bareloop 0.7.0 → 0.8.0

package/src/exits.js

@@ -33,8 +33,14 @@ import { globToPrefix } from './validate.js';
  * `not ok`/`FAILED` names — the mechanical gap the F46 conversion mechanism
  * feeds the worker (F28 reintroduced). This cap is a defensive backstop above
  * boundGap's own envelope: a normal bounded gap passes through intact, and only
- * a pathological seam that returned an unbounded gap would ever be trimmed. */
-const CHECK_GAP_MAX = 12000;
+ * a pathological seam that returned an unbounded gap would ever be trimmed.
+ *
+ * Exported for the ONE reason `boundGap`/`GAP_KEEP_TRIM_MARKER` are (src/ralph.js):
+ * the replan brief re-bounds this same artifact one seam later (`closeGapBlock`), and
+ * a second hand-spelled ceiling there would be a second answer to "how big may a
+ * check gap be" — the two would drift on exactly the property that matters, whether
+ * the `not ok`/`FAILED` names survive. */
+export const CHECK_GAP_MAX = 12000;
 
 /** @typedef {{ type: string, pass: boolean, detail?: string, fault?: string }} ExitResult
  * `fault` present means the INSTRUMENT could not judge (unwired snapshot/seam,

package/src/job.js

@@ -14,7 +14,7 @@
 // judgment call. Minting policy is product doctrine, not job-authorable.
 
 import { createHash } from 'node:crypto';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
 
 // The menus below ARE the close-authoring hierarchy (PRD §7) and ship frozen:
 // they are read at call time, so a mutable export would let adopter code
@@ -123,7 +123,12 @@ const CLOSE_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red — `verb` rides request-reds as structured data (the ledger keys on it, never on prose) */
+/** @typedef {{code: string, path: string, detail?: string, verb?: string, lib?: string}} Red — `verb` and `lib` ride request-reds as structured data (the ledger keys on them, never on prose).
+ * `lib` is the TERRITORY the demand lands against, stamped HERE at the emit site
+ * (the typed-lib rule): one code, two catalogues — a locked TOOL verb is demand
+ * against the worker-surface package, a locked VERDICT type is demand against
+ * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
+ * filed as an upstream bug (the BA-2 misattribution class). */
 
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
@@ -278,6 +283,21 @@ function validateClose(close, at, red) {
   return true;
 }
 
