@bongos/core 1.19.1037 → 1.19.1038

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1037",
-  "core_contract": "1.19.1037",
-  "source_commit": "fc8861f3a11ffc5ecf0eb8625adaa18f22232afc",
+  "core_version": "1.19.1038",
+  "core_contract": "1.19.1038",
+  "source_commit": "da6abbe0d3be205fbf1468053e22d062f0f88c53",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T07:41:37.582Z",
+  "built_at": "2026-09-26T08:02:16.753Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2490,
+    "functional_verbatim": 2493,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3059,
-  "tree_sha256": "0ed4394afb862d1a8286d75da8f8d8ea947c47b9d26842004c92fe4f2a2825df",
+  "file_count": 3062,
+  "tree_sha256": "809d2cff15d7aea1e31dcb2a5d161eae233d7b7b4edaae142688cd13b33ef9a4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -907,7 +907,7 @@
     {
       "path": "docs/adr/0089-modular-multi-model-adversarial-grader.md",
       "mode": "0000644",
-      "sha256": "8311a65febe09e8912e1d09ccdf026b180540c6020ee464c14154c4244dcb151"
+      "sha256": "4ec01143da7055676994ec4351c71a1321d41224076f0c4639c451fba28e62b9"
     },
     {
       "path": "docs/adr/0090-metic-task-authoring.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "db77f43319c78e54f21709f88f82b7b27392a99cfcdf61a6dc25552a8be6c90f"
+      "sha256": "f4e772d2b38f923f36c45a1e2fc9254a2843370b4703d291ab82b0e5b126e998"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4597,7 +4597,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "9889997d8a8c8c2145fb856bb94dd42131c3757300188324dfb8f5a0dcbf617c"
+      "sha256": "e703a0c652d40d8d8f5578fbcb4b08dde9afd4f97ecef0b99db5e3a181b05aae"
     },
     {
       "path": "modules/government/ranks.js",
@@ -4662,7 +4662,7 @@
     {
       "path": "modules/grading/grader-model.js",
       "mode": "0000644",
-      "sha256": "597f883d4878a8fb585585331e11dc219e8a57d1459be4039116b60e7fdc556d"
+      "sha256": "4141bc9e7ff90ab474af51bc78c0805af982b610c91ec90a8441e2b89a7596ce"
     },
     {
       "path": "modules/grading/grader-no-artifact.js",
@@ -4674,10 +4674,15 @@
       "mode": "0000644",
       "sha256": "d845b8785b39c89777e9cb9cdf5e869b51e8eae11c76288d9be4790239fd5e13"
     },
+    {
+      "path": "modules/grading/grader-providers.neutral.json",
+      "mode": "0000644",
+      "sha256": "1e1313c9bf157ce4b380c89e59832da4ee5573a18e1b70aa730c3826923b67eb"
+    },
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "a2c5ea5298e20b53ec03a5f047a3c5ae46fbaaedf9809d2b533ef7f81763f3dc"
+      "sha256": "58c445d96348ea0e9ee7d0603b88aa684fd7ad478a9de46c6668696ce8cd13f0"
     },
     {
       "path": "modules/grading/grader-score.js",
@@ -4687,7 +4692,7 @@
     {
       "path": "modules/grading/grader-subagent.js",
       "mode": "0000644",
-      "sha256": "4a185832e6bd6bce5bc7ad58d3f53f377a09b997a65037cb97714617cc6e0740"
+      "sha256": "a7e7c0cd702ff1a6b83d12ce0310de72ed601c6a4b8e886f1a873eeaeaaecadd"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -4749,6 +4754,11 @@
       "mode": "0000644",
       "sha256": "e223155c25f1fe4a66d7e3dd03b10632b76d4a7b851182df4afd05f5ae9d40bd"
     },
+    {
+      "path": "modules/grading/model-provider.js",
+      "mode": "0000644",
+      "sha256": "608f90bb52ed2fb9341021c02c6ae0f44ed41192c0050ce3052861e9216bd2ad"
+    },
     {
       "path": "modules/grading/module.json",
       "mode": "0000644",
@@ -8442,12 +8452,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "656579d0a1b5572cb3af67d5224a450c34175a8cc0804c68149f653aec7e77d7"
+      "sha256": "b884a2821059a8a69b9757b7eb9cb8432983a1563b5a5461044aed5129119a69"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a5dd2e4c5f4ae817b4c34e70319307e79b4b0ff119bd56e3d4db4f933512b45d"
+      "sha256": "735b76d59c3bbe7444b3354e6bba1a1e72bcf639236fb4dd7925561290c71e96"
     },
     {
       "path": "public-docs/index.html",
@@ -8467,7 +8477,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "5eff67626993ed0c57101af392a9943d2e19c59571f6497ebc38a4d5d799afdb"
+      "sha256": "bd9f61be14683fe846ffb42627b8cd3b24e1a4a732c793248d4eb4d845dae5cd"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10522,7 +10532,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7d7946d420008189ad09b1871574c396acb3e7b24b0961e0118e381dd01e4c9d"
+      "sha256": "b1619ae083207e98797c5198861f067a405ee89c80ccc5a0b83d1fc1d381a465"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12352,7 +12362,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "baa87c05907ac8a4180d9bcdc58eca66e3bce9cae0e12093a7b53669f0e9a1b9"
+      "sha256": "3b022d77647dd871c43cdcfd8855932cc5d2c8a40fb061babcbae0d86e225097"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -12439,6 +12449,11 @@
       "mode": "0000644",
       "sha256": "b638a9fc43d9a1b8ca92ee20b9d0b6cc92104581d4f5d3af7bfd4bf9b310e508"
     },
+    {
+      "path": "tests/grade_model_provider.mjs",
+      "mode": "0000644",
+      "sha256": "11cfa2deade2db1f88f643d9aa310d34bdd0f37423944db4a68fa0ea2b2eba77"
+    },
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",

package/docs/adr/0089-modular-multi-model-adversarial-grader.md

@@ -187,6 +187,8 @@ Roll out behind a flag (the [ADR 0079](0079-value-gated-autonomous-engagement.md
 
