@bongos/core 1.19.1036 → 1.19.1038

package/modules/grading/model-provider.js

@@ -0,0 +1,257 @@
+// modules/grading/model-provider.js — the ModelProvider port (ADR 0089 §3,
+// task 1002840): how a judge's model is called, as an adapter behind one seam
+// instead of a hard-coded `claude` spawn.
+//
+// WHY. Every platform LLM call funnels through runSubagent (grader-subagent.js):
+// the panel workers, the no-artifact shots, architect-audit, and the agents
+// module through the grade port. Until this file that function WAS the Claude
+// CLI spawn, so a judge from another model family — the property ADR 0089's
+// ensemble exists for — had no way in. Now a call names a provider and the
+// provider makes it. Every provider answers in the SAME shape the Claude spawn
+// always has: a `claude -p --output-format json`-style envelope on stdout and the
+// same error codes (SUBAGENT_SPAWN_FAILED / SUBAGENT_TIMEOUT /
+// SUBAGENT_NONZERO_EXIT). So nothing downstream changes — runWorker's retry, the
+// outage detection, extractAssistantResult / extractCostUsd, the LLM cache.
+//
+// THE MODEL REFERENCE. A model is still ONE STRING everywhere it travels
+// (signals.workers[].model, grader_model, the cache key). A string with no
+// provider prefix is an anthropic-cli model — every id this project uses today —
+// so today's calls are byte-identical. `<provider>:<model>` routes to a
+// REGISTERED provider (`deepinfra:deepseek-ai/DeepSeek-V3.1`,
+// `ollama:qwen2.5-coder:32b`). Only a prefix that names a registered provider is
+// split off; anything else stays a Claude model id, so a colon inside an id can
+// never re-route a call by accident.
+//
+// PROVIDERS.
+//   anthropic-cli      the `claude -p` spawn (grader-subagent.js registers it).
+//                      The default, and the only provider shipped config uses.
+//   openai-compatible  one adapter for DeepInfra / OpenRouter / Together /
+//                      Fireworks / Groq / vLLM / Ollama — POST
+//                      <base_url>/chat/completions with a BYOK key read from the
+//                      env var the instance names. PROMPT-ONLY: it has no Read
+//                      tool, so such a judge sees exactly what its prompt carries.
+//
+// INSTANCE CONFIG (the ADR 0062 host-owned pattern). Providers are declared in
+// config/grader-providers.json at the instance root; the core ships
+// grader-providers.neutral.json beside this file with NO providers, so a vanilla
+// instance is Claude-only. A key never lives in a config file — only the NAME
+// of the env var holding it. Declaring a provider is an owner decision: it sends
+// the diff under review to that vendor and it costs money per call (ADR 0089 §3).
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+
+const DEFAULT_PROVIDER = 'anthropic-cli';
+const PROVIDER_NAME_RE = /^[a-z][a-z0-9-]{1,39}$/;
+const API_KEY_ENV_RE = /^[A-Z][A-Z0-9_]{1,63}$/;
+const KINDS = new Set(['openai-compatible']);
+const DEFAULT_TIMEOUT_MS = 240_000;
+const ERROR_BODY_MAX = 2000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+
+const providers = new Map(); // name -> { name, kind, run }
+
+// One place a refusal is reported, so a malformed instance config is loud
+// without scattering console calls (the fitness console ratchet counts them).
+function refuse(msg) {
+  console.error(`grade model-provider: ${msg}`);
+}
+
+function registerModelProvider(provider) {
+  if (!provider || typeof provider.run !== 'function' || typeof provider.name !== 'string' || !provider.name) {
+    throw new TypeError('registerModelProvider: a provider needs a name and a run({ prompt, opts }) function');
+  }
+  const held = providers.get(provider.name);
+  if (held && held !== provider) throw new Error(`model provider '${provider.name}' is already registered`);
+  providers.set(provider.name, provider);
+  return provider;
+}
+
+function resolveModelProvider(name = DEFAULT_PROVIDER) {
+  const p = providers.get(name);
+  if (!p) throw new Error(`model provider '${name}' is not registered`);
+  return p;
+}
+
+function listModelProviders() {
+  return [...providers.keys()].sort();
