looply-cli 0.0.0-stage → 0.2.0

package/dist/completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../src/completion.ts"],"names":[],"mappings":";;AAoFA,sCAuEC;AAoBD,0CAyBC;AAxMD,6CAAsD;AACtD,+CAAmD;AACnD,+DAA8E;AAC9E,+CAA+C;AAyE/C,gGAAgG;AAChG,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAAuC,EACvC,MAA0B,EAC1B,QAA+B;AAC/B,qGAAqG;AACrG,SAA4B,EAAE;IAE9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC;IACxE,IAAI,SAAS,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM;YACN,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;YAC3B,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;YACnF,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnI,GAAG,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;YACzF,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD;;;;;;;;;;;;;;;OAeG;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9H,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC;QACvE,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;gBACxB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1H,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC1D;;;;;;;;OAQG;IACH,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAI,IAAkB;IACnC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAChI,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAC7B,GAAW;AACX,gGAAgG;AAChG,OAAuC,EAAE;IAEzC,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAc,EAAe,EAAE,CAC3C,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,kCAAY,EAAC,GAAG,CAAC,CAAC;YACnC,8FAA8F;YAC9F,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC7F,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,gCAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,gCAAkB,EAAE,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC;YACtH,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,549 @@
+import { type RequiredProfile } from '@looply/core';
+import { type AgentSpec } from './agent-exec';
+import type { StepSpec } from './gate';
+/**
+ * `.looply/config.yaml` — the one file a user edits by hand.
+ *
+ * Validation is strict and happens at load, not at hour three of a run. Every
+ * message names the exact key, because a config error found at round 1 of an
+ * overnight run has already cost the night.
+ */
+export interface LooplyConfig {
+    project: {
+        name: string;
+        id?: string;
+    };
+    run: {
+        minHours: number;
+        maxRounds: number;
+        cooldownS: number;
+        /**
+         * Directories to copy from this project into any checkout the product makes
+         * for itself — a second worker's workspace, and the throwaway tree a
+         * candidate is checked in.
+         *
+         * Both are `git worktree add`, so both hold exactly what git tracks, and
+         * `node_modules` is gitignored everywhere. The contained gate has no network
+         * by design, so it cannot install them either: the gate could not pass for any
+         * project with a dependency, in a checkout the product made in order to gate it.
+         *
+         * EMPTY BY DEFAULT, and absent means absent — every existing project behaves
+         * exactly as it did. Named rather than guessed: a product that silently copies
+         * directories nobody asked for is one nobody can predict. See `checkout-carry`.
+         * ⚠️ OPTIONAL, like every other key added to `run` since the first three.
+         * A fixture that names only `min_hours`/`max_rounds`/`cooldown_s` must keep
+         * compiling; making this required broke 7 suites at ts-jest time while
+         * `npm run typecheck` stayed green, because that script does not read specs.
+         */
+        carryIntoCheckouts?: readonly string[];
+        /**
+         * Record one loop-safety observation per ROUND rather than per RUN.
+         *
+         * 🔴 OFF BY DEFAULT, AND THAT IS A COMPATIBILITY DECISION. The thresholds
+         * in `core/loop-safety.ts` were written for a per-round denominator —
+         * `MAX_SAME_FAILURE_REPEATS = 3` is stated there as sitting "exactly on
+         * MAX_ITEM_EXECUTION_ATTEMPTS" — and the producer has always recorded once
+         * per run, which made that claim false by a factor of the round count.
+         * Turning this on makes the comment true. Turning it on SILENTLY would
+         * retune the brake for every existing single-goal user, who asked for none
+         * of it.
+         *
+         * Optional on the TYPE so a config object built before this existed still
+         * means false. `parseConfig` always sets it.
+         */
+        perRoundSafety?: boolean;
+        /**
+         * Whether declared resource surfaces are acquired and enforced.
