@bongos/core 1.17.0

package/tests/grader.mjs

@@ -0,0 +1,1960 @@
+// tests/grader.mjs
+//
+// Grader tests. Covers both:
+//   - the v1 deterministic process-audit grader (kept for audit-ships.js)
+//   - the v2 subagent quality grader (the actual credits gate from V3.R18 #209)
+//
+// The v2 subagent itself is a real-network call, so the tests stop at the
+// validator + prompt-builder boundary; the network-touching end-to-end check
+// lives in scripts/gds/grade-smoke.js and is run manually.
+//
+// Run:  node tests/grader.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const grader = require('../modules/grading/grader.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    const maybePromise = fn();
+    if (maybePromise && typeof maybePromise.then === 'function') {
+      throw new Error('async tests not supported in this runner');
+    }
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  FAIL ${name}`);
+    console.error('    ', err.message);
+    failed++;
+  }
+}
+
+// Async variant (#465) — the sync `test()` above rejects promises, but a few
+// checks (runWorker's retry control flow) are genuinely async. Call with
+// top-level `await testAsync(...)` so it resolves before the summary runs.
+async function testAsync(name, fn) {
+  try {
+    await fn();
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  FAIL ${name}`);
+    console.error('    ', err.message);
+    failed++;
+  }
+}
+
+// ========================================================================
+// v1 — deterministic grader (legacy, used only by audit-ships.js)
+// ========================================================================
+
+test('v1 scoreEstActualBand: ratio inside [0.5, 2.0] → 10', () => {
+  assert.equal(grader.scoreEstActualBand(60, 60), 10);
+  assert.equal(grader.scoreEstActualBand(30, 60), 10);
+  assert.equal(grader.scoreEstActualBand(120, 60), 10);
+});
+
+test('v1 scoreEstActualBand: ratio outside band drops linearly', () => {
+  assert.equal(grader.scoreEstActualBand(18, 60), 5);
+  assert.equal(grader.scoreEstActualBand(360, 60), 5);
+});
+
+test('v1 scoreEstActualBand: extreme ratios → 0', () => {
+  assert.equal(grader.scoreEstActualBand(6, 60), 0);
+  assert.equal(grader.scoreEstActualBand(600, 60), 0);
+});
+
+test('v1 scoreEstActualBand: missing est → 6, missing actual → 5', () => {
+  assert.equal(grader.scoreEstActualBand(60, null), 6);
+  assert.equal(grader.scoreEstActualBand(null, 60), 5);
+});
+
+test('v1 scoreValueSummary: maps length + verb', () => {
+  assert.equal(grader.scoreValueSummary(''), 0);
+  assert.equal(grader.scoreValueSummary(null), 0);
+  assert.equal(grader.scoreValueSummary('short note'), 5);
+  assert.equal(grader.scoreValueSummary('a moderately worded summary that lands above forty characters'), 8);
+  const s = 'wire the auto-grader into the completed→confirmed transition so every task gets a quality mark before its credits are paid out';
+  assert.ok(s.length > 120);
+  assert.equal(grader.scoreValueSummary(s), 10);
+});
+
+test('v1 scoreDiffHygiene: phantom ship → 0, normal → 10, too-broad → 5', () => {
+  assert.equal(grader.scoreDiffHygiene({ files_changed: 0, lines_added: 0, lines_removed: 0 }), 0);
+  assert.equal(grader.scoreDiffHygiene({ files_changed: 5, lines_added: 200, lines_removed: 30 }), 10);
+  assert.equal(grader.scoreDiffHygiene({ files_changed: 80, lines_added: 1000, lines_removed: 200 }), 5);
+});
+
+test('v1 scoreScopingSignal: maps each level', () => {
+  assert.equal(grader.scoreScopingSignal(0), 2);
+  assert.equal(grader.scoreScopingSignal(1), 4);
+  assert.equal(grader.scoreScopingSignal(2), 6);
+  assert.equal(grader.scoreScopingSignal(3), 7);
+  assert.equal(grader.scoreScopingSignal(4), 8);
+  assert.equal(grader.scoreScopingSignal(5), 10);
+  assert.equal(grader.scoreScopingSignal(null), 6);
+});
+
+test('v1 scoreLocNetNegative', () => {
+  assert.equal(grader.scoreLocNetNegative({ lines_added: 20, lines_removed: 100 }), 10);
+  assert.equal(grader.scoreLocNetNegative({ lines_added: 100, lines_removed: 20 }), 0);
+});
+
+test('v1 scoreLearningRow', () => {
+  assert.equal(grader.scoreLearningRow({ body_md: 'x'.repeat(200) }), 10);
+  assert.equal(grader.scoreLearningRow(null), 0);
+});
+
+test('v1 scoreArtRubricAvg clamps + nulls', () => {
+  assert.equal(grader.scoreArtRubricAvg(8.7), 8.7);
+  assert.equal(grader.scoreArtRubricAvg(15), 10);
+  assert.equal(grader.scoreArtRubricAvg(-1), 0);
+  assert.equal(grader.scoreArtRubricAvg(NaN), null);
+});
+
+test('v1 blendWeightsForKind: feature renorms to 1.0', () => {
+  const w = grader.blendWeightsForKind('feature');
+  const total = Object.values(w).reduce((a, b) => a + b, 0);
+  assert.ok(Math.abs(total - 1.0) < 1e-6, `total=${total}, expected 1.0`);
+});
+
+test('v1 blendWeightsForKind: cleanup replaces diff_hygiene', () => {
+  const w = grader.blendWeightsForKind('cleanup');
+  assert.ok('loc_net_negative' in w);
+  assert.ok(!('diff_hygiene' in w));
+});
+
+test('v1 gradeDeterministic: well-shipped feature passes', () => {
+  const result = grader.gradeDeterministic({
+    task: { id: 99, kind: 'feature', est_minutes: 240, actual_minutes: 200, scoping_confidence: 4 },
+    verification: {
+      scanner_clean: true, smoke_clean: true,
+      diff_stats: { files_changed: 10, lines_added: 400, lines_removed: 50 },
+    },
+    actualMinutes: 200,
+    valueSummary: 'wire the auto-grader into ship.js so every task gets a quality mark before credits are paid; gates the completed→confirmed transition',
+  });
+  assert.ok(result.score >= 9.0, `score=${result.score}`);
+  assert.equal(result.passed, true);
+  assert.equal(result.grader_kind, 'auto');
+  assert.equal(result.grader_version, grader.RUBRIC.v1.version);
+  assert.equal(result.threshold, grader.RUBRIC.v1.threshold);
+});
+
+test('v1 gradeDeterministic: phantom ship scores low', () => {
+  const result = grader.gradeDeterministic({
+    task: { id: 100, kind: 'feature', est_minutes: 240, actual_minutes: 30, scoping_confidence: 2 },
+    verification: {
+      scanner_clean: true, smoke_clean: true,
+      diff_stats: { files_changed: 0, lines_added: 0, lines_removed: 0 },
+    },
+    actualMinutes: 30,
+    valueSummary: '',
+  });
+  assert.ok(result.score < 5.0, `score=${result.score}`);
+  assert.equal(result.passed, false);
+});
+
+test('v1 gradeDeterministic: notes_md says deprecated', () => {
+  const result = grader.gradeDeterministic({
+    task: { id: 106, kind: 'feature', est_minutes: 60, actual_minutes: 60, scoping_confidence: 4 },
+    verification: { scanner_clean: true, smoke_clean: true, diff_stats: { files_changed: 3, lines_added: 50, lines_removed: 5 } },
+    actualMinutes: 60,
+    valueSummary: 'a reasonable shipped change',
+  });
+  assert.match(result.notes_md, /v1.*deprecated/i);
+});
+
+// ========================================================================
+// v2 — subagent grader (the credits gate as of V3.R18 #209)
+// ========================================================================
+
+test('v4 exports the expected surface (current panel-based gate)', () => {
+  const required = [
+    // v4 entry points
+    'gradeSubagent', 'aggregatePanel', 'WORKERS', 'FALLTHROUGH_CONFIDENCE',
+    // v3 surface kept exported for diagnostics + tests
+    'buildPrompt', 'selectGraderModel', 'validateAndScore', 'aggregateShots',
+    'runSubagent', 'runOneShot', 'gradeSubagentV3MultiShot',
+    // constants
+    'THRESHOLD', 'VERSION', 'DEFAULT_GRADER_MODEL', 'DEFAULT_SHOTS', 'ASSUMED_BUILDER_MODEL',
+    // utilities
+    'extractJson', 'extractAssistantResult', 'extractCostUsd', 'RUBRIC',
+  ];
+  for (const name of required) {
+    assert.ok(name in grader, `missing export: ${name}`);
+  }
+  assert.ok(typeof grader.THRESHOLD === 'number');
+  assert.ok(grader.THRESHOLD >= 5.0 && grader.THRESHOLD <= 10.0);
+  assert.ok(grader.VERSION.startsWith('v4'), `expected v4.*, got ${grader.VERSION}`);
+  assert.equal(grader.DEFAULT_SHOTS, 3); // kept for v3 multi-shot diagnostic path
+  assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-4-6');
+  assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-opus-4-7');
+  assert.equal(grader.FALLTHROUGH_CONFIDENCE, 0.3);
+  // Worker registry sanity — Phase 2.2 added efficiency as the 4th worker
+  // (after Phase 2.1's hacker).
