bareloop 0.7.0 → 0.9.0

package/src/ledger.js

@@ -79,6 +79,14 @@ const EXCLUDED_ESCALATIONS = new Set([
   'smoke-red',          // already counted via primitive-smoke
   'hitl-close',         // by design: a human is the close
   'close-unsupported',  // honest refusal, by design
+  // Close authoring (M4, D13) — the interview refusing a job we cannot close: a
+  // genre we do not run, a job with no seed to measure against, a locked kind.
+  // Honest refusal, exactly like `close-unsupported` above, and excluded for a
+  // SECOND reason that matters more: the demand is already counted once, as the
+  // `request-red` the same refusal emits with `lib: 'bareloop'` stamped at its
+  // emit site. Counting the escalation too would double every refusal in the one
+  // number the admission path exists to measure.
+  'close-unauthorable',
   // Layer 3 (D2 split): the bridge load gate refused a wrong-KIND recipe at the door.
   // That is the mechanism WORKING — every recipe from a different day is a candidate for
   // refusal, and the run stopped having spent nothing. Filing it upstream would aim a bug
@@ -99,6 +107,11 @@ const EXCLUDED_ESCALATIONS = new Set([
   // in the registry. Both are the operator's own state speaking (a stale signature, an
   // edited registry), and both stop having run nothing.
   'resume-red',
+  // v1.57 §3 — the work branch could not be created: the patient is not a git checkout,
+  // or its branch namespace is too crowded to find a free name. The operator's own state
+  // speaking, exactly like `registry-red` below, and the run stopped having spent nothing.
+  // Filing it upstream would aim a bug report at a library for a patient nobody prepared.
+  'branch-red',
   'registry-red',       // the operator-supplied registry path does not exist — a typo, not a bug
   'envelope-red',       // the envelope does not compose with the signed spec — operator input
   // the reuse runner also STOPS on the three answers no further try could change, and
@@ -117,9 +130,15 @@ const ASKS = /** @type {Record<string, (o: {lib: string, verb: string, detail: s
   'runtime-red': (o) => `${o.lib}: \`${o.verb}\` threw at runtime — ${o.detail}`,
   'provider-red': (o) => `bare-agent: the provider path failed — ${o.detail}`,
   'pricing-red': (o) => `bare-agent: a provider result carried no priced cost (unpriced is never free, F6) — ${o.detail}`,
-  'capability-gap': (o) => `bare-agent: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
+  // same rule as request-red below (capability-gap is its cap-halted form): the
+  // ask is seeded at the STAMPED target, so a bareloop-catalogue refusal cannot
+  // render as "bare-agent: …" — fixing the occurrence's lib alone would leave the
+  // misattribution intact in the one field a human actually files from
+  'capability-gap': (o) => `${o.lib}: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
   'broken-close': (o) => `job owner: the close itself cannot run — ${o.detail}`,
-  'request-red': (o) => `admission: locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
+  // the target is the STAMPED lib, never a hardcoded package: a bareloop-catalogue
+  // refusal (a locked verdict type) must not seed an ask that reads "bare-agent: …"
+  'request-red': (o) => `${o.lib}: admission — locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
   'retention-red': (o) => `litectx: on-green retention failed — ${o.detail}`,
   'config-red': (o) => `bareloop: drafting friction at ${o.verb} — ${o.detail}`,
 });
@@ -160,9 +179,20 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
       // a repeated signature indicts the drafting prompt/schema, i.e. bareloop
       add(ev, 'config-red', 'bareloop', String(ev.path ?? 'config').split('.')[0] || 'config', `${ev.code} at ${ev.path}: ${ev.detail ?? ''}`);
     } else if (ev.type === 'job-red' && ev.code === 'request-red') {
-      // the structured field wins; the prose-quoted verb stays as the fallback
-      // for spines written before the field existed
-      add(ev, 'request-red', 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
+      // the structured fields win; the prose-quoted verb stays as the fallback
+      // for spines written before the field existed, and the hardcoded
+      // 'bare-agent' lib stays as the fallback for the same reason — it was the
+      // only territory `request-red` had when the field did not exist.
+      //
+      // One code, TWO territories: a locked TOOL verb is demand against the
+      // worker-surface package; a locked VERDICT type (and, when D13 lands, a
+      // genre refusal) is demand against bareloop's OWN catalogue and must never
+      // seed an upstream ask. The lib is stamped at the emit site (src/job.js)
+      // per the typed-lib rule — deriving it here from the code or the path is
+      // exactly the BA-2 misattribution class. A new bareloop-territory
+      // request-red therefore routes correctly by stamping its own lib, with no
+      // change to this branch.
+      add(ev, 'request-red', ev.lib ?? 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
     } else if (ev.type === 'escalation') {
       if (ev.category === 'broken-close') {
         add(ev, 'broken-close', 'consumer', 'close', ev.detail);
@@ -211,10 +241,41 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
 
