bareloop 0.40.0 → 0.42.0

package/src/inputlook.js

@@ -0,0 +1,301 @@
+// THE LOOK (PART 1c, docs/product/ITEM33-BUILD.md "3. The look", PRD item 33 RF19/RF20): before the drafter writes a single check, the AI
+// LOOKS at the person's input - read only, bounded, with tools that can do nothing but search and read the input's own text - and
+// reports, per job line, the facts it can check (name, shape, a label PICKED from the code-made list, one example value it saw) and
+// what it could not find. This module holds the pure parts: the two read-only tools, the strict answer form, the prompt, and the
+// code that turns the AI's report into a verified one. The paid loop around them is `runInputLook` in src/authorscout.js.
+//
+// LABELS ARE PICKED, NEVER TYPED: the AI names a label by its id on the list (src/labelscan.js) or by its exact words; a label that is
+// not on the list is NOT carried into the report - it is moved to "could not check", named. Code never decides two words mean the
+// same: the AI proposes, the list and the source prove.
+
+import { scanLabels, labelOnList, renderLabelList, normLabel, LABEL_SHAPES } from './labelscan.js';
+import { FACT_SHAPES, FACT_OPS } from './facts.js';
+import { lineRules } from './rubricstep.js';
+
+/** the name of the answer tool - the one place the AI's report enters */
+export const LOOK_REPORT_TOOL = 'report_look';
+/** how many hits one search returns at most, and how long a snippet or a read line is */
+export const LOOK_MAX_HITS = 40;
+const SNIPPET = 220;
+const READ_LINE = 320;
+const READ_LINES = 40;
+const TAG = /\[[A-Za-z]+=[^\]\s]*\]/g;
+const WS = /[\s   ]+/g;
+
+/**
+ * The input as the AI sees it: lines with any run of white space (U+202F included) made one space and the page reader's bracketed tags
+ * (`[ref=549]`) removed - an id that is only the page reader's, never part of a label.
+ * @param {string} text @returns {string[]}
+ */
+export function lookLines(text) {
+  return String(text ?? '').split('\n').map((l) => l.replace(TAG, ' ').replace(WS, ' ').trim());
+}
+
+/**
+ * The two read-only tools: search the input text, read a slice around a hit. They are closures over in-memory text and touch nothing
+ * else - read-only BY CONSTRUCTION, not by a fence. Several inputs: the `input` argument names which (its label).
+ * @param {Record<string, string>} texts label -> frozen text
+ * @returns {{name: string, description: string, parameters: any, execute: (a: any) => Promise<any>}[]}
+ */
+export function lookReadTools(texts) {
+  const labels = Object.keys(texts);
+  /** @type {Record<string, string[]>} */
+  const lines = Object.fromEntries(labels.map((l) => [l, lookLines(texts[l])]));
+  const which = (/** @type {any} */ a) => (typeof a?.input === 'string' && lines[a.input] ? a.input : (labels.length === 1 ? labels[0] : null));
+  const inputProp = { type: 'string', description: `the input's label - one of: ${labels.join(', ')}` };
+  return [
+    {
+      name: 'search_input',
+      description: 'Case-insensitive search of one input for a word or phrase. Returns the line numbers and the start of each line that holds it. Search the person\'s own words AND other words that mean the same (nonstop / direct, San Francisco / SFO).',
+      parameters: { type: 'object', properties: { input: inputProp, text: { type: 'string', minLength: 1 }, max: { type: 'integer', minimum: 1, maximum: LOOK_MAX_HITS } }, required: ['text'] },
+      execute: async (a) => {
+        const name = which(a);
+        if (name === null) return { error: `name the input: ${labels.join(', ')}` };
+        const q = String(a?.text ?? '').toLowerCase().replace(WS, ' ').trim();
+        if (q === '') return { error: 'give the words to search for' };
+        const max = Math.min(Number.isInteger(a?.max) ? a.max : 20, LOOK_MAX_HITS);
+        /** @type {{line: number, text: string}[]} */
+        const hits = [];
+        let total = 0;
+        lines[name].forEach((l, i) => { if (l.toLowerCase().includes(q)) { total += 1; if (hits.length < max) hits.push({ line: i + 1, text: l.slice(0, SNIPPET) }); } });
+        return { input: name, total, hits };
+      },
+    },
+    {
+      name: 'read_input',
+      description: 'Read some lines of one input, starting at a line number (from a search).',
+      parameters: { type: 'object', properties: { input: inputProp, line: { type: 'integer', minimum: 1 }, count: { type: 'integer', minimum: 1, maximum: READ_LINES } }, required: ['line'] },
+      execute: async (a) => {
+        const name = which(a);
+        if (name === null) return { error: `name the input: ${labels.join(', ')}` };
+        const from = Math.max(1, Number.isInteger(a?.line) ? a.line : 1);
+        const n = Math.min(Number.isInteger(a?.count) ? a.count : 12, READ_LINES);
+        return { input: name, lines: lines[name].slice(from - 1, from - 1 + n).map((l, i) => ({ line: from + i, text: l.slice(0, READ_LINE) })) };
+      },
+    },
+  ];
+}
+
+/** the strict answer form (a JSON schema - never free prose with JSON inside) */
+export function lookReportSchema() {
+  return {
+    type: 'object',
