bareloop 0.6.0 → 0.8.0

package/src/plan.js

@@ -25,7 +25,7 @@
 // plain parsed data; every failure is a named {code, path, detail} red.
 
 import { TOOL_MENU, LOCKED_TOOLS, WRITE_VERBS, checkMenu } from './job.js';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
 
 /** the closed exit menu (PRD v1.12 §3 + decision 1's `check-passes`): the
  * shell evaluates every form with its own fixed code, never a command — the
@@ -102,8 +102,28 @@ const STEP_FIELDS = ['id', 'action', 'tools', 'rounds', 'target', 'exit', 'model
  * construction — the agent picks a tier, never names an arbitrary model string
  * (the tier→model mapping and any effort params are the RUNNER's, per provider).
  * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
- * never plan-selectable. */
-export const STEP_MODELS = Object.freeze(['sonnet', 'haiku']);
+ * never plan-selectable.
+ *
+ * 2026-08-06 — haiku dropped, on hamr's order: "haiku should be dropped to see if
+ * it passes, if it's agent poor work or harness, like always." This is a REVERSIBLE
+ * ATTRIBUTION PROBE, not a finding that haiku is incapable. What the $0 archive read
+ * (186 spines / 71 accepted plans / 255 steps) actually shows is a CONFOUND, in both
+ * directions: only 20 steps ever declared a tier at all — haiku 12 (9 of them on a
+ * REPLANNED plan, 6 the LAST step of their plan, bounds 3–12 rounds, 2 ever green)
+ * against explicitly-declared sonnet 8 (bounds 14–32, 5 green). The planner picks
+ * haiku for steps it judges mechanical, and replanned steps sit on runs already in
+ * trouble, so neither column is a controlled read. All three bareagent-u runs of
+ * 2026-08-06 tiered the REPLANNED step down (haiku/6, haiku/8, haiku/12) and all
+ * three failed, against sonnet initial steps at 30–40 rounds — a confound sitting
+ * on the programme's most recent capability read. Removing the tier is how it gets
+ * attributed: with only one tier expressible, a still-failing replan is agent or
+ * harness, not the tier.
+ *
+ * The `model` FIELD and its validator branch stay: a one-entry menu means a plan (or
+ * a stored bridge) declaring `model:"sonnet"` still validates, and restoring haiku is
+ * a one-token edit. This narrows only what the AGENT may express — `--model haiku`
+ * remains the OPERATOR's probe knob (PRD v1.36), untouched in the runner scripts. */
+export const STEP_MODELS = Object.freeze(['sonnet']);
 const EXIT_FIELDS = {
   'artifact-written': ['type', 'path', 'pattern'],
   'tree-changed': ['type', 'scope'],
@@ -112,103 +132,14 @@ const EXIT_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
- * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
- * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
- * outer repeat is polynomial at worst, and the body is self-authored — F49).
- * @param {string} src @param {number} i */
-function unboundedQuantLen(src, i) {
-  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
-  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
-  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
-  return len;
-}
-
-/**
- * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
- * unbounded quantifier applied to a group whose body itself repeats unboundedly
- * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
- * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
- * and is caught by propagating the inner repeat up through the wrapper. Such a
- * pattern can hang `RegExp.test` for
- * seconds on a short crafted body, and `evalExits` runs the agent-authored
- * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
- * authors both the pattern and (via the worker) the artifact, so a hang burns
- * only its own run's wall-clock; there is NO arbiter compromise (it cannot
- * escape the fence, forge a green, or leak a secret). So the reject targets the
- * dominant exponential class and fails it as a mechanical gap at the validation
- * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
- * (an external native dep we do not take for a LOW issue); exotic
- * overlapping-alternation blowup is out of scope by decision.
- *
- * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — out of scope (self-DoS only, no arbiter compromise).
- *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
- *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
- *     though a real engine runs it linearly — the scan sees the nested-quantifier
- *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
- *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
- *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
- *     Detecting "safe because anchored" needs the same real engine we declined,
- *     and guessing it wrong would ADMIT an exponential pattern — so the shape
- *     reject stands, and the over-rejection is a named, accepted limitation.
- *
- * The input is guaranteed to compile as a RegExp (checked first by the caller),
- * so this scan assumes valid, balanced JS regex syntax.
- * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
- */
-export function hasNestedQuantifier(src) {
-  /** @type {{ quant: boolean }[]} */
-  const stack = [];
-  for (let i = 0; i < src.length; i++) {
-    const c = src[i];
-    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
-    if (c === '[') {                            // character class: quantifier chars inside are literals
-      i++;
-      if (src[i] === '^') i++;
-      // NO POSIX leading-`]`-is-a-literal rule: JS is not POSIX here. `[]` is the
-      // EMPTY class (matches nothing) and `[^]` the any-char idiom — both close at
-      // that first `]`. Skipping it ran the scan past the class's real end and
-      // swallowed every quantifier after it, so `x[^](a+)+$` read as safe while
-      // RegExp.test on it does not finish in 15s on a 31-char body. A false
-      // NEGATIVE is the dangerous direction (F49), so the scan follows JS.
-      //
-      // Honest limit on the monotonicity claim: this is a PARSE correction, not
-      // the "add rejections only" tightening F49's rule contemplates, and it is
-      // not strictly rejection-monotonic. Measured over 14,862 compilable
-      // generated patterns (2,369 previously rejected): 2 rejections disappear,
-      // both pathological `[]`-bearing shapes whose old `true` came from the very
-      // misparse being fixed, and both verified to finish RegExp.test in ~0ms.
-      // Every entry of the checked-in REDOS_BAD/GOOD/OVERREJECTED corpus is
-      // unchanged. So no real hazard was un-rejected — but the claim is
-      // "measured, no hazard lost", never "monotonic by construction".
-      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
-      continue;
-    }
-    if (c === '(') { stack.push({ quant: false }); continue; }
-    if (c === ')') {
-      const g = stack.pop();
-      const qlen = unboundedQuantLen(src, i + 1);
-      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
-      // The group is an unbounded-repeated atom of its parent when it is directly
-      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
-      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
-      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
-      // enclosing group or the outer quantifier's close never sees it. Propagation
-      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
-      // can widen over-rejection — the named FAIL-SAFE direction — but can never
-      // introduce a false negative, which is the dangerous one (F49).
-      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
-      i += qlen;
-      continue;
-    }
-    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
-    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
-  }
-  return false;
-}
+/** F49's catastrophic-backtracking reject. RE-EXPORTED from validate.js, never
+ * re-declared: THREE untimed regex fields are split across the two documents —
+ * this one (`artifact-written.pattern`, agent-authored) and the operator's
+ * `judged.pattern` + `gapKeep` in job.js. plan.js imports job.js, so job.js
+ * cannot import plan.js; housing the scan in the shared primitives module is
+ * what lets both reject through ONE inventory (the SECRET_PATTERNS precedent —
+ * a second copy is a shape one side rejects and the other admits). */
+export { hasNestedQuantifier };
 