+  assert.deepEqual(grader.WORKERS.DEFAULT_PANEL, ['narc', 'quality', 'hacker', 'efficiency']);
+  assert.ok(grader.WORKERS.REGISTRY.narc);
+  assert.ok(grader.WORKERS.REGISTRY.quality);
+  assert.ok(grader.WORKERS.REGISTRY.hacker);
+  assert.ok(grader.WORKERS.REGISTRY.efficiency);
+});
+
+test('#486 extractCostUsd: pulls total_cost_usd from the claude -p envelope', () => {
+  assert.equal(grader.extractCostUsd(JSON.stringify({ type: 'result', total_cost_usd: 0.1981, result: 'x' })), 0.1981);
+  assert.equal(grader.extractCostUsd(JSON.stringify({ total_cost_usd: 0 })), 0);     // free turn is a real 0
+  assert.equal(grader.extractCostUsd(JSON.stringify({ result: 'no cost field' })), null);
+  assert.equal(grader.extractCostUsd(JSON.stringify({ total_cost_usd: '0.5' })), null); // string, not a number
+  assert.equal(grader.extractCostUsd(JSON.stringify({ total_cost_usd: -1 })), null);    // negative rejected
+  assert.equal(grader.extractCostUsd('not json at all'), null);                         // partial/non-JSON stdout
+});
+
+test('#486 aggregatePanel sums worker cost_usd into panel_cost_usd (null → 0)', () => {
+  const mkWorker = (kind, cost) => ({
+    kind, name: kind, specialty: '', verdict: 'pass',
+    scores: { functional_fidelity: 9, code_quality: 9 },
+    issues: [], notes_md: '', confidence: 0.9, model: 'm', run_ms: 1,
+    cost_usd: cost, retried: false, error: null,
+  });
+  const res = grader.aggregatePanel([
+    mkWorker('narc', 0.2), mkWorker('quality', 0.3),
+    mkWorker('hacker', null), mkWorker('efficiency', 0.05), // null contributes 0
+  ]);
+  assert.ok(Math.abs(res.panel_cost_usd - 0.55) < 1e-9, `expected 0.55, got ${res.panel_cost_usd}`);
+  assert.ok(Math.abs(res.signals.panel_cost_usd - 0.55) < 1e-9, 'mirrored into signals');
+});
+
+test('#486 aggregateShots sums shot cost_usd into panel_cost_usd (trivial-diff path)', () => {
+  const mkShot = (cost) => ({
+    passed: true,
+    rubric_scores: { functional_fidelity: 9, code_quality: 9 },
+    signals: { confidence: 0.9, model: 'm', run_ms: 1, shot_index: 0 },
+    notes_md: '', issues: [], cost_usd: cost,
+  });
+  const res = grader.aggregateShots([mkShot(0.4), mkShot(0.1), mkShot(null)]); // null → 0
+  assert.ok(Math.abs(res.panel_cost_usd - 0.5) < 1e-9, `expected 0.5, got ${res.panel_cost_usd}`);
+});
+
+test('v2 buildPrompt: includes task title, description, value_summary, file list, diff', () => {
+  const prompt = grader.buildPrompt({
+    task: {
+      id: 42,
+      title: 'V3.R18 — Replace v1 grader',
+      description: 'Replace the v1 deterministic grader with a subagent.',
+      kind: 'feature',
+      discipline: 'engineering',
+      version_id: 'GDS-V3',
+    },
+    valueSummary: 'Subagent grader now gates credits.',
+    diff: 'diff --git a/foo b/foo\n+added\n',
+    changedFiles: ['src/bongos/grader.js', 'tests/grader.mjs'],
+  });
+  assert.match(prompt, /V3\.R18 — Replace v1 grader/);
+  assert.match(prompt, /Replace the v1 deterministic grader with a subagent/);
+  assert.match(prompt, /Subagent grader now gates credits/);
+  assert.match(prompt, /src\/bongos\/grader\.js/);
+  assert.match(prompt, /tests\/grader\.mjs/);
+  assert.match(prompt, /\+added/);
+  assert.match(prompt, /Output ONLY the JSON object/);
+});
+
+test('v2 buildPrompt: empty changedFiles is flagged as suspicious', () => {
+  const prompt = grader.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: '',
+    changedFiles: [],
+  });
+  assert.match(prompt, /no files changed.*suspicious/i);
+});
+
+test('v2 extractJson: pulls JSON from ```json fenced output', () => {
+  const wrapped = '```json\n{"functional_fidelity": 8, "code_quality": 7, "notes_md": "ok", "confidence": 0.8, "issues": []}\n```';
+  const parsed = grader.extractJson(wrapped);
+  assert.ok(parsed);
+  assert.equal(parsed.functional_fidelity, 8);
+});
+
+test('v2 extractJson: pulls JSON when subagent adds leading prose', () => {
+  const wrapped = 'Here is the grade:\n{"functional_fidelity": 9, "code_quality": 8, "notes_md": "good", "confidence": 0.9, "issues": []}\nThanks.';
+  const parsed = grader.extractJson(wrapped);
+  assert.ok(parsed);
+  assert.equal(parsed.functional_fidelity, 9);
+});
+
+test('v2 extractJson: malformed → null', () => {
+  assert.equal(grader.extractJson('totally not json'), null);
+  assert.equal(grader.extractJson(''), null);
+  assert.equal(grader.extractJson('{not valid'), null);
+});
+
+// #79 (#380): robustness against the cases the old first-'{'-to-last-'}' slice
+// mangled into a spurious parse_error.
+test('#79 extractJson: trailing prose after the object (with a stray brace) still parses', () => {
+  const r = grader.extractJson('{"verdict":"pass","code_quality":7}\n\nThat is my assessment. }');
+  assert.equal(r.verdict, 'pass');
+  assert.equal(r.code_quality, 7);
+});
+
+test('#79 extractJson: leading prose containing braces, then a fenced grade block', () => {
+  const r = grader.extractJson('Review notes (see {context}):\n```json\n{"functional_fidelity":9}\n```');
+  assert.equal(r.functional_fidelity, 9);
+});
+
+test('#79 extractJson: picks the grade-shaped object when an incidental object precedes it', () => {
+  const r = grader.extractJson('prefix {"unrelated":1} then the real one {"functional_fidelity":8,"code_quality":6}');
+  assert.equal(r.functional_fidelity, 8);
+  assert.equal(r.code_quality, 6);
+});
+
+test('#79 extractJson: an incidental {"verdict":...} in prose does NOT win over the real score object', () => {
+  const r = grader.extractJson('My verdict object {"verdict":"maybe"} — but the grade is {"functional_fidelity":7,"code_quality":8}');
+  assert.equal(r.functional_fidelity, 7);
+  assert.equal(r.code_quality, 8);
+});
+
+test('#79/#493 worker extractJson delegates to the shared robust extractor (panel path)', () => {
+  // The v4 panel uses each worker's extractJson — they must be the hardened
+  // shared one, not the old first-{-to-last-} copy. Trailing prose with a stray
+  // brace would have broken the copy.
+  for (const kind of ['narc', 'quality', 'hacker', 'efficiency']) {
+    const r = grader.WORKERS[kind].extractJson('{"functional_fidelity":8,"code_quality":7}\n\nThat is all. }');
+    assert.equal(r.functional_fidelity, 8, `${kind} should parse robustly`);
+    assert.equal(r.code_quality, 7);
+  }
+});
+
+test('#79 extractJson: clean JSON-only response is returned as-is', () => {
+  const r = grader.extractJson('{"functional_fidelity":10,"confidence":0.9}');
+  assert.equal(r.functional_fidelity, 10);
+  assert.equal(r.confidence, 0.9);
+});
+
+test('v2 validateAndScore: both axes above threshold → PASS', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 7,
+    notes_md: 'looks fine',
+    confidence: 0.85,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.grader_kind, 'subagent');
+  assert.equal(r.grader_version, grader.VERSION);
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 7);
+  assert.equal(r.score, 7.5); // blended (8+7)/2
+});
+
+test('v2 validateAndScore: functional_fidelity below threshold → FAIL', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 4,
+    code_quality: 9,
+    notes_md: 'did not implement description',
+    confidence: 0.9,
+    issues: [{ severity: 'blocker', file: 'foo.js', summary: 'missing impl' }],
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /functional_fidelity below/);
+  assert.equal(r.issues.length, 1);
+});
+
+test('v2 validateAndScore: code_quality below threshold → FAIL', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 9,
+    code_quality: 4,
+    notes_md: 'tons of dead code',
+    confidence: 0.9,
+    issues: [{ severity: 'major', file: 'bar.js', summary: 'unused fn' }],
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /code_quality below/);
+});
+
+test('v2 validateAndScore: low confidence → FAIL even with high scores', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 9,
+    code_quality: 9,
+    notes_md: 'can\'t really tell, description was vague',
+    confidence: 0.2,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /low confidence/i);
+});
+
+// #489 / finding #56: null confidence must NOT silently pass the gate.
+test('#489 validateAndScore: missing confidence → FAIL (not a silent gate-walk)', () => {
+  // A subagent that omits confidence entirely should fail, not slip through.
+  // High ff/cq do not save it — the gate requires confidence to be present.
+  const r = grader.validateAndScore({
+    functional_fidelity: 9,
+    code_quality: 9,
+    notes_md: 'great code but no confidence field',
+    issues: [],
+    // confidence: intentionally absent
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /confidence absent/i);
+  assert.equal(r.signals.confidence, null);
+});
+
+test('#489 validateAndScore: explicit null confidence → FAIL (same as absent)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 9,
+    code_quality: 9,
+    notes_md: 'explicit null',
+    confidence: null,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /confidence absent/i);
+});
+
+// #489 aggregateShots safety: a unanimousPASS result can never produce a null
+// confidenceMedian, because any shot that passes must now have non-null confidence.