+    additionalProperties: false,
+    required: ['facts', 'prose', 'notFound'],
+    properties: {
+      facts: {
+        type: 'array',
+        items: {
+          type: 'object',
+          additionalProperties: false,
+          required: ['line', 'name', 'shape', 'source', 'example'],
+          properties: {
+            line: { type: 'integer', minimum: 1, description: 'the job line this fact belongs to' },
+            name: { type: 'string', minLength: 1, description: 'a short name, letters only' },
+            shape: { enum: [...FACT_SHAPES] },
+            source: { type: 'string', minLength: 1, description: 'the label of the input it is read from' },
+            label: { type: 'string', description: 'the words right before the value: the id (like t1) or the exact words of a label on the LIST for this input and shape - never a word you typed that is not on the list' },
+            value: { type: 'string', description: 'a phrase fact only: the fixed words, copied from the input exactly as it writes them (a place, a name, a word)' },
+            example: { type: 'string', description: 'ONE value you really saw in the input for this fact' },
+            rule: {
+              type: 'object',
+              additionalProperties: false,
+              required: ['op'],
+              properties: { op: { enum: [...FACT_OPS] }, value: {}, lo: {}, hi: {} },
+              description: 'only where the person asked for a limit (or you made one out of their words and set aiProposal)',
+            },
+            aiProposal: { type: 'boolean', description: 'true when YOU made this number out of the person\'s words (for example a night window for "not a red-eye")' },
+            forRule: { type: 'integer', minimum: 1, description: 'the number of the ~ rule under that line this fact carries out (1 = the first), when it carries one - a rule you turned into a number or range yourself ("not a red-eye") is carried by a fact with aiProposal, never reported as not found' },
+          },
+        },
+      },
+      prose: {
+        type: 'array',
+        description: 'job lines (and their ~ limits) that ask for written text - a summary, a report. They are not looked up.',
+        items: { type: 'object', additionalProperties: false, required: ['line'], properties: { line: { type: 'integer', minimum: 1 }, text: { type: 'string' } } },
+      },
+      notFound: {
+        type: 'array',
+        description: 'what you could not find in the input, and, when it is one ~ rule, which one',
+        items: {
+          type: 'object',
+          additionalProperties: false,
+          required: ['line', 'why'],
+          properties: { line: { type: 'integer', minimum: 1 }, rule: { type: 'integer', minimum: 1, description: 'the number of the ~ rule under that line (1 = the first), when the thing not found is one rule' }, words: { type: 'string', description: 'the person\'s own words that you could not find' }, why: { type: 'string', minLength: 1 } },
+        },
+      },
+    },
+  };
+}
+
+/**
+ * What the AI is told: the numbered job, the inputs and their label lists, and what to do.
+ * @param {{jobLines: {n: number, text: string, rule?: string, rules?: string[]}[], labels: string[], lists: Record<string, string>}} o
+ * @returns {string}
+ */
+export function lookPrompt({ jobLines, labels, lists }) {
+  const job = jobLines.map((l) => `${l.n}. ${l.text}${(l.rules ?? (l.rule ? l.rule.split('; ') : [])).map((r, i) => `\n   ~ ${i + 1}. ${r}`).join('')}`).join('\n');
+  return `The person's job (line numbers start at 1; "~" lines are the person's rules for the line above, numbered under it):\n${job}\n\n`
+    + `The inputs you can look at: ${labels.map((l) => JSON.stringify(l)).join(', ')}. You can only use search_input and read_input, then you MUST finish by calling ${LOOK_REPORT_TOOL} once.\n\n`
+    + `${labels.map((l) => lists[l]).join('\n\n')}\n\n`
+    + `Shapes a value can have: ${FACT_SHAPES.join(', ')} (phrase = fixed words the quote must contain; text = the words after a label).\n`
+    + 'For each job line, find the facts the person asked for and report ONLY what you can check in the input:\n'
+    + ' - Search the input with the person\'s words AND other words that mean the same, read the spots you find, and use what you know (for example what a red-eye is: propose a night time window and set aiProposal true).\n'
+    + ' - A ~ rule whose meaning you can turn into a number or a range from what you know (a red-eye is a night departure; a weekend; business hours) is NOT something to ask the person about and NOT "notFound": report it as a fact on the time, date or amount the input does hold, with a between (or other) rule, aiProposal true and forRule set to that rule\'s number. Use notFound with a rule number only for intent you cannot know (for example "one per week" when the input has no weekly grouping).\n'
+    + ' - Every place, date or name written in the job line itself is a fact too. Bind it to the label that sits right before it in the input - a direction like "from X to Y" is the label before the origin (for example Leaves) and the label before the destination (for example arrives at): report each as a phrase fact whose label is that label and whose value is the place EXACTLY as the input writes it.\n'