 **Progress (2026-09-25).** Step 3's engine and registry landed first, ahead of steps 1–2, because both build on it: `modules/grading/grade-engine.js` names the pipeline (`select → pre_pass → evidence → fan_out → aggregate → gate → persist`), owns both deterministic pre-passes and a deterministic veto no work-type's aggregate can override, and resolves work-types from its own registry or a module's `grader.workType.<key>` seam provider. The code panel is registered as work-type `code`, the default. Proven a no-op: a before/after run of 27 grading scenarios came out byte-identical, and a replay of 376 recorded production grades reproduced every stored decision except 22 from June 2026, which an older grader produced before two deliberate gate changes (the task 943 "grader unavailable" outcome and the task 574 missing-security-lens block). Task 1002839; the replay tool is `scripts/gds/grade-replay.js`.
 
+**Progress (2026-09-26).** Step 1 landed (task 1002840): `modules/grading/model-provider.js` is the `ModelProvider` port at `runSubagent`, with the Claude spawn as the default `anthropic-cli` provider (a before/after run of 29 grading scenarios came out byte-identical) and an `openai-compatible` adapter tested against a local stub. `selectGraderModel`'s if/else is now the rubric's `judge_by_builder_family` table, refused at load if a judge would grade its own family or leave Claude. Providers are instance config (`config/grader-providers.json`); the core declares none, so no open model is called and nothing is spent until the owner adds one. The error-correlation audit (step 5) also landed early (task 1002843, `scripts/gds/grade-correlation-audit.js`).
+
 ---
 
 ## Sources

package/docs/module-api-changelog.md

@@ -2553,5 +2553,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1035 with no explicit bump. run 36226955285. (task 1002620)
   1.19.1037 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1036 with no explicit bump. run 36227523642. (task 1002620)
+  1.19.1038 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1037 with no explicit bump. run 36228544921. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -60,6 +60,8 @@
     { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grade-engine.js", "group": "pipeline", "why": "task 1002839. The central grading engine every work-type is graded through: it runs the deterministic route-rank and permission-path pre-passes and applies the deterministic veto, so editing it can switch off the protected-path gate for every grade at once." },
+    { "glob": "modules/grading/model-provider.js", "group": "pipeline", "why": "task 1002840. The ModelProvider port every grader model call goes through: it decides which vendor receives the diff under review and with which key, so editing it can re-route or blind the whole panel." },
+    { "glob": "modules/grading/grader-providers.neutral.json", "group": "pipeline", "why": "task 1002840. The core's neutral provider set (none): an entry here would send every instance's diffs to a vendor by default." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },

package/modules/grading/grader-model.js

@@ -8,7 +8,7 @@
 
 'use strict';
 
-const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, WORKER_MODEL_TIERS, api } = require('./grader-config.js');
+const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, V4, WORKER_MODEL_TIERS, api } = require('./grader-config.js');
 
 function r1(n) {
   return Math.round(Number(n) * 10) / 10;
@@ -93,12 +93,14 @@ function isTrivialDiff({ changedFiles, diffStats } = {}) {
 // misconfiguration it guarded. Unknown ids now warn loudly and grade on
 // DEFAULT_GRADER_MODEL; the id still reaches signals.builder_model_assumed,
 // so /grader-health can spot the drift.
+//
+// task 1002840 (ADR 0089 §3): the Claude-only if/else is now DATA — the judge
+// table below, first matching row wins, in the old branch order.
 function selectGraderModel({ builderModel } = {}) {
   const bm = (builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
-  if (bm.includes('fable') || bm.includes('mythos')) return 'claude-sonnet-5';
-  if (bm.includes('opus')) return 'claude-sonnet-5';
-  if (bm.includes('sonnet')) return 'claude-opus-5';
-  if (bm.includes('haiku')) return 'claude-opus-5';
+  for (const row of JUDGE_TABLE) {
+    if (row.builder_families.some((f) => bm.includes(f))) return row.judge_model;
+  }
   console.error(
     `selectGraderModel: unrecognized builder model ${JSON.stringify(builderModel)} — ` +
     `no 'fable'/'mythos'/'opus'/'sonnet'/'haiku' token; grading on the default ` +
@@ -112,6 +114,46 @@ function selectGraderModel({ builderModel } = {}) {
 // back to graderModel) when it lands on the BUILDER's own family: tiering is
 // a cost lever, never a hole in the ADR 0024 cross-model guarantee.
 const MODEL_FAMILY_TOKENS = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+
+// task 1002840: the judge table — which grader model each builder family gets.
+// Read from the rubric (v4.judge_by_builder_family) and VALIDATED at load. A
+// row is refused when its judge shares a family with a builder it serves (the
+// ADR 0024 cross-model guarantee: no resolution may land the judge in the
+// builder's own family) or is not a plain Claude model id — the GATING panel
+// stays on Claude, the quality floor ADR 0089 keeps; an open model joins only as
+// an advisory judge (task 1003858). A table that fails is replaced WHOLE by the
+// built-in one below, which is the mapping the old if/else hard-coded, so a bad
+// rubric edit degrades to today's behaviour instead of to a throw at grade time.
+const BUILTIN_JUDGE_TABLE = Object.freeze([
+  Object.freeze({ builder_families: Object.freeze(['fable', 'mythos', 'opus']), judge_model: 'claude-sonnet-5' }),
+  Object.freeze({ builder_families: Object.freeze(['sonnet', 'haiku']), judge_model: 'claude-opus-5' }),
+]);
+
+function judgeTableProblems(table) {
+  if (!Array.isArray(table) || table.length === 0) return ['judge_by_builder_family must be a non-empty array'];
+  const problems = [];
+  table.forEach((row, i) => {
+    const fams = row && Array.isArray(row.builder_families) ? row.builder_families : null;
+    const judge = row && typeof row.judge_model === 'string' ? row.judge_model.toLowerCase() : null;
+    if (!fams || fams.length === 0 || !fams.every((f) => MODEL_FAMILY_TOKENS.includes(f))) {
+      problems.push(`row ${i}: builder_families must list family tokens (${MODEL_FAMILY_TOKENS.join('/')})`);
+      return;
+    }
+    const judgeFamily = judge && !judge.includes(':') ? MODEL_FAMILY_TOKENS.find((t) => judge.includes(t)) : null;
+    if (!judgeFamily) problems.push(`row ${i}: judge_model must be a plain Claude model id (the gating panel stays on Claude)`);
+    else if (fams.includes(judgeFamily)) problems.push(`row ${i}: judge '${row.judge_model}' is in the '${judgeFamily}' family it would grade (ADR 0024)`);
+  });
+  return problems;
+}
+
+function resolveJudgeTable(table) {
+  const problems = judgeTableProblems(table);
+  if (problems.length === 0) return table;
+  console.error(`grader: rubric v4.judge_by_builder_family refused (${problems.join('; ')}) — grading on the built-in judge table`);
+  return BUILTIN_JUDGE_TABLE;
+}
+const JUDGE_TABLE = resolveJudgeTable(V4.judge_by_builder_family);
+
 function workerModelFor(kind, graderModel, builderModel) {
   const tier = WORKER_MODEL_TIERS[kind];
   if (!tier) return graderModel;
@@ -137,12 +179,15 @@ const LLM_PROJECT = (() => {
 
