@bongos/core 1.19.1033 → 1.19.1034

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2048,
-    "unique_ids": 1750,
-    "certain": 2048,
+    "strings": 2052,
+    "unique_ids": 1754,
+    "certain": 2052,
     "heuristic": 0,
     "duplicate_ids": 211
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 102,
-      "strings": 1547
+      "strings": 1551
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1181,8 +1181,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:360",
-        "modules/hall-ui/public/deploy.js:472"
+        "modules/hall-ui/public/deploy.js:395",
+        "modules/hall-ui/public/deploy.js:507"
       ]
     },
     {
@@ -2305,7 +2305,7 @@
       "surface": "builders-hall",
       "text": "(checked {…})",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 256,
+      "line": 291,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3709,7 +3709,7 @@
       "surface": "builders-hall",
       "text": "Checked against {…} — nothing blocks this move.{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 259,
+      "line": 294,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3736,7 +3736,7 @@
       "surface": "builders-hall",
       "text": "Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can take a couple of minutes.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 248,
+      "line": 283,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4537,7 +4537,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 414,
+      "line": 449,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4546,7 +4546,7 @@
       "surface": "builders-hall",
       "text": "Could not read what this would bring in: {…}. The check below still applies.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 333,
+      "line": 368,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4996,7 +4996,7 @@
       "surface": "builders-hall",
       "text": "Database behind.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 378,
+      "line": 413,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6602,6 +6602,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "4ef9f2a4df3b",
+      "surface": "builders-hall",
+      "text": "If you own this project,",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 250,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "b6c47d4ee42c",
       "surface": "builders-hall",
@@ -7507,7 +7516,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 360,
+      "line": 395,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7516,10 +7525,19 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 472,
+      "line": 507,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "a851e4dc141b",
+      "surface": "builders-hall",
+      "text": "Moved {…}, and the box confirmed it. The project’s repository on GitHub still names the old core, so changes pushed there may not reach the live site until the two match.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 216,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "393139f648b8",
       "surface": "builders-hall",
@@ -7867,7 +7885,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 450,
+      "line": 485,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7894,7 +7912,7 @@
       "surface": "builders-hall",
       "text": "No shipped work is recorded between core {…} and {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 340,
+      "line": 375,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8002,7 +8020,7 @@
       "surface": "builders-hall",
       "text": "Not checked yet — the runner takes this reading on its own tick.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 254,
+      "line": 289,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8191,7 +8209,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 395,
+      "line": 430,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8236,7 +8254,16 @@
       "surface": "builders-hall",
       "text": "Now running core {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 211,
+      "line": 226,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "21cb60a8a96a",
+      "surface": "builders-hall",
+      "text": "Now running core {…} — but GitHub was not updated.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 216,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9919,7 +9946,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 221,
+      "line": 256,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10000,7 +10027,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 398,
+      "line": 433,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10549,7 +10576,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 506,
+      "line": 541,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -11503,7 +11530,7 @@
       "surface": "builders-hall",
       "text": "The upgrade checked {…} and refused:{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 264,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11836,7 +11863,7 @@
       "surface": "builders-hall",
       "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 378,
+      "line": 413,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11845,7 +11872,7 @@
       "surface": "builders-hall",
       "text": "This restarts {…} onto core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 360,
+      "line": 395,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11890,7 +11917,7 @@
       "surface": "builders-hall",
       "text": "This would fail.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 264,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12322,7 +12349,7 @@
       "surface": "builders-hall",
       "text": "What this brings in",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 349,
+      "line": 384,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12682,7 +12709,7 @@
       "surface": "builders-hall",
       "text": "You can still press Move — the runner will refuse it the same way, and the box is left where it is.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 264,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13897,7 +13924,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 221,
+      "line": 256,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14392,7 +14419,16 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 454,
+      "line": 489,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "8d810f134b7b",
+      "surface": "builders-hall",
+      "text": "reconnect GitHub with repository access",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 250,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15832,7 +15868,7 @@
       "surface": "builders-hall",
       "text": "— moved {…}, and the box confirmed it.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 211,
+      "line": 226,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15922,7 +15958,7 @@
       "surface": "builders-hall",
       "text": "— {…} {…} of work landed between core {…} and {…}{…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 349,
+      "line": 384,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15958,7 +15994,7 @@
       "surface": "builders-hall",
       "text": "…and {…} more, not listed.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 347,
+      "line": 382,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2544,6 +2544,8 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.1032 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1031 with no explicit bump. run 36192968150. (task 1002620)
   1.19.1033 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.1032 with no explicit bump. run 36194601014. (task 1002620)
+        landed since 1.19.1032 with no explicit bump. run 36214617025. (task 1002620)
+  1.19.1034 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1033 with no explicit bump. run 36215757254. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/local-dev.md

@@ -2,7 +2,7 @@
 
 > The one-command path from a freshly-cloned **standalone instance repo** (one whose
 > `config/branding.json` points at `http://localhost:<port>`) to a running, signed-in
-> instance on your Mac. This is the local counterpart of `bongos onboard` (which
+> instance on your Mac, Linux or Windows machine. This is the local counterpart of `bongos onboard` (which
 > stands an instance up in the **cloud**) — see [ADR 0149](../adr/0149-bongos-dev-local-launcher.md).