+    + ' - A label is PICKED from the LIST above (its id or its exact words) - never typed. A label that is not on the list is refused. Never use the person\'s own words as a label unless the list holds them, never a one-time id like [ref=...], and never one result\'s own value.\n'
+    + ' - Lines that ask for written prose (a summary, a short text) and the ~ limits on them (word count, paragraphs) are NOT looked up: put them in "prose" with their line number.\n'
+    + ' - Whatever you cannot find in the input goes to "notFound" with the person\'s own words; when it is one ~ rule, give that rule\'s number.\n'
+    + `Report only through ${LOOK_REPORT_TOOL}.`;
+}
+
+/** @typedef {{line: number, name: string, shape: string, source: string, label?: string, labelId?: string, value?: string, phrase?: string, example: string, rule?: any, aiProposal?: boolean, forRule?: number}} LookFact */
+/** @typedef {{line: number, rule?: number, words?: string, why: string}} LookNotFound */
+/** @typedef {{facts: LookFact[], prose: {line: number, text?: string}[], notFound: LookNotFound[]}} LookReport */
+
+/** @param {unknown} v @returns {v is Record<string, any>} */
+const isRec = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * Turn the AI's raw report into a VERIFIED one, by code, at $0. A fact is carried only when: its shape is a real shape, its source is
+ * a real input, and its label is ON THE LIST for that input and shape (an id is resolved to its exact words). Anything else is moved
+ * to `notFound` with a plain reason naming the word - never dropped silently. `prove` is the "found in the source" test of the
+ * phrase a phrase fact builds (label + value), supplied by the caller.
+ * @param {unknown} raw
+ * @param {{scans: Record<string, import('./labelscan.js').LabelScan>, jobLines: {n: number}[], prove?: (source: string, phrase: string) => number}} o
+ * @returns {LookReport}
+ */
+export function verifyLookReport(raw, { scans, jobLines, prove }) {
+  const rep = isRec(raw) ? raw : {};
+  const lineNos = new Set(jobLines.map((l) => l.n));
+  /** @type {LookFact[]} */
+  const facts = [];
+  /** @type {LookNotFound[]} */
+  const notFound = [];
+  const dropped = (/** @type {any} */ f, /** @type {string} */ why) => notFound.push({
+    line: Number.isInteger(f?.line) && lineNos.has(f.line) ? f.line : (jobLines[0]?.n ?? 1),
+    words: typeof f?.name === 'string' ? f.name : undefined,
+    why,
+  });
+  for (const f of Array.isArray(rep.facts) ? rep.facts : []) {
+    if (!isRec(f) || !Number.isInteger(f.line) || !lineNos.has(f.line)) { dropped(f, 'the look named a job line that does not exist'); continue; }
+    const name = typeof f.name === 'string' ? f.name.replace(/[^A-Za-z _-]/g, '').trim() : '';
+    if (name === '') { dropped(f, 'the look gave a fact no usable name'); continue; }
+    if (!FACT_SHAPES.includes(f.shape)) { dropped({ ...f, name }, `the look gave "${name}" a shape (${String(f.shape)}) that does not exist`); continue; }
+    const scan = typeof f.source === 'string' ? scans[f.source] : undefined;
+    if (!scan) { dropped({ ...f, name }, `the look read "${name}" from an input (${String(f.source)}) that is not one of yours`); continue; }
+    /** @type {LookFact} */
+    const out = { line: f.line, name, shape: f.shape, source: f.source, example: typeof f.example === 'string' ? f.example : '' };
+    if (typeof f.label === 'string' && f.label.trim() !== '') {
+      const row = labelOnList(scan, f.shape === 'phrase' ? 'text' : f.shape, f.label);
+      if (!row) { dropped({ ...f, name }, `the label "${normLabel(f.label)}" for "${name}" is not one of the labels found in "${f.source}", so it was not used`); continue; }
+      out.label = row.label;
+      out.labelId = row.id;
+    }
+    if (f.shape === 'phrase') {
+      const value = typeof f.value === 'string' ? normLabel(f.value) : '';
+      if (value === '') { dropped({ ...f, name }, `the look gave the phrase fact "${name}" no words`); continue; }
+      out.value = value;
+      out.phrase = out.label ? `${out.label} ${value}` : value;
+      if (prove && prove(f.source, out.phrase) < 1) { dropped({ ...f, name }, `"${out.phrase}" is not in the input "${f.source}"`); continue; }
+    }
+    if (isRec(f.rule)) out.rule = f.rule;
+    if (f.aiProposal === true) out.aiProposal = true;
+    if (Number.isInteger(f.forRule) && f.forRule >= 1) out.forRule = f.forRule;
+    facts.push(out);
+  }
+  for (const n of Array.isArray(rep.notFound) ? rep.notFound : []) {
+    if (!isRec(n) || !Number.isInteger(n.line) || !lineNos.has(n.line) || typeof n.why !== 'string') continue;
+    // a rule that a verified fact carries is checked, so it is not also "not found" (L3: a ~ rule is one or the other)
+    if (Number.isInteger(n.rule) && facts.some((x) => x.line === n.line && x.forRule === n.rule)) continue;
+    notFound.push({ line: n.line, ...(Number.isInteger(n.rule) ? { rule: n.rule } : {}), ...(typeof n.words === 'string' && n.words ? { words: n.words } : {}), why: n.why });
