@bongos/core 1.19.1036 → 1.19.1038

package/tests/grade_model_provider.mjs

@@ -0,0 +1,217 @@
+// tests/grade_model_provider.mjs — the ModelProvider port + the openai-compatible
+// adapter (task 1002840, ADR 0089 §3).
+//
+// Pins: (1) every model id in use today still runs on the Claude spawn, with the
+// identical argv; (2) the openai-compatible adapter against a LOCAL STUB server —
+// request shape, envelope, cost, and every failure mapped to the error codes the
+// worker runner already understands — with no real key and no network; (3) a key
+// that is missing sends nothing, and a key never leaks into an error; (4) the
+// config loader fails to vanilla; (5) the judge table reproduces the old if/else
+// and refuses a same-family or non-Claude judge (ADR 0024 / the Claude floor).
+//
+// Run:  node --test tests/grade_model_provider.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const subagent = require('../modules/grading/grader-subagent.js');
+const mp = require('../modules/grading/model-provider.js');
+const model = require('../modules/grading/grader-model.js');
+const workers = require('../modules/grading/grader-workers');
+
+// A local OpenAI-shaped server. `reply(req, body)` returns { status, json|text, delayMs }.
+async function stubServer(reply) {
+  const seen = [];
+  const server = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', (d) => { raw += d; });
+    req.on('end', async () => {
+      const body = raw ? JSON.parse(raw) : null;
+      seen.push({ method: req.method, url: req.url, headers: req.headers, body });
+      const r = reply(req, body) || {};
+      if (r.delayMs) await new Promise((ok) => setTimeout(ok, r.delayMs));
+      res.writeHead(r.status || 200, { 'content-type': 'application/json' });
+      res.end(r.text != null ? r.text : JSON.stringify(r.json));
+    });
+  });
+  await new Promise((ok) => server.listen(0, '127.0.0.1', ok));
+  const { port } = server.address();
+  return { seen, base: `http://127.0.0.1:${port}/v1`, close: () => new Promise((ok) => server.close(ok)) };
+}
+
+const KEY = 'test-key-not-a-real-secret-0123456789';
+function provider(base, extra = {}, env = { STUB_LLM_KEY: KEY }) {
+  const v = mp.validateProviderDef('stub', { kind: 'openai-compatible', base_url: base, api_key_env: 'STUB_LLM_KEY', ...extra });
+  assert.ok(v.def, v.error);
+  return mp.createOpenAICompatibleProvider(v.def, { env });
+}
+const completion = (content, usage = { prompt_tokens: 1000, completion_tokens: 200 }) => ({ json: { choices: [{ message: { role: 'assistant', content } }], usage } });
+
+test('parseModelRef: every id in use today is a Claude model; only a REGISTERED prefix routes elsewhere', () => {
+  for (const id of ['claude-sonnet-5', 'claude-opus-5', 'claude-fable-5', '', 'x:y']) {
+    assert.deepEqual(mp.parseModelRef(id), { provider: 'anthropic-cli', model: id });
+  }
+  mp.registerModelProvider({ name: 'test-ollama', kind: 'openai-compatible', run: async () => ({}) });
+  assert.deepEqual(mp.parseModelRef('test-ollama:qwen2.5-coder:32b'), { provider: 'test-ollama', model: 'qwen2.5-coder:32b' },
+    'split at the FIRST colon only — a colon inside the model id survives');
+  assert.deepEqual(mp.parseModelRef('anthropic-cli:claude-sonnet-5'), { provider: 'anthropic-cli', model: 'anthropic-cli:claude-sonnet-5' },
+    'the default is never a prefix');
+  assert.ok(mp.listModelProviders().includes('anthropic-cli'));
+});
+
+test('the Claude spawn is the default provider, with the identical argv', { skip: process.platform === 'win32' && 'the fake CLI is a shebang script' }, async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-'));
+  const bin = path.join(dir, 'claude');
+  fs.writeFileSync(bin, '#!/usr/bin/env node\nprocess.stdin.resume(); process.stdin.on("end", () => process.stdout.write(JSON.stringify({ type: "result", result: JSON.stringify(process.argv.slice(2)), total_cost_usd: 0.5 })));\n');
+  fs.chmodSync(bin, 0o755);
+  try {
+    const r = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, model: 'claude-sonnet-5', cwd: dir } });
+    const argv = JSON.parse(subagent.extractAssistantResult(r.stdout));
+    const perm = typeof process.getuid === 'function' && process.getuid() === 0 ? 'acceptEdits' : 'bypassPermissions';