+}
+
+// `<provider>:<model>` → { provider, model }, split ONLY when the prefix names a
+// registered provider other than the default; everything else is one Claude id.
+function parseModelRef(ref) {
+  const s = String(ref == null ? '' : ref);
+  const i = s.indexOf(':');
+  if (i > 0) {
+    const name = s.slice(0, i);
+    if (name !== DEFAULT_PROVIDER && providers.has(name)) return { provider: name, model: s.slice(i + 1) };
+  }
+  return { provider: DEFAULT_PROVIDER, model: s };
+}
+
+function codeError(code, message, extra = {}) {
+  return Object.assign(new Error(message), { code, ...extra });
+}
+
+// base_url must be https, or plain http to THIS machine only (a local vLLM /
+// Ollama): a key must never cross a network in cleartext.
+function checkBaseUrl(raw) {
+  let u;
+  try { u = new URL(String(raw)); } catch { return null; }
+  const loopback = LOOPBACK_HOSTS.has(u.hostname);
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) return null;
+  if (u.username || u.password || u.search || u.hash) return null;
+  return { url: u.toString().replace(/\/+$/, ''), loopback };
+}
+
+// Validate one declared provider: { def } normalised, or { error } saying why
+// not — never throws, so one bad entry cannot take the grader down.
+function validateProviderDef(name, def) {
+  if (!PROVIDER_NAME_RE.test(name) || name === DEFAULT_PROVIDER) return { error: `provider name '${name}' must match ${PROVIDER_NAME_RE} and not be '${DEFAULT_PROVIDER}'` };
+  if (!def || typeof def !== 'object') return { error: `provider '${name}' must be an object` };
+  if (!KINDS.has(def.kind)) return { error: `provider '${name}': kind must be one of ${[...KINDS].join(', ')}` };
+  const base = checkBaseUrl(def.base_url);
+  if (!base) return { error: `provider '${name}': base_url must be https:// (http:// only to localhost), with no credentials or query` };
+  const keyEnv = def.api_key_env == null ? null : String(def.api_key_env);
+  if (keyEnv != null && !API_KEY_ENV_RE.test(keyEnv)) return { error: `provider '${name}': api_key_env must be an env var NAME (${API_KEY_ENV_RE}) — never the key itself` };
+  if (keyEnv == null && !base.loopback) return { error: `provider '${name}': a remote provider needs api_key_env` };
+  const prices = {};
+  for (const [model, p] of Object.entries(def.price_per_mtok || {})) {
+    const input = Number(p && p.input);
+    const output = Number(p && p.output);
+    if (!(Number.isFinite(input) && input >= 0 && Number.isFinite(output) && output >= 0)) {
+      return { error: `provider '${name}': price_per_mtok['${model}'] needs non-negative input and output` };
+    }
+    prices[model] = { input, output };
+  }
+  return { def: { name, kind: def.kind, baseUrl: base.url, apiKeyEnv: keyEnv, prices } };
+}
+
+// USD for one call from the reply's token usage, or null when the model has no
+// declared price — a cost signal never fabricates a number it does not have.
+function priceCall(prices, model, usage) {
+  const p = prices[model];
+  if (!p || !usage) return null;
+  const inTok = Number(usage.prompt_tokens);
+  const outTok = Number(usage.completion_tokens);
+  if (!Number.isFinite(inTok) || !Number.isFinite(outTok)) return null;
+  return (inTok * p.input + outTok * p.output) / 1_000_000;
+}
+
+// The openai-compatible adapter. `fetchImpl` and `env` are injectable so the
+// whole adapter is testable against a stub with no key and no network.
+function createOpenAICompatibleProvider(def, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
+  const run = async ({ prompt, opts = {} }) => {
+    const started = Date.now();
+    const model = String(opts.model || '');
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const key = def.apiKeyEnv ? env[def.apiKeyEnv] : null;
+    // Refused BEFORE any request: no key means nothing is sent anywhere.
+    if (def.apiKeyEnv && !key) {
+      throw codeError('SUBAGENT_SPAWN_FAILED', `provider ${def.name}: no API key — set ${def.apiKeyEnv} (bring-your-own key)`, { run_ms: 0, stdout: '', stderr: '' });
+    }
