Deploy calibration @ d667e6d-space

README.md

@@ -1,5 +1,5 @@
 ---
-title: LocalGate Audit — Calibration
+title: LocalGate Audit — Judge Calibration
 emoji: ⚖️
 colorFrom: gray
 colorTo: gray
@@ -11,10 +11,11 @@ hf_oauth: true
 hf_oauth_expiration_minutes: 1440
 hf_oauth_scopes:
   - read-repos
-  # write-repos, not contribute-repos — see audit-verdicts/README.md: each
-  # Space is its own OAuth app, so app-scoped contribute-repos cannot write
-  # the shared results repo created under another Space's app.
+  # Union is load-bearing — see audit-verdicts/README.md: write-repos commits
+  # to the shared repo regardless of creator; contribute-repos creates it on
+  # a first login. Each Space is its own OAuth app.
   - write-repos
+  - contribute-repos
 hf_oauth_authorized_org: localgate
 ---
 

app.js

@@ -24,7 +24,8 @@ import { oauthLoginUrl, oauthHandleRedirectIfPresent, uploadFiles, downloadFile,
 // the ?v= stamp — an unversioned nested import could load a stale module.
 import { keyOf, latestByKey, mergeEvents, orderItems, firstUngraded as
          firstUngradedPure, countComplete, stampClass, nextEpoch,
-         standsDownTo } from "./logic.mjs?v=d4fa750-space";
+         standsDownTo, statusOf, classifyProbe, hasScopes }
+  from "./logic.mjs?v=d667e6d-space";
 
 // Test seam: Playwright installs window.__testHub (an in-memory hub) before
 // any page script runs; production never defines it, so this is one inert
@@ -37,6 +38,9 @@ const hub = () => window.__testHub ?? {
 
 /* global CONFIG */
 const ORG_ID = "6a7af86a89612db0d39b0b14";           // localgate — forces the org grant
+// write-repos: commit to the shared repo whichever app created it;
+// contribute-repos: create it on a brand-new annotator's first login.
+const REQUIRED_SCOPES = ["read-repos", "write-repos", "contribute-repos"];
 const ITEMS_REPO = { type: "dataset", name: "localgate/audit-items" };
 const SAVE_EVERY = 3;   // phones kill background fetches; keep the window small
 
@@ -62,25 +66,33 @@ function storedAuth() {
     if (!raw) return null;
     const auth = JSON.parse(raw);
     if (new Date(auth.accessTokenExpiresAt) <= new Date()) return null;
+    // A token minted before a scope change still "works" for reads but fails
+    // at publish — treat it as absent so the user re-consents cleanly.
+    if (!hasScopes(auth.scope, REQUIRED_SCOPES)) return null;
     return auth;
   } catch { return null; }
 }
 
 async function ensureAuth() {
-  let auth = storedAuth();
-  if (auth) return auth;
-  const fresh = await hub().oauthHandleRedirectIfPresent();
-  if (fresh) {
-    sessionStorage.setItem("oauth", JSON.stringify(fresh));
-    history.replaceState(null, "", location.pathname);   // ?code is single-use; keep it out of history
-    return fresh;
+  // A fresh authorization redirect ALWAYS outranks the cache: the user just
+  // consented, possibly to new scopes — ignoring it kept stale tokens alive.
+  if (new URLSearchParams(location.search).has("code")) {
+    const fresh = await hub().oauthHandleRedirectIfPresent();
+    if (fresh) {
+      sessionStorage.setItem("oauth", JSON.stringify(fresh));
+      history.replaceState(null, "", location.pathname); // ?code is single-use
+      return fresh;
+    }
   }
-  return null;
+  return storedAuth();
 }
 
 async function signIn() {
-  const url = await hub().oauthLoginUrl();                     // reads window.huggingface.variables in a Space
-  window.location.href = url + "&orgIds=" + ORG_ID;      // no param passthrough in the helper; append
+  sessionStorage.removeItem("oauth");                    // never carry a stale grant
+  const url = await hub().oauthLoginUrl();               // reads window.huggingface.variables in a Space
+  // prompt=consent re-shows the consent screen (the HF client-side-oauth
+  // idiom) so scope changes are actually granted, not silently skipped.
+  window.location.href = url + "&orgIds=" + ORG_ID + "&prompt=consent";
 }
 
