@bongos/core 1.19.25 → 1.19.27

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.25",
-  "core_contract": "1.19.25",
-  "source_commit": "5946896ddb840e6d7a52eadf92a5e42d47d716fa",
+  "core_version": "1.19.27",
+  "core_contract": "1.19.27",
+  "source_commit": "a8f09266a4b9cdbdf70ea92de3c2a26553aacab2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T13:18:22.297Z",
+  "built_at": "2026-08-11T13:38:48.421Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1204,
+    "functional_verbatim": 1205,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1510,
-  "tree_sha256": "159afabb8c0c958bde0c962fb152ab372f6c6e34333f2d6718a4b2f2e40dd47b",
+  "file_count": 1511,
+  "tree_sha256": "b85699092f300b5bab1ab32e95763e4f032d2ee8f688466f4c4dc939048174bd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2822,7 +2822,7 @@
     {
       "path": "modules/grading/db.js",
       "mode": "0000644",
-      "sha256": "ed7df5654cead0c89945a53c2de65bbdb7549aeeb7b73845143bced5a451d77b"
+      "sha256": "b651b73c65b0da33284430b430638dbc39b34db43846a05ab431deaabcc44b3b"
     },
     {
       "path": "modules/grading/grader-rubric.json",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "a08e9c017a07bffa311a9de6df007c30d9f3766c86d0ce2ec88660fed60d37aa"
+      "sha256": "bc2b580d2be98f5b2acb9a0dd9416dd3c2cad387bbe61a6823e37102d3468675"
     },
     {
       "path": "modules/grading/module.json",
@@ -2932,7 +2932,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "dcb19e4ec7a5df5299f84d70dc80fcc09d0ecf3110d89dda9ec40d1444df376d"
+      "sha256": "5bdd907f10ae15f8efdb55adce3ce23991a376122eb79c549e025f8f4845fae5"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -3352,7 +3352,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "7dc50e4e88a204583c753555c76f4103df405a143c4266dbff53793c292803f9"
+      "sha256": "85c856016e548399538734098d2f08d3920fb52814759ffa314ed26d98bf32eb"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "f5041a43ea0a74bc6b16f8ceb6490c70090e7959e66f137c92040ee842db1ec0"
+      "sha256": "aa179ab79508a002e8f580fb839767d8aaa8b6f02a46d021bb61633dd9f8f9a4"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "61a5251f8c5ae2be0e5d3cce0dbff87afc4ec3b5327d128a04ad67b6283b23ba"
+      "sha256": "a32cc5b3e33b39013ebe6508049b2ce0dac4c6ac8edce2adf396af265a0c4df8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "11341042a94fdb5a03fd8d318a6471763f0b97d46efb13b00743f4abee686839"
+      "sha256": "aea4f2f3266f8107e00346fb410bb214997bc0cda76e7ecba36b7f2210b9b661"
     },
     {
       "path": "public-docs/index.html",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3b6cabeb91e7181b5d83689bb3e81b4113e0c1a357e6b040fc0caecbf405802b"
+      "sha256": "f75a298d5c776e9bb7ba33c75061ca193c73b0004eea7c0f6706f02b8daad0f0"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6564,6 +6564,11 @@
       "mode": "0000644",
       "sha256": "a2d76ca391999e54b0767c3cba8eba34e84d5c704c3ac98370195ef9889bd152"
     },
+    {
+      "path": "tests/grade_aggregates_unavailable.mjs",
+      "mode": "0000644",
+      "sha256": "a55ae09e94648035479ff214ac26c2c84f2fc3c166237f06d296a6fd6608ec48"
+    },
     {
       "path": "tests/grade_attempts.mjs",
       "mode": "0000644",
@@ -6582,7 +6587,7 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "c650bd3c79d469f3ffb1cdada6f23521dd09c97844affd5b9e7f340d1796daa6"
+      "sha256": "b0af74bc3b3e203716b13fbf3fc174a90f51daf659d5c5e5400725e85a0da4fc"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",

package/modules/grading/db.js

@@ -18,22 +18,33 @@
 const api = require('../../src/module-api');
 const { pool } = api;
 