+         *
+         * 🔴 OFF BY DEFAULT, AND THE EXIT CRITERION IS THAT TURNING IT OFF CHANGES
+         * NOTHING. Surfaces are additive: a Run declaring none behaves exactly as
+         * it did before they existed, and with this false no lease is taken, no
+         * fence is minted and no write is ever compared against a declaration.
+         */
+        surfaces?: boolean;
+        /**
+         * Whether run branches converge on `looply/integration`.
+         *
+         * 🔴 OFF BY DEFAULT, AND THE GATE IS NOT TIMIDITY. With it off there is no
+         * `looply/integration` ref to cut from, and changing where a Mode 1 run's
+         * branch starts is a behaviour change to the simplest path in the product —
+         * a FIX for the ever-deepening chain, but one that moves what `git log`
+         * shows a person who has never asked for a second workspace. The stacking
+         * fix arrives with the thing that makes it necessary.
+         */
+        integration?: boolean;
+        /**
+         * Whether a reasoning provider may PROPOSE.
+         *
+         * 🔴 OFF BY DEFAULT, AND THE DISABLING TEST IS THE PHASE'S WHOLE POINT.
+         * With this false the coordinator is called with an EMPTY proposal array,
+         * no L0–L3 file imports the brain, and every earlier phase's behaviour is
+         * exactly what it was. A brain that cost something to disable would not be
+         * optional; it would be load-bearing wearing a flag.
+         *
+         * ⚠️ AND `advisory` IS THE ONLY AUTONOMY THIS SHIPS. A proposal is
+         * recorded; nothing acts on one. `approval` and `auto` are named in the
+         * plan and are not built, because a proposal channel with no measured
+         * refusal rate is not a channel anybody should be able to arm.
+         */
+        brain?: boolean;
+        /**
+         * How many executions of THIS PROJECT may run at once, across every
+         * workspace.
+         *
+         * Optional on the TYPE so that a config object built before this existed —
+         * every test fixture, and any caller outside `parseConfig` — still means one.
+         * `parseConfig` always sets it.
+         *
+         * ⚠️ DEFAULT 1, which is exactly today's behaviour: one lease, one checkout,
+         * one run. Nothing about Simple Mode changes unless a person raises it.
+         *
+         * ⚠️ DELIBERATELY NOT `machine.maxConcurrentAgents` OR
+         * `machine.maxConcurrentGates`. Those count agent processes and gate
+         * processes, not executions; adopting either would retroactively activate a
+         * number somebody saved when it meant nothing, and would silently cap this
+         * at 2 or at 1.
+         *
+         * 🔴 THE DECISION IS NOW MADE, AND IT IS DEPRECATE. Both keys stay
+         * PARSEABLE for ever — a config carrying them loads without complaint —
+         * and neither is ever read. The rule that settles it is the one already
+         * stated above: new behaviour gets a new key. Somebody who wrote
+         * `max_concurrent_agents: 8` wrote it about agent processes on a machine
+         * with no coordinator, and turning that into a fleet size today would be
+         * looply deciding something they did not.
+         *
+         * ⚠️ AND `account.keeper` IS NOT THE COORDINATOR. Same rule, and it is
+         * worth saying because the name invites the mistake.
+         */
+        maxConcurrentRuns?: number;
+    };
+    /**
+     * THE COORDINATOR'S CEILINGS, AND WHY THEY ARE NEW NAMES.
+     *
+     * ⚠️ NOT `machine.max_concurrent_agents` OR `machine.max_concurrent_gates`.
+     * Phase 0 marked both `unsupported` precisely so nobody's saved number would
+     * be adopted by a later phase that gave it a meaning it never had. Adopting
+     * them here would retroactively activate a value somebody wrote when it did
+     * nothing — and would silently cap a project at whatever they happened to
+     * type. New behaviour gets a new key; that is the whole rule.
+     *
+     * ⚠️ AND BOTH DEFAULT TO 1, so a machine that has never heard of a
+     * coordinator behaves exactly as it does today: one checkout, one agent.
