@bongos/core 1.19.133 → 1.19.135

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.133",
-  "core_contract": "1.19.133",
-  "source_commit": "ab4e04d82f1699e1781d780bf327f3da0150ddb9",
+  "core_version": "1.19.135",
+  "core_contract": "1.19.135",
+  "source_commit": "888206791acb8371163b4909f0d01592cd8d8a1f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T03:42:15.630Z",
+  "built_at": "2026-08-15T03:59:48.918Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1573,
-  "tree_sha256": "90710d328ac6f0b388a9c427df22ad7fb6fc7087ea9b5baebc708525e61aac50",
+  "tree_sha256": "8caf88024c497018a5d895be214220b6aa689b494d915c19cfeba7976ae93205",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3012,7 +3012,7 @@
     {
       "path": "modules/grading/grader-workers/worker-prompt.js",
       "mode": "0000644",
-      "sha256": "5b614e96ed951c5eebb5c40c93612f59ff79da768055233b59790599421a70ec"
+      "sha256": "986c7b039f392704613160c7ee10738030ef47972150d867e0972f6dfb761ae4"
     },
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
@@ -3022,7 +3022,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "edf6ecc725b37fe2c515174e6b06025f82fae10172e6f13d8fcfbb060c11474a"
+      "sha256": "49ae9286fea73fbf67a89e42bf10a14f9fb04d7857582accaab402ad966fafd6"
     },
     {
       "path": "modules/grading/module.json",
@@ -4172,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fd95462763cc12a1a060875e7ba46a46b8e3a396cbda3ad743ea926357ddfda9"
+      "sha256": "2ab902a16af6a378e0d37d108096211715103b4b1cfeccc4d8bb2f1619b5fe4a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "73ce7f53c0bab1ed2c0ab9dc6f6b8e64fadc8d01b6baa9afcfa2b10710f196a5"
+      "sha256": "30e48a7fe9316928d30c21508aaadc2f8a4aa9963acc74da16f1decfeb6ef7b3"
     },
     {
       "path": "public-docs/index.html",
@@ -5762,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6d426bc93757b3261642a8969c3ee1e87ab9c2c60e2cdb74539db67759501bbd"
+      "sha256": "705d95d94403240aa779f550a285fbc72f9c0729c83568dc5d28e7b4f5ceebbe"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6792,7 +6792,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "31557b08f8886f5d76201b5afbe0332e834504b67a391699798170aede9541e8"
+      "sha256": "e97bbe1f1d9bc1b602adbae26e5144675a9324c5b729d0046ffa43407a88922c"
     },
     {
       "path": "tests/grader_bypass.mjs",

package/modules/grading/grader-workers/worker-prompt.js

@@ -115,12 +115,21 @@ function buildWorkerPrompt({
     lines.push('---');
     lines.push(`## Post-change file contents (${contextBundle.files.length} of ${(changedFiles || []).length} changed files, bundled)`);
     lines.push('');
-    lines.push('The post-change contents of the changed files below are included inline — use your Read tool ONLY for files not bundled here (listed after the blocks) or for unchanged context files.');
+    lines.push('The post-change contents of the changed files below are included inline — use your Read tool ONLY for files not bundled here (listed after the blocks), for any block marked TRUNCATED, or for unchanged context files.');
+    lines.push('');
+    // task 1002905: a TRUNCATED block is a head PREFIX, not the file. A worker
+    // that searched the prefix, missed a change 62k chars in, and reported it as
+    // absent produced five fabricated blockers on a correct ship — so say what
+    // truncation means and forbid the absence claim it invites.
+    lines.push('A block marked TRUNCATED shows only the first N characters of that file — everything past that point is ABSENT FROM THIS PROMPT, not absent from the file. Never report code as missing, unexported, unchanged, or "not applied" on the strength of a truncated block: Read the file first, and if you cannot, say so rather than asserting absence.');
     lines.push('');
     for (const f of contextBundle.files) {
       // The filename is builder-controlled — scrub it like every other
       // untrusted string that lands OUTSIDE a fence (panel hacker finding).
-      const label = `FILE: ${scrubUntrusted(String(f.file))}${f.truncated ? ' (truncated)' : ''}`;
+      const truncNote = f.truncated
+        ? ` (TRUNCATED — first ${f.content.length} of ${f.chars_total ?? 'unknown'} chars; the rest is NOT shown)`
+        : '';
+      const label = `FILE: ${scrubUntrusted(String(f.file))}${truncNote}`;
       lines.push(...fenceBlock(label, f.content));
       lines.push('');
     }