 // ── state ────────────────────────────────────────────────────────────────────
@@ -91,7 +103,7 @@ const state = {
   shownAt: 0, rubricVersion: "", resultsRepo: null, last: null,
   breakShownAt: Date.now(), stickyBanner: null, stickyActions: [], stickyKind: null,
   gradedSinceBreak: 0, infoNavsLeft: 0,
-  hbTimer: null, pushing: null, pushQueued: false,
+  hbTimer: null, pushing: null, pushQueued: false, publishBlocked: null,
 };
 
 const logKey = () => `audit:${CONFIG.task}:${state.user}`;
@@ -113,22 +125,72 @@ function firstUngraded() {
                            (ev) => CONFIG.isComplete(ev));
 }
 
-// ── results repo (own namespace; contribute-repos scope) ─────────────────────
+// ── results repo (own namespace) ─────────────────────────────────────────────
+// GET /api/datasets/{name} with the user's token: 200 = exists and visible.
+async function repoProbe() {
+  try {
+    const res = await hub().fetch(
+      `https://huggingface.co/api/datasets/${state.resultsRepo.name}`,
+      { headers: { Authorization: `Bearer ${state.auth.accessToken}` },
+        cache: "no-store" });
+    return classifyProbe(res.ok ? 200 : res.status);
+  } catch { return "network"; }
+}
+
+// huggingface_hub's own exist_ok logic, ported: create, treat the
+// already-exists 409 as success, retry the concurrency 409, and on a
+// permission 401/403 probe whether the repo exists anyway (write-repos can
+// commit to it even when creation is not granted). Returns a status object —
+// boot decides policy; grading must never be blocked by this.
 async function ensureResultsRepo() {
   const name = `${state.user}/localgate-audit-results`;
   state.resultsRepo = { type: "dataset", name };
-  try {
-    await hub().createRepo({ repo: state.resultsRepo, accessToken: state.auth.accessToken,
-                       private: true });
-  } catch (err) {
-    // Already exists (any prior session) is the expected steady state; the hub's
-    // message says "You already created this dataset repo" with no status code.
-    if (!/409|exist|already/i.test(String(err))) throw err;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await hub().createRepo({ repo: state.resultsRepo,
+                               accessToken: state.auth.accessToken, private: true });
+      return { ok: true, repo: "created" };
+    } catch (err) {
+      const status = statusOf(err);
+      if (status === 409 || /already/i.test(String(err))) {
+        if (/conflicting operation/i.test(String(err))) continue;  // create race
+        return { ok: true, repo: "present" };
+      }
+      if (status === 401 || status === 403) {
+        const probe = await repoProbe();
+        if (probe === "present") return { ok: true, repo: "present" };
+        if (probe === "absent") return { ok: false, kind: "cannot-create" };
+        return { ok: false, kind: probe === "denied" ? "stale-token" : "network" };
+      }
+      return { ok: false, kind: "network", detail: String(err).slice(0, 120) };
+    }
   }
+  return { ok: false, kind: "network", detail: "create kept conflicting" };
 }
 
 const remotePath = () => `${CONFIG.task}/${state.user}.jsonl`;
 