+  }
+  const prose = (Array.isArray(rep.prose) ? rep.prose : []).filter((p) => isRec(p) && Number.isInteger(p.line) && lineNos.has(p.line))
+    .map((p) => ({ line: p.line, ...(typeof p.text === 'string' ? { text: p.text.slice(0, 400) } : {}) }));
+  return { facts, prose, notFound };
+}
+
+/**
+ * The look's report as the DRAFTER reads it: one block, per job line, of what can be checked (with the exact words to copy) and what
+ * could not be found. Written by code from the verified report.
+ * @param {LookReport} report @returns {string}
+ */
+export function renderLookReport(report) {
+  const byLine = new Map();
+  const add = (/** @type {number} */ n, /** @type {string} */ s) => byLine.set(n, [...(byLine.get(n) ?? []), s]);
+  for (const f of report.facts) {
+    const bits = [`${f.name} - ${f.shape}`, `from "${f.source}"`];
+    if (f.phrase !== undefined) bits.push(`the quote must say ${JSON.stringify(f.phrase)}`);
+    else if (f.label !== undefined) bits.push(`label ${JSON.stringify(f.label)} (id ${f.labelId})`);
+    else bits.push('no label (the value as the quote writes it)');
+    if (f.example) bits.push(`seen: ${JSON.stringify(f.example)}`);
+    if (f.rule) bits.push(`rule ${JSON.stringify(f.rule)}`);
+    if (f.aiProposal) bits.push("AI's proposal");
+    if (f.forRule !== undefined) bits.push(`carries ~ rule ${f.forRule}`);
+    add(f.line, `CAN CHECK: ${bits.join(', ')}`);
+  }
+  for (const p of report.prose) add(p.line, 'WRITTEN TEXT (not looked up; keep its word/section counts)');
+  for (const n of report.notFound) add(n.line, `NOT FOUND${n.rule ? ` (rule ${n.rule})` : ''}: ${n.words ? `${JSON.stringify(n.words)} - ` : ''}${n.why}`);
+  const lines = [...byLine.keys()].sort((a, b) => a - b).map((n) => `line ${n}:\n${byLine.get(n).map((/** @type {string} */ s) => `  ${s}`).join('\n')}`);
+  return `WHAT THE LOOK AT THE INPUTS FOUND - write the facts from this; copy the label and phrase words exactly\n\n${lines.join('\n') || '(the look reported nothing)'}`;
+}
+
+/**
+ * The label scans and the rendered lists for the inputs the look will read.
+ * @param {Record<string, string>} texts
+ * @returns {{scans: Record<string, import('./labelscan.js').LabelScan>, lists: Record<string, string>}}
+ */
+export function labelListsOf(texts) {
+  /** @type {Record<string, import('./labelscan.js').LabelScan>} */
+  const scans = {};
+  /** @type {Record<string, string>} */
+  const lists = {};
+  for (const [label, text] of Object.entries(texts)) { scans[label] = scanLabels(text); lists[label] = renderLabelList(label, scans[label]); }
+  return { scans, lists };
+}
+
+export { LABEL_SHAPES };
+
+/**
+ * L3: a reason the AI gave, cut only at a sentence end (never mid-sentence): whole sentences while they fit in `max` characters,
+ * and nothing at all if the first one alone does not fit. A trailing full stop is dropped (the caller closes the clause).
+ * @param {string} text @param {number} max @returns {string}
+ */
+export function wholeSentences(text, max) {
+  const sentences = text.replace(/\s+/g, ' ').trim().split(/(?<=[.!?])\s+/).filter(Boolean);
+  let out = '';
+  for (const s of sentences) {
+    const next = out === '' ? s : `${out} ${s}`;
+    if (next.length > max) break;
+    out = next;
+  }
+  return out.replace(/[.!?]+$/, '');
+}
+
+/**
+ * I1 (hamr, 2026-10-13, "Ruled by hamr" 2): when the look shows the person's intent on one `~` rule was NOT captured - its words or
+ * meaning are not in the source - the person is asked about THAT rule at once, named by its line and rule. Only a look entry that names
+ * a rule number counts; anything else the look could not find is not asked piecemeal (it is Not checked, or the whole job is reviewed).
+ * The wording is the code's own, never the model's. The keep-or-drop and the cap are `normalizeQuestions` (src/authorflow.js).
+ * @param {LookNotFound[]} notFound @param {{n: number, text?: string, rule?: string, rules?: string[]}[]} jobLines
+ * @returns {{line: number, question: string}[]} every candidate question (the caller applies the machine's caps)
+ */
+export function ruleQuestions(notFound, jobLines) {
+  /** @type {{line: number, question: string}[]} */
+  const out = [];
+  /** @type {Set<string>} */
+  const seen = new Set();
+  for (const n of Array.isArray(notFound) ? notFound : []) {
+    if (!Number.isInteger(n.rule)) continue;
+    const line = jobLines.find((l) => l.n === n.line);
+    const rule = line ? lineRules(line)[/** @type {number} */ (n.rule) - 1] : undefined;
+    if (!line || rule === undefined) continue;
+    const key = `${n.line}:${n.rule}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const words = n.words ? `${JSON.stringify(n.words)} (from your words)` : 'what this rule asks for';
+    const why = wholeSentences(String(n.why), 200);
+    out.push({ line: n.line, question: `Line ${n.line}, rule ${n.rule} - "${rule}": I could not find ${words} in your input${why ? ` (${why})` : ''}. What do you mean by it? Your answer is added as a new ~ rule on line ${n.line}.` });
+  }
+  return out;
+}

