@bongos/core 1.19.28 → 1.19.29

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.28",
-  "core_contract": "1.19.28",
-  "source_commit": "10e31a3212982a5385e83bec33a5ba12b733929f",
+  "core_version": "1.19.29",
+  "core_contract": "1.19.29",
+  "source_commit": "653afa8efb0b5167d51ed1510c45977a56a575dd",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T14:01:24.503Z",
+  "built_at": "2026-08-11T14:19:03.503Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1511,
-  "tree_sha256": "e1dee62e1e6e30b75671474f69e5e6b97f0ea598c9a66b5ad49867906f85e51d",
+  "tree_sha256": "0076ae91d3bb7f715ca250d05367d1eae9a660b5c015b88c0a6687d7a01a9794",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "bc2b580d2be98f5b2acb9a0dd9416dd3c2cad387bbe61a6823e37102d3468675"
+      "sha256": "3461862dc1af26875958697291128fbf4d914fff9b00b7920e5f25dae73f6ba4"
     },
     {
       "path": "modules/grading/module.json",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8ecf54691f56a0579f3d732323aebbe9620b3b46fa6f8711a959f20dac1cffaa"
+      "sha256": "7a14171b353dbfb6da83df462c031ecce9d4c97b085504845035072e5e97bbfa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d7dcf7da61008463a0e5ddb5da440f85bd845a2a0ea8d8125c2684dad24cdac6"
+      "sha256": "3ff6057a4a6120421ce79d9593bdf54e424fdd143bd0a20fc616ba92582ee910"
     },
     {
       "path": "public-docs/index.html",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b97afd8c79d048c057170fb03010be8d89f051cc8d4c43a2ecb85343785fe194"
+      "sha256": "576d6afdcdf097366f36831d4b56ba300f71beefdc29c853605f9c0788cd260c"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6597,7 +6597,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "380ef7c395dea5ba988a1b0f9492451c621ebc01ba5e04c2674ebb54fe32cddd"
+      "sha256": "4832bcffc7385cdd8deb0c1ff9bb44542190a3da106d2f00ccacd823c90103ec"
     },
     {
       "path": "tests/grader_bypass.mjs",

package/modules/grading/grader.js

@@ -365,6 +365,19 @@ function isNum(n) {
   return Number.isFinite(n);
 }
 
+// #1002653 corroboration helpers for validateAndScore's null-ff lens branch.
+// A worker entry is untrusted input — w.issues may be any shape. Absent issues
+// on an errored worker is the normal outage shape (treated as none); a truthy
+// NON-ARRAY issues is malformed and must DISQUALIFY corroboration (fail-closed
+// schema_error downstream), never TypeError into a 500 on grade submission.
+const isNarcErroredClean = (w) => {
+  if (!w || w.kind !== 'narc' || !w.error) return false;
+  const issues = w.issues == null ? [] : w.issues;
+  if (!Array.isArray(issues)) return false;
+  return !issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+};
+const isNarcHealthy = (w) => !!w && w.kind === 'narc' && !w.error;
+
 // Validates ONE shot's subagent JSON and produces a per-shot grade-result.
 // Never throws — malformed inputs produce a passed=false result with notes_md.
 // The downstream aggregateShots collapses N of these into a final verdict.
@@ -394,7 +407,25 @@ function validateAndScore(rawSubagent, meta = {}) {
     };
   }
 
-  const ff = Number(parsed.functional_fidelity);
+  // #1002653: Number(null) === 0, so an errored ADVISORY Narc forwarding an
+  // EXPLICIT ff:null fabricated "FAIL — functional_fidelity below 6" at
+  // (0+cq)/2. Explicit null = the lens did not run (the #395 confidence
+  // precedent): gate/score on the axes that ran. A bare null is NOT enough —
+  // a prompt-injected Narc emitting null must stay fail-closed — so the branch
+  // needs POSITIVE corroboration: workers[] carries an errored
+  // no-substantive-finding Narc (#473 missing-signal semantics) and no healthy
+  // Narc. Empty/narc-less/absent workers, ABSENT ff, and every other shape
+  // fall through to the fail-closed schema_error below. Quality has no such
+  // branch — gating lens, absence stays fail-closed.
+  // Trust note: workers[] is client-supplied like every SR-9 grade input — a
+  // forger gains nothing here they cannot get by sending ff:9 directly; the
+  // server-derivable-signals redesign is tracked separately (SR-9 residual).
+  const metaWorkers = Array.isArray(meta.workers) ? meta.workers : null;
+  const narcMissingSignal = !!metaWorkers &&
+    metaWorkers.some(isNarcErroredClean) && !metaWorkers.some(isNarcHealthy);
+  const ffExplicitNull = parsed.functional_fidelity === null;
+  const ffLensUnavailable = ffExplicitNull && narcMissingSignal;
+  const ff = ffExplicitNull ? null : Number(parsed.functional_fidelity);
   const cq = Number(parsed.code_quality);
   const economyRaw = Number(parsed.economy);
   const economy =
@@ -427,8 +458,9 @@ function validateAndScore(rawSubagent, meta = {}) {
 