package/modules/grading/grader.js

@@ -1166,22 +1166,59 @@ const CONTEXT_BUNDLE_MAX_FILE_CHARS = 16_000;
 // Binary-ish extensions never worth inlining (the diff already names them).
 const CONTEXT_BUNDLE_SKIP_RE = /\.(?:png|jpe?g|gif|webp|ico|svgz|woff2?|ttf|eot|zip|gz|tgz|tar|pdf|mp[34]|wav|ogg|bin|exe|dll|node)$/i;
 
+// Added lines per file, from the unified diff. Only lines long enough to be a
+// meaningful fingerprint (a bare `}` or `});` matches anywhere) — used to prove
+// a truncated bundle prefix actually SHOWS the change (task 1002905).
+const BUNDLE_EVIDENCE_MIN_CHARS = 12;
+function diffAddedLinesByFile(diff) {
+  const byFile = new Map();
+  let cur = null;
+  let prevWasOldHeader = false;
+  for (const line of String(diff || '').split('\n')) {
+    // A '+++ ' header only counts right after its '--- ' partner: a content line
+    // reading '++ x' arrives as '+++ x' and must not be mistaken for a header.
+    if (prevWasOldHeader && line.startsWith('+++ ')) {
+      prevWasOldHeader = false;
+      const p = line.slice(4).trim().replace(/^b\//, '');
+      cur = p === '/dev/null' ? null : p;
+      continue;
+    }
+    prevWasOldHeader = line.startsWith('--- ');
+    if (prevWasOldHeader || line.startsWith('diff --git')) continue;
+    if (!cur || !line.startsWith('+')) continue;
+    const t = line.slice(1).trim();
+    if (t.length < BUNDLE_EVIDENCE_MIN_CHARS) continue;
+    if (!byFile.has(cur)) byFile.set(cur, []);
+    byFile.get(cur).push(t);
+  }
+  return byFile;
+}
+
 // Pure-ish (fs reads only, injectable): returns { files: [{file, content,
-// truncated}], skipped: [file...], total_chars } for the post-change contents
-// of changedFiles under cwd. Deleted/unreadable files land in skipped —
+// truncated, chars_total}], skipped: [file...], total_chars } for the post-change
+// contents of changedFiles under cwd. Deleted/unreadable files land in skipped —
 // their absence from the bundle is visible, never silent.
 //
-// Security (panel hacker finding, this task): changedFiles is builder-
+// Security (panel hacker finding, task 1002660): changedFiles is builder-
 // controlled and git commits symlinks, so a naive readFileSync would follow a
 // committed link OUT of the repo (SSH keys, session tokens) and inject the
 // target into worker prompts + the stored grade. lstat-refuse symlinks and
 // non-files, and require the resolved path to stay under cwd (containment) —
 // a refused entry lands in skipped, visible like every other exclusion.
-function buildContextBundle({ changedFiles, cwd, fsImpl = fs } = {}) {
+function buildContextBundle({ changedFiles, cwd, diff, fsImpl = fs } = {}) {
   const files = [];
   const skipped = [];
   let total = 0;
   const root = path.resolve(cwd || process.cwd());
+  // task 1002905: the fabricated all-blocker FAIL. A file over the per-file cap
+  // is truncated from the HEAD, so on a large file (ship.js: 250k chars) a change
+  // at char 62k lands entirely outside the bundle — and the prompt presents what
+  // IS bundled as "the post-change contents". A worker then searches the prefix,
+  // doesn't find the new code, and reports it as absent (5 blockers, every claim
+  // exactly the pre-change state). A prefix that contains none of the change is
+  // worse than no bundle at all, so refuse it: skipped[] already tells the worker
+  // to Read the file.
+  const addedByFile = diffAddedLinesByFile(diff);
   for (const rel of (Array.isArray(changedFiles) ? changedFiles : [])) {
     if (files.length >= CONTEXT_BUNDLE_MAX_FILES || total >= CONTEXT_BUNDLE_MAX_TOTAL_CHARS) {
       skipped.push(rel);
@@ -1196,14 +1233,19 @@ function buildContextBundle({ changedFiles, cwd, fsImpl = fs } = {}) {
       if (!st.isFile() || st.isSymbolicLink()) { skipped.push(rel); continue; }
       content = fsImpl.readFileSync(abs, 'utf8');
     } catch (_) { skipped.push(rel); continue; } // deleted by the diff, or unreadable
+    const charsTotal = content.length;
     let truncated = false;
     if (content.length > CONTEXT_BUNDLE_MAX_FILE_CHARS) {
       content = content.slice(0, CONTEXT_BUNDLE_MAX_FILE_CHARS);
       truncated = true;
     }
+    if (truncated) {
+      const added = addedByFile.get(rel);
+      if (added && added.length && !added.some((a) => content.includes(a))) { skipped.push(rel); continue; }
+    }
     if (total + content.length > CONTEXT_BUNDLE_MAX_TOTAL_CHARS) { skipped.push(rel); continue; }
     total += content.length;
-    files.push({ file: rel, content, truncated });
+    files.push({ file: rel, content, truncated, chars_total: charsTotal });
   }
   return { files, skipped, total_chars: total };
 }
@@ -1727,7 +1769,9 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
 
