@bongos/core 1.17.0

package/modules/economy/routes/cost.js

@@ -0,0 +1,97 @@
+const express = require('express');
+// Carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2): auth gates + request
+// validators reach through the published doorway; the cost_log writer is an
+// intra-module require — a module never requires a core internal.
+const api = require('../../../src/module-api');
+const cost = require('../cost');
+const { validateOrRespond, LIMITS } = api;
+
+const COST_CATEGORIES = ['api', 'compute', 'infra', 'domain', 'art', 'other'];
+
+module.exports = function buildCostRouter() {
+  const router = express.Router();
+
+  // rank: any-builder — log cost on own claim (idempotent via source/source_ref).
+  router.post('/cost', api.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      task_id: { type: 'integer', min: 1 },
+      amount_usd: { required: true, type: 'number', min: 0, max: 1000000 },
+      // Don't enum-restrict category — the existing skills set categories that
+      // may legitimately drift; just cap the length. (CLAUDE.md mentions
+      // api|compute|infra|domain|art|other as the canonical set.)
+      category: { required: true, type: 'string', maxLength: 64, minLength: 1 },
+      description: { type: 'string', maxLength: LIMITS.NOTES },
+      source: { type: 'string', maxLength: LIMITS.SOURCE },
+      source_ref: { type: 'string', maxLength: LIMITS.SOURCE_REF },
+      recorded_at: { type: 'string', maxLength: 64 },
+      // System 1 / task 1344: optional per-tier USD split (cost_log columns
+      // added by migration 123). session-cost.js sends these so spend can be
+      // attributed by tier (cache_read is the marathon sink). Omitted → NULL.
+      fresh_input_usd: { type: 'number', min: 0, max: 1000000 },
+      cache_read_usd: { type: 'number', min: 0, max: 1000000 },
+      cache_write_usd: { type: 'number', min: 0, max: 1000000 },
+      output_usd: { type: 'number', min: 0, max: 1000000 },
+      // V3.R11 (#91): builder_id is optional. When absent we default to the
+      // authed builder (the right answer 99% of the time). When provided it
+      // must match the authed builder — we don't let one builder attribute
+      // spend to another. Archons could in theory be allowed to override
+      // (e.g. for backfill), but the only existing backfill path is
+      // scripts/gds/backfill-cost.js, which runs as Lars (archon) and reads
+      // the historical ledger that had no builder_id anyway. Keep the rule
+      // tight; relax later if/when a real cross-builder use case appears.
+      builder_id: { type: 'integer', min: 1 },
+      // task #385 / migration 181: which skill invocation incurred this cost.
+      skill_name: { type: 'string', maxLength: 64 },
+    })) return;
+    const { task_id: taskId, amount_usd: amountUsd, category, description, source, source_ref: sourceRef, recorded_at: recordedAt, builder_id: bodyBuilderId,
+      fresh_input_usd: freshInputUsd, cache_read_usd: cacheReadUsd, cache_write_usd: cacheWriteUsd, output_usd: outputUsd,
+      skill_name: skillName } = req.body || {};
+    const authedBuilderId = Number(req.builder?.id);
+    let builderId = authedBuilderId || null;
+    if (bodyBuilderId != null) {
+      const requested = Number(bodyBuilderId);
+      if (!Number.isFinite(requested) || requested <= 0) {
+        return res.fail('bad_builder_id', 400);
+      }
+      if (requested !== authedBuilderId) {
+        return res.fail('builder_id_mismatch', { status: 403, message: 'builder_id must match the authenticated builder' });
+      }
+      builderId = requested;
+    }
+    let recordedAtDate = null;
+    if (recordedAt) {
+      const parsed = new Date(recordedAt);
+      if (Number.isNaN(parsed.getTime())) {
+        return res.fail('bad_recorded_at', 400);
+      }
+      recordedAtDate = parsed;
+    }
+    try {
+      const out = await cost.logCost({
+        taskId: taskId ?? null,
+        amountUsd,
+        category,
+        description: description ?? null,
+        source: source ?? 'manual',
+        sourceRef: sourceRef ?? null,
+        recordedAt: recordedAtDate,
+        builderId,
+        freshInputUsd: freshInputUsd ?? null,
+        cacheReadUsd: cacheReadUsd ?? null,
+        cacheWriteUsd: cacheWriteUsd ?? null,
+        outputUsd: outputUsd ?? null,
+        skillName: skillName ?? null,
+      });
+      if (!out) {
+        // ON CONFLICT skipped: same (source, source_ref) already logged. Idempotent.
