@bongos/core 1.19.1036 → 1.19.1037

package/tests/grader.mjs

@@ -1,8 +1,8 @@
 // tests/grader.mjs
 //
-// Grader tests. Covers both:
-//   - the v1 deterministic process-audit grader (kept for audit-ships.js)
-//   - the v2 subagent quality grader (the actual credits gate from V3.R18 #209)
+// Grader tests: the subagent quality grader (the credits gate since V3.R18 #209).
+// The v1 deterministic process-audit grader was retired in task 1002842; the
+// export-surface test below pins that it stays gone.
 //
 // The v2 subagent itself is a real-network call, so the tests stop at the
 // validator + prompt-builder boundary; the network-touching end-to-end check
@@ -48,127 +48,6 @@ async function testAsync(name, fn) {
   }
 }
 
-// ========================================================================
-// v1 — deterministic grader (legacy, used only by audit-ships.js)
-// ========================================================================
-
-test('v1 scoreEstActualBand: ratio inside [0.5, 2.0] → 10', () => {
-  assert.equal(grader.scoreEstActualBand(60, 60), 10);
-  assert.equal(grader.scoreEstActualBand(30, 60), 10);
-  assert.equal(grader.scoreEstActualBand(120, 60), 10);
-});
-
-test('v1 scoreEstActualBand: ratio outside band drops linearly', () => {
-  assert.equal(grader.scoreEstActualBand(18, 60), 5);
-  assert.equal(grader.scoreEstActualBand(360, 60), 5);
-});
-
-test('v1 scoreEstActualBand: extreme ratios → 0', () => {
-  assert.equal(grader.scoreEstActualBand(6, 60), 0);
-  assert.equal(grader.scoreEstActualBand(600, 60), 0);
-});
-
-test('v1 scoreEstActualBand: missing est → 6, missing actual → 5', () => {
-  assert.equal(grader.scoreEstActualBand(60, null), 6);
-  assert.equal(grader.scoreEstActualBand(null, 60), 5);
-});
-
-test('v1 scoreValueSummary: maps length + verb', () => {
-  assert.equal(grader.scoreValueSummary(''), 0);
-  assert.equal(grader.scoreValueSummary(null), 0);
-  assert.equal(grader.scoreValueSummary('short note'), 5);
-  assert.equal(grader.scoreValueSummary('a moderately worded summary that lands above forty characters'), 8);
-  const s = 'wire the auto-grader into the completed→confirmed transition so every task gets a quality mark before its credits are paid out';
-  assert.ok(s.length > 120);
-  assert.equal(grader.scoreValueSummary(s), 10);
-});
-
-test('v1 scoreDiffHygiene: phantom ship → 0, normal → 10, too-broad → 5', () => {
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 0, lines_added: 0, lines_removed: 0 }), 0);
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 5, lines_added: 200, lines_removed: 30 }), 10);
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 80, lines_added: 1000, lines_removed: 200 }), 5);
-});
-
-test('v1 scoreScopingSignal: maps each level', () => {
-  assert.equal(grader.scoreScopingSignal(0), 2);
-  assert.equal(grader.scoreScopingSignal(1), 4);
-  assert.equal(grader.scoreScopingSignal(2), 6);
-  assert.equal(grader.scoreScopingSignal(3), 7);
-  assert.equal(grader.scoreScopingSignal(4), 8);
-  assert.equal(grader.scoreScopingSignal(5), 10);
-  assert.equal(grader.scoreScopingSignal(null), 6);
-});
-
-test('v1 scoreLocNetNegative', () => {
-  assert.equal(grader.scoreLocNetNegative({ lines_added: 20, lines_removed: 100 }), 10);
-  assert.equal(grader.scoreLocNetNegative({ lines_added: 100, lines_removed: 20 }), 0);
-});
-
-test('v1 scoreLearningRow', () => {
-  assert.equal(grader.scoreLearningRow({ body_md: 'x'.repeat(200) }), 10);
-  assert.equal(grader.scoreLearningRow(null), 0);
-});
-
-test('v1 scoreArtRubricAvg clamps + nulls', () => {
-  assert.equal(grader.scoreArtRubricAvg(8.7), 8.7);
-  assert.equal(grader.scoreArtRubricAvg(15), 10);
-  assert.equal(grader.scoreArtRubricAvg(-1), 0);
-  assert.equal(grader.scoreArtRubricAvg(NaN), null);
-});
-
-test('v1 blendWeightsForKind: feature renorms to 1.0', () => {
-  const w = grader.blendWeightsForKind('feature');
-  const total = Object.values(w).reduce((a, b) => a + b, 0);
-  assert.ok(Math.abs(total - 1.0) < 1e-6, `total=${total}, expected 1.0`);
-});
-
-test('v1 blendWeightsForKind: cleanup replaces diff_hygiene', () => {
-  const w = grader.blendWeightsForKind('cleanup');
-  assert.ok('loc_net_negative' in w);