 
 module.exports = {
+  BUILTIN_JUDGE_TABLE,
+  JUDGE_TABLE,
   LLM_PROJECT,
   MODEL_FAMILY_TOKENS,
   TRIVIAL_MAX_FILES,
   TRIVIAL_MAX_LINES,
   clamp,
   isTrivialDiff,
+  judgeTableProblems,
   median,
   r1,
   selectGraderModel,

package/modules/grading/grader-providers.neutral.json

@@ -0,0 +1,4 @@
+{
+  "_comment": "The core's neutral starter for grader model providers (task 1002840, ADR 0089 §3): NONE, so a vanilla instance grades on Claude alone. An instance declares its own in config/grader-providers.json at the instance root. Each entry is { kind: 'openai-compatible', base_url: https://…, api_key_env: <ENV VAR NAME, never the key>, price_per_mtok: { <model>: { input, output } } }. Declaring one is an owner decision: it sends the diff under review to that vendor and costs money per call.",
+  "providers": {}
+}

package/modules/grading/grader-rubric.json

@@ -14,6 +14,11 @@
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
     "worker_model_tiers": { "quality": "claude-sonnet-5", "reader": "claude-sonnet-5" },
     "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically. task 1003977: the READER is pinned to claude-sonnet-5 for the same task-1003318 reason — it is Read-heavy by construction (the voice guide, then the render paths that decide whether a string is user-facing), and a small window fails deterministically with PROMPT_TOO_LONG. For a NON-GATING worker that means silently reading no copy at all on exactly the biggest copy diffs, with nothing blocking to reveal it.",
+    "judge_by_builder_family": [
+      { "builder_families": ["fable", "mythos", "opus"], "judge_model": "claude-sonnet-5" },
+      { "builder_families": ["sonnet", "haiku"], "judge_model": "claude-opus-5" }
+    ],
+    "judge_by_builder_family_note": "task 1002840 (ADR 0089 §3): the cross-family judge choice selectGraderModel used to hard-code as an if/else — the first row whose family token appears in the builder's model id wins. Validated at load (grader-model.js judgeTableProblems): a judge in the family it grades (ADR 0024) or anything but a plain Claude id is refused and the whole table falls back to the built-in copy of exactly these two rows. An unmatched builder still grades on default_model with a warning (task 1002659).",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-subagent.js

@@ -12,8 +12,13 @@ const path = require('node:path');
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 const { DEFAULT_GRADER_MODEL, api } = require('./grader-config.js');
+// task 1002840: the ModelProvider port (ADR 0089 §3) — runSubagent below routes
+// through it; the Claude spawn is its default provider.
+const modelProvider = require('./model-provider.js');
 
-function runSubagent({ prompt, opts = {} }) {
+// The `claude -p` spawn — the anthropic-cli ModelProvider. Body unchanged by
+// task 1002840; only its name moved, so runSubagent could become the port.
+function runClaudeCli({ prompt, opts = {} }) {
   return new Promise((resolve, reject) => {
     const timeoutMs = opts.timeoutMs ?? 240_000;
     const cwd = opts.cwd ?? process.cwd();
@@ -119,6 +124,17 @@ function runSubagent({ prompt, opts = {} }) {
     child.stdin.end();
   });
 }
+modelProvider.registerModelProvider({ name: modelProvider.DEFAULT_PROVIDER, kind: 'anthropic-cli', run: runClaudeCli });
+
+// runSubagent — the ModelProvider port every platform LLM call goes through
+// (the panel workers, the no-artifact shots, architect-audit, the agents module
+// via the grade port). A model with no registered provider prefix — every id in
+// use today — runs on the Claude spawn exactly as before; `<provider>:<model>`
+// runs on that provider, which answers in the same envelope + error codes.
+function runSubagent({ prompt, opts = {} }) {
+  const ref = modelProvider.parseModelRef(opts.model ?? DEFAULT_GRADER_MODEL);
+  return modelProvider.resolveModelProvider(ref.provider).run({ prompt, opts: { ...opts, model: ref.model } });
+}
 
