@bongos/core 1.19.1033 → 1.19.1035

package/modules/grading/grader-workers/worker-verdict.js

@@ -57,6 +57,10 @@ function finalizeVerdict({ verdict, scores, issues, extra = {}, notesPrefix, not
   };
 }
 
+// The marker the policy below stamps on a worker it downgraded. Exported so every
+// reader (aggregatePanel, the ship card) names the one string instead of retyping it.
+const UNBACKED_SCORE_DOWNGRADE = 'subthreshold_score_without_substantive_finding';
+
 // #1002663 severity-gate policy: style findings are advisory, and a
 // sub-threshold score must be BACKED by a substantive finding. Every worker
 // prompt already demands "a score below threshold must be accompanied by a
@@ -81,9 +85,35 @@ function applySeverityGatePolicy(result, { threshold, substantiveFail = false })
   return {
     ...result,
     verdict: 'concerns',
-    policy_downgrade: 'subthreshold_score_without_substantive_finding',
+    policy_downgrade: UNBACKED_SCORE_DOWNGRADE,
     notes_md: `${result.notes_md}\n[severity-gate] sub-threshold score with no major/blocker finding — fail downgraded to concerns (style findings are advisory)`.trim(),
   };
 }
 
-module.exports = { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy };
+// task 1002903 — the UNBACKED low scores in a panel: every sub-threshold axis of a
+// worker the policy above downgraded, as [{ kind, axis, score }] in worker order.
+//
+// WHY THIS EXISTS. A downgraded worker still carries its low score, and that score
+// still reaches the record (the axis median, the blended score) and the server's
+// ff/cq gate. So the grade reads "FAIL 5.5" with no finding behind it, and the card
+// told the builder to "fix the issues above" when there were none — the shape task
+// 1002721 was filed as. Naming these lets the record and the card say what they
+// are: a low mark nobody could point at, not a rejection with work to do.
+//
+// Keyed on the policy's own marker, so it can only ever list what the policy
+// already decided: a low score that IS backed (the worker stays 'fail'), an errored
+// worker, and the exempt Hacker (never downgraded) cannot appear. Pure; tolerates
+// any input shape because signals.workers comes back off the wire.
+function unbackedLowScores(workerResults, { threshold }) {
+  const out = [];
+  for (const w of (Array.isArray(workerResults) ? workerResults : [])) {
+    if (!w || typeof w !== 'object' || w.policy_downgrade !== UNBACKED_SCORE_DOWNGRADE) continue;
+    const scores = w.scores && typeof w.scores === 'object' ? w.scores : {};
+    for (const [axis, score] of Object.entries(scores)) {
+      if (Number.isFinite(score) && score < threshold) out.push({ kind: String(w.kind || '?'), axis, score });
+    }
+  }
+  return out;
+}
+
+module.exports = { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy, unbackedLowScores, UNBACKED_SCORE_DOWNGRADE };

package/modules/grading/grader.js

@@ -46,7 +46,9 @@
 //       (narc + quality + hacker + efficiency — the full 4-worker panel, so an
 //       honest ship always clears hasPanelEvidence's ≥3-worker floor). Wraps
 //       subprocess failures so resolveClaim/applyGrade can always write
-//       task_grades.
+//       task_grades. Since task 1002839 it is the code panel (CODE_WORK_TYPE,
+//       below) run through the central grade engine (grade-engine.js), which
+//       owns the pipeline, the deterministic pre-passes and the veto.
 //
 //   aggregatePanel(workerResults, meta)
 //       → final grade-result from per-worker WorkerResults. Applies the
@@ -82,7 +84,7 @@ const path = require('node:path');
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 
-const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, DEFAULT_SHOTS, FALLTHROUGH_CONFIDENCE, RUBRIC, THRESHOLD, V1, V3, VERSION, api, generatedProvenance, permissionPathPrePass, routeRankPrePass, workers } = require('./grader-config.js');
+const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, DEFAULT_SHOTS, FALLTHROUGH_CONFIDENCE, RUBRIC, THRESHOLD, V1, V3, VERSION, generatedProvenance, permissionPathPrePass, routeRankPrePass, workers } = require('./grader-config.js');
 const { clamp, isTrivialDiff, median, r1, selectGraderModel, workerModelFor } = require('./grader-model.js');
 const { buildPrompt, extractJson } = require('./grader-prompt.js');
 // task 1004011: the second grade species — a grade over the CLAIM on an
@@ -90,6 +92,10 @@ const { buildPrompt, extractJson } = require('./grader-prompt.js');
 const { GRADER_KIND: NO_ARTIFACT_GRADER_KIND, buildNoArtifactPrompt, gradeNoArtifact } = require('./grader-no-artifact.js');
 const { aggregateShots, changeMagnitude, hasPanelEvidence, isSubstantiveIssue, serverSideGuards, validateAndScore } = require('./grader-score.js');
 const { buildContextBundle, diffAddedLinesByFile, extractAssistantResult, extractCostUsd, runOneShot, runSubagent, runSubagentCached } = require('./grader-subagent.js');
+// task 1002903: the severity gate's unbacked low scores, named once for the record.
+const { unbackedLowScores } = require('./grader-workers/worker-verdict.js');
+// task 1002839: the central engine the code panel below registers into (ADR 0089 §1).
+const engine = require('./grade-engine.js');
 