   if (capHalted) {
     // capability-gap: the run hit its cap in a spine that also asked for a
-    // locked verb — the strongest admission evidence there is (design table)
-    for (const verb of new Set(occs.filter((o) => o.class === 'request-red').map((o) => o.verb))) {
-      const halt = events.find((e) => e.type === 'cap-halt');
-      add(halt, 'capability-gap', 'bare-agent', verb, `locked "${verb}" requested and the run cap-halted`);
+    // locked verb — the strongest admission evidence there is (design table).
+    // STILL DORMANT, exactly as the module header says: a request-red is a
+    // job-validation red, validateJob returns not-ok on any red and run.js
+    // returns on a validation red, so a request-red and a cap-halt cannot share
+    // one spine today. What follows is a latent-consistency fix at a documented
+    // dormant seam, not a live bug fix.
+    //
+    // The territory comes from the OCCURRENCE, never from a hardcoded package.
+    // capability-gap inherits request-red's two territories: a locked TOOL verb
+    // is demand against the worker-surface package, a locked VERDICT type is
+    // demand against bareloop's OWN catalogue. The request-red rows above
+    // already carry the lib stamped at their emit site (src/job.js), so reading
+    // it here is the typed-lib rule; re-hardcoding 'bare-agent' would seed an
+    // upstream ask for our own refusal — the BA-2 misattribution class. The
+    // sibling request-red site was fixed on this branch and this one was missed;
+    // a fix landing at one of two identical sites is the class already paid for
+    // once here (the ripgrep install that landed in ci.yml but not publish.yml).
+    //
+    // The dedup key is (verb, lib), not verb alone. The ledger's own occurrence
+    // key already carries lib, so folding on the verb would merge two
+    // territories into one row and attribute it to whichever lib the Set
+    // happened to hold first — an arbitrary target, which IS the defect. One
+    // gap per (territory, verb) costs nothing and each carries an honest one.
+    // The key is JSON, not a joined string: a delimiter that can appear in
+    // either half makes ("a-b","c") and ("a","b-c") the same key, and picking
+    // an "impossible" delimiter is a guess about names neither of these two
+    // vocabularies has promised to keep.
+    const halt = events.find((e) => e.type === 'cap-halt');
+    const seen = new Set();
+    // .filter() snapshots before add() appends, so the loop cannot feed itself
+    for (const o of occs.filter((x) => x.class === 'request-red')) {
+      const dedup = JSON.stringify([o.lib, o.verb]);
+      if (seen.has(dedup)) continue;
+      seen.add(dedup);
+      add(halt, 'capability-gap', o.lib, o.verb, `locked "${o.verb}" requested and the run cap-halted`);
     }
   }
   return occs;

package/src/plan.js

@@ -25,7 +25,8 @@
 // plain parsed data; every failure is a named {code, path, detail} red.
 
 import { TOOL_MENU, LOCKED_TOOLS, WRITE_VERBS, checkMenu } from './job.js';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { declaredStages } from './declaredclose.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
 