+    assert.deepEqual(argv, ['-p', '--print', '--model', 'claude-sonnet-5', '--output-format', 'json', '--tools', 'Read', '--disable-slash-commands', '--permission-mode', perm]);
+    assert.equal(r.cost_usd, 0.5);
+    const d = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, cwd: dir } });
+    assert.equal(JSON.parse(subagent.extractAssistantResult(d.stdout))[3], 'claude-sonnet-5', 'no model → the default grader model, as before');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('openai-compatible: request shape, envelope and cost — against a local stub', async () => {
+  const s = await stubServer(() => completion('{"code_quality": 8}'));
+  try {
+    const p = provider(s.base, { price_per_mtok: { 'deepseek-x': { input: 0.25, output: 1 } } });
+    const r = await p.run({ prompt: 'PROMPT TEXT', opts: { model: 'deepseek-x', timeoutMs: 5000 } });
+    assert.equal(s.seen.length, 1);
+    assert.equal(s.seen[0].method, 'POST');
+    assert.equal(s.seen[0].url, '/v1/chat/completions');
+    assert.equal(s.seen[0].headers.authorization, `Bearer ${KEY}`);
+    assert.deepEqual(s.seen[0].body, { model: 'deepseek-x', messages: [{ role: 'user', content: 'PROMPT TEXT' }] });
+    // The same envelope contract the Claude spawn honours, so nothing downstream changes.
+    assert.equal(subagent.extractAssistantResult(r.stdout), '{"code_quality": 8}');
+    const cost = (1000 * 0.25 + 200 * 1) / 1e6;
+    assert.equal(subagent.extractCostUsd(r.stdout), cost);
+    assert.equal(r.cost_usd, cost);
+    assert.equal(r.exit_code, 0);
+    const unpriced = await p.run({ prompt: 'x', opts: { model: 'other-model' } });
+    assert.equal(unpriced.cost_usd, null, 'no declared price → no cost number, never a guess');
+    assert.equal(subagent.extractCostUsd(unpriced.stdout), null);
+  } finally { await s.close(); }
+});
+
+test('openai-compatible: failures map to the codes the worker runner already retries or reports', async () => {
+  const s = await stubServer((req, body) => {
+    if (body.model === 'http-500') return { status: 500, text: `upstream says ${KEY} is invalid` };
+    if (body.model === 'slow') return { delayMs: 300, ...completion('late') };
+    if (body.model === 'garbage') return { text: 'not json at all' };
+    return completion('ok');
+  });
+  try {
+    const p = provider(s.base);
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'http-500' } }), (e) => {
+      assert.equal(e.code, 'SUBAGENT_NONZERO_EXIT');
+      assert.equal(e.exit_code, 500);
+      assert.ok(!e.stderr.includes(KEY) && e.stderr.includes('[redacted]'), 'the key is scrubbed from what a grade row stores');
+      return true;
+    });
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'slow', timeoutMs: 50 } }), (e) => e.code === 'SUBAGENT_TIMEOUT');
+    const g = await p.run({ prompt: 'x', opts: { model: 'garbage' } });
+    assert.equal(subagent.extractAssistantResult(g.stdout), '', 'an unparseable 200 is an empty result → the worker parse_error path, retried once');
+  } finally { await s.close(); }
+  const dead = provider(s.base);
+  await assert.rejects(dead.run({ prompt: 'x', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED', 'a closed port is a spawn failure');
+});
+
+test('a missing key sends NOTHING anywhere', async () => {
+  const s = await stubServer(() => completion('ok'));
+  try {
+    const p = provider(s.base, {}, {});
+    await assert.rejects(p.run({ prompt: 'the diff', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED' && /set STUB_LLM_KEY/.test(e.message));
+    assert.equal(s.seen.length, 0);
+  } finally { await s.close(); }
+});
+
+test('an open-model judge runs through the SAME worker runner and verdict code', async () => {
+  const s = await stubServer(() => completion(JSON.stringify({ code_quality: 8, economy: 8, confidence: 0.8, issues: [], notes_md: 'fine' })));
+  try {
+    mp.registerModelProvider({ ...provider(s.base, { price_per_mtok: { 'q-coder': { input: 1, output: 1 } } }), name: 'test-stub' });
+    const r = await workers.runWorker(workers.quality, {
+      task: { id: 1, title: 't', description: 'd' }, valueSummary: 'v', diff: 'diff', changedFiles: [], diffStats: null,
+      model: 'test-stub:q-coder', runOpts: {}, runSubagentFn: subagent.runSubagent, extractAssistantResultFn: subagent.extractAssistantResult,