package/src/interviewrun.js

@@ -87,7 +87,7 @@
 // non-repo source gets the form up to here and then an honest named stop:
 // bareloop has no checks for that kind of job yet (ruling 7 → M4).
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, rowsForHome } from './providerrows.js';
+import { keyValueOf, namedRowsForHome, resolveWorker } from './providerrows.js';
 import {
   writeFileSync, mkdirSync, readFileSync, statSync,
 } from 'node:fs';
@@ -192,6 +192,9 @@ export async function main(argv, deps = {}) {
   // way an empty `--verdict`/`--provider` value already does elsewhere in this
   // file.
   const baseUrlArg = arg('base-url');
+  // `--model <id>`: the model id of a line ticked in Settings > Providers (with both prices). Written into the draft as `model`, so the
+  // job carries its own model; absent when never given (run-author then stops at $0 asking for one).
+  const modelArg = arg('model');
   // `--lang` IS GONE (PRD item 33 M3, ruling 3): language is a FACT of the
   // repository, read off its own manifest, never a flag a person sets. A
   // `--lang` on the command line now is an operator error, stopped loud rather
@@ -686,6 +689,7 @@ export async function main(argv, deps = {}) {
     // written as `null`/`''`; every provider constructor defaults its own
     // endpoint on its own in that case (PRD item 28 ruling (d)).
     ...(baseUrlArg === null ? {} : { baseUrl: baseUrlArg }),
+    ...(modelArg === null ? {} : { model: modelArg }),
     cadence: { unit: 'day', every: 1 },
     budgetUsd,
     ...(wallMin === null ? {} : { maxWallMs: Math.round(wallMin * 60_000) }),
@@ -782,29 +786,17 @@ export async function main(argv, deps = {}) {
   // anything this script itself let through; the try/catch is only for the
   // off-menu case `validateJob` reds but does not stop the write for (an
   // admitted-but-uncrafted table entry would otherwise crash this print).
-  let providerEntry = null;
-  try { providerEntry = resolveProvider(PROVIDER); } catch { providerEntry = null; }
-  const providerEnvKey = providerEntry?.envKey ?? null;
-  say(`  ${providerEnvKey ?? 'YOUR_PROVIDER_API_KEY'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
-  // An `openai-api` + `baseUrl` draft (DeepSeek, today's one secondary, reached
-  // this way) still reads its key from `OPENAI_API_KEY` — there is no separate
-  // "DeepSeek key" env var, and a person pointed only at the command above could
-  // reasonably miss that. Said once, plainly, never a key VALUE.
-  if (draft.baseUrl !== undefined && providerEnvKey) {
-    say(`  (the endpoint above is reached through the "${PROVIDER}" table entry, so its key still goes in ${providerEnvKey} — there is no separate endpoint-specific key variable)`);
-  }
-  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own
-  // door, before a spine exists — so with the shell unkeyed this question has
-  // exactly one possible outcome for the person, and putting it anyway spends
-  // their attention on a choice they do not have. What is actionable instead is
-  // the command above and the one line that says how to make it work.
-  // F181 — a key that IS set can still carry a shape run-author will refuse
-  // (a line break/control char/stray whitespace, e.g. a two-line secret-store
-  // entry). A malformed key must not count as KEYED: this offer must read the
-  // same "will it actually run" question run-author itself asks at its door.
-  // P4a item 4 — the key variable the person picked in Settings stands in for the built-in one
-  const keyEnv = keys.home !== undefined ? applyConfiguredKey(env, PROVIDER, draft.baseUrl, rowsForHome(keys.home)) : env;
-  const rawKeyValue = providerEnvKey ? keyEnv[providerEnvKey] : undefined;
+  // The key is the Settings row's own variable (P8: no built-in name). The worker is the draft's API shape + Base URL + model line.
+  const keyRowsNow = keys.home !== undefined ? namedRowsForHome(keys.home) : [];
+  const worker = resolveWorker(keyRowsNow, { provider: PROVIDER, baseUrl: draft.baseUrl, model: modelArg });
+  const providerEnvKey = worker.ok ? worker.row.envName : null;
+  say(`  ${providerEnvKey ?? 'YOUR_KEY_NAME'}=... ${commandFor('author', deps.invokedAs)} ${childArgs.join(' ')}`);
+  if (!worker.ok) say(`  (${worker.say.replace(' Nothing was spent.', '')} — bareloop author stops at $0 until it is)`);
+  // NO KEY, NO OFFER. `run-author.mjs` refuses without one and exits 2 at its own door, before a spine exists — so with the shell
+  // unkeyed this question has exactly one possible outcome for the person, and putting it anyway spends their attention on a choice
+  // they do not have. F181 — a key that IS set can still carry a shape run-author will refuse (a line break/control char/stray
+  // whitespace). A malformed key must not count as KEYED: this offer reads the same "will it actually run" question run-author asks.
+  const rawKeyValue = providerEnvKey ? keyValueOf(env, providerEnvKey) : undefined;
   const keyProblem = rawKeyValue ? apiKeyProblem(rawKeyValue) : null;
   const KEYED = providerEnvKey !== null && Boolean(rawKeyValue) && !keyProblem;
   if (!KEYED) {
@@ -814,7 +806,7 @@ export async function main(argv, deps = {}) {
     } else {
       say(providerEnvKey
         ? `  (${providerEnvKey} is not set in this shell — bareloop author refuses without it; secrets load from the environment, never the tree)`
-        : `  (provider "${PROVIDER}" is not in the runnable table — bareloop author will refuse it loud; this is not a key problem)`);
+        : '  (no key row serves this model yet — bareloop author refuses it at $0; this is not a key problem)');
     }
     // The repair, in plain words and WITHOUT a command: which secret store a person
     // keeps their key in is theirs, and printing one specific incantation would be

