bareloop 0.40.0 → 0.42.0

package/src/panel/authorsession.js

@@ -20,14 +20,14 @@
 // `src/panel/server.js`'s POST routes). Nothing here changes what a step
 // means or what an answer does — only where the answer comes from.
 
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, modelChoiceFor, ratesFor, rowsForHome } from '../providerrows.js';
+import { judgePick, judgeRatesFor, judgeRowFor, keyValueOf, modelChoiceFor, ratesOfLine, rowsForHome } from '../providerrows.js';
 import { ConfigError } from '../config.js';
 import {
   mkdirSync, existsSync, writeFileSync, readdirSync,
 } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import {
-  prepareSource, proveDestination, missingDependencies, looksLikeRepoSource, nearestGitAncestor, nonRepoSourceMessage,
+  prepareSource, proveDestination, proveRubricInputs, looksLikeRubricInput, missingDependencies, looksLikeRepoSource, nearestGitAncestor, nonRepoSourceMessage,
 } from '../source.js';
 import {
   worktreePath, uncommittedCount, shortHead, removeWorktree,
@@ -45,14 +45,17 @@ import {
   questionsFor, requiredAnswersFor, makeLoopGenerate, CONFIRM_SYSTEM, SOFTGREEN_JUDGE_EXAMPLES_KEY,
 } from '../authorflow.js';
 import {
-  resolveProvider, buildRunnerProviders, apiKeyProblem, assertDraftThinking, draftThinkingFor,
+  resolveProvider, buildRunnerProviders, apiKeyProblem,
 } from '../providers.js';
 import { resolveJobJudge, defaultJudgeLoop } from '../judged.js';
+import { assertThinkingMode, thinkingPlanFor, thinkingRowText } from '../thinking.js';
 import { closeJudges } from '../kinds.js';
+import { RUBRIC_LANG } from '../authoring.js';
+import { rubricGoal, reconcileRubricPlan } from '../rubricstep.js';
 import { redactSecrets } from '../validate.js';
 import { tallyCalls } from '../text.js';
 import { writeDraftSpend, appendDraftLog } from '../draftspend.js';
-import { PLAIN_PROPOSAL_STOPS, proposalStopText, signingStopText, draftStopText, redsRecord, calibrationSummary } from '../authorreadout.js';
+import { PLAIN_PROPOSAL_STOPS, proposalStopText, signingStopText, draftStopText, redsRecord, declarationRecord, calibrationSummary, tryRefusedText } from '../authorreadout.js';
 import { runNpmCi, NPM_CI_LOCKS } from '../npminstall.js';
 import {
   parseJobBlock, parseInputs, jobBlockFitsCheck, renderJobLines, renderExamples, signedJobLines,
@@ -74,6 +77,7 @@ export const STEP_LABELS = Object.freeze({
   reuse: 'reusing signed workflow',
   read: 'reading repo',
   scout: 'scouting repo',
+  look: 'looking at your input',
   listing: 'listing files',
   confirm: 'confirming plan',
   draft: 'drafting',
@@ -83,6 +87,16 @@ export const STEP_LABELS = Object.freeze({
   signed: 'signed hash',
 });
 
+/**
+ * The same steps, worded for a job on the person's own local FILES (Part 1a): there is no worktree and no repo to read.
+ * Code-owned, one table beside STEP_LABELS; a step with no entry keeps its STEP_LABELS word.
+ * @type {Readonly<Record<string, string>>}
+ */
+export const FILE_JOB_STEP_LABELS = Object.freeze({
+  copy: 'copying input files',
+  read: 'reading input files',
+});
+
 /**
  * The library's own `onPhase(name, ...)` calls (`src/authorjob.js`/`src/authorflow.js`) -> the step each one advances.
  * A phase with no entry leaves the current step as it was.
@@ -100,6 +114,8 @@ export const PHASE_STEP = Object.freeze({
   seed: 'read',
   scout: 'scout',
   'scout-done': 'scout',
+  look: 'look',
+  'look-done': 'look',
   confirm: 'confirm',
   'confirm-turn-done': 'confirm',
   listing: 'listing',
@@ -110,19 +126,7 @@ export const PHASE_STEP = Object.freeze({
   'rubric-scrubbed': 'calibrate',
 });
 
-/**
- * The first drafting row's words (hamr 2026-10-11) — code-owned, one owner, ALWAYS starting "thinking on" or "thinking off".
- * `sent` is what the drafting calls carry (`draftThinkingFor`); `thoughtAnyway` = a call reported `thinkingApplied === false`
- * after 'off' was sent (bare-agent saw reasoning in the reply).
- * @param {'on'|'off'|'not-switchable'|'unverified'} sent @param {boolean} [thoughtAnyway]
- * @returns {string}
- */
-export function thinkingRowText(sent, thoughtAnyway = false) {
-  if (sent === 'off') return thoughtAnyway ? 'thinking on (the model thought anyway)' : 'thinking off';
-  if (sent === 'on') return 'thinking on';
-  if (sent === 'not-switchable') return "thinking on (this model can't turn it off)";
-  return 'thinking on (not verified for this model)';
-}
+export { thinkingRowText };
 