+/**
+ * The F49 reject's OPERATOR-side detail. ONE spelling for both regex fields —
+ * they differ only in which untimed evaluator the pattern reaches — so the two
+ * reds can never drift into saying different things about the same hazard.
+ *
+ * The second sentence is the part an operator cannot derive: on the agent side
+ * F49 is self-DoS, but these two patterns are compiled and run in BARELOOP'S OWN
+ * PROCESS, where the hang blocks the event loop the in-process stall fuse lives
+ * on (F67 — a guard sharing the fate of the process it guards). The run then
+ * dies to the outside watchdog and reads as a model stall, so without this red a
+ * bad regex in a SIGNED spec is diagnosed as a provider problem.
+ * @param {string} evaluator the consumer that would run it, named concretely
+ */
+const redosDetail = (evaluator) => `nested unbounded quantifier (e.g. (a+)+ , (\\d*)* , (x+){1,}) — a catastrophic-backtracking footgun that can hang ${evaluator}, untimed (F49). It runs in bareloop's own process, so the hang blocks the event loop the stall fuse lives on (F67) and the run dies to the outside watchdog looking like a model stall; rewrite without a repeated group inside a repeat`;
+
 /**
  * The predicate BODY contract — cmd/expect/judged/gapKeep. Shared verbatim by
  * the predicate close and the Layer 2 named checks (decision 1: a check runs
@@ -330,6 +350,13 @@ function predicateBody(o, at, red) {
         // the fake green this floor exists to catch). Alternation stays
         // fully expressible with non-capturing branches: `(?:a|b) (\d+)`.
         else if (groups > 1) red('invalid-value', `${at}.judged.pattern`, `${groups} capture groups — the count is read from group 1 only; use exactly one capture group and non-capturing (?:…) branches`);
+        // F49, operator side: `runClose` execs this against the close's whole
+        // stdout+stderr with no timeout. Gated on `groups >= 0` — that is the
+        // COMPILED flag in disguise (the catch sets -1), and the scan documents
+        // that it assumes syntactically valid input.
+        if (groups >= 0 && hasNestedQuantifier(j.pattern)) {
+          red('invalid-value', `${at}.judged.pattern`, redosDetail('the close reader (runClose)'));
+        }
       }
       if (!Number.isInteger(j.min) || j.min < 1) {
         red('invalid-value', `${at}.judged.min`, 'integer >= 1 — a floor of 0 is satisfied by judging nothing, which is the check it is meant to make');
@@ -348,8 +375,15 @@ function predicateBody(o, at, red) {
   if (o.gapKeep !== undefined) {
     if (!isNonEmptyString(o.gapKeep)) red('invalid-value', `${at}.gapKeep`, 'regex source string — lines matching it survive the gap bound (F28)');
     else {
-      try { new RegExp(o.gapKeep, 'm'); }
+      let compiled = false;
+      try { new RegExp(o.gapKeep, 'm'); compiled = true; }
       catch { red('invalid-value', `${at}.gapKeep`, 'must compile as a RegExp'); }
+      // F49, operator side and the measured one: `boundGap` runs this per LINE
+      // over the whole close stream, untimed. Measured: `(a+)+$` against a
+      // 40-char line does not finish in 20s.
+      if (compiled && hasNestedQuantifier(o.gapKeep)) {
+        red('invalid-value', `${at}.gapKeep`, redosDetail('the gap bound (boundGap), once per line of close output'));
+      }
     }
   }
 }
@@ -486,8 +520,9 @@ function validatePlanShape(spec, red, reds) {
   else if (LOCKED_VERDICTS.includes(spec.verdictType)) {
     // declared-but-locked (disclosure ≠ admission, the tool-menu pattern):
     // the type rides as a structured field — the ledger keys admission demand
-    // on it, never on prose
-    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
+    // on it, never on prose. `lib: 'bareloop'`: the refused catalogue is OURS
+    // (VERDICT_TYPES), so this demand is never an upstream ask.
+    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, lib: 'bareloop', detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
     demanded = CLASS_BY_VERDICT[spec.verdictType];
   } else if (!VERDICT_TYPES.includes(spec.verdictType)) {
     red('invalid-value', 'verdictType', `menu: ${VERDICT_TYPES.join('|')} — an unknown type is a typo, never a request`);
@@ -529,7 +564,9 @@ function validatePlanShape(spec, red, reds) {
       red('invalid-value', 'tools', `non-empty unique subset of ${TOOL_MENU.join('|')}`);
     } else {
       for (const t of spec.tools.filter((/** @type {string} */ t) => LOCKED_TOOLS.includes(t))) {
-        reds.push({ code: 'request-red', path: 'tools', verb: t, detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
+        // `lib: 'bare-agent'`: a locked TOOL verb is demand against the
+        // worker-surface package that would have to expose it (the original case)
+        reds.push({ code: 'request-red', path: 'tools', verb: t, lib: 'bare-agent', detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
       }
       const unknown = spec.tools.filter((/** @type {string} */ t) => !TOOL_MENU.includes(t) && !LOCKED_TOOLS.includes(t));
       if (unknown.length) red('invalid-value', 'tools', `unknown tool(s) ${unknown.join(', ')} — menu: ${TOOL_MENU.join('|')}`);