 // task 1003313: render the WHY of a total outage into the verdict line.
 //
@@ -159,6 +165,18 @@ function aggregatePanel(workerResults, meta = {}) {
   const cqEffective = cq != null && economy != null ? r1(clamp(cq - economyPenalty, 0, 10)) : cq;
   const blended = ff != null && cq != null ? r1((ff + cq) / 2) : 0;
 
+  // task 1002903: low scores the severity gate found no major/blocker finding
+  // behind (worker-verdict.js applySeverityGatePolicy). Recorded, never hidden —
+  // the scores above keep them — so the card can say "nothing listed to fix".
+  const unbackedScores = unbackedLowScores(workerResults, { threshold: THRESHOLD });
+  // The two axes the SERVER gates on. validateAndScore re-checks ff and cq from
+  // the scores this panel forwards, so either one under threshold fails the ship
+  // whatever the verdict below says (see the gatingAllPass branch).
+  const serverGatedBelow = [
+    ...(ff != null && ff < THRESHOLD ? [`functional_fidelity ${ff}`] : []),
+    ...(cq != null && cq < THRESHOLD ? [`code_quality ${cq}`] : []),
+  ];
+
   // Verdict counts.
   const passCount = gateResults.filter((w) => w.verdict === 'pass').length;
   const concernsCount = gateResults.filter((w) => w.verdict === 'concerns').length;
@@ -356,6 +374,19 @@ function aggregatePanel(workerResults, meta = {}) {
     verdict = `CONCERNS — ${reasons.join('; ')} (manual-confirm available)`;
     panelOutcome = 'concerns';
     forwardedConfidence = FALLTHROUGH_CONFIDENCE;
+  } else if (gatingAllPass && serverGatedBelow.length > 0) {
+    // task 1002903: every gating worker passed, but a server-gated axis is under
+    // threshold. Today that is one shape — the ADVISORY Narc scored ff low with no
+    // finding, so the severity gate made it 'concerns' and the branch below would
+    // call the panel a PASS. The server then re-checks ff from the forwarded score
+    // and fails the ship anyway, so the stored grade said FAIL with a PASS verdict
+    // inside it. Say what will actually happen: manual-confirm, the same
+    // fall-through as every other concerns branch. The ship was already not
+    // passing, so this is no new gate — and an unbacked low score still does not
+    // pass, so it is no loosening either.
+    verdict = `CONCERNS — ${serverGatedBelow.join(' and ')} ${serverGatedBelow.length > 1 ? 'are' : 'is'} below ${THRESHOLD} with every gating worker passing; the server's score gate still applies (manual-confirm available)`;
+    panelOutcome = 'concerns';
+    forwardedConfidence = FALLTHROUGH_CONFIDENCE;
   } else if (gatingAllPass) {
     // Every gating worker passed. A Narc 'concerns' here is advisory only.
     verdict = `PASS — ${gating.length}/${gating.length} gating worker(s) cleared${advisoryConcerns ? ' (narc advisory: concerns)' : ''}`;
@@ -402,6 +433,9 @@ function aggregatePanel(workerResults, meta = {}) {
   if (efficiencyScore != null) lines.push(`  efficiency_score (EffMng):   ${efficiencyScore}/10`);
   lines.push(`  blended:                     ${blended}/10  (threshold ${THRESHOLD}, gating workers must PASS; narc advisory — #481)`);
   lines.push(`  forwarded confidence:       ${forwardedConfidence ?? '?'}  (panel: ${panelOutcome})`);
+  for (const u of unbackedScores) {
+    lines.push(`  unbacked score: ${u.kind} ${u.axis} ${u.score}/10 is below ${THRESHOLD} with no major/blocker finding behind it (severity gate) — nothing listed to fix`);
+  }
   lines.push('');
   lines.push('Per-worker:');
   for (const w of workerResults) {
@@ -471,6 +505,9 @@ function aggregatePanel(workerResults, meta = {}) {
       fail_count: failCount,
       error_count: errorCount,
       panel_cost_usd: panelCostUsd, // #486: mirror into signals for the audit trail
+      // task 1002903: present only when there is one, so an ordinary grade's
+      // signals keep their exact shape.
+      ...(unbackedScores.length ? { unbacked_scores: unbackedScores } : {}),
       ...meta,
     },
     notes_md: lines.join('\n'),
@@ -531,96 +568,56 @@ function graderUnavailableResult({ reason, note, meta = {} } = {}) {
   };
 }
 