 /** @typedef {{id: string, label: string, status: 'running'|'done'|'failed', detail: string}} StepLine */
 
@@ -138,12 +142,13 @@ export function latestStep(steps, id) {
  * earlier line keeps its status and detail). Existing lines are never moved. Re-starting the step that is still the
  * LAST line just resumes that line.
  * @param {StepLine[]} steps @param {string} id @param {string} [detail] (absent = keep what the line has)
+ * @param {Readonly<Record<string, string>>} [labels] the label table (a file job passes its own)
  */
-export function advanceSteps(steps, id, detail) {
+export function advanceSteps(steps, id, detail, labels = STEP_LABELS) {
   for (const x of steps) if (x.status === 'running' && x.id !== id) x.status = 'done';
   const last = steps.at(-1);
   if (last && last.id === id) { last.status = 'running'; if (detail !== undefined) last.detail = detail; return; }
-  steps.push({ id, label: STEP_LABELS[id] ?? id, status: 'running', detail: detail ?? '' });
+  steps.push({ id, label: labels[id] ?? id, status: 'running', detail: detail ?? '' });
 }
 
 /** source-door refusals that come from CHECKING the copied source (the scan/freeze), not from reaching it */
@@ -194,7 +199,7 @@ export function jobNameTaken(name, opts = {}) {
 }
 
 /** the form's fields, in card order — what `card.json` stores, verbatim (P5 item 3) */
-export const CARD_FIELDS = Object.freeze(['jobName', 'checkType', 'model', 'jobText', 'inputs', 'destination', 'capUsd', 'maxWallMs']);
+export const CARD_FIELDS = Object.freeze(['jobName', 'checkType', 'provider', 'model', 'thinking', 'jobText', 'inputs', 'destination', 'capUsd', 'maxWallMs']);
 