package/src/ledger.js

@@ -117,9 +117,15 @@ const ASKS = /** @type {Record<string, (o: {lib: string, verb: string, detail: s
   'runtime-red': (o) => `${o.lib}: \`${o.verb}\` threw at runtime — ${o.detail}`,
   'provider-red': (o) => `bare-agent: the provider path failed — ${o.detail}`,
   'pricing-red': (o) => `bare-agent: a provider result carried no priced cost (unpriced is never free, F6) — ${o.detail}`,
-  'capability-gap': (o) => `bare-agent: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
+  // same rule as request-red below (capability-gap is its cap-halted form): the
+  // ask is seeded at the STAMPED target, so a bareloop-catalogue refusal cannot
+  // render as "bare-agent: …" — fixing the occurrence's lib alone would leave the
+  // misattribution intact in the one field a human actually files from
+  'capability-gap': (o) => `${o.lib}: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
   'broken-close': (o) => `job owner: the close itself cannot run — ${o.detail}`,
-  'request-red': (o) => `admission: locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
+  // the target is the STAMPED lib, never a hardcoded package: a bareloop-catalogue
+  // refusal (a locked verdict type) must not seed an ask that reads "bare-agent: …"
+  'request-red': (o) => `${o.lib}: admission — locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
   'retention-red': (o) => `litectx: on-green retention failed — ${o.detail}`,
   'config-red': (o) => `bareloop: drafting friction at ${o.verb} — ${o.detail}`,
 });
@@ -160,9 +166,20 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
       // a repeated signature indicts the drafting prompt/schema, i.e. bareloop
       add(ev, 'config-red', 'bareloop', String(ev.path ?? 'config').split('.')[0] || 'config', `${ev.code} at ${ev.path}: ${ev.detail ?? ''}`);
     } else if (ev.type === 'job-red' && ev.code === 'request-red') {
-      // the structured field wins; the prose-quoted verb stays as the fallback
-      // for spines written before the field existed
-      add(ev, 'request-red', 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
+      // the structured fields win; the prose-quoted verb stays as the fallback
+      // for spines written before the field existed, and the hardcoded
+      // 'bare-agent' lib stays as the fallback for the same reason — it was the
+      // only territory `request-red` had when the field did not exist.
+      //
+      // One code, TWO territories: a locked TOOL verb is demand against the
+      // worker-surface package; a locked VERDICT type (and, when D13 lands, a
+      // genre refusal) is demand against bareloop's OWN catalogue and must never
+      // seed an upstream ask. The lib is stamped at the emit site (src/job.js)
+      // per the typed-lib rule — deriving it here from the code or the path is
+      // exactly the BA-2 misattribution class. A new bareloop-territory
+      // request-red therefore routes correctly by stamping its own lib, with no
+      // change to this branch.
+      add(ev, 'request-red', ev.lib ?? 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
     } else if (ev.type === 'escalation') {
       if (ev.category === 'broken-close') {
         add(ev, 'broken-close', 'consumer', 'close', ev.detail);
@@ -211,10 +228,41 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
 
   if (capHalted) {
     // capability-gap: the run hit its cap in a spine that also asked for a
-    // locked verb — the strongest admission evidence there is (design table)
-    for (const verb of new Set(occs.filter((o) => o.class === 'request-red').map((o) => o.verb))) {
-      const halt = events.find((e) => e.type === 'cap-halt');
-      add(halt, 'capability-gap', 'bare-agent', verb, `locked "${verb}" requested and the run cap-halted`);
+    // locked verb — the strongest admission evidence there is (design table).
+    // STILL DORMANT, exactly as the module header says: a request-red is a
+    // job-validation red, validateJob returns not-ok on any red and run.js
+    // returns on a validation red, so a request-red and a cap-halt cannot share
+    // one spine today. What follows is a latent-consistency fix at a documented
+    // dormant seam, not a live bug fix.
+    //
+    // The territory comes from the OCCURRENCE, never from a hardcoded package.
+    // capability-gap inherits request-red's two territories: a locked TOOL verb
+    // is demand against the worker-surface package, a locked VERDICT type is
+    // demand against bareloop's OWN catalogue. The request-red rows above
+    // already carry the lib stamped at their emit site (src/job.js), so reading
+    // it here is the typed-lib rule; re-hardcoding 'bare-agent' would seed an
+    // upstream ask for our own refusal — the BA-2 misattribution class. The
+    // sibling request-red site was fixed on this branch and this one was missed;
+    // a fix landing at one of two identical sites is the class already paid for
+    // once here (the ripgrep install that landed in ci.yml but not publish.yml).
+    //
+    // The dedup key is (verb, lib), not verb alone. The ledger's own occurrence
+    // key already carries lib, so folding on the verb would merge two
+    // territories into one row and attribute it to whichever lib the Set
+    // happened to hold first — an arbitrary target, which IS the defect. One
+    // gap per (territory, verb) costs nothing and each carries an honest one.
+    // The key is JSON, not a joined string: a delimiter that can appear in
+    // either half makes ("a-b","c") and ("a","b-c") the same key, and picking
+    // an "impossible" delimiter is a guess about names neither of these two
+    // vocabularies has promised to keep.
+    const halt = events.find((e) => e.type === 'cap-halt');
+    const seen = new Set();
+    // .filter() snapshots before add() appends, so the loop cannot feed itself
+    for (const o of occs.filter((x) => x.class === 'request-red')) {
+      const dedup = JSON.stringify([o.lib, o.verb]);
+      if (seen.has(dedup)) continue;
+      seen.add(dedup);
+      add(halt, 'capability-gap', o.lib, o.verb, `locked "${o.verb}" requested and the run cap-halted`);
     }
   }
   return occs;

