@bongos/core 1.17.0

package/scripts/gds/codemod-rename-src-gds.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// scripts/gds/codemod-rename-src-gds.js
+//
+// One-shot, auditable codemod for task 2004 (BV1.R124): rename the core source
+// directory src/gds/ -> src/bongos/ and rewrite EVERY in-repo reference to it.
+// Committed so the approach is reproducible and reviewable (task done-when).
+//
+// Deterministic by construction:
+//   1. `git mv src/gds src/bongos`  (idempotent -- skipped if already moved).
+//   2. Over every TRACKED text file, rewrite the literal path token `src/gds`
+//      -> `src/bongos`, guarded by a TRAILING boundary so look-alike tokens are
+//      never clobbered:
+//         src/gds/...     -> src/bongos/...     (directory refs)
+//         "src/gds"       -> "src/bongos"       (bare, at a boundary)
+//         src/gds-client  -> src/gds-client     (UNCHANGED: devbox-app/src/gds-client.js)
+//         src/gdsx        -> src/gdsx           (UNCHANGED here: prefix-edge fixture)
+//
+//   Regex: /src\/gds(?![A-Za-z0-9_-])/g  -- trailing guard only. No LEADING guard:
+//   `scripts/gds` contains no `src/gds` substring, and the two real leading-glue
+//   sites (`keyed-to-src/gds` in an audit, `\tsrc/gds/auth.js` in a mirror-export
+//   fixture) are genuine directory refs we DO want rewritten.
+//
+// Excluded from the sweep (see EXCLUDE):
+//   - this script (its own source contains the search literal),
+//   - tests/path_match.mjs + tests/touches_overlap.mjs -- they assert the
+//     "src/gdsx must NOT match src/gds/" boundary edge; a mechanical half-rewrite
+//     (which leaves `src/gdsx` but changes `src/gds/`) would silently gut the
+//     test. Those two are hand-edited to src/bongos / src/bongosx so the edge
+//     stays meaningful.
+//
+// git ls-files is the file source, so gitignored generated docs
+// (docs/repo-map.md, docs/session-log-index.md) are excluded -- they regenerate.
+// Binary files are skipped via a NUL-byte sniff.
+//
+// Idempotent: a second run moves nothing and rewrites nothing (0 replacements).
+
+const { execSync } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = execSync('git rev-parse --show-toplevel').toString().trim();
+
+// (a) The slash form: `src/gds`, `src/gds/routes`, `"src/gds"` ... Trailing guard
+// only (see header) so `src/gds-client` and `src/gdsx` are left alone.
+const NEEDLE = /src\/gds(?![A-Za-z0-9_-])/g;
+const REPLACEMENT = 'src/bongos';
+
+// (b) The SPLIT-SEGMENT form: `path.join(root, 'src', 'gds', ...)` -- the segments
+// are separate string args, so there is no literal `src/gds` substring for (a) to
+// catch. Anchored on a PRECEDING quoted `'src'` segment so it rewrites only the
+// `'gds'` that follows `'src'` -- NEVER `'scripts', 'gds'` (scripts/gds is not
+// renamed). \s between segments tolerates a newline-split path.join. The `gds`
+// quote must close immediately, so `'gdsx'` / `'gds-client'` never match.
+const SEG = /(['"])src\1(\s*,\s*)(['"])gds\3/g;
+const segReplace = (s) => s.replace(SEG, (_m, q1, sep, q2) => `${q1}src${q1}${sep}${q2}bongos${q2}`);
+
+// (c) RELATIVE requires into the moved dir. A file DIRECTLY under src/ addresses
+// its former sibling as `require('./gds/x')` -- no `src/` prefix, so (a) misses it,
+// and after the move it dangles. `./gds` resolves to src/gds ONLY from a src-top-
+// level file; a `./gds` in scripts/* means scripts/gds (NOT renamed) and a deeper
+// src/**/* file resolves elsewhere -- so this pass is gated to `src/<file>` and
+// never fires elsewhere. (Verified: the only matches are src/module-api.js +
+// src/platform-server.js; no `../gds` relative forms exist.) `(?=\/|['"])` keeps
+// `./gds-client` / `./gdsx` safe.