-// End-to-end v4 grader. Runs the worker panel through the cross-family
-// grader model and returns the panel-aggregated grade-result.
+// ---------- the code panel as work-type #1 of the grade engine (task 1002839) ----------
 //
-// workers: defaults to DEFAULT_PANEL (narc + quality + hacker + efficiency —
-//   the full 4-worker panel since Phase 2.1/2.2). An array of worker kinds
-//   (strings) like ['narc', 'quality']. A default-panel run always satisfies
-//   hasPanelEvidence's ≥3-worker floor, so an honest unanimous zero-issue
-//   PASS is waived, never manual-confirm-gated (task 1002664 / ADR 0164).
-// builderModel: the model the builder used. Defaults to ASSUMED_BUILDER_MODEL
-//   (Opus, per CLAUDE.md §2). Drives selectGraderModel — workers pick the
-//   cross-family alternative.
-async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats, workers: workerKinds, builderModel, builderRank, priorRound, runOpts = {} }) {
-  // #943: bypass / disabled short-circuit — BEFORE resolving the panel or
-  // spawning any worker. When the grader is globally bypassed (the
-  // GRADER_BYPASS_ENABLED killswitch, ADR 0041) or a caller explicitly disables
-  // it (runOpts.bypass), do NOT spawn the panel. Spawning into an outage/bypass
-  // window is exactly what manufactured the "FAIL · 0/10" false-verdict in
-  // session 1659 — the bypass was honored only DOWNSTREAM of the spawn. Return
-  // the distinct 'unavailable' outcome so the result reads as "grader bypassed",
-  // never a quality 0/10.
-  if (runOpts.bypass === true || process.env.GRADER_BYPASS_ENABLED === '1') {
-    const reason = runOpts.bypass === true ? 'bypass_requested' : 'grader_bypass_enabled';
-    return graderUnavailableResult({
-      reason,
-      note: 'Grader bypassed before worker spawn (GRADER_BYPASS_ENABLED / runOpts.bypass) — no panel ran. Land via manual-confirm (/confirm).',
-      meta: { builder_model_assumed: builderModel || ASSUMED_BUILDER_MODEL, bypassed: true },
-    });
-  }
-  const panel = workers.resolvePanel(workerKinds ?? workers.DEFAULT_PANEL);
-  const graderModel = selectGraderModel({ builderModel });
-
-  // Deterministic route-rank pre-pass — its findings feed the Hacker as input;
-  // its pseudo-worker result is appended to the panel below.
-  const routeRank = routeRankPrePass(changedFiles);
-  // Deterministic permission-path pre-pass (SEC #863) — a sub-Metic diff that
-  // touches the rank/permission/ship-grade/deploy machinery hard-fails.
-  const permPath = permissionPathPrePass(changedFiles, builderRank);
-  const deterministicFindings = [
-    ...(routeRank ? routeRank.findings : []),
-    ...(permPath ? permPath.findings : []),
-  ];
-
+// ADR 0089 §1: the pipeline (select → pre_pass → evidence → fan_out → aggregate →
+// gate → persist) lives in grade-engine.js and is identical for every work-type;
+// a work-type supplies only what is its own. For code that is the v4 adversarial
+// worker panel, and every hook below is what gradeSubagent's body did inline
+// before the extraction — same calls, same arguments, same order. The engine
+// owns the rest: the bypass short-circuit, grader-model selection, BOTH
+// deterministic pre-passes (the code panel cannot skip them — nothing here names
+// them), the parallel fan-out, the deterministic veto and the record meta.
+const CODE_WORK_TYPE = Object.freeze({
+  key: 'code',
+  title: 'Code — the v4 adversarial worker panel (narc / quality / hacker / efficiency, + the advisory reader on copy-bearing ships)',
+  // Part of the llm-cache key: kept at the pre-engine value so every cached
+  // worker reply stays a hit.
+  cacheTaskType: 'grade_worker',
+  // The judges: an explicit list of worker kinds, else the full 4-worker
+  // panel. An unknown kind throws — a typo in a custom panel surfaces at once.
+  resolveJudges: (kinds) => workers.resolvePanel(kinds ?? workers.DEFAULT_PANEL),
+  // task 1002660: the rubric tier override per worker (cross-model-guarded).
+  modelFor: (worker, graderModel, builderModel) => workerModelFor(worker.KIND, graderModel, builderModel),
   // task 1002660: one read of the changed files, shared by all four workers —
   // kills the per-worker re-exploration that dominated panel cost.
   // diff (task 1002905): lets the bundle prove a truncated prefix actually shows
   // the change instead of handing a worker a head fragment as "post-change".
-  const contextBundle = Object.assign(...await Promise.all([buildContextBundle({ changedFiles, cwd: runOpts.cwd, diff }), generatedProvenance.verifyGeneratedProvenanceAsync({ changedFiles, cwd: runOpts.cwd }).then((generatedProvenance) => ({ generatedProvenance }))])); // task 1002795 — verified once, concurrently with the bundle read, off the prompt path
-  // task 1002660: cache-wrapped spawns. Same prompt + model replays at $0
-  // (llm-cache, System 5) — the prompt embeds the diff + bundle, so the key
-  // needs no separate scope sha. Absent llm-cache → plain runSubagent.