 /**
  * The close, as the ordered STAGE LIST the plan flow actually executes (PRD
@@ -246,7 +177,7 @@ export function stageClose(close) {
  * job spec. Never throws on JSON text or plain parsed data; every failure is
  * a named red. Returns the parsed plan on ok (single parse), null on any red.
  * @param {object|string} input parsed plan, or raw JSON text (parse failures are a red)
- * @param {{ job?: any, maxStepRounds?: number, scopes?: string[], capRuns?: number }} [opts] `job`: the
+ * @param {{ job?: any, maxStepRounds?: number, scopes?: string[], seedRed?: string[], priorChecks?: string[] }} [opts] `job`: the
  *   validateJob-GREEN four-field spec (the ceiling, the fence, and the checks
  *   menu all come from it — a missing or non-plan-shape job fails CLOSED);
  *   `maxStepRounds`: the shell's per-step rounds ceiling (interpret's
@@ -254,9 +185,23 @@ export function stageClose(close) {
  *   `scopes`: the offered `tree-changed` menu from `legalScopes` (the SAME array
  *   the drafting prompt enumerated). Omitted, it derives from the signed
  *   writeScope — never a free-text fallback (F50).
+ *
+ *   The two shape-lottery gate rules (2026-08-04) — both keyed on RECORDED
+ *   facts, never an LLM judgment of "is this job small", and both inactive
+ *   when their fact is omitted (resume/reuse callers stay byte-identical):
+ *   `seedRed`: check names whose PREFLIGHT verdict was needs_revision. Rule
+ *   A-v2 — a seed-red check is the goal itself, not a milestone; it may only
+ *   sit on the plan's FINAL write step (`check-placement`). The $0 archive
+ *   sweep: seed-red-check-on-an-early-step has 0 honest greens ever; the one
+ *   wide closing step greens 7/7. Green-at-seed checks stay free mid-plan
+ *   (the 20 TESTGEN mid-plan greens — a guard, not a goal).
+ *   `priorChecks`: the check names the PREDECESSOR plan carried (replan gate
+ *   only). Rule B — a redraft may not drop one (`check-shed`): exits without
+ *   the check verify FORM alone, so a shed lets the run "green" unearned
+ *   (u-msdsmkid mechanism b; the 3 archived sheds were all on step-red runs).
  * @returns {{ ok: boolean, reds: Red[], plan: object|null }}
  */
-export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns = 3 } = {}) {
+export function validatePlan(input, { job, maxStepRounds = 40, scopes, seedRed, priorChecks } = {}) {
   /** @type {Red[]} */
   const reds = [];
   /** @type {(code: string, path: string, detail?: string) => void} */
@@ -319,6 +264,14 @@ export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns =
   } else if (plan.steps.length > MAX_PLAN_STEPS) {
     red('bounds', 'steps', `max ${MAX_PLAN_STEPS} steps — per-step rounds bound the spend, the step count bounds the claim on the wallet`);
   } else {
+    // Rule A-v2's anchor: the index of the plan's FINAL write-granted step. Read
+    // off the RAW steps (a step whose grant didn't parse counts as non-write —
+    // its own missing-required/invalid-value red already fired; deriving a
+    // placement charge from the false default would be a second red for one
+    // defect). -1 when no step writes: every check then reds as a mailbox anyway.
+    const lastWriteIdx = plan.steps.reduce((/** @type {number} */ acc, /** @type {any} */ s, /** @type {number} */ i) => (
+      isObj(s) && Array.isArray(s.tools) && s.tools.some((/** @type {unknown} */ t) => WRITE_VERBS.includes(/** @type {string} */ (t))) ? i : acc), -1);
+    const seedRedNames = Array.isArray(seedRed) ? seedRed.filter(isNonEmptyString) : [];
     const seen = new Set();
     plan.steps.forEach((/** @type {any} */ s, /** @type {number} */ i) => {
       const at = `steps.${i}`;
@@ -370,8 +323,24 @@ export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns =
       if (s.model !== undefined && !STEP_MODELS.includes(s.model)) {
         red('invalid-value', `${at}.model`, `menu: ${STEP_MODELS.join('|')} — the tier menu is signed; the agent picks a tier, never names a model`);
       }
-      if (s.attempts !== undefined && !(Number.isInteger(s.attempts) && s.attempts >= 1 && s.attempts <= capRuns)) {
-        red('bounds', `${at}.attempts`, `integer 1..${capRuns} — a step may tighten the shell's attempt cap, never exceed it`);
+      // `attempts` is TOLERATED-INERT (step ladder, 2026-08-03). It once tightened a
+      // fixed per-step attempt count; that count is gone — a step's iterations are
+      // governed by the strike ladder, and a field that could only ever TIGHTEN is
+      // the wrong shape for a progress rule (drafters measurably tightened it to 3,
+      // then to 2 on replan, which is the opposite of the heal a converging step
+      // needs). It is no longer OFFERED in the drafting prompt, and the runner
+      // ignores it.
+      //
+      // It is not REJECTED, and that is the load-bearing half: the frozen bridge
+      // registry's stored plans carry `attempts`, and a bridge rides into the drafter
+      // as a starting draft after passing the ordinary validator. Redding it here
+      // would refuse every stored recipe minted before today and ruin a frozen
+      // contrast experiment. The SHAPE is still checked — a known field holding
+      // garbage stays a named red — but the upper bound is gone with the cap it
+      // named: keeping `<= capRuns` would make a plan stored under one runner's
+      // number invalid under another's, for a field that decides nothing.
+      if (s.attempts !== undefined && !(Number.isInteger(s.attempts) && s.attempts >= 1)) {
+        red('bounds', `${at}.attempts`, 'integer >= 1 — the field is accepted for stored-plan compatibility and bounds nothing (the step ladder governs iterations)');
       }
       if (s.scope !== undefined && !scopeMenu.includes(s.scope)) {
         red('invalid-value', `${at}.scope`, `menu: [${scopeMenu.join(', ')}] — a per-step write scope narrows the fence from the same menu tree-changed uses`);
@@ -435,8 +404,26 @@ export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns =
         red('step-scope-escape', `${at}.target`, `"${s.target}" is inside the signed fence but outside this step's own scope "${stepScope}" — the step's gate is built from that narrowed prefix, so every write to this target would be denied`);
       }
 