-  assert.ok(!('diff_hygiene' in w));
-});
-
-test('v1 gradeDeterministic: well-shipped feature passes', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 99, kind: 'feature', est_minutes: 240, actual_minutes: 200, scoping_confidence: 4 },
-    verification: {
-      scanner_clean: true, smoke_clean: true,
-      diff_stats: { files_changed: 10, lines_added: 400, lines_removed: 50 },
-    },
-    actualMinutes: 200,
-    valueSummary: 'wire the auto-grader into ship.js so every task gets a quality mark before credits are paid; gates the completed→confirmed transition',
-  });
-  assert.ok(result.score >= 9.0, `score=${result.score}`);
-  assert.equal(result.passed, true);
-  assert.equal(result.grader_kind, 'auto');
-  assert.equal(result.grader_version, grader.RUBRIC.v1.version);
-  assert.equal(result.threshold, grader.RUBRIC.v1.threshold);
-});
-
-test('v1 gradeDeterministic: phantom ship scores low', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 100, kind: 'feature', est_minutes: 240, actual_minutes: 30, scoping_confidence: 2 },
-    verification: {
-      scanner_clean: true, smoke_clean: true,
-      diff_stats: { files_changed: 0, lines_added: 0, lines_removed: 0 },
-    },
-    actualMinutes: 30,
-    valueSummary: '',
-  });
-  assert.ok(result.score < 5.0, `score=${result.score}`);
-  assert.equal(result.passed, false);
-});
-
-test('v1 gradeDeterministic: notes_md says deprecated', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 106, kind: 'feature', est_minutes: 60, actual_minutes: 60, scoping_confidence: 4 },
-    verification: { scanner_clean: true, smoke_clean: true, diff_stats: { files_changed: 3, lines_added: 50, lines_removed: 5 } },
-    actualMinutes: 60,
-    valueSummary: 'a reasonable shipped change',
-  });
-  assert.match(result.notes_md, /v1.*deprecated/i);
-});
-
 // ========================================================================
 // v2 — subagent grader (the credits gate as of V3.R18 #209)
 // ========================================================================
@@ -181,17 +60,29 @@ test('v4 exports the expected surface (current panel-based gate)', () => {
     'buildPrompt', 'selectGraderModel', 'validateAndScore', 'aggregateShots',
     'runSubagent', 'runOneShot', 'gradeSubagentV3MultiShot',
     // constants
-    'THRESHOLD', 'VERSION', 'DEFAULT_GRADER_MODEL', 'DEFAULT_SHOTS', 'ASSUMED_BUILDER_MODEL',
+    'THRESHOLD', 'VERSION', 'DEFAULT_GRADER_MODEL', 'ASSUMED_BUILDER_MODEL',
     // utilities
     'extractJson', 'extractAssistantResult', 'extractCostUsd', 'RUBRIC',
   ];
   for (const name of required) {
     assert.ok(name in grader, `missing export: ${name}`);
   }
+  // task 1002842: the v1 generation is retired, not merely unused.
+  for (const gone of ['gradeDeterministic', 'scoreEstActualBand', 'scoreValueSummary', 'scoreDiffHygiene',
+    'scoreScannerSmoke', 'scoreScopingSignal', 'scoreLocNetNegative', 'scoreLearningRow', 'scoreArtRubricAvg',
+    'blendWeightsForKind']) {
+    assert.equal(gone in grader, false, `retired v1 export came back: ${gone}`);
+  }
+  assert.equal('v1' in grader.RUBRIC, false, 'the v1 rubric block is retired');
+  assert.equal('v3' in grader.RUBRIC, false, 'the v3 rubric block is retired');
+  // The moved plumbing is one implementation, reachable from both homes.
+  const noArtifact = require('../modules/grading/grader-no-artifact.js');
+  assert.equal(grader.aggregateShots, noArtifact.aggregateShots);
+  assert.equal(grader.runOneShot, noArtifact.runOneShot);
   assert.ok(typeof grader.THRESHOLD === 'number');
   assert.ok(grader.THRESHOLD >= 5.0 && grader.THRESHOLD <= 10.0);
   assert.ok(grader.VERSION.startsWith('v4'), `expected v4.*, got ${grader.VERSION}`);
-  assert.equal(grader.DEFAULT_SHOTS, 3); // kept for v3 multi-shot diagnostic path
+  assert.equal('DEFAULT_SHOTS' in grader, false, 'the v3 3-shot default is retired (task 1002842)');
   assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-5'); // task 1002659: Claude 5 family pin
   assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-fable-5');
   assert.equal(grader.FALLTHROUGH_CONFIDENCE, 0.3);
@@ -2316,6 +2207,37 @@ test('isTrivialDiff: empty changed-files or zero-line diff → false', () => {
   );
 });
 