 
 ## TL;DR
@@ -26,8 +26,50 @@ it is safe (idempotent). Stop it with `bongos dev stop`.
   brew install postgresql@16
   brew services start postgresql@16   # bongos dev will also try to start it for you
   ```
-- macOS or Linux (migrations use `bash`). On **Windows**, use WSL, or the Docker path in
-  [`self-host.md`](self-host.md).
+- macOS, Linux or Windows. On **Windows**, see the next section.
+
+## On Windows
+
+`bongos dev` runs natively on Windows (task 1002707). You need two installs, both one-time:
+
+1. **Git for Windows** — [git-scm.com/download/win](https://git-scm.com/download/win). It
+   includes **Git Bash**, which `bongos dev` uses to run the migrations. You can run
+   `bongos dev` itself from Git Bash, PowerShell or Command Prompt.
+2. **PostgreSQL** — the installer from
+   [postgresql.org/download/windows](https://www.postgresql.org/download/windows/). Keep the
+   default port (5432), and **note the password** it asks you to choose for the `postgres`
+   user. You do not need to add anything to PATH: `bongos dev` finds the installed tools
+   itself.
+
+Then tell `bongos dev` that password and run it:
+
+```powershell
+# PowerShell
+$env:PGPASSWORD = "<the password you chose>"
+npx bongos dev
+```
+
+```bash
+# Git Bash
+PGPASSWORD="<the password you chose>" npx bongos dev
+```
+
+To keep the password for next time, run `setx PGPASSWORD "<the password you chose>"` once
+and open a new terminal.
+
+What is different on Windows, and why:
+
+- **The Postgres user is `postgres`.** The Windows installer creates only that one user, so
+  `bongos dev` uses it unless you set `PGUSER`. It never stops at a password prompt: a
+  missing or wrong password stops with a message saying what to set.
+- **Postgres runs as a Windows service** (`postgresql-x64-<version>`), which normally starts
+  with Windows. If it is stopped, `bongos dev` tries to start it. Starting a service needs an
+  Administrator terminal; otherwise press Win+R, type `services.msc`, find the service, and
+  click Start.
+- **WSL's bash is not used.** `C:\Windows\System32\bash.exe` runs Linux, which cannot reach a
+  Windows Postgres, so `bongos dev` looks for Git Bash instead.
+- **Docker is the fallback.** If you would rather not install Postgres or Git, the Docker
+  path in [`self-host.md`](self-host.md) runs everything in containers.
 
 ## What `bongos dev` does (and why it's needed)
 

package/docs/recipes/packaging-the-core.md

@@ -46,7 +46,7 @@ If the no-leak gate fails, it names the file + the residual literal. Fix the red
 
 Two standing gates keep "a published core boots clean from a bare install" honest (task [#1002221](https://example.com/builders#/task/1002221), audit H1/H2):
 
-- **`node scripts/gds/run-unit-tests.js --integration`** — the integration-smoke gate. Runs the heavier integration set (longer per-test budget), including [`tests/consumer_layout_boot.mjs`](../../tests/consumer_layout_boot.mjs), which packages the core, `npm install`s the `.tgz`, and boots `/healthz` from the real consumer layout. Run it per release / on a schedule in an env that provides the services (network, and — for the deeper DB leg tracked as a follow-up — Postgres). The default `run-unit-tests.js` (no flag) stays the fast DB-free unit gate and *excludes* this set.
+- **`node scripts/gds/run-unit-tests.js --integration`** — the integration-smoke gate. Runs the heavier integration set (longer per-test budget), including [`tests/consumer_layout_boot.mjs`](../../tests/consumer_layout_boot.mjs), which packages the core, `npm install`s the `.tgz`, and boots `/healthz` from the real consumer layout. Since task 1002863 it also carries the database half: it installs the unpacked package from its **own shipped lockfile** with `npm ci`, runs `npm run migrate` from the consumer onto a brand-new **empty** database (and onto a second one with every optional module switched on), then boots the installed server against the first and reads a sentinel row back through `GET /api/bongos/public/versions`. It creates and drops those databases itself, so it needs a Postgres whose role may `CREATE DATABASE`; without one it prints SKIP lines, except under `CI=true`, where a missing Postgres fails the run. The `integration` job of [`.github/workflows/integration.yml`](../../.github/workflows/integration.yml) runs this set on every push to `main` (not per PR — a cost decision recorded in that file). The default `run-unit-tests.js` (no flag) stays the fast DB-free unit gate and *excludes* this set.