 /**
  * The repo a card names: Inputs line 1 (P7 — the Source box is gone; the first input IS the repo). `''` when the Inputs
@@ -268,13 +273,13 @@ export function buildReuseSpec(originSpec, card, rows) {
   spec.budgetUsd = card.capUsd;
   if (typeof card.maxWallMs === 'number' && Number.isFinite(card.maxWallMs) && card.maxWallMs > 0) spec.maxWallMs = card.maxWallMs;
   else delete spec.maxWallMs;
-  const choice = rows && typeof card.model === 'string' ? modelChoiceFor(rows, card.model) : null;
+  const choice = rows && typeof card.model === 'string' ? modelChoiceFor(rows, { provider: card.provider, model: card.model }) : null;
   if (choice) {
     if (spec.verdictType === 'soft-green' && !spec.judge) spec.judge = resolveJobJudge(originSpec, originSpec.provider ?? choice.provider, resolveWorkerModel);
-    const entry = resolveProvider(choice.provider);
+    resolveProvider(choice.provider);
     spec.provider = choice.provider;
     if (choice.baseUrl) spec.baseUrl = choice.baseUrl; else delete spec.baseUrl;
-    if (choice.name !== entry.tiers.sonnet) spec.model = choice.name; else delete spec.model;
+    spec.model = choice.name; // a job always carries its own model
   }
   return spec;
 }
@@ -289,7 +294,8 @@ export function buildReuseSpec(originSpec, card, rows) {
  */
 export function validateReuseCard(card, opts = {}) {
   if (!card || typeof card !== 'object') return { ok: false, error: 'missing job card' };
-  if (!modelChoiceFor(opts.rows ?? [], card.model)) return { ok: false, error: 'Model must be one of the Names in Settings > Providers' };
+  const pick = judgePick(opts.rows ?? [], { provider: card.provider, model: card.model });
+  if (!pick.ok) return { ok: false, error: pick.say };
   const ip = parseInputs(card.inputs);
   if (!ip.ok) return { ok: false, error: ip.error };
   if (typeof card.destination !== 'string' || card.destination.trim() === '') return { ok: false, error: 'Destination is required' };
@@ -332,13 +338,18 @@ export function validateJobCard(card, opts = {}) {
     return { ok: false, error: `a job named "${jobName}" already exists — P3 is new jobs only (Q4=A)` };
   }
   if (checkType !== 'deterministic' && checkType !== 'rubric') return { ok: false, error: 'Check type must be deterministic or rubric' };
-  if (!modelChoiceFor(opts.rows ?? [], model)) return { ok: false, error: 'Model must be one of the Names in Settings > Providers' };
+  const pick = judgePick(opts.rows ?? [], { provider: card.provider, model });
+  if (!pick.ok) return { ok: false, error: pick.say };
+  if (card.thinking !== undefined && typeof card.thinking !== 'boolean') return { ok: false, error: 'Thinking on must be on or off' };
   const jb = parseJobBlock(card.jobText);
   if (!jb.ok) return { ok: false, error: jb.error };
-  const misfit = jobBlockFitsCheck(jb.lines, checkType === 'rubric');
-  if (misfit) return { ok: false, error: misfit };
   const ib = parseInputs(card.inputs);
   if (!ib.ok) return { ok: false, error: ib.error };
+  // P1=B: PASS/FAIL examples are required of a rubric job only when it holds a judged part. A rubric on the person's own
+  // local files (first input not a repo) holds none in this build; a rubric on a repo composes the judged floor.
+  const rubricFiles = checkType === 'rubric' && looksLikeRubricInput(ib.inputs[0].value);
+  const misfit = jobBlockFitsCheck(jb.lines, checkType === 'rubric', { judged: !rubricFiles });
+  if (misfit) return { ok: false, error: misfit };
   if (typeof destination !== 'string' || destination.trim() === '') return { ok: false, error: 'Destination is required' };
   if (typeof capUsd !== 'number' || !Number.isFinite(capUsd) || capUsd <= 0) {
     return { ok: false, error: '$ cap is required and must be a positive number' };
@@ -354,16 +365,16 @@ export function validateJobCard(card, opts = {}) {
  * @param {any} card the validated job card (see {@link validateJobCard})
  * @param {{env?: Record<string,string|undefined>, sessionsRoot?: string, home?: string, timeoutMs?: number,
  *   scout?: any, generate?: Function, confirmGenerate?: Function, authorFn?: Function,
- *   prepareSigningFn?: Function, npmCiFn?: Function, draftThinking?: "on"|"off", reuse?: {spec: any, workflowKey: string}}} [deps] `scout`..`prepareSigningFn` are
+ *   prepareSigningFn?: Function, npmCiFn?: Function, lookFn?: Function|null, fetchUrl?: (url: string) => Promise<{ok: true, text: string, url: string}|{ok: false, error: string}>, draftThinking?: "on"|"off", reuse?: {spec: any, workflowKey: string}}} [deps] `scout`..`prepareSigningFn` are
  *   TEST SEAMS ONLY — see the note just above where each is read, below. `reuse` (Reuse workflow) is NOT a seam: the
  *   caller (`/api/author/start`) sets it only when the server's own same-job rule held.
  * @returns {any} the session object
  */
 export function createSession(card, deps = {}) {
   const env = deps.env ?? process.env;
-  // The drafter's THINKING knob ('on' | 'off'): an explicit operator option, never read from env and not in the panel UI. A bad
-  // value throws here, before a session exists. Default 'off' (hamr ruling 2026-10-11, after the paid ON/OFF contrast).
-  const draftThinking = assertDraftThinking(deps.draftThinking ?? 'off');
+  // The drafter's THINKING mode ('on' | 'off'): the card's "Thinking on" tick (unticked = 'off'), signed into the job only when ticked.
+  // `deps.draftThinking` is an operator override for tests/probes; a bad value throws here, before a session exists.
+  const draftThinking = assertThinkingMode(deps.draftThinking ?? (card.thinking === true ? 'on' : 'off'));
   // P7: the person's own words, parsed ONCE by the one parser (src/jobblock.js). The card validator refused a malformed
   // block before a session exists; a reuse card's job text is the origin's and is not drafted from.
   const jobParsed = parseJobBlock(card.jobText);
@@ -440,10 +451,13 @@ export function createSession(card, deps = {}) {
     });
   };
 
+  /** a rubric job on local files words its copy/read steps for files (set once the card is known) */
+  let fileJob = card.checkType === 'rubric' && looksLikeRubricInput(parseInputs(card.inputs).ok ? (/** @type {any} */ (parseInputs(card.inputs))).inputs[0].value : '');
   /** @param {string} id @param {string} [detail] (absent = keep what the step has) start (or restart) a step; whatever step was running is finished */
   const stepStart = (id, detail) => {
-    advanceSteps(state.steps, id, detail);
-    state.progressLabel = STEP_LABELS[id] ?? id;
+    const labels = fileJob ? { ...STEP_LABELS, ...FILE_JOB_STEP_LABELS } : STEP_LABELS;
+    advanceSteps(state.steps, id, detail, labels);
+    state.progressLabel = labels[id] ?? id;
     logSteps();
   };
   /** @param {string} id @param {string} detail set a step's latest line's detail without changing its status */
@@ -508,6 +522,7 @@ export function createSession(card, deps = {}) {
     return true;
   };
 