package/src/plan.js

@@ -25,7 +25,7 @@
 // plain parsed data; every failure is a named {code, path, detail} red.
 
 import { TOOL_MENU, LOCKED_TOOLS, WRITE_VERBS, checkMenu } from './job.js';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
 
 /** the closed exit menu (PRD v1.12 §3 + decision 1's `check-passes`): the
  * shell evaluates every form with its own fixed code, never a command — the
@@ -102,8 +102,28 @@ const STEP_FIELDS = ['id', 'action', 'tools', 'rounds', 'target', 'exit', 'model
  * construction — the agent picks a tier, never names an arbitrary model string
  * (the tier→model mapping and any effort params are the RUNNER's, per provider).
  * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
- * never plan-selectable. */
-export const STEP_MODELS = Object.freeze(['sonnet', 'haiku']);
+ * never plan-selectable.
+ *
+ * 2026-08-06 — haiku dropped, on hamr's order: "haiku should be dropped to see if
+ * it passes, if it's agent poor work or harness, like always." This is a REVERSIBLE
+ * ATTRIBUTION PROBE, not a finding that haiku is incapable. What the $0 archive read
+ * (186 spines / 71 accepted plans / 255 steps) actually shows is a CONFOUND, in both
+ * directions: only 20 steps ever declared a tier at all — haiku 12 (9 of them on a
+ * REPLANNED plan, 6 the LAST step of their plan, bounds 3–12 rounds, 2 ever green)
+ * against explicitly-declared sonnet 8 (bounds 14–32, 5 green). The planner picks
+ * haiku for steps it judges mechanical, and replanned steps sit on runs already in
+ * trouble, so neither column is a controlled read. All three bareagent-u runs of
+ * 2026-08-06 tiered the REPLANNED step down (haiku/6, haiku/8, haiku/12) and all
+ * three failed, against sonnet initial steps at 30–40 rounds — a confound sitting
+ * on the programme's most recent capability read. Removing the tier is how it gets
+ * attributed: with only one tier expressible, a still-failing replan is agent or
+ * harness, not the tier.
+ *
+ * The `model` FIELD and its validator branch stay: a one-entry menu means a plan (or
+ * a stored bridge) declaring `model:"sonnet"` still validates, and restoring haiku is
+ * a one-token edit. This narrows only what the AGENT may express — `--model haiku`
+ * remains the OPERATOR's probe knob (PRD v1.36), untouched in the runner scripts. */
+export const STEP_MODELS = Object.freeze(['sonnet']);
 const EXIT_FIELDS = {
   'artifact-written': ['type', 'path', 'pattern'],
   'tree-changed': ['type', 'scope'],
@@ -112,103 +132,14 @@ const EXIT_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
- * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
- * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
- * outer repeat is polynomial at worst, and the body is self-authored — F49).
- * @param {string} src @param {number} i */
-function unboundedQuantLen(src, i) {
-  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
-  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
-  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
-  return len;
-}
-
-/**
- * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
- * unbounded quantifier applied to a group whose body itself repeats unboundedly
- * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
- * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
- * and is caught by propagating the inner repeat up through the wrapper. Such a
- * pattern can hang `RegExp.test` for
- * seconds on a short crafted body, and `evalExits` runs the agent-authored
- * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
- * authors both the pattern and (via the worker) the artifact, so a hang burns
- * only its own run's wall-clock; there is NO arbiter compromise (it cannot
- * escape the fence, forge a green, or leak a secret). So the reject targets the
- * dominant exponential class and fails it as a mechanical gap at the validation
- * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
- * (an external native dep we do not take for a LOW issue); exotic
- * overlapping-alternation blowup is out of scope by decision.
- *
- * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — out of scope (self-DoS only, no arbiter compromise).