-// Rolling grade stats for a builder over the last `days`: { n, avg_score, n_passed }.
-// Windows by graded_at; `shipped_by` attributes the grade to the builder who did
-// the work. Returns a zero row when the builder has no grades in the window.
+// Rolling grade stats for a builder over the last `days`: { n, avg_score,
+// n_passed, n_unavailable }. Windows by graded_at; `shipped_by` attributes the
+// grade to the builder who did the work. Returns a zero row when the builder
+// has no grades in the window.
+//
+// Quality stats count ONLY quality-graded rows (task 1002652): a grader outage
+// (#943 — signals.panel_outcome='unavailable') or a json-null gating axis
+// (functional_fidelity / code_quality) is bucketed as n_unavailable, never a
+// 0-score fail. The predicate is a documented twin of lifecycle/db.js
+// `gradeQualityWhere` (module boundary — keep the two in sync).
 async function builderRollingAvgGrade(builderId, days = 14) {
+  const q = `(COALESCE(g.signals->>'panel_outcome','') <> 'unavailable'
+           AND COALESCE(jsonb_typeof(g.rubric_scores->'functional_fidelity'),'') <> 'null'
+           AND COALESCE(jsonb_typeof(g.rubric_scores->'code_quality'),'') <> 'null')`;
   const { rows } = await pool.query(
     `SELECT
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(g.score), 0)::numeric(3,1)                  AS avg_score,
-       COALESCE(SUM(CASE WHEN g.passed THEN 1 ELSE 0 END), 0)::int AS n_passed
+       COUNT(*) FILTER (WHERE ${q})::int                         AS n,
+       COALESCE(AVG(g.score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       COALESCE(SUM(CASE WHEN g.passed THEN 1 ELSE 0 END) FILTER (WHERE ${q}), 0)::int AS n_passed,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                     AS n_unavailable
        FROM task_grades g
        JOIN tasks t ON t.id = g.task_id
       WHERE t.shipped_by = $1
         AND g.graded_at >= now() - ($2 || ' days')::interval`,
     [builderId, String(days)]
   );
-  return rows[0] || { n: 0, avg_score: 0, n_passed: 0 };
+  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, n_unavailable: 0 };
 }
 
 module.exports = { builderRollingAvgGrade };

package/modules/grading/grader.js

@@ -645,6 +645,37 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
     if (clientPassed) downgradeTo = 'fail';
   }
 