+const isSrcTopLevel = (rel) => /^src\/[^/]+\.(?:js|mjs|cjs)$/.test(rel);
+const REL = /(\.\/)gds(?=\/|['"])/g;
+
+// (d) REGEX-ESCAPED slash form: `src\/gds` (backslash-slash) as written inside a
+// RegExp literal -- e.g. route-rank-check.js's ROUTE_FILE_RE and the tests that
+// match against it. `\/` is not the plain `/` (a) scans for, so (a) misses it.
+const ESC = /src\\\/gds(?![A-Za-z0-9_-])/g;
+
+// (e) WINDOWS double-backslash form: `src\\gds` in JS source (one backslash on
+// disk-per-escape, two chars) -- Windows-path fixtures the matchers normalize
+// (permission_path / publish_manifest). Trailing guard keeps `src\\gdsx` safe.
+const WIN = /src\\\\gds(?![A-Za-z0-9_-])/g;
+
+const EXCLUDE = new Set([
+  'scripts/gds/codemod-rename-src-gds.js',
+  'tests/path_match.mjs',
+  'tests/touches_overlap.mjs',
+]);
+
+function gitMv() {
+  const oldDir = path.join(REPO_ROOT, 'src', 'gds');
+  const newDir = path.join(REPO_ROOT, 'src', 'bongos');
+  if (fs.existsSync(newDir)) {
+    console.log('git mv: src/bongos already exists -- skipping move (idempotent).');
+    return;
+  }
+  if (!fs.existsSync(oldDir)) {
+    console.log('git mv: neither src/gds nor src/bongos present -- nothing to move.');
+    return;
+  }
+  execSync('git mv src/gds src/bongos', { cwd: REPO_ROOT, stdio: 'inherit' });
+  console.log('git mv: src/gds -> src/bongos');
+}
+
+function isBinary(buf) {
+  const n = Math.min(buf.length, 8192);
+  for (let i = 0; i < n; i++) if (buf[i] === 0) return true;
+  return false;
+}
+
+function main() {
+  gitMv();
+
+  const tracked = execSync('git ls-files', { cwd: REPO_ROOT, maxBuffer: 128 * 1024 * 1024 })
+    .toString().split('\n').filter(Boolean);
+
+  let filesChanged = 0;
+  let totalReplacements = 0;
+  const changed = [];
+
+  for (const rel of tracked) {
+    if (EXCLUDE.has(rel)) continue;
+    const abs = path.join(REPO_ROOT, rel);
+    let buf;
+    try { buf = fs.readFileSync(abs); } catch { continue; } // e.g. deleted-in-index
+    if (isBinary(buf)) continue;
+    const before = buf.toString('utf8');
+    const slashN = (before.match(NEEDLE) || []).length;
+    const segN = (before.match(SEG) || []).length;
+    const escN = (before.match(ESC) || []).length;
+    const winN = (before.match(WIN) || []).length;
+    const relN = isSrcTopLevel(rel) ? (before.match(REL) || []).length : 0;
+    if (slashN === 0 && segN === 0 && escN === 0 && winN === 0 && relN === 0) continue;
+    let after = segReplace(before.replace(NEEDLE, REPLACEMENT));
+    after = after.replace(ESC, 'src\\/bongos').replace(WIN, 'src\\\\bongos');
+    if (relN > 0) after = after.replace(REL, '$1bongos');
+    if (after === before) continue;
+    fs.writeFileSync(abs, after);
+    filesChanged++;
+    const n = slashN + segN + escN + winN + relN;
+    totalReplacements += n;
+    changed.push({ rel, n });
+  }
+
+  changed.sort((a, b) => b.n - a.n);
+  console.log(`\ncodemod: rewrote ${totalReplacements} reference(s) across ${filesChanged} file(s).`);
+  for (const c of changed) console.log(`  ${String(c.n).padStart(4)}  ${c.rel}`);
+  console.log('\nExcluded (hand-edited or self): ' + [...EXCLUDE].join(', '));
+}
+
+main();

package/scripts/gds/conductor-dispatch.js

@@ -0,0 +1,426 @@
+#!/usr/bin/env node
+// MAS Phase 4 (#439) — Conductor dispatcher.