+// ---------- task 1002842: the kept trivial-diff fast path still works ----------
+//
+// The v3 generation is retired, but its fast path is kept (moving it onto a v4
+// panel needs a new reviewer type — an owner decision). These pin that what was
+// kept works: ONE generalist shot by default, the generalist prompt, and the
+// moved aggregateShots collapse — driven through the runShot seam, no model spawned.
+
+await testAsync('fast path: one generalist shot by default, aggregated into a gradeable result', async () => {
+  const calls = [];
+  const r = await grader.gradeSubagentV3MultiShot({
+    task: { id: 1002842, title: 't', description: 'd', kind: 'cleanup' },
+    valueSummary: 'v', diff: '+ docs line', changedFiles: ['docs/x.md'], diffStats: { files_changed: 1, lines_added: 1, lines_removed: 0 },
+    builderModel: 'claude-fable-5', runOpts: {},
+    runShot: async (args) => { calls.push(args); return mkPassShot(8, 8, 0.9, args.shotIndex); },
+  });
+  assert.equal(calls.length, 1, 'the fast path runs exactly one shot unless told otherwise');
+  assert.match(calls[0].prompt, /default-fail|DEFAULT/i, 'it is the generalist default-fail prompt');
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 8);
+  assert.equal(r.signals.confidence, 0.9, 'the server gate reads a real confidence');
+});
+
+await testAsync('fast path: a failing shot still fails the grade (not loosened by the move)', async () => {
+  const r = await grader.gradeSubagentV3MultiShot({
+    task: { id: 1 }, valueSummary: 'v', diff: '+ x', changedFiles: ['docs/x.md'], diffStats: {},
+    runOpts: {}, runShot: async (args) => mkFailShot(4, 8, 0.9, args.shotIndex),
+  });
+  assert.equal(r.passed, false);
+});
+
 // ---------- Summary ----------
 
 console.log('');

package/tests/grader_unbacked_score.mjs

@@ -14,7 +14,7 @@
 //      server's ff gate failed the ship — a PASS verdict inside a FAIL grade;
 //   3. the card had no branch for it, so it printed the ordinary FAIL block.
 // The constraint the task set: close it WITHOUT letting an unbacked low score
-// pass and WITHOUT adding a gate (ADR 0162). Every case below that has a low
+// pass and WITHOUT adding a gate (the task's own scope: it corrects what the grade SAYS). Every case below that has a low
 // score also asserts the server still refuses it.
 //
 // Run:  node tests/grader_unbacked_score.mjs

package/tests/regrade_actual_minutes.mjs

@@ -32,7 +32,7 @@
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const { buildPrompt } = require('../modules/grading/grader-prompt.js');
@@ -78,23 +78,24 @@ test('a task with no actual_minutes at all builds the same prompt', () => {
   assert.equal(withFigure, without, 'actual_minutes changes nothing about what the panel reads');
 });
 