+        return res.status(200).json({ skipped: true, reason: 'duplicate_source_ref' });
+      }
+      res.status(201).json({ id: out.id, recorded_at: out.recorded_at });
+    } catch (err) {
+      console.error('[gds] POST /cost', err);
+      res.fail('cost_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/economy/routes/leaderboard.js

@@ -0,0 +1,26 @@
+const express = require('express');
+// Carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2): the leaderboard query
+// is an intra-module require — a module never requires a core internal. The
+// pagination helpers reach through the published doorway.
+const api = require('../../../src/module-api');
+const credits = require('../credits');
+
+module.exports = function buildLeaderboardRouter() {
+  const router = express.Router();
+
+  // rank: public — leaderboard mirrors the public /public/leaderboard surface;
+  // preserved unauthenticated to match current production behavior.
+  router.get('/leaderboard', async (req, res) => {
+    // task 1750: top 100 — the hall Leaderboard view pages through these, and the
+    // "#N on the leaderboard" standing stat needs ranks beyond the top 20.
+    // R14 (#2001 / ADR 0119): honor ?limit=&offset= via the shared helper; the
+    // default 100 preserves the prior ceiling. The list is small + SQL-LIMIT'd, so
+    // fetch offset+limit and slice; `page` is additive (readers of .leaderboard
+    // are unchanged).
+    const { limit, offset } = api.parsePagination(req, { defaultLimit: 100, maxLimit: 200 });
+    const rows = await credits.leaderboard(offset + limit);
+    res.json({ leaderboard: rows.slice(offset, offset + limit), page: api.pageMeta(limit, offset) });
+  });
+
+  return router;
+};

package/modules/economy/routes/reward.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// The economy module's kernel PORT registration (BV1.R77 / ADR 0093 §1-2).
+//
+// economy exposes its credit-allocation + gamification + cost/leaderboard READ
+// surface as the `reward` kernel PORT. CORE files that must NOT import a module
+// resolve it instead:
+//   • the LIFECYCLE (db.applyGrade/confirmTask/claimTask/
+//     upsertSessionRecordWithReward) — credit allocation + the claim/ship
+//     gamification hooks, each passing its tx `client` (transaction-participant);
+//   • the core read routes (routes/me.js, routes/public.js, routes/builders.js,
+//     routes/sessions.js) — cost rollups, the leaderboard, achievement getters,
+//     streak previews, and the budget setter.
+// All reach economy WITHOUT importing it by resolving the `reward` kernel PORT
+// this factory registers (ADR 0093 §2: keep the state machine whole, extract the
+// capability behind a seam). The provider IS the economy module's reward surface.
+//
+// Why a route factory for a routeless capability: `mountModuleRoutes` (the loader)
+// is the one boot hook that runs BOTH in the live server AND whenever a test
+// rebuilds the GDS router — so registering here (not in a poller) is what keeps
+// the port present for the route-building tests too. Registration is
+// hasProvider-guarded so re-instantiation never trips the seam's single-provider
+// duplicate guard. (Mirrors modules/grading/routes/grade.js.)
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const reward = require('../reward');
+
+function registerSeams() {
+  if (!api.hasProvider('reward')) {
+    api.registerProvider('reward', reward);
+  }
+}
+
+module.exports = function buildRewardRouter() {
+  registerSeams();
+  // No HTTP surface — the reward capability is a pure kernel port. The empty
+  // router is only the loader's contributes.routes mount vehicle; returning a
+  // valid express.Router() keeps mountModuleRoutes' `router.use(sub)` happy
+  // without exposing any endpoint.