+test('#489 aggregateShots unanimousPASS always has non-null median confidence', () => {
+  // Construct two shots that pass with real confidence values.
+  const mkPassShot = (conf) => ({
+    passed: true,
+    rubric_scores: { functional_fidelity: 9, code_quality: 9 },
+    signals: { confidence: conf, model: 'm', run_ms: 1, shot_index: 0 },
+    notes_md: '', issues: [], cost_usd: 0,
+  });
+  const res = grader.aggregateShots([mkPassShot(0.8), mkPassShot(0.9)]);
+  assert.equal(res.passed, true);
+  assert.ok(res.signals.confidence !== null, 'unanimousPASS must have non-null confidenceMedian');
+  assert.ok(typeof res.signals.confidence === 'number', 'confidenceMedian must be a number');
+});
+
+test('v2 validateAndScore: malformed input → passed=false, parse_error in signals', () => {
+  const r = grader.validateAndScore('not even json');
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.parse_error, true);
+  assert.equal(r.score, 0);
+});
+
+test('v2 validateAndScore: out-of-range scores → passed=false, schema_error', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 15,
+    code_quality: 8,
+    notes_md: 'oops',
+    confidence: 0.9,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('v2 validateAndScore: accepts JSON-string input', () => {
+  const r = grader.validateAndScore(JSON.stringify({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'great',
+    confidence: 0.9,
+    issues: [],
+  }));
+  assert.equal(r.passed, true);
+});
+
+test('v2 validateAndScore: issues array preserved + count in signals', () => {
+  const issues = [
+    { severity: 'minor', file: 'a.js', summary: 'nit' },
+    { severity: 'blocker', file: 'b.js', summary: 'broken' },
+  ];
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'see issues',
+    confidence: 0.9,
+    issues,
+  });
+  assert.equal(r.issues.length, 2);
+  assert.equal(r.signals.issue_count, 2);
+  assert.equal(r.issues[0].severity, 'minor');
+});
+
+test('v2 validateAndScore: just-at-threshold passes', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 6,
+    code_quality: 6,
+    notes_md: 'borderline',
+    confidence: 0.7,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.score, 6);
+});
+
+test('v2 validateAndScore: just-below-threshold fails', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 5.9,
+    code_quality: 9,
+    notes_md: 'near miss',
+    confidence: 0.9,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+});
+
+test('v2 validateAndScore: rubric_scores records the two gated axes plus advisory fields', () => {
+  // Phase 2.5 (#423) added security_score + efficiency_score to the
+  // rubric_scores shape (both null when not provided — advisory, additive).
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 7,
+    economy: 9,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  });
+  assert.deepEqual(
+    Object.keys(r.rubric_scores).sort(),
+    ['code_quality', 'code_quality_effective', 'economy', 'efficiency_score', 'functional_fidelity', 'security_score']
+  );
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 7);
+  assert.equal(r.rubric_scores.economy, 9);
+  assert.equal(r.rubric_scores.security_score, null);
+  assert.equal(r.rubric_scores.efficiency_score, null);
+});
+
+// ---------- economy axis (V3.R92 #353) — ADVISORY ----------
+
+test('economy: every grade records an economy sub-score', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8, economy: 5,
+    notes_md: 'ok', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.economy, 5);
+});
+
+test('economy: missing economy field → recorded as null, no penalty (back-compat)', () => {
+  // An older subagent output without an economy field must grade exactly as before.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 7,
+    notes_md: 'legacy output', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.economy, null);
+  // No penalty: effective quality equals raw code_quality.
+  assert.equal(r.rubric_scores.code_quality_effective, 7);
+  assert.equal(r.passed, true); // unchanged gate behaviour
+});
+
+test('economy: out-of-range economy → recorded as null, no penalty', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 7, economy: 42,
+    notes_md: 'bad economy', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.economy, null);
+  assert.equal(r.rubric_scores.code_quality_effective, 7);
+});
+
+test('economy: high economy (>= threshold) applies no quality nudge', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8, economy: 9,
+    notes_md: 'tight diff', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.code_quality_effective, 8); // no penalty
+  assert.equal(r.passed, true);
+});
+
+test('economy: low economy blends DOWN into code_quality_effective (advisory)', () => {
+  // economy 2, threshold 6 → penalty = (6-2)/2 = 2. cqEffective = 7-2 = 5.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 7, economy: 2,
+    notes_md: 'over-written', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.economy, 2);
+  assert.equal(r.rubric_scores.code_quality_effective, 5);
+  // ...but the effective value is the *only* thing that moves. Raw cq unchanged.
+  assert.equal(r.rubric_scores.code_quality, 7);
+});
+
+test('economy: a terrible economy does NOT hard-block when both gated axes pass', () => {
+  // This is the load-bearing advisory-first guarantee: economy alone can never
+  // fail a ship today. Both gated axes are >= threshold, economy is rock-bottom.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8, economy: 0,
+    notes_md: 'wildly over-abstracted but functionally correct',
+    confidence: 0.9, issues: [],
+  });
+  assert.equal(r.rubric_scores.economy, 0);
+  assert.equal(r.passed, true, 'economy must not independently hard-block (advisory first)');
+});
+
+test('economy: a great economy cannot rescue a failing gated axis', () => {
+  // economy never lifts quality; a sub-threshold code_quality still fails.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 4, economy: 10,
+    notes_md: 'tiny but broken', confidence: 0.9, issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /code_quality below/);
+});
+
+test('economy: gate still reads raw axes — identical to pre-economy behaviour', () => {
+  // Same inputs as the canonical "both axes above threshold → PASS" test, now
+  // with an economy field present. Pass/blended/score must be unchanged.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 7, economy: 6,
+    notes_md: 'looks fine', confidence: 0.85, issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.score, 7.5); // blended (8+7)/2 — economy does NOT enter the score
+});
+
+test('economy: buildPrompt asks for the economy axis and renders diff stats + est_minutes', () => {
+  const prompt = grader.buildPrompt({
+    task: { id: 7, title: 't', description: 'd', kind: 'feature', est_minutes: 90 },
+    valueSummary: 's',
+    diff: 'diff --git a/x b/x\n+1\n',
+    changedFiles: ['x'],
+    diffStats: { files_changed: 3, lines_added: 120, lines_removed: 40 },
+  });
+  assert.match(prompt, /economy/i);
+  assert.match(prompt, /"economy":\s+<number 0-10>/);
+  assert.match(prompt, /lines added: 120/);
+  assert.match(prompt, /lines removed: 40/);
+  assert.match(prompt, /files changed: 3/);
+  assert.match(prompt, /90 min/);
+});
+
+test('economy: buildPrompt degrades gracefully when diff stats are absent', () => {
+  const prompt = grader.buildPrompt({
+    task: { id: 7, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  assert.match(prompt, /diff stats unavailable/i);
+  assert.match(prompt, /not estimated/i);
+});
+
+test('v2 extractAssistantResult: unwraps claude -p JSON envelope', () => {
+  // What `claude -p --output-format json` returns.
+  const env = JSON.stringify({
+    type: 'result',
+    subtype: 'success',
+    result: '{"functional_fidelity": 8, "code_quality": 7, "notes_md": "ok", "confidence": 0.8, "issues": []}',
+    is_error: false,
+  });
+  const inner = grader.extractAssistantResult(env);
+  assert.equal(typeof inner, 'string');
+  const r = grader.validateAndScore(inner);
+  assert.equal(r.passed, true);
+});
+
+test('v2 extractAssistantResult: passes-through non-envelope output', () => {
+  // If the subagent didn't return a wrapper, just hand the raw text back.
+  const out = grader.extractAssistantResult('{"functional_fidelity":8,"code_quality":7,"notes_md":"","confidence":0.8,"issues":[]}');
+  const r = grader.validateAndScore(out);
+  assert.equal(r.passed, true);
+});
+
+// ========================================================================
+// v3 — cross-family selection + multi-shot aggregation (MAS Phase 1 / #395)
+// ========================================================================
+
+test('v3 selectGraderModel: builder Opus → grader Sonnet (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-7' }), 'claude-sonnet-4-6');
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-8' }), 'claude-sonnet-4-6');
+  assert.equal(grader.selectGraderModel({ builderModel: 'opus' }), 'claude-sonnet-4-6');
+});
+
+test('v3 selectGraderModel: builder Sonnet → grader Opus (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-sonnet-4-6' }), 'claude-opus-4-7');
+  assert.equal(grader.selectGraderModel({ builderModel: 'sonnet' }), 'claude-opus-4-7');
+});
+
+test('v3 selectGraderModel: builder Haiku → grader Opus', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-haiku-4-5-20251001' }), 'claude-opus-4-7');
+  assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-4-7');
+});
+
+test('selectGraderModel: missing builder → default Sonnet (assumed-Opus builder); explicit unknown THROWS (#117)', () => {
+  // No builderModel is the legitimate default path (the caller assumes the Opus
+  // builder per CLAUDE.md §2), so it resolves through the opus branch to Sonnet.
+  // This is the path the live callers — selectGraderModel({}) — take.
+  assert.equal(grader.selectGraderModel({}), 'claude-sonnet-4-6');
+  assert.equal(grader.selectGraderModel(), 'claude-sonnet-4-6');
+  // An explicitly-supplied unrecognized model is a misconfiguration: loud-throw
+  // instead of silently grading on the wrong cross-family assumption (#117).