-test('scoreEstActualBand is reachable only from the retroactive audit', () => {
-  // The one scorer that DOES read the figure. It lives in gradeDeterministic,
-  // which the grader module's own comment calls the legacy v1 entry — its single
-  // non-test caller is scripts/gds/audit-ships.js, a process audit run by hand
-  // over already-shipped tasks, not a gate anything passes through. A new caller
-  // is the same risk as wiring the figure into the prompt.
+test('no grader entry reads actual_minutes — the one scorer that did is retired', () => {
+  // scoreEstActualBand was the ONE scorer that read the figure. It lived in the v1
+  // gradeDeterministic, whose only non-test caller was scripts/gds/audit-ships.js;
+  // task 1002842 retired all three. So the stale-figure risk this file guards is now
+  // closed at the source, and this pins it: nothing in the grading module may
+  // accept or read the figure, and the retired entry may not come back.
   const grader = require('../modules/grading/grader.js');
-  assert.equal(typeof grader.gradeDeterministic, 'function', 'the legacy entry still exists');
-  assert.equal(grader.gradeSubagent.length > 0, true, 'and the live entry is a different function');
+  assert.equal(grader.gradeDeterministic, undefined, 'the retired v1 entry stays gone');
+  assert.equal(grader.scoreEstActualBand, undefined, 'and so does its minutes scorer');
+  assert.equal(typeof grader.gradeSubagent, 'function', 'the live entry is still here');
 
-  // gradeSubagent / gradeSubagentV3MultiShot take a single options object, so the
-  // guard that matters is which KEYS they destructure. Neither may take minutes.
-  const src = readFileSync(new URL('../modules/grading/grader.js', import.meta.url), 'utf8');
-  for (const fn of ['async function gradeSubagent(', 'async function gradeSubagentV3MultiShot(']) {
-    const at = src.indexOf(fn);
-    assert.ok(at !== -1, `${fn} is still the entry point this pins`);
-    const sig = src.slice(at, src.indexOf(')', at));
-    assert.ok(!/actualMinutes/.test(sig), `${fn} does not accept actualMinutes`);
+  // Every grading source, not just grader.js: a new reader anywhere in the module
+  // is the same risk as wiring the figure into the prompt.
+  const dir = new URL('../modules/grading/', import.meta.url);
+  const files = readdirSync(dir, { recursive: true }).filter((f) => String(f).endsWith('.js'));
+  assert.ok(files.length > 5, 'the grading module was found');
+  for (const f of files) {
+    const src = readFileSync(new URL(String(f), dir), 'utf8');
+    assert.doesNotMatch(src, /actualMinutes|actual_minutes/, `${f} must not read actual_minutes`);
   }
 });

package/tests/render_check.mjs

@@ -1,6 +1,6 @@
 // tests/render_check.mjs — the rendered fit check (task 1004203, ADR 0329): which pages a changed path
 // reaches, which report rows it keeps, and that /ship-check shows it as a signal that never flips its exit
-// (ADR 0162). DB-free and browser-free; the in-page measurement is pinned in tests/ui_design_kit_fit.mjs.
+// (ADR 0329, decision 3). DB-free and browser-free; the in-page measurement is pinned in tests/ui_design_kit_fit.mjs.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';

package/tests/skill_grade_audit.mjs

@@ -2,8 +2,8 @@
 // accountability sweep from the grader-hardening evaluation §6 (task 1002657):
 // the override ledger, dropped blocker/major findings on passing grades (with
 // the advisory-Narc attribution filter), the false-pass spot-check, and the
-// outage roll-up handoff — describing and queueing ONLY (ADR 0162/0158: it
-// never confirms a task or flips status).
+// outage roll-up handoff — describing and queueing ONLY (ADR 0158 §2: it
+// never confirms a task or flips status; ADR 0162: it adds no approval step to a ship).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -45,6 +45,6 @@ test('/grade-audit exists, covers the sweep legs, and stays describe-and-queue o
 