+    });
+    assert.equal(r.verdict, 'pass');
+    assert.equal(r.scores.code_quality, 8);
+    assert.equal(r.model, 'test-stub:q-coder', 'the record names the provider');
+    assert.equal(r.cost_usd, 1200 / 1e6);
+    assert.equal(s.seen[0].body.model, 'q-coder', 'the provider receives its own model id');
+  } finally { await s.close(); }
+});
+
+test('provider config: validated, and a bad instance file fails to vanilla', () => {
+  const bad = (name, def) => mp.validateProviderDef(name, def).error;
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'K_KEY' }), /https/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1', api_key_env: 'sk-live-abc' }), /env var NAME/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1' }), /needs api_key_env/);
+  assert.match(bad('anthropic-cli', { kind: 'openai-compatible', base_url: 'https://x.example/v1', api_key_env: 'K' }), /must match|not be/);
+  assert.match(bad('x-prov', { kind: 'grpc', base_url: 'https://x.example/v1', api_key_env: 'KK' }), /kind/);
+  assert.equal(bad('local-ollama', { kind: 'openai-compatible', base_url: 'http://localhost:11434/v1' }), undefined, 'keyless http is allowed to this machine only');
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-cfg-'));
+  try {
+    const neutral = path.join(gradingDir(), 'grader-providers.neutral.json');
+    assert.deepEqual(mp.loadProviderConfig({ instancePath: path.join(dir, 'absent.json'), neutralPath: neutral }).defs, [],
+      'the shipped neutral starter declares no provider — a vanilla instance is Claude-only');
+    const broken = path.join(dir, 'broken.json');
+    fs.writeFileSync(broken, '{ not json');
+    assert.equal(mp.loadProviderConfig({ instancePath: broken, neutralPath: neutral }).source, neutral);
+    const mixed = path.join(dir, 'mixed.json');
+    fs.writeFileSync(mixed, JSON.stringify({ providers: {
+      deepinfra: { kind: 'openai-compatible', base_url: 'https://api.deepinfra.com/v1/openai', api_key_env: 'DEEPINFRA_API_KEY' },
+      leaky: { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'LEAKY_KEY' },
+    } }));
+    const cfg = mp.loadProviderConfig({ instancePath: mixed, neutralPath: neutral });
+    assert.deepEqual(cfg.defs.map((d) => d.name), ['deepinfra']);
+    assert.equal(cfg.refused.length, 1, 'one bad entry is refused by name; the rest load');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+function gradingDir() {
+  return path.dirname(require.resolve('../modules/grading/model-provider.js'));
+}
+
+test('the judge table reproduces the old if/else, and refuses a same-family or non-Claude judge', () => {
+  const oldIfElse = (bm) => {
+    const s = bm.toLowerCase();
+    if (s.includes('fable') || s.includes('mythos')) return 'claude-sonnet-5';
+    if (s.includes('opus')) return 'claude-sonnet-5';
+    if (s.includes('sonnet')) return 'claude-opus-5';
+    if (s.includes('haiku')) return 'claude-opus-5';
+    return null;
+  };
+  const tokens = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+  const ids = ['claude-fable-5', 'claude-opus-5-5', 'claude-sonnet-5', 'claude-haiku-4-5', 'Claude-OPUS-4-8'];
+  for (const a of tokens) for (const b of tokens) ids.push(`claude-${a}-${b}`);
+  for (const id of ids) assert.equal(model.selectGraderModel({ builderModel: id }), oldIfElse(id), id);
+  assert.deepEqual(model.JUDGE_TABLE, model.BUILTIN_JUDGE_TABLE, 'the rubric table is exactly the built-in fallback');
+
+  const logged = [];
+  const orig = console.error;
+  console.error = (...a) => { logged.push(a.join(' ')); };
+  try {
+    assert.equal(model.selectGraderModel({ builderModel: 'gpt-9' }), 'claude-sonnet-5', 'an unknown builder warns and grades on the default — never throws (task 1002659)');
+  } finally { console.error = orig; }
+  assert.match(logged.join('\n'), /unrecognized builder model/);
+
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'claude-opus-5' }]).join(), /family it would grade/);
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'deepinfra:deepseek-v3' }]).join(), /plain Claude model id/);
+  assert.match(model.judgeTableProblems([]).join(), /non-empty/);
+  assert.deepEqual(model.judgeTableProblems(model.BUILTIN_JUDGE_TABLE), []);
+});