+  assert.throws(() => grader.selectGraderModel({ builderModel: 'gpt-4' }), /unrecognized builder model/);
+  assert.throws(() => grader.selectGraderModel({ builderModel: 'llama-3' }), /unrecognized builder model/);
+});
+
+// --- aggregateShots: helpers ---
+
+function mkPassShot(ff, cq, conf, idx) {
+  return grader.validateAndScore({
+    functional_fidelity: ff,
+    code_quality: cq,
+    economy: 7,
+    notes_md: 'ok',
+    confidence: conf,
+    issues: [],
+  }, { model: 'claude-sonnet-4-6', shot_index: idx });
+}
+
+function mkFailShot(ff, cq, conf, idx, issues = []) {
+  return grader.validateAndScore({
+    functional_fidelity: ff,
+    code_quality: cq,
+    economy: 5,
+    notes_md: 'problems',
+    confidence: conf,
+    issues,
+  }, { model: 'claude-sonnet-4-6', shot_index: idx });
+}
+
+function mkErroredShot(idx) {
+  return {
+    score: 0,
+    passed: false,
+    threshold: 6,
+    grader_kind: 'subagent',
+    grader_version: 'v3.0',
+    rubric_scores: {},
+    signals: {
+      shot_index: idx,
+      model: 'claude-sonnet-4-6',
+      subprocess_error: 'SUBAGENT_TIMEOUT',
+    },
+    notes_md: 'timeout',
+    issues: [],
+  };
+}
+
+test('v3 aggregateShots: 3 unanimous PASS → passed=true, shot_aggregation=unanimous_pass', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.9, 0),
+    mkPassShot(8, 8, 0.85, 1),
+    mkPassShot(8, 8, 0.88, 2),
+  ]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.shot_aggregation, 'unanimous_pass');
+  assert.equal(r.grader_kind, 'subagent-multishot');
+  // aggregateShots is a legacy diagnostic path; it stamps grader_version
+  // with whatever the current rubric VERSION is (v4.0 today). Asserting
+  // against grader.VERSION rather than a hardcoded literal keeps this test
+  // valid through future bumps.
+  assert.equal(r.grader_version, grader.VERSION);
+  assert.equal(r.signals.pass_count, 3);
+  assert.equal(r.signals.fail_count, 0);
+  assert.equal(r.signals.error_count, 0);
+  assert.equal(r.signals.shot_count, 3);
+});
+
+test('v3 aggregateShots: 2 PASS + 1 FAIL → passed=false, disagreement', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.9, 0),
+    mkPassShot(8, 8, 0.85, 1),
+    mkFailShot(4, 7, 0.7, 2, [{ severity: 'blocker', file: 'foo', summary: 'broken' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.shot_aggregation, 'disagreement');
+  assert.equal(r.signals.pass_count, 2);
+  assert.equal(r.signals.fail_count, 1);
+});
+
+test('v3 aggregateShots: 2 PASS + 1 low-confidence → passed=false (low-conf is FAIL per-shot)', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.9, 0),
+    mkPassShot(8, 8, 0.85, 1),
+    mkPassShot(8, 8, 0.2, 2), // confidence below 0.4 → per-shot FAIL
+  ]);
+  assert.equal(r.passed, false);
+  // The third "shot" failed on confidence — counted as fail by per-shot validateAndScore.
+  assert.equal(r.signals.pass_count, 2);
+  assert.equal(r.signals.fail_count, 1);
+});
+
+test('v3 aggregateShots: all 3 FAIL → passed=false, unanimous_fail', () => {
+  const r = grader.aggregateShots([
+    mkFailShot(4, 5, 0.9, 0, [{ severity: 'blocker', file: 'a', summary: 'X' }]),
+    mkFailShot(5, 4, 0.85, 1, [{ severity: 'major', file: 'b', summary: 'Y' }]),
+    mkFailShot(3, 5, 0.88, 2, [{ severity: 'blocker', file: 'a', summary: 'X' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.shot_aggregation, 'unanimous_fail');
+  // Issues deduped across shots by (file, summary).
+  assert.equal(r.issues.length, 2);
+});
+
+test('v3 aggregateShots: any errored shot → passed=false, errored', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.9, 0),
+    mkPassShot(8, 8, 0.85, 1),
+    mkErroredShot(2),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.shot_aggregation, 'errored');
+  assert.equal(r.signals.error_count, 1);
+});
+
+test('v3 aggregateShots: shots=1 PASS → passes (back-compat with single-shot)', () => {
+  const r = grader.aggregateShots([mkPassShot(8, 8, 0.9, 0)]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.shot_aggregation, 'unanimous_pass');
+  assert.equal(r.signals.shot_count, 1);
+});
+
+test('v3 aggregateShots: median across shots for displayed rubric_scores', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(7, 6, 0.9, 0),
+    mkPassShot(9, 8, 0.9, 1),
+    mkPassShot(8, 7, 0.9, 2),
+  ]);
+  // Sorted ff = [7,8,9], median 8. Sorted cq = [6,7,8], median 7.
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 7);
+  // Blended median = (8+7)/2 = 7.5.
+  assert.equal(r.score, 7.5);
+});
+
+test('v3 aggregateShots: signals.shots[] preserves per-shot detail', () => {
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.9, 0),
+    mkPassShot(7, 9, 0.85, 1),
+    mkPassShot(9, 7, 0.88, 2),
+  ]);
+  assert.ok(Array.isArray(r.signals.shots));
+  assert.equal(r.signals.shots.length, 3);
+  assert.equal(r.signals.shots[0].ff, 8);
+  assert.equal(r.signals.shots[1].ff, 7);
+  assert.equal(r.signals.shots[2].ff, 9);
+  assert.equal(r.signals.shots[0].model, 'claude-sonnet-4-6');
+});
+
+test('v3 aggregateShots: signals.confidence populated as median across shots (regression for null→server-FAIL)', () => {
+  // Caught on the MAS Phase 1 self-ship (#395): aggregateShots did not set a
+  // top-level confidence, ship.js forwarded null to the server, and the
+  // server's validateAndScore hit Number(null)=0 → lowConfidence → FAIL
+  // despite a unanimous-PASS verdict. The fix populates signals.confidence
+  // as the median of per-shot confidences.
+  const r = grader.aggregateShots([
+    mkPassShot(8, 8, 0.72, 0),
+    mkPassShot(8, 8, 0.85, 1),
+    mkPassShot(8, 8, 0.72, 2),
+  ]);
+  assert.equal(r.signals.confidence, 0.72, 'median of [0.72, 0.85, 0.72] is 0.72');
+  assert.notEqual(r.signals.confidence, null, 'must not be null — ship.js forwards this to the server');
+});
+
+test('v3 validateAndScore: null confidence treated as ABSENT, not as low-confidence (regression for Number(null)=0)', () => {
+  // Original #395 fix: Number(null)===0 must NOT trigger the low-confidence gate.
+  // #489 update: absent confidence still fails, but via a distinct "confidence absent"
+  // path — NOT the "low confidence" path. The distinction matters: the #395 invariant
+  // (null ≠ numeric-zero) is preserved; the #489 invariant (absent → gate failure) is added.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'no confidence field set',
+    confidence: null,
+    issues: [],
+  });
+  // #489: absent confidence now fails, but NOT via the low-confidence message.
+  assert.equal(r.passed, false, 'absent confidence must now fail (#489)');
+  assert.match(r.notes_md, /confidence absent/i, 'must say "confidence absent", not "low confidence"');
+  assert.doesNotMatch(r.notes_md, /low confidence/i, '#395 invariant: null must not alias to numeric 0');
+  assert.equal(r.signals.confidence, null, 'confidence stays null in signals (truly absent)');
+});
+
+test('v3 validateAndScore: undefined confidence treated as ABSENT (same as null)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'no confidence field at all',
+    issues: [],
+    // confidence omitted entirely
+  });
+  // #489: absent (omitted) confidence fails with "confidence absent", not "low confidence".
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /confidence absent/i);
+  assert.doesNotMatch(r.notes_md, /low confidence/i);
+  assert.equal(r.signals.confidence, null);
+});
+
+test('v3 validateAndScore: explicit 0 confidence STILL FAILS (real low-confidence signal)', () => {
+  // Belt-and-braces: an explicit confidence: 0 from a real subagent IS a
+  // low-confidence signal and MUST still fail. The null fix doesn't change
+  // this — only null/undefined are treated as absent.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'totally unsure',
+    confidence: 0,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.confidence, 0);
+  assert.match(r.notes_md, /low confidence/i);
+});
+
+test('v3 buildPrompt: includes default-fail framing', () => {
+  const prompt = grader.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  // Adversarial framing markers.
+  assert.match(prompt, /default verdict is FAIL/i);
+  assert.match(prompt, /FIND WHAT IS WRONG/i);
+  // Failure-mode checklist markers.
+  assert.match(prompt, /TODOs.*FIXMEs/i);
+  assert.match(prompt, /Hardcoded shortcuts/i);
+  assert.match(prompt, /Scope gaps/i);
+  assert.match(prompt, /Demo \/ dummy/i);
+  // Sanity-check requirements.
+  assert.match(prompt, /PASS with no issues.*is suspicious/i);
+  assert.match(prompt, /FAIL with no issues.*is invalid/i);
+  // Default-fail reminder at the end.