 // ---------- task 1002660: shared context bundle ----------
 //

package/modules/grading/model-provider.js

@@ -0,0 +1,257 @@
+// modules/grading/model-provider.js — the ModelProvider port (ADR 0089 §3,
+// task 1002840): how a judge's model is called, as an adapter behind one seam
+// instead of a hard-coded `claude` spawn.
+//
+// WHY. Every platform LLM call funnels through runSubagent (grader-subagent.js):
+// the panel workers, the no-artifact shots, architect-audit, and the agents
+// module through the grade port. Until this file that function WAS the Claude
+// CLI spawn, so a judge from another model family — the property ADR 0089's
+// ensemble exists for — had no way in. Now a call names a provider and the
+// provider makes it. Every provider answers in the SAME shape the Claude spawn
+// always has: a `claude -p --output-format json`-style envelope on stdout and the
+// same error codes (SUBAGENT_SPAWN_FAILED / SUBAGENT_TIMEOUT /
+// SUBAGENT_NONZERO_EXIT). So nothing downstream changes — runWorker's retry, the
+// outage detection, extractAssistantResult / extractCostUsd, the LLM cache.
+//
+// THE MODEL REFERENCE. A model is still ONE STRING everywhere it travels
+// (signals.workers[].model, grader_model, the cache key). A string with no
+// provider prefix is an anthropic-cli model — every id this project uses today —
+// so today's calls are byte-identical. `<provider>:<model>` routes to a
+// REGISTERED provider (`deepinfra:deepseek-ai/DeepSeek-V3.1`,
+// `ollama:qwen2.5-coder:32b`). Only a prefix that names a registered provider is
+// split off; anything else stays a Claude model id, so a colon inside an id can
+// never re-route a call by accident.
+//
+// PROVIDERS.
+//   anthropic-cli      the `claude -p` spawn (grader-subagent.js registers it).
+//                      The default, and the only provider shipped config uses.
+//   openai-compatible  one adapter for DeepInfra / OpenRouter / Together /
+//                      Fireworks / Groq / vLLM / Ollama — POST
+//                      <base_url>/chat/completions with a BYOK key read from the
+//                      env var the instance names. PROMPT-ONLY: it has no Read
+//                      tool, so such a judge sees exactly what its prompt carries.
+//
+// INSTANCE CONFIG (the ADR 0062 host-owned pattern). Providers are declared in
+// config/grader-providers.json at the instance root; the core ships
+// grader-providers.neutral.json beside this file with NO providers, so a vanilla
+// instance is Claude-only. A key never lives in a config file — only the NAME
+// of the env var holding it. Declaring a provider is an owner decision: it sends
+// the diff under review to that vendor and it costs money per call (ADR 0089 §3).
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+
+const DEFAULT_PROVIDER = 'anthropic-cli';
+const PROVIDER_NAME_RE = /^[a-z][a-z0-9-]{1,39}$/;
+const API_KEY_ENV_RE = /^[A-Z][A-Z0-9_]{1,63}$/;
+const KINDS = new Set(['openai-compatible']);
+const DEFAULT_TIMEOUT_MS = 240_000;
+const ERROR_BODY_MAX = 2000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+
+const providers = new Map(); // name -> { name, kind, run }
+
+// One place a refusal is reported, so a malformed instance config is loud
+// without scattering console calls (the fitness console ratchet counts them).
+function refuse(msg) {
+  console.error(`grade model-provider: ${msg}`);
+}
+
+function registerModelProvider(provider) {
+  if (!provider || typeof provider.run !== 'function' || typeof provider.name !== 'string' || !provider.name) {
+    throw new TypeError('registerModelProvider: a provider needs a name and a run({ prompt, opts }) function');
+  }
+  const held = providers.get(provider.name);
+  if (held && held !== provider) throw new Error(`model provider '${provider.name}' is already registered`);
+  providers.set(provider.name, provider);
+  return provider;
+}
+
+function resolveModelProvider(name = DEFAULT_PROVIDER) {
+  const p = providers.get(name);
+  if (!p) throw new Error(`model provider '${name}' is not registered`);
+  return p;
+}
+
+function listModelProviders() {
+  return [...providers.keys()].sort();
+}
+
+// `<provider>:<model>` → { provider, model }, split ONLY when the prefix names a
+// registered provider other than the default; everything else is one Claude id.
+function parseModelRef(ref) {
+  const s = String(ref == null ? '' : ref);
+  const i = s.indexOf(':');
+  if (i > 0) {
+    const name = s.slice(0, i);
+    if (name !== DEFAULT_PROVIDER && providers.has(name)) return { provider: name, model: s.slice(i + 1) };
+  }
+  return { provider: DEFAULT_PROVIDER, model: s };
+}
+
+function codeError(code, message, extra = {}) {
+  return Object.assign(new Error(message), { code, ...extra });