+     */
+    /**
+     * ⚠️ OPTIONAL ON THE TYPE, following `run.maxConcurrentRuns` exactly. A config
+     * object built before this existed — every test fixture, and any caller
+     * outside `parseConfig` — still means one of each. `parseConfig` always sets
+     * it, so the only readers that see `undefined` are ones that never asked for
+     * a coordinator.
+     */
+    machine?: {
+        /** How many checkouts this machine may hold at once. */
+        maxWorkspaces: number;
+        /** How many agent processes may be in flight at once. */
+        maxAgentsInFlight: number;
+        /**
+         * Let the scheduler choose which goal gets the daemon's turn.
+         *
+         * 🔴 OFF BY DEFAULT, AND THAT IS NOT TIMIDITY. With it off the daemon does
+         * exactly what it did before — oldest grant first, rotated for fairness —
+         * so no existing project's overnight behaviour changes because it upgraded.
+         *
+         * ⚠️ AND IT ORDERS; IT DOES NOT PARALLELISE. The tick still performs AT
+         * MOST ONE transition per cadence. What changes is which controller is
+         * asked first: dependency order, holds, cycles and the anti-starvation age
+         * boost instead of arrival time. "DO NOT make parallel execution
+         * mandatory" is the owner's line and this respects it — turning several
+         * runs loose at once is a separate decision, taken with `max_workspaces`.
+         */
+        coordinator: boolean;
+        /**
+         * Let the daemon MAKE a checkout when the scheduler has room under
+         * `max_workspaces` and no checkout is idle (M4-1).
+         *
+         * 🔴 OFF BY DEFAULT. Off, the scheduler waits exactly as it always has and
+         * a person makes checkouts with `looply run --new-workspace`. On, at most
+         * ONE checkout is made per cadence, with the same code a person's uses,
+         * counted against the ceiling; nothing is reaped or deleted by it.
+         */
+        provisionWorkspaces?: boolean;
+        /**
+         * Let the daemon ask a MACHINE-started run to stop at its round boundary
+         * so a higher-priority goal can have its checkout (M4-2).
+         *
+         * 🔴 OFF BY DEFAULT. Off, a `preempt` decision stays a line in
+         * `schedule.jsonl` that nothing acts on, as it always was. On, at most ONE
+         * run is asked per cadence, with the run's own graceful `stop` request —
+         * the one `looply stop` writes — never a kill; a run a person started is
+         * never asked.
+         */
+        preemption?: boolean;
+        /**
+         * Let the daemon retire a checkout IT MADE — idle for `idle_checkout_minutes`,
+         * referenced by no run, with no uncommitted work — through the manual
+         * command's own reaping (M4-4).
+         *
+         * 🔴 OFF BY DEFAULT. Off, nothing is inspected or removed. On, at most ONE
+         * per cadence; a checkout a person cut is never touched; anything with
+         * residue is kept with the reason.
+         */
+        reapProvisioned?: boolean;
+        /** How long a checkout the machine made must sit idle before it may be retired. Default 60. */
+        idleCheckoutMinutes?: number;
+        /**
+         * Let the daemon offer a finished run's branch to the integration lane —
+         * `looply/run-*` branches ahead of `looply/integration`, not a live run's,
+         * not already attempted at their tip — one per cadence, through the very
+         * `integrationTick` the `looply integrate` command calls (M5-1).
+         *
+         * 🔴 OFF BY DEFAULT, and meaningful only with `run.integration` on (the
+         * lane's own gate). Off, nothing is listed or offered.
+         */
+        integrate?: boolean;
+        /**
+         * PROGRAMME MODE, slice 1 (M6-7). 🔴 OFF BY DEFAULT — manual defaults intact.
+         *
+         * On, a VALID decision lets the machine continue without another tap: an
+         * `approved` approval no longer holds the grant; the controller buys the
+         * next Start itself and that Start carries the approval, reserved once
+         * through the same seam a person's Start uses. Nothing else widens: a
+         * request, a denial, a revocation and an expiry still hold; a person's
+         * stop or pause still wins; the server's ending wins over everything.