+  assert.match(prompt, /Default-fail unless/i);
+});
+
+// ========================================================================
+// v4 — worker panel (MAS Phase 2.0 / #410)
+// ========================================================================
+
+// --- helpers ---
+
+function mkWorkerResult(kind, verdict, scores, confidence, issues = [], error = null) {
+  return {
+    kind,
+    name: kind,
+    specialty: 'x',
+    verdict,
+    scores,
+    issues,
+    notes_md: `${kind} ${verdict}`,
+    confidence,
+    model: 'claude-sonnet-4-6',
+    run_ms: 1000,
+    error,
+  };
+}
+
+// --- worker module surface ---
+
+test('v4 narc worker: exposes the expected contract', () => {
+  const narc = grader.WORKERS.narc;
+  assert.equal(narc.KIND, 'narc');
+  assert.equal(typeof narc.buildPrompt, 'function');
+  assert.equal(typeof narc.extractJson, 'function');
+  assert.equal(typeof narc.computeVerdict, 'function');
+  assert.match(narc.SPECIALTY, /semantic completion|completion/i);
+});
+
+test('v4 quality worker: exposes the expected contract', () => {
+  const q = grader.WORKERS.quality;
+  assert.equal(q.KIND, 'quality');
+  assert.equal(typeof q.buildPrompt, 'function');
+  assert.equal(typeof q.extractJson, 'function');
+  assert.equal(typeof q.computeVerdict, 'function');
+  assert.match(q.SPECIALTY, /code quality|quality/i);
+});
+
+test('v4 narc prompt: includes default-fail framing + AC walking instructions', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  assert.match(prompt, /Narc/);
+  assert.match(prompt, /default verdict is FAIL/i);
+  assert.match(prompt, /walk(ing)? .*acceptance criter/i);
+  assert.match(prompt, /ac_checklist/);
+});
+
+test('v4 quality prompt: includes default-fail framing + cq + economy', () => {
+  const prompt = grader.WORKERS.quality.buildPrompt({
+    task: { id: 1, title: 't', description: 'd', est_minutes: 60 },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+    diffStats: { files_changed: 1, lines_added: 10, lines_removed: 2 },
+  });
+  assert.match(prompt, /Quality/);
+  assert.match(prompt, /default verdict is FAIL/i);
+  assert.match(prompt, /code_quality/);
+  assert.match(prompt, /economy/);
+});
+
+// --- narc.computeVerdict ---
+
+test('v4 narc: all ACs satisfied + ff>=6 + conf>=0.4 → pass', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 8,
+    confidence: 0.85,
+    ac_checklist: [{ ac: 'A', status: 'satisfied', evidence: 'foo:1' }],
+    issues: [],
+    notes_md: 'verified',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+  assert.equal(v.scores.functional_fidelity, 8);
+});
+
+test('v4 narc: any missing AC → fail (even if ff was scored above threshold)', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 7,
+    confidence: 0.9,
+    ac_checklist: [
+      { ac: 'A', status: 'satisfied', evidence: 'foo' },
+      { ac: 'B', status: 'missing', evidence: '' },
+    ],
+    issues: [{ severity: 'blocker', file: 'foo', summary: 'missing B' }],
+    notes_md: 'B missing',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 narc Phase 2.0.5: diff-confirmed AC counts as satisfied (no Read needed) → pass', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 9,
+    confidence: 0.9,
+    ac_checklist: [
+      { ac: 'add X', status: 'diff-confirmed', evidence: '+function X()' },
+      { ac: 'add Y', status: 'diff-confirmed', evidence: '+function Y()' },
+    ],
+    issues: [],
+    notes_md: 'all visible in diff',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+  assert.equal(v.scores.functional_fidelity, 9);
+});
+
+test('v4 narc Phase 2.0.5: a few unverified-budget mixed with satisfied → still pass (neutral)', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 8,
+    confidence: 0.85,
+    ac_checklist: [
+      { ac: 'A', status: 'satisfied', evidence: 'foo:1' },
+      { ac: 'B', status: 'diff-confirmed', evidence: '+B' },
+      { ac: 'C', status: 'satisfied', evidence: 'bar:2' },
+      { ac: 'D', status: 'unverified-budget', evidence: '' },
+    ],
+    issues: [],
+    notes_md: 'mixed',
+  }, {});
+  assert.equal(v.verdict, 'pass', '1 of 4 unverified-budget should not dominate');
+});
+
+test('v4 narc Phase 2.0.5: majority unverified-budget → concerns (dominates)', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 7,
+    confidence: 0.85,
+    ac_checklist: [
+      { ac: 'A', status: 'satisfied', evidence: 'foo' },
+      { ac: 'B', status: 'unverified-budget', evidence: '' },
+      { ac: 'C', status: 'unverified-budget', evidence: '' },
+      { ac: 'D', status: 'unverified-budget', evidence: '' },
+    ],
+    issues: [],
+    notes_md: '3 of 4 unverified',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 narc Phase 2.0.5: out-of-scope ACs excluded from the verifiable-count denominator', () => {
+  // 1 of 2 verifiable (the 2 'out-of-scope' don't count) unverified-budget = 50%,
+  // NOT majority. Should stay pass.
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 8,
+    confidence: 0.85,
+    ac_checklist: [
+      { ac: 'A', status: 'satisfied', evidence: 'foo' },
+      { ac: 'B', status: 'unverified-budget', evidence: '' },
+      { ac: 'C', status: 'out-of-scope', evidence: 'description says X' },
+      { ac: 'D', status: 'out-of-scope', evidence: 'description says Y' },
+    ],
+    issues: [],
+    notes_md: '',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+});
+
+test('v4 narc Phase 2.0.5: prompt mentions Read budget + prefers diff', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  // Budget instructions visible
+  assert.match(prompt, /Read budget/i);
+  assert.match(prompt, /5 Read calls/);
+  // Prefer-diff guidance visible
+  assert.match(prompt, /Prefer the diff/i);
+  // New statuses listed
+  assert.match(prompt, /diff-confirmed/);
+  assert.match(prompt, /unverified-budget/);
+});
+
+test('v4 narc: any partial AC → concerns', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 7,
+    confidence: 0.85,
+    ac_checklist: [{ ac: 'A', status: 'partial', evidence: 'foo' }],
+    issues: [],
+    notes_md: 'partial',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 narc: ff < threshold → fail', () => {
+  const v = grader.WORKERS.narc.computeVerdict({
+    functional_fidelity: 4,
+    confidence: 0.9,
+    ac_checklist: [{ ac: 'A', status: 'satisfied' }],
+    issues: [],
+    notes_md: 'low score',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 narc: parse error → fail with error tag', () => {
+  const v = grader.WORKERS.narc.computeVerdict(null, {});
+  assert.equal(v.verdict, 'fail');
+  assert.equal(v.error, 'parse_error');
+});
+
+test('v4 narc: subprocess error → fail with error tag', () => {
+  const v = grader.WORKERS.narc.computeVerdict(null, { subprocess_error: 'SUBAGENT_TIMEOUT' });
+  assert.equal(v.verdict, 'fail');
+  assert.equal(v.error, 'SUBAGENT_TIMEOUT');
+});
+
+// --- quality.computeVerdict ---
+
+test('v4 quality: cq>=6 + economy>=6 + conf>=0.4 + no major+blocker → pass', () => {
+  const v = grader.WORKERS.quality.computeVerdict({
+    code_quality: 8,
+    economy: 7,
+    confidence: 0.85,
+    issues: [],
+    notes_md: 'clean',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+  assert.equal(v.scores.code_quality, 8);
+  assert.equal(v.scores.economy, 7);
+});
+
+test('v4 quality: blocker issue → fail', () => {
+  const v = grader.WORKERS.quality.computeVerdict({
+    code_quality: 8,
+    economy: 7,
+    confidence: 0.85,
+    issues: [{ severity: 'blocker', file: 'foo', summary: 'broken' }],
+    notes_md: 'has blocker',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 quality: cq < threshold → fail', () => {
+  const v = grader.WORKERS.quality.computeVerdict({
+    code_quality: 4, economy: 7, confidence: 0.9, issues: [], notes_md: '',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 quality: major issue → concerns', () => {
+  const v = grader.WORKERS.quality.computeVerdict({
+    code_quality: 7, economy: 7, confidence: 0.85,
+    issues: [{ severity: 'major', file: 'foo', summary: 'rough' }],
+    notes_md: 'major found',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 quality: low economy (advisory) → concerns even if cq passes', () => {
+  const v = grader.WORKERS.quality.computeVerdict({
+    code_quality: 8, economy: 3, confidence: 0.85, issues: [], notes_md: '',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+// --- aggregatePanel ---
+
+test('v4 aggregatePanel: all PASS → panel pass, forwarded confidence = median', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+  ]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.grader_kind, 'subagent-panel');
+  assert.equal(r.grader_version, grader.VERSION);
+  // median confidence of [0.80, 0.85] is 0.825
+  assert.equal(r.signals.confidence, 0.825);
+});
+
+test('v4 aggregatePanel: any CONCERNS → panel concerns, confidence = FALLTHROUGH_CONFIDENCE', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'concerns', { code_quality: 7, economy: 4 }, 0.75,
+      [{ severity: 'major', file: 'x', summary: 'rough' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'concerns');
+  assert.equal(r.signals.confidence, grader.FALLTHROUGH_CONFIDENCE);
+});
+
+test('v4 aggregatePanel: any FAIL → panel fail, confidence = 0', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'fail', { code_quality: 4 }, 0.75,
+      [{ severity: 'blocker', file: 'x', summary: 'broken' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'fail');
+  assert.equal(r.signals.confidence, 0);
+});
+
+test('v4 aggregatePanel: an errored GATING worker → panel concerns, manual-confirm (#126; not a hard fail)', () => {
+  // Updated from the pre-#126 expectation of 'fail': a crashed worker is
+  // MISSING SIGNAL, not a finding, so with no substantive failure it falls
+  // through to manual-confirm. (narc here is advisory per #481; quality is the
+  // gating worker that errored.)