   // The hard constraint.
   assert.match(md, /never confirm/i, 'states it never confirms');
-  assert.match(md, /ADR 0162/, 'anchors the no-new-gates constraint');
+  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
   assert.ok(!/curl[^\n]*\/confirm/.test(md), 'carries no ready-to-paste confirm curl');
 });

package/tests/skill_grader_health.mjs

@@ -2,7 +2,7 @@
 // the four health axes from the grader-hardening evaluation §6 (task 1002656):
 // outage runs, pass-rate drift, cost anomalies, and stale model pins — reading
 // LIVE data surfaces, emitting exact --regrade remediation lines, and staying
-// read-only (describe, never confirm/flip — ADR 0162).
+// read-only (describe, never confirm/flip — ADR 0158 §2; no approval step on anyone's ship — ADR 0162).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -44,5 +44,5 @@ test('/grader-health exists and covers the four health axes on live data', (t) =
   assert.match(md, /--probe/, 'offers the optional live calibration probe');
   assert.match(md, /grade-smoke\.js/, 'names the probe script');
   assert.match(md, /read-only/i, 'states the read-only contract');
-  assert.match(md, /ADR 0162/, 'anchors the no-new-gates constraint');
+  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
 });

package/scripts/gds/audit-ships.js

@@ -1,319 +0,0 @@
-// Retroactive audit script for task #204.
-//
-// Loads every task shipped in the last `days` (default 2), fetches full
-// task data via the authenticated /tasks/:id API, derives diff stats from
-// git (one commit per task, found by the `<VERSION> #<id>:` subject prefix),
-// then calls src/bongos/grader.js in-process to get a score.
-//
-// Output: JSON to stdout (--json) or human-readable table (default).
-// Audit-only — does NOT write to task_grades. Pre-grader ships keep clean
-// history.
-
-const { execFileSync } = require('node:child_process');
-const grader = require('../../modules/grading/grader');
-const { cliClient } = require('./cli-lib');
-
-// EVERY git call here goes through argv, never a shell string (task 1003223 —
-// the class task 1002761 named and task 1002526 fixed in docs-entropy).
-//
-// WHAT WAS WRONG. Five call sites built shell strings. THREE of them interpolated
-// a quoted empty `--format=''`; a POSIX shell strips those quotes and git sees an
-// empty format, but the shell Node uses on Windows does not, so git receives
-// `--format=''` literally and dies with `fatal: invalid --pretty format: ''`.
-// Verified on win32 before fixing: the shell-string form throws, the argv form
-// returns " 1 file changed, 139 insertions(+)". The correct argv spelling is
-// `--format=` — empty value, no quotes, which no shell can mangle because no
-// shell is involved. The other two passed `--format='%H %s'`, which survives a
-// POSIX shell and arrives with literal quotes elsewhere; same class, same fix.
-//
-// WHY IT MATTERED MORE THAN A LOUD CRASH. The originating row asked whether the
-// try/catch around these calls "degrades to a silently empty audit — if so it is
-// the same dangerous shape after all". It did. Every catch returned null or [],
-// so on Windows the audit reported no diff stats and zero downstream impact for
-// EVERY ship, and looked like a clean run. `gitFails` below keeps the same return
-// values but says so on stderr, so an empty audit can never again be mistaken for
-// an uneventful one.
-//
-// One of the five also built a `grep | head | awk` pipeline and pinned
-// `shell: '/bin/bash'` to survive; that filtering is now done in JS, so the script
-// needs no shell at all.
-function gitLines(args, { cwd } = {}) {
-  return execFileSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
-    .split('\n').map((s) => s.trim()).filter(Boolean);
