@bongos/core 1.19.26 → 1.19.27

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.26",
-  "core_contract": "1.19.26",
-  "source_commit": "522fdcf67202b1961ce21cc5bb1e9e21f3455105",
+  "core_version": "1.19.27",
+  "core_contract": "1.19.27",
+  "source_commit": "a8f09266a4b9cdbdf70ea92de3c2a26553aacab2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T13:25:13.567Z",
+  "built_at": "2026-08-11T13:38:48.421Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1511,
-  "tree_sha256": "ecaa7b2c50ea700a1da02925b30bc638ccef3e362d27f47a50c59957afc232be",
+  "tree_sha256": "b85699092f300b5bab1ab32e95763e4f032d2ee8f688466f4c4dc939048174bd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "a08e9c017a07bffa311a9de6df007c30d9f3766c86d0ce2ec88660fed60d37aa"
+      "sha256": "bc2b580d2be98f5b2acb9a0dd9416dd3c2cad387bbe61a6823e37102d3468675"
     },
     {
       "path": "modules/grading/module.json",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "f5041a43ea0a74bc6b16f8ceb6490c70090e7959e66f137c92040ee842db1ec0"
+      "sha256": "aa179ab79508a002e8f580fb839767d8aaa8b6f02a46d021bb61633dd9f8f9a4"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "08c0827545637895b730387d92d4a0ce7fef7b055a966cb88ab70e6be901880c"
+      "sha256": "a32cc5b3e33b39013ebe6508049b2ce0dac4c6ac8edce2adf396af265a0c4df8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1ac1c894e7f11d5502855775e3f2ca37031927a68ec7e8dca447661b872467e5"
+      "sha256": "aea4f2f3266f8107e00346fb410bb214997bc0cda76e7ecba36b7f2210b9b661"
     },
     {
       "path": "public-docs/index.html",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "39b05d86d4fbb1035769ff0c30a97b21c75eea8ee145a25784789d17fb20aa38"
+      "sha256": "f75a298d5c776e9bb7ba33c75061ca193c73b0004eea7c0f6706f02b8daad0f0"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6587,7 +6587,7 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "c650bd3c79d469f3ffb1cdada6f23521dd09c97844affd5b9e7f340d1796daa6"
+      "sha256": "b0af74bc3b3e203716b13fbf3fc174a90f51daf659d5c5e5400725e85a0da4fc"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",

package/modules/grading/grader.js

@@ -645,6 +645,37 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
     if (clientPassed) downgradeTo = 'fail';
   }
 
+  // --- Guard 1b: vacuous permission-path input (task 1002646 / report 1000021 G-1) ---
+  // The pre-pass above pairs the SERVER-known rank with CLIENT-supplied
+  // committed_files, so omitting the list (or sending []) made the sub-floor
+  // protected-path check pass VACUOUSLY — zero files, zero hits, hardFail:false —
+  // a trusted-rank check applied to an untrusted, omittable diff. The server
+  // still cannot re-derive the feature-branch diff at grade time (boundary note
+  // above; the task-1002645 published tip is recorded at ci-land, AFTER the
+  // grade), but it can refuse to treat "no input" as "no hits": a caller below
+  // the registry's lowest floor submitting NO file list makes the check
+  // UNPROVABLE → fail closed. Honest ships are unaffected (ship.js always sends
+  // the real committed list — task 878 — and a floor-clearing rank never enters
+  // this branch). The dishonest-LIST case (a sub-floor caller sending an
+  // innocuous list while touching protected paths) stays owned by gate-review CI
+  // + the post-push main audit, which read the REAL diff. Unknown rank keeps
+  // failing open at this layer (isBelowFloor → false) — the main audit reads the
+  // real author rank from the DB and owns that case, exactly as for the pre-pass.
+  const submittedFileCount = Array.isArray(committedFiles)
+    ? committedFiles.filter((f) => typeof f === 'string' && f.trim()).length
+    : 0;
+  if (permissionPathCheck.isBelowFloor(builderRank) && submittedFileCount === 0) {
+    // Resolve the floor label from the registry at runtime (the D-16/N-3
+    // stale-string rule) — never a hardcoded rank name.
+    const floorRank = Object.keys(permissionPathCheck.RANK_TIER)
+      .find((r) => permissionPathCheck.RANK_TIER[r] === permissionPathCheck.MIN_TIER) || 'the floor';
+    guardsTripped.push({ guard: 'permission_path_unprovable', severity: 'blocker',
+      summary: `rank '${builderRank}' is below the protected-path floor ('${floorRank}') and the grade submitted no committed_files — the permission-path check cannot run on an empty list, so a client PASS cannot stand (fail closed; task 1002646 / SR-9). Remedy: re-run the ship — ship.js submits the real committed file list; a genuinely file-less (DB-only) change needs a ${floorRank}+ builder to land it via /tasks/:id/confirm.` });
+    extraIssues.push({ severity: 'blocker', file: '(grade)', summary:
+      `[server permission-path] no committed_files submitted by a rank below the '${floorRank}' floor — the protected-path check is unprovable and fails closed (task 1002646)`, worker: 'server-permission-path' });
+    if (clientPassed) downgradeTo = 'fail';
+  }
+
   // --- Guard 2: implausible client verdict (SR-9) ---
   // A client PASS with an empty issues[] on a non-trivial diff is not a credible
   // default-fail panel verdict. Downgrade to manual-confirm (a human lands it via
@@ -697,7 +728,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       ...base,
       signals: {
         ...(base.signals || {}),
-        server_guard: { applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
+        server_guard: { applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
       },
     };
   }
@@ -729,7 +760,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       // body already ran; this is the authoritative post-hoc adjustment).
       confidence: forwardedConfidence,
       server_guard: {
-        applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'],
+        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
         ok: guardsTripped.length === 0,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,
@@ -739,7 +770,9 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
         // the code. Named here so clients render it as a wall, not a quality
         // FAIL the builder should fix-and-retry (the envelope used to teach
         // exactly that wrong lesson). route_rank stays a code finding.
-        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path'),
+        // task 1002646: permission_path_unprovable is the same wall — the rank
+        // floor refusing an unverifiable diff — so it renders the same way.
+        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path' || g.guard === 'permission_path_unprovable'),
       },
     },
     notes_md: `${base.notes_md || ''}${guardNote}`,