-      validateExit(s, at, red, { checkNames, fence: spec.writeScope, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope });
+      validateExit(s, at, red, { checkNames, fence: spec.writeScope, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope, seedRedNames, isFinalWrite: i === lastWriteIdx });
     });
+
+    // Rule B (`check-shed`, replan gate): the caller hands over the check names
+    // the PREDECESSOR plan carried; a redraft that drops one is refused. Exits
+    // without the check verify FORM alone (tree-changed/artifact-written), so a
+    // shed lets a step "green" with the truth unjudged — u-msdsmkid's replan
+    // dropped check-passes from BOTH steps and greened unearned on form. Set
+    // semantics on NAMES: where the check sits may move (A-v2 forces it to the
+    // final write step); that it is judged at all may not. One red listing every
+    // dropped name — one defect (the shed), one red.
+    if (Array.isArray(priorChecks)) {
+      const carried = new Set(plan.steps.flatMap((/** @type {any} */ s) => (isObj(s) && Array.isArray(s.exit)
+        ? s.exit.filter((/** @type {any} */ e) => isObj(e) && e.type === 'check-passes' && isNonEmptyString(e.name)).map((/** @type {any} */ e) => e.name)
+        : [])));
+      const dropped = priorChecks.filter(isNonEmptyString).filter((n) => !carried.has(n));
+      if (dropped.length) {
+        red('check-shed', 'steps', `the predecessor plan carried check-passes(${dropped.join(', ')}) and this redraft drops ${dropped.length === 1 ? 'it' : 'them'} — a replan may move a check, never shed it (the remaining exits verify form only, so a shed green would be unearned)`);
+      }
+    }
   }
 