+  // #943: this must be a PARTIAL outage — another gating worker (hacker) DID
+  // report — so it stays 'concerns'. If EVERY gating worker errored it would be
+  // the distinct 'unavailable' total-outage outcome instead (covered in
+  // tests/grader_panel.mjs). The earlier 2-worker panel had quality as the lone
+  // gating worker, which is by definition a total gating outage.
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'fail', {}, 0, [], 'parse_error'),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'concerns');
+  assert.equal(r.signals.error_count, 1);
+});
+
+test('v4 aggregatePanel: rubric_scores = median across workers that report each axis', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 9 }, 0.9),
+    mkWorkerResult('quality', 'pass', { code_quality: 7, economy: 8 }, 0.85),
+  ]);
+  assert.equal(r.rubric_scores.functional_fidelity, 9);
+  assert.equal(r.rubric_scores.code_quality, 7);
+  assert.equal(r.rubric_scores.economy, 8);
+  assert.equal(r.score, 8); // blended = (9 + 7) / 2 = 8
+});
+
+test('v4 aggregatePanel: signals.workers[] preserves the full per-worker audit trail', () => {
+  const workers = [
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+  ];
+  const r = grader.aggregatePanel(workers);
+  assert.ok(Array.isArray(r.signals.workers));
+  assert.equal(r.signals.workers.length, 2);
+  assert.equal(r.signals.workers[0].kind, 'narc');
+  assert.equal(r.signals.workers[1].kind, 'quality');
+  // pass/concerns/fail counts surface for dashboards
+  assert.equal(r.signals.pass_count, 2);
+  assert.equal(r.signals.fail_count, 0);
+  assert.equal(r.signals.concerns_count, 0);
+  assert.equal(r.signals.error_count, 0);
+});
+
+test('v4 aggregatePanel: issues deduped across workers by (kind, file, summary)', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'fail', { functional_fidelity: 4 }, 0.85,
+      [{ severity: 'blocker', file: 'foo.js', summary: 'X' }]),
+    mkWorkerResult('quality', 'fail', { code_quality: 4 }, 0.80,
+      [{ severity: 'blocker', file: 'foo.js', summary: 'X' }]),
+  ]);
+  // Same (file, summary) from two different workers should appear twice
+  // (different worker namespaces — issue origin matters)
+  assert.equal(r.issues.length, 2);
+  assert.equal(r.issues[0].worker, 'narc');
+  assert.equal(r.issues[1].worker, 'quality');
+});
+
+// --- #481: Narc is advisory in the gate ---
+
+test('v4 aggregatePanel (#481): a Narc CONCERNS is advisory — panel PASSES when gating workers pass', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'concerns', { functional_fidelity: 6 }, 0.7,
+      [{ severity: 'major', file: 'x', summary: 'AC quibble' }]),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 8 }, 0.85),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  // the Narc's lens still surfaces in the audit trail even though it didn't gate
+  assert.ok(r.issues.some((i) => i.worker === 'narc'));
+});
+
+test('v4 aggregatePanel (#481): a Narc FAIL downgrades to manual-confirm (CONCERNS), not a hard FAIL', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'fail', { functional_fidelity: 4 }, 0.8,
+      [{ severity: 'major', file: 'x', summary: 'scope gap' }]),
+    mkWorkerResult('quality', 'pass', { code_quality: 8 }, 0.85),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'concerns'); // manual-confirm, NOT a hard fail
+});
+
+test('v4 aggregatePanel (#481): a GATING worker FAIL still hard-FAILs regardless of the Narc', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 9 }, 0.9),
+    mkWorkerResult('quality', 'fail', { code_quality: 3 }, 0.8,
+      [{ severity: 'blocker', file: 'x', summary: 'broken' }]),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'fail');
+});
+
+test('v4 aggregatePanel (#481): an errored (missing-signal) Narc does not gate — gating workers govern', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'fail', {}, 0, [], 'parse_error'), // missing signal, advisory kind
+    mkWorkerResult('quality', 'pass', { code_quality: 8 }, 0.85),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, true); // a crashed advisory lens doesn't block a clean panel
+  assert.equal(r.signals.panel_outcome, 'pass');
+});
+
+test('v4 aggregatePanel (#481 defense-in-depth): a Narc carrying a BLOCKER issue is NOT advisory — it gates', () => {
+  // Guards the Hacker's #481 concern: a blocker-severity finding can never be
+  // silently downgraded to manual-confirm just because it came through an
+  // advisory-kind worker.
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'fail', { functional_fidelity: 2 }, 0.9,
+      [{ severity: 'blocker', file: 'auth.js', summary: 'ungated write route' }]),
+    mkWorkerResult('quality', 'pass', { code_quality: 8 }, 0.85),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.9),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 9 }, 0.9),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'fail'); // blocker hard-FAILs even from the Narc
+});
+
+// --- #465: runWorker auto-retries transient errors once ---
+
+// A minimal worker module: extractJson parses JSON; computeVerdict maps a
+// subprocess error / bad parse to the matching error tag, else echoes the
+// parsed verdict. Mirrors the real workers' error contract closely enough to
+// exercise runWorker's retry branch.
+function mkFakeWorker(kind = 'narc') {
+  return {
+    KIND: kind, NAME: kind, SPECIALTY: 'x',
+    buildPrompt: () => 'p',
+    extractJson: (raw) => { try { return JSON.parse(raw); } catch { return null; } },
+    computeVerdict: (parsed, meta) => {
+      if (meta.subprocess_error) return { verdict: 'fail', error: meta.subprocess_error, scores: {}, issues: [], confidence: 0 };
+      if (!parsed) return { verdict: 'fail', error: 'parse_error', scores: {}, issues: [], confidence: 0 };
+      return { verdict: parsed.verdict || 'pass', scores: parsed.scores || {}, issues: parsed.issues || [], confidence: parsed.confidence ?? 0.9, error: null };
+    },
+  };
+}
+const okJson = JSON.stringify({ verdict: 'pass', scores: { functional_fidelity: 8 }, confidence: 0.9 });
+
+await testAsync('v4 runWorker (#465): retries ONCE on parse_error, second (good) attempt wins', async () => {
+  let calls = 0;
+  const runSubagentFn = async () => { calls++; return { stdout: calls === 1 ? 'not-json' : okJson, run_ms: 10 }; };
+  const r = await grader.WORKERS.runWorker(mkFakeWorker(), { runSubagentFn });
+  assert.equal(calls, 2);
+  assert.equal(r.retried, true);
+  assert.equal(r.error, null);
+  assert.equal(r.verdict, 'pass');
+});
+
+await testAsync('v4 runWorker (#465): does NOT retry SUBAGENT_TIMEOUT (real budget signal)', async () => {
+  let calls = 0;
+  const runSubagentFn = async () => { calls++; throw Object.assign(new Error('t/o'), { code: 'SUBAGENT_TIMEOUT', run_ms: 240000 }); };
+  const r = await grader.WORKERS.runWorker(mkFakeWorker(), { runSubagentFn });
+  assert.equal(calls, 1); // no retry
+  assert.equal(r.retried, false);
+  assert.equal(r.error, 'SUBAGENT_TIMEOUT');
+});
+
+await testAsync('v4 runWorker (#465): does NOT retry a real (non-error) verdict', async () => {
+  let calls = 0;
+  const failJson = JSON.stringify({ verdict: 'fail', scores: { functional_fidelity: 3 }, confidence: 0.9 });
+  const runSubagentFn = async () => { calls++; return { stdout: failJson, run_ms: 10 }; };
+  const r = await grader.WORKERS.runWorker(mkFakeWorker(), { runSubagentFn });
+  assert.equal(calls, 1); // a real low-quality verdict is signal, not retried
+  assert.equal(r.retried, false);
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.error, null);
+});
+
+await testAsync('v4 runWorker (#465): one retry only — if the retry also errors, that error stands', async () => {
+  let calls = 0;
+  const runSubagentFn = async () => {
+    calls++;
+    if (calls === 1) return { stdout: 'not-json', run_ms: 10 };          // parse_error
+    throw Object.assign(new Error('exit 1'), { code: 'SUBAGENT_NONZERO_EXIT', run_ms: 10 }); // retry also fails
+  };
+  const r = await grader.WORKERS.runWorker(mkFakeWorker(), { runSubagentFn });
+  assert.equal(calls, 2); // exactly one retry, never more
+  assert.equal(r.retried, true);
+  assert.equal(r.error, 'SUBAGENT_NONZERO_EXIT');
+});
+
+// --- #467: per-worker timeouts + transient-error set + audit-exports core ---
+
+test('v4 #467: timeoutForWorker gives Read-heavy workers a longer budget', () => {
+  const tfw = grader.WORKERS.timeoutForWorker;
+  assert.equal(tfw({ KIND: 'narc' }, {}), 360000);
+  assert.equal(tfw({ KIND: 'quality' }, {}), 360000);
+  assert.equal(tfw({ KIND: 'hacker' }, {}), 240000);
+  assert.equal(tfw({ KIND: 'efficiency' }, {}), 240000);
+});
+
+test('v4 #467: an explicit module MAX_TIMEOUT_MS overrides the KIND map', () => {
+  const tfw = grader.WORKERS.timeoutForWorker;
+  assert.equal(tfw({ KIND: 'narc', MAX_TIMEOUT_MS: 120000 }, {}), 120000);
+});
+
+test('v4 #467: unlisted worker falls back to runOpts.timeoutMs', () => {
+  const tfw = grader.WORKERS.timeoutForWorker;
+  assert.equal(tfw({ KIND: 'mystery' }, { timeoutMs: 99000 }), 99000);
+});
+
+test('v4 #465/#467: TRANSIENT_WORKER_ERRORS covers infra noise but NOT timeout', () => {
+  const t = grader.WORKERS.TRANSIENT_WORKER_ERRORS;
+  for (const code of ['parse_error', 'schema_error', 'SUBAGENT_SPAWN_FAILED', 'SUBAGENT_NONZERO_EXIT']) {
+    assert.ok(t.has(code), `${code} should be retryable`);
+  }
+  assert.ok(!t.has('SUBAGENT_TIMEOUT'), 'timeout is a real budget signal, never retried');
+});
+
+test('v4 #467: audit-exports classifyExports — consumed / test-only / DEAD', () => {
+  const auditExports = require('../scripts/gds/audit-exports.js');
+  const target = '/repo/src/bongos/grader.js';
+  const corpus = {
+    [target]: 'function usedSym(){} function testSym(){} function deadSym(){}', // self — excluded
+    '/repo/src/server.js': 'grader.usedSym()',          // consumer in src/
+    '/repo/tests/grader.mjs': 'grader.testSym === 1',   // consumer only in tests/
+    // deadSym appears nowhere outside the defining file
+  };
+  const out = auditExports.classifyExports(target, ['usedSym', 'testSym', 'deadSym'], corpus);
+  const by = Object.fromEntries(out.map((r) => [r.name, r.status]));
+  assert.equal(by.usedSym, 'consumed');
+  assert.equal(by.testSym, 'test-only');
+  assert.equal(by.deadSym, 'DEAD');
+});
+