+         */
+        programme?: boolean;
+        /**
+         * PROGRAMME MODE, slice 2 (M6-10): THE UMBRELLA. Present only when
+         * `machine.programme` is a block with `on: true`. Its limits are the
+         * owner's declared ceilings, and the parser has already done two things
+         * with them: landed each on the knob it feeds (`max_workspaces`,
+         * `max_agents_in_flight`, the envelope's window; the Start ceiling per
+         * grant is read by the daemon), and turned every face of the programme on
+         * — the coordinator, provisioning, reaping, preemption, the integration
+         * lane, the brain, the continuation — except a face this config turned
+         * off explicitly. `integrationRef` is declared and checked against the
+         * lane's ref; the lane takes no other yet. A bare `programme: true` is
+         * slice 1 alone (continuation), and a config without the block is byte-
+         * identical to before.
+         */
+        programmeMode?: ProgrammeMode;
+        /**
+         * WHAT THIS MACHINE MAY SPEND WITHOUT ASKING AGAIN.
+         *
+         * 🔴 NOTHING COULD CONSTRUCT AN `Envelope` BEFORE THIS. `withinEnvelope`
+         * shipped fully specced with no production caller and no config key that
+         * could produce its input — a whole phase whose only reachable artefact was
+         * a docblock saying that a budget over numbers nobody counts is theatre.
+         *
+         * ⚠️ ABSENT MEANS NO CEILING, WHICH IS WHAT EVERY EXISTING PROJECT HAS. A
+         * machine with no envelope is bounded exactly as it was before: by hours,
+         * rounds and the queue. Writing one is opting IN to being stopped.
+         *
+         * ⚠️ AND IT BOUNDS EVERY RUN, NOT ONLY THE AUTONOMOUS ONES — this paragraph
+         * used to say the opposite, and was wrong.
+         *
+         * The gate is `runLoop`'s, which is the one thing a person's `looply run`,
+         * a Start the daemon spawned, a coordinator-placed goal and anything
+         * Autopilot decides all ARE. A ceiling that bound only the autonomous path
+         * would be one somebody could step over by typing the command themselves,
+         * which is not a ceiling.
+         *
+         * Simple Mode is protected by the ENVELOPE BEING ABSENT rather than by the
+         * gate being partial: a project that never wrote one is bounded exactly as
+         * it always was.
+         */
+        envelope?: {
+            readonly maxConcurrentRuns: number;
+            readonly maxStartsPerWindow: number;
+            readonly windowMs: number;
+            readonly maxWallClockMs: number;
+            /** Dollars. Absent means no money ceiling — see `Envelope.maxUsd`. */
+            readonly maxUsd?: number;
+            /**
+             * WHAT ONE START IS EXPECTED TO COST, WHEN A DOLLAR CEILING IS SET.
+             *
+             * 🔴 REQUIRED WITH `max_usd`, AND THAT COUPLING IS THE HONEST ONE.
+             * Admission has to bound what is ABOUT to be spent, and nothing on this
+             * machine can know what a Run will cost before it runs. Without a number
+             * the admission check reads its own reservation as unmeasurable and
+             * refuses EVERY start — correct, and useless. The person who wrote a
+             * dollar ceiling is the one who can say what they think a run costs.
+             *
+             * ⚠️ IT IS AN ESTIMATE AND IS NOT PRETENDED OTHERWISE. What it buys is
+             * that concurrent starts see each other's intent instead of each reading
+             * a machine that has spent nothing yet. What a run ACTUALLY costs is
+             * recorded by the transport as it goes, and that is what the ceiling
+             * compares against once the hold expires.
+             */
+            readonly estimateUsdPerStart?: number;
+        };
+    };
+    gates: StepSpec[];
+    rails: {
+        forbiddenPaths: string[];
+        prodPatterns: string[];
+        prodEnvFiles: string[];
+        exemptions: 'ask' | 'never';
+    };
+    /**
+     * Where a round may write.