+  return express.Router();
+};

package/modules/economy/streak.js

@@ -0,0 +1,285 @@
+'use strict';
+
+// Streak math + anti-gaming guards (PMS-V2 #52, criterion 3).
+//
+// Definitions (locked in PMS-V2 planning, see limitations/pms-v2.md):
+//   - A "ship-day" = a local-builder-timezone calendar day in which the builder
+//     shipped >=1 qualifying task.
+//   - A "qualifying ship" requires:
+//       * claim.outcome = 'shipped'           (builder declared done)
+//       * task.status IN ('confirmed','shipped')  (verification passed; credits landed)
+//       * task.est_minutes >= 15              (anti-gaming floor)
+//     NOTE: cleanup/refactor tasks DO now count (V3.R93 #354). The original
+//     PMS-V2 rule excluded kind='cleanup', which mildly penalized the exact
+//     simplification work we want to reward. That exclusion was removed in both
+//     the SQL below and the wouldExtendStreak guard; the only anti-gaming floor
+//     that remains is est_minutes >= 15.
+//   - Cap: at most 5 qualifying ships per local-day count toward streak (so you
+//     can't pad a streak by shipping micro-tasks). Note: since one calendar day
+//     is one ship-day regardless of count, the 5-cap doesn't change ship-day
+//     identification — it's a guard that's surfaced honestly in the per-day
+//     counts the API returns (and that future "qualifying ships" features can
+//     use to throttle credit recognition).
+//   - Current streak = consecutive ship-days ending today (in the builder's
+//     timezone). If today is NOT a ship-day, current streak = 0. Strict.
+//   - Longest streak = the longest run of consecutive ship-days ever.
+//
+// SOURCE of ship events: claims (joined to tasks) — NOT session_logs. The
+// session_logs row for a just-finishing ship is INSERTed AFTER evaluateAfterShip
+// runs in resolveClaim, so it's invisible at evaluator time. The claim row,
+// however, has already been UPDATEd to outcome='shipped' + released_at=now()
+// and the task to status='confirmed' before the evaluator fires, so claims+tasks
+// gives us a stable, in-transaction view.
+//
+// Caller contract:
+//   - Pass a `client` for in-transaction calls (achievements evaluator path).
+//   - Pass `pool` for out-of-transaction calls (HTTP /me/streak path).
+// Either works — both have .query().
+
+// Carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2): reach the shared pool
+// through the published doorway — a module never requires a core internal.
+const { pool } = require('../../src/module-api');
+
+// -------------------------------------------------------------------------
+// Core query — pulls a builder's qualifying ship-days in their local TZ.
+// Caps each calendar day at 5 ships (anti-gaming).
+//
+// Returns: { ship_days: [{ local_date: 'YYYY-MM-DD', count: int (1..5) }],
+//            timezone: 'America/...' }
+// Sorted by local_date ASC.
+// -------------------------------------------------------------------------
+async function qualifyingShipDays(client, builderId) {
+  const sql = `
+    WITH builder_tz AS (
+      SELECT timezone FROM builders WHERE id = $1
+    ),
+    qualifying AS (
+      SELECT c.released_at,
+             ((c.released_at AT TIME ZONE (SELECT timezone FROM builder_tz))::date) AS local_date
+        FROM claims c
+        JOIN tasks t ON t.id = c.task_id
+       WHERE c.builder_id = $1
+         AND c.outcome = 'shipped'
+         AND c.released_at IS NOT NULL
+         AND t.status IN ('confirmed', 'shipped')
+         AND t.est_minutes >= 15
+    ),
+    ranked AS (
+      SELECT local_date,
+             ROW_NUMBER() OVER (PARTITION BY local_date ORDER BY released_at) AS rn
+        FROM qualifying
+    ),
+    capped AS (
+      SELECT local_date, COUNT(*)::int AS cnt
+        FROM ranked
+       WHERE rn <= 5
+       GROUP BY local_date
+    )
+    SELECT to_char(local_date, 'YYYY-MM-DD') AS local_date,
+           cnt,
+           (SELECT timezone FROM builder_tz) AS timezone
+      FROM capped
+      ORDER BY local_date
+  `;
+  const { rows } = await client.query(sql, [builderId]);
+  if (rows.length === 0) {
+    // We still want the builder's timezone for downstream "today" math.