package/modules/lifecycle/routes/tasks.js

@@ -1431,8 +1431,10 @@ module.exports = function buildTasksRouter() {
     // forged {ff:10,cq:10,issues:[]} to self-pass. serverSideGuards re-runs the
     // two DETERMINISTIC pre-passes here (route-rank against the server's own
     // route files; permission-path against the caller's LIVE, authoritative
-    // rank — req.builder.rank, read fresh from the DB per request), rejects an
-    // implausible empty-issues PASS on a non-trivial diff, and neutralizes an
+    // rank — req.builder.rank, read fresh from the DB per request), fails a
+    // sub-floor PASS that submitted NO committed_files closed (the check is
+    // unprovable on an empty list — task 1002646 / report 1000021 G-1), rejects
+    // an implausible empty-issues PASS on a non-trivial diff, and neutralizes an
     // obviously-forged net-negative credit signal (SR-18). It is DOWNGRADE-ONLY:
     // it can flip a client PASS to a hard FAIL or manual-confirm, but never
     // upgrades a fail and never relaxes the existing gate — so a legitimate

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.26",
+  "version": "1.19.27",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.26",
+      "version": "1.19.27",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.26",
+  "version": "1.19.27",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -479,8 +479,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.24 with no explicit bump. run 31495418623. (task 1002620)
 //   1.19.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
+//   1.19.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.26'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.27'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_server_authoritative.mjs

@@ -141,6 +141,93 @@ await test('route-rank hard-fail (forged routes dir) flips a client PASS to FAIL
   }
 });
 
+// ========================================================================
+// Guard 1b — vacuous permission-path input fails CLOSED (task 1002646 /
+// report 1000021 G-1). The pre-pass pairs the server-known rank with
+// CLIENT-supplied committed_files, so omitting the list (or sending []) made
+// the sub-floor protected-path check pass vacuously — the exact bypass the
+// report demonstrated. A sub-floor caller submitting NO file list now fails
+// closed; honest ships always send the real list (task 878).
+// ========================================================================
+
+const ppc = require('../src/bongos/permission-path-check.js');
+const REGISTRY_FLOOR = Object.keys(ppc.RANK_TIER).find((r) => ppc.RANK_TIER[r] === ppc.MIN_TIER);
+
+await test('1002646 sub-floor PASS with committed_files ABSENT → hard FAIL (omission no longer bypasses the floor)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'omitting committed_files must not make the protected-path floor vacuous');
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.equal(g.signals.confidence, 0, 'fail forwards confidence 0 so the server gate also fails');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+  assert.ok(g.issues.some((i) => i.worker === 'server-permission-path'));
+  assert.equal(g.signals.server_guard.authorization_refusal, true,
+    'the unprovable trip is the same rank wall as permission_path — not a quality verdict (task 1002614 shape)');
+});
+
+await test('1002646 sub-floor PASS with committed_files [] → hard FAIL (empty list is the same omission)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: [], builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false);
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 whitespace-only entries do not count as a submitted list → hard FAIL', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: ['   ', ''], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'padding the list with blanks is still an empty list');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 the refusal names the registry-resolved floor + the remedy (wave-5 speech standard)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  const trip = g.signals.server_guard.tripped.find((t) => t.guard === 'permission_path_unprovable');
+  assert.ok(trip, 'the guard must be recorded');
+  assert.ok(trip.summary.includes(`'${REGISTRY_FLOOR}'`),
+    'the floor name comes from the registry at runtime, never a hardcoded rank string (D-16/N-3)');
+  assert.match(trip.summary, /re-run the ship/i, 'carries the remedy');
+  assert.match(trip.summary, /\/tasks\/:id\/confirm/, 'names the file-less-change exit too');
+});
+
+await test('1002646 a floor-clearing rank with an absent list is NOT blocked (guard scoped to the floor)', () => {
+  const g = grader.serverSideGuards(clientGrade(), {
+    committedFiles: null, builderRank: 'metic',
+    diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+  });
+  assert.equal(g.passed, true, 'the floor does not apply to metic+ — no new refusal for them (ADR 0162)');
+  assert.equal(g.signals.server_guard.ok, true);
+});
+
+await test('1002646 an honest sub-floor ship with a real, unprotected list still passes (no new gate on honest work)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'docs/notes.md', summary: 'x' }] }),
+    { committedFiles: ['docs/notes.md'], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 5, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, true,
+    'a real submitted list keeps working; the dishonest-LIST residual is owned by gate-review CI + the post-push main audit');
+});
+
+await test('1002646 downgrade-only: a sub-floor client FAIL with an absent list stays FAIL (no behavior change)', () => {
+  const failGrade = grader.validateAndScore(
+    { functional_fidelity: 3, code_quality: 3, confidence: 1, issues: [{ severity: 'blocker', file: 'a', summary: 'broken' }] },
+    {}
+  );
+  const g = grader.serverSideGuards(failGrade, {
+    committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 1, lines_removed: 1 },
+  });
+  assert.equal(g.passed, false, 'still failed — the guard only ever downgrades');
+});
+
 // ========================================================================
 // Guard 2 — implausible empty-issues PASS on a non-trivial diff → manual-confirm.
 // ========================================================================