package/src/job.js

@@ -16,6 +16,7 @@
 import { createHash } from 'node:crypto';
 import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier, closeScriptCandidateToken } from './validate.js';
 import { validateCloseDecl, DECLARED_CLOSE_CLASSES } from './declaredclose.js';
+import { inputLabelsOf } from './rubricstep.js';
 import { CLOSE_TIMEOUT_FLOOR_MS } from './closetimeout.js';
 
 // The menus below ARE the close-authoring hierarchy (PRD §7) and ship frozen:
@@ -167,7 +168,7 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'baseUrl', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'closeTimeoutMs', 'model', 'thinking', 'judge', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools', 'jobLines', 'inputs'];
 /** the exact fields of a signed `judge` override — nested objects red unknown
  * keys too, because no smuggling level exists in a signed spec */
 const JUDGE_FIELDS = ['provider', 'model'];
@@ -329,7 +330,12 @@ export function validateJob(input, { shellCapUsd = 2 } = {}) {
   // on THAT model, not merely on the goal/close it runs against. The judge
   // model stays library-pinned pending recalibration — out of scope here.
   if (spec.model !== undefined && !isNonEmptyString(spec.model)) {
-    red('invalid-value', 'model', 'non-empty string — exact provider model id (e.g. "claude-sonnet-5")');
+    red('invalid-value', 'model', 'non-empty string — the exact model id of a line ticked in Settings > Providers');
+  }
+  // THINKING (P8) — the job's "Thinking on" tick, OPTIONAL: absent means off (and an old spec keeps the hash it always had); present it is
+  // signed like `model`. It covers DRAFTING and the rubric JUDGE only — the worker is never handed a thinking option. A boolean, nothing else.
+  if (spec.thinking !== undefined && typeof spec.thinking !== 'boolean') {
+    red('invalid-value', 'thinking', 'true or false — the job\'s "Thinking on" tick (absent = off)');
   }
 
   // JUDGE — PRD item 32.1 (hamr, 2026-09-10: the judge "defaults to whatever
@@ -790,7 +796,7 @@ function validatePlanShape(spec, red, reds) {
     // class the user picked (PRD v1.57 §2), so the gate cannot check D5 without
     // it. An unknown or locked class is refused there, on its own axis, beside
     // the counted `request-red` above.
-    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null });
+    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null, inputLabels: inputLabelsOf(spec.inputs) });
     for (const r of cd.reds) reds.push(r);
     if (demanded !== undefined && !CLASS_BY_CLOSE.declared.includes(demanded)) {
       // the same laundering guard as the close-type hierarchy, one level up: a
@@ -984,15 +990,15 @@ export function checkApproval(job, approvals) {
  * mismatched flag is a mistake worth stopping on, never a silent swap); the
  * same id from both is not a conflict. Extracted from scripts/run-u.mjs so
  * the decision is testable without running the script or touching a provider.
- * @param {{ specModel?: string, flagModel?: string, defaultModel: string }} args
+ * @param {{ specModel?: string, flagModel?: string, suppliedModel?: string }} args
  *   `specModel` — `job.model` if the signed spec carries one, else undefined.
  *   `flagModel` — the model id an explicit `--model <tier>` resolved to, else
  *   undefined (a flag that was never passed, not merely a default tier name).
- *   `defaultModel` — the runner's own default when neither spec nor flag says.
+ *   `suppliedModel` — a model the CALLER supplies when neither spec nor flag says (bareloop keeps none of its own).
  * @returns {{ model: string, source: 'spec'|'flag'|'default' }}
- * @throws {Error} when the spec names a model and the flag names a different one
+ * @throws {Error} when the spec names a model and the flag names a different one, or when no model is named at all
  */
-export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
+export function resolveWorkerModel({ specModel, flagModel, suppliedModel }) {
   if (specModel !== undefined) {
     if (flagModel !== undefined && flagModel !== specModel) {
       throw new Error(`spec names model "${specModel}" but --model resolved to "${flagModel}" — the signed spec wins; a mismatched --model flag is refused, never silently overridden. Drop --model or point it at the same model.`);
@@ -1000,5 +1006,6 @@ export function resolveWorkerModel({ specModel, flagModel, defaultModel }) {
     return { model: specModel, source: 'spec' };
   }
   if (flagModel !== undefined) return { model: flagModel, source: 'flag' };
-  return { model: defaultModel, source: 'default' };
+  if (suppliedModel === undefined) throw new Error('no model is named — a job carries its own model, or the run is given --model <id> (one ticked in Settings > Providers with both prices)');
+  return { model: suppliedModel, source: 'default' };
 }