package/tests/grader.mjs

@@ -1,8 +1,8 @@
 // tests/grader.mjs
 //
-// Grader tests. Covers both:
-//   - the v1 deterministic process-audit grader (kept for audit-ships.js)
-//   - the v2 subagent quality grader (the actual credits gate from V3.R18 #209)
+// Grader tests: the subagent quality grader (the credits gate since V3.R18 #209).
+// The v1 deterministic process-audit grader was retired in task 1002842; the
+// export-surface test below pins that it stays gone.
 //
 // The v2 subagent itself is a real-network call, so the tests stop at the
 // validator + prompt-builder boundary; the network-touching end-to-end check
@@ -48,127 +48,6 @@ async function testAsync(name, fn) {
   }
 }
 
-// ========================================================================
-// v1 — deterministic grader (legacy, used only by audit-ships.js)
-// ========================================================================
-
-test('v1 scoreEstActualBand: ratio inside [0.5, 2.0] → 10', () => {
-  assert.equal(grader.scoreEstActualBand(60, 60), 10);
-  assert.equal(grader.scoreEstActualBand(30, 60), 10);
-  assert.equal(grader.scoreEstActualBand(120, 60), 10);
-});
-
-test('v1 scoreEstActualBand: ratio outside band drops linearly', () => {
-  assert.equal(grader.scoreEstActualBand(18, 60), 5);
-  assert.equal(grader.scoreEstActualBand(360, 60), 5);
-});
-
-test('v1 scoreEstActualBand: extreme ratios → 0', () => {
-  assert.equal(grader.scoreEstActualBand(6, 60), 0);
-  assert.equal(grader.scoreEstActualBand(600, 60), 0);
-});
-
-test('v1 scoreEstActualBand: missing est → 6, missing actual → 5', () => {
-  assert.equal(grader.scoreEstActualBand(60, null), 6);
-  assert.equal(grader.scoreEstActualBand(null, 60), 5);
-});
-
-test('v1 scoreValueSummary: maps length + verb', () => {
-  assert.equal(grader.scoreValueSummary(''), 0);
-  assert.equal(grader.scoreValueSummary(null), 0);
-  assert.equal(grader.scoreValueSummary('short note'), 5);
-  assert.equal(grader.scoreValueSummary('a moderately worded summary that lands above forty characters'), 8);
-  const s = 'wire the auto-grader into the completed→confirmed transition so every task gets a quality mark before its credits are paid out';
-  assert.ok(s.length > 120);
-  assert.equal(grader.scoreValueSummary(s), 10);
-});
-
-test('v1 scoreDiffHygiene: phantom ship → 0, normal → 10, too-broad → 5', () => {
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 0, lines_added: 0, lines_removed: 0 }), 0);
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 5, lines_added: 200, lines_removed: 30 }), 10);
-  assert.equal(grader.scoreDiffHygiene({ files_changed: 80, lines_added: 1000, lines_removed: 200 }), 5);
-});
-
-test('v1 scoreScopingSignal: maps each level', () => {
-  assert.equal(grader.scoreScopingSignal(0), 2);
-  assert.equal(grader.scoreScopingSignal(1), 4);
-  assert.equal(grader.scoreScopingSignal(2), 6);
-  assert.equal(grader.scoreScopingSignal(3), 7);
-  assert.equal(grader.scoreScopingSignal(4), 8);
-  assert.equal(grader.scoreScopingSignal(5), 10);
-  assert.equal(grader.scoreScopingSignal(null), 6);
-});
-
-test('v1 scoreLocNetNegative', () => {
-  assert.equal(grader.scoreLocNetNegative({ lines_added: 20, lines_removed: 100 }), 10);
-  assert.equal(grader.scoreLocNetNegative({ lines_added: 100, lines_removed: 20 }), 0);
-});
-
-test('v1 scoreLearningRow', () => {
-  assert.equal(grader.scoreLearningRow({ body_md: 'x'.repeat(200) }), 10);
-  assert.equal(grader.scoreLearningRow(null), 0);
-});
-
-test('v1 scoreArtRubricAvg clamps + nulls', () => {
-  assert.equal(grader.scoreArtRubricAvg(8.7), 8.7);
-  assert.equal(grader.scoreArtRubricAvg(15), 10);
-  assert.equal(grader.scoreArtRubricAvg(-1), 0);
-  assert.equal(grader.scoreArtRubricAvg(NaN), null);
-});
-
-test('v1 blendWeightsForKind: feature renorms to 1.0', () => {
-  const w = grader.blendWeightsForKind('feature');
-  const total = Object.values(w).reduce((a, b) => a + b, 0);
-  assert.ok(Math.abs(total - 1.0) < 1e-6, `total=${total}, expected 1.0`);
-});
-
-test('v1 blendWeightsForKind: cleanup replaces diff_hygiene', () => {
-  const w = grader.blendWeightsForKind('cleanup');
-  assert.ok('loc_net_negative' in w);
-  assert.ok(!('diff_hygiene' in w));