+    const { rows: tzRows } = await client.query(
+      'SELECT timezone FROM builders WHERE id = $1',
+      [builderId]
+    );
+    return {
+      ship_days: [],
+      timezone: tzRows[0]?.timezone || 'America/New_York',
+    };
+  }
+  return {
+    ship_days: rows.map((r) => ({ local_date: r.local_date, count: Number(r.cnt) })),
+    timezone: rows[0].timezone,
+  };
+}
+
+// -------------------------------------------------------------------------
+// "Today" in the builder's local timezone, formatted as 'YYYY-MM-DD'.
+// Pulled from Postgres so the same clock the qualifying-ships query used
+// is used here (no JS-vs-DB clock drift, no host-TZ surprises).
+// -------------------------------------------------------------------------
+async function todayInBuilderTz(client, builderId) {
+  const { rows } = await client.query(
+    `SELECT to_char((now() AT TIME ZONE timezone)::date, 'YYYY-MM-DD') AS today
+       FROM builders WHERE id = $1`,
+    [builderId]
+  );
+  return rows[0]?.today || null;
+}
+
+// -------------------------------------------------------------------------
+// Pure helpers (no DB) — walk a sorted ascending list of YYYY-MM-DD strings
+// and compute current + longest streak relative to "today" string.
+// -------------------------------------------------------------------------
+function ymdToOrdinal(ymd) {
+  // 'YYYY-MM-DD' → integer day-number suitable for diffing.
+  // Using Date.UTC so DST has no effect (we're comparing whole local days).
+  const [y, m, d] = ymd.split('-').map(Number);
+  return Math.floor(Date.UTC(y, m - 1, d) / 86400000);
+}
+
+function computeRunsFromShipDays(shipDayStrs, todayStr) {
+  if (!shipDayStrs || shipDayStrs.length === 0) {
+    return { current_streak: 0, longest_streak: 0, last_ship_day: null };
+  }
+  const ords = shipDayStrs.map(ymdToOrdinal);
+  const todayOrd = todayStr ? ymdToOrdinal(todayStr) : null;
+
+  // Longest run: walk and count consecutive (diff==1) values.
+  let longest = 1;
+  let run = 1;
+  for (let i = 1; i < ords.length; i++) {
+    if (ords[i] === ords[i - 1] + 1) {
+      run++;
+      if (run > longest) longest = run;
+    } else if (ords[i] === ords[i - 1]) {
+      // duplicate — shouldn't happen given GROUP BY, but stay defensive
+      continue;
+    } else {
+      run = 1;
+    }
+  }
+
+  // Current run: streak ending TODAY (strict). If today is not a ship-day,
+  // current_streak = 0.