+     *
+     * 🔴 `declared` IS NOT COSMETIC. It separates a project that never named a
+     * scope — which keeps its documented no-constraint behaviour, and is every
+     * config written before the scope interlock existed — from one that wrote
+     * `scope:` and listed nothing, which is an explicit grant of nothing and
+     * denies every path. Collapsing the two would make the most cautious-looking
+     * config the most permissive one. `scope-rule.ts` holds the semantics.
+     */
+    scope: {
+        free: string[];
+        additive: string[];
+        declared: boolean;
+    };
+    queue: {
+        topupThreshold: number;
+        topupSize: number;
+        maxSameShape: number;
+    };
+    proof: {
+        enabled: boolean;
+        onPartial: 'ask' | 'keep' | 'discard';
+        askWindowMin: number;
+    };
+    notify: {
+        channel: string;
+        everyMin: number;
+        to?: string;
+    };
+    /**
+     * WHETHER ANYTHING MAY LEAVE THIS MACHINE.
+     *
+     * The setup wizard has asked this since it was written, and wrote the answer
+     * into `publish.policy` — and until now NOTHING PARSED IT. The promise on the
+     * screen, "nothing leaves your machine unless you say so", was true only
+     * because Looply had no way to publish at all. It is a policy now rather than
+     * an accident.
+     *
+     * `never`  — Looply may not publish. The default, and the answer to every
+     *            question this file cannot answer.
+     * `manual` — a person publishes, by hand, as usual. For LOOPLY this is
+     *            identical to `never`; the two differ in what a PERSON does, not
+     *            in what this program may do, and `mayPublish` collapses them
+     *            rather than carrying a distinction the code does not have.
+     * `on-approval` — an exact action, approved by a person, may be carried out
+     *            through the governed broker. Nothing weaker.
+     */
+    publish: {
+        policy: PublishPolicy;
+    };
+    /**
+     * Architectural decisions a PERSON has made about this project.
+     *
+     * 🔴 THIS FILE IS THE HUMAN CHANNEL, AND THAT IS AN EXISTING BOUNDARY RATHER
+     * THAN A NEW CLAIM. `.looply/config.yaml` is in `protectedPaths()` beside
+     * `.git` and `.looply/state`: the container the model runs in has that path
+     * taken back, and "if a protected path cannot be protected, nothing is
+     * launched". So a model cannot author a decision here — not by policy, by
+     * construction.
+     *
+     * It is also the only tracked file under `.looply`, so a decision arrives
+     * through a diff somebody can review, which is what a decision should do.
+     *
+     * Phase 11 turns these into memory of kind `decision`, which no model may
+     * assert and no inference may supersede.
+     */
+    decisions: {
+        subject: string;
+        decision: string;
+    }[];
+    server?: {
+        url: string;
+        machineTokenFile?: string;
+    };
+    /**
+     * D7 — the other repositories this programme spans, declared by identity.
+     *
+     * 🔴 AN IDENTITY, NOT A PATH. `id` is what a compatible-revision set names and
+     * what survives somebody moving the checkout; `path` is only where it happens
+     * to be on this machine today. A set that named paths would stop meaning
+     * anything the moment two people had different layouts.
+     *
+     * ⚠️ ABSENT MEANS SINGLE-REPOSITORY, which is every project that exists today,
+     * and nothing about them changes. The charter is explicit that cross-repo work
+     * "must not delay" the single-repository demonstration.
+     *
+     * ⚠️ LOCAL PATHS ONLY, and no publication is implied. The charter allows two
+     * DISPOSABLE LOCAL repositories for validation and forbids remote or
+     * production publication outright.
+     */
+    repos?: {
+        id: string;
+        path: string;
+    }[];
+    /**
+     * F-14 — the terms a session must meet before this machine will manage it.
+     *
+     * 🔴 EVERY KEY IS OPTIONAL AND ABSENCE IS NEVER PERMISSIVE. A missing
+     * `scope` or `budget_owner` makes the corresponding measurement
+     * UNMEASURABLE, not `allowed` — `session-adoption.ts` then answers
+     * `unmeasurable` and manages nothing. A project that says nothing here
+     * adopts nothing, which is every project that exists today.