+    const scrub = (t) => (key ? String(t).split(key).join('[redacted]') : String(t));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    let text;
+    try {
+      res = await fetchImpl(`${def.baseUrl}/chat/completions`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(key ? { authorization: `Bearer ${key}` } : {}) },
+        body: JSON.stringify({ model, messages: [{ role: 'user', content: String(prompt) }] }),
+        signal: controller.signal,
+      });
+      text = await res.text();
+    } catch (err) {
+      const run_ms = Date.now() - started;
+      if (controller.signal.aborted) {
+        throw codeError('SUBAGENT_TIMEOUT', `provider ${def.name}: timed out after ${timeoutMs}ms`, { run_ms, stdout: '', stderr: '' });
+      }
+      throw codeError('SUBAGENT_SPAWN_FAILED', `provider ${def.name}: request failed: ${scrub(err && err.message)}`, { run_ms, stdout: '', stderr: scrub(err && err.message) });
+    } finally {
+      clearTimeout(timer);
+    }
+    const run_ms = Date.now() - started;
+    if (!res.ok) {
+      throw codeError('SUBAGENT_NONZERO_EXIT', `provider ${def.name}: HTTP ${res.status}`, {
+        exit_code: res.status, run_ms, stdout: '', stderr: scrub(text).slice(0, ERROR_BODY_MAX),
+      });
+    }
+    let body = null;
+    try { body = JSON.parse(text); } catch { /* an unparseable 200 → empty result → the worker's parse_error path */ }
+    const content = body && body.choices && body.choices[0] && body.choices[0].message
+      ? body.choices[0].message.content : null;
+    const usage = body && body.usage ? body.usage : null;
+    const cost = priceCall(def.prices, model, usage);
+    const envelope = {
+      type: 'result',
+      result: typeof content === 'string' ? content : '',
+      ...(cost != null ? { total_cost_usd: cost } : {}),
+      provider: def.name,
+      model,
+      usage,
+    };
+    return { stdout: JSON.stringify(envelope), stderr: '', run_ms, exit_code: 0, cost_usd: cost };
+  };
+  return { name: def.name, kind: def.kind, run };
+}
+
+// ---------- instance config ----------
+//
+// The host's config/grader-providers.json, else the neutral starter beside this
+// file (which declares none). A missing instance file is the ordinary case; one
+// that does not parse falls back to the neutral starter — fail to vanilla, never
+// to dead — and each invalid entry is refused by name while the rest load.
+const NEUTRAL_PATH = path.join(__dirname, 'grader-providers.neutral.json');
+const INSTANCE_PATH = path.join(api.resolveInstanceRoot(), 'config', 'grader-providers.json');
+
+function readPack(file) {
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); } catch { return null; }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch { return null; }
+}
+
+function loadProviderConfig({ instancePath = INSTANCE_PATH, neutralPath = NEUTRAL_PATH } = {}) {
+  const instance = readPack(instancePath);
+  const pack = instance || readPack(neutralPath) || {};
+  const defs = [];
+  const refused = [];
+  const declared = pack.providers && typeof pack.providers === 'object' && !Array.isArray(pack.providers) ? pack.providers : {};
+  for (const [name, def] of Object.entries(declared)) {
+    const v = validateProviderDef(name, def);
+    if (v.error) refused.push(v.error); else defs.push(v.def);
+  }
+  return { source: instance ? instancePath : neutralPath, defs, refused };
+}
+
+// Register every provider the instance declares. Idempotent: an already
+// registered name is left alone. Returns the provider names now resolvable.
+function registerConfiguredProviders(opts = {}) {
+  const { defs, refused } = loadProviderConfig(opts);
+  for (const reason of refused) refuse(`${reason} — refused, grading continues without it`);
+  for (const def of defs) {
+    if (!providers.has(def.name)) registerModelProvider(createOpenAICompatibleProvider(def, opts));
+  }
+  return listModelProviders();
+}
+
+registerConfiguredProviders();
+
+module.exports = {
+  DEFAULT_PROVIDER,
+  createOpenAICompatibleProvider,
+  listModelProviders,
+  loadProviderConfig,
+  parseModelRef,
+  registerConfiguredProviders,
+  registerModelProvider,
+  resolveModelProvider,
+  validateProviderDef,
+};