-}
-
-// One place that reports a git failure instead of swallowing it. Returns the
-// caller's fallback so behaviour is unchanged; only the silence is.
-function gitFails(what, err, fallback) {
-  const msg = String((err && (err.stderr || err.message)) || err).trim().split('\n')[0];
-  console.error(`audit-ships: ${what} failed — ${msg}`);
-  return fallback;
-}
-
-const DAYS = Number(process.env.AUDIT_DAYS || 2);
-
-// `git log --all` once per RUN, not once per task.
-//
-// The shell pipeline this replaced ended in `head -1`, which let git stop as soon
-// as one subject matched. The argv rewrite has no such early exit — and
-// findCommitForTask is called once per shipped task, up to 500 in a run — so a
-// naive port turned one bounded call into 500 full history walks. The commit list
-// cannot change mid-run, so it is read once and reused. Caught by the grader on
-// the first round of this task, which is a fair catch: replacing a shell pipeline
-// means inheriting the work its operators were doing, not just its output.
-let commitSubjectsCache = null;
-function commitSubjects() {
-  if (commitSubjectsCache) return commitSubjectsCache;
-  commitSubjectsCache = gitLines(['log', '--all', '--format=%H %s']);
-  return commitSubjectsCache;
-}
-
-function findCommitForTask(taskId) {
-  // Matches both subject conventions: the legacy ' #NNN:' prefix and the de-#-ed
-  // 'task NNN:' form ship.js writes since task 916 (a bare "#NNN" in commit
-  // subjects autolinked to dead GitHub issue numbers).
-  //
-  // The grep|head|awk pipeline this replaces needed `shell: '/bin/bash'` to run at
-  // all — a hard dependency on a POSIX shell at a fixed path, for filtering JS can
-  // do. Doing it here also makes the id match EXACT: the old regex was
-  // interpolated unescaped, so a task id was pasted straight into a regex.
-  const re = new RegExp(` (?:#|task )${String(taskId).replace(/[^0-9]/g, '')}:`);
-  let lines;
-  try {
-    lines = commitSubjects();
-  } catch (e) {
-    return gitFails(`finding the commit for task ${taskId}`, e, null);
-  }
-  const hit = lines.find((l) => re.test(l));
-  return hit ? (hit.split(' ')[0] || null) : null;
-}
-
-function gitDiffStatsForCommit(sha) {
-  if (!sha) return null;
-  let raw;
-  try {
-    raw = execFileSync('git', ['show', '--shortstat', '--format=', sha], { encoding: 'utf8' });
-  } catch (e) {
-    return gitFails(`reading diff stats for ${String(sha).slice(0, 8)}`, e, null);
-  }
-  // Example shortstat line: " 15 files changed, 1171 insertions(+), 65 deletions(-)"
-  const m = raw.match(/(\d+) files? changed(?:, (\d+) insertions?\(\+\))?(?:, (\d+) deletions?\(-\))?/);
-  if (!m) return null;
-  return {
-    files_changed: Number(m[1] || 0),
-    lines_added: Number(m[2] || 0),
-    lines_removed: Number(m[3] || 0),
-    commit_sha: sha,
-  };
-}
-
-function filesTouchedByCommit(sha) {
-  if (!sha) return [];
-  try {
-    return gitLines(['show', '--name-only', '--format=', sha]);
-  } catch (e) {
-    return gitFails(`listing files touched by ${String(sha).slice(0, 8)}`, e, []);
-  }
-}
-
-// Downstream-impact heuristic: number of distinct commits on main reachable
-// from origin/main that landed AFTER `sha` and touched any of `files`. High
-// count = subsequent work has built on top of this change, so a "redo"
-// risks conflicts. Excludes `sha` itself.
-const NO_DOWNSTREAM = Object.freeze({
-  commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [],
-});
-
-function downstreamImpact(sha, files) {
-  if (!sha || files.length === 0) return { ...NO_DOWNSTREAM };
-  // The hand-rolled POSIX shell-quoting this replaces ("'" + escape + "'") was
-  // both unnecessary and wrong on Windows, where that quoting style is not the
