bareloop 0.5.1 → 0.7.0

package/README.md

@@ -25,15 +25,32 @@ inheritance with ledger-counted attribution.
 The pitch in one line: **workflows that earn their own design, with receipts** — every
 inherited rule carries the green that minted it and the contrast that attributed it.
 
+**What you keep is the workflow, not the session.** An agent figures your recurring,
+verifiable job out once; what survives is a verified, self-healing workflow you can run
+again — with bounded spend under an envelope *you* sign, deterministic verification you
+don't author, and cost and time reported honestly (an unknown is reported unknown, never
+rounded to zero). *Direction, not yet shipped:* a local workbench where you experiment with
+a job, graduate a workflow once it greens, and **export** it — signed spec, workflow, close
+scripts and a thin runner that depends on bareloop, so the whole self-healing library
+(bare-agent · bareguard · litectx) comes along as npm dependencies. That bundle runs
+headless as an enclosed CLI and asks you the same signing questions at the prompt that the
+workbench would. It is a dependency, never generated standalone code: the gate travels with
+it and never disappears.
+
 > **Status: Layer 2 — accepted.** The agent now authors its own workflow: `runJob()`
 > takes a signed job spec, surveys the repo, **drafts a validated plan of bounded steps**
 > (each with an operator-signed self-check it may reference but never author), and runs it
 > under an un-gameable outer close and one budget it can only tighten. On the real-model
 > acceptance battery (F47) the emergent flow converted a job the same worker failed 4/4
 > before — 3/3 runs, clearing the owned bar every time, composing its own check exits. The
-> within-run ratchet (Layer R) ships armed-and-inert by measurement (F41). Next: **N3 —
-> executed inheritance**, where the workflow persists and improves across runs (the
-> ladder's kill-switch question).
+> within-run ratchet (Layer R) ships armed-and-inert by measurement (F41). **In flight:
+> N3 — executed inheritance**, where a workflow that greened is kept, offered to the next
+> similar job, and improved as executed instead of drafted from scratch (the ladder's
+> kill-switch question). As of 0.7.0 N3's machinery **ships** — the bridge registry, the
+> operator-signed reuse envelope, the selection call and step-level resume are all in the
+> public API — but shipping is not acceptance: one execution green proves reuse safe and
+> legal, never *beneficial*. The lift claim waits on the ON-vs-forced-cold contrast, which
+> has not fired. Until it does, treat reuse as available and unproven.
 
 ## Quick start
 
@@ -60,26 +77,36 @@ Three layers; nothing inside negotiates with the layer above it.
 | Layer | What it is | Emergent? |
 |---|---|---|
 | **Outer shell** | Per-run budget cap (bareguard), retry cap, verdict collection, escalation routing. Stateless across runs | never — permanent, dumb, un-gameable |
-| **Emergent middle** | The authored workflow config: steps, per-step verdict class, memory binding, write scopes — schema-validated, config-red before tokens burn | yes — authored and improved by the agent |
+| **Emergent middle** | The authored plan: bounded steps, each with its granted verbs, its own round cap, its write scope and its form-checkable exits — schema-validated, red before tokens burn. A step keeps iterating while it is making progress; when it stops, the shell ends it and the planner re-allocates | yes — authored and improved by the agent |
 | **Floor** | Append-only JSONL spine (single source for every UI), litectx store per job, per-run ledger | never — the record |
 
-Every checkpoint in a workflow carries its own **verdict class**, and the class decides
-what the run's learning is worth:
+Every job declares a **verdict class**, and the class decides what the run's learning is
+worth. Today exactly one is built:
 
-| Verdict | Truth source | Mints inheritance? |
-|---|---|---|
-| **Hard green** | predicate / exit-code (tests, build, lint) | automatically |
-| **Soft green** | rubric / assessment | only with HITL confirm or N consistent repeats |
-| **HITL green** | a human is the close (PR merge, "publish") | yes — and merge stays human, forever |
+| Verdict | Truth source | Mints inheritance? | Status |
+|---|---|---|---|
+| **Hard green** | predicate / exit-code (tests, build, lint) | automatically | **built** |
+| **Soft green** | rubric / assessment | only with HITL confirm or N consistent repeats | declared, not built (rung N4) |
+| **HITL green** | a human is the close (PR merge, "publish") | yes — and merge stays human, forever | declared, not built (rung N4) |
 
 The full bare-suite surface is *disclosed* to the authoring agent; only *admitted* verbs
 are callable per job. A request against a locked primitive is a structured red — real
 diagnostic signal, and the admission path when it's justified.
 
+## Security posture — honest about the boundary
+
+bareloop runs **locally**, as you. Secrets load from the environment and never enter the
+tree, the spine, the configs or the ledger — and the close child, which executes the code
+the worker just wrote, gets its environment **stripped of credential-shaped variables**
+(provider keys, `AWS_*`, anything named `*_TOKEN`/`*_SECRET`/`*_PASSWORD`/`*_API_KEY`):
+nothing that judges a tree needs them. That is exposure reduction, **not a sandbox** — the
+worker's code still runs with your OS permissions and network access, so treat a bareloop
+run as inside your trust boundary and give it a repo you'd let an agent touch.
+
 ## The science behind it
 
 bareloop is the productization of **[adaptlearn](https://github.com/hamr0/adaptlearn)**
-(archived at v0.11.1) — a closed experimental record, findings F1–F20. What it settled,
+(archived at v0.11.1) — a closed experimental record, findings F1–F23. What it settled,
 bareloop consumes without re-proving:
 
 | Mechanism | Evidence |
@@ -104,7 +131,7 @@ ladder, and the stop is a result.
 | **N1** ✅ | Job/close schema + validator — v0.2.0 |
 | **N2** ✅ | Single-job headless loop — job #1 minimal (review→fix→PR, hard greens only) — v0.3.0 |
 | **Layer R** ✅ | Within-run ratchet: shell-side fixation detector (intent) + rejected-edit feedback (outcome), **shipped OFF by default** (F41: fixation in remission, so ON has never won its A/B; F43 split the two axes; field read + default decision defer to Layer 2) — v0.4.0 |
-| **Layer 2** | plan-v1 micro-wheels — the road: bounded steps with in-run verifiable exits (the F39-measured semantic converter) |
+| **Layer 2** ✅ | plan-v1 micro-wheels — the road: bounded steps with in-run verifiable exits (the F39-measured semantic converter), accepted on the real-model battery (F47) — v0.5.0, then finished by T·A·P·U (a wall clock, variance-triggered replan, the 14-verb palette, user-mode e2e) |
 | **N3** | Executed inheritance + contrast-bit extractor — **kill-switch: rules must transmit across non-identical runs** |
 | **N4** | Verdict classes complete (soft/HITL minting) |
 | **N5** | Scheduler + budget ops |