+     *
+     * ⚠️ `repo` IS THE IDENTITY A SESSION MUST CLAIM, not a path. A session
+     * asserting some other repository is refused outright.
+     */
+    sessions?: {
+        repo?: string;
+        scope?: string[];
+        budgetOwner?: string;
+    };
+    /**
+     * D7 — what this project cannot start until another repository has PUBLISHED.
+     *
+     * 🔴 NAMED `cross_repo_needs`, NOT `needs`. A bare `needs:` would be claimed
+     * by the first person who wants item-level or goal-level prerequisites, and
+     * two different relations under one key is how a caller ends up checking the
+     * wrong graph — the same reason `item-depends.ts` is named apart from
+     * `goal-links.ts`.
+     *
+     * ⚠️ THIS IS PROJECT-LEVEL. It answers "may this project start work at all",
+     * not "may this item". Item-level cross-repo needs are UNFINISHED and
+     * recorded as such; a project-level need is the coarse form and is honest
+     * about being coarse.
+     *
+     * ⚠️ ABSENT MEANS NOTHING IS WAITED FOR, which is every project today.
+     */
+    crossRepoNeeds?: {
+        repo: string;
+        what: string;
+    }[];
+    /**
+     * How to start the coding agent. The prompt is not part of this: it goes to
+     * the agent's stdin (agent-exec.ts), so the line here is flags only and can
+     * be swapped for another agent without touching any prompt builder.
+     */
+    agent: AgentSpec;
+    /**
+     * A named provider preset, or absent to use `agent.command` as written.
+     *
+     * 🔴 A CONVENIENCE OVER `agent.command`, NEVER A REPLACEMENT FOR IT. The
+     * preset supplies the three facts a person cannot guess — the flags, whether
+     * the prompt goes on stdin, and where the runtime lives for containment to
+     * grant — and an explicit `command` still wins, because somebody who wrote one
+     * is telling us something we do not know.
+     *
+     * ⚠️ TWO OF THE PRESETS HAVE NEVER BEEN RUN by this repository's tests; see
+     * `providers.ts`, where each carries its provenance. Naming one prints a
+     * warning rather than implying it is known to work.
+     */
+    provider?: string;
+}
+export declare const PUBLISH_POLICIES: readonly ["never", "on-approval", "manual"];
+export type PublishPolicy = (typeof PUBLISH_POLICIES)[number];
+/**
+ * May Looply itself publish, under this policy?
+ *
+ * ONE PREDICATE, so that no caller has to remember that `manual` means "not
+ * Looply". Two call sites reasoning about the enum separately is how one of
+ * them eventually treats an unfamiliar value as permission.
+ */
+export declare function mayPublish(policy: PublishPolicy): boolean;
+export declare const DEFAULTS: {
+    run: {
+        minHours: number;
+        maxRounds: number;
+        cooldownS: number;
+        carryIntoCheckouts: never[];
+        maxConcurrentRuns: number;
+        perRoundSafety: boolean;
+        surfaces: boolean;
+        integration: boolean;
+        brain: boolean;
+    };
+    machine: {
+        maxWorkspaces: number;
+        maxAgentsInFlight: number;
+        coordinator: boolean;
+        provisionWorkspaces: boolean;
+        preemption: boolean;
+        reapProvisioned: boolean;
+        idleCheckoutMinutes: number;
+        integrate: boolean;
+    };
+    publish: {
+        policy: "never";
+    };
+    rails: {
+        exemptions: "ask";
+        prodEnvFiles: string[];
+    };
+    queue: {
+        topupThreshold: number;
+        topupSize: number;
+        maxSameShape: number;
+    };
+    proof: {
+        enabled: boolean;
+        onPartial: "ask";
+        askWindowMin: number;
+    };
+    notify: {
+        channel: string;
+        everyMin: number;
+    };
+    agent: AgentSpec;
+};
+export declare class ConfigError extends Error {
+    readonly key: string;
+    constructor(key: string, message: string);
+}
+/** The owner's declared limits under programme mode (M6-10). */
+export interface ProgrammeLimits {
+    readonly maxWorkspaces: number;
+    readonly maxAgentsInFlight: number;
+    readonly startsPerGrant: number;
+    readonly windowMinutes: number;
+    readonly integrationRef: string;
+}
+export interface ProgrammeMode {
+    readonly limits: ProgrammeLimits;
+    /**
+     * THE ACCEPTANCE SPECIFICATION'S ENVIRONMENT PREDICATE — owner rule #1.