+  // --- Guard 1b: vacuous permission-path input (task 1002646 / report 1000021 G-1) ---
+  // The pre-pass above pairs the SERVER-known rank with CLIENT-supplied
+  // committed_files, so omitting the list (or sending []) made the sub-floor
+  // protected-path check pass VACUOUSLY — zero files, zero hits, hardFail:false —
+  // a trusted-rank check applied to an untrusted, omittable diff. The server
+  // still cannot re-derive the feature-branch diff at grade time (boundary note
+  // above; the task-1002645 published tip is recorded at ci-land, AFTER the
+  // grade), but it can refuse to treat "no input" as "no hits": a caller below
+  // the registry's lowest floor submitting NO file list makes the check
+  // UNPROVABLE → fail closed. Honest ships are unaffected (ship.js always sends
+  // the real committed list — task 878 — and a floor-clearing rank never enters
+  // this branch). The dishonest-LIST case (a sub-floor caller sending an
+  // innocuous list while touching protected paths) stays owned by gate-review CI
+  // + the post-push main audit, which read the REAL diff. Unknown rank keeps
+  // failing open at this layer (isBelowFloor → false) — the main audit reads the
+  // real author rank from the DB and owns that case, exactly as for the pre-pass.
+  const submittedFileCount = Array.isArray(committedFiles)
+    ? committedFiles.filter((f) => typeof f === 'string' && f.trim()).length
+    : 0;
+  if (permissionPathCheck.isBelowFloor(builderRank) && submittedFileCount === 0) {
+    // Resolve the floor label from the registry at runtime (the D-16/N-3
+    // stale-string rule) — never a hardcoded rank name.
+    const floorRank = Object.keys(permissionPathCheck.RANK_TIER)
+      .find((r) => permissionPathCheck.RANK_TIER[r] === permissionPathCheck.MIN_TIER) || 'the floor';
+    guardsTripped.push({ guard: 'permission_path_unprovable', severity: 'blocker',
+      summary: `rank '${builderRank}' is below the protected-path floor ('${floorRank}') and the grade submitted no committed_files — the permission-path check cannot run on an empty list, so a client PASS cannot stand (fail closed; task 1002646 / SR-9). Remedy: re-run the ship — ship.js submits the real committed file list; a genuinely file-less (DB-only) change needs a ${floorRank}+ builder to land it via /tasks/:id/confirm.` });
+    extraIssues.push({ severity: 'blocker', file: '(grade)', summary:
+      `[server permission-path] no committed_files submitted by a rank below the '${floorRank}' floor — the protected-path check is unprovable and fails closed (task 1002646)`, worker: 'server-permission-path' });
+    if (clientPassed) downgradeTo = 'fail';
+  }
+
   // --- Guard 2: implausible client verdict (SR-9) ---
   // A client PASS with an empty issues[] on a non-trivial diff is not a credible
   // default-fail panel verdict. Downgrade to manual-confirm (a human lands it via
@@ -697,7 +728,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       ...base,
       signals: {
         ...(base.signals || {}),
-        server_guard: { applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
+        server_guard: { applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
       },
     };
   }
@@ -729,7 +760,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       // body already ran; this is the authoritative post-hoc adjustment).
       confidence: forwardedConfidence,
       server_guard: {
-        applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'],
+        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
         ok: guardsTripped.length === 0,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,
@@ -739,7 +770,9 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
         // the code. Named here so clients render it as a wall, not a quality
         // FAIL the builder should fix-and-retry (the envelope used to teach
         // exactly that wrong lesson). route_rank stays a code finding.
-        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path'),
+        // task 1002646: permission_path_unprovable is the same wall — the rank
+        // floor refusing an unverifiable diff — so it renders the same way.
+        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path' || g.guard === 'permission_path_unprovable'),
       },
     },
     notes_md: `${base.notes_md || ''}${guardNote}`,

package/modules/hall-ui/public/builders.js

@@ -1457,15 +1457,20 @@
       return;
     }
     tbody.innerHTML = grades.map((g) => {
-      const score = Number(g.score).toFixed(1);
-      const verdict = g.passed
-        ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
-        : `<span style="color:#a04040;font-weight:600">fell short</span>`;
+      // A grader OUTAGE row (panel_outcome 'unavailable') carries a placeholder
+      // score of 0 — label it, never render it as a 0.0 fail (task 1002652).
+      const isOutage = g.panel_outcome === 'unavailable';
+      const score = isOutage ? '—' : Number(g.score).toFixed(1);
+      const verdict = isOutage
+        ? `<span style="color:var(--ink-soft,#8a8577)">not graded (grader outage)</span>`
+        : g.passed
+          ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
+          : `<span style="color:#a04040;font-weight:600">fell short</span>`;
       return `
         <tr>
           <td class="ledger__num">#${g.task_id}</td>
           <td>${escapeHtml(g.title || '')}</td>
-          <td class="ledger__drachmae">${score} / 10</td>
+          <td class="ledger__drachmae">${isOutage ? '—' : `${score} / 10`}</td>
           <td>${verdict}</td>
           <td class="ledger__date">${fmtDate(g.graded_at)}</td>
         </tr>
@@ -1603,7 +1608,9 @@
     if (!isEco) {
       charts.push(chartCard('Cost / work ($)', (data.cost_trend || []).map((r) => r.per_work), 'var(--terracotta)',
         `total ${usd(h.total_cost_usd)}`));
-      charts.push(chartCard('Grade pass rate', (data.grade_trend || []).map((r) => (r.n ? r.n_passed / r.n : 0)), 'var(--accent)',
+      // n counts quality-graded rows only (task 1002652); a day whose grades
+      // were all outages has n=0 and must not plot as a 0% dip.
+      charts.push(chartCard('Grade pass rate', (data.grade_trend || []).filter((r) => Number(r.n) > 0).map((r) => r.n_passed / r.n), 'var(--accent)',
         'share of work passing review'));
     }
     gridEl.innerHTML = charts.join('');

package/modules/lifecycle/db.js

@@ -83,15 +83,34 @@ const staleClaimHourPredicate = (param) =>
                     AND c.claimed_at    < now() - (${param}::int * interval '1 hour'))`;
 
