bareloop 0.7.0 → 0.9.0

package/src/job.js

@@ -14,7 +14,8 @@
 // judgment call. Minting policy is product doctrine, not job-authorable.
 
 import { createHash } from 'node:crypto';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
+import { validateCloseDecl, DECLARED_CLOSE_CLASSES } from './declaredclose.js';
 
 // The menus below ARE the close-authoring hierarchy (PRD §7) and ship frozen:
 // they are read at call time, so a mutable export would let adopter code
@@ -25,7 +26,20 @@ export const CLOSE_TYPES = Object.freeze(['predicate', 'gold', 'rubric', 'hitl']
  * type cannot legally claim (green-on-rubric is laundering). The `CLASSES`
  * vocabulary export went with steps[] (PRD v1.32): a class was a STEP field, and
  * nothing declares one now. */
-export const CLASS_BY_CLOSE = Object.freeze({ predicate: Object.freeze(['hard']), gold: Object.freeze(['hard']), rubric: Object.freeze(['soft']), hitl: Object.freeze(['hitl']) });
+export const CLASS_BY_CLOSE = Object.freeze({
+  predicate: Object.freeze(['hard']),
+  gold: Object.freeze(['hard']),
+  rubric: Object.freeze(['soft']),
+  hitl: Object.freeze(['hitl']),
+  // The AUTHORED close (M4, `closeDecl`) is not a `close.type` — it is the other
+  // field a plan-shape spec may carry — but it claims a verdict class exactly
+  // like one, so it belongs in the SAME table rather than in a second constant
+  // beside it. Hard by construction: every live kind is a mechanical command
+  // whose measurement is the truth, and the two judgment kinds are locked out at
+  // the catalogue and absent from the executor. The suite pins the key set
+  // against CLOSE_TYPES so the two can never drift apart silently.
+  declared: DECLARED_CLOSE_CLASSES,
+});
 export const GOLD_COMPARE = Object.freeze(['exact', 'json-equal']);
 /** the tool grant menu (2b interview #1): read/grep/write, plus the two litectx
  * RETRIEVAL verbs (F19) — `run` stays locked-but-listed; a spec requesting it
@@ -108,11 +122,11 @@ export const CONDITION_KEYS = Object.freeze(['providerPath', 'closeVerbosity', '
 // `steps` stays in the field list ONLY so a retired spec reds by name
 // (`shape-retired`) instead of falling through to a generic unknown-field —
 // the operator gets told what happened, not just that something is wrong.
-const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'checks', 'tools'];
+const JOB_FIELDS = ['schema', 'job', 'description', 'provider', 'conditions', 'cadence', 'budgetUsd', 'maxWallMs', 'writeScope', 'steps', 'escalation', 'goal', 'verdictType', 'close', 'closeDecl', 'checks', 'tools'];
 /** the four-field plan shape's core (decision 5) — presence of any of these
  * declares the shape; `tools` (the ceiling) rides the shape but alone does not
  * declare it, so a legacy spec carrying it gets a pointed red, not a conflict */
-const PLAN_CORE_FIELDS = ['goal', 'verdictType', 'close', 'checks'];
+const PLAN_CORE_FIELDS = ['goal', 'verdictType', 'close', 'closeDecl', 'checks'];
 /** exact field set per close type — anything else is an unknown-field red
  * (freeform code, script bodies, and minting claims all land there) */
 const CLOSE_FIELDS = {
@@ -123,7 +137,12 @@ const CLOSE_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red — `verb` rides request-reds as structured data (the ledger keys on it, never on prose) */
+/** @typedef {{code: string, path: string, detail?: string, verb?: string, lib?: string}} Red — `verb` and `lib` ride request-reds as structured data (the ledger keys on them, never on prose).
+ * `lib` is the TERRITORY the demand lands against, stamped HERE at the emit site
+ * (the typed-lib rule): one code, two catalogues — a locked TOOL verb is demand
+ * against the worker-surface package, a locked VERDICT type is demand against
+ * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
+ * filed as an upstream bug (the BA-2 misattribution class). */
 