+//
+// Runs one or more grader specialists on the CURRENT working diff — the
+// mid-flight counterpart to the ship-time panel. It REUSES the exact
+// grader-workers/* machinery (same prompts, same cross-family model, same
+// verdict logic), so a mid-flight Hacker review and a ship-time Hacker review
+// are literally the same code. This is the "dispatch" capability the Conductor
+// points at: when you've touched a security surface, you (or the Conductor's
+// directive) run this to bring the Hacker in NOW instead of waiting for ship.
+//
+// Dispatch mode is SESSION-MEDIATED (ADR 0024 Phase 4): the specialist-on-diff
+// modes below run inside the builder's session, visibly. The Conductor hook
+// recommends running it; the session executes it.
+//
+// Phase 4.5 (ADR 0024 — the one deferred MAS leg) adds the AUTONOMOUS path:
+// `auto-dispatch` selects the next claimable autonomous task WITHOUT a human
+// prompt and emits a dispatch directive (the `/builder-claim` command) for a
+// runner to execute. It still "proposes, never disposes" — this entry point
+// SELECTS + EMITS; it does not itself spawn a build session or land code (that
+// stays the runner/ship-pipeline's job, where ADR 0016's DB-enforced gates and
+// the grader still bite). It is gated by the same $0 deterministic
+// `autonomy-gate` precheck the nightly routines use, so it is INERT until
+// OTB_AUTONOMY_ENABLED=1 and respects the MTD spend brake + no-signal skips.
+// The claimable feed is the protected-path-filtered `fit:'autonomous'` view, so
+// the permission/methodology/deploy core can never be auto-selected (SR-12).
+//
+// Usage:
+//   node scripts/gds/conductor-dispatch.js [hacker|narc|quality|efficiency|auto|all] [--base <ref>]
+//   node scripts/gds/conductor-dispatch.js auto-dispatch [--json]
+//
+//   auto  (default) → pick specialists by what changed (Hacker if a security
+//                     surface is in the diff; nothing otherwise → suggests `all`)
+//   all             → run the full 4-worker panel on the current diff
+//   <name>          → run just that specialist
+//   auto-dispatch   → Phase 4.5: autonomous selection. Gate → pick the top
+//                     claimable autonomous task → emit its claim directive.
+//
+// Diff = everything different from origin/main right now: committed-on-branch
+// PLUS uncommitted, via `git diff <merge-base HEAD origin/main>`.
+//
+// Exit code: 0 if no worker returned verdict 'fail'; 1 if any did (so it can
+// gate a script). Informational findings print regardless. For auto-dispatch:
+// 0 when a task was selected (a directive was emitted), 1 on a NO-GO / no work.
+
+const { execFileSync } = require('node:child_process');
+const { cliClient } = require('./cli-lib');
+const grader = require('../../modules/grading/grader');
+// Phase 4.5: reuse the $0 deterministic autonomy precheck (the same gate the
+// nightly routines run as Step 0). It owns the master kill-switch, the MTD
+// spend brake, and the no-signal skip — autonomous dispatch must not re-invent
+// any of them. Built INERT (OTB_AUTONOMY_ENABLED off) → precheck returns GO but
+// gatherSignals isn't paid for; selection below still runs but the runner that
+// consumes the directive is what actually spends.
+const autonomyGate = require('./autonomy-gate');
+// Single source of truth shared with the Conductor hook — see
+// src/bongos/sensitive-surfaces.js. (The Phase 4 dogfood flagged the prior
+// hand-copied pattern set in this file as a drift risk vs. the hook.)
+const { isSensitive } = require('../../src/bongos/sensitive-surfaces');
+// Canonical touches[] matcher — the same one ship.js's scanner + the Conductor
+// hook use. (#439 first-ship: the panel flagged that bestMatchingClaim had
+// re-hand-rolled this coverage logic — the exact drift this PR fixed for the
+// sensitive-surface set. Route through the one matcher instead.)
+const { matchOne } = require('../../src/bongos/path-match');
+
+const GRADER_DIFF_CHAR_CAP = 250_000;
+const GRADER_TIMEOUT_MS = 240_000;
+
+// --- pure: which specialists does `auto` pick for a given changed-file set? ---
+// Phase 4 auto-dispatch is deliberately security-focused: Hacker is the
+// highest-value mid-flight check and the one cleanly triggered by file paths.
