@bongos/core 1.19.216 → 1.19.217

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.216",
-  "core_contract": "1.19.216",
-  "source_commit": "332217b9ce9425651b7e9cc00f7c10370283a3c5",
+  "core_version": "1.19.217",
+  "core_contract": "1.19.217",
+  "source_commit": "2a474dc7f283910befbca2879f13d342c4d5f0b4",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T00:28:05.306Z",
+  "built_at": "2026-08-18T00:33:32.467Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "ef48b6c7019bc69b448588ddba70fd4dad3efe642c319e131914d0719faa13a2",
+  "tree_sha256": "a3212b990024b1a28961deb9e9d93d52eeca950d4be79f84b3bddd2fe928583f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -167,7 +167,7 @@
     {
       "path": ".claude/skills/grader-health/SKILL.md",
       "mode": "0000644",
-      "sha256": "3186b6ead583632966031b9bcf57f40a98eeecfe4ab7e40435e4874a5e37eb20"
+      "sha256": "3268e1138e02245ddf16d11b072133168cf0f59ca0ea4656631babba5df7158c"
     },
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e3ec1b7c73d0f97c739441cbfb445bf1272ab8188908a40c5f5b20b503e0aecf"
+      "sha256": "09501ec03bde658dfcbc651c0603d0c45f5d38914aafb73ff685ccec7c76d69e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6e3bf39a631c8a79e69291876119717c4f25acf8ad15144bfd845452e3a4ec2"
+      "sha256": "c6882c7a5bf88c3cdd811dd9b957aeffe46b5ffbdc9c42e45a49c5e5caff1edf"
     },
     {
       "path": "public-docs/index.html",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1b0b819f43443acd16ef719721610c5eb1d4077a083f5b40f272b7e176ab203a"
+      "sha256": "6123bf63d65e4e5327c05a413117015e2198293f2a1a2191f10cb1ecbb397fbf"
     },
     {
       "path": "src/module-loader/catalog.js",

package/.claude/skills/grader-health/SKILL.md

@@ -31,7 +31,16 @@ Baselines: the 14-agent evaluation window measured a **90.6%** pass rate, alread
 
 ### 3 — Cost anomalies
 
-Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. Read grader spend: `node scripts/gds/api.js GET "/api/gds/public/cost-summary?source=grader&days=30"` and divide by the grade count from axis 2's window.
+Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. Read grader spend and divide by the grade count from axis 2's window:
+
+```
+node scripts/gds/api.js GET "/api/gds/public/cost-summary?source=grader&days=30" --quiet \
+  | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const j=JSON.parse(s);
+      if(j.applied_filters?.source!=='grader'){console.error('FILTER DROPPED — do not divide');process.exit(1)}
+      console.log('grader 30d:', j.filtered_total_usd)})"
+```
+
+**Read `filtered_total_usd`, never `total_usd`.** The filters drill into the breakdown; they deliberately do *not* rescope the headline, so `total_usd` stays instance-wide (the treasury chart depends on that) and is off by more than an order of magnitude here. `by_category` / `by_builder` / `by_source` *are* filtered — under `?source=grader`, `by_builder` attributes each panel to the builder whose ship triggered it, which is why human logins appear. The `applied_filters` guard above makes a silently-dropped filter fail loudly instead of yielding a wrong mean.
 
 - Mean drifting well above the benchmark → panel re-rolls/retries or timeout-and-retry loops (not "big diffs" — the fixed-cost share means diff size barely moves the mean).
 - Near-zero spend with grades still recording → the trivial path or grade reuse dominating; spot-check that gating lenses are actually running.
@@ -56,6 +65,6 @@ End with a compact findings list, most severe first: axis, evidence (the numbers
 
 ## Files this skill touches
 
-- Reads: `GET /api/gds/public/grades`, `GET /api/gds/grades/by-builder` (Archon), `GET /api/gds/public/cost-summary?source=grader`, `GET /api/gds/tasks/:id?include=grade`, `modules/grading/grader.js`, `modules/grading/grader-rubric.json`.
+- Reads: `GET /api/gds/public/grades`, `GET /api/gds/grades/by-builder` (Archon), `GET /api/gds/public/cost-summary?source=grader` (the `filtered_total_usd` key), `GET /api/gds/tasks/:id?include=grade`, `modules/grading/grader.js`, `modules/grading/grader-rubric.json`.
 - Runs (read-only): `node scripts/gds/doctor.js`; with `--probe` only: `node scripts/gds/grade-smoke.js`.
 - Writes: nothing.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.216",
+  "version": "1.19.217",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.216",
+      "version": "1.19.217",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.216",
+  "version": "1.19.217",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -859,8 +859,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.214 with no explicit bump. run 32084187695. (task 1002620)
 //   1.19.216 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.215 with no explicit bump. run 32084584347. (task 1002620)
+//   1.19.217 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.216 with no explicit bump. run 32084927511. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.216'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.217'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');