+}
+
+// base_url must be https, or plain http to THIS machine only (a local vLLM /
+// Ollama): a key must never cross a network in cleartext.
+function checkBaseUrl(raw) {
+  let u;
+  try { u = new URL(String(raw)); } catch { return null; }
+  const loopback = LOOPBACK_HOSTS.has(u.hostname);
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) return null;
+  if (u.username || u.password || u.search || u.hash) return null;
+  return { url: u.toString().replace(/\/+$/, ''), loopback };
+}
+
+// Validate one declared provider: { def } normalised, or { error } saying why
+// not — never throws, so one bad entry cannot take the grader down.
+function validateProviderDef(name, def) {
+  if (!PROVIDER_NAME_RE.test(name) || name === DEFAULT_PROVIDER) return { error: `provider name '${name}' must match ${PROVIDER_NAME_RE} and not be '${DEFAULT_PROVIDER}'` };
+  if (!def || typeof def !== 'object') return { error: `provider '${name}' must be an object` };
+  if (!KINDS.has(def.kind)) return { error: `provider '${name}': kind must be one of ${[...KINDS].join(', ')}` };
+  const base = checkBaseUrl(def.base_url);
+  if (!base) return { error: `provider '${name}': base_url must be https:// (http:// only to localhost), with no credentials or query` };
+  const keyEnv = def.api_key_env == null ? null : String(def.api_key_env);
+  if (keyEnv != null && !API_KEY_ENV_RE.test(keyEnv)) return { error: `provider '${name}': api_key_env must be an env var NAME (${API_KEY_ENV_RE}) — never the key itself` };
+  if (keyEnv == null && !base.loopback) return { error: `provider '${name}': a remote provider needs api_key_env` };
+  const prices = {};
+  for (const [model, p] of Object.entries(def.price_per_mtok || {})) {
+    const input = Number(p && p.input);
+    const output = Number(p && p.output);
+    if (!(Number.isFinite(input) && input >= 0 && Number.isFinite(output) && output >= 0)) {
+      return { error: `provider '${name}': price_per_mtok['${model}'] needs non-negative input and output` };
+    }
+    prices[model] = { input, output };
+  }
+  return { def: { name, kind: def.kind, baseUrl: base.url, apiKeyEnv: keyEnv, prices } };
+}
+
+// USD for one call from the reply's token usage, or null when the model has no
+// declared price — a cost signal never fabricates a number it does not have.
+function priceCall(prices, model, usage) {
+  const p = prices[model];
+  if (!p || !usage) return null;
+  const inTok = Number(usage.prompt_tokens);
+  const outTok = Number(usage.completion_tokens);
+  if (!Number.isFinite(inTok) || !Number.isFinite(outTok)) return null;
+  return (inTok * p.input + outTok * p.output) / 1_000_000;
+}
+
+// The openai-compatible adapter. `fetchImpl` and `env` are injectable so the
+// whole adapter is testable against a stub with no key and no network.
+function createOpenAICompatibleProvider(def, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
+  const run = async ({ prompt, opts = {} }) => {
+    const started = Date.now();
+    const model = String(opts.model || '');
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const key = def.apiKeyEnv ? env[def.apiKeyEnv] : null;
+    // Refused BEFORE any request: no key means nothing is sent anywhere.
+    if (def.apiKeyEnv && !key) {
+      throw codeError('SUBAGENT_SPAWN_FAILED', `provider ${def.name}: no API key — set ${def.apiKeyEnv} (bring-your-own key)`, { run_ms: 0, stdout: '', stderr: '' });
+    }
+    const scrub = (t) => (key ? String(t).split(key).join('[redacted]') : String(t));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    let text;
+    try {
+      res = await fetchImpl(`${def.baseUrl}/chat/completions`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(key ? { authorization: `Bearer ${key}` } : {}) },
+        body: JSON.stringify({ model, messages: [{ role: 'user', content: String(prompt) }] }),
+        signal: controller.signal,
+      });
+      text = await res.text();
+    } catch (err) {
+      const run_ms = Date.now() - started;
+      if (controller.signal.aborted) {
+        throw codeError('SUBAGENT_TIMEOUT', `provider ${def.name}: timed out after ${timeoutMs}ms`, { run_ms, stdout: '', stderr: '' });
+      }
+      throw codeError('SUBAGENT_SPAWN_FAILED', `provider ${def.name}: request failed: ${scrub(err && err.message)}`, { run_ms, stdout: '', stderr: scrub(err && err.message) });
+    } finally {
+      clearTimeout(timer);
+    }
+    const run_ms = Date.now() - started;
+    if (!res.ok) {
+      throw codeError('SUBAGENT_NONZERO_EXIT', `provider ${def.name}: HTTP ${res.status}`, {
+        exit_code: res.status, run_ms, stdout: '', stderr: scrub(text).slice(0, ERROR_BODY_MAX),
+      });
+    }
+    let body = null;