 // grade pass-count fragment: SUM of passed-as-1. `col` is the (possibly
-// alias-qualified) boolean column ('passed' or 'g.passed'); pass
-// { coalesce: false } for the two sites that omit the COALESCE(...,0) wrap
-// (audit §2B db-tx — alias × coalesce are the two preserved drift dimensions).
-
-const gradePassCount = (col, { coalesce = true } = {}) => {
-  const inner = `SUM(CASE WHEN ${col} THEN 1 ELSE 0 END)`;
+// alias-qualified) boolean column ('passed' or 'g.passed'); { where } restricts
+// the sum to quality-graded rows via FILTER (task 1002652 — every aggregate
+// site passes gradeQualityWhere, and keeps coalesce on because FILTER can zero
+// out a group). { coalesce: false } preserved for callers that want a raw SUM.
+
+const gradePassCount = (col, { coalesce = true, where = null } = {}) => {
+  const filter = where ? ` FILTER (WHERE ${where})` : '';
+  const inner = `SUM(CASE WHEN ${col} THEN 1 ELSE 0 END)${filter}`;
   return coalesce ? `COALESCE(${inner}, 0)::int` : `${inner}::int`;
 };
 
+// Quality-graded row predicate (task 1002652). Two task_grades shapes carry
+// score 0 / passed=false that are NOT quality verdicts and must never enter an
+// aggregate: a grader OUTAGE (#943 — signals.panel_outcome='unavailable',
+// rubric axes json-null) and a panel row whose gating axis
+// (functional_fidelity / code_quality) is json-null (an errored worker, not a
+// judged 0). jsonb_typeof + COALESCE keep legacy rows counted (missing keys /
+// SQL-NULL rubric_scores → typeof NULL → '' ≠ 'null') and keep the predicate
+// NULL-safe under NOT (a bare NULL operand would drop rows from the
+// n_unavailable bucket).
+
+const gradeQualityWhere = (alias = '') => {
+  const a = alias ? `${alias}.` : '';
+  return `(COALESCE(${a}signals->>'panel_outcome','') <> 'unavailable'
+           AND COALESCE(jsonb_typeof(${a}rubric_scores->'functional_fidelity'),'') <> 'null'
+           AND COALESCE(jsonb_typeof(${a}rubric_scores->'code_quality'),'') <> 'null')`;
+};
+
 // The shared `bounds`/`days` DAY_SERIES_CTE for the costSummary day-series
 // queries moved with costSummary into modules/economy/cost.js (BV1.R77 / ADR
 // 0093 §§1-2) — its only two callers left the monolith.
@@ -4856,9 +4875,13 @@ async function recentShippedTasksByBuilder(builderId, limit = 10) {
 // this is safe to call freely.
 
 async function recentGradesForBuilder(builderId, limit = 5) {
+  // panel_outcome rides along so consumers can LABEL an outage row ("not
+  // graded") instead of rendering its placeholder 0.0 as a fail (task 1002652).
+  // A list read stays unfiltered — honesty here means labeling, not hiding.
   const { rows } = await pool.query(
     `SELECT g.task_id, g.score, g.passed, g.threshold, g.graded_at,
             g.grader_kind, g.grader_version, g.rubric_scores,
+            g.signals->>'panel_outcome' AS panel_outcome,
             COALESCE(g.signals->'issues', '[]'::jsonb) AS issues,
             COALESCE((g.signals->>'confidence')::numeric, NULL) AS confidence,
             t.title, t.kind, t.discipline
@@ -4876,33 +4899,43 @@ async function recentGradesForBuilder(builderId, limit = 5) {
 // public status tile + leaderboard hover.
 