+// Read one of the user's own log files with honest outcomes: an absent repo
+// or file is "absent" (legitimately not started); permission problems are
+// "denied" (stale token — NOT the same as zero progress); anything else is
+// "error". Callers must never render "0 graded" for denied/error.
+async function readOwnLog(task) {
+  try {
+    const blob = await hub().downloadFile({
+      repo: state.resultsRepo, accessToken: state.auth.accessToken,
+      path: `${task}/${state.user}.jsonl` });
+    if (blob === null) return { kind: "absent", rows: [] };
+    const rows = (await blob.text()).split("\n").filter(Boolean)
+      .map((line) => JSON.parse(line));
+    return { kind: "rows", rows };
+  } catch (err) {
+    const status = statusOf(err);
+    if (status === 404) return { kind: "absent", rows: [] };   // repo not created yet
+    if (status === 401 || status === 403) return { kind: "denied", rows: [] };
+    return { kind: "error", rows: [], detail: String(err).slice(0, 100) };
+  }
+}
+
 async function pullRemote() {
   const blob = await hub().downloadFile({ repo: state.resultsRepo, path: remotePath(),
                                     accessToken: state.auth.accessToken });
@@ -166,12 +228,14 @@ async function pushOnce() {
         parentCommit: parent,
       });
     } catch (err) {
-      if (attempt < 3 && /412|precondition/i.test(String(err))) continue;
+      if (attempt < 3 && (statusOf(err) === 412
+                          || /412|precondition/i.test(String(err)))) continue;
       throw err;                       // someone kept committing, or a real failure
     }
     // Events recorded while the upload was in flight are still unsaved —
     // assigning 0 here would make the pagehide flush skip them.
     state.unsaved = state.events.length - snapshot;
+    state.publishBlocked = null;                         // publishing works again
     clearErrorBanner();                                  // never eats an info banner
     renderStatus();
     return;
@@ -208,23 +272,23 @@ async function pushGuarded() {
   catch (err) {
     if (document.visibilityState === "hidden") return;   // browser killed the
     // fetch on backgrounding — expected on phones; retried on return/boot
+    const status = statusOf(err);
     if (!storedAuth()) {
-      // The token has a hard 8h expiry and no refresh — a retry can never
-      // succeed. Re-login reloads the page; localStorage keeps everything.
-      banner("Your login expired — all your work is saved in this browser. Sign "
-             + "in again to publish it; you will continue where you left off.", true,
-             [{ label: "Sign in again", onClick: signIn },
+      // Tokens expire (no refresh) and stale-scope tokens are rejected — a
+      // retry can never succeed. Re-login; localStorage keeps everything.
+      banner("Your login needs refreshing — all your work is saved in this "
+             + "browser. Sign in again to publish it; you will continue "
+             + "exactly where you left off.", true,
+             [{ label: "Sign in again (refreshes permissions)", onClick: signIn },
               { label: "Download your log", onClick: downloadLog }]);
       return;
     }
-    if (/403|forbidden/i.test(String(err))) {
-      // A cached token can carry outdated permissions (e.g. after a scope
-      // change). A fresh sign-in reissues it; localStorage keeps every event.
+    if (status === 401 || status === 403 || /forbidden/i.test(String(err))) {
+      state.publishBlocked = "permissions";              // stop burning auto-pushes
       banner("Your work is saved in this browser, but publishing was refused "
              + "(permissions). Sign in again to refresh your access — you will "
              + "continue exactly where you left off.", true,
-             [{ label: "Sign in again", onClick: () => {
-                 sessionStorage.removeItem("oauth"); signIn(); } },
+             [{ label: "Sign in again (refreshes permissions)", onClick: signIn },
               { label: "Download your log", onClick: downloadLog }]);
       return;
     }
@@ -303,7 +367,7 @@ function record(item, values, unsure, note) {
                  cls: stampClass(values) };
   state.unsaved += 1;
   if (!item.warmup) state.gradedSinceBreak += 1;
-  if (state.unsaved >= SAVE_EVERY) pushGuarded();
+  if (state.unsaved >= SAVE_EVERY && !state.publishBlocked) pushGuarded();
 }
 
 // ── UI ───────────────────────────────────────────────────────────────────────
@@ -541,7 +605,8 @@ function move(delta) {
   renderItem();
   if (discarded) {
     banner("Heads up: the note on the item you just left was not recorded — "
-           + "notes only save once both of its questions are answered.");
+           + "notes only save once both of its questions are answered.",
+           false, [], "info");
   }
 }
 