   signals.confidence = confidence;
   signals.issue_count = issues.length;
+  if (ffLensUnavailable) signals.ff_lens_unavailable = true;
 
-  if (!isNum(ff) || !isNum(cq) || ff < 0 || ff > 10 || cq < 0 || cq > 10) {
+  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || !isNum(cq) || cq < 0 || cq > 10) {
     return {
       score: 0,
       passed: false,
@@ -437,12 +469,15 @@ function validateAndScore(rawSubagent, meta = {}) {
       grader_version: VERSION,
       rubric_scores: {},
       signals: { ...signals, schema_error: true },
-      notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`,
+      notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`
+        + (ffExplicitNull && !narcMissingSignal
+          ? ' Explicit null functional_fidelity without a corroborated Narc outage in signals.workers is fail-closed.'
+          : ''),
       issues,
     };
   }
 
-  const ffR = r1(clamp(ff, 0, 10));
+  const ffR = ffLensUnavailable ? null : r1(clamp(ff, 0, 10));
   const cqR = r1(clamp(cq, 0, 10));
   const economyR = economy != null ? r1(clamp(economy, 0, 10)) : null;
   const securityR = securityScore != null ? r1(clamp(securityScore, 0, 10)) : null;
@@ -450,7 +485,9 @@ function validateAndScore(rawSubagent, meta = {}) {
   const economyPenalty =
     economyR != null ? Math.max(0, (THRESHOLD - economyR) / 2) : 0;
   const cqEffective = economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
-  const blended = r1((ffR + cqR) / 2);
+  // With the ff lens out, the score reflects only the axis that ran — never a
+  // blend with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold.
+  const blended = ffLensUnavailable ? cqR : r1((ffR + cqR) / 2);
 
   // confidence must be present (not null) for a PASS. A subagent that omits
   // confidence entirely silently bypassed the low-confidence gate under the
@@ -461,7 +498,11 @@ function validateAndScore(rawSubagent, meta = {}) {
   // so aggregateShots can never reach unanimousPASS with a null confidenceMedian.
   const confidenceAbsent = confidence === null;
   const lowConfidence = !confidenceAbsent && confidence < LOW_CONFIDENCE;
-  const bothPass = ffR >= THRESHOLD && cqR >= THRESHOLD;
+  // ffR is null when the lens is unavailable — it must not fail the gate
+  // (null < THRESHOLD is true via JS coercion), and must not appear in the
+  // verdict's below-threshold branches.
+  const ffBelow = !ffLensUnavailable && ffR < THRESHOLD;
+  const bothPass = !ffBelow && cqR >= THRESHOLD;
   const passed = bothPass && !lowConfidence && !confidenceAbsent;
 
   const verdict = passed
@@ -472,15 +513,15 @@ function validateAndScore(rawSubagent, meta = {}) {
         ? 'FAIL — low confidence'
         : bothPass
           ? 'FAIL'
-          : ffR < THRESHOLD && cqR < THRESHOLD
+          : ffBelow && cqR < THRESHOLD
             ? `FAIL — both axes below ${THRESHOLD}`
-            : ffR < THRESHOLD
+            : ffBelow
               ? `FAIL — functional_fidelity below ${THRESHOLD}`
               : `FAIL — code_quality below ${THRESHOLD}`;
 
   const notesLines = [];
   notesLines.push(`Shot ${signals.shot_index != null ? signals.shot_index : '?'} (${signals.model}) — ${verdict}`);
-  notesLines.push(`  ff=${ffR}/10  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
+  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
   if (notesFromSubagent) {
     notesLines.push('');
     notesLines.push(notesFromSubagent.trim());