package/modules/lifecycle/db-ship.js

@@ -277,9 +277,9 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     // The ordering below is NOT for the grader, whatever this comment used to
     // say. V3.R18 (#209) moved the grader out of resolveClaim — see the block
     // after this one — and the live panel never receives actual_minutes at all
-    // (modules/grading/grader-prompt.js buildPrompt prints est_minutes only;
-    // scoreEstActualBand lives in gradeDeterministic, whose one non-test caller
-    // is the retroactive audit in scripts/gds/audit-ships.js). The seal must
+    // (modules/grading/grader-prompt.js buildPrompt prints est_minutes only; the
+    // one scorer that read actual_minutes was retired with the v1 grader in task
+    // 1002842). The seal must
     // still precede the recompute, because the recompute SUMs the row it writes.
     // tests/regrade_actual_minutes.mjs pins the panel half of that.
     await sealSessionLog(client, {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1036",
+  "version": "1.19.1038",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1036",
+      "version": "1.19.1038",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1036",
+  "version": "1.19.1038",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7497,5 +7497,21 @@
       "id": "1004174",
       "text": "The owner of a hosted project can now upgrade it themselves: the \"you're behind\" banner on their project links to the Deploy page on the hub, which lets a project's owner move their own project, and only their own."
     }
+  ],
+  "1.19.1037": [
+    {
+      "id": "1002842",
+      "text": "The grader's retired first generation and an unused one-off audit script are removed, and the pieces a newer reviewer still depends on now live with it — nothing about how work is graded changes."
+    },
+    {
+      "id": "1004280",
+      "text": "The project's own notes no longer claim a past decision banned all new checks; each one now gives its real reason, and a test stops the wrong claim coming back."
+    }
+  ],
+  "1.19.1038": [
+    {
+      "id": "1002840",
+      "text": "The grader can now call AI models from other companies through one plug-in point, ready for a second-opinion reviewer; nothing changes today — it still uses only Claude and spends nothing new."
+    }
   ]
 }

package/scripts/gds/claim.js

@@ -739,7 +739,8 @@ async function main() {
     // last thing the builder reads before deciding how to work — task 1267.
     printDisciplineMode(task);
     // task 1004202: a task that changes a page is told to use /design and get its
-    // human's OK on the before/after. A nudge, never a gate (ADR 0162).
+    // human's OK on the before/after. A nudge, never a gate: gating on that OK would
+    // put a person's approval in the land path, which ADR 0162 retired.
     try {
       const nudge = visualReviewNudge(task);
       if (nudge) console.log(`\n${nudge.join('\n')}`);

package/scripts/gds/grade-smoke.js

@@ -2,7 +2,7 @@
 // Subagent grader smoke test — GDS-V3 task V3.R18 (#209) → MAS Phase 1 #395.
 //
 // Runs two synthetic ship scenarios end-to-end through the v3 multi-shot
-// subagent grader (DEFAULT_SHOTS × cross-family model, unanimous-PASS gate).
+// subagent grader (the worker panel, cross-family model, unanimous-PASS gate).
 // Asserts:
 //
 //   - Known-GOOD ship: a tiny, complete change → grade passes (unanimous
@@ -148,8 +148,8 @@ function summarize(result, label) {
 // -------- Main --------
 