+    try { body = JSON.parse(text); } catch { /* an unparseable 200 → empty result → the worker's parse_error path */ }
+    const content = body && body.choices && body.choices[0] && body.choices[0].message
+      ? body.choices[0].message.content : null;
+    const usage = body && body.usage ? body.usage : null;
+    const cost = priceCall(def.prices, model, usage);
+    const envelope = {
+      type: 'result',
+      result: typeof content === 'string' ? content : '',
+      ...(cost != null ? { total_cost_usd: cost } : {}),
+      provider: def.name,
+      model,
+      usage,
+    };
+    return { stdout: JSON.stringify(envelope), stderr: '', run_ms, exit_code: 0, cost_usd: cost };
+  };
+  return { name: def.name, kind: def.kind, run };
+}
+
+// ---------- instance config ----------
+//
+// The host's config/grader-providers.json, else the neutral starter beside this
+// file (which declares none). A missing instance file is the ordinary case; one
+// that does not parse falls back to the neutral starter — fail to vanilla, never
+// to dead — and each invalid entry is refused by name while the rest load.
+const NEUTRAL_PATH = path.join(__dirname, 'grader-providers.neutral.json');
+const INSTANCE_PATH = path.join(api.resolveInstanceRoot(), 'config', 'grader-providers.json');
+
+function readPack(file) {
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); } catch { return null; }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch { return null; }
+}
+
+function loadProviderConfig({ instancePath = INSTANCE_PATH, neutralPath = NEUTRAL_PATH } = {}) {
+  const instance = readPack(instancePath);
+  const pack = instance || readPack(neutralPath) || {};
+  const defs = [];
+  const refused = [];
+  const declared = pack.providers && typeof pack.providers === 'object' && !Array.isArray(pack.providers) ? pack.providers : {};
+  for (const [name, def] of Object.entries(declared)) {
+    const v = validateProviderDef(name, def);
+    if (v.error) refused.push(v.error); else defs.push(v.def);
+  }
+  return { source: instance ? instancePath : neutralPath, defs, refused };
+}
+
+// Register every provider the instance declares. Idempotent: an already
+// registered name is left alone. Returns the provider names now resolvable.
+function registerConfiguredProviders(opts = {}) {
+  const { defs, refused } = loadProviderConfig(opts);
+  for (const reason of refused) refuse(`${reason} — refused, grading continues without it`);
+  for (const def of defs) {
+    if (!providers.has(def.name)) registerModelProvider(createOpenAICompatibleProvider(def, opts));
+  }
+  return listModelProviders();
+}
+
+registerConfiguredProviders();
+
+module.exports = {
+  DEFAULT_PROVIDER,
+  createOpenAICompatibleProvider,
+  listModelProviders,
+  loadProviderConfig,
+  parseModelRef,
+  registerConfiguredProviders,
+  registerModelProvider,
+  resolveModelProvider,
+  validateProviderDef,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1037",
+  "version": "1.19.1038",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1037",
+      "version": "1.19.1038",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1037",
+  "version": "1.19.1038",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7507,5 +7507,11 @@
       "id": "1004280",
       "text": "The project's own notes no longer claim a past decision banned all new checks; each one now gives its real reason, and a test stops the wrong claim coming back."
     }
+  ],
+  "1.19.1038": [
+    {
+      "id": "1002840",
+      "text": "The grader can now call AI models from other companies through one plug-in point, ready for a second-opinion reviewer; nothing changes today — it still uses only Claude and spends nothing new."
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1037'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1038'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -305,6 +305,20 @@ const ADDED_SINCE_R101 = [
        + 'deterministic veto, so an edit here can switch off the protected-path gate '
        + 'for every grade at once.',
   },
+  // task 1002840 (ADR 0089 §3): the ModelProvider port and its neutral config.
+  {
+    after: 'modules/grading/grade-engine.js',
+    glob: 'modules/grading/model-provider.js',
+    why: 'the ModelProvider port every grader model call goes through. It decides which '
+       + 'vendor receives the diff under review and with which key, so an edit here can '
+       + 're-route or blind the whole panel.',
+  },
+  {
+    after: 'modules/grading/model-provider.js',
+    glob: 'modules/grading/grader-providers.neutral.json',
+    why: 'the core neutral provider set, which declares none. An entry added here would '
+       + 'send every instance\'s diffs to a vendor by default.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from

package/tests/grade_model_provider.mjs

@@ -0,0 +1,217 @@
+// tests/grade_model_provider.mjs — the ModelProvider port + the openai-compatible
+// adapter (task 1002840, ADR 0089 §3).
+//
+// Pins: (1) every model id in use today still runs on the Claude spawn, with the
+// identical argv; (2) the openai-compatible adapter against a LOCAL STUB server —
+// request shape, envelope, cost, and every failure mapped to the error codes the
+// worker runner already understands — with no real key and no network; (3) a key
+// that is missing sends nothing, and a key never leaks into an error; (4) the
+// config loader fails to vanilla; (5) the judge table reproduces the old if/else
+// and refuses a same-family or non-Claude judge (ADR 0024 / the Claude floor).
+//
+// Run:  node --test tests/grade_model_provider.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const subagent = require('../modules/grading/grader-subagent.js');
+const mp = require('../modules/grading/model-provider.js');
+const model = require('../modules/grading/grader-model.js');
+const workers = require('../modules/grading/grader-workers');
+
+// A local OpenAI-shaped server. `reply(req, body)` returns { status, json|text, delayMs }.
+async function stubServer(reply) {
+  const seen = [];
+  const server = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', (d) => { raw += d; });
+    req.on('end', async () => {
+      const body = raw ? JSON.parse(raw) : null;
+      seen.push({ method: req.method, url: req.url, headers: req.headers, body });
+      const r = reply(req, body) || {};
+      if (r.delayMs) await new Promise((ok) => setTimeout(ok, r.delayMs));
+      res.writeHead(r.status || 200, { 'content-type': 'application/json' });
+      res.end(r.text != null ? r.text : JSON.stringify(r.json));
+    });
+  });
+  await new Promise((ok) => server.listen(0, '127.0.0.1', ok));
+  const { port } = server.address();
+  return { seen, base: `http://127.0.0.1:${port}/v1`, close: () => new Promise((ok) => server.close(ok)) };
+}
+
+const KEY = 'test-key-not-a-real-secret-0123456789';
+function provider(base, extra = {}, env = { STUB_LLM_KEY: KEY }) {
+  const v = mp.validateProviderDef('stub', { kind: 'openai-compatible', base_url: base, api_key_env: 'STUB_LLM_KEY', ...extra });
+  assert.ok(v.def, v.error);
+  return mp.createOpenAICompatibleProvider(v.def, { env });
+}
+const completion = (content, usage = { prompt_tokens: 1000, completion_tokens: 200 }) => ({ json: { choices: [{ message: { role: 'assistant', content } }], usage } });
+
+test('parseModelRef: every id in use today is a Claude model; only a REGISTERED prefix routes elsewhere', () => {
+  for (const id of ['claude-sonnet-5', 'claude-opus-5', 'claude-fable-5', '', 'x:y']) {
+    assert.deepEqual(mp.parseModelRef(id), { provider: 'anthropic-cli', model: id });
+  }
+  mp.registerModelProvider({ name: 'test-ollama', kind: 'openai-compatible', run: async () => ({}) });
+  assert.deepEqual(mp.parseModelRef('test-ollama:qwen2.5-coder:32b'), { provider: 'test-ollama', model: 'qwen2.5-coder:32b' },
+    'split at the FIRST colon only — a colon inside the model id survives');
+  assert.deepEqual(mp.parseModelRef('anthropic-cli:claude-sonnet-5'), { provider: 'anthropic-cli', model: 'anthropic-cli:claude-sonnet-5' },
+    'the default is never a prefix');
+  assert.ok(mp.listModelProviders().includes('anthropic-cli'));
+});
+
+test('the Claude spawn is the default provider, with the identical argv', { skip: process.platform === 'win32' && 'the fake CLI is a shebang script' }, async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-'));
+  const bin = path.join(dir, 'claude');
+  fs.writeFileSync(bin, '#!/usr/bin/env node\nprocess.stdin.resume(); process.stdin.on("end", () => process.stdout.write(JSON.stringify({ type: "result", result: JSON.stringify(process.argv.slice(2)), total_cost_usd: 0.5 })));\n');
+  fs.chmodSync(bin, 0o755);
+  try {
+    const r = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, model: 'claude-sonnet-5', cwd: dir } });
+    const argv = JSON.parse(subagent.extractAssistantResult(r.stdout));
+    const perm = typeof process.getuid === 'function' && process.getuid() === 0 ? 'acceptEdits' : 'bypassPermissions';
+    assert.deepEqual(argv, ['-p', '--print', '--model', 'claude-sonnet-5', '--output-format', 'json', '--tools', 'Read', '--disable-slash-commands', '--permission-mode', perm]);
+    assert.equal(r.cost_usd, 0.5);
+    const d = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, cwd: dir } });
+    assert.equal(JSON.parse(subagent.extractAssistantResult(d.stdout))[3], 'claude-sonnet-5', 'no model → the default grader model, as before');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('openai-compatible: request shape, envelope and cost — against a local stub', async () => {
+  const s = await stubServer(() => completion('{"code_quality": 8}'));
+  try {
+    const p = provider(s.base, { price_per_mtok: { 'deepseek-x': { input: 0.25, output: 1 } } });
+    const r = await p.run({ prompt: 'PROMPT TEXT', opts: { model: 'deepseek-x', timeoutMs: 5000 } });
+    assert.equal(s.seen.length, 1);
+    assert.equal(s.seen[0].method, 'POST');
+    assert.equal(s.seen[0].url, '/v1/chat/completions');
+    assert.equal(s.seen[0].headers.authorization, `Bearer ${KEY}`);
+    assert.deepEqual(s.seen[0].body, { model: 'deepseek-x', messages: [{ role: 'user', content: 'PROMPT TEXT' }] });
+    // The same envelope contract the Claude spawn honours, so nothing downstream changes.
+    assert.equal(subagent.extractAssistantResult(r.stdout), '{"code_quality": 8}');
+    const cost = (1000 * 0.25 + 200 * 1) / 1e6;
+    assert.equal(subagent.extractCostUsd(r.stdout), cost);
+    assert.equal(r.cost_usd, cost);
+    assert.equal(r.exit_code, 0);
+    const unpriced = await p.run({ prompt: 'x', opts: { model: 'other-model' } });
+    assert.equal(unpriced.cost_usd, null, 'no declared price → no cost number, never a guess');
+    assert.equal(subagent.extractCostUsd(unpriced.stdout), null);
+  } finally { await s.close(); }
+});
+
+test('openai-compatible: failures map to the codes the worker runner already retries or reports', async () => {
+  const s = await stubServer((req, body) => {
+    if (body.model === 'http-500') return { status: 500, text: `upstream says ${KEY} is invalid` };
+    if (body.model === 'slow') return { delayMs: 300, ...completion('late') };
+    if (body.model === 'garbage') return { text: 'not json at all' };
+    return completion('ok');
+  });
+  try {
+    const p = provider(s.base);
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'http-500' } }), (e) => {
+      assert.equal(e.code, 'SUBAGENT_NONZERO_EXIT');
+      assert.equal(e.exit_code, 500);
+      assert.ok(!e.stderr.includes(KEY) && e.stderr.includes('[redacted]'), 'the key is scrubbed from what a grade row stores');
+      return true;
+    });
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'slow', timeoutMs: 50 } }), (e) => e.code === 'SUBAGENT_TIMEOUT');
+    const g = await p.run({ prompt: 'x', opts: { model: 'garbage' } });
+    assert.equal(subagent.extractAssistantResult(g.stdout), '', 'an unparseable 200 is an empty result → the worker parse_error path, retried once');
+  } finally { await s.close(); }
+  const dead = provider(s.base);
+  await assert.rejects(dead.run({ prompt: 'x', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED', 'a closed port is a spawn failure');
+});
+
+test('a missing key sends NOTHING anywhere', async () => {
+  const s = await stubServer(() => completion('ok'));
+  try {
+    const p = provider(s.base, {}, {});
+    await assert.rejects(p.run({ prompt: 'the diff', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED' && /set STUB_LLM_KEY/.test(e.message));
+    assert.equal(s.seen.length, 0);
+  } finally { await s.close(); }
+});
+
+test('an open-model judge runs through the SAME worker runner and verdict code', async () => {
+  const s = await stubServer(() => completion(JSON.stringify({ code_quality: 8, economy: 8, confidence: 0.8, issues: [], notes_md: 'fine' })));
+  try {
+    mp.registerModelProvider({ ...provider(s.base, { price_per_mtok: { 'q-coder': { input: 1, output: 1 } } }), name: 'test-stub' });
+    const r = await workers.runWorker(workers.quality, {
+      task: { id: 1, title: 't', description: 'd' }, valueSummary: 'v', diff: 'diff', changedFiles: [], diffStats: null,
+      model: 'test-stub:q-coder', runOpts: {}, runSubagentFn: subagent.runSubagent, extractAssistantResultFn: subagent.extractAssistantResult,
+    });
+    assert.equal(r.verdict, 'pass');
+    assert.equal(r.scores.code_quality, 8);
+    assert.equal(r.model, 'test-stub:q-coder', 'the record names the provider');
+    assert.equal(r.cost_usd, 1200 / 1e6);
+    assert.equal(s.seen[0].body.model, 'q-coder', 'the provider receives its own model id');
+  } finally { await s.close(); }
+});
+
+test('provider config: validated, and a bad instance file fails to vanilla', () => {
+  const bad = (name, def) => mp.validateProviderDef(name, def).error;
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'K_KEY' }), /https/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1', api_key_env: 'sk-live-abc' }), /env var NAME/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1' }), /needs api_key_env/);
+  assert.match(bad('anthropic-cli', { kind: 'openai-compatible', base_url: 'https://x.example/v1', api_key_env: 'K' }), /must match|not be/);
+  assert.match(bad('x-prov', { kind: 'grpc', base_url: 'https://x.example/v1', api_key_env: 'KK' }), /kind/);
+  assert.equal(bad('local-ollama', { kind: 'openai-compatible', base_url: 'http://localhost:11434/v1' }), undefined, 'keyless http is allowed to this machine only');
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-cfg-'));
+  try {
+    const neutral = path.join(gradingDir(), 'grader-providers.neutral.json');
+    assert.deepEqual(mp.loadProviderConfig({ instancePath: path.join(dir, 'absent.json'), neutralPath: neutral }).defs, [],
+      'the shipped neutral starter declares no provider — a vanilla instance is Claude-only');
+    const broken = path.join(dir, 'broken.json');
+    fs.writeFileSync(broken, '{ not json');
+    assert.equal(mp.loadProviderConfig({ instancePath: broken, neutralPath: neutral }).source, neutral);
+    const mixed = path.join(dir, 'mixed.json');
+    fs.writeFileSync(mixed, JSON.stringify({ providers: {
+      deepinfra: { kind: 'openai-compatible', base_url: 'https://api.deepinfra.com/v1/openai', api_key_env: 'DEEPINFRA_API_KEY' },
+      leaky: { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'LEAKY_KEY' },
+    } }));
+    const cfg = mp.loadProviderConfig({ instancePath: mixed, neutralPath: neutral });
+    assert.deepEqual(cfg.defs.map((d) => d.name), ['deepinfra']);
+    assert.equal(cfg.refused.length, 1, 'one bad entry is refused by name; the rest load');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+function gradingDir() {
+  return path.dirname(require.resolve('../modules/grading/model-provider.js'));
+}
+
+test('the judge table reproduces the old if/else, and refuses a same-family or non-Claude judge', () => {
+  const oldIfElse = (bm) => {
+    const s = bm.toLowerCase();
+    if (s.includes('fable') || s.includes('mythos')) return 'claude-sonnet-5';
+    if (s.includes('opus')) return 'claude-sonnet-5';
+    if (s.includes('sonnet')) return 'claude-opus-5';
+    if (s.includes('haiku')) return 'claude-opus-5';
+    return null;
+  };
+  const tokens = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+  const ids = ['claude-fable-5', 'claude-opus-5-5', 'claude-sonnet-5', 'claude-haiku-4-5', 'Claude-OPUS-4-8'];
+  for (const a of tokens) for (const b of tokens) ids.push(`claude-${a}-${b}`);
+  for (const id of ids) assert.equal(model.selectGraderModel({ builderModel: id }), oldIfElse(id), id);
+  assert.deepEqual(model.JUDGE_TABLE, model.BUILTIN_JUDGE_TABLE, 'the rubric table is exactly the built-in fallback');
+
+  const logged = [];
+  const orig = console.error;
+  console.error = (...a) => { logged.push(a.join(' ')); };
+  try {
+    assert.equal(model.selectGraderModel({ builderModel: 'gpt-9' }), 'claude-sonnet-5', 'an unknown builder warns and grades on the default — never throws (task 1002659)');
+  } finally { console.error = orig; }
+  assert.match(logged.join('\n'), /unrecognized builder model/);
+
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'claude-opus-5' }]).join(), /family it would grade/);
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'deepinfra:deepseek-v3' }]).join(), /plain Claude model id/);
+  assert.match(model.judgeTableProblems([]).join(), /non-empty/);
+  assert.deepEqual(model.judgeTableProblems(model.BUILTIN_JUDGE_TABLE), []);
+});