+     *
+     * Which verification-environment facts must hold for a machine-verifiable
+     * requirement to be accepted under this programme. `matchProfile` loops over
+     * exactly these keys and no others, so a fact declared here is the ONLY kind
+     * that can refuse a receipt.
+     *
+     * ⚠️ ABSENT IS AN EMPTY PREDICATE, AND AN EMPTY PREDICATE ACCEPTS EVERY
+     * ENVIRONMENT — today's behaviour, byte for byte. There is deliberately NO
+     * default: `lock` is the only core fact that can ever be unknown, so a default
+     * demanding every core fact be known would refuse every project that is not
+     * npm-shaped, for ever. That is the shape this lane already reverted a feature
+     * over — "a safeguard that only ever fires is not a safeguard".
+     */
+    readonly acceptance?: RequiredProfile;
+    /**
+     * How to read the facts this machine cannot read for itself — a database
+     * engine and major version, a migration head, a build target.
+     *
+     * 🔴 PAIRED WITH THE PREDICATE AT PARSE TIME, IN BOTH DIRECTIONS. A `probe.*`
+     * demanded with no probe is a requirement nothing can ever observe; a probe
+     * with no demand is a command run for nobody. Each is this repository's
+     * most-named defect in one of its two directions, and both are a `ConfigError`
+     * rather than a runtime surprise.
+     */
+    readonly acceptanceProbes?: readonly AcceptanceProbe[];
+}
+/** One declared reader for a `probe.<name>` fact. */
+export interface AcceptanceProbe {
+    readonly fact: string;
+    readonly run: string;
+}
+export declare function parseConfig(text: string): LooplyConfig;
+/**
+ * Warnings that do not block a run but that a user should see before starting one.
+ * Silence here was how the previous harness shipped 166 commits whose trailer
+ * named a check that had never run.
+ */
+export declare function configWarnings(cfg: LooplyConfig): string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIvC;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,EAAE;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;;;;;;;;;;;;;WAiBG;QACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC;;;;;;;;;;;;;;WAcG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;;;OAYG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,wDAAwD;QACxD,aAAa,EAAE,MAAM,CAAC;QACtB,yDAAyD;QACzD,iBAAiB,EAAE,MAAM,CAAC;QAC1B;;;;;;;;;;;;;WAaG;QACH,WAAW,EAAE,OAAO,CAAC;QACrB;;;;;;;;WAQG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;;;;;WAQG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,+FAA+F;QAC/F,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;;;;;WAQG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;WASG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;WAaG;QACH,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;YACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;YACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;YAChC,sEAAsE;YACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB;;;;;;;;;;;;;;;eAeG;YACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;SACvC,CAAC;KACH,CAAC;IACF,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE;QACL,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,EAAE,KAAK,GAAG,OAAO,CAAC;KAC7B,CAAC;IACF;;;;;;;;;OASG;IACH,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IACjE,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,EAAE;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC;IACnC;;;;;;;;;;;;;;;OAeG;IACH,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAEvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAErE;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClD;;;;OAIG;IACH,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,gBAAgB,6CAA8C,CAAC;AAC5E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAEzD;AAED,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBpB,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;aAElB,GAAG,EAAE,MAAM;gBAAX,GAAG,EAAE,MAAM,EAC3B,OAAO,EAAE,MAAM;CAKlB;AA6HD,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AACD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACxD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AA6JD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA4TtD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,EAAE,CA6H1D"}