package/src/jobblock.js

@@ -113,16 +113,21 @@ export function renderInputs(inputs) {
  * The two cross-checks between a parsed job block and the Check type: a RUBRIC job needs at least one `PASS:` and one
  * `FAIL:` example (the calibration compile reads them); a DETERMINISTIC job has no judge, so an example line would be
  * silently dropped — a red instead.
+ * PART 1a (hamr's ruling P1=B, docs/product/ITEM33-BUILD.md "Addendum 2026-10-12"): the examples are required of a rubric
+ * job ONLY when it holds a judged part. A rubric job on the person's own local files holds none in this build (its
+ * parts are counted or checked against a quote), so the caller says `judged: false` and a block without examples fits.
+ * Examples written anyway are never a red there — they simply have no judge to read them yet.
  * @param {JobLine[]} lines
  * @param {boolean} rubric
+ * @param {{judged?: boolean}} [o] `judged` (default true): does this job hold a judged part, so that it needs examples?
  * @returns {string|null} the plain red, or null when the block fits the Check type
  */
-export function jobBlockFitsCheck(lines, rubric) {
+export function jobBlockFitsCheck(lines, rubric, { judged = true } = {}) {
   const all = lines.flatMap((l) => l.examples.map((e) => ({ n: l.n, ...e })));
   if (!rubric) {
     return all.length ? `The job, line ${all[0].n}: PASS:/FAIL: examples are for a Rubric check — a Deterministic job has no judge to read them` : null;
   }
-  if (!all.some((e) => e.verdict === 'PASS') || !all.some((e) => e.verdict === 'FAIL')) {
+  if (judged && (!all.some((e) => e.verdict === 'PASS') || !all.some((e) => e.verdict === 'FAIL'))) {
     return 'The job: a Rubric check needs at least one "~ PASS:" line and one "~ FAIL:" line under a job line';
   }
   return null;

package/src/judged.js

@@ -66,43 +66,11 @@
 import { quoteIn } from 'bareguard';
 import { createRequire } from 'node:module';
 import { extractArtifact, priceOf, scrubRaw, rateSourceFields } from './text.js';
-import { resolveProvider, judgeCallOptions } from './providers.js';
+import { resolveProvider } from './providers.js';
+import { thinkingCallOptions } from './thinking.js';
 
 const require = createRequire(import.meta.url);
 
-/**
- * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
- * the judge: every grading path imported it, so bareloop could run a worker on
- * any provider and still judge only on Claude.
- *
- * It is no longer read by any grading path. The judge identity is now RESOLVED
- * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
- * `runJudgedFloor`, an explicit argument into the calibration gate, and
- * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
- * Keeping the export is deliberate: it is part of the public API
- * (`src/index.js`) and an adopter importing it should not break on a minor.
- * What it means now is "the judge bareloop pinned before item 32", which is
- * still the right DEFAULT for an anthropic-api job and still the only tier with
- * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
- * haiku-4.5 only).
- *
- * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
- * rule with no detector is prose (F45) — only the value being compared moved
- * from this constant to the resolved identity:
- *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
- *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Change the judge and every
- *      signed judged spec hashes differently: the signature dies, and re-signing
- *      is what re-runs the calibration gate.
- *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a judge is a floor nobody can tell apart from a moved one.
- *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
- *      about to grade, naming both. It does not degrade in either direction:
- *      grading on the new judge judges against a floor nobody calibrated, and
- *      the old judge is not on offer.
- */
-export const JUDGE_MODEL = 'claude-haiku-4-5';
-
 /**
  * RESOLVE WHICH MODEL GRADES THIS JOB (PRD item 32.1).
  *
@@ -122,7 +90,7 @@ export const JUDGE_MODEL = 'claude-haiku-4-5';
  *      item 31.4 a green job runs on its own key alone, and this is what lets a
  *      JUDGED one do the same.
  *
- * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * There is deliberately NO third fallback to a library-pinned model. A caller that cannot
  * say which model will grade has not wired a judge, and the grading path stops
  * as a wiring gap rather than grading under an identity nobody chose — the same
  * answer an absent `judgeLoop` already gets. A silent default here would be the
@@ -198,15 +166,13 @@ export function resolveJudge({ specJudge, workerProvider, workerModel } = {}) {
  *
  * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
  * @param {string} fallbackProviderName used only when `source.provider` is absent
- * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @param {(o: {specModel?: string, flagModel?: string, suppliedModel?: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
  * @returns {{provider: string, model: string}}
  */
 export function resolveJobJudge(source, fallbackProviderName, resolveWorkerModelFn) {
   const providerName = source?.provider ?? fallbackProviderName;
-  const providerEntry = resolveProvider(providerName);
-  const { model } = resolveWorkerModelFn({
-    specModel: source?.model, flagModel: undefined, defaultModel: providerEntry.tiers.sonnet,
-  });
+  resolveProvider(providerName); // an unknown shape is the named throw, never a silent default
+  const { model } = resolveWorkerModelFn({ specModel: source?.model, flagModel: undefined });
   return resolveJudge({ specJudge: source?.judge, workerProvider: providerName, workerModel: model });
 }
 