 /** the closed exit menu (PRD v1.12 §3 + decision 1's `check-passes`): the
  * shell evaluates every form with its own fixed code, never a command — the
@@ -102,8 +103,28 @@ const STEP_FIELDS = ['id', 'action', 'tools', 'rounds', 'target', 'exit', 'model
  * construction — the agent picks a tier, never names an arbitrary model string
  * (the tier→model mapping and any effort params are the RUNNER's, per provider).
  * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
- * never plan-selectable. */
-export const STEP_MODELS = Object.freeze(['sonnet', 'haiku']);
+ * never plan-selectable.
+ *
+ * 2026-08-06 — haiku dropped, on hamr's order: "haiku should be dropped to see if
+ * it passes, if it's agent poor work or harness, like always." This is a REVERSIBLE
+ * ATTRIBUTION PROBE, not a finding that haiku is incapable. What the $0 archive read
+ * (186 spines / 71 accepted plans / 255 steps) actually shows is a CONFOUND, in both
+ * directions: only 20 steps ever declared a tier at all — haiku 12 (9 of them on a
+ * REPLANNED plan, 6 the LAST step of their plan, bounds 3–12 rounds, 2 ever green)
+ * against explicitly-declared sonnet 8 (bounds 14–32, 5 green). The planner picks
+ * haiku for steps it judges mechanical, and replanned steps sit on runs already in
+ * trouble, so neither column is a controlled read. All three bareagent-u runs of
+ * 2026-08-06 tiered the REPLANNED step down (haiku/6, haiku/8, haiku/12) and all
+ * three failed, against sonnet initial steps at 30–40 rounds — a confound sitting
+ * on the programme's most recent capability read. Removing the tier is how it gets
+ * attributed: with only one tier expressible, a still-failing replan is agent or
+ * harness, not the tier.
+ *
+ * The `model` FIELD and its validator branch stay: a one-entry menu means a plan (or
+ * a stored bridge) declaring `model:"sonnet"` still validates, and restoring haiku is
+ * a one-token edit. This narrows only what the AGENT may express — `--model haiku`
+ * remains the OPERATOR's probe knob (PRD v1.36), untouched in the runner scripts. */
+export const STEP_MODELS = Object.freeze(['sonnet']);
 const EXIT_FIELDS = {
   'artifact-written': ['type', 'path', 'pattern'],
   'tree-changed': ['type', 'scope'],
@@ -112,103 +133,14 @@ const EXIT_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
- * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
- * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
- * outer repeat is polynomial at worst, and the body is self-authored — F49).
- * @param {string} src @param {number} i */
-function unboundedQuantLen(src, i) {
-  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
-  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
-  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
-  return len;
-}
-
-/**
- * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
- * unbounded quantifier applied to a group whose body itself repeats unboundedly
- * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
- * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
- * and is caught by propagating the inner repeat up through the wrapper. Such a
- * pattern can hang `RegExp.test` for
- * seconds on a short crafted body, and `evalExits` runs the agent-authored
- * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
- * authors both the pattern and (via the worker) the artifact, so a hang burns
- * only its own run's wall-clock; there is NO arbiter compromise (it cannot
- * escape the fence, forge a green, or leak a secret). So the reject targets the
- * dominant exponential class and fails it as a mechanical gap at the validation
- * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
- * (an external native dep we do not take for a LOW issue); exotic
- * overlapping-alternation blowup is out of scope by decision.
- *
- * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — out of scope (self-DoS only, no arbiter compromise).
- *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
- *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
- *     though a real engine runs it linearly — the scan sees the nested-quantifier
- *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
- *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
- *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
- *     Detecting "safe because anchored" needs the same real engine we declined,
- *     and guessing it wrong would ADMIT an exponential pattern — so the shape
- *     reject stands, and the over-rejection is a named, accepted limitation.
- *
- * The input is guaranteed to compile as a RegExp (checked first by the caller),
- * so this scan assumes valid, balanced JS regex syntax.
- * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
- */
-export function hasNestedQuantifier(src) {
-  /** @type {{ quant: boolean }[]} */
-  const stack = [];
-  for (let i = 0; i < src.length; i++) {
-    const c = src[i];
-    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
-    if (c === '[') {                            // character class: quantifier chars inside are literals
-      i++;
-      if (src[i] === '^') i++;
-      // NO POSIX leading-`]`-is-a-literal rule: JS is not POSIX here. `[]` is the
-      // EMPTY class (matches nothing) and `[^]` the any-char idiom — both close at
-      // that first `]`. Skipping it ran the scan past the class's real end and
-      // swallowed every quantifier after it, so `x[^](a+)+$` read as safe while
-      // RegExp.test on it does not finish in 15s on a 31-char body. A false
-      // NEGATIVE is the dangerous direction (F49), so the scan follows JS.
-      //
-      // Honest limit on the monotonicity claim: this is a PARSE correction, not
-      // the "add rejections only" tightening F49's rule contemplates, and it is
-      // not strictly rejection-monotonic. Measured over 14,862 compilable
-      // generated patterns (2,369 previously rejected): 2 rejections disappear,
-      // both pathological `[]`-bearing shapes whose old `true` came from the very
-      // misparse being fixed, and both verified to finish RegExp.test in ~0ms.
-      // Every entry of the checked-in REDOS_BAD/GOOD/OVERREJECTED corpus is
-      // unchanged. So no real hazard was un-rejected — but the claim is
-      // "measured, no hazard lost", never "monotonic by construction".
-      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
-      continue;
-    }
-    if (c === '(') { stack.push({ quant: false }); continue; }
-    if (c === ')') {
-      const g = stack.pop();
-      const qlen = unboundedQuantLen(src, i + 1);
-      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
-      // The group is an unbounded-repeated atom of its parent when it is directly
-      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
-      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
-      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
-      // enclosing group or the outer quantifier's close never sees it. Propagation
-      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
-      // can widen over-rejection — the named FAIL-SAFE direction — but can never
-      // introduce a false negative, which is the dangerous one (F49).
-      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
-      i += qlen;
-      continue;
-    }
-    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
-    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
-  }
-  return false;
-}
+/** F49's catastrophic-backtracking reject. RE-EXPORTED from validate.js, never
+ * re-declared: THREE untimed regex fields are split across the two documents —
+ * this one (`artifact-written.pattern`, agent-authored) and the operator's
+ * `judged.pattern` + `gapKeep` in job.js. plan.js imports job.js, so job.js
+ * cannot import plan.js; housing the scan in the shared primitives module is
+ * what lets both reject through ONE inventory (the SECRET_PATTERNS precedent —
+ * a second copy is a shape one side rejects and the other admits). */
+export { hasNestedQuantifier };
 