-  // shell's. In argv form a path with spaces, quotes or a `$` is just an element.
-  const range = `${sha}..origin/main`;
-  let lines;
-  try {
-    lines = gitLines(['log', range, '--format=%H %s', '--', ...files]);
-  } catch (e) {
-    return gitFails(`reading downstream commits after ${String(sha).slice(0, 8)}`, e, { ...NO_DOWNSTREAM });
-  }
-  // Distinct downstream files touched
-  let distinct = 0;
-  try {
-    distinct = new Set(gitLines(['log', range, '--name-only', '--format=', '--', ...files])).size;
-  } catch (e) {
-    // Same shape as every other call site: the fallback comes FROM gitFails, so
-    // the value and the report can never drift apart.
-    distinct = gitFails(`reading downstream files after ${String(sha).slice(0, 8)}`, e, 0);
-  }
-  return {
-    commits_after_touching_files: lines.length,
-    distinct_files_touched: distinct,
-    sample_subjects: lines.slice(0, 3).map((l) => l.split(' ').slice(1).join(' ')),
-  };
-}
-
-async function fetchShipped(days) {
-  // Derive the public read host from branding (statusOrigin → publicOrigin), never a
-  // hardcoded founder host (was https://status.example.com — task 1002234). The
-  // recent-shipped feed is a public endpoint served on the status dashboard host.
-  const b = (() => { try { return require('../../src/branding').branding(); } catch (_) { return {}; } })();
-  const d = b.domains || {};
-  const statusBase = String(d.statusOrigin || d.publicOrigin || '').replace(/\/+$/, '');
-  const r = await fetch(
-    `${statusBase}/api/bongos/public/recent-shipped?days=${days}&limit=500`
-  );
-  const data = await r.json();
-  return data.tasks || [];
-}
-
-async function fetchFullTask(id) {
-  const api = await cliClient();
-  const r = await api.tasks.getTasksId({ id });
-  if (!r.ok) return null;
-  return r.data.task;
-}
-
-async function fetchLearning(taskId) {
-  // /api/bongos/learnings?task=<id> — we just need body_md.
-  const api = await cliClient();
-  const r = await api.learnings.getLearnings({ query: { task: taskId } });
-  if (!r.ok) return null;
-  const rows = r.data.learnings || [];
-  return rows[0] ? { body_md: rows[0].body_md } : null;
-}
-
-async function main() {
-  console.error(`Loading shipped tasks (last ${DAYS} days)...`);
-  const shipped = await fetchShipped(DAYS);
-  console.error(`Got ${shipped.length} shipped tasks. Fetching full data + diffs...`);
-
-  const results = [];
-  for (const t of shipped) {
-    const full = await fetchFullTask(t.id);
-    if (!full) {
-      console.error(`  #${t.id}: could not fetch full task — skip`);
-      continue;
-    }
-    const sha = findCommitForTask(t.id);
-    const diff = gitDiffStatsForCommit(sha);
-    const files = filesTouchedByCommit(sha);
-    const downstream = downstreamImpact(sha, files);
-    const verification = {
-      scanner_clean: true, // got shipped → passed
-      smoke_clean: true,
-      diff_stats: diff || undefined,
-    };
-    const learningRow =
-      full.kind === 'learning-capture' ? await fetchLearning(full.id) : null;
-
-    // V3.R18 (#209): the runtime grade entry switched to gradeSubagent;
-    // this retroactive #204 audit keeps using the v1 deterministic scorer
-    // because the historical signal we're measuring (process audit, not
-    // subagent quality) is what's in the v1 rubric. The function was
-    // renamed from grade() to gradeDeterministic() in the same commit.
-    const g = grader.gradeDeterministic({
-      task: full,
-      verification,
-      actualMinutes: full.actual_minutes,
-      valueSummary: full.value_summary,
-      learningRow,
-    });
-
-    // Categorize failure mode. Only meaningful when g.passed === false.