- *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
- *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
- *     though a real engine runs it linearly — the scan sees the nested-quantifier
- *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
- *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
- *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
- *     Detecting "safe because anchored" needs the same real engine we declined,
- *     and guessing it wrong would ADMIT an exponential pattern — so the shape
- *     reject stands, and the over-rejection is a named, accepted limitation.
- *
- * The input is guaranteed to compile as a RegExp (checked first by the caller),
- * so this scan assumes valid, balanced JS regex syntax.
- * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
- */
-export function hasNestedQuantifier(src) {
-  /** @type {{ quant: boolean }[]} */
-  const stack = [];
-  for (let i = 0; i < src.length; i++) {
-    const c = src[i];
-    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
-    if (c === '[') {                            // character class: quantifier chars inside are literals
-      i++;
-      if (src[i] === '^') i++;
-      // NO POSIX leading-`]`-is-a-literal rule: JS is not POSIX here. `[]` is the
-      // EMPTY class (matches nothing) and `[^]` the any-char idiom — both close at
-      // that first `]`. Skipping it ran the scan past the class's real end and
-      // swallowed every quantifier after it, so `x[^](a+)+$` read as safe while
-      // RegExp.test on it does not finish in 15s on a 31-char body. A false
-      // NEGATIVE is the dangerous direction (F49), so the scan follows JS.
-      //
-      // Honest limit on the monotonicity claim: this is a PARSE correction, not
-      // the "add rejections only" tightening F49's rule contemplates, and it is
-      // not strictly rejection-monotonic. Measured over 14,862 compilable
-      // generated patterns (2,369 previously rejected): 2 rejections disappear,
-      // both pathological `[]`-bearing shapes whose old `true` came from the very
-      // misparse being fixed, and both verified to finish RegExp.test in ~0ms.
-      // Every entry of the checked-in REDOS_BAD/GOOD/OVERREJECTED corpus is
-      // unchanged. So no real hazard was un-rejected — but the claim is
-      // "measured, no hazard lost", never "monotonic by construction".
-      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
-      continue;
-    }
-    if (c === '(') { stack.push({ quant: false }); continue; }
-    if (c === ')') {
-      const g = stack.pop();
-      const qlen = unboundedQuantLen(src, i + 1);
-      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
-      // The group is an unbounded-repeated atom of its parent when it is directly
-      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
-      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
-      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
-      // enclosing group or the outer quantifier's close never sees it. Propagation
-      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
-      // can widen over-rejection — the named FAIL-SAFE direction — but can never
-      // introduce a false negative, which is the dangerous one (F49).
-      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
-      i += qlen;
-      continue;
-    }
-    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
-    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
-  }
-  return false;
-}
+/** F49's catastrophic-backtracking reject. RE-EXPORTED from validate.js, never
+ * re-declared: THREE untimed regex fields are split across the two documents —
+ * this one (`artifact-written.pattern`, agent-authored) and the operator's
+ * `judged.pattern` + `gapKeep` in job.js. plan.js imports job.js, so job.js
+ * cannot import plan.js; housing the scan in the shared primitives module is
+ * what lets both reject through ONE inventory (the SECRET_PATTERNS precedent —
+ * a second copy is a shape one side rejects and the other admits). */
+export { hasNestedQuantifier };
 
 /**
  * The close, as the ordered STAGE LIST the plan flow actually executes (PRD