-  const runSubagentPanelCached = ({ prompt, opts }) => runSubagentCached({
-    prompt,
-    opts,
-    cache: api.llmCache
-      ? api.llmCache.makeCacheSpec({ prompt, model: opts?.model, task_type: 'grade_worker' })
-      : null,
-  });
-
-  const startedAt = Date.now();
-  const workerPromises = panel.map((worker) => workers.runWorker(worker, {
-    task,
-    valueSummary,
-    diff,
-    changedFiles,
-    diffStats,
-    // task 1002660: rubric tier override per worker (cross-model-guarded).
-    model: workerModelFor(worker.KIND, graderModel, builderModel),
-    runOpts,
-    runSubagentFn: runSubagentPanelCached,
-    extractAssistantResultFn: extractAssistantResult,
-    deterministicFindings: deterministicFindings.length ? deterministicFindings : null,
-    priorRound: priorRound || null, // task 1002662: delta-aware re-grade context
-    contextBundle, // task 1002660: post-change file contents, read once
-  }));
-  const workerResults = await Promise.all(workerPromises);
-  // Append the deterministic checks as pseudo-workers so the any-fail gate
-  // treats a write-route 'unknown' OR a sub-Metic permission-path edit as a
-  // hard block with no gate-logic change.
-  if (routeRank) workerResults.push(routeRank.workerResult);
-  if (permPath) workerResults.push(permPath.workerResult);
-  const totalMs = Date.now() - startedAt;
-
-  return aggregatePanel(workerResults, {
-    builder_model_assumed: builderModel || ASSUMED_BUILDER_MODEL,
-    grader_model: graderModel,
-    total_ms: totalMs,
-    // task 1002905: what the panel could actually SEE, recorded on every grade.
-    // Diagnosing the fabricated all-blocker FAIL cost a session because the grade
-    // record said nothing about the read root or how much of each file the workers
-    // were shown; a "the panel read the wrong tree" claim is now one field away.
+  gatherEvidence: async ({ changedFiles, diff, runOpts }) => ({
+    contextBundle: Object.assign(...await Promise.all([buildContextBundle({ changedFiles, cwd: runOpts.cwd, diff }), generatedProvenance.verifyGeneratedProvenanceAsync({ changedFiles, cwd: runOpts.cwd }).then((generatedProvenance) => ({ generatedProvenance }))])), // task 1002795 — verified once, concurrently with the bundle read, off the prompt path
+  }),
+  runJudge: (worker, ctx) => workers.runWorker(worker, {
+    task: ctx.task,
+    valueSummary: ctx.valueSummary,
+    diff: ctx.diff,
+    changedFiles: ctx.changedFiles,
+    diffStats: ctx.diffStats,
+    model: ctx.model,
+    runOpts: ctx.runOpts,
+    runSubagentFn: ctx.runSubagentFn,
+    extractAssistantResultFn: ctx.extractAssistantResultFn,
+    // Only the Hacker renders these; the route-rank + permission-path findings.
+    deterministicFindings: ctx.deterministicFindings.length ? ctx.deterministicFindings : null,
+    priorRound: ctx.priorRound || null, // task 1002662: delta-aware re-grade context
+    contextBundle: ctx.evidence.contextBundle, // task 1002660: post-change file contents, read once
+  }),
+  aggregate: aggregatePanel,
+  unavailable: graderUnavailableResult,
+  // task 1002905: what the panel could actually SEE, recorded on every grade.
+  // Diagnosing the fabricated all-blocker FAIL cost a session because the grade
+  // record said nothing about the read root or how much of each file the workers
+  // were shown; a "the panel read the wrong tree" claim is now one field away.
+  recordEvidence: ({ contextBundle }, { runOpts }) => ({
     context_bundle: {
       read_root: path.resolve(runOpts.cwd || process.cwd()),
       bundled: contextBundle.files.map((f) => ({
@@ -628,6 +625,29 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
       })),
       skipped: contextBundle.skipped,
     },
+  }),
+});
+engine.registerWorkType(CODE_WORK_TYPE, { isDefault: true });
+
+// End-to-end v4 grader: the code panel through the grade engine. Returns the
+// panel-aggregated grade-result.
+//
+// workers: defaults to DEFAULT_PANEL (narc + quality + hacker + efficiency —
+//   the full 4-worker panel since Phase 2.1/2.2). An array of worker kinds
+//   (strings) like ['narc', 'quality']. A default-panel run always satisfies
+//   hasPanelEvidence's ≥3-worker floor, so an honest unanimous zero-issue
+//   PASS is waived, never manual-confirm-gated (task 1002664 / ADR 0164).
+// builderModel: the model the builder used. Defaults to ASSUMED_BUILDER_MODEL
+//   (Opus, per CLAUDE.md §2). Drives selectGraderModel — workers pick the
+//   cross-family alternative.
+// bypass (#943): runOpts.bypass or GRADER_BYPASS_ENABLED returns the distinct
+//   'unavailable' result BEFORE any worker spawns — see engine.runGrade.
+async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats, workers: workerKinds, builderModel, builderRank, priorRound, runOpts = {} }) {
+  return engine.runGrade({
+    workType: CODE_WORK_TYPE.key,
+    task, valueSummary, diff, changedFiles, diffStats,
+    judges: workerKinds,
+    builderModel, builderRank, priorRound, runOpts,
   });
 }
 