+// Efficiency Monger needs perf-context paths don't reveal; Narc/Quality want
+// a finished task to grade against — all three remain available explicitly.
+function pickSpecialists(changedFiles) {
+  const picks = [];
+  if ((changedFiles || []).some((f) => isSensitive(f))) {
+    picks.push('hacker');
+  }
+  return picks;
+}
+
+// --- pure: Phase 4.5 autonomous task selection ---
+// Given a GO/NO-GO gate result and the already-fetched claimable-autonomous
+// feed, pick the work to dispatch and shape the directive. Pure (no I/O) so the
+// selection contract is unit-testable; the live gate + feed are gathered in
+// autoDispatch() below.
+//
+// Contract:
+//   - gate.decision !== 'go'           → { ok:false, reason } (no work dispatched)
+//   - empty/absent feed                → { ok:false, reason:'no claimable…' }
+//   - otherwise                        → { ok:true, task, command, directive }
+//
+// The feed is ALREADY ordered by priority then calibrated-estimate then
+// created_at (listClaimableTasks) and ALREADY protected-path filtered for the
+// autonomous fit (SR-12), so "the top row" is the right pick — we don't
+// re-rank, we take rows[0]. command is the exact `/builder-claim` a runner
+// runs; the entry point proposes it, the runner disposes.
+function selectAutonomousDispatch(gate, claimable) {
+  if (!gate || gate.decision !== 'go') {
+    return { ok: false, reason: gate ? gate.reason : 'no gate decision' };
+  }
+  const rows = Array.isArray(claimable) ? claimable : [];
+  if (rows.length === 0) {
+    return { ok: false, reason: 'no claimable autonomous tasks — nothing to dispatch' };
+  }
+  const t = rows[0];
+  const task = {
+    id: t.id,
+    title: t.title || '(untitled)',
+    version_id: t.version_id,
+    est_minutes: t.est_minutes_calibrated != null ? t.est_minutes_calibrated : t.est_minutes,
+    discipline: t.discipline || null,
+  };
+  const command = `node scripts/gds/claim.js ${task.id}`;
+  return {
+    ok: true,
+    task,
+    command,
+    directive: `Autonomously dispatch task #${task.id} — ${task.title}. Run \`${command}\`, build it, then \`/builder-ship\`.`,
+  };
+}
+
+// --- git diff plumbing (mirrors scripts/gds/ship.js's computation) ---
+
+function git(args) {
+  try {
+    return execFileSync('git', args, { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch (_) {
+    return '';
+  }
+}
+
+function repoRoot() {
+  const top = git(['rev-parse', '--show-toplevel']).trim();
+  return top || process.cwd();
+}
+
+function resolveBase(explicit) {
+  if (explicit) return explicit;
+  const mb = git(['merge-base', 'HEAD', 'origin/main']).trim();
+  // Fallback when origin/main can't be resolved (offline / fresh clone): diff
+  // against HEAD. NOTE this only surfaces UNCOMMITTED work — committed-on-branch
+  // changes are relative to a base we couldn't compute, so they're dropped in
+  // this degraded mode. Untracked files are still picked up separately.
+  return mb || 'HEAD';
+}
+
+function untrackedFiles() {
+  // `git diff` shows only TRACKED changes — brand-new files are invisible to
+  // it. A security/quality reviewer must not be blind to a new route file, so
+  // we list untracked files explicitly (mirrors the hook's status-based
+  // collection). The worker has a Read tool + cwd=repo root, so naming them is
+  // enough — it can Read the contents.
+  const out = git(['ls-files', '--others', '--exclude-standard']);
+  return out.split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+// `untracked` is computed once in main() and threaded through, so we don't
+// spawn `git ls-files` twice per dispatch (Efficiency Monger flagged the
+// double-spawn on the Phase 4 dogfood).
+function changedFilesSince(base, untracked) {
+  // `git diff --name-only <base>` = tracked changes (committed + uncommitted)
+  // vs base. Union with untracked so new files are included.