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
@@ -278,6 +297,21 @@ function validateClose(close, at, red) {
   return true;
 }
 
+/**
+ * The F49 reject's OPERATOR-side detail. ONE spelling for both regex fields —
+ * they differ only in which untimed evaluator the pattern reaches — so the two
+ * reds can never drift into saying different things about the same hazard.
+ *
+ * The second sentence is the part an operator cannot derive: on the agent side
+ * F49 is self-DoS, but these two patterns are compiled and run in BARELOOP'S OWN
+ * PROCESS, where the hang blocks the event loop the in-process stall fuse lives
+ * on (F67 — a guard sharing the fate of the process it guards). The run then
+ * dies to the outside watchdog and reads as a model stall, so without this red a
+ * bad regex in a SIGNED spec is diagnosed as a provider problem.
+ * @param {string} evaluator the consumer that would run it, named concretely
+ */
+const redosDetail = (evaluator) => `nested unbounded quantifier (e.g. (a+)+ , (\\d*)* , (x+){1,}) — a catastrophic-backtracking footgun that can hang ${evaluator}, untimed (F49). It runs in bareloop's own process, so the hang blocks the event loop the stall fuse lives on (F67) and the run dies to the outside watchdog looking like a model stall; rewrite without a repeated group inside a repeat`;
+
 /**
  * The predicate BODY contract — cmd/expect/judged/gapKeep. Shared verbatim by
  * the predicate close and the Layer 2 named checks (decision 1: a check runs
@@ -330,6 +364,13 @@ function predicateBody(o, at, red) {
         // the fake green this floor exists to catch). Alternation stays
         // fully expressible with non-capturing branches: `(?:a|b) (\d+)`.
         else if (groups > 1) red('invalid-value', `${at}.judged.pattern`, `${groups} capture groups — the count is read from group 1 only; use exactly one capture group and non-capturing (?:…) branches`);
+        // F49, operator side: `runClose` execs this against the close's whole
+        // stdout+stderr with no timeout. Gated on `groups >= 0` — that is the
+        // COMPILED flag in disguise (the catch sets -1), and the scan documents
+        // that it assumes syntactically valid input.
+        if (groups >= 0 && hasNestedQuantifier(j.pattern)) {
+          red('invalid-value', `${at}.judged.pattern`, redosDetail('the close reader (runClose)'));
+        }
       }
       if (!Number.isInteger(j.min) || j.min < 1) {
         red('invalid-value', `${at}.judged.min`, 'integer >= 1 — a floor of 0 is satisfied by judging nothing, which is the check it is meant to make');
@@ -348,8 +389,15 @@ function predicateBody(o, at, red) {
   if (o.gapKeep !== undefined) {
     if (!isNonEmptyString(o.gapKeep)) red('invalid-value', `${at}.gapKeep`, 'regex source string — lines matching it survive the gap bound (F28)');
     else {
-      try { new RegExp(o.gapKeep, 'm'); }
+      let compiled = false;
+      try { new RegExp(o.gapKeep, 'm'); compiled = true; }
       catch { red('invalid-value', `${at}.gapKeep`, 'must compile as a RegExp'); }
+      // F49, operator side and the measured one: `boundGap` runs this per LINE
+      // over the whole close stream, untimed. Measured: `(a+)+$` against a
+      // 40-char line does not finish in 20s.
+      if (compiled && hasNestedQuantifier(o.gapKeep)) {
+        red('invalid-value', `${at}.gapKeep`, redosDetail('the gap bound (boundGap), once per line of close output'));
+      }
     }
   }
 }
@@ -486,8 +534,9 @@ function validatePlanShape(spec, red, reds) {
   else if (LOCKED_VERDICTS.includes(spec.verdictType)) {
     // declared-but-locked (disclosure ≠ admission, the tool-menu pattern):
     // the type rides as a structured field — the ledger keys admission demand
-    // on it, never on prose
-    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
+    // on it, never on prose. `lib: 'bareloop'`: the refused catalogue is OURS
+    // (VERDICT_TYPES), so this demand is never an upstream ask.
+    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, lib: 'bareloop', detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
     demanded = CLASS_BY_VERDICT[spec.verdictType];
   } else if (!VERDICT_TYPES.includes(spec.verdictType)) {
     red('invalid-value', 'verdictType', `menu: ${VERDICT_TYPES.join('|')} — an unknown type is a typo, never a request`);
@@ -495,7 +544,37 @@ function validatePlanShape(spec, red, reds) {
     demanded = CLASS_BY_VERDICT[spec.verdictType];
   }
 