+  let current = 0;
+  if (todayOrd !== null) {
+    const lastOrd = ords[ords.length - 1];
+    if (lastOrd === todayOrd) {
+      current = 1;
+      for (let i = ords.length - 2; i >= 0; i--) {
+        if (ords[i] === ords[i + 1] - 1) {
+          current++;
+        } else {
+          break;
+        }
+      }
+    }
+  }
+
+  return {
+    current_streak: current,
+    longest_streak: longest,
+    last_ship_day: shipDayStrs[shipDayStrs.length - 1],
+  };
+}
+
+// -------------------------------------------------------------------------
+// Public: computeStreak(builderId, [client])
+// -------------------------------------------------------------------------
+async function computeStreak(builderId, client) {
+  const c = client || pool;
+  const [{ ship_days, timezone }, today] = await Promise.all([
+    qualifyingShipDays(c, builderId),
+    todayInBuilderTz(c, builderId),
+  ]);
+  const dayStrs = ship_days.map((d) => d.local_date);
+  const runs = computeRunsFromShipDays(dayStrs, today);
+  // Find when the current run started (for UI display + 'streak began' hint)
+  let current_started_on = null;
+  if (runs.current_streak > 0) {
+    const lastOrd = ymdToOrdinal(today);
+    const startOrd = lastOrd - (runs.current_streak - 1);
+    const ms = startOrd * 86400000;
+    const dt = new Date(ms);
+    const y = dt.getUTCFullYear();
+    const m = String(dt.getUTCMonth() + 1).padStart(2, '0');
+    const d = String(dt.getUTCDate()).padStart(2, '0');
+    current_started_on = `${y}-${m}-${d}`;
+  }
+  return {
+    current_streak: runs.current_streak,
+    longest_streak: runs.longest_streak,
+    last_ship_day: runs.last_ship_day,
+    current_started_on,
+    timezone,
+    today,
+    ship_day_counts: ship_days, // useful for debug / future UI
+  };
+}
+
+// -------------------------------------------------------------------------
+// Public: wouldExtendStreak(builderId, taskId, [client])
+//
+// Preview helper: "if this task were shipped right now (qualifying), what
+// would the streak become?" Used by /me to render hints like
+// "shipping #52 would extend your streak to 4 days".
+//
+// Returns: { current_streak, projected_streak, qualifies, reason? }
+//   qualifies = false when task doesn't meet est_minutes>=15. (As of V3.R93
+//   #354 kind='cleanup' is NO LONGER a disqualifier — cleanup/refactor ships
+//   count toward streaks like any other ship.)
+//   reason explains why (rendered by CLI).
+// -------------------------------------------------------------------------
+async function wouldExtendStreak(builderId, taskId, client) {
+  const c = client || pool;
+  const cur = await computeStreak(builderId, c);
+
+  const { rows: taskRows } = await c.query(
+    'SELECT id, kind, est_minutes FROM tasks WHERE id = $1',
+    [taskId]
+  );
+  const task = taskRows[0];
+  if (!task) {
+    return { current_streak: cur.current_streak, projected_streak: cur.current_streak,
+             qualifies: false, reason: 'task-not-found' };
+  }
+  if ((task.est_minutes ?? 0) < 15) {
+    return { current_streak: cur.current_streak, projected_streak: cur.current_streak,
+             qualifies: false, reason: 'est_minutes<15' };
+  }
+  // V3.R93 (#354): kind='cleanup' used to disqualify here. It no longer does —
+  // cleanup/refactor ships count toward streaks. The only remaining floor is
+  // est_minutes >= 15 above.
+
+  // Project: today becomes (or stays) a ship-day.
+  const todayOrd = ymdToOrdinal(cur.today);
+  const ords = cur.ship_day_counts.map((d) => ymdToOrdinal(d.local_date));
+
+  if (cur.current_streak > 0) {
+    // Already shipped today → today already counted. Streak doesn't change
+    // from another ship today (one calendar day = one ship-day).
+    return {
+      current_streak: cur.current_streak,
+      projected_streak: cur.current_streak,
+      qualifies: true,
+      reason: 'today-already-counted',
+    };
+  }
+
+  // current_streak = 0 means today is NOT yet a ship-day. Shipping now adds today.
+  // Find run length ending at yesterday.