 (async () => {
-  console.log(`Running subagent grader smoke (v${grader.VERSION}, model=${grader.DEFAULT_GRADER_MODEL}, ${grader.DEFAULT_SHOTS}× shots, threshold=${grader.THRESHOLD})`);
-  console.log('Two scenarios will run sequentially. Each spawns 3 parallel shots.');
+  console.log(`Running subagent grader smoke (v${grader.VERSION}, model=${grader.DEFAULT_GRADER_MODEL}, ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel, threshold=${grader.THRESHOLD})`);
+  console.log(`Two scenarios will run sequentially. Each runs the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel.`);
 
   let assertFailures = 0;
 

package/scripts/gds/render-check.js

@@ -7,7 +7,7 @@
 // count that still ran past its card (task 1003480) and a second grid child landing on the first (task 1003078)
 // both shipped looking correct in code and were found only by opening a browser.
 //
-// A SIGNAL, never a gate (ADR 0162): /ship-check shows it as an advisory row; ship.js and the grader never
+// A SIGNAL, never a gate (ADR 0329, decisions 3-4): /ship-check shows it as an advisory row; ship.js and the grader never
 // read it. The measurement is the kit's `text-fit` + `sibling-overlap` floors (modules/ui-design/kit/lib.js);
 // this file only picks the pages, runs the kit's renderer at 1280 + 390, and keeps those two floors.
 //

package/scripts/gds/ship-check.js

@@ -25,7 +25,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Each step: a label, the argv to run (node scripts run with THIS node), the command that heals it,
 // and how to read a non-zero exit. `optional` steps are skipped when their script is absent. An `advisory`
-// step is a signal, never a gate (ADR 0162): a non-zero exit reads `warn` (3 = no browser reads `skipped`).
+// step is a signal, never a gate (ADR 0329, decision 3): a non-zero exit reads `warn` (3 = no browser reads `skipped`).
 // `onlyWith` names the flag that adds a step; `skipWith` the flag that leaves one out.
 const STEPS = [
   { key: 'fitness', label: 'fitness.js (architecture + budgets + freshness gate)', argv: ['scripts/gds/fitness.js'], fix: 'read the ✗ lines above; each names its fix' },

package/scripts/gds/ship-flow.js

@@ -496,7 +496,7 @@ async function shipMain() {
       passed,
       // touches[] cleanup [4/8] (task 879): the drift scanner is gone; with no
       // scanner there is nothing to drift, so this audit-trail signal
-      // (grader.scoreScannerSmoke) is vacuously clean.
+      // (read by the retired v1 grader, task 1002842) is vacuously clean.
       scanner_clean: true,
       smoke_clean: smoke.clean,
     },

package/scripts/gds/ship-grade-steps.js

@@ -314,7 +314,7 @@ function formatOutageDiagnostic(g, cliFinding) {
 
 // cliFinding: the preflight `claude CLI` row, injected by printGradeOutcome so a
 // dark panel can say "your CLI is logged out" instead of leaving the builder to
-// guess. Report-only — it never changes the outcome (ADR 0162: no new gates).
+// guess. Report-only — it never changes the outcome: it explains an outage, it does not decide one.
 function formatGradeOutcome(g, taskId, cliFinding = null) {
   const out = [];
   // #943: a TOTAL grader outage (every gating worker failed to spawn / the
@@ -466,7 +466,7 @@ function printGradeOutcome(g, taskId) {
   // task 1003313: on a TOTAL outage only, ask the existing preflight whether the
   // local `claude` CLI is launchable and logged in — the two faults that produce
   // this exact all-workers-dead signature. Report-only and outage-only, so the
-  // happy path pays nothing and no ship is newly gated (ADR 0162).
+  // happy path pays nothing and no ship's outcome depends on the probe.
   let cliFinding = null;
   if (g?.signals?.panel_outcome === 'unavailable') {
     try {

package/scripts/gds/visual-review-nudge.js

@@ -5,7 +5,8 @@
 // real browser, and get the human's OK on the before/after before shipping — the
 // project default for every builder since the owner's 2026-09-23 decision.
 //
-// A NUDGE, never a gate (ADR 0162). "Is this UI work" is the ONE predicate the
+// A NUDGE, never a gate: as a gate, the human's OK would be a person's approval in
+// the land path, which ADR 0162 retired. "Is this UI work" is the ONE predicate the
 // artist review and the grader's copy lens already use (lifecycle/cascade.js), so
 // the three cannot disagree. Nothing has changed yet at claim time, so it is fed
 // the paths the task NAMES: its touches[] and any modules/*/public/ path written