+  let lastTryRefused = false;
   const onPhase = (name, data = {}) => {
     // COLLAPSED INTO THE PROGRESS INDICATOR ONLY (build item 3) — this used
     // to also `say('system', `… ${name}`)`, one jargon chat bubble per
@@ -518,10 +533,24 @@ export function createSession(card, deps = {}) {
     // person needs to read; the step-by-step detail lives in one line.
     // ONE owner of the drafting line's detail (model + cap): the drafting line is started here, by the real author phase
     if (PHASE_STEP[name]) stepStart(PHASE_STEP[name], PHASE_STEP[name] === 'draft' ? `${card.model}, $${card.capUsd.toFixed(2)} cap` : undefined);
-    // a drafting call after the first (`author-call` i >= 1, of up to `of + 1`) is a RETRY: the line says so in plain words, so a
-    // long silence on call 2 of 3 does not read as a hang. The same one line, relabelled — never a second line.
+    // WHY a try was refused: the drafting log keeps it beside the call that made it (it used to say only "retry 3 of 3"), and the
+    // progress line shows it briefly, in code's words
+    if (name === 'author-try-failed') {
+      lastTryRefused = true;
+      const no = state.steps.findLastIndex((/** @type {any} */ x) => x.id === 'draft');
+      const reason = tryRefusedText(data);
+      appendDraftLog(outDir, {
+        kind: 'try-refused', no: no === -1 ? state.steps.length - 1 : no, call: String(data.call ?? ''), reason,
+        ...(Array.isArray(data.reds) && data.reds.length ? { reds: redsRecord(data.reds) } : {}), ...declarationRecord(data.declaration), at: new Date().toISOString(),
+      });
+      stepDetail('draft', `${data.call}: refused — ${reason.length > 160 ? `${reason.slice(0, 160)}…` : reason}`);
+    }
+    // a drafting call after the first (`author-call` i >= 1, of up to `of + 1`) is relabelled in plain words, so a long silence on call 2
+    // of 3 does not read as a hang. The loop drafts again after a try that PASSED too (the drafter sees its own seed-read), so
+    // "retry" is said only when the previous try was actually refused; otherwise it is "look". The same one line, never a second one.
     if (name === 'author-call' && Number.isInteger(data.i) && data.i >= 1 && Number.isInteger(data.of)) {
-      const label = `${STEP_LABELS.draft} (retry ${data.i + 1} of ${data.of + 1})`;
+      const label = `${STEP_LABELS.draft} (${lastTryRefused ? 'retry' : 'look'} ${data.i + 1} of ${data.of + 1})`;
+      lastTryRefused = false;
       stepLabel('draft', label);
       state.progressLabel = label;
     }
@@ -557,16 +586,22 @@ export function createSession(card, deps = {}) {
     // the call's label, the drafting model, its cost (null stays null: unpriced is never $0). One owner: this onCall.
     const runningNo = state.steps.findLastIndex((/** @type {any} */ x) => x.status === 'running');
     const callNo = runningNo === -1 ? state.steps.length - 1 : runningNo;
-    // bare-agent's own verdict on the call's run (true | false | null), present only when thinkingMode was sent. 'off' sent but
-    // reasoning seen (false) turns the first drafting row into "thinking on (the model thought anyway)" and stays so.
-    if (draftThinkingLogged === 'off' && call.thinkingApplied === false && !thoughtAnyway) {
-      thoughtAnyway = true;
+    // bare-agent's own verdict on the call's run — `thinkingStatus`: 'applied' | 'unsupported' | 'ignored' | 'unknown' — present only
+    // when thinkingMode was sent. The first drafting row then says what REALLY happened ("the model thought anyway", "can't change it",
+    // "not confirmed"); a row that moved to a worse word never moves back.
+    if (draftThinkingPlan !== null && call.thinkingStatus !== undefined && call.thinkingStatus !== thinkingStatusSeen
+      && !(thinkingStatusSeen !== null && thinkingStatusSeen !== 'applied' && call.thinkingStatus === 'applied')) {
+      thinkingStatusSeen = call.thinkingStatus;
       const row = latestStep(state.steps, 'thinking');
-      if (row) { row.label = thinkingRowText('off', true); appendDraftLog(outDir, { kind: 'step-label', no: state.steps.indexOf(row), label: row.label, at: new Date().toISOString() }); }
+      if (row) {
+        row.label = thinkingRowText({ mode: draftThinkingPlan.mode, support: draftThinkingPlan.support, status: call.thinkingStatus });
+        appendDraftLog(outDir, { kind: 'step-label', no: state.steps.indexOf(row), label: row.label, at: new Date().toISOString() });
+      }
     }
     appendDraftLog(outDir, {
       kind: 'call', no: callNo, step: state.steps[callNo]?.id ?? null, label: call.label, model: draftIdentity?.model ?? null,
-      thinking: draftThinkingLogged, ...(call.thinkingApplied === undefined ? {} : { thinkingApplied: call.thinkingApplied }),
+      thinking: draftThinkingPlan === null ? null : draftThinkingPlan.mode, thinkingSupport: draftThinkingPlan === null ? null : draftThinkingPlan.support,
+      ...(call.thinkingStatus === undefined ? {} : { thinkingStatus: call.thinkingStatus }),
       costUsd: call.costUsd ?? null, unpricedRounds: call.unpricedRounds ?? 0, at: nowIso,
     });
     try {
@@ -578,10 +613,11 @@ export function createSession(card, deps = {}) {
   };
   /** @type {string|null} */
   let draftStartedAt = null;
-  /** what the drafting calls really carry for thinking ('on' | 'off' | 'not-switchable' | 'unverified'), set once the Model Name resolves; null before @type {string|null} */
-  let draftThinkingLogged = null;
-  /** a drafting call reported thinkingApplied === false after 'off' was sent */
-  let thoughtAnyway = false;
+  /** what the drafting calls will carry for thinking — the tick's mode and bare-agent's support answer — set once the Model resolves; null before
+   * @type {ReturnType<typeof thinkingPlanFor>|null} */
+  let draftThinkingPlan = null;
+  /** the worst-so-far `thinkingStatus` a drafting call reported (null until one did) @type {string|null} */
+  let thinkingStatusSeen = null;
   /** P6 item 1: the worktree this session made in the person's repo (null until made, and again once removed) @type {{repo: string, dir: string}|null} */
   let madeWorktree = null;
   /** a session that ends WITHOUT ever running (refused, errored, abandoned) takes its worktree with it; a signed one keeps it for the run */
@@ -607,36 +643,37 @@ export function createSession(card, deps = {}) {
 