+  let runEndingYesterday = 0;
+  if (ords.length > 0) {
+    const lastOrd = ords[ords.length - 1];
+    if (lastOrd === todayOrd - 1) {
+      runEndingYesterday = 1;
+      for (let i = ords.length - 2; i >= 0; i--) {
+        if (ords[i] === ords[i + 1] - 1) runEndingYesterday++;
+        else break;
+      }
+    }
+  }
+  return {
+    current_streak: cur.current_streak,
+    projected_streak: runEndingYesterday + 1,
+    qualifies: true,
+    reason: runEndingYesterday > 0 ? 'extends-yesterday-run' : 'starts-new-run',
+  };
+}
+
+module.exports = {
+  computeStreak,
+  wouldExtendStreak,
+  // Exported for testing
+  qualifyingShipDays,
+  todayInBuilderTz,
+  ymdToOrdinal,
+  computeRunsFromShipDays,
+};

package/modules/grading/CLAUDE.md

@@ -0,0 +1,42 @@
+# `grading` module — the grade-a-diff adversarial panel + the `grade` kernel port
+
+> The **second CORE-domain** carved into a module (BV1.R73, [ADR 0091](../../docs/adr/<redacted>.md) §1+§4) — after memory (R72). It is the carve that proves ADR 0091 §4's load-bearing pattern: **keep the lifecycle state machine whole, extract the capability it invokes behind a kernel seam.** The lifecycle no longer imports the grader directly; it resolves a `grade` PORT this module registers.
+
+Owns the **quality gate**: the v4 adversarial worker panel (Narc / Quality / Hacker / Efficiency, unanimous-PASS), the deterministic pre-passes (route-rank + permission-path, run as panel inputs), and the scoring **rubric**. `default: true` in `module.json` — every instance grades its own ships, so it mounts unconditionally unless explicitly disabled.
+
+## The boundary (the one rule)
+
+This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.6.0` — it needs the R73 doorway additions: `routeRankCheck`, `permissionPathCheck`, `llmCache`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches grading only through the `grade` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks; R70's `kernel-imports-no-domain` check keeps the kernel from reaching back in.
+
+## The `grade` kernel PORT (ADR 0091 §4 — the headline of this carve)
+
+- **Provides — port `grade`** → the grader module surface. Registered in `routes/grade.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider duplicate guard).
+- **Core consumes it WITHOUT importing this module:**
+  - `routes/tasks.js` (the LIFECYCLE ship path, `POST /tasks/:id/grade`) resolves it via `seams.resolveOptional('grade')` and calls `grade.validateAndScore(...)` then `grade.serverSideGuards(...)`. A grading-disabled instance gets a clean `503 grading_unavailable` instead of a thrown `resolve()`.
+  - `routes/public.js` (`GET /public/grades`) resolves it the same way and reads `grade.RUBRIC.{threshold,version}`, falling back to `null` when grading is off.
+- This replaced the former `const grader = require('../grader')` core→domain import in both files — the edge ADR 0091 §4 set out to sever.
+
+Why a route factory for a module with **no HTTP routes**: `mountModuleRoutes` is the only loader hook that runs both in the live server and when a test rebuilds the GDS router, so it's where the port registration belongs. The factory returns an empty `express.Router()` purely as the mount vehicle.
+
+## Files
+
+| File | What |
+|---|---|
+| `grader.js` | the quality gate (~86 KB): v4 adversarial panel + `validateAndScore`/`serverSideGuards`/`gradeSubagent`/`RUBRIC`. The deterministic pre-passes reach `routeRankCheck`/`permissionPathCheck` through the doorway; `runSubagentCached` wraps spawns in the doorway's `llmCache`. |
+| `grader-workers/` | the four worker modules (`narc`/`quality`/`hacker`/`efficiency`) + shared kit (`fence`, `worker-prompt`, `worker-verdict`, `rubric`, `extract-json`, `index`). All intra-module relative requires — unchanged by the move. |
+| `grader-rubric.json` | the single-source scoring rubric (thresholds, per-worker config). Read by `grader.js` + `grader-workers/rubric.js` via `__dirname`-relative paths — survives the move. |
+| `routes/grade.js` | registers the `grade` port (above); no HTTP endpoint. |
+
+## NOT in this module (deliberately left in core)
+
+- **`cascade-dispatch.js`** — stays in `src/bongos/`. It is dormant System 3 (model-tier dispatch, `OTB_AUTONOMY_ENABLED`-gated; nothing calls it but its mock unit test), and its real dependencies are core `task-classifier` (lifecycle) + `skill-prefs` (builder-settings), **not** the grader (the grader is an injected `runner`, never imported). Moving it would force two gratuitous doorway domain-leaks (`classifyTaskKind`, `skill-prefs.getForBuilder`) for capabilities grading never uses — the "ceremony with no boundary benefit" ADR 0091 §Alternatives rejects. It stays a core lib (scoped to `grading` in `module-scope-map.js`) until autonomy/dispatch is carved (tranche 2). The grading scope-map glob lists it as a core file, not part of this dir.