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1036'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1038'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/adr_0162_gate_citation.mjs

@@ -0,0 +1,167 @@
+// tests/adr_0162_gate_citation.mjs — "no new gates" is not what ADR 0162 decided; no surface
+// may cite 0162 as the reason something is a signal and not a gate (task 1004280).
+//
+// WHAT WENT WRONG. Task 1003573 corrected one slogan cited to ADR 0162 ("verdicts are advisory,
+// never self-executing" — ADR 0158 §2's rule; tests/adr_0162_citation.mjs pins that). A sibling
+// slogan rode along: "no new gates (ADR 0162)", "a signal, never a gate (ADR 0162)", "NOT A
+// PIPELINE GATE (ADR 0162)". It is broader than the ADR. 0162 retired REVIEW gates — a gate that
+// needs a particular person's approval before work can land — and its own table keeps four
+// automatic controls, three of which fail CLOSED (the grader among them). ADR 0241 ("What ADR 0162
+// actually forbids") states the test 0162 leaves behind: an automatic, state-read, rank-consistent
+// gate with a named escape hatch is admissible. So "this is not a gate because 0162" cites a rule
+// 0162 does not make, and it hides the surface's real reason for staying advisory.
+//
+// The surfaces keep their choice (most were right to stay advisory); only the reason changed:
+// 0162 for "no human approval in the land path", and the surface's own reason otherwise.
+//
+// WHAT THIS PINS. (1) The premise, read from the ADRs: 0162 keeps fail-closed automatic controls
+// and never says "no new gates"; 0241 says what 0162 forbids. (2) No tracked surface cites 0162
+// with the gate shorthand, in any of the shapes the 2026-09-25 sweep found.
+//
+// Run:  node --test tests/adr_0162_gate_citation.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ADR_0162 = 'docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md';
+const ADR_0241 = 'docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md';
+
+// A match is a line that gives 0162 as the reason something is not (or must not be) a gate.
+const GATE_SHORTHANDS = [
+  // The advisory claim, then 0162 as its source: "no new gates (ADR 0162)", "A SIGNAL, never a
+  // gate (ADR 0162)", "NOT A PIPELINE GATE (ADR 0162)", "no ship is newly gated (ADR 0162)",
+  // "WITHOUT adding a gate (ADR 0162)", "It gates NOTHING (ADR 0162 / ADR 0241)", "a new gate on
+  // the ship path (ADR 0162)", "It had to stay a signal (ADR 0162)", "never flips its exit (ADR 0162)".
+  /\b(?:no new gates?|never a gate|not a (?:pipeline )?gate|newly gated|adding a gate|gates nothing|new gate on the ship path|stay a signal|never flips its exit)\b[^\n()]{0,40}\(ADR 0162\b/i,
+  // 0162, then the shorthand as its gloss: "ADR 0162 — no new gates", "(ADR 0162: no new gates)",
+  // "[ADR 0162](…) (no new gates)".
+  /\b0162\b[\])]?\s*(?:\(|—|–|:)\s*no new gates?\b/i,
+  // A describe-only posture cited to 0162: "(describe, never confirm/flip — ADR 0162)". That is
+  // 0158 §2's rule — the sibling test's subject, in a shape it does not match.
+  /\bnever confirm\/flip\s*[—–-]\s*ADR 0162\b/i,
+];
+
+// Deliberately NOT corrected, each with its reason. Shrink-only: when one is fixed, delete its
+// row — the last test fails until you do, so a stale exemption cannot outlive what it excused.
+const KNOWN_DEFERRED = new Map([
+  // HARD-FLOOR surfaces (scripts/gds/gate-review.js HARD_FLOOR_GLOBS lists `.claude/hooks/`):
+  // even a comment-only edit escalates to the owner, which a citation fix does not justify on
+  // its own. Correct them with the next real edit (the redteam-patrol.yml precedent, task 1003573).
+  ['.claude/hooks/allow-rule-guard.js', 'hard-floor gate surface'],
+  ['.claude/hooks/git-guard.js', 'hard-floor gate surface'],
