstruments, LOCKED_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";

package/types/job.d.ts

@@ -122,18 +122,18 @@ export function checkApproval(job: object, approvals: unknown): boolean;
  * mismatched flag is a mistake worth stopping on, never a silent swap); the
  * same id from both is not a conflict. Extracted from scripts/run-u.mjs so
  * the decision is testable without running the script or touching a provider.
- * @param {{ specModel?: string, flagModel?: string, defaultModel: string }} args
+ * @param {{ specModel?: string, flagModel?: string, suppliedModel?: string }} args
  *   `specModel` — `job.model` if the signed spec carries one, else undefined.
  *   `flagModel` — the model id an explicit `--model <tier>` resolved to, else
  *   undefined (a flag that was never passed, not merely a default tier name).
- *   `defaultModel` — the runner's own default when neither spec nor flag says.
+ *   `suppliedModel` — a model the CALLER supplies when neither spec nor flag says (bareloop keeps none of its own).
  * @returns {{ model: string, source: 'spec'|'flag'|'default' }}
- * @throws {Error} when the spec names a model and the flag names a different one
+ * @throws {Error} when the spec names a model and the flag names a different one, or when no model is named at all
  */
-export function resolveWorkerModel({ specModel, flagModel, defaultModel }: {
+export function resolveWorkerModel({ specModel, flagModel, suppliedModel }: {
     specModel?: string;
     flagModel?: string;
-    defaultModel: string;
+    suppliedModel?: string;
 }): {
     model: string;
     source: "spec" | "flag" | "default";

package/types/judged.d.ts

@@ -17,7 +17,7 @@
  *      item 31.4 a green job runs on its own key alone, and this is what lets a
  *      JUDGED one do the same.
  *
- * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * There is deliberately NO third fallback to a library-pinned model. A caller that cannot
  * say which model will grade has not wired a judge, and the grading path stops
  * as a wiring gap rather than grading under an identity nobody chose — the same
  * answer an absent `judgeLoop` already gets. A silent default here would be the
@@ -79,7 +79,7 @@ export function resolveJudge({ specJudge, workerProvider, workerModel }?: {
  *
  * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
  * @param {string} fallbackProviderName used only when `source.provider` is absent
- * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @param {(o: {specModel?: string, flagModel?: string, suppliedModel?: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
  * @returns {{provider: string, model: string}}
  */
 export function resolveJobJudge(source: {
@@ -89,7 +89,7 @@ export function resolveJobJudge(source: {
 }, fallbackProviderName: string, resolveWorkerModelFn: (o: {
     specModel?: string;
     flagModel?: string;
-    defaultModel: string;
+    suppliedModel?: string;
 }) => {
     model: string;
     source: string;
@@ -309,38 +309,6 @@ export function decide(facts: any, card: any, { artifactText }?: {
     firstRed: string | null;
     reason: string | null;
 };
-/**
- * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
- * the judge: every grading path imported it, so bareloop could run a worker on
- * any provider and still judge only on Claude.
- *
- * It is no longer read by any grading path. The judge identity is now RESOLVED
- * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
- * `runJudgedFloor`, an explicit argument into the calibration gate, and
- * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
- * Keeping the export is deliberate: it is part of the public API
- * (`src/index.js`) and an adopter importing it should not break on a minor.
- * What it means now is "the judge bareloop pinned before item 32", which is
- * still the right DEFAULT for an anthropic-api job and still the only tier with
- * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
- * haiku-4.5 only).
- *
- * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
- * rule with no detector is prose (F45) — only the value being compared moved
- * from this constant to the resolved identity:
- *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
- *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Change the judge and every
- *      signed judged spec hashes differently: the signature dies, and re-signing
- *      is what re-runs the calibration gate.
- *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a judge is a floor nobody can tell apart from a moved one.
- *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
- *      about to grade, naming both. It does not degrade in either direction:
- *      grading on the new judge judges against a floor nobody calibrated, and
- *      the old judge is not on offer.
- */
-export const JUDGE_MODEL: "claude-haiku-4-5";
 /**
  * The locate call's token ceiling. The POC's two real artifacts came back well
  * inside 2000; this doubles that for headroom on a longer artifact, and the
@@ -402,13 +370,14 @@ export const JUDGE_RULE_IDS: readonly string[];
 export const CALIBRATION_SIZE: 10;
 /** the two verdicts a case may expect — `decide()`'s own closed set */
 export const CASE_VERDICTS: readonly string[];
-export function defaultJudgeLoop({ provider, system, rates }: {
+export function defaultJudgeLoop({ provider, system, rates, thinking }: {
     provider: any;
     system: string;
     rates?: {
         in: number;
         out: number;
     } | null;
+    thinking?: boolean;
 }): {
     run: (msgs: any[], tools: any[], opts?: any) => Promise<any>;
 };

package/types/keysfile.d.ts

@@ -25,19 +25,20 @@ export function parseKeysText(text: string): Record<string, string>;
  */
 export function filledKeyNames(home?: string): string[];
 /**
- * Create the keys file with the five empty preset lines when — and only when — it does not
- * exist (mode 600). An existing file is never touched.
- * @param {readonly string[]} presetNames the names to seed, in order
+ * Create the keys file with {@link KEYS_FILE_BODY} when — and only when — it does not
+ * exist (mode 600, dir 700). An existing file is never touched.
  * @param {string} [home]
  * @returns {boolean} true if it was created
  */
-export function ensureKeysFile(presetNames: readonly string[], home?: string): boolean;
+export function ensureKeysFile(home?: string): boolean;
 /**
  * @typedef {object} KeysLoad
  * @property {boolean} exists the file is there
  * @property {string[]} names the NAMES the file defines (sorted; never values)
  * @property {string|null} warning a plain-words warning (file readable by others, or
  *   unreadable), else null — a warning, never a refusal
+ * @property {boolean} [unreadable] true only when the file is there but could not be read (the Settings row then
+ *   reads "refused — see above"); absent otherwise
  * @property {Record<string,string|undefined>} env shell env with the file filling the
  *   names the shell does not set. THE ONLY place values leave this module.
  */
@@ -68,6 +69,11 @@ export function keysForDoor(deps: {
     env: Record<string, string | undefined>;
     home: string | undefined;
 };
+/**
+ * The two comment lines a fresh keys file is created with — no provider name, no preset key.
+ * Each key the person types becomes a row in Settings > Providers.
+ */
+export const KEYS_FILE_BODY: string;
 export type KeysLoad = {
     /**
      * the file is there
@@ -82,6 +88,11 @@ export type KeysLoad = {
      * unreadable), else null — a warning, never a refusal
      */
     warning: string | null;
+    /**
+     * true only when the file is there but could not be read (the Settings row then
+     * reads "refused — see above"); absent otherwise
+     */
+    unreadable?: boolean | undefined;
     /**
      * shell env with the file filling the
      * names the shell does not set. THE ONLY place values leave this module.