+test('v4 WORKERS.resolvePanel: unknown kind throws (typo catches don\'t silently skip)', () => {
+  assert.throws(() => grader.WORKERS.resolvePanel(['narc', 'nopenotreal']), /unknown worker kind/i);
+});
+
+// ========================================================================
+// v4 Phase 2.1 — Hacker worker (#416)
+// ========================================================================
+
+test('v4 hacker worker: exposes the expected contract', () => {
+  const h = grader.WORKERS.hacker;
+  assert.equal(h.KIND, 'hacker');
+  assert.equal(typeof h.buildPrompt, 'function');
+  assert.equal(typeof h.extractJson, 'function');
+  assert.equal(typeof h.computeVerdict, 'function');
+  assert.match(h.SPECIALTY, /security|red[- ]?team/i);
+});
+
+test('v4 hacker prompt: includes default-fail framing + security failure modes', () => {
+  const prompt = grader.WORKERS.hacker.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  assert.match(prompt, /Hacker/);
+  assert.match(prompt, /default verdict is FAIL/i);
+  // Failure modes by class
+  assert.match(prompt, /SQL.*injection/i);
+  assert.match(prompt, /[Cc]ommand injection/);
+  assert.match(prompt, /[Aa]uthn? \/ authz|requireRank|auth.*bypass/i);
+  assert.match(prompt, /[Hh]ardcoded secret/);
+  assert.match(prompt, /[Tt]rust[- ]boundary/);
+  // Severity ladder
+  assert.match(prompt, /critical/i);
+  assert.match(prompt, /[Hh]igh-severity/);
+  assert.match(prompt, /[Mm]edium-severity/);
+  // Read budget
+  assert.match(prompt, /5 Read calls/);
+  // New JSON fields
+  assert.match(prompt, /security_score/);
+  assert.match(prompt, /surfaces_checked/);
+});
+
+// --- hacker.computeVerdict ---
+
+test('v4 hacker: clean security (sec>=6, no blocker, conf>=0.4) → pass', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 9,
+    confidence: 0.9,
+    surfaces_checked: [
+      { kind: 'route', where: 'src/bongos/routes/x.js:42', verdict: 'ok' },
+    ],
+    issues: [],
+    notes_md: 'auth wrapper present on the new route',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+  assert.equal(v.scores.security_score, 9);
+});
+
+test('v4 hacker: blocker (critical/high) issue → fail', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 3,
+    confidence: 0.9,
+    surfaces_checked: [{ kind: 'db_write', where: 'foo:1', verdict: 'flagged' }],
+    issues: [{ severity: 'blocker', file: 'foo.js', summary: 'unparameterized SQL — concatenates req.body.id' }],
+    notes_md: 'sql injection in new route',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 hacker: security_score below threshold → fail', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 4, confidence: 0.9, surfaces_checked: [], issues: [], notes_md: '',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 hacker: medium-severity issue (major) → concerns', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 7,
+    confidence: 0.85,
+    surfaces_checked: [],
+    issues: [{ severity: 'major', file: 'auth.js', summary: 'MD5 used for non-password hashing — should be SHA-256' }],
+    notes_md: 'defense-in-depth gap',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 hacker: low-severity (minor) → pass (hardening note only)', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 8,
+    confidence: 0.9,
+    surfaces_checked: [{ kind: 'route', where: 'foo:1', verdict: 'ok' }],
+    issues: [{ severity: 'minor', file: 'foo.js', summary: 'consider rate-limiting on this public endpoint' }],
+    notes_md: 'small hardening recommendation',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+});
+
+test('v4 hacker: low confidence → concerns even with clean scores', () => {
+  const v = grader.WORKERS.hacker.computeVerdict({
+    security_score: 8,
+    confidence: 0.2,
+    surfaces_checked: [],
+    issues: [],
+    notes_md: 'large diff touched auth.js — couldn\'t fully evaluate within budget',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 hacker: subprocess error → fail with error tag', () => {
+  const v = grader.WORKERS.hacker.computeVerdict(null, { subprocess_error: 'SUBAGENT_TIMEOUT' });
+  assert.equal(v.verdict, 'fail');
+  assert.equal(v.error, 'SUBAGENT_TIMEOUT');
+});
+
+// --- 3-worker panel ---
+
+test('v4 aggregatePanel: 3-worker unanimous PASS → panel pass + security_score recorded', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.90),
+  ]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.signals.worker_count, 3);
+  // security_score appears in rubric_scores for the audit trail
+  assert.equal(r.rubric_scores.security_score, 9);
+});
+
+test('v4 aggregatePanel: 3-worker — Hacker fails, blocks the ship', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+    mkWorkerResult('hacker', 'fail', { security_score: 3 }, 0.90,
+      [{ severity: 'blocker', file: 'auth.js', summary: 'authn bypass' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'fail');
+  assert.equal(r.signals.fail_count, 1);
+});
+
+// ========================================================================
+// v4 Phase 2.2 — Efficiency Monger worker (#421)
+// ========================================================================
+
+test('v4 efficiency worker: exposes the expected contract', () => {
+  const e = grader.WORKERS.efficiency;
+  assert.equal(e.KIND, 'efficiency');
+  assert.equal(typeof e.buildPrompt, 'function');
+  assert.equal(typeof e.extractJson, 'function');
+  assert.equal(typeof e.computeVerdict, 'function');
+  assert.match(e.SPECIALTY, /runtime|performance|hot[- ]?path/i);
+});
+
+test('v4 efficiency prompt: includes default-fail framing + runtime-cost failure modes', () => {
+  const prompt = grader.WORKERS.efficiency.buildPrompt({
+    task: { id: 1, title: 't', description: 'd', est_minutes: 60 },
+    valueSummary: 's',
+    diff: 'd',
+    changedFiles: ['x'],
+  });
+  assert.match(prompt, /Efficiency Monger/);
+  assert.match(prompt, /default verdict is FAIL/i);
+  // Failure mode classes
+  assert.match(prompt, /N\+1/);
+  assert.match(prompt, /O\(n²\)|O\(n\^?2\)/);
+  assert.match(prompt, /[Ss]ync I\/O/);
+  // Distinct-from-economy framing
+  assert.match(prompt, /diff size/i);
+  assert.match(prompt, /runtime cost/i);
+  // Read budget
+  assert.match(prompt, /5 Read calls/);
+  // New JSON fields
+  assert.match(prompt, /efficiency_score/);
+  assert.match(prompt, /expensive_patterns_checked/);
+});
+
+// --- efficiency.computeVerdict ---
+
+test('v4 efficiency: clean runtime (eff>=6, no blocker, conf>=0.4) → pass', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict({
+    efficiency_score: 9,
+    confidence: 0.9,
+    expensive_patterns_checked: [
+      { kind: 'loop', where: 'foo:1', verdict: 'ok', note: 'bounded by config' },
+    ],
+    issues: [],
+    notes_md: 'hot path checked',
+  }, {});
+  assert.equal(v.verdict, 'pass');
+  assert.equal(v.scores.efficiency_score, 9);
+});
+
+test('v4 efficiency: blocker (N+1, O(n²), sync-I/O-on-hot-path) → fail', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict({
+    efficiency_score: 3,
+    confidence: 0.9,
+    expensive_patterns_checked: [{ kind: 'query', where: 'foo:1', verdict: 'flagged', note: 'N+1' }],
+    issues: [{ severity: 'blocker', file: 'foo.js', summary: 'N+1 query in request handler loop' }],
+    notes_md: 'per-request N+1',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 efficiency: efficiency_score below threshold → fail', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict({
+    efficiency_score: 4, confidence: 0.9, expensive_patterns_checked: [], issues: [], notes_md: '',
+  }, {});
+  assert.equal(v.verdict, 'fail');
+});
+
+test('v4 efficiency: medium-severity (major) → concerns', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict({
+    efficiency_score: 7,
+    confidence: 0.85,
+    expensive_patterns_checked: [],
+    issues: [{ severity: 'major', file: 'q.js', summary: 'missing index on WHERE column' }],
+    notes_md: 'index gap',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 efficiency: low confidence → concerns', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict({
+    efficiency_score: 8,
+    confidence: 0.2,
+    expensive_patterns_checked: [],
+    issues: [],
+    notes_md: 'large diff — could not establish call frequency for new function within budget',
+  }, {});
+  assert.equal(v.verdict, 'concerns');
+});
+
+test('v4 efficiency: subprocess error → fail with error tag', () => {
+  const v = grader.WORKERS.efficiency.computeVerdict(null, { subprocess_error: 'SUBAGENT_TIMEOUT' });
+  assert.equal(v.verdict, 'fail');
+  assert.equal(v.error, 'SUBAGENT_TIMEOUT');
+});
+
+// --- 4-worker panel ---
+
+test('v4 aggregatePanel: 4-worker unanimous PASS → panel pass + all 4 score axes recorded', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.90),
+    mkWorkerResult('efficiency', 'pass', { efficiency_score: 8 }, 0.85),
+  ]);
+  assert.equal(r.passed, true);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.signals.worker_count, 4);
+  // All 4 score axes appear in rubric_scores
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 8);
+  assert.equal(r.rubric_scores.economy, 7);
+  assert.equal(r.rubric_scores.security_score, 9);
+  assert.equal(r.rubric_scores.efficiency_score, 8);
+});
+
+test('v4 aggregatePanel: 4-worker — Efficiency Monger fails, blocks the ship', () => {
+  const r = grader.aggregatePanel([
+    mkWorkerResult('narc', 'pass', { functional_fidelity: 8 }, 0.85),
+    mkWorkerResult('quality', 'pass', { code_quality: 8, economy: 7 }, 0.80),
+    mkWorkerResult('hacker', 'pass', { security_score: 9 }, 0.90),
+    mkWorkerResult('efficiency', 'fail', { efficiency_score: 3 }, 0.90,
+      [{ severity: 'blocker', file: 'q.js', summary: 'N+1 in hot path' }]),
+  ]);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.panel_outcome, 'fail');
+  assert.equal(r.signals.fail_count, 1);
+});
+
+// ========================================================================
+// v4 Phase 2.5 — server audit gap fix (#423)
+// ========================================================================
+// validateAndScore is what the server runs on the POST body. After Phases
+// 2.1 + 2.2, the local aggregatePanel computed security_score +
+// efficiency_score but the server-recorded rubric_scores didn't include
+// them because the POST body didn't forward them AND validateAndScore
+// didn't read them. Phase 2.5 closes both halves.