-  if (spec.close === undefined) red('missing-required', 'close', 'declared green with nothing to run it — preflight validates the declaration, never infers');
+  // THE TWO CLOSE FIELDS, and they are ALTERNATIVES (M4). `close` is the
+  // operator's own command stages; `closeDecl` is the AUTHORED declaration over
+  // owned kinds — the whole point of the close-authoring rung, and the field a
+  // user who is not an engineer ends up with. Both at once is refused rather
+  // than merged or precedence-ordered: a spec carrying two closes has two
+  // arbiters, and picking one silently is how the signed artefact stops meaning
+  // what the signer read.
+  if (spec.close !== undefined && spec.closeDecl !== undefined) {
+    red('close-duplicated', 'closeDecl', 'a job declares EITHER a command close (close) OR an authored declaration '
+      + '(closeDecl) — never both. Two closes are two arbiters, and the close is the only truth');
+  } else if (spec.closeDecl !== undefined) {
+    // The DECLARED close. The tree-grounded half of the gate (hamr's listing
+    // rule, and the scoped-job derivation that arms the F84 one-population law)
+    // is DEFERRED here and re-run by the runner against the real seed before any
+    // stage executes — a job spec is validated with no repository in hand, and a
+    // validator that quietly skipped those two rules would report a declaration
+    // it never examined. `grounded: false` is what the runner keys on.
+    // the class rides along: the mandatory guard battery keys off the verdict
+    // class the user picked (PRD v1.57 §2), so the gate cannot check D5 without
+    // it. An unknown or locked class is refused there, on its own axis, beside
+    // the counted `request-red` above.
+    const cd = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', deferListing: true, verdictType: spec.verdictType });
+    for (const r of cd.reds) reds.push(r);
+    if (demanded !== undefined && !CLASS_BY_CLOSE.declared.includes(demanded)) {
+      // the same laundering guard as the close-type hierarchy, one level up: a
+      // declared close is HARD, so a soft/hitl verdict can never ride one
+      red('close-hierarchy', 'verdictType', `verdictType ${spec.verdictType} demands a ${demanded}-class close; an `
+        + `authored declaration admits ${CLASS_BY_CLOSE.declared.join('|')} only — every live kind is a mechanical `
+        + 'measurement, and the two judgment kinds are locked out of the catalogue (PRD §7)');
+    }
+  } else if (spec.close === undefined) red('missing-required', 'close', 'declared green with nothing to run it — preflight validates the declaration, never infers');
   // The staged close (PRD v1.28): an ordered list of named command stages, from
   // which the check menu derives. The object form remains ONLY for the
   // declared-but-locked verdict classes (gold/rubric/hitl), which name no
@@ -529,7 +608,9 @@ function validatePlanShape(spec, red, reds) {
       red('invalid-value', 'tools', `non-empty unique subset of ${TOOL_MENU.join('|')}`);
     } else {
       for (const t of spec.tools.filter((/** @type {string} */ t) => LOCKED_TOOLS.includes(t))) {
-        reds.push({ code: 'request-red', path: 'tools', verb: t, detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
+        // `lib: 'bare-agent'`: a locked TOOL verb is demand against the
+        // worker-surface package that would have to expose it (the original case)
+        reds.push({ code: 'request-red', path: 'tools', verb: t, lib: 'bare-agent', detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
       }
       const unknown = spec.tools.filter((/** @type {string} */ t) => !TOOL_MENU.includes(t) && !LOCKED_TOOLS.includes(t));
       if (unknown.length) red('invalid-value', 'tools', `unknown tool(s) ${unknown.join(', ')} — menu: ${TOOL_MENU.join('|')}`);