@@ -842,7 +862,8 @@ function gradeDeterministic({ task, verification, actualMinutes, valueSummary, l
 module.exports = {
   // v4 surface (active panel-based gate)
   aggregatePanel,
-  gradeSubagent,                  // panel by default
+  gradeSubagent,                  // panel by default — the code work-type through the grade engine
+  gradeEngine: engine,            // task 1002839: the central pipeline + work-type registry (ADR 0089 §1), code panel registered
   gradeNoArtifact,                // task 1004011: the no-diff species — grades the CLAIM, not a diff
   buildNoArtifactPrompt,          // exported so tests can read the prompt without spawning a model
   NO_ARTIFACT_GRADER_KIND,        // task 1004011: 'subagent-no-artifact' — the species marker

package/modules/hall-ui/public/deploy.js

@@ -207,6 +207,21 @@
           ${detail}
         </div>`;
     }
+    // LANDED, BUT GITHUB DID NOT GET IT (task 1004065). The runner pushes a hosted
+    // project's new pin to its repo after the move; when it could not, the move is still
+    // done — the site runs the new core — and `warning` says why the repo was not updated.
+    // Its own treatment, never the success one: "and the box confirmed it" on its own is
+    // the sentence that hid this while the box and the repo drifted apart.
+    if (m.state === 'done' && m.warning && m.target_version === p.served_version) {
+      return `
+        <div class="dp-settled dp-settled--warn">
+          <p class="ov-row__sub"><strong>Now running core ${escapeHtml(String(m.target_version))} — but GitHub was not updated.</strong>
+            Moved ${escapeHtml(ago(m.at))}, and the box confirmed it. The project’s repository on GitHub
+            still names the old core, so changes pushed there may not reach the live site until the two match.</p>
+          <p class="ov-row__sub">${escapeHtml(String(m.warning.text || ''))}</p>
+          ${reconnectHtml(p, m.warning.code)}
+        </div>`;
+    }
     if (m.state === 'done' && m.target_version === p.served_version) {
       return `
         <div class="dp-settled dp-settled--ok">
@@ -217,6 +232,26 @@
     return '';
   }
 