 async function rollingAvgGrade(days = 7) {
+  // Quality stats aggregate ONLY quality-graded rows; outage / null-axis rows
+  // are counted apart as n_unavailable (task 1002652 — 21 outage rows once
+  // read as a month of pass_rate 0.000).
+  const q = gradeQualityWhere();
   const { rows } = await pool.query(
     `SELECT
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(score), 0)::numeric(3,1)                    AS avg_score,
-       ${gradePassCount('passed')} AS n_passed,
-       COALESCE(MIN(score), 0)::numeric(3,1)                    AS min_score,
-       COALESCE(MAX(score), 0)::numeric(3,1)                    AS max_score
+       COUNT(*) FILTER (WHERE ${q})::int                         AS n,
+       COALESCE(AVG(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       ${gradePassCount('passed', { where: q })} AS n_passed,
+       COALESCE(MIN(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS min_score,
+       COALESCE(MAX(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS max_score,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                     AS n_unavailable
        FROM task_grades
       WHERE graded_at >= now() - ($1 || ' days')::interval`,
     [String(days)]
   );
-  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, min_score: 0, max_score: 0 };
+  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, min_score: 0, max_score: 0, n_unavailable: 0 };
 }
 
 // Per-builder rolling avg, last `days` days. Powers the /builders profile.
 
 async function gradeByBuilder(days = 30) {
+  // pass_rate is NULL (not 0.000) for a builder whose window holds only
+  // outage / null-axis rows — "no graded work", never a fabricated fail-streak
+  // (task 1002652). fmtPct-style consumers already render null as '—'.
+  const q = gradeQualityWhere('g');
   const { rows } = await pool.query(
     `SELECT
        t.shipped_by                                             AS builder_id,
        b.github_login,
        b.display_name,
        b.avatar_url,
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(g.score), 0)::numeric(3,1)                  AS avg_score,
-       ${gradePassCount('g.passed')} AS n_passed,
-       ROUND(COALESCE(AVG(CASE WHEN g.passed THEN 1 ELSE 0 END), 0), 3) AS pass_rate,
+       COUNT(*) FILTER (WHERE ${q})::int                        AS n,
+       COALESCE(AVG(g.score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       ${gradePassCount('g.passed', { where: q })} AS n_passed,
+       ROUND(AVG(CASE WHEN g.passed THEN 1 ELSE 0 END) FILTER (WHERE ${q}), 3) AS pass_rate,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                    AS n_unavailable,
        MAX(g.graded_at)                                         AS last_graded_at
        FROM task_grades g
        JOIN tasks t    ON t.id = g.task_id
@@ -4920,12 +4953,17 @@ async function gradeByBuilder(days = 30) {
 // chart on status.amazonprimea.com.
 
 async function gradeTrendByDay(days = 30) {
+  // A day whose rows are all outages keeps its row (n=0, avg_score NULL,
+  // n_unavailable>0) so a chart can show "grader down", never a 0.0-score day
+  // (task 1002652 — the 2026-07-12..19 zero-score week was five outage days).
+  const q = gradeQualityWhere();
   const { rows } = await pool.query(
     `SELECT
        to_char(date_trunc('day', graded_at), 'YYYY-MM-DD') AS day,
-       COUNT(*)::int AS n,
-       AVG(score)::numeric(3,1) AS avg_score,
-       ${gradePassCount('passed', { coalesce: false })} AS n_passed
+       COUNT(*) FILTER (WHERE ${q})::int AS n,
+       AVG(score) FILTER (WHERE ${q})::numeric(3,1) AS avg_score,
+       ${gradePassCount('passed', { where: q })} AS n_passed,
+       COUNT(*) FILTER (WHERE NOT ${q})::int AS n_unavailable
        FROM task_grades
       WHERE graded_at >= now() - ($1 || ' days')::interval
       GROUP BY date_trunc('day', graded_at)
@@ -4989,11 +5027,14 @@ async function builderAnalytics(builderId, days = 90) {
         [builderId, d]
       ),
       // Grade pass-rate per day (quality holding up as throughput rises?).
+      // Quality-graded rows only — outage / null-axis rows would read as
+      // fail-days (task 1002652); headline.grade_pass_rate derives from these
+      // rows so it inherits the same honesty.
       pool.query(
         `SELECT to_char(date_trunc('day', g.graded_at), 'YYYY-MM-DD') AS day,
-                COUNT(*)::int AS n,
-                ${gradePassCount('g.passed', { coalesce: false })} AS n_passed,
-                AVG(g.score)::numeric(3,1) AS avg_score
+                COUNT(*) FILTER (WHERE ${gradeQualityWhere('g')})::int AS n,
+                ${gradePassCount('g.passed', { where: gradeQualityWhere('g') })} AS n_passed,
+                AVG(g.score) FILTER (WHERE ${gradeQualityWhere('g')})::numeric(3,1) AS avg_score
            FROM task_grades g
            JOIN tasks t ON t.id = g.task_id
           WHERE t.shipped_by = $1
@@ -5457,6 +5498,7 @@ module.exports = {
   rollingAvgGrade,
   gradeByBuilder,
   gradeTrendByDay,
+  gradeQualityWhere, // exported for tests/grade_aggregates_unavailable.mjs (task 1002652)
   builderAnalytics,
   ecosystemAnalytics,
   createOverrideRequest,