   async function run() {
     // ── keys, at $0, before anything is prepared ────────────────────────
-    const keyRows = rowsForHome(configHome);
-    const modelChoice = modelChoiceFor(keyRows, card.model);
+    const keyRows = rowsForHome(configHome, env);
+    const pick = judgePick(keyRows, { provider: card.provider, model: card.model });
+    const modelChoice = pick.ok ? pick.choice : null;
     // hamr 2026-10-11: the FIRST drafting row says whether the drafter thinks, before any other line ("checking setup" follows).
     // A Reuse session drafts nothing, so it has no row. A provider shape that cannot be built is refused below, in words.
     if (modelChoice && deps.reuse === undefined) {
       try {
-        draftThinkingLogged = draftThinkingFor({ providerName: modelChoice.provider, model: modelChoice.name, baseUrl: modelChoice.baseUrl ?? null }, draftThinking);
-        state.steps.push({ id: 'thinking', label: thinkingRowText(/** @type {any} */ (draftThinkingLogged)), status: 'done', detail: '' });
+        draftThinkingPlan = thinkingPlanFor({ providerName: modelChoice.provider, model: modelChoice.name, baseUrl: modelChoice.baseUrl ?? null }, draftThinking);
+        state.steps.push({ id: 'thinking', label: thinkingRowText({ mode: draftThinkingPlan.mode, support: draftThinkingPlan.support }), status: 'done', detail: '' });
         logSteps();
-      } catch { draftThinkingLogged = null; }
+      } catch { draftThinkingPlan = null; }
     }
     stepStart('setup');
-    if (!modelChoice) { refuse(`Model "${card.model}" is not a Name in Settings > Providers. Stopped — nothing spent.`); return; }
+    if (!modelChoice) { refuse(pick.ok ? 'Pick a model. Nothing was spent.' : pick.say); return; }
     draftIdentity = { provider: modelChoice.provider, baseUrl: modelChoice.baseUrl ?? null, model: modelChoice.name };
     let providerEntry;
     try { providerEntry = resolveProvider(modelChoice.provider); } catch (e) { refuse(/** @type {Error} */ (e).message); return; }
-    // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
+    // the key is the chosen row's own variable (P8: no built-in name)
     const keyCfg = keyRows;
-    const draftEnv = applyConfiguredKey(env, modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name);
-    const draftKeyName = keyNameFor(modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name).name;
-    const apiKey = draftEnv[providerEntry.envKey];
+    const draftKeyName = modelChoice.envName;
+    const apiKey = keyValueOf(env, draftKeyName);
     if (!apiKey) { refuse(`${draftKeyName} not set. Stopped — nothing spent.`); return; }
     // the customer's own price on this row (USD per 1M in config.json), resolved once here at $0 and
     // handed to every model call this session makes; a bad price refuses, never falls back to the guess
-    /** @type {ReturnType<typeof ratesFor>} */
+    /** @type {import('../providerrows.js').PriceResult} */
     let draftPrice = null;
-    try { draftPrice = ratesFor(modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name); } catch (e) {
-      if (!(e instanceof ConfigError)) throw e;
-      refuse(`${e.message}. Stopped — nothing spent.`);
-      return;
+    {
+      const chosenRow = keyCfg.find((r) => r.envName === modelChoice.envName);
+      const dl = chosenRow?.models.find((l) => l.model === modelChoice.name);
+      const dp = dl ? ratesOfLine(dl) : null;
+      draftPrice = dp ? { ...dp, envName: modelChoice.envName } : null;
     }
     const keyProblem = apiKeyProblem(apiKey);
     if (keyProblem) { refuse(`${draftKeyName} ${keyProblem}. Stopped — nothing spent.`); return; }
@@ -644,6 +681,9 @@ export function createSession(card, deps = {}) {
     const verdictType = card.checkType === 'rubric' ? 'soft-green' : 'green';
     const into = join(outDir, 'source-seed');
     const isRepoLike = looksLikeRepoSource(SOURCE);
+    // PART 1a: a RUBRIC job whose first input is not a repo works on the person's own local FILES — every numbered input
+    // line is one file, frozen by `proveRubricInputs`; there is no repo, no language and no scout (docs/product/ITEM33-BUILD.md)
+    const RUBRIC_FILES = card.checkType === 'rubric' && !isRepoLike;
     // hamr's ruling B (2026-10-05): ONE rule for both a fresh card and a reuse card, at $0, before the copy and any model call
     const destProblem = repoDestinationProblem(card.destination, isRepoLike);
     if (destProblem !== null) { refuse(destProblem); return; }
@@ -667,10 +707,21 @@ export function createSession(card, deps = {}) {
     // fence read as a directory and refused as "not absolute" — hiding the real problem with the Source. A scope-shaped
     // (relative) Destination is therefore handed to the door only when the source is repo-like.
     const destIsDir = isAbsoluteDestination(card.destination);
-    const prep = await prepareSource({
-      source: SOURCE, into, ...(isRepoLike || destIsDir ? { destination: card.destination } : {}),
-      ...(repoRoot === null ? {} : { worktree: worktreePath(repoRoot, id) }),
-    });
+    if (RUBRIC_FILES && !destIsDir) {
+      refuse('Destination must be the full path of a folder, like /home/me/out — the finished files are delivered there. Nothing spent.');
+      return;
+    }
+    /** @type {any} */
+    let prep;
+    if (RUBRIC_FILES) {
+      const proved = await proveRubricInputs({ inputs: INPUTS, into, destination: card.destination, ...(deps.fetchUrl ? { fetchUrl: deps.fetchUrl } : {}) });
+      prep = proved.ok ? proved.prep : { stop: proved.error, code: proved.code };
+    } else {
+      prep = await prepareSource({
+        source: SOURCE, into, ...(isRepoLike || destIsDir ? { destination: card.destination } : {}),
+        ...(repoRoot === null ? {} : { worktree: worktreePath(repoRoot, id) }),
+      });
+    }
     if (repoRoot !== null && prep.stop === null && prep.manifest?.worktree) madeWorktree = { repo: repoRoot, dir: prep.manifest.worktree };
     if (abandoned) dropWorktree();
     if (prep.stop !== null) {
@@ -682,7 +733,7 @@ export function createSession(card, deps = {}) {
     stepStart('check');
 