-});
-
-test('v1 gradeDeterministic: well-shipped feature passes', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 99, kind: 'feature', est_minutes: 240, actual_minutes: 200, scoping_confidence: 4 },
-    verification: {
-      scanner_clean: true, smoke_clean: true,
-      diff_stats: { files_changed: 10, lines_added: 400, lines_removed: 50 },
-    },
-    actualMinutes: 200,
-    valueSummary: 'wire the auto-grader into ship.js so every task gets a quality mark before credits are paid; gates the completed→confirmed transition',
-  });
-  assert.ok(result.score >= 9.0, `score=${result.score}`);
-  assert.equal(result.passed, true);
-  assert.equal(result.grader_kind, 'auto');
-  assert.equal(result.grader_version, grader.RUBRIC.v1.version);
-  assert.equal(result.threshold, grader.RUBRIC.v1.threshold);
-});
-
-test('v1 gradeDeterministic: phantom ship scores low', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 100, kind: 'feature', est_minutes: 240, actual_minutes: 30, scoping_confidence: 2 },
-    verification: {
-      scanner_clean: true, smoke_clean: true,
-      diff_stats: { files_changed: 0, lines_added: 0, lines_removed: 0 },
-    },
-    actualMinutes: 30,
-    valueSummary: '',
-  });
-  assert.ok(result.score < 5.0, `score=${result.score}`);
-  assert.equal(result.passed, false);
-});
-
-test('v1 gradeDeterministic: notes_md says deprecated', () => {
-  const result = grader.gradeDeterministic({
-    task: { id: 106, kind: 'feature', est_minutes: 60, actual_minutes: 60, scoping_confidence: 4 },
-    verification: { scanner_clean: true, smoke_clean: true, diff_stats: { files_changed: 3, lines_added: 50, lines_removed: 5 } },
-    actualMinutes: 60,
-    valueSummary: 'a reasonable shipped change',
-  });
-  assert.match(result.notes_md, /v1.*deprecated/i);
-});
-
 // ========================================================================
 // v2 — subagent grader (the credits gate as of V3.R18 #209)
 // ========================================================================
@@ -181,17 +60,29 @@ test('v4 exports the expected surface (current panel-based gate)', () => {
     'buildPrompt', 'selectGraderModel', 'validateAndScore', 'aggregateShots',
     'runSubagent', 'runOneShot', 'gradeSubagentV3MultiShot',
     // constants
-    'THRESHOLD', 'VERSION', 'DEFAULT_GRADER_MODEL', 'DEFAULT_SHOTS', 'ASSUMED_BUILDER_MODEL',
+    'THRESHOLD', 'VERSION', 'DEFAULT_GRADER_MODEL', 'ASSUMED_BUILDER_MODEL',
     // utilities
     'extractJson', 'extractAssistantResult', 'extractCostUsd', 'RUBRIC',
   ];
   for (const name of required) {
     assert.ok(name in grader, `missing export: ${name}`);
   }
+  // task 1002842: the v1 generation is retired, not merely unused.
+  for (const gone of ['gradeDeterministic', 'scoreEstActualBand', 'scoreValueSummary', 'scoreDiffHygiene',
+    'scoreScannerSmoke', 'scoreScopingSignal', 'scoreLocNetNegative', 'scoreLearningRow', 'scoreArtRubricAvg',
+    'blendWeightsForKind']) {
+    assert.equal(gone in grader, false, `retired v1 export came back: ${gone}`);
+  }
+  assert.equal('v1' in grader.RUBRIC, false, 'the v1 rubric block is retired');
+  assert.equal('v3' in grader.RUBRIC, false, 'the v3 rubric block is retired');
+  // The moved plumbing is one implementation, reachable from both homes.
+  const noArtifact = require('../modules/grading/grader-no-artifact.js');
+  assert.equal(grader.aggregateShots, noArtifact.aggregateShots);
+  assert.equal(grader.runOneShot, noArtifact.runOneShot);
   assert.ok(typeof grader.THRESHOLD === 'number');
   assert.ok(grader.THRESHOLD >= 5.0 && grader.THRESHOLD <= 10.0);
   assert.ok(grader.VERSION.startsWith('v4'), `expected v4.*, got ${grader.VERSION}`);
-  assert.equal(grader.DEFAULT_SHOTS, 3); // kept for v3 multi-shot diagnostic path
+  assert.equal('DEFAULT_SHOTS' in grader, false, 'the v3 3-shot default is retired (task 1002842)');
   assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-5'); // task 1002659: Claude 5 family pin
   assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-fable-5');
   assert.equal(grader.FALLTHROUGH_CONFIDENCE, 0.3);
@@ -2316,6 +2207,37 @@ test('isTrivialDiff: empty changed-files or zero-line diff → false', () => {
   );
 });
 