+  // The one fix a page can hand the owner for a repo that was not updated: sign in again
+  // with repository access, which stores the token the runner pushes with. Offered only
+  // for the two causes it can cure — a sign-in does nothing for GitHub being ahead of the
+  // box, or for a project with no repo. It says the access is short-lived (an hour, per
+  // GITHUB_TOKEN_TTL_MS) rather than promising the repo will simply catch up.
+  const RECONNECT_CURES = new Set(['no_access', 'refused']);
+  function reconnectHtml(p, code) {
+    if (!RECONNECT_CURES.has(code)) return '';
+    // Back to THIS page. An absolute https URL survives the callback's host (the
+    // allowlist admits the apex's subdomains); where there is none to read, the page's
+    // own path is the fallback.
+    let back = '';
+    try { back = String((window.location && window.location.href) || ''); } catch (e) { back = ''; }
+    if (!/^https:\/\//.test(back)) back = `/deploy${view.isSelf ? '' : `?project=${encodeURIComponent(String(p.slug))}`}`;
+    const href = `${API}/auth/web/start?repos=1&return=${encodeURIComponent(back)}`;
+    return `
+      <p class="ov-row__sub">If you own this project, <a href="${escapeHtml(href)}">reconnect GitHub with repository access</a>.
+        The hub keeps that access for about an hour, so the next upgrade run within the hour saves this change to GitHub along with its own.</p>`;
+  }
+
   function stepOneHtml(p) {
     return `
       <p class="ov-row__sub">Core <strong>${escapeHtml(String(p.recommended_version))}</strong> is published and

package/modules/hall-ui/public/project-settings.css

@@ -160,6 +160,13 @@
   border-left: 3px solid var(--danger);
   padding-left: 0.7rem;
 }
+/* It landed, but the project's GitHub repo did not get the new pin (task 1004065). Not
+   the ok mark — the box and the repo now disagree — and not the danger one, because the
+   project is running exactly what was asked for. */
+.dp-settled--warn {
+  border-left: 3px solid var(--warn);
+  padding-left: 0.7rem;
+}
 /* A failure the box has already moved past (task 1004172). It keeps a mark, because it
    is still a thing that happened and worth reading — but not the danger mark, which on
    this page means "your project is in this state now". A two-day-old refusal wearing the

package/modules/lifecycle/routes/tasks.js

@@ -53,6 +53,11 @@ const githubPush = require('../github-push');
 const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
+// task 1003764: publish-status with no ?branch= and no PR titled for the task — the shape
+// getPublishStatus gives a branch with no PR, plus how to ask about one. Never a 400.
+const NO_PR_STATUS = Object.freeze({
+  pr_state: 'none', merged: false, merge_sha: null, deploy_status: 'none', pr_url: null, pr_number: null, pr_title: null, pr_body: null,
+  branch_hint: 'No pull request titled for this task is among the 100 most recent. Pass ?branch=<name> to ask about a specific branch.' });
 const seams = api;
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
@@ -1250,15 +1255,25 @@ module.exports = function buildTasksRouter() {
   // GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy
   // state for a server-mediated publish so ship.js can confirm the land WITHOUT
   // gh on the box. Ownership-gated like the POST. Derives state live from GitHub.
+  // `branch` is optional (task 1003764): without it the server finds the task's own PR
+  // (both publish paths title it "task <id>: …") and the answer names the `branch` it
+  // used and its `branch_source`, so the check agents are sent to instead of git probes
+  // never refuses a live publish for want of a branch name.
   router.get('/tasks/:id/publish-status', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_task_id' });
     if (id === null) return;
     if (!(await gateTaskOwnership(req, res, id))) return;
     if (!githubPush.isConfigured()) return res.fail('push_unconfigured', { status: 503, message: PUSH_UNCONFIGURED_MSG });
-    const branch = req.query.branch;
-    if (!githubPush.isSafeBranch(branch)) return res.fail('bad_branch', 400);
+    // A fully-qualified ref names the same branch, so it is accepted rather than refused.
+    const asked = typeof req.query.branch === 'string' ? req.query.branch.replace(/^refs\/heads\//, '') : req.query.branch;
+    if (asked != null && asked !== '' && !githubPush.isSafeBranch(asked)) {
+      return res.fail('bad_branch', { status: 400, message: 'branch must be a plain branch name such as task-123, or left out so the server finds the task\'s own PR.' });
+    }
     try {
-      const status = await githubPush.getPublishStatus({ branch });
+      const found = asked ? null : await githubPush.findTaskPullRequest({ taskId: id });
+      const branch = asked || (found && found.branch) || null;
+      const branch_source = asked ? 'query' : (branch ? 'task_pr' : null);
+      const status = branch ? await githubPush.getPublishStatus({ branch }) : NO_PR_STATUS;
       // task 1049 (B — server-side reconcile-on-read): when GitHub shows the PR
       // MERGED and deploy-prod SUCCEEDED, finish the task right here so a
       // confirmed-but-unshipped task never strands waiting on a human to re-poll
@@ -1318,7 +1333,7 @@ module.exports = function buildTasksRouter() {
           log.error('[gds] publish-status merge-driver (non-blocking):', e && e.message);
         }
       }
-      return res.json({ ok: true, ...status, reconciled, reconcile_blocked, merge_driver });
+      return res.json({ ok: true, ...status, branch, branch_source, reconciled, reconcile_blocked, merge_driver });
     } catch (e) {
       if (e.code === 'NO_REPO_INFO') return res.fail('no_repo_info', 500);
       if (e.code === 'APP_NOT_INSTALLED') return res.fail('push_unconfigured', { status: 503, message: appNotInstalledMessage(e) });