+
+test('v4 Phase 2.5: validateAndScore accepts security_score → recorded in rubric_scores', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    economy: 7,
+    security_score: 9,
+    notes_md: 'panel forwarded by ship.js',
+    confidence: 0.85,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.security_score, 9);
+  // The gate is UNCHANGED — only ff + cq drive pass/fail.
+  assert.equal(r.score, 8); // blended = (8+8)/2
+});
+
+test('v4 Phase 2.5: validateAndScore accepts efficiency_score → recorded in rubric_scores', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    economy: 7,
+    efficiency_score: 7,
+    notes_md: 'panel forwarded',
+    confidence: 0.85,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.efficiency_score, 7);
+});
+
+test('v4 Phase 2.5: validateAndScore accepts both new fields together', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    economy: 7,
+    security_score: 9,
+    efficiency_score: 8,
+    notes_md: 'full panel',
+    confidence: 0.85,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.security_score, 9);
+  assert.equal(r.rubric_scores.efficiency_score, 8);
+});
+
+test('v4 Phase 2.5: missing security_score + efficiency_score → recorded as null (back-compat)', () => {
+  // Legacy callers (Phase 2.0 era or v3 single-shot diagnostics) that
+  // don't include the new fields must grade EXACTLY as before.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8,
+    code_quality: 8,
+    notes_md: 'no new fields',
+    confidence: 0.85,
+    issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.security_score, null);
+  assert.equal(r.rubric_scores.efficiency_score, null);
+});
+
+test('v4 Phase 2.5: out-of-range security_score → recorded as null, no penalty', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8,
+    security_score: 42, // out of range
+    notes_md: 'bad input', confidence: 0.85, issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.security_score, null);
+});
+
+test('v4 Phase 2.5: low security_score does NOT independently fail (advisory only)', () => {
+  // The gate is unchanged: only ff + cq drive pass/fail. A low security_score
+  // is recorded for trending but doesn't gate the ship by itself. Hacker's
+  // per-worker verdict drives the panel gate via confidence-forwarding —
+  // that path is exercised in the aggregatePanel tests, not here.
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8, security_score: 2,
+    notes_md: '', confidence: 0.85, issues: [],
+  });
+  assert.equal(r.passed, true, 'security_score is advisory at validateAndScore — does NOT hard-block');
+  assert.equal(r.rubric_scores.security_score, 2);
+});
+
+test('v4 Phase 2.5: low efficiency_score does NOT independently fail (advisory only)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 8, code_quality: 8, efficiency_score: 2,
+    notes_md: '', confidence: 0.85, issues: [],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.efficiency_score, 2);
+});
+
+// ---------- v4.1 trivial-diff fast-path (#513) ----------
+
+test('isTrivialDiff: small static front-end diff (CSS) → true', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      // the hall surface carved to modules/hall-ui/public/ in BV1.R85
+      changedFiles: ['modules/hall-ui/public/styles.css'],
+      diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+    }),
+    true
+  );
+});
+
+test('isTrivialDiff: executable front-end (JS, HTML, SVG) is NEVER trivial (#513 Hacker)', () => {
+  // The #506 case (a copy string inside modules/hall-ui/public/builders.js) now
+  // correctly takes the full panel: a path+size heuristic can't tell a copy
+  // tweak from an XSS / client-authz regression. HTML and SVG are executable
+  // too (inline <script>, on* handlers), so they get the panel as well.
+  for (const f of [
+    'modules/hall-ui/public/builders.js', 'public/game/main.js', 'modules/status-ui/public/app.mjs',
+    'public/index.html', 'modules/hall-ui/public/welcome.htm', 'public/assets/icon.svg',
+  ]) {
+    assert.equal(
+      grader.isTrivialDiff({ changedFiles: [f], diffStats: { files_changed: 1, lines_added: 1, lines_removed: 1 } }),
+      false,
+      `${f} must not be trivial (executable front-end)`
+    );
+  }
+});
+
+test('isTrivialDiff: docs/markdown-only diff → true', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['docs/architecture.md', 'README.md'],
+      diffStats: { files_changed: 2, lines_added: 6, lines_removed: 2 },
+    }),
+    true
+  );
+});
+
+test('isTrivialDiff: a logic-path file (src/) → false even when small', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['src/bongos/routes/tasks.js'],
+      diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+    }),
+    false
+  );
+});
+
+test('isTrivialDiff: scripts/ and tests/ are logic paths → false', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['scripts/gds/smoke-write.sh'],
+      diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+    }),
+    false
+  );
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['tests/grader.mjs'],
+      diffStats: { files_changed: 1, lines_added: 3, lines_removed: 0 },
+    }),
+    false
+  );
+});
+
+test('isTrivialDiff: config/data files (.json/.yaml/.env) are NOT trivial (#513 Hacker)', () => {
+  for (const f of ['public/config.json', 'modules/hall-ui/public/settings.yaml', 'public/.env']) {
+    assert.equal(
+      grader.isTrivialDiff({ changedFiles: [f], diffStats: { files_changed: 1, lines_added: 2, lines_removed: 0 } }),
+      false,
+      `${f} must not be trivial (config/data)`
+    );
+  }
+});
+
+test('isTrivialDiff: oversized diff (too many lines) → false', () => {
+  // Use a trivial-eligible extension so this exercises the SIZE gate, not the
+  // extension gate.
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['public/styles.css'],
+      diffStats: { files_changed: 1, lines_added: 40, lines_removed: 0 },
+    }),
+    false
+  );
+});
+
+test('isTrivialDiff: too many files → false', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['docs/a.md', 'docs/b.md', 'docs/c.md', 'docs/d.md'],
+      diffStats: { files_changed: 4, lines_added: 4, lines_removed: 0 },
+    }),
+    false
+  );
+});
+
+test('isTrivialDiff: mix of copy + logic path → false (any logic path disqualifies)', () => {
+  assert.equal(
+    grader.isTrivialDiff({
+      changedFiles: ['docs/x.md', 'src/a.js'],
+      diffStats: { files_changed: 2, lines_added: 4, lines_removed: 0 },
+    }),
+    false
+  );
+});
+
+test('isTrivialDiff: missing diffStats → false (fail-safe to full panel)', () => {
+  assert.equal(grader.isTrivialDiff({ changedFiles: ['docs/x.md'], diffStats: null }), false);
+  assert.equal(grader.isTrivialDiff({ changedFiles: ['docs/x.md'] }), false);
+});
+
+test('isTrivialDiff: empty changed-files or zero-line diff → false', () => {
+  assert.equal(
+    grader.isTrivialDiff({ changedFiles: [], diffStats: { files_changed: 0, lines_added: 0, lines_removed: 0 } }),
+    false
+  );
+  assert.equal(
+    grader.isTrivialDiff({ changedFiles: ['docs/x.md'], diffStats: { files_changed: 1, lines_added: 0, lines_removed: 0 } }),
+    false
+  );
+});
+
+// ---------- Summary ----------
+
+console.log('');
+console.log(`Grader tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);