+  // A hall PAGE script: any edit under modules/*/public/ is UI work, so its ship files an artist
+  // review that holds the deploy (ADR 0241). A comment fix does not justify that; correct it
+  // with the next real edit to the page.
+  ['modules/hall-ui/public/studio.js', 'page script — an edit files an artist review'],
+]);
+
+const HISTORICAL = /^docs\/session-logs\//;
+// This file and its sibling quote the shapes they hunt, as examples.
+const SELF = new Set(['tests/adr_0162_gate_citation.mjs', 'tests/adr_0162_citation.mjs']);
+const TEXT = /\.(?:md|js|mjs|cjs|json|ya?ml|sql|sh|html|txt)$/;
+// A line that NAMES the slogan as its subject is discussing it, not citing by it.
+const DISCUSSES_SLOGAN = /paraphrase|shorthand/i;
+// Markdown link targets carry the ADR's filename, which would sit between a citation and its gloss.
+const stripLinkTargets = (s) => s.replace(/\]\([^)\s]*\)/g, ']');
+const continuation = (s) => (s || '').replace(/^\s*(?:\/\/+|#+|--|\*|>|-)?\s*/, '');
+
+function offendersIn(rel, text) {
+  const lines = stripLinkTargets(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    const here = lines[i];
+    if (DISCUSSES_SLOGAN.test(here)) continue;
+    // Join the next line so a citation wrapped mid-phrase still reads as one; only a match
+    // that STARTS on this line is this line's.
+    const window = `${here} ${continuation(lines[i + 1])}`;
+    if (!/0162/.test(window)) continue;
+    for (const re of GATE_SHORTHANDS) {
+      const m = re.exec(window);
+      if (m && m.index < here.length) { hits.push(`${rel}:${i + 1}: ${here.trim().slice(0, 140)}`); break; }
+    }
+  }
+  return hits;
+}
+
+function trackedTextFiles() {
+  const r = spawnSync('git', ['ls-files', '-z'], { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0) return null; // a packaged core is not a git checkout
+  return r.stdout.split('\0').filter((f) => f && TEXT.test(f));
+}
+
+test('the premise: ADR 0162 keeps automatic gates that fail closed, and never says "no new gates"', () => {
+  const adr0162 = read(ADR_0162);
+  assert.match(adr0162, /Review requirements on `main` are \*\*retired permanently\*\*/, 'what 0162 retired');
+  const failsClosed = adr0162.split('\n').filter((l) => /^\|.*\|\s*closed\s*\|\s*$/.test(l));
+  assert.ok(failsClosed.length >= 3,
+    `0162's compensating-controls table should keep >=3 controls that fail CLOSED (found ${failsClosed.length}) — `
+    + 'if the ADR changed, re-ask whether "no new gates" became its rule before re-pointing these citations');
+  assert.doesNotMatch(adr0162, /no new gates?/i, 'ADR 0162 never says "no new gates"');
+  assert.match(read(ADR_0241), /^## What ADR 0162 actually forbids$/m, 'ADR 0241 is where the narrower rule is written');
+});
+
+test('the detector recognises every shape the sweep corrected, and passes the true citations', () => {
+  const flag = (line) => offendersIn('probe.md', line).length > 0;
+  for (const bad of [
+    '- **ADR 0162 — no new gates.** This skill describes and recovers; it never inserts a human-approval step',
+    '// A SIGNAL, never a gate (ADR 0162): /ship-check shows it as an advisory row; ship.js and the grader never',
+    '// step is a signal, never a gate (ADR 0162): a non-zero exit reads `warn` (3 = no browser reads `skipped`).',
+    '// A NUDGE, never a gate (ADR 0162). "Is this UI work" is the ONE predicate the',
+    '    // human\'s OK on the before/after. A nudge, never a gate (ADR 0162).',
+    '// guess. Report-only — it never changes the outcome (ADR 0162: no new gates).',
+    '  // happy path pays nothing and no ship is newly gated (ADR 0162).',
+    '- **Relates to:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (no new gates), [ADR 0197](0197-the-ui-design-module.md) (the kit)',
+    'or both. It had to stay a signal (ADR 0162).',