+  const tracked = git(['diff', '--name-only', base]).split('\n').map((s) => s.trim()).filter(Boolean);
+  return [...new Set([...tracked, ...untracked])];
+}
+
+function diffTextSince(base, untracked) {
+  let diff = git(['diff', '--no-color', '-M', base]);
+  // Note untracked files at the tail so the worker knows to Read them (their
+  // content isn't in the tracked diff).
+  if (untracked.length) {
+    diff += `\n\n[untracked new files — not shown in the diff above; Read them for content]\n${untracked.map((f) => `  + ${f}`).join('\n')}\n`;
+  }
+  if (!diff.trim()) return '';
+  if (diff.length > GRADER_DIFF_CHAR_CAP) {
+    return `${diff.slice(0, GRADER_DIFF_CHAR_CAP)}\n\n[diff truncated — original ${diff.length} chars. The worker can Read any file for full context.]`;
+  }
+  return diff;
+}
+
+function diffStatsSince(base, untracked) {
+  const s = git(['diff', '--shortstat', base]);
+  const f = /(\d+)\s+files?\s+changed/.exec(s);
+  const i = /(\d+)\s+insertions?\(\+\)/.exec(s);
+  const d = /(\d+)\s+deletions?\(-\)/.exec(s);
+  // Untracked new files aren't in `git diff` shortstat; add them to the file
+  // count so the worker's diff-size context isn't undercounted. (Their line
+  // counts aren't computed — the worker has the file list + a Read tool.)
+  const untrackedCount = Array.isArray(untracked) ? untracked.length : 0;
+  return {
+    files_changed: (f ? Number(f[1]) : 0) + untrackedCount,
+    lines_added: i ? Number(i[1]) : 0,
+    lines_removed: d ? Number(d[1]) : 0,
+  };
+}
+
+// Pick the active claim whose touches[] best overlap the changed files — the
+// claim the current diff most plausibly belongs to. With multiple (possibly
+// stale) claims, blindly taking claims[0] grades the diff against the wrong
+// task: the Phase 4 dogfood's Narc FAILed because it graded Conductor code
+// against an unrelated stale offsite-backup claim. Best-overlap fixes that.
+function bestMatchingClaim(claims, changedFiles) {
+  if (!Array.isArray(claims) || claims.length === 0) return null;
+  const files = Array.isArray(changedFiles) ? changedFiles : [];
+  let best = claims[0];
+  let bestScore = -1;
+  for (const c of claims) {
+    // Use the canonical matcher; ties keep the earlier claim (strict >).
+    const score = files.filter((f) => matchOne(f, c.touches || []) !== null).length;
+    if (score > bestScore) { bestScore = score; best = c; }
+  }
+  return best;
+}
+
+// --- task context (best-effort) ---
+// Workers grade a diff against a task. For a mid-flight review we use the
+// best-matching active claim's task; otherwise we synthesize a minimal
+// context so the specialist judges the diff on its own merits.
+async function resolveTaskContext(changedFiles) {
+  try {
+    const api = await cliClient();
+    const me = await api.me.getMe();
+    if (me.ok) {
+      const claims = me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []);
+      if (claims.length > 0) {
+        const c = bestMatchingClaim(claims, changedFiles);
+        // Pull the full description for richer context (best-effort). Coerce
+        // task_id to an integer before interpolating it into the URL path —
+        // it's a trusted internal value, but a guard costs nothing and closes
+        // the theoretical path-injection the Hacker noted.