     const IS_REPO_SOURCE = prep.manifest.kind === 'repo';
-    let LANG = 'none-detected';
+    let LANG = RUBRIC_FILES ? RUBRIC_LANG : 'none-detected';
     /** @type {any} */
     let langResult = null;
     if (IS_REPO_SOURCE) {
@@ -741,7 +792,7 @@ export function createSession(card, deps = {}) {
         state.phase = 'drafting';
       }
     }
-    if (!IS_REPO_SOURCE) {
+    if (!IS_REPO_SOURCE && !RUBRIC_FILES) {
       refuse(nonRepoSourceMessage(prep.manifest.kind));
       return;
     }
@@ -791,9 +842,10 @@ export function createSession(card, deps = {}) {
       const judges = closeJudges(spec.closeDecl);
       const judge = judges ? resolveJobJudge(spec, modelChoice.provider, resolveWorkerModel) : null;
       let judgeProvider = null;
-      /** @type {ReturnType<typeof ratesFor>} */
+      /** @type {import('../providerrows.js').PriceResult} */
       let judgePrice = null;
       if (judge) {
+        const judgeRow = judgeRowFor(keyCfg, judge, modelChoice.provider, keyCfg.find((r) => r.envName === modelChoice.envName) ?? null);
         try {
           judgePrice = judgeRatesFor(judge, modelChoice.provider, modelChoice.baseUrl, draftPrice, keyCfg);
         } catch (e) {
@@ -801,22 +853,23 @@ export function createSession(card, deps = {}) {
           refuse(`${e.message} — refusing before gate 4 spends anything`);
           return;
         }
-        const judgeKeyValue = env.JUDGE_API_KEY ?? (judge.provider === modelChoice.provider ? draftEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model))[resolveProvider(judge.provider).envKey];
+        const judgeKeyValue = env.JUDGE_API_KEY ?? (judge.provider === modelChoice.provider ? apiKey : keyValueOf(env, judgeRow?.envName));
         const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
         if (!judgeKeyValue || judgeKeyProblem) {
           refuse(`the judge key is not usable (${judgeKeyProblem ?? 'not set'}) — refusing before gate 4 spends anything`);
           return;
         }
         judgeProvider = buildRunnerProviders({
-          providerName: modelChoice.provider, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl: modelChoice.baseUrl,
+          providerName: modelChoice.provider, apiKey, model: MODEL, baseUrl: modelChoice.baseUrl, legacyMaxTokens: modelChoice.legacyMaxTokens,
           judgeApiKey: judgeKeyValue, judgeModel: judge.model, judgeProviderName: judge.provider,
-          judgeBaseUrl: judge.provider === modelChoice.provider ? modelChoice.baseUrl : undefined,
+          judgeBaseUrl: judge.provider === modelChoice.provider ? modelChoice.baseUrl : (judgeRow?.baseUrl.trim() || undefined),
+          judgeLegacyMaxTokens: judge.provider === modelChoice.provider ? modelChoice.legacyMaxTokens : (judgeRow?.legacyMaxTokens ?? false),
         }).judgeProvider;
       }
       const signing = await prepareSigningFn({
         spec, workdir: prep.tree, seedRef: seedRef, timeoutMs,
         shellCapUsd: spec.budgetUsd, ceilingUsd: card.capUsd, priorCalls: [...metered],
-        judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null }) : null,
+        judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null, thinking: spec.thinking === true }) : null,
         judgeModel: judge?.model ?? null,
         onJudgeCost: (c) => onCall({ label: `${c.label}:${c.id}`, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds }),
       });
@@ -872,7 +925,9 @@ export function createSession(card, deps = {}) {
       return;
     }
 