@@ -683,32 +748,52 @@ async function boot() {
     return;
   }
 
+  let prep;
   try {
-    await withTimeout(ensureResultsRepo(), 60, "preparing your results dataset");
-  } catch (err) {
-    $("#main").replaceChildren(el("p", null,
-      `Could not prepare your results dataset: ${String(err).slice(0, 140)}`));
-    const retry = el("button", "signin", "Retry");
-    retry.addEventListener("click", () => location.reload());
-    $("#main").append(retry);
-    return;
+    prep = await withTimeout(ensureResultsRepo(), 60, "preparing your results dataset");
+  } catch { prep = { ok: false, kind: "network" }; }
+  if (!prep.ok) {
+    // NEVER block grading on this: every judgment lands in localStorage and
+    // the backlog auto-publishes once publishing works. Only the "published"
+    // claim is blocked (completion screen + counters stay honest).
+    state.publishBlocked = prep.kind;
+    const text = prep.kind === "stale-token"
+      ? "Your access needs refreshing before results can publish. You can "
+        + "grade now — everything is kept in this browser — but do sign in "
+        + "again soon so it uploads."
+      : prep.kind === "cannot-create"
+        ? "Your results dataset does not exist yet and this login cannot "
+          + "create it. You can grade now — everything is kept in this "
+          + "browser — then sign in again to set it up."
+        : "Could not reach your results dataset (network). You can grade — "
+          + "everything is kept in this browser and publishing retries.";
+    banner(text, true,
+           [{ label: "Sign in again (refreshes permissions)", onClick: signIn },
+            { label: "Download your log", onClick: downloadLog }]);
   }
 
   // Ordering gate: a task can require another task's completion first (the
   // conversion fidelity pass must not open before the blind verdict pass,
   // because it reveals which items the filter kept).
   if (CONFIG.requires) {
-    let done = 0;
-    try {
-      const blob = await hub().downloadFile({
-        repo: state.resultsRepo, accessToken: state.auth.accessToken,
-        path: `${CONFIG.requires.task}/${state.user}.jsonl`,
-      });
-      if (blob !== null) {
-        const rows = (await blob.text()).split("\n").filter(Boolean).map((l) => JSON.parse(l));
-        done = countComplete(rows, CONFIG.requires.fields);
-      }
-    } catch { /* unreadable counts as not done — the gate stays shut */ }
+    const log = await readOwnLog(CONFIG.requires.task);
+    if (log.kind === "denied" || log.kind === "error") {
+      // Saying "you have graded 0 items" here would be FALSE — the read
+      // failed; their work may be complete. Fail closed with the truth.
+      $("#main").replaceChildren(el("p", null,
+        `Could not read your ${CONFIG.requires.label} progress`
+        + (log.kind === "denied" ? " (permissions — your login may need refreshing)."
+                                 : " (network)." )
+        + " This pass stays locked until it can be verified."));
+      const again = el("button", "signin", log.kind === "denied"
+        ? "Sign in again (refreshes permissions)" : "Retry");
+      again.addEventListener("click",
+        log.kind === "denied" ? signIn : () => location.reload());
+      $("#main").append(again);
+      $("#controls").hidden = true;
+      return;
+    }
+    const done = countComplete(log.rows, CONFIG.requires.fields);
     if (done < CONFIG.requires.count) {
       $("#main").replaceChildren(el("p", null,
         `${CONFIG.requires.label} must be finished first — you have graded ` +
@@ -729,26 +814,26 @@ async function boot() {
   // wrongly locking is a reload; wrongly unlocking is an invisible validity
   // hole (post-unblinding edits are only detectable, not preventable).
   if (CONFIG.lockWhen) {
-    let started = false, unreadable = false;
-    try {
-      const blob = await hub().downloadFile({
-        repo: state.resultsRepo, accessToken: state.auth.accessToken,
-        path: `${CONFIG.lockWhen.task}/${state.user}.jsonl`,
-      });
-      if (blob !== null) {
-        const rows = (await blob.text()).split("\n").filter(Boolean).map((l) => JSON.parse(l));
-        started = rows.some((ev) => !ev.warmup);
-      }
-    } catch { unreadable = true; }
+    const log = await readOwnLog(CONFIG.lockWhen.task);
+    const started = log.kind === "rows" && log.rows.some((ev) => !ev.warmup);
+    const unreadable = log.kind === "denied" || log.kind === "error";
     if (started || unreadable) {
       $("#main").replaceChildren(el("p", null, unreadable
         ? "Could not verify whether the next pass has already started, so this "
-          + "one stays closed to be safe. Reload to try again."
+          + "one stays closed to be safe."
+          + (log.kind === "denied" ? " Your login may need refreshing." : "")
         : `${CONFIG.lockWhen.label} has begun, so this pass is closed for `
           + "revision — its blindness window has ended. Every verdict you "
           + "recorded here is safe and counted. If a correction is genuinely "
           + "needed, tell Samuel; corrections after unblinding are flagged in "
           + "the analysis rather than silently applied."));
+      if (unreadable) {
+        const again = el("button", "signin", log.kind === "denied"
+          ? "Sign in again (refreshes permissions)" : "Retry");
+        again.addEventListener("click",
+          log.kind === "denied" ? signIn : () => location.reload());
+        $("#main").append(again);
+      }
       $("#controls").hidden = true;
       return;
     }
@@ -777,7 +862,7 @@ async function boot() {
     // Transient on purpose: mobile browsers reload the tab on every app
     // switch, so a sticky notice re-arms forever and reads as stuck.
     banner(`Welcome back — ${done} already recorded. `
-           + "Continuing exactly where you left off.");
+           + "Continuing exactly where you left off.", false, [], "info");
   }
 }
 