+// ---------- task 1002842: the kept trivial-diff fast path still works ----------
+//
+// The v3 generation is retired, but its fast path is kept (moving it onto a v4
+// panel needs a new reviewer type — an owner decision). These pin that what was
+// kept works: ONE generalist shot by default, the generalist prompt, and the
+// moved aggregateShots collapse — driven through the runShot seam, no model spawned.
+
+await testAsync('fast path: one generalist shot by default, aggregated into a gradeable result', async () => {
+  const calls = [];
+  const r = await grader.gradeSubagentV3MultiShot({
+    task: { id: 1002842, title: 't', description: 'd', kind: 'cleanup' },
+    valueSummary: 'v', diff: '+ docs line', changedFiles: ['docs/x.md'], diffStats: { files_changed: 1, lines_added: 1, lines_removed: 0 },
+    builderModel: 'claude-fable-5', runOpts: {},
+    runShot: async (args) => { calls.push(args); return mkPassShot(8, 8, 0.9, args.shotIndex); },
+  });
+  assert.equal(calls.length, 1, 'the fast path runs exactly one shot unless told otherwise');
+  assert.match(calls[0].prompt, /default-fail|DEFAULT/i, 'it is the generalist default-fail prompt');
+  assert.equal(r.passed, true);
+  assert.equal(r.rubric_scores.functional_fidelity, 8);
+  assert.equal(r.rubric_scores.code_quality, 8);
+  assert.equal(r.signals.confidence, 0.9, 'the server gate reads a real confidence');
+});
+
+await testAsync('fast path: a failing shot still fails the grade (not loosened by the move)', async () => {
+  const r = await grader.gradeSubagentV3MultiShot({
+    task: { id: 1 }, valueSummary: 'v', diff: '+ x', changedFiles: ['docs/x.md'], diffStats: {},
+    runOpts: {}, runShot: async (args) => mkFailShot(4, 8, 0.9, args.shotIndex),
+  });
+  assert.equal(r.passed, false);
+});
+
 // ---------- Summary ----------
 