   // task 1002660: one read of the changed files, shared by all four workers —
   // kills the per-worker re-exploration that dominated panel cost.
-  const contextBundle = buildContextBundle({ changedFiles, cwd: runOpts.cwd });
+  // diff (task 1002905): lets the bundle prove a truncated prefix actually shows
+  // the change instead of handing a worker a head fragment as "post-change".
+  const contextBundle = buildContextBundle({ changedFiles, cwd: runOpts.cwd, diff });
   // task 1002660: cache-wrapped spawns. Same prompt + model replays at $0
   // (llm-cache, System 5) — the prompt embeds the diff + bundle, so the key
   // needs no separate scope sha. Absent llm-cache → plain runSubagent.
@@ -1767,6 +1811,17 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
     builder_model_assumed: builderModel || ASSUMED_BUILDER_MODEL,
     grader_model: graderModel,
     total_ms: totalMs,
+    // task 1002905: what the panel could actually SEE, recorded on every grade.
+    // Diagnosing the fabricated all-blocker FAIL cost a session because the grade
+    // record said nothing about the read root or how much of each file the workers
+    // were shown; a "the panel read the wrong tree" claim is now one field away.
+    context_bundle: {
+      read_root: path.resolve(runOpts.cwd || process.cwd()),
+      bundled: contextBundle.files.map((f) => ({
+        file: f.file, chars: f.content.length, chars_total: f.chars_total ?? null, truncated: f.truncated,
+      })),
+      skipped: contextBundle.skipped,
+    },
   });
 }
 
@@ -1997,6 +2052,7 @@ module.exports = {
   selectGraderModel,
   workerModelFor,                 // task 1002660: per-worker tier override (cross-model-guarded)
   buildContextBundle,             // task 1002660: shared post-change file contents, read once per panel
+  diffAddedLinesByFile,           // task 1002905: added-line fingerprints proving a truncated prefix shows the change
   validateAndScore,
   aggregateShots,
   runSubagent,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.133",
+  "version": "1.19.135",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.133",
+      "version": "1.19.135",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.133",
+  "version": "1.19.135",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -693,8 +693,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.131 with no explicit bump. run 31862317758. (task 1002620)
 //   1.19.133 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.132 with no explicit bump. run 31862484011. (task 1002620)
+//   1.19.134 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.133 with no explicit bump. run 31862749526. (task 1002620)
+//   1.19.135 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.134 with no explicit bump. run 31863235867. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.133'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.135'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -908,6 +908,74 @@ test('buildContextBundle truncates oversized files and marks them', () => {
   assert.ok(bundle.files[0].content.length <= 16_000);
 });
 
+// task 1002905 — the fabricated all-blocker FAIL.
+//
+// Task 1001916 shipped a 2-file diff from a feature worktree. ship.js is
+// 250,432 chars; the change (a new helper, its call site, its export) sits at
+// char ~62,000 — far past the 16,000-char per-file bundle cap. The bundle
+// therefore carried ONLY lines 1-265 of ship.js, and the prompt told the worker
+// to Read only files NOT bundled. The Quality worker searched the prefix, did
+// not find the new symbols, and returned 5 blockers asserting the change "does
+// not exist" — every claim exactly the pre-change state. (Three sibling workers
+// in the SAME process with the SAME cwd read the real files and passed, which
+// rules out the spawn cwd.) A truncated prefix that contains none of the change
+// must never be presented as "the post-change contents".
+test('buildContextBundle REFUSES a truncated prefix that shows none of the change (task 1002905)', () => {
+  const head = '// preamble\n'.repeat(2_000);            // ~24k chars, all before the change
+  const big = `${head}function formatPublishFailure(data, status, branch) {\n  return 'x';\n}\n`;
+  const diff = [
+    'diff --git a/scripts/gds/ship.js b/scripts/gds/ship.js',
+    '--- a/scripts/gds/ship.js',
+    '+++ b/scripts/gds/ship.js',
+    '@@ -1226,0 +1226,3 @@',
+    '+function formatPublishFailure(data, status, branch) {',
+    "+  return 'x';",
+    '+}',
+  ].join('\n');
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['scripts/gds/ship.js'], cwd: '/r', diff,
+    fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
+  });
+  assert.deepEqual(bundle.files, [], 'a prefix with none of the change is not bundled');
+  assert.deepEqual(bundle.skipped, ['scripts/gds/ship.js'], 'it lands in skipped, where the prompt tells the worker to Read it');
+});
+
+test('buildContextBundle still bundles a truncated file when the change IS visible in the prefix (task 1002905)', () => {
+  const big = `const NEW_HELPER_MARKER = 1;\n${'// filler\n'.repeat(4_000)}`;
+  const diff = [
+    '--- a/src/a.js',
+    '+++ b/src/a.js',
+    '@@ -1,0 +1,1 @@',
+    '+const NEW_HELPER_MARKER = 1;',
+  ].join('\n');
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['src/a.js'], cwd: '/r', diff,
+    fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
+  });
+  assert.equal(bundle.files.length, 1, 'the cost saving survives when the prefix carries the change');
+  assert.equal(bundle.files[0].truncated, true);
+  assert.equal(bundle.files[0].chars_total, big.length, 'the full size rides along so the prompt can state the extent');
+});
+
+test('worker prompts mark a TRUNCATED block and exempt it from the do-not-Read rule (task 1002905)', () => {
+  const prompt = grader.WORKERS.quality.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 'v',
+    diff: 'diff --git a/x b/x',
+    changedFiles: ['src/big.js'],
+    contextBundle: {
+      files: [{ file: 'src/big.js', content: 'const a = 1;', truncated: true, chars_total: 250_432 }],
+      skipped: [],
+      total_chars: 12,
+    },
+  });
+  assert.ok(/FILE: src\/big\.js \(TRUNCATED/.test(prompt), 'the label says TRUNCATED, not a quiet "(truncated)"');
+  assert.ok(prompt.includes('250432'), 'the label states how much of the file is missing');
+  assert.ok(/TRUNCATED/.test(prompt.split('Post-change file contents')[1].split('```')[0]),
+    'the lead instruction names truncated blocks as a Read exemption');
+  assert.ok(/never report code as missing/i.test(prompt), 'absence claims from a truncated block are forbidden');
+});
+
 test('buildContextBundle REFUSES symlinks — a committed link cannot pull out-of-repo content into prompts (hacker finding)', () => {
   const files = { 'src/a.js': 'ok', 'evil-link.js': 'should never be read' };
   const bundle = grader.buildContextBundle({