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.28",
+  "version": "1.19.29",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.28",
+      "version": "1.19.29",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.28",
+  "version": "1.19.29",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -483,8 +483,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
 //   1.19.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.27 with no explicit bump. run 31499228797. (task 1002620)
+//   1.19.29 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.28 with no explicit bump. run 31500810303. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.28'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.29'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -415,6 +415,165 @@ test('#489 validateAndScore: explicit null confidence → FAIL (same as absent)'
   assert.match(r.notes_md, /confidence absent/i);
 });
 
+// Task 1002653: an errored ADVISORY Narc forwards an EXPLICIT
+// functional_fidelity: null on an otherwise-passing panel (advisory since
+// #481). Number(null) === 0 used to fabricate "FAIL — functional_fidelity
+// below 6" at (0+cq)/2. Explicit null = the ff lens did not run: gate + score
+// on the axes that DID run — but ONLY when signals.workers corroborates the
+// Narc as missing-signal (errored, no substantive finding). A bare null with a
+// healthy Narc (the prompt-injection shape this ship's own Hacker flagged), an
+// ABSENT ff, or no workers signal at all stays fail-closed.
+const NARC_ERRORED_META = {
+  workers: [
+    { kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: [] },
+    { kind: 'quality', verdict: 'pass', scores: { code_quality: 8 }, issues: [] },
+  ],
+};
+
+test('#1002653 validateAndScore: null ff + corroborated Narc outage + passing cq → PASS on the axes that ran', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: 'narc errored; quality passed',
+    confidence: 0.8,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, true);
+  assert.equal(r.score, 8); // cq only — never blended with a synthetic 0
+  assert.equal(r.rubric_scores.functional_fidelity, null);
+  assert.equal(r.signals.ff_lens_unavailable, true);
+  assert.match(r.notes_md, /lens unavailable/);
+  assert.doesNotMatch(r.notes_md, /functional_fidelity below/);
+});
+
+test('#1002653 validateAndScore: null ff with a HEALTHY Narc in signals → fail-closed (injection shape)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, { workers: [
+    { kind: 'narc', verdict: 'pass', scores: { functional_fidelity: null }, issues: [] },
+    { kind: 'quality', verdict: 'pass', scores: { code_quality: 9 }, issues: [] },
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+  assert.match(r.notes_md, /without a corroborated Narc outage/);
+});
+
+test('#1002653 validateAndScore: null ff with NO workers signal at all → fail-closed', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff with EMPTY workers array → fail-closed (no vacuous truth)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff with a narc-less workers array → fail-closed (positive corroboration only)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [{ kind: 'quality', verdict: 'pass', scores: { code_quality: 8 }, issues: [] }] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: malformed issues shape on the errored narc → fail-closed, no throw', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [{ kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: 'none' }] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: an errored narc alongside a HEALTHY narc does not excuse null ff', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [
+    { kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: [] },
+    { kind: 'narc', verdict: 'pass', scores: { functional_fidelity: 8 }, issues: [] },
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff does NOT rescue a failing cq (verdict names cq alone)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 4,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [{ severity: 'major', file: 'x.js', summary: 'real problem' }],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /code_quality below/);
+  assert.doesNotMatch(r.notes_md, /both axes below/);
+});
+
+test('#1002653 validateAndScore: ABSENT ff stays a schema_error FAIL (omission cannot dodge the gate)', () => {
+  const r = grader.validateAndScore({
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: a judged ff of 0 is still a real FAIL (only corroborated null is a lens outage)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 0,
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /functional_fidelity below/);
+  assert.notEqual(r.signals.ff_lens_unavailable, true);
+});
+
+test('#1002653 validateAndScore: null ff + null confidence still FAILs on confidence', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 9,
+    notes_md: '',
+    confidence: null,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /confidence absent/i);
+});
+
 // #489 aggregateShots safety: a unanimousPASS result can never produce a null
 // confidenceMedian, because any shot that passes must now have non-null confidence.
 test('#489 aggregateShots unanimousPASS always has non-null median confidence', () => {