 - **[`tests/pruned_lockfile_integrity.mjs`](../../tests/pruned_lockfile_integrity.mjs)** — a network-free unit guard (runs in the default gate every PR) that rebuilds the shipped pruned lockfile and asserts every registry package keeps a **well-formed, verbatim `integrity` hash**. This is the exact R88 regression (redaction once blanked those base64 hashes → `npm ci` could no longer verify) caught before a consumer's install ever fails.
 
 ## Consume + pin it (the R85 side)

package/modules/autonomy/cadence.js

@@ -50,6 +50,30 @@ const CLASSES = ['progress', 'quiet', 'stopped', 'transient', 'systemic', 'unwor
 // Only these advance the failure count toward `probing`.
 const COUNTS_AS_FAILURE = new Set(['transient', 'systemic']);
 
+// WORKER_RAN_FLOOR_S — below this, a worker did not do any work (task 1004179).
+//
+// A real Claude Code session that read a brief, touched a repo and produced a
+// verdict does not finish in seconds. The observed broken shape was 2s with no
+// cost recorded at all. The floor is generous on purpose: it only has to
+// separate "the process died on startup" from "a session ran", and being wrong
+// in the permissive direction costs one extra iteration, while being wrong in
+// the strict direction would call a fast legitimate run breakage.
+const WORKER_RAN_FLOOR_S = 30;
+
+// workerNeverRan — the supervisor already decided the worker FAILED; this asks
+// whether it ever started. Both conditions are required: a worker that burned
+// real time or real tokens and then failed DID run and met something, which is
+// a different fact that this must not swallow.
+function workerNeverRan(row = {}) {
+  if (row.outcome !== 'worker_failed') return false;
+  if (row.spawn_error) return true;   // it could not even be launched
+  const cost = Number(row.cost_usd);
+  const spentNothing = !Number.isFinite(cost) || cost <= 0;
+  const dur = Number(row.duration_s);
+  const tooFast = Number.isFinite(dur) && dur < WORKER_RAN_FLOOR_S;
+  return spentNothing && tooFast;
+}
+
 // SYSTEMIC_MARKERS — substrings that mean waiting will not help.
 //
 // A heuristic over an error string, which is a thing to be uneasy about, so the
@@ -86,6 +110,33 @@ function classifyEvent(row = {}) {
     // counting it as such would hold a broken runner at full speed indefinitely.
     if (row.verified === true) return { class: 'progress', detail: 'a task shipped and the ledger confirms it' };
     if (row.ledger_shape === 'undetermined') return { class: 'transient', detail: 'the ledger could not be read back' };
+    // DID THE WORKER ACTUALLY RUN? (task 1004179, found by the 1003907 proof run.)
+    //
+    // Everything below this line assumes a worker that ran and met a real
+    // obstacle — a grader refusal, a red main, a task it could not finish. That
+    // is genuinely quiet: the machine is fine, a blocker was filed, the task is
+    // out of the pool, and moving to the next one is right.
+    //
+    // A worker that never got going is the opposite, and it was landing in the
+    // same bucket. On the Windows host every worker exited in ~2s with "worker
+    // output was not JSON" because its argv was corrupted; each run filed a
+    // blocker, parked a task, and was classed `quiet` — which neither trips nor
+    // forgives the failure count. consecutive_failures stayed 0, the mode stayed
+    // `full`, and the runner would have worked through the entire allowlisted
+    // goal at one task per five minutes, parking every one of them, while the
+    // hall showed it alive and allowed to work. It got through one task before a
+    // human stopped it.
+    //
+    // The queue-vs-runner distinction this module already draws is the same one:
+    // `unworkable_queue` is a healthy machine with nothing it can do, and must
+    // never escalate. A worker that cannot start is a BROKEN machine with plenty
+    // it should be doing, and must.
+    if (workerNeverRan(row)) {
+      return {
+        class: looksSystemic(reason) ? 'systemic' : 'transient',
+        detail: `the worker never ran (${row.outcome || 'worker_failed'}${Number.isFinite(Number(row.duration_s)) ? `, ${row.duration_s}s` : ''}, no cost recorded): ${String(row.reason || '').slice(0, 200)}`,
+      };
+    }
     // It ran, it did not ship. Not breakage — a blocker was filed and the task is
     // out of the pool — but not progress either. Quiet keeps the runner at full
     // speed so it moves on to the next task, which is the right response.
@@ -273,4 +324,5 @@ function shouldJumpWait(before, after) {
 module.exports = {
   CLASSES, COUNTS_AS_FAILURE, SYSTEMIC_MARKERS, DEFAULTS, START,
   looksSystemic, classifyEvent, nextCadence, signalFingerprint, shouldJumpWait,
+  workerNeverRan, WORKER_RAN_FLOOR_S,
 };

package/modules/government/protected-surfaces.json

@@ -59,6 +59,7 @@
     { "glob": "modules/grading/grader-prompt.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grade-engine.js", "group": "pipeline", "why": "task 1002839. The central grading engine every work-type is graded through: it runs the deterministic route-rank and permission-path pre-passes and applies the deterministic veto, so editing it can switch off the protected-path gate for every grade at once." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },