@bongos/core 1.19.1037 → 1.19.1039

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1037",
-  "core_contract": "1.19.1037",
-  "source_commit": "fc8861f3a11ffc5ecf0eb8625adaa18f22232afc",
+  "core_version": "1.19.1039",
+  "core_contract": "1.19.1039",
+  "source_commit": "dc9e168d73f9ec605af32419b0b638cca7539418",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T07:41:37.582Z",
+  "built_at": "2026-09-26T08:16:22.165Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2490,
+    "functional_verbatim": 2496,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3059,
-  "tree_sha256": "0ed4394afb862d1a8286d75da8f8d8ea947c47b9d26842004c92fe4f2a2825df",
+  "file_count": 3065,
+  "tree_sha256": "e4228541e27d69f8e2578edadb43181228ced5f21cc7b6dbe0102de50c3917be",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -907,7 +907,7 @@
     {
       "path": "docs/adr/0089-modular-multi-model-adversarial-grader.md",
       "mode": "0000644",
-      "sha256": "8311a65febe09e8912e1d09ccdf026b180540c6020ee464c14154c4244dcb151"
+      "sha256": "4ec01143da7055676994ec4351c71a1321d41224076f0c4639c451fba28e62b9"
     },
     {
       "path": "docs/adr/0090-metic-task-authoring.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "db77f43319c78e54f21709f88f82b7b27392a99cfcdf61a6dc25552a8be6c90f"
+      "sha256": "3d636e0870231f27697b67900e7feedff8e82b751cdd9771509cfe792d7157d6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,7 +2887,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "12e2fdc72d1bed7d524b50960dea3a67791b098b7dbafaff9c6f95cd356b185a"
+      "sha256": "4f006e07e58a861399d8d04ab0b52a1752f4ff605475288d60b60bffb7e123e7"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -2967,7 +2967,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "5e4213d19d7f13ff0a378f996c7e909e00cf262516e72f96e44d4ddf0d4cc861"
+      "sha256": "0125fca7ef4c910f87a03e20ccfb06ae8a81cf5ebc8f9821e4bc3e8a8d0a7ea1"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -4597,7 +4597,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "9889997d8a8c8c2145fb856bb94dd42131c3757300188324dfb8f5a0dcbf617c"
+      "sha256": "e703a0c652d40d8d8f5578fbcb4b08dde9afd4f97ecef0b99db5e3a181b05aae"
     },
     {
       "path": "modules/government/ranks.js",
@@ -4662,7 +4662,7 @@
     {
       "path": "modules/grading/grader-model.js",
       "mode": "0000644",
-      "sha256": "597f883d4878a8fb585585331e11dc219e8a57d1459be4039116b60e7fdc556d"
+      "sha256": "4141bc9e7ff90ab474af51bc78c0805af982b610c91ec90a8441e2b89a7596ce"
     },
     {
       "path": "modules/grading/grader-no-artifact.js",
@@ -4674,10 +4674,15 @@
       "mode": "0000644",
       "sha256": "d845b8785b39c89777e9cb9cdf5e869b51e8eae11c76288d9be4790239fd5e13"
     },
+    {
+      "path": "modules/grading/grader-providers.neutral.json",
+      "mode": "0000644",
+      "sha256": "1e1313c9bf157ce4b380c89e59832da4ee5573a18e1b70aa730c3826923b67eb"
+    },
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "a2c5ea5298e20b53ec03a5f047a3c5ae46fbaaedf9809d2b533ef7f81763f3dc"
+      "sha256": "58c445d96348ea0e9ee7d0603b88aa684fd7ad478a9de46c6668696ce8cd13f0"
     },
     {
       "path": "modules/grading/grader-score.js",
@@ -4687,7 +4692,7 @@
     {
       "path": "modules/grading/grader-subagent.js",
       "mode": "0000644",
-      "sha256": "4a185832e6bd6bce5bc7ad58d3f53f377a09b997a65037cb97714617cc6e0740"
+      "sha256": "a7e7c0cd702ff1a6b83d12ce0310de72ed601c6a4b8e886f1a873eeaeaaecadd"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -4749,6 +4754,11 @@
       "mode": "0000644",
       "sha256": "e223155c25f1fe4a66d7e3dd03b10632b76d4a7b851182df4afd05f5ae9d40bd"
     },
+    {
+      "path": "modules/grading/model-provider.js",
+      "mode": "0000644",
+      "sha256": "608f90bb52ed2fb9341021c02c6ae0f44ed41192c0050ce3052861e9216bd2ad"
+    },
     {
       "path": "modules/grading/module.json",
       "mode": "0000644",
@@ -8442,12 +8452,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "656579d0a1b5572cb3af67d5224a450c34175a8cc0804c68149f653aec7e77d7"
+      "sha256": "3a6d785e2391594909ba62c1e5dcf1c250096d802da67b1033353c8ced7bfac8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a5dd2e4c5f4ae817b4c34e70319307e79b4b0ff119bd56e3d4db4f933512b45d"
+      "sha256": "9ef9e201b3c2d1326f37ecd30eb7ed0ebbb56f8360608128e4b04974798cf4d0"
     },
     {
       "path": "public-docs/index.html",
@@ -8467,7 +8477,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "5eff67626993ed0c57101af392a9943d2e19c59571f6497ebc38a4d5d799afdb"
+      "sha256": "d39efdd82af8f39bf10ff6b145838d57dd6ab9eea277836ff1b7bd67a06f61ca"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9372,7 +9382,7 @@
     {
       "path": "scripts/gds/plain-cards.js",
       "mode": "0000644",
-      "sha256": "59735337e798c66feedeabfde750a9639a0def9c64ded40faa4c8b35b40adc5f"
+      "sha256": "b253a6c0e34cac3d18fb031b9a445d4db0589484da016309ecd7481a1ec1f311"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -9469,6 +9479,11 @@
       "mode": "0000644",
       "sha256": "3fbf7c20f83e3de8b47f834414c2bec9ba35f528cfb93995db73d627c8d46e73"
     },
+    {
+      "path": "scripts/gds/publish-integration-gate.js",
+      "mode": "0000644",
+      "sha256": "f797bfe1b72d0bb50587093ab93f32fd86b916f644dbf782cedf0b0e177b2b25"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
@@ -9862,7 +9877,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "92fcb61d2f0a1ee08912972fa153295e15684535d34e115574ff58e72d0d3615"
+      "sha256": "699e58b44e1be60c9e17acf108f7cd895a75d43a2854dac494583df35f522dbc"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -10522,7 +10537,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7d7946d420008189ad09b1871574c396acb3e7b24b0961e0118e381dd01e4c9d"
+      "sha256": "ef1f931d2bcea8854e341858cc0b0d7d347ede63bcc77377c71695f6600852fa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12352,7 +12367,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "baa87c05907ac8a4180d9bcdc58eca66e3bce9cae0e12093a7b53669f0e9a1b9"
+      "sha256": "3b022d77647dd871c43cdcfd8855932cc5d2c8a40fb061babcbae0d86e225097"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -12439,6 +12454,11 @@
       "mode": "0000644",
       "sha256": "b638a9fc43d9a1b8ca92ee20b9d0b6cc92104581d4f5d3af7bfd4bf9b310e508"
     },
+    {
+      "path": "tests/grade_model_provider.mjs",
+      "mode": "0000644",
+      "sha256": "11cfa2deade2db1f88f643d9aa310d34bdd0f37423944db4a68fa0ea2b2eba77"
+    },
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
@@ -14049,6 +14069,11 @@
       "mode": "0000644",
       "sha256": "3e3b97d2c7e4e67a412eaa04bbf3d8fd4ad649ae46f9e194c8e07eedfc2349bb"
     },
+    {
+      "path": "tests/publish_integration_gate.mjs",
+      "mode": "0000644",
+      "sha256": "f220032a0e9d58bfc07316f4192744294d2eef023677e602c23fc2c775e87390"
+    },
     {
       "path": "tests/publish_manifest.mjs",
       "mode": "0000644",
@@ -14604,6 +14629,11 @@
       "mode": "0000644",
       "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
     },
+    {
+      "path": "tests/ship_land_ci_not_started.mjs",
+      "mode": "0000644",
+      "sha256": "9d7902dfb2183713a06ecc845c4f466d3dc04fcf7d34a0f79cb2c6b6f89587af"
+    },
     {
       "path": "tests/ship_land_conflict.mjs",
       "mode": "0000644",

package/docs/adr/0089-modular-multi-model-adversarial-grader.md

@@ -187,6 +187,8 @@ Roll out behind a flag (the [ADR 0079](0079-value-gated-autonomous-engagement.md
 
 **Progress (2026-09-25).** Step 3's engine and registry landed first, ahead of steps 1–2, because both build on it: `modules/grading/grade-engine.js` names the pipeline (`select → pre_pass → evidence → fan_out → aggregate → gate → persist`), owns both deterministic pre-passes and a deterministic veto no work-type's aggregate can override, and resolves work-types from its own registry or a module's `grader.workType.<key>` seam provider. The code panel is registered as work-type `code`, the default. Proven a no-op: a before/after run of 27 grading scenarios came out byte-identical, and a replay of 376 recorded production grades reproduced every stored decision except 22 from June 2026, which an older grader produced before two deliberate gate changes (the task 943 "grader unavailable" outcome and the task 574 missing-security-lens block). Task 1002839; the replay tool is `scripts/gds/grade-replay.js`.
 
+**Progress (2026-09-26).** Step 1 landed (task 1002840): `modules/grading/model-provider.js` is the `ModelProvider` port at `runSubagent`, with the Claude spawn as the default `anthropic-cli` provider (a before/after run of 29 grading scenarios came out byte-identical) and an `openai-compatible` adapter tested against a local stub. `selectGraderModel`'s if/else is now the rubric's `judge_by_builder_family` table, refused at load if a judge would grade its own family or leave Claude. Providers are instance config (`config/grader-providers.json`); the core declares none, so no open model is called and nothing is spent until the owner adds one. The error-correlation audit (step 5) also landed early (task 1002843, `scripts/gds/grade-correlation-audit.js`).
+
 ---
 
 ## Sources

package/docs/module-api-changelog.md

@@ -2553,5 +2553,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1035 with no explicit bump. run 36226955285. (task 1002620)
   1.19.1037 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1036 with no explicit bump. run 36227523642. (task 1002620)
+  1.19.1038 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1037 with no explicit bump. run 36228854271. (task 1002620)
+  1.19.1039 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1038 with no explicit bump. run 36229255566. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -99,7 +99,7 @@ node scripts/gds/package-core.js --ref main --self-verify
 
 ### 2c. Publish — automatic on merge
 
-**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
+**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push — and the `integration` lane is green on the commit being released, which carries the packaged-core empty-database proof (task 1002863; the wait is task 1004290) — the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
 
 The lane is armed by the owner via the `PUBLISH_ON_MERGE=1` repo variable + two secrets (`NPM_TOKEN`, `RELEASE_PUSH_TOKEN`); while disarmed it no-ops loudly. Manual fallback, same command CI runs:
 

package/docs/recipes/private-npm-distribution.md

@@ -55,7 +55,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 ## Cutting a core release (the policy — [ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137)
 
-**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
+**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check and waits for the `integration` lane's verdict on the commit it releases (task 1004290), auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 

package/modules/government/protected-surfaces.json

@@ -60,6 +60,8 @@
     { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grade-engine.js", "group": "pipeline", "why": "task 1002839. The central grading engine every work-type is graded through: it runs the deterministic route-rank and permission-path pre-passes and applies the deterministic veto, so editing it can switch off the protected-path gate for every grade at once." },
+    { "glob": "modules/grading/model-provider.js", "group": "pipeline", "why": "task 1002840. The ModelProvider port every grader model call goes through: it decides which vendor receives the diff under review and with which key, so editing it can re-route or blind the whole panel." },
+    { "glob": "modules/grading/grader-providers.neutral.json", "group": "pipeline", "why": "task 1002840. The core's neutral provider set (none): an entry here would send every instance's diffs to a vendor by default." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },

package/modules/grading/grader-model.js

@@ -8,7 +8,7 @@
 
 'use strict';
 
-const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, WORKER_MODEL_TIERS, api } = require('./grader-config.js');
+const { ASSUMED_BUILDER_MODEL, DEFAULT_GRADER_MODEL, V4, WORKER_MODEL_TIERS, api } = require('./grader-config.js');
 
 function r1(n) {
   return Math.round(Number(n) * 10) / 10;
@@ -93,12 +93,14 @@ function isTrivialDiff({ changedFiles, diffStats } = {}) {
 // misconfiguration it guarded. Unknown ids now warn loudly and grade on
 // DEFAULT_GRADER_MODEL; the id still reaches signals.builder_model_assumed,
 // so /grader-health can spot the drift.
+//
+// task 1002840 (ADR 0089 §3): the Claude-only if/else is now DATA — the judge
+// table below, first matching row wins, in the old branch order.
 function selectGraderModel({ builderModel } = {}) {
   const bm = (builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
-  if (bm.includes('fable') || bm.includes('mythos')) return 'claude-sonnet-5';
-  if (bm.includes('opus')) return 'claude-sonnet-5';
-  if (bm.includes('sonnet')) return 'claude-opus-5';
-  if (bm.includes('haiku')) return 'claude-opus-5';
+  for (const row of JUDGE_TABLE) {
+    if (row.builder_families.some((f) => bm.includes(f))) return row.judge_model;
+  }
   console.error(
     `selectGraderModel: unrecognized builder model ${JSON.stringify(builderModel)} — ` +
     `no 'fable'/'mythos'/'opus'/'sonnet'/'haiku' token; grading on the default ` +
@@ -112,6 +114,46 @@ function selectGraderModel({ builderModel } = {}) {
 // back to graderModel) when it lands on the BUILDER's own family: tiering is
 // a cost lever, never a hole in the ADR 0024 cross-model guarantee.
 const MODEL_FAMILY_TOKENS = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+
+// task 1002840: the judge table — which grader model each builder family gets.
+// Read from the rubric (v4.judge_by_builder_family) and VALIDATED at load. A
+// row is refused when its judge shares a family with a builder it serves (the
+// ADR 0024 cross-model guarantee: no resolution may land the judge in the
+// builder's own family) or is not a plain Claude model id — the GATING panel
+// stays on Claude, the quality floor ADR 0089 keeps; an open model joins only as
+// an advisory judge (task 1003858). A table that fails is replaced WHOLE by the
+// built-in one below, which is the mapping the old if/else hard-coded, so a bad
+// rubric edit degrades to today's behaviour instead of to a throw at grade time.
+const BUILTIN_JUDGE_TABLE = Object.freeze([
+  Object.freeze({ builder_families: Object.freeze(['fable', 'mythos', 'opus']), judge_model: 'claude-sonnet-5' }),
+  Object.freeze({ builder_families: Object.freeze(['sonnet', 'haiku']), judge_model: 'claude-opus-5' }),
+]);
+
+function judgeTableProblems(table) {
+  if (!Array.isArray(table) || table.length === 0) return ['judge_by_builder_family must be a non-empty array'];
+  const problems = [];
+  table.forEach((row, i) => {
+    const fams = row && Array.isArray(row.builder_families) ? row.builder_families : null;
+    const judge = row && typeof row.judge_model === 'string' ? row.judge_model.toLowerCase() : null;
+    if (!fams || fams.length === 0 || !fams.every((f) => MODEL_FAMILY_TOKENS.includes(f))) {
+      problems.push(`row ${i}: builder_families must list family tokens (${MODEL_FAMILY_TOKENS.join('/')})`);
+      return;
+    }
+    const judgeFamily = judge && !judge.includes(':') ? MODEL_FAMILY_TOKENS.find((t) => judge.includes(t)) : null;
+    if (!judgeFamily) problems.push(`row ${i}: judge_model must be a plain Claude model id (the gating panel stays on Claude)`);
+    else if (fams.includes(judgeFamily)) problems.push(`row ${i}: judge '${row.judge_model}' is in the '${judgeFamily}' family it would grade (ADR 0024)`);
+  });
+  return problems;
+}
+
+function resolveJudgeTable(table) {
+  const problems = judgeTableProblems(table);
+  if (problems.length === 0) return table;
+  console.error(`grader: rubric v4.judge_by_builder_family refused (${problems.join('; ')}) — grading on the built-in judge table`);
+  return BUILTIN_JUDGE_TABLE;
+}
+const JUDGE_TABLE = resolveJudgeTable(V4.judge_by_builder_family);
+
 function workerModelFor(kind, graderModel, builderModel) {
   const tier = WORKER_MODEL_TIERS[kind];
   if (!tier) return graderModel;
@@ -137,12 +179,15 @@ const LLM_PROJECT = (() => {
 
 
 module.exports = {
+  BUILTIN_JUDGE_TABLE,
+  JUDGE_TABLE,
   LLM_PROJECT,
   MODEL_FAMILY_TOKENS,
   TRIVIAL_MAX_FILES,
   TRIVIAL_MAX_LINES,
   clamp,
   isTrivialDiff,
+  judgeTableProblems,
   median,
   r1,
   selectGraderModel,

package/modules/grading/grader-providers.neutral.json

@@ -0,0 +1,4 @@
+{
+  "_comment": "The core's neutral starter for grader model providers (task 1002840, ADR 0089 §3): NONE, so a vanilla instance grades on Claude alone. An instance declares its own in config/grader-providers.json at the instance root. Each entry is { kind: 'openai-compatible', base_url: https://…, api_key_env: <ENV VAR NAME, never the key>, price_per_mtok: { <model>: { input, output } } }. Declaring one is an owner decision: it sends the diff under review to that vendor and costs money per call.",
+  "providers": {}
+}

package/modules/grading/grader-rubric.json

@@ -14,6 +14,11 @@
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
     "worker_model_tiers": { "quality": "claude-sonnet-5", "reader": "claude-sonnet-5" },
     "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically. task 1003977: the READER is pinned to claude-sonnet-5 for the same task-1003318 reason — it is Read-heavy by construction (the voice guide, then the render paths that decide whether a string is user-facing), and a small window fails deterministically with PROMPT_TOO_LONG. For a NON-GATING worker that means silently reading no copy at all on exactly the biggest copy diffs, with nothing blocking to reveal it.",
+    "judge_by_builder_family": [
+      { "builder_families": ["fable", "mythos", "opus"], "judge_model": "claude-sonnet-5" },
+      { "builder_families": ["sonnet", "haiku"], "judge_model": "claude-opus-5" }
+    ],
+    "judge_by_builder_family_note": "task 1002840 (ADR 0089 §3): the cross-family judge choice selectGraderModel used to hard-code as an if/else — the first row whose family token appears in the builder's model id wins. Validated at load (grader-model.js judgeTableProblems): a judge in the family it grades (ADR 0024) or anything but a plain Claude id is refused and the whole table falls back to the built-in copy of exactly these two rows. An unmatched builder still grades on default_model with a warning (task 1002659).",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-subagent.js

@@ -12,8 +12,13 @@ const path = require('node:path');
 const fs = require('node:fs');
 const { spawn } = require('node:child_process');
 const { DEFAULT_GRADER_MODEL, api } = require('./grader-config.js');
+// task 1002840: the ModelProvider port (ADR 0089 §3) — runSubagent below routes
+// through it; the Claude spawn is its default provider.
+const modelProvider = require('./model-provider.js');
 
-function runSubagent({ prompt, opts = {} }) {
+// The `claude -p` spawn — the anthropic-cli ModelProvider. Body unchanged by
+// task 1002840; only its name moved, so runSubagent could become the port.
+function runClaudeCli({ prompt, opts = {} }) {
   return new Promise((resolve, reject) => {
     const timeoutMs = opts.timeoutMs ?? 240_000;
     const cwd = opts.cwd ?? process.cwd();
@@ -119,6 +124,17 @@ function runSubagent({ prompt, opts = {} }) {
     child.stdin.end();
   });
 }
+modelProvider.registerModelProvider({ name: modelProvider.DEFAULT_PROVIDER, kind: 'anthropic-cli', run: runClaudeCli });
+
+// runSubagent — the ModelProvider port every platform LLM call goes through
+// (the panel workers, the no-artifact shots, architect-audit, the agents module
+// via the grade port). A model with no registered provider prefix — every id in
+// use today — runs on the Claude spawn exactly as before; `<provider>:<model>`
+// runs on that provider, which answers in the same envelope + error codes.
+function runSubagent({ prompt, opts = {} }) {
+  const ref = modelProvider.parseModelRef(opts.model ?? DEFAULT_GRADER_MODEL);
+  return modelProvider.resolveModelProvider(ref.provider).run({ prompt, opts: { ...opts, model: ref.model } });
+}
 
 // ---------- task 1002660: shared context bundle ----------
 //