+        let description = '';
+        const taskId = Number(c.task_id);
+        if (Number.isInteger(taskId)) {
+          try {
+            const t = await api.tasks.getTasksId({ id: taskId });
+            if (t.ok && t.data.task) description = t.data.task.description || '';
+          } catch (_) { /* fall through to title-only */ }
+        }
+        return {
+          id: c.task_id,
+          title: c.title || '(active claim)',
+          description: description || '(no description fetched — mid-flight review; judge the diff on its own merits)',
+          kind: 'unclassified',
+          version_id: c.version_id,
+        };
+      }
+    }
+  } catch (_) { /* offline / no session */ }
+  return {
+    id: null,
+    title: '(mid-flight review — no active claim)',
+    description: 'Conductor mid-flight dispatch. No formal task/acceptance context; review the current working changes for this specialist\'s concern and judge the diff on its own merits.',
+    kind: 'unclassified',
+  };
+}
+
+// --- rendering ---
+
+function renderWorker(w) {
+  const lines = [];
+  const status = w.error ? `ERROR (${w.error})` : w.verdict.toUpperCase();
+  const scores = Object.entries(w.scores || {})
+    .filter(([, v]) => Number.isFinite(v))
+    .map(([k, v]) => `${k}=${v}`)
+    .join('  ');
+  lines.push(`── ${w.name} — ${status}${scores ? '  ·  ' + scores : ''}${w.confidence != null ? `  ·  conf=${w.confidence}` : ''}`);
+  if (Array.isArray(w.issues) && w.issues.length) {
+    for (const it of w.issues) {
+      const sev = String(it.severity || '?').padEnd(7);
+      lines.push(`   [${sev}] ${it.file || '?'} — ${String(it.summary || '').replace(/\s+/g, ' ').trim()}`);
+    }
+  }
+  // First substantive line of the worker's own notes, for a human-readable
+  // gist. The worker's notes_md always opens with a "<Name> — VERDICT (...)"
+  // header line we've already rendered (status/scores above), so drop line 0
+  // and take the next non-empty line — robust regardless of its content.
+  const noteLines = (w.notes_md || '').split('\n').slice(1);
+  const note = noteLines.find((l) => l.trim());
+  if (note) lines.push(`   ${note.trim()}`);
+  return lines.join('\n');
+}
+
+// --- Phase 4.5: autonomous background dispatch ---
+// Gate (deterministic, $0) → select the top claimable autonomous task → emit
+// the claim directive. No git diff, no grader, no model spend in this path: it
+// is the SELECTOR, and the runner that consumes the directive is what spends.
+// Deps are injectable so the live wiring stays a thin shell over pure logic.
+async function autoDispatch(deps = {}) {
+  const ROUTINE = 'conductor-auto-dispatch';
+  const precheck = deps.precheck || autonomyGate.precheck;
+  // The same protected-path-filtered autonomous feed the gate itself counts.
+  // Required lazily (a module require) so `require()`-ing this file for its pure
+  // exports never pulls the lifecycle data layer / a DB pool.
+  const listClaimable = deps.listClaimableTasks
+    || ((opts) => require('../../modules/lifecycle/db').listClaimableTasks(opts));
+
+  const gate = await precheck(ROUTINE).catch((e) => ({ decision: 'no-go', reason: `gate error: ${e && e.message}` }));
+  // Only pay for the feed when the gate said GO.
+  let claimable = [];
+  if (gate.decision === 'go') {
+    claimable = await listClaimable({ fit: 'autonomous' }).catch(() => []);
+  }
+  const result = selectAutonomousDispatch(gate, claimable);
+  return { routine: ROUTINE, gate, ...result };
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  // Phase 4.5 — autonomous dispatch is its own mode (no diff/grader machinery).
+  if (args.includes('auto-dispatch')) {
+    const out = await autoDispatch();
+    if (args.includes('--json')) {
+      console.log(JSON.stringify(out, null, 2));
+    } else {
+      console.log(`🎼 Conductor auto-dispatch — gate: ${out.gate.decision.toUpperCase()} (${out.gate.reason})`);
+      if (out.ok) {
+        console.log(`   → selected task #${out.task.id}: ${out.task.title}`);
+        console.log(`   → ${out.directive}`);
+      } else {
+        console.log(`   → no dispatch: ${out.reason}`);
+      }
+    }
+    process.exit(out.ok ? 0 : 1);
+  }
+
+  const baseArg = (() => { const i = args.indexOf('--base'); return i >= 0 ? args[i + 1] : null; })();
+  // --base is passed to git as an array arg (no shell), but reject anything
+  // that isn't a plausible ref so a malformed value can't silently produce a
+  // misleading review scope (dev-tool surface, but cheap to validate).
+  // Reject anything that isn't a plausible git ref (first char not '-', so a
+  // value like '--format=...' can't masquerade as a ref).