 console.log('');

package/tests/grader_unbacked_score.mjs

@@ -14,7 +14,7 @@
 //      server's ff gate failed the ship — a PASS verdict inside a FAIL grade;
 //   3. the card had no branch for it, so it printed the ordinary FAIL block.
 // The constraint the task set: close it WITHOUT letting an unbacked low score
-// pass and WITHOUT adding a gate (ADR 0162). Every case below that has a low
+// pass and WITHOUT adding a gate (the task's own scope: it corrects what the grade SAYS). Every case below that has a low
 // score also asserts the server still refuses it.
 //
 // Run:  node tests/grader_unbacked_score.mjs

package/tests/regrade_actual_minutes.mjs

@@ -32,7 +32,7 @@
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const { buildPrompt } = require('../modules/grading/grader-prompt.js');
@@ -78,23 +78,24 @@ test('a task with no actual_minutes at all builds the same prompt', () => {
   assert.equal(withFigure, without, 'actual_minutes changes nothing about what the panel reads');
 });
 
-test('scoreEstActualBand is reachable only from the retroactive audit', () => {
-  // The one scorer that DOES read the figure. It lives in gradeDeterministic,
-  // which the grader module's own comment calls the legacy v1 entry — its single
-  // non-test caller is scripts/gds/audit-ships.js, a process audit run by hand
-  // over already-shipped tasks, not a gate anything passes through. A new caller
-  // is the same risk as wiring the figure into the prompt.
+test('no grader entry reads actual_minutes — the one scorer that did is retired', () => {
+  // scoreEstActualBand was the ONE scorer that read the figure. It lived in the v1
+  // gradeDeterministic, whose only non-test caller was scripts/gds/audit-ships.js;
+  // task 1002842 retired all three. So the stale-figure risk this file guards is now
+  // closed at the source, and this pins it: nothing in the grading module may
+  // accept or read the figure, and the retired entry may not come back.
   const grader = require('../modules/grading/grader.js');
-  assert.equal(typeof grader.gradeDeterministic, 'function', 'the legacy entry still exists');
-  assert.equal(grader.gradeSubagent.length > 0, true, 'and the live entry is a different function');
+  assert.equal(grader.gradeDeterministic, undefined, 'the retired v1 entry stays gone');
+  assert.equal(grader.scoreEstActualBand, undefined, 'and so does its minutes scorer');
+  assert.equal(typeof grader.gradeSubagent, 'function', 'the live entry is still here');
 