-    const writeScope = card.destination.split(/[,\n]/).map((s) => s.trim()).filter(Boolean);
+    // a rubric job on files writes only inside the hidden tree's own `output/`; its Destination is a drop-off folder
+    // (proven above, per run), never a fence
+    const writeScope = RUBRIC_FILES ? ['output/'] : card.destination.split(/[,\n]/).map((s) => s.trim()).filter(Boolean);
     /** @type {any} the confirm turn (below) fills `goal` in once accepted —
      * declared loosely rather than typed field-by-field, since this object's
      * own shape is a `job-v1` draft `validateJob` itself is the real
@@ -886,8 +941,10 @@ export function createSession(card, deps = {}) {
       inputs: INPUTS,
       provider: modelChoice.provider,
       ...(modelChoice.baseUrl ? { baseUrl: modelChoice.baseUrl } : {}),
-      // the Name is the model id: signed into the spec only when it is not the provider's own default
-      ...(modelChoice.name !== providerEntry.tiers.sonnet ? { model: modelChoice.name } : {}),
+      // a job always carries its own model (P8: there is no provider default to omit it against)
+      model: modelChoice.name,
+      // the "Thinking on" tick is signed ONLY when ticked (unticked writes no field: the hash stays what it would have been)
+      ...(card.thinking === true && draftThinkingPlan?.support !== false ? { thinking: true } : {}),
       cadence: { unit: 'day', every: 1 },
       budgetUsd: card.capUsd,
       ...(typeof card.maxWallMs === 'number' ? { maxWallMs: card.maxWallMs } : {}),
@@ -905,16 +962,17 @@ export function createSession(card, deps = {}) {
     /** @type {Record<string, string>} */
     const answers = { 1: renderJobLines(jobLines) };
     if (verdictType === 'soft-green') answers[SOFTGREEN_JUDGE_EXAMPLES_KEY] = renderExamples(jobLines);
-    const required = requiredAnswersFor(verdictType);
+    // a rubric job on files holds no judged part in this build, so the PASS/FAIL examples are not required of it
+    const required = RUBRIC_FILES ? [1] : requiredAnswersFor(verdictType);
     for (const n of required) {
       if (!answers[n]) { refuse(`the ${verdictType} check type needs ${required.length} answers and one is missing (key ${n})`); return; }
     }
 