@@ -1089,9 +1055,11 @@ function topLevelFunctionNames(artifactText) {
  * so the priced seam is the only legal one.
  * `rates` is the customer's own price for the judge's row (USD per 1K, `ratesFor`'s
  * `rates`); null/absent = bare-agent's built-in guess, exactly as before.
- * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o
+ * `thinking` is the job's SIGNED "Thinking on" tick (false/absent = off): the judge follows the signed value — so the calibration gate
+ * (10/10) and the later grading run with the SAME tick — and bare-agent decides what each model can switch (src/thinking.js).
+ * @param {{provider: any, system: string, rates?: {in: number, out: number}|null, thinking?: boolean}} o
  * @returns {{run: (msgs: any[], tools: any[], opts?: any) => Promise<any>}} */
-export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
+export const defaultJudgeLoop = ({ provider, system, rates = null, thinking = false }) => {
   const { Loop } = require('bare-agent');
   // BA-21: the Loop's run RESULT carries no `rateSource` — only the per-call metering event
   // does (`onLlmResult`). Capture it there and ride it on the result, so `runLocate` can
@@ -1107,7 +1075,7 @@ export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
   return {
     run: async (/** @type {any[]} */ msgs, /** @type {any[]} */ tools, /** @type {any} */ opts) => {
       seen = null;
-      const res = await loop.run(msgs, tools, { ...judgeCallOptions(provider), ...opts });
+      const res = await loop.run(msgs, tools, { ...thinkingCallOptions(provider, thinking === true ? 'on' : 'off'), ...opts });
       return res && typeof res === 'object' && seen ? { ...res, rateSource: /** @type {any} */ (seen).rateSource } : res;
     },
   };

package/src/keysfile.js

@@ -76,18 +76,24 @@ export function filledKeyNames(home) {
 }
 
 /**
- * Create the keys file with the five empty preset lines when — and only when — it does not
- * exist (mode 600). An existing file is never touched.
- * @param {readonly string[]} presetNames the names to seed, in order
+ * The two comment lines a fresh keys file is created with — no provider name, no preset key.
+ * Each key the person types becomes a row in Settings > Providers.
+ */
+export const KEYS_FILE_BODY = '# bareloop keys — type NAME=value by hand; this file is never shown or written by bareloop.\n'
+  + '# One line per provider key, e.g. MY_PROVIDER_API_KEY=... ; each key becomes a row in Settings > Providers.\n';
+
+/**
+ * Create the keys file with {@link KEYS_FILE_BODY} when — and only when — it does not
+ * exist (mode 600, dir 700). An existing file is never touched.
  * @param {string} [home]
  * @returns {boolean} true if it was created
  */
-export function ensureKeysFile(presetNames, home) {
+export function ensureKeysFile(home) {
   const file = keysFilePath(home);
   if (existsSync(file)) return false;
-  mkdirSync(keysHome(home), { recursive: true });
+  mkdirSync(keysHome(home), { recursive: true, mode: 0o700 });
   try {
-    writeFileSync(file, presetNames.map((n) => `${n}=\n`).join(''), { mode: 0o600, flag: 'wx' });
+    writeFileSync(file, KEYS_FILE_BODY, { mode: 0o600, flag: 'wx' });
   } catch (/** @type {any} */ e) {
     if (e?.code === 'EEXIST') return false; // lost a race: the file is there, untouched
     throw e;
@@ -101,6 +107,8 @@ export function ensureKeysFile(presetNames, home) {
  * @property {string[]} names the NAMES the file defines (sorted; never values)
  * @property {string|null} warning a plain-words warning (file readable by others, or
  *   unreadable), else null — a warning, never a refusal
+ * @property {boolean} [unreadable] true only when the file is there but could not be read (the Settings row then
+ *   reads "refused — see above"); absent otherwise
  * @property {Record<string,string|undefined>} env shell env with the file filling the
  *   names the shell does not set. THE ONLY place values leave this module.
  */
@@ -127,7 +135,7 @@ export function loadKeysEnv(opts = {}) {
   try {
     parsed = parseKeysText(readFileSync(file, 'utf8'));
   } catch (/** @type {any} */ e) {
-    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, env: { ...base } };
+    return { exists: true, names: [], warning: `${file} could not be read (${e?.code ?? 'error'})`, unreadable: true, env: { ...base } };
   }
   /** @type {Record<string,string|undefined>} */
   const env = { ...base };