-  // gradeSubagent / gradeSubagentV3MultiShot take a single options object, so the
-  // guard that matters is which KEYS they destructure. Neither may take minutes.
-  const src = readFileSync(new URL('../modules/grading/grader.js', import.meta.url), 'utf8');
-  for (const fn of ['async function gradeSubagent(', 'async function gradeSubagentV3MultiShot(']) {
-    const at = src.indexOf(fn);
-    assert.ok(at !== -1, `${fn} is still the entry point this pins`);
-    const sig = src.slice(at, src.indexOf(')', at));
-    assert.ok(!/actualMinutes/.test(sig), `${fn} does not accept actualMinutes`);
+  // Every grading source, not just grader.js: a new reader anywhere in the module
+  // is the same risk as wiring the figure into the prompt.
+  const dir = new URL('../modules/grading/', import.meta.url);
+  const files = readdirSync(dir, { recursive: true }).filter((f) => String(f).endsWith('.js'));
+  assert.ok(files.length > 5, 'the grading module was found');
+  for (const f of files) {
+    const src = readFileSync(new URL(String(f), dir), 'utf8');
+    assert.doesNotMatch(src, /actualMinutes|actual_minutes/, `${f} must not read actual_minutes`);
   }
 });

package/tests/render_check.mjs

@@ -1,6 +1,6 @@
 // tests/render_check.mjs — the rendered fit check (task 1004203, ADR 0329): which pages a changed path
 // reaches, which report rows it keeps, and that /ship-check shows it as a signal that never flips its exit
-// (ADR 0162). DB-free and browser-free; the in-page measurement is pinned in tests/ui_design_kit_fit.mjs.
+// (ADR 0329, decision 3). DB-free and browser-free; the in-page measurement is pinned in tests/ui_design_kit_fit.mjs.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';

package/tests/skill_grade_audit.mjs

@@ -2,8 +2,8 @@
 // accountability sweep from the grader-hardening evaluation §6 (task 1002657):
 // the override ledger, dropped blocker/major findings on passing grades (with
 // the advisory-Narc attribution filter), the false-pass spot-check, and the
-// outage roll-up handoff — describing and queueing ONLY (ADR 0162/0158: it
-// never confirms a task or flips status).
+// outage roll-up handoff — describing and queueing ONLY (ADR 0158 §2: it
+// never confirms a task or flips status; ADR 0162: it adds no approval step to a ship).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -45,6 +45,6 @@ test('/grade-audit exists, covers the sweep legs, and stays describe-and-queue o
 
   // The hard constraint.
   assert.match(md, /never confirm/i, 'states it never confirms');
-  assert.match(md, /ADR 0162/, 'anchors the no-new-gates constraint');
+  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
   assert.ok(!/curl[^\n]*\/confirm/.test(md), 'carries no ready-to-paste confirm curl');
 });

package/tests/skill_grader_health.mjs

@@ -2,7 +2,7 @@
 // the four health axes from the grader-hardening evaluation §6 (task 1002656):
 // outage runs, pass-rate drift, cost anomalies, and stale model pins — reading
 // LIVE data surfaces, emitting exact --regrade remediation lines, and staying
-// read-only (describe, never confirm/flip — ADR 0162).
+// read-only (describe, never confirm/flip — ADR 0158 §2; no approval step on anyone's ship — ADR 0162).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -44,5 +44,5 @@ test('/grader-health exists and covers the four health axes on live data', (t) =
   assert.match(md, /--probe/, 'offers the optional live calibration probe');
   assert.match(md, /grade-smoke\.js/, 'names the probe script');
   assert.match(md, /read-only/i, 'states the read-only contract');
-  assert.match(md, /ADR 0162/, 'anchors the no-new-gates constraint');
+  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
 });