   // 3. secrets sweep — the agent-authored document is the riskier entry point
@@ -452,13 +439,15 @@ export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns =
  * @param {Record<string, any>} s the step
  * @param {string} at step path prefix
  * @param {(code: string, path: string, detail?: string) => void} red
- * @param {{ checkNames: string[], fence: string[], insideFence: (p: string) => boolean, writeStep: boolean, toolsParsed: boolean, scopeMenu: string[], stepScope: string|null, overlapsStepScope: (p: string) => boolean }} ctx
+ * @param {{ checkNames: string[], fence: string[], insideFence: (p: string) => boolean, writeStep: boolean, toolsParsed: boolean, scopeMenu: string[], stepScope: string|null, overlapsStepScope: (p: string) => boolean, seedRedNames: string[], isFinalWrite: boolean }} ctx
  *   `stepScope`/`overlapsStepScope` (W3): the step's OWN narrowed fence when it
  *   declared a legal `scope`, null/always-true otherwise. Exits are OBSERVATIONS,
  *   not writes, so only `tree-changed` is constrained by it and only against
  *   DISJOINTness — see the arm for the measured semantics.
+ *   `seedRedNames`/`isFinalWrite` (Rule A-v2): the preflight-red check names and
+ *   whether THIS step is the plan's final write step — see the check-passes arm.
  */
-function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope }) {
+function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope, seedRedNames, isFinalWrite }) {
   if (!Array.isArray(s.exit) || s.exit.length === 0) {
     red('missing-required', `${at}.exit`, `non-empty array from the closed menu ${EXIT_TYPES.join('|')} — ALL listed exits must pass (AND-only); a step without an exit has no progress gate`);
     return;
@@ -485,6 +474,16 @@ function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep, t
         // decision 1: a check the spec doesn't sign DOES NOT EXIST — and the
         // detail names the signed menu so the replan can aim, not guess
         red('check-unknown', eAt, `"${e.name}" is not an offered close stage — the agent references stages of the operator's close, never authors a ruler; offered: [${checkNames.join(', ') || 'none'}]`);
+      } else if (seedRedNames.includes(e.name) && writeStep && !isFinalWrite) {
+        // Rule A-v2 (`check-placement`): a check that was RED at preflight is
+        // the GOAL itself, not a milestone — it judges the whole territory, so
+        // an earlier step scoped to a slice can never satisfy it without
+        // crossing its own boundary (the bareagent-u death shape: 0 honest
+        // greens in the whole archive; the wide closing step greens 7/7). Only
+        // on a WRITE step and only when the anchor exists elsewhere: a
+        // read-only step already redded as a mailbox (one defect, one red),
+        // and a green-at-seed check is a guard, free to sit anywhere.
+        red('check-placement', eAt, `"${e.name}" was RED at preflight — a failing check is the goal itself and may only gate the plan's FINAL write step (make that step wide: free to edit any file it reports, iterating until it passes); an earlier step scoped to a slice can never satisfy a whole-goal check`);
       }
     } else if (e.type === 'tree-changed') {
       hasTreeChanged = true;