+  if (baseArg && !/^[\w.@~^{}/][\w./@~^{}-]*$/.test(baseArg)) {
+    console.error(`Invalid --base ref '${baseArg}'. Expected a git ref (commit/branch/tag).`);
+    process.exit(2);
+  }
+  const target = (args.find((a) => !a.startsWith('--') && a !== baseArg) || 'auto').toLowerCase();
+
+  const root = repoRoot();
+  process.chdir(root); // so workers' Read tool resolves repo-relative paths
+  const base = resolveBase(baseArg);
+  const untracked = untrackedFiles(); // computed once, threaded through
+  const files = changedFilesSince(base, untracked);
+  const diff = diffTextSince(base, untracked);
+  const stats = diffStatsSince(base, untracked);
+
+  if (files.length === 0) {
+    console.log('Conductor dispatch: no changes vs origin/main — nothing to review.');
+    process.exit(0);
+  }
+
+  // Resolve which specialists to run.
+  const REGISTRY = grader.WORKERS.REGISTRY;
+  let kinds;
+  if (target === 'all') {
+    kinds = grader.WORKERS.DEFAULT_PANEL.slice();
+  } else if (target === 'auto') {
+    kinds = pickSpecialists(files);
+    if (kinds.length === 0) {
+      console.log(`Conductor dispatch (auto): ${files.length} file(s) changed, none on a security surface — nothing auto-triggers.`);
+      console.log('For a full mid-flight review of all four lenses, run:  node scripts/gds/conductor-dispatch.js all');
+      process.exit(0);
+    }
+  } else if (Object.hasOwn(REGISTRY, target)) {
+    // hasOwn, not truthiness — a target of '__proto__'/'constructor' would
+    // otherwise resolve off Object.prototype rather than a real worker.
+    kinds = [target];
+  } else {
+    console.error(`Unknown specialist '${target}'. Use one of: ${Object.keys(REGISTRY).join(', ')}, auto, all.`);
+    process.exit(2);
+  }
+
+  const task = await resolveTaskContext(files);
+  const model = grader.selectGraderModel({});
+  const valueSummary = '(work in progress — Conductor mid-flight dispatch; no final value summary yet)';
+
+  // Deterministic route-rank pre-pass (#475) — same helper the ship-time
+  // grader uses. Findings feed the Hacker as input; its pseudo-worker result
+  // is appended below so the dispatch verdict reflects it. Runs only when a
+  // route file is in the diff (zero cost otherwise).
+  const routeRank = grader.routeRankPrePass(files);
+
+  console.log(`🎼 Conductor dispatch → ${kinds.join(', ')}  (model=${model}, ${files.length} changed file(s), base=${base.slice(0, 8)})`);
+  console.log(`   task context: ${task.id ? '#' + task.id + ' ' + task.title : task.title}`);
+  if (routeRank) console.log('   + deterministic route-rank check (route file in diff)');
+  console.log('');
+
+  const results = await Promise.all(kinds.map((k) => grader.WORKERS.runWorker(REGISTRY[k], {
+    task,
+    valueSummary,
+    diff,
+    changedFiles: files,
+    diffStats: stats,
+    model,
+    runOpts: { timeoutMs: GRADER_TIMEOUT_MS, cwd: root },
+    runSubagentFn: grader.runSubagent,
+    extractAssistantResultFn: grader.extractAssistantResult,
+    deterministicFindings: routeRank ? routeRank.findings : null,
+  })));
+  // Append the deterministic pseudo-worker so a write-route 'unknown' fails the
+  // dispatch on its own, even if the requested specialist set excludes Hacker.
+  if (routeRank) results.push(routeRank.workerResult);
+
+  for (const w of results) {
+    console.log(renderWorker(w));
+    console.log('');
+  }
+
+  const anyFail = results.some((w) => w.verdict === 'fail');
+  const anyConcerns = results.some((w) => w.verdict === 'concerns');
+  const summary = anyFail ? 'FAIL — at least one specialist flagged a blocker'
+    : anyConcerns ? 'CONCERNS — review the flagged items'
+      : 'CLEAR — no blocking findings';
+  console.log(`Conductor dispatch verdict: ${summary}`);
+  process.exit(anyFail ? 1 : 0);
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('Conductor dispatch error:', err && err.message ? err.message : err);
+    process.exit(2);
+  });
+}
+
+module.exports = { pickSpecialists, bestMatchingClaim, selectAutonomousDispatch, autoDispatch };