package/modules/lifecycle/routes/tasks.js

@@ -1431,8 +1431,10 @@ module.exports = function buildTasksRouter() {
     // forged {ff:10,cq:10,issues:[]} to self-pass. serverSideGuards re-runs the
     // two DETERMINISTIC pre-passes here (route-rank against the server's own
     // route files; permission-path against the caller's LIVE, authoritative
-    // rank — req.builder.rank, read fresh from the DB per request), rejects an
-    // implausible empty-issues PASS on a non-trivial diff, and neutralizes an
+    // rank — req.builder.rank, read fresh from the DB per request), fails a
+    // sub-floor PASS that submitted NO committed_files closed (the check is
+    // unprovable on an empty list — task 1002646 / report 1000021 G-1), rejects
+    // an implausible empty-issues PASS on a non-trivial diff, and neutralizes an
     // obviously-forged net-negative credit signal (SR-18). It is DOWNGRADE-ONLY:
     // it can flip a client PASS to a hard FAIL or manual-confirm, but never
     // upgrades a fail and never relaxes the existing gate — so a legitimate

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.25",
+  "version": "1.19.27",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.25",
+      "version": "1.19.27",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.25",
+  "version": "1.19.27",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -477,8 +477,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.23 with no explicit bump. run 31450459825. (task 1002620)
 //   1.19.25 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.24 with no explicit bump. run 31495418623. (task 1002620)
+//   1.19.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
+//   1.19.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.25'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.27'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_aggregates_unavailable.mjs