config.js

@@ -2,7 +2,7 @@ window.CONFIG = {
   task: "calibration",
   title: "Judge calibration — 100 gradings",
   itemsPath: "calibration_items.json",
-  build: "d4fa750-space",
+  build: "d667e6d-space",
   landing: "You will grade whether a model's answer states the same fact as a "
     + "reference answer. 100 gradings plus 4 discussable warm-ups; expect 2–3 "
     + "hours total, in as many sittings as you like — progress saves continuously. "

index.html

@@ -5,8 +5,8 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; font-src 'self'; connect-src https://huggingface.co https://*.hf.co; img-src 'self' data:; base-uri 'none'; form-action 'none'">
 <title>LocalGate audit</title>
-<link rel="stylesheet" href="style.css?v=d4fa750-space">
-<link rel="stylesheet" href="katex/katex.min.css?v=d4fa750-space">
+<link rel="stylesheet" href="style.css?v=d667e6d-space">
+<link rel="stylesheet" href="katex/katex.min.css?v=d667e6d-space">
 </head>
 <body>
 <header>
@@ -22,9 +22,9 @@
 <pre id="rubric-body"></pre></details>
 </div>
 <div id="controls" hidden></div>
-<script src="katex/katex.min.js?v=d4fa750-space"></script>
-<script src="katex/auto-render.min.js?v=d4fa750-space"></script>
-<script src="config.js?v=d4fa750-space"></script>
-<script type="module" src="app.js?v=d4fa750-space"></script>
+<script src="katex/katex.min.js?v=d667e6d-space"></script>
+<script src="katex/auto-render.min.js?v=d667e6d-space"></script>
+<script src="config.js?v=d667e6d-space"></script>
+<script type="module" src="app.js?v=d667e6d-space"></script>
 </body>
 </html>

logic.mjs

@@ -82,3 +82,24 @@ export function isForeignFresh(hb, sessionId, now, freshMs) {
 export function standsDownTo(hb, sessionId, myEpoch, now, freshMs) {
   return isForeignFresh(hb, sessionId, now, freshMs) && (hb.epoch ?? 0) >= myEpoch;
 }
+
+// ── error/status classification (HF error prose carries no status digits —
+//    branch on HubApiError.statusCode, never on message text) ────────────────
+
+export const statusOf = (err) =>
+  Number.isInteger(err?.statusCode) ? err.statusCode
+    : Number((String(err).match(/\b(40\d|409|412|5\d{2})\b/) ?? [])[1]) || null;
+
+// Repo-existence probe outcomes, from a raw fetch status.
+export const classifyProbe = (status) =>
+  status === 200 ? "present"
+    : status === 404 ? "absent"
+    : (status === 401 || status === 403) ? "denied"
+    : "network";
+
+// A cached token is only usable if it still carries every scope the app now
+// requires — scopes changed mid-study, and a stale grant fails at publish.
+export const hasScopes = (grantedString, required) => {
+  const granted = new Set(String(grantedString ?? "").split(/\s+/));
+  return required.every((scope) => granted.has(scope));
+};