+- **`scripts/gds/grade-smoke.js`** + the other grading-owned CLIs — a command travels with its domain but stays under `scripts/gds/` (the memory-carve precedent). They `require('../../modules/grading/grader')`.
+- **`llm-cache.js`** — shared LLM-cost infra core also uses (`routes/llm-cache.js`, the cost scripts); it stays core and is exposed to this module on the doorway as `api.llmCache` (a tracked R70 leak).
+
+## Tables
+
+None owned. The grade-attempt rows (`grades`, `grade_attempts`, …) are written by core `db.applyGrade` on the lifecycle side; grading only computes the verdict the route then persists. No `modules/grading/migrations/` yet.
+
+## Tests
+
+`tests/grader.mjs`, `tests/grader_panel.mjs`, `tests/grader_prompt_fencing.mjs`, `tests/grade_server_authoritative.mjs`, `tests/grade_unavailable_display.mjs` import from `modules/grading/…`. `tests/cascade-dispatch.mjs` still imports `src/bongos/cascade-dispatch.js` (it stayed core). `scripts/gds/grade-smoke.js` is the live panel smoke.

package/modules/grading/db.js

@@ -0,0 +1,39 @@
+// modules/grading/db.js — the grading module's db slice (ADR 0102).
+//
+// The grade-TREND read (`builderRollingAvgGrade`) carved from the core db.js
+// residue so the published doorway (a KERNEL_FILE) stops importing `./gds/db` —
+// the last tranche-2 kernel→domain leak (fitness Check 12 / ADR 0091 §1).
+//
+// It reads `task_grades` (grading domain). Two consumers reach it through the
+// `grade.builderRollingAvgGrade` seam port: core me.js's profile aggregator and
+// the sessions module's BFG scorer. Both degrade to a zero-grade shape when this
+// module is off (a vanilla instance). Reaches `pool` through the doorway.
+//
+// The old core copy interpolated a shared `gradePassCount` SQL fragment (a
+// documented twin with lifecycle/db.js); that one-liner is inlined here so this
+// slice carries no cross-file fragment dependency.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const { pool } = api;
+
+// Rolling grade stats for a builder over the last `days`: { n, avg_score, n_passed }.
+// Windows by graded_at; `shipped_by` attributes the grade to the builder who did
+// the work. Returns a zero row when the builder has no grades in the window.
+async function builderRollingAvgGrade(builderId, days = 14) {
+  const { rows } = await pool.query(
+    `SELECT
+       COUNT(*)::int                                            AS n,
+       COALESCE(AVG(g.score), 0)::numeric(3,1)                  AS avg_score,
+       COALESCE(SUM(CASE WHEN g.passed THEN 1 ELSE 0 END), 0)::int AS n_passed
+       FROM task_grades g
+       JOIN tasks t ON t.id = g.task_id
+      WHERE t.shipped_by = $1
+        AND g.graded_at >= now() - ($2 || ' days')::interval`,
+    [builderId, String(days)]
+  );
+  return rows[0] || { n: 0, avg_score: 0, n_passed: 0 };
+}
+
+module.exports = { builderRollingAvgGrade };