@@ -0,0 +1,114 @@
+// tests/grade_aggregates_unavailable.mjs
+//
+// Unit tests for task 1002652 — a grader OUTAGE row (#943: score 0, passed
+// false, signals.panel_outcome='unavailable', rubric axes json-null) and a
+// null-gating-axis panel row must never enter a quality aggregate. 21 outage
+// rows once read as a month of pass_rate 0.000 on /public/grades and the hall.
+//
+// The SQL itself runs against live Postgres in production; here we pin the
+// QUERY CONTRACT the same way the other pool.query readers are pinned (see
+// versions_route.mjs note): pool.query is stubbed to capture SQL, and each
+// aggregate's captured text must carry the quality predicate + the
+// n_unavailable bucket. gradeQualityWhere's NULL-safety (COALESCE around every
+// operand) is what keeps legacy rows counted AND the NOT-bucket total — a bare
+// NULL operand under NOT would silently drop rows from both buckets.
+//
+// Run:  node tests/grade_aggregates_unavailable.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { pool } = require('../src/bongos/pool.js');
+const db = require('../modules/lifecycle/db.js');
+const gradingDb = require('../modules/grading/db.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// Capture every SQL text pool.query sees while `fn` runs; always restore.
+async function captureSql(fn) {
+  const captured = [];
+  const orig = pool.query;
+  pool.query = async (sql) => { captured.push(String(sql)); return { rows: [] }; };
+  try { await fn(); } finally { pool.query = orig; }
+  return captured;
+}
+
+const PREDICATE_MARKS = [
+  "panel_outcome", "'unavailable'",
+  "jsonb_typeof", "functional_fidelity", "code_quality",
+];
+
+function assertQualityFiltered(sql, label) {
+  for (const mark of PREDICATE_MARKS) {
+    assert.ok(sql.includes(mark), `${label}: SQL must carry quality-predicate mark "${mark}"`);
+  }
+  assert.ok(sql.includes('FILTER (WHERE'), `${label}: aggregates must FILTER on the predicate`);
+  assert.ok(sql.includes('n_unavailable'), `${label}: must bucket excluded rows as n_unavailable`);
+  // NULL-safety: every jsonb_typeof operand must be COALESCE-wrapped, or NOT
+  // (predicate) goes NULL on legacy rows and drops them from n_unavailable.
+  const typeofCount = (sql.match(/jsonb_typeof/g) || []).length;
+  const guardedCount = (sql.match(/COALESCE\(jsonb_typeof/g) || []).length;
+  assert.equal(guardedCount, typeofCount, `${label}: every jsonb_typeof must be COALESCE-guarded`);
+}
+
+await test('gradeQualityWhere: parenthesized, alias-qualified, NULL-safe on all three operands', () => {
+  const bare = db.gradeQualityWhere();
+  const aliased = db.gradeQualityWhere('g');
+  assert.ok(bare.startsWith('(') && bare.trimEnd().endsWith(')'), 'must parenthesize (composes under NOT/AND)');
+  assert.ok(aliased.includes('g.signals') && aliased.includes('g.rubric_scores'), 'alias must qualify both columns');
+  assert.ok(!bare.includes('g.'), 'bare form must not smuggle an alias');
+  assert.ok(bare.includes("COALESCE(") && bare.includes("panel_outcome"), 'panel_outcome operand must be COALESCE-guarded');
+  assert.equal((bare.match(/COALESCE\(jsonb_typeof/g) || []).length, 2, 'both rubric axes COALESCE-guarded');
+});
+
+await test('rollingAvgGrade excludes outage/null-axis rows and buckets n_unavailable', async () => {
+  const sql = (await captureSql(() => db.rollingAvgGrade(7)))[0];
+  assertQualityFiltered(sql, 'rollingAvgGrade');
+});
+
+await test('gradeByBuilder: quality-filtered, and pass_rate is NULL (not 0.000) with no quality rows', async () => {
+  const sql = (await captureSql(() => db.gradeByBuilder(30)))[0];
+  assertQualityFiltered(sql, 'gradeByBuilder');
+  // The old shape ROUND(COALESCE(AVG(...),0),3) fabricated a 0.000 fail-streak
+  // for an all-outage window — the lars589 symptom. COALESCE must be gone from
+  // the pass_rate expression so it reads NULL ("no graded work") instead.
+  assert.ok(!sql.includes('ROUND(COALESCE(AVG'), 'pass_rate must not coalesce an empty window to 0');
+  assert.ok(/AVG\(CASE WHEN g\.passed THEN 1 ELSE 0 END\) FILTER/.test(sql), 'pass_rate must average quality rows only');
+});
+
+await test('gradeTrendByDay keeps outage-only days as n=0 + n_unavailable, never a 0.0-score day', async () => {
+  const sql = (await captureSql(() => db.gradeTrendByDay(30)))[0];
+  assertQualityFiltered(sql, 'gradeTrendByDay');
+  assert.ok(!/WHERE[^G]*unavailable[^G]*GROUP BY/s.test(sql.replace(/FILTER \(WHERE[^)]+\)+/g, '')),
+    'exclusion must be FILTER-based (top-level WHERE would drop outage-only days from the series)');
+});
+
+await test('recentGradesForBuilder labels rather than hides: selects panel_outcome, no FILTER', async () => {
+  const sql = (await captureSql(() => db.recentGradesForBuilder(1, 5)))[0];
+  assert.ok(sql.includes("signals->>'panel_outcome'"), 'must select panel_outcome for display labeling');
+  assert.ok(!sql.includes('FILTER (WHERE'), 'the list read stays unfiltered — labeling, not hiding');
+});
+
+await test('builderAnalytics grade-trend query is quality-filtered (feeds headline.grade_pass_rate)', async () => {
+  const sqls = await captureSql(() => db.builderAnalytics(1, 90));
+  const gradeSql = sqls.find((s) => s.includes('task_grades') && s.includes('graded_at'));
+  assert.ok(gradeSql, 'builderAnalytics must query task_grades');
+  for (const mark of PREDICATE_MARKS) {
+    assert.ok(gradeSql.includes(mark), `builderAnalytics grade query must carry "${mark}"`);
+  }
+  assert.ok(gradeSql.includes('FILTER (WHERE'), 'builderAnalytics grade query must FILTER');
+});
+
+await test('grading/db builderRollingAvgGrade (the documented twin) carries the same predicate', async () => {
+  const sql = (await captureSql(() => gradingDb.builderRollingAvgGrade(1, 14)))[0];
+  assertQualityFiltered(sql, 'builderRollingAvgGrade');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/grade_server_authoritative.mjs