package/modules/lifecycle/ship-assurance.js

@@ -74,10 +74,26 @@ async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeE
   // before landProvenForTask ever saw a recorded tip, so a commit provably on main
   // was refused as "not proven" (strands 1003285/1003286, task 1003434). Each step
   // now fails on its own: a status miss degrades to status=null, never to no-proof.
+  //
+  // The status probe needs a BRANCH (task 1004275). It used to be called with
+  // { taskId, publishedSha }, which getPublishStatus does not read, so it threw
+  // BAD_BRANCH every time and both PR-witness proofs in landProvenForTask (the
+  // squash/out-of-band land, and the no-tip fallback) could never fire on this path,
+  // while the reconciler proved the same land ~5 min later. So find the task's own PR
+  // first, by the "task <id>: …" title both publish paths give it (the same lookup
+  // GET /publish-status does since task 1003764), and ask about that branch. No PR,
+  // or a failed search, leaves status=null: the tip proof still runs.
   let publishedSha = null;
   try { publishedSha = await db.getClaimPublishedSha(taskId); } catch (e) { report(e); }
+  let branch = null;
+  try {
+    const found = await githubPush.findTaskPullRequest({ taskId });
+    branch = (found && found.branch) || null;
+  } catch (e) { report(e); }
   let status = null;
-  try { status = await githubPush.getPublishStatus({ taskId, publishedSha }); } catch (e) { report(e); }
+  if (branch) {
+    try { status = await githubPush.getPublishStatus({ branch }); } catch (e) { report(e); }
+  }
   try {
     const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
     if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };

package/modules/provisioning/control-plane-guard.js

@@ -24,6 +24,8 @@
 // that file sits on the oversized-file ratchet; a guard whose whole value is being
 // read before it is edited should not be the thing that reds the build either.
 
+const { PublicRefusal } = require('./public-refusal');
+
 // The only acts that cannot destroy the box they run on.
 //
 //   core-upgrade — moves the pin, health-gated, auto-rollback on failure. This is
@@ -86,25 +88,24 @@ function intentAllowedForShape(action, hostingShape) {
  * @param {{query: Function}} db
  * @param {number|string} instanceId
  * @param {string} action  an INTENT_ACTIONS member
- * @throws {Error} code 'control_plane_protected'
+ * @throws {PublicRefusal} code 'control_plane_protected', status 409
  */
 async function assertIntentAllowed(db, instanceId, action) {
   const { rows } = await db.query(
     'SELECT hosting_shape FROM provisioning_instances WHERE id = $1', [instanceId]);
   const shape = rows[0] && rows[0].hosting_shape;
   if (!shape || intentAllowedForShape(action, shape)) return;
-  // It carries the { code, status, message } shape credential-preflight.js established,
-  // so a route that wants to answer 409 with the sentence can, without re-deriving it.
-  // NO ROUTE MAPS IT TODAY, and that is the honest state rather than an oversight: every
-  // action that can reach this throw has its own earlier refusal, so arriving here means
-  // a route forgot one — a bug in us, not a thing the caller did. A 500 plus a logged
-  // stack is the right loudness for that, and the fields are here so the day a route
-  // legitimately needs to say it to a person, the wording is already written.
-  const err = new Error(`'${action}' cannot be aimed at the control plane — only ${CONTROL_PLANE_ACTIONS.join(' and ')} may run against the box the platform itself runs on`);
-  err.code = 'control_plane_protected';
-  err.status = 409;
-  err.publicMessage = `That action cannot be aimed at the machine the platform itself runs on. Only ${CONTROL_PLANE_ACTIONS.join(' and ')} are allowed there.`;
-  throw err;
+  // A PublicRefusal, so every route answers it as a 409 in the owner's words (task
+  // 1004126). This used to rest on "every action that can reach this throw has its own
+  // earlier refusal", and that did not hold: teardown, force-teardown and disconnect reach
+  // it with none, and the owner read "internal error". Each route still logs the stack, so
+  // a route that forgot its own check stays as visible to us as it was.
+  throw new PublicRefusal({
+    code: 'control_plane_protected',
+    status: 409,
+    publicMessage: `That action cannot be aimed at the machine the platform itself runs on. Only ${CONTROL_PLANE_ACTIONS.join(' and ')} are allowed there.`,
+    message: `'${action}' cannot be aimed at the control plane — only ${CONTROL_PLANE_ACTIONS.join(' and ')} may run against the box the platform itself runs on`,
+  });
 }
 
 module.exports = { CONTROL_PLANE_ACTIONS, intentAllowedForShape, assertIntentAllowed };

package/modules/provisioning/core-upgrade.js

@@ -29,6 +29,7 @@
 // AT the 1500-line fitness ratchet, and at that ceiling a new function costs more
 // than the build will give back.
 