     const draftJudge = (() => {
-      try { return resolveJobJudge(draft, modelChoice.provider, resolveWorkerModel); } catch { return { provider: modelChoice.provider, model: providerEntry.tiers.sonnet }; }
+      try { return resolveJobJudge(draft, modelChoice.provider, resolveWorkerModel); } catch { return { provider: modelChoice.provider, model: modelChoice.name }; }
     })();
     const { provider } = buildRunnerProviders({
-      providerName: modelChoice.provider, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl: modelChoice.baseUrl,
+      providerName: modelChoice.provider, apiKey, model: MODEL, baseUrl: modelChoice.baseUrl, legacyMaxTokens: modelChoice.legacyMaxTokens,
       judgeApiKey: apiKey, judgeModel: MODEL, judgeProviderName: modelChoice.provider, judgeBaseUrl: modelChoice.baseUrl,
     });
     // TEST SEAMS (see the constructor's own note): a test overrides
@@ -969,8 +1027,10 @@ export function createSession(card, deps = {}) {
       rates: draftPrice?.rates ?? null,
       draftThinking,
       onPhase, onCall,
-      ask, answerQuestions, confirmGenerate, isRepo: true, langResult,
+      ask, answerQuestions, confirmGenerate, isRepo: !RUBRIC_FILES, langResult,
       ...(deps.scout ? { scout: deps.scout } : {}),
+      // PART 1c: a test that replaces the model boundary (`generate`) must not reach the real paid look; `deps.lookFn` brings its own
+      ...(deps.lookFn !== undefined ? { lookFn: deps.lookFn } : (deps.generate ? { lookFn: null } : {})),
       ...(authorFnOverride ? { authorFn: authorFnOverride } : {}),
     });
 
@@ -1004,13 +1064,34 @@ export function createSession(card, deps = {}) {
         : draftStopText({
           stop: String(authored.stop ?? 'authoring-failed'), reds: stopReds, refusal: authored.refusal,
           spend: { knownUsd: state.draftSpentUsd, spendComplete: state.draftSpendComplete },
+          wholeJob: RUBRIC_FILES,
         }), authored.stop === 'confirm-abandoned' ? 'abandoned' : 'refused');
       return;
     }
 
-    if (authored.confirmed?.goal) draft.goal = redactSecrets(String(authored.confirmed.goal));
+    if (RUBRIC_FILES) draft.goal = redactSecrets(rubricGoal({ jobLines, files: prep.manifest.inputs, confirmedGoal: authored.confirmed?.goal ?? null, closeDecl: authored.closeDecl }));
+    else if (authored.confirmed?.goal) draft.goal = redactSecrets(String(authored.confirmed.goal));
     const spec = assembleSpec(draft, { ...authored, verdictType: /** @type {string} */ (authored.verdictType) });
+    // PART 1a (run mv5bk400): the plan the person confirmed named three checks for line 1; the composer wrote ONE stage and put
+    // "lists 3 releases" in its notes, so the card promised a check the close never ran. The card AFTER drafting is now built
+    // from the close itself, and every confirmed check no part carries out is moved to Not checked, in code, before signing.
+    if (RUBRIC_FILES) {
+      const rec = reconcileRubricPlan({
+        confirmed: authored.confirmed?.checkItems ?? [], notChecked: authored.confirmed?.notChecked ?? [], closeDecl: spec.closeDecl, jobLines,
+      });
+      state.finalPlan = { goal: String(draft.goal ?? ''), checkItems: rec.checkItems, notChecked: rec.notChecked, protections: authored.confirmed?.protections ?? [], moved: rec.moved };
+    }
     await finish(spec, authored.seedRef);
+    if (state.finalPlan && state.phase === 'prepared') {
+      // The confirm turn's plan bubble (and a try-3 "answers are in" one) is the DRAFTER's wording of the checks, written before
+      // any close existed. Once the close is signed-ready its card is the only plan the person sees: the earlier ones are
+      // dropped, so drafter prose can never sit above (and be read instead of) the code's sentences (run mv5e1ktb).
+      state.messages = state.messages.filter((/** @type {any} */ m) => m.kind !== 'plan');
+      state.messages.push({
+        ...planMessage({ checkItems: state.finalPlan.checkItems, checks: state.finalPlan.checkItems.map((/** @type {any} */ c) => c.text), notChecked: state.finalPlan.notChecked, protections: state.finalPlan.protections, questions: [] }, jobLines),
+        text: 'These are the checks the signed close will run, and what it will not check. Sign & run to accept them, or Revise to edit the boxes and draft again.',
+      });
+    }
   }
 
   // fire-and-forget — the caller (src/panel/server.js) never awaits this; it