 /**
  * The close, as the ordered STAGE LIST the plan flow actually executes (PRD
@@ -239,6 +171,30 @@ export function stageClose(close) {
   return [{ name: 'close', cmd: close.cmd, expect: close.expect, judged: close.judged, gapKeep: close.gapKeep }];
 }
 
+/**
+ * THE ONE STAGING, one level up: a job's close stages, from EITHER of the two
+ * fields a spec may carry.
+ *
+ * `stageClose` reads a command close; `declaredStages` reads an authored
+ * declaration (M4). A spec declares exactly one of them — the job validator reds
+ * `close-duplicated` on both — so this is a selection, never a merge.
+ *
+ * Every consumer calls THIS rather than `stageClose` directly, for the reason
+ * W4 wrote `stageClose` in the first place: the drafting prompt, the plan
+ * validator, the runner, the bridge registry and the reuse envelope must all see
+ * the same stage list, and a consumer that reads only `close` sees a declared
+ * job as having no close at all — an empty check menu offered to a drafter whose
+ * plan the validator would then red for referencing a stage nobody offered.
+ * @param {any} job the job spec, any shape
+ * @returns {any[]|null} the stage list, or null when the job names no close
+ */
+export function closeStagesOf(job) {
+  if (!isObj(job)) return null;
+  const declared = declaredStages(job.closeDecl);
+  if (declared) return declared;
+  return stageClose(job.close);
+}
+
 /** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red */
 
 /**
@@ -304,7 +260,7 @@ export function validatePlan(input, { job, maxStepRounds = 40, scopes, seedRed,
   // (gold/rubric/hitl) stages nothing, so it offers nothing — the runner
   // escalates `close-unsupported` on the same null, and an empty menu is already
   // the honest reading here (every check-passes becomes a check-unknown).
-  const checkNames = checkMenu(stageClose(spec.close) ?? []).map((m) => m.name);
+  const checkNames = checkMenu(closeStagesOf(spec) ?? []).map((m) => m.name);
   // The offered scope menu. A caller-supplied menu must be the same one the
   // prompt enumerated; with none, derive from the signed fence — fail-CLOSED,
   // so omitting the option narrows the agent's choices and never widens them.