-    // - calibration-noise: only criterion under 5 is est_actual_band
-    // - quality-concern:   multiple criteria under 5
-    // - structural-risk:   downstream impact high (≥10 commits or ≥10 distinct files)
-    let category = null;
-    if (!g.passed) {
-      const lowCriteria = Object.entries(g.rubric_scores)
-        .filter(([_k, v]) => v < 5)
-        .map(([k]) => k);
-      const onlyCalibrationLow = lowCriteria.length === 1 && lowCriteria[0] === 'est_actual_band';
-      const heavyDownstream =
-        downstream.commits_after_touching_files >= 10 ||
-        downstream.distinct_files_touched >= 10;
-      if (heavyDownstream) category = 'structural-risk';
-      else if (onlyCalibrationLow) category = 'calibration-noise';
-      else category = 'quality-concern';
-    }
-
-    results.push({
-      id: full.id,
-      title: full.title,
-      version_id: full.version_id,
-      kind: full.kind,
-      discipline: full.discipline,
-      est_minutes: full.est_minutes,
-      actual_minutes: full.actual_minutes,
-      scoping_confidence: full.scoping_confidence,
-      value_summary: full.value_summary,
-      description: full.description,
-      shipped_at: t.shipped_at,
-      diff_stats: diff,
-      files_touched: files,
-      downstream,
-      grade: g,
-      category,
-    });
-  }
-
-  if (process.argv.includes('--json')) {
-    console.log(JSON.stringify(results, null, 2));
-    return;
-  }
-
-  // Human-readable summary.
-  const passed = results.filter((r) => r.grade.passed);
-  const failed = results.filter((r) => !r.grade.passed);
-  console.log(`\n=== Audit summary ===`);
-  console.log(`Total graded:  ${results.length}`);
-  console.log(`Passed:        ${passed.length}`);
-  console.log(`Failed:        ${failed.length}  (threshold ${grader.RUBRIC.v1.threshold}, v1 deterministic)`);
-  console.log('');
-
-  if (failed.length === 0) {
-    console.log('No failures. Nothing to redo.');
-    return;
-  }
-
-  console.log('=== FAILURES (sorted by score asc) ===\n');
-  failed
-    .sort((a, b) => a.grade.score - b.grade.score)
-    .forEach((r) => {
-      console.log(`#${r.id}  score ${r.grade.score}/10  [${r.kind}]  est=${r.est_minutes}m act=${r.actual_minutes}m`);
-      console.log(`  ${r.title}`);
-      const scores = r.grade.rubric_scores;
-      const parts = Object.entries(scores).map(([k, v]) => `${k}=${v}`);
-      console.log(`  ${parts.join('  ')}`);
-      console.log('');
-    });
-
-  // Score histogram for the passed set so we see what the distribution looks like.
-  const buckets = { '5.0-5.9': 0, '6.0-6.9': 0, '7.0-7.9': 0, '8.0-8.9': 0, '9.0-10': 0 };
-  for (const r of passed) {
-    const s = r.grade.score;
-    if (s < 6) buckets['5.0-5.9']++;
-    else if (s < 7) buckets['6.0-6.9']++;
-    else if (s < 8) buckets['7.0-7.9']++;
-    else if (s < 9) buckets['8.0-8.9']++;
-    else buckets['9.0-10']++;
-  }
-  console.log('=== Passed-score histogram ===');
-  for (const [k, v] of Object.entries(buckets)) console.log(`  ${k}: ${v}`);
-}
-
-// Run only as a CLI. Without this guard the file executes main() — and hits the
-// API — the instant anything requires it, which is why its git helpers had never
-// been tested: there was no way to reach them without starting an audit
-// (task 1003223).
-if (require.main === module) {
-  main().catch((err) => {
-    console.error(err);
-    process.exit(1);
-  });
-}
-
-// Exported for tests/audit_ships_git_argv.mjs — the argv-vs-shell-string fix is a
-// property of THESE functions, so the test drives them rather than re-typing an
-// equivalent git call and hoping it matches.
-module.exports = { findCommitForTask, gitDiffStatsForCommit, filesTouchedByCommit, downstreamImpact };