+    '- **Block the fourth attempt.** That is a new gate on the ship path (ADR 0162), and a wrong',
+    'shows them as an ADVISORY row that never flips its exit (ADR 0162). Not a grader worker',
+    '// NOT A PIPELINE GATE (ADR 0162): it gates no merge, no CI check, no ship.',
+    '// It gates NOTHING (ADR 0162 / ADR 0241): nothing here holds a ship or a deploy.',
+    '// pass and WITHOUT adding a gate (ADR 0162). Every case below that has a low',
+    '// read-only (describe, never confirm/flip — ADR 0162).',
+  ]) assert.ok(flag(bad), `should flag: ${bad}`);
+
+  for (const good of [
+    '- **Related:** ADR 0162 (no new human gates on the ship path)',
+    'No review requirement — gates are CI checks, not human approvals (ADR 0162).',
+    '- **Relates to:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (review gates retired: no human approval in the land path)',
+    'no confirms, no status flips, and no new approval step on anyone\'s ship (ADR 0162). The remediation lines',
+    '// A NUDGE, never a gate: as a gate, the human\'s OK would be a person\'s approval in\n// the land path, which ADR 0162 retired.',
+    '// A SIGNAL, never a gate (ADR 0329, decisions 3-4): /ship-check shows it as an advisory row',
+    'It never holds a builder\'s ship, which is what keeps it compatible with ADR 0162.',
+    'This matters, because the shorthand "no new gates (ADR 0162)" is broader than the ADR',
+  ]) assert.ok(!flag(good), `should pass: ${good}`);
+});
+
+test('no tracked surface cites ADR 0162 as the reason something is not a gate', (t) => {
+  const files = trackedTextFiles();
+  if (!files) return t.skip('not a git checkout — nothing tracked to scan');
+  const offenders = [];
+  for (const rel of files) {
+    if (SELF.has(rel) || HISTORICAL.test(rel) || KNOWN_DEFERRED.has(rel)) continue;
+    let text;
+    try { text = readFileSync(path.join(ROOT, rel), 'utf8'); } catch { continue; }
+    if (!text.includes('0162')) continue;
+    offenders.push(...offendersIn(rel, text));
+  }
+  assert.deepEqual(offenders, [],
+    'these cite ADR 0162 for "no new gates" / "a signal, never a gate". 0162 retired gates that need a '
+    + 'particular person\'s approval in the land path, and keeps automatic gates that fail closed (ADR 0241). '
+    + 'Cite 0162 for "no human approval in the land path", and name the surface\'s own reason for staying advisory.');
+});
+
+test('every deferred exemption still has something to excuse (shrink-only)', (t) => {
+  if (!trackedTextFiles()) return t.skip('not a git checkout');
+  for (const [rel, why] of KNOWN_DEFERRED) {
+    let text = '';
+    try { text = read(rel); } catch { /* deleted: the exemption is stale too */ }
+    assert.ok(offendersIn(rel, text).length > 0,
+      `${rel} (${why}) no longer cites 0162 for the gate shorthand — delete its KNOWN_DEFERRED row`);
+  }
+});

package/tests/government_protected_surfaces.mjs

@@ -305,6 +305,20 @@ const ADDED_SINCE_R101 = [
        + 'deterministic veto, so an edit here can switch off the protected-path gate '
        + 'for every grade at once.',
   },
+  // task 1002840 (ADR 0089 §3): the ModelProvider port and its neutral config.
+  {
+    after: 'modules/grading/grade-engine.js',
+    glob: 'modules/grading/model-provider.js',
+    why: 'the ModelProvider port every grader model call goes through. It decides which '
+       + 'vendor receives the diff under review and with which key, so an edit here can '
+       + 're-route or blind the whole panel.',
+  },
+  {
+    after: 'modules/grading/model-provider.js',
+    glob: 'modules/grading/grader-providers.neutral.json',
+    why: 'the core neutral provider set, which declares none. An entry added here would '
+       + 'send every instance\'s diffs to a vendor by default.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from