@@ -141,6 +141,93 @@ await test('route-rank hard-fail (forged routes dir) flips a client PASS to FAIL
   }
 });
 
+// ========================================================================
+// Guard 1b — vacuous permission-path input fails CLOSED (task 1002646 /
+// report 1000021 G-1). The pre-pass pairs the server-known rank with
+// CLIENT-supplied committed_files, so omitting the list (or sending []) made
+// the sub-floor protected-path check pass vacuously — the exact bypass the
+// report demonstrated. A sub-floor caller submitting NO file list now fails
+// closed; honest ships always send the real list (task 878).
+// ========================================================================
+
+const ppc = require('../src/bongos/permission-path-check.js');
+const REGISTRY_FLOOR = Object.keys(ppc.RANK_TIER).find((r) => ppc.RANK_TIER[r] === ppc.MIN_TIER);
+
+await test('1002646 sub-floor PASS with committed_files ABSENT → hard FAIL (omission no longer bypasses the floor)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'omitting committed_files must not make the protected-path floor vacuous');
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.equal(g.signals.confidence, 0, 'fail forwards confidence 0 so the server gate also fails');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+  assert.ok(g.issues.some((i) => i.worker === 'server-permission-path'));
+  assert.equal(g.signals.server_guard.authorization_refusal, true,
+    'the unprovable trip is the same rank wall as permission_path — not a quality verdict (task 1002614 shape)');
+});
+
+await test('1002646 sub-floor PASS with committed_files [] → hard FAIL (empty list is the same omission)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: [], builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false);
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 whitespace-only entries do not count as a submitted list → hard FAIL', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: ['   ', ''], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'padding the list with blanks is still an empty list');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 the refusal names the registry-resolved floor + the remedy (wave-5 speech standard)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  const trip = g.signals.server_guard.tripped.find((t) => t.guard === 'permission_path_unprovable');
+  assert.ok(trip, 'the guard must be recorded');
+  assert.ok(trip.summary.includes(`'${REGISTRY_FLOOR}'`),
+    'the floor name comes from the registry at runtime, never a hardcoded rank string (D-16/N-3)');
+  assert.match(trip.summary, /re-run the ship/i, 'carries the remedy');
+  assert.match(trip.summary, /\/tasks\/:id\/confirm/, 'names the file-less-change exit too');
+});
+
+await test('1002646 a floor-clearing rank with an absent list is NOT blocked (guard scoped to the floor)', () => {
+  const g = grader.serverSideGuards(clientGrade(), {
+    committedFiles: null, builderRank: 'metic',
+    diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+  });
+  assert.equal(g.passed, true, 'the floor does not apply to metic+ — no new refusal for them (ADR 0162)');
+  assert.equal(g.signals.server_guard.ok, true);
+});
+
+await test('1002646 an honest sub-floor ship with a real, unprotected list still passes (no new gate on honest work)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'docs/notes.md', summary: 'x' }] }),
+    { committedFiles: ['docs/notes.md'], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 5, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, true,
+    'a real submitted list keeps working; the dishonest-LIST residual is owned by gate-review CI + the post-push main audit');
+});
+
+await test('1002646 downgrade-only: a sub-floor client FAIL with an absent list stays FAIL (no behavior change)', () => {
+  const failGrade = grader.validateAndScore(
+    { functional_fidelity: 3, code_quality: 3, confidence: 1, issues: [{ severity: 'blocker', file: 'a', summary: 'broken' }] },
+    {}
+  );
+  const g = grader.serverSideGuards(failGrade, {
+    committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 1, lines_removed: 1 },
+  });
+  assert.equal(g.passed, false, 'still failed — the guard only ever downgrades');
+});
+
 // ========================================================================
 // Guard 2 — implausible empty-issues PASS on a non-trivial diff → manual-confirm.
 // ========================================================================