+const { failFrom } = require('./public-refusal');
 
 // Exactly the states in which there is a running instance whose pin can move.
 // Narrower than RESTART_FROM on purpose: an instance mid-standup has no settled pin
@@ -209,18 +210,10 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/core-upgrade', err);
-      // A REFUSAL IS NOT AN OUTAGE. The control-plane guard throws an error carrying
-      // `code`, `status` and a `publicMessage` it wrote for exactly this moment — and
-      // this catch used to discard all three, so every guard refusal reached the owner
-      // as a 500 "internal error" while the real sentence sat in the journal. Nothing
-      // in the repo honoured `publicMessage`; it was assigned once and read never
-      // (task 1004125). Only an error that has already declared itself public is
-      // forwarded — anything else still gets the opaque 500, because an unexpected
-      // throw may carry anything.
-      if (err && err.publicMessage && err.code && err.status) {
-        return res.fail(err.code, { status: err.status, message: err.publicMessage });
-      }
-      return res.fail('core_upgrade_failed', { status: 500, message: 'internal error' });
+      // A REFUSAL IS NOT AN OUTAGE (task 1004125): a guard refusal reaches the owner as
+      // its own sentence, and an unexpected throw, which may carry anything, stays the
+      // opaque 500. The one definition of "public" is public-refusal.js (task 1004126).
+      return failFrom(res, err, 'core_upgrade_failed');
     }
   };
 }
@@ -256,6 +249,23 @@ function lastMoveSuperseded(target, served, recommended) {
   return !!(recommended && String(recommended) !== String(target));
 }
 
+/**
+ * The note a DONE move carries when the upgrade landed but its pin never reached the
+ * project's GitHub repo (task 1004065) — `{ code, text }`, or null. PURE.
+ *
+ * The runner writes it into the intent's last_error as `repo_not_updated:<code>: <text>`
+ * (scripts/gds/provision-core-upgrade.js repoNote; re-stated here because a module may
+ * not require a script, and round-tripped by tests/core_upgrade_runner.mjs). ONLY that
+ * shape is read: any other text on a done row is not turned into a warning, because
+ * inventing one would tell an owner their repo is stale on no evidence.
+ */
+const REPO_NOTE_RE = /^repo_not_updated:([a-z_]+): ([\s\S]+)$/;
+function parseRepoNote(text) {
+  const m = REPO_NOTE_RE.exec(String(text || ''));
+  // Bounded because it reaches a DOM, like the error beside it.
+  return m ? { code: m[1], text: m[2].slice(0, 600) } : null;
+}
+
 /**
  * The cached dry-run verdict, IF it is about the move now on offer. PURE (task 1004173).
  *
@@ -344,8 +354,11 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       // versions, and this is a version question wearing a different hat.
       superseded: lastMoveSuperseded(lastMove.target_version, served, recommended),
       // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
-      // `git status` (the dirty-tree one lists every file).
-      error: lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+      // `git status` (the dirty-tree one lists every file). Never set on a DONE move:
+      // a done row's last_error is the note below, and a move that worked is not an error.
+      error: lastMove.state !== 'done' && lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+      // It LANDED, but GitHub did not get the new pin (task 1004065) — parseRepoNote.
+      warning: lastMove.state === 'done' ? parseRepoNote(lastMove.last_error) : null,
     } : null,
   };
 }
@@ -379,7 +392,7 @@ function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
       return res.json({ ok: true, preview: await loadPreview(pool, provisioning, inst) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/core-upgrade', err);
-      return res.fail('core_upgrade_preview_failed', { status: 500, message: 'internal error' });
+      return failFrom(res, err, 'core_upgrade_preview_failed');
     }
   };
 }
@@ -410,10 +423,10 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
       return res.json({ ok: true, preview: await loadPreview(pool, provisioning, rows[0]) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/control-plane', err);
-      return res.fail('control_plane_read_failed', { status: 500, message: 'internal error' });
+      return failFrom(res, err, 'control_plane_read_failed');
     }
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };