@bongos/core 1.19.292 → 1.19.293

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.292",
-  "core_contract": "1.19.292",
-  "source_commit": "57bc876c876c64bf07069a3646e253006a917fc6",
+  "core_version": "1.19.293",
+  "core_contract": "1.19.293",
+  "source_commit": "d37d65e03910c166c3a3af9827ffa2a2d8f8a204",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T15:49:03.336Z",
+  "built_at": "2026-08-22T16:56:18.512Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 320,
+    "docs_redacted": 321,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1391,
+    "functional_verbatim": 1393,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1733,
-  "tree_sha256": "ca47008669375b8c24cbecd5f6142a05b189fce9c02e8c3d2bdc29a2da237f87",
+  "file_count": 1736,
+  "tree_sha256": "a7ed89984671394923e64db2b93e69efd81ef112f856a58f58009bf4bc0c4b1d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1399,20 +1399,25 @@
       "mode": "0000644",
       "sha256": "e7d0245b21406ddcd118dce29ffb1df5a4797e33d66231aa6bc734316c19530f"
     },
+    {
+      "path": "docs/adr/0184-ship-requires-an-assurance.md",
+      "mode": "0000644",
+      "sha256": "d68cae6169d7ef251fdf6c721e63a124bd3bf46979ffa51459db435426d24f8b"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "5e8bcc7eff0a9940760952e4dffe3855474e506439d677625f411164ae226a35"
+      "sha256": "0eafe881d241706331548cf8212c5e84f2f42167c2ac5688427820fa394d77ef"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "2c4a9b56aea5a8e1a42c70ad5c2646c0d6db6d713c13b8d2068bd3a2fa6ac27e"
+      "sha256": "8fb83f272ef8810df2c517d9514495f44016da2e23cdd67937463f40c0d1605d"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "fcb40a7d655517e6dd24b2d4e0e00a9fcace75b2eb0aa89348d2546abf8df422"
+      "sha256": "f51be43a281c9609980fca57d2fa11cafb460a414e506174715d53c08cef6965"
     },
     {
       "path": "docs/architecture.md",
@@ -3777,7 +3782,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "18b2053d9195936be86d98e00812ab69980986f91cf83bc9db054441036192fd"
+      "sha256": "f4d3df748f39109c775ae167712926cd44832aba0651251f508adc4a8d4e57fe"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -3862,7 +3867,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "900fc9ecfe91a0c1e9cd62b619f609c1416196d502c007d0bbb87c41387b6163"
+      "sha256": "8f08c6d58db41ba247aaf5b04b5a8988365b469e96c0ad04c336f272ef308c4e"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3902,13 +3907,18 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "0600b76953e28b2c5828301606c72e2490756d43a2eb74b4bc92dca9d795cb77"
+      "sha256": "3dbbf03588eb70c3d84b1d98f1e7a94a2c7bd0612d4835bd0fe1cc0470b802b4"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
       "sha256": "044ca86e5605c19dd8e523da9eb061b4a90ed0af199ec1288c3c5f1b1bb8f46b"
     },
+    {
+      "path": "modules/lifecycle/ship-assurance.js",
+      "mode": "0000644",
+      "sha256": "2938d8ea651af09b3c73d294057c153ce079170ae34a42e3e94025daab097dcf"
+    },
     {
       "path": "modules/lifecycle/ship-card.js",
       "mode": "0000644",
@@ -4527,12 +4537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "417cc856bf6eca0ed8c214b12624c6bc7567bb96b07a5999ebf5b72ab6b4ca05"
+      "sha256": "090cb33345196e3e3d42d1d6b81a591095b1f3c622becfff8e1eed4ce3f0577f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "06e136123405fad423973fd79250b7baae689b122c0975e41f369ae87cdfe9e9"
+      "sha256": "78db3e19a56e9aa909f0fa6314315c2cec90439bb3cc82111b974937d05f3fb2"
     },
     {
       "path": "public-docs/index.html",
@@ -5732,7 +5742,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "542d36dfe7dd25d20936844b237b6681b1e64d34c66448438cf7ef9d86abb79f"
+      "sha256": "73c2e91340171d6a9112e869552be17e0f82aeb80a5c680205ac452d34c3ddc4"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -6177,7 +6187,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a00525dccc2576669f8793418e40f7232dd2f8662163900142b561ce3c93a2db"
+      "sha256": "d9155f571379dfbb8e352671aad7a062e52027b225fe615d61a18c1452dde5a0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7867,7 +7877,7 @@
     {
       "path": "tests/orphaned_claim_ship.mjs",
       "mode": "0000644",
-      "sha256": "ecc09c00cc35a2a77bb8a2519332ee3da5b8a5ed8e580e5b21eb4ca43f12a10b"
+      "sha256": "a67dd7e828196929e1fdcdc6cf09255aa583c2013b30632ad8eb847cc6ff5d3b"
     },
     {
       "path": "tests/override_attribution.mjs",
@@ -7907,7 +7917,7 @@
     {
       "path": "tests/pay_on_land.mjs",
       "mode": "0000644",
-      "sha256": "f5ff4080073fa5e6b8d764860dc677b6e617b7b055c2233047163e9c0ed66ce9"
+      "sha256": "6c623a5abe9aadf4821ad8ca291fb5d7805a7a5bc874bfc3cd7e51e83de289d2"
     },
     {
       "path": "tests/permission_path.mjs",
@@ -8344,6 +8354,11 @@
       "mode": "0000644",
       "sha256": "57afd052aaf40ac487d53bf6850710e43c79babaeaa1859374fcc5d8200d92c2"
     },
+    {
+      "path": "tests/ship_assurance.mjs",
+      "mode": "0000644",
+      "sha256": "6fc882d215ce78f968b25477db8596ea70a28765fd222b8a9ffca331e7f2827c"
+    },
     {
       "path": "tests/ship_autolinkify.mjs",
       "mode": "0000644",

package/docs/adr/0184-ship-requires-an-assurance.md

@@ -0,0 +1,106 @@
+# 0184 — A ship must account for itself: `shipTask` requires a land proof or a declared no-artifact
+
+- **Status:** Accepted
+- **Date:** 2026-08-19
+- **Tasks:** [#1002483](https://cloudbongos.com/builders#/task/1002483) (goal 1000024, build-pipeline integrity). Carried forward from blocker 1000047
+- **Extends:** [ADR 0120](<redacted>.md) — pay on land. This makes "land" checkable at the write.
+- **Related:** ADR 0055 (server-mediated publish), 0137 (land → release → deploy are three gates), 0082 (generated-file conflict resolver); tasks 1313 / 1547 / 1002615 / 1002724 (the per-task land proof), [#1002478](https://cloudbongos.com/builders#/task/1002478) (the no-artifact dead end)
+
+## Context
+
+`db.shipTask` is the confirmed→shipped flip. Since ADR 0120 it is also **where the credit is booked**.
+Its only precondition was:
+
+```sql
+UPDATE tasks SET status = 'shipped' … WHERE id = $1 AND status = 'confirmed'
+```
+
+Nothing about whether any code reached `main`.
+
+The two **automated** paths each proved the land before calling it — the reconciler sweep and
+reconcile-on-read both run `landProvenForTask` and refuse without a proof. The **manual** route,
+`POST /tasks/:id/ship`, called `shipTask` with nothing. It is `requireBuilder` +
+`gateTaskOwnership(allowSupervisor: true)`, so a task confirmed with no pushed code could be flipped
+to shipped by its claim holder, or by **any Metic+ running `/merge-mode`**, and it would book its
+`task.shipped` credit.
+
+Blast radius was genuinely small — it takes two deliberate steps, the automated healers refuse, and
+ADR 0120 made strands loud and gated the builder's next claims. That is exactly why it kept being
+deferred. **And why it needed a decision rather than another deferral:** it had resurfaced as a
+blocker repeatedly, and its tracking task ([#1000900](https://cloudbongos.com/builders#/task/1000900))
+was closed in June on a rationale asserting task 1001547 had delivered a confirm-time gate. It had
+not — blocker 1000047's own final update says so explicitly, and the code agreed with the blocker, not
+with the closure note. So the hole was untracked for two months **because a record was wrong**, which
+is the same failure this ADR's gate is about: a ledger entry nobody could check.
+
+## Decision
+
+### 1. The gate lives at the WRITE, not at the route
+
+`shipTask` requires a `landAssurance` and is **fail-closed** — no assurance, no ship, thrown before
+any pool use.
+
+Gating only `POST /tasks/:id/ship` was the cheaper option and was rejected: it leaves the invariant
+unenforced at the layer that actually moves the ledger, so the next caller added anywhere reopens it
+silently. There are three call sites today; the point is that there is no way to add a fourth that
+ships without accounting for it.
+
+### 2. Two kinds, and the second one is why this doesn't make things worse
+
+```
+proof        the caller verified THIS task's own commit is on main
+no_artifact  a deliberate DB-only ship, declared and recorded
+```
+
+A no-artifact ship is an **explicitly supported shape** — CLAUDE.md's "Direct DB writes are work too"
+— and task 1002478 documents that it is already a dead end below Archon. A naive land-proof gate would
+have made that strictly worse, which 1002483 warned about in as many words: *solve them together or
+they will fight.*
+
+Naming `no_artifact` as a **kind** is the resolution. A DB-only ship stops being an absence the gate
+has to be talked out of and becomes a recorded answer: the builder declares it, says what was
+delivered, and the ledger keeps both. That is a small step toward 1002478 rather than away from it.
+
+### 3. Every assurance carries a reason, and the reason is audited
+
+Both kinds require non-empty prose, capped at 500 characters, written to `audit_log` after the
+transaction commits. The ledger should say **why** a ship was allowed, not merely that it happened —
+which is precisely what was missing when this hole went unnoticed.
+
+The audit write is post-commit and best-effort by construction (`insertAuditLog` uses the module pool,
+not the transaction's client). An audit miss must never roll back a landed ship — the same posture
+`src/bongos/middleware/audit.js` already takes.
+
+### 4. The CLI declares its own empty ships
+
+`scripts/gds/ship.js` POSTs `/ship` with an empty body after a `--db-only` / `--allow-empty` land. Left
+alone, this gate would have refused exactly the flow CLAUDE.md calls supported — turning a correctness
+fix into a regression for every builder shipping DB-only work. The deliberate-empty land sites now mark
+themselves, and the CLI sends the declaration.
+
+## Consequences
+
+- **A confirmed-but-unpushed task can no longer be manually shipped or paid.** The refusal names both
+  remedies: push the branch and let the reconciler land it, or declare the no-artifact ship.
+- **The hall's task page ships through the same route** and will now receive a `409
+  ship_land_not_proven` for an unprovable task. That is the correct behaviour — the UI should not be
+  able to phantom-ship either — but its error rendering was not reviewed here and may show the refusal
+  poorly. Worth a look.
+- **`shipTask`'s signature changed.** Three production call sites and four test files were updated. Any
+  out-of-repo caller breaks loudly rather than shipping blind, which is the intended direction.
+- **A STALE `ship.js` against an updated server cannot complete a DB-only ship.** The CLI is what sends
+  the `no_artifact` declaration; an older checkout POSTs an empty body and collects
+  `409 ship_land_not_proven` on a task that has no commit to prove. The refusal names exactly what to
+  send, but the old CLI will not send it, so the remedy is to update the checkout (or re-send by hand).
+  Bounded rather than open-ended — the CLI travels with the core, so on the monolith and on a consumer
+  instance the two move together; the skew window is a builder running a stale clone or dev box. Worth
+  knowing before the first report, because the symptom ("I cannot ship my DB-only task") does not
+  obviously point at a version skew. **Note this affects ONLY no-artifact ships:** a normal ship is
+  proven server-side from git and needs nothing from the CLI.
+- **This does not gate CONFIRM.** A codeless confirm is still accepted; what it can no longer do is
+  reach `shipped` and book a credit. Gating confirm is a separate question — confirm means "verified",
+  not "landed", and conflating them would break the legitimate confirm-then-land sequence.
+- **Rejected — option (c), record the residual as tolerable.** Defensible on blast radius, and it was
+  genuinely close. It lost because the residual had already survived one incorrect closure and several
+  blocker filings; a decision to accept it would have been the fourth record asserting this was
+  handled, with nothing checkable behind it.

package/docs/adr/README.md

@@ -257,5 +257,6 @@ This keeps the decision history honest and traceable.
 | 0181 | [**Teardown accepts every state but `torn_down`, and deliberately keeps the address** ([task 1003042](https://cloudbongos.com/builders#/task/1003042), goal 1000058). Walk finding N5: an instance at `status='error'` could never be removed — the owner's teardown answered 409 `not_teardownable` and the archon `force-teardown`, which exists as the escape hatch, answered the SAME refusal, because both read one hand-kept whitelist `['provisioning','active','tearing_down']` that omitted `requested` and `error`. No role had a path out, so errored rows accumulated permanently (instance 15 `swag` from 2026-08-07). The whitelist justified itself as "nothing running to tear down", which is FALSE for `error`: a provision failing mid-run lands there AFTER it may have created the database, taken a port, and written the systemd unit, Caddy block and DNS record — a partial standup is the thing most in need of reclaiming. `TEARDOWN_FROM` is now DERIVED from `INSTANCE_STATES` minus `torn_down`, so a future state is teardownable by DEFAULT — the bug was an allow-list that silently omitted states, and for a failure mode whose signature is "a row with no exit", the safe default is that an exit exists. The runner needed no change (its steps are each `allowFail`); only the web guard refused. The one surviving refusal is now ONE shared helper: the copies had drifted, and force-teardown's positional `res.fail` form put the bare code `not_teardownable` on the wire as the human text. **The `port` and `domain` are deliberately NOT released** — releasing the port alone would be WORSE than the status quo, because the `<slug>.caddy` block survives teardown and proxies the hostname to a PORT NUMBER, so a later instance given that port would answer at the torn-down project's still-live address (verified live: two projects torn down 2026-08-13 still resolved on 2026-08-19). Holding the port is what keeps the address inert at a harmless 502; releasing both is [task 1002897](https://cloudbongos.com/builders#/task/1002897). Retention is also correct for revive, which re-uses the same hostname. Copy was corrected to match: it had promised "the address stops answering", which was never true.](0181-teardown-state-gate-and-address-retention.md) | provisioning / lifecycle |
 | 0182 | [**Project visibility is TWO axes: a derived publish gate and a stored join door** ([task 1002320](https://cloudbongos.com/builders#/task/1002320), goal 1000046). Goal 1000046 seeded 31 tasks each citing "per R01" — this ADR — so nothing in the goal could start until it landed: it gated **29 open tasks**, the largest single chokepoint in the repo, while itself parked at `backlog` with no dependencies. The spec its planning task cites was never written, so this is the design of record. The goal's criterion says **four** states (Public/Private/Stealth/Unlisted) and R04 says **three** stored plus a derived dark-matter; both are right and conflating them is the trap. There are two INDEPENDENT axes: **publishability** (DERIVED from the identity gate — name + description, per the owner interview) decides whether a project is on the map at all, and **the join door** (STORED `visibility ∈ public|private|stealth`, owner-set) decides how it renders and who gets in. Four user-facing states = 3 × publishable + one derived state that collapses all three. The column name `visibility` is a mild lie kept for consistency with `goals.visibility` (ADR 0112) — it does NOT decide visibility, publishability does — and the ADR is the mitigation. All three stored states are VISIBLE; only the derived state is invisible, which is what makes the 3+1 split honest rather than a workaround. `private` inherits ADR 0112's exact meaning (visible-but-closed); `stealth` exposes EXISTENCE but not IDENTITY, and its redaction is **server-side in the feed** — the naive client-side version leaks to anyone opening the network tab, and the orbs page is a static site OUTSIDE this repo (R09) so it could never be enforced there. Three mechanisms touch "does this appear" and are separated: `status` (operational), `visibility` (owner), `featured` (Archon editorial) — on the map iff `status='active' AND publishable`, with `featured` only ranking among those. That is a real behaviour change: today's predicate is `featured=true AND status='active'`, so **featuring is currently load-bearing for visibility at all** and the goal's owner-control premise silently does not work without it. Visibility is owned by the INSTANCE and the hub row is a CACHE (ADR 0141 §3 + the admin-console spike's D1) — so `owner_github_id` being "advisory, not an authority" is CORRECT rather than a gap, R05 moves to an instance surface, and R08's absent-report default is fail-closed (unreported ⇒ dark matter, off the map rather than exposed by omission). Per-state join rules compose with the separate `open|closed` join policy ([task 1002817](https://cloudbongos.com/builders#/task/1002817)) by one rule: **visibility sets the ceiling, join policy may only narrow** — otherwise the two settings are a coin-flip decided by evaluation order. Finally, `stealth` COLLIDES with the existing instance-wide pre-launch password gate (`STEALTH_PASSWORD`, `src/bongos/stealth-gate.js`), which means nearly the opposite (a whole instance made unreadable vs a project publicly on the map, anonymously); per ADR 0174 the product meaning keeps the word and the infra rename is filed separately rather than decided by an ADR about visibility. Rejected: a stored 4-valued enum (makes `unlisted` compete with `private`, and lets publishable+unlisted disagree), a separate `published` boolean (can drift from the identity it summarises; derived cannot), and keeping `featured` as the visibility gate (an owner who sets public and appears nowhere has not been given control).](<redacted>.md) | platform-identity / project visibility |
 | 0183 | [**A done-when criterion closes itself; the review queue becomes a place to look** ([task 1002069](https://cloudbongos.com/builders#/task/1002069), goal 1000072, owner request 2026-07-05). ADR 0086 §6 made `satisfied` reachable exactly one way — a Metic+ calling `POST /done-when/:id/satisfy` — even though the signal it gated on is unambiguous (**every** gating task shipped) and a human confirming it adds no information. When nobody runs `/goal-review` the result is not a careful pause but a **lying board**: this session measured goal 1000072 at `6/9 shipped, 0/5 criteria`. Now one helper, `doneWhen.autoSatisfyShippedCriteria(exec, {taskId})`, runs from **two** places for two different reasons — inside `shipTask`'s txn (scoped, **immediate**, on the txn client so a rolled-back ship cannot leave a goal achieved) and unscoped on every `publish-reconciler` tick (**backlog drain** for criteria whose tasks shipped before this existed, since nothing will ship against them again, plus **self-heal**). Idempotent by construction — it reads only `satisfied=false` rows — which is what makes an every-tick sweep safe. **The load-bearing subtlety is the delivery guard.** Auto-close needs BOTH "nothing still pending" AND **≥ 1 task actually `shipped`**; the second is not redundant, because since [task 1002651](https://cloudbongos.com/builders#/task/1002651) made `abandoned` terminal-not-pending, a criterion whose tasks were **all cut** satisfies the first clause *vacuously* and would auto-close on ZERO delivered work, cascading its goal to `achieved` (measured: `buildCriterionProgress` returns `pending_review:true` for exactly that shape). Yet `pending_review` **keeps** that wider meaning on purpose — it asks "should a human LOOK at this", and 1002651 chose that an all-abandoned criterion surfaces so someone decides whether it still means anything. So: everything that auto-closes was flagged; not everything flagged auto-closes. An earlier draft "aligned" the two predicates and broke that intent — `tests/criterion_progress.mjs` caught it; **do not re-align them**, the gap is the design. `/goal-review` is kept, demoted from gate to viewing surface; manual `POST /satisfy` stays for what automation cannot judge (a criterion with no linked tasks never auto-closes). Honest limits recorded: auto-satisfy cannot help a criterion nothing is LINKED to, and the in-txn close logs before commit (accepted — threading the summary out through `withTx` would cost ~5 lines in the over-threshold `db.js` under shrink-only ratchet policy). Rejected: sweep-only (up to 5 min to see your own goal close), hook-only (never drains the backlog), a stored `pending_review` column (second source of truth), deleting `/goal-review`.](<redacted>.md) | lifecycle / goal tier |
+| 0184 | [**A ship must account for itself: `shipTask` requires a land proof or a declared no-artifact** ([task 1002483](https://cloudbongos.com/builders#/task/1002483), goal 1000024). `db.shipTask` is the confirmed→shipped flip and, since [ADR 0120](<redacted>.md), where the CREDIT is booked — yet its only precondition was `WHERE status = 'confirmed'`, nothing about whether code reached main. The two AUTOMATED paths each proved the land first; the MANUAL route passed nothing, so a task confirmed with no pushed code could be shipped by its claim holder **or by any Metic+ sweeping `/merge-mode`**, booking its `task.shipped` credit. It stayed untracked for two months because its tracking task was closed in June asserting task 1001547 had delivered the gate — it had not, blocker 1000047's own final update says so, and the code agreed with the blocker rather than the closure note: **a hole hidden by a record nobody checked**, which is the same failure the gate is about. Decision: the gate lives at the WRITE, not the route (a route gate leaves the invariant unenforced at the layer that moves the ledger, so the next caller reopens it silently), and `shipTask` is FAIL-CLOSED on a required `landAssurance`. TWO kinds, and the second is why this does not make things worse: `proof` (this task's commit is on main) and **`no_artifact`** — a deliberate DB-only ship, an explicitly supported shape (CLAUDE.md "Direct DB writes are work too") that [task 1002478](https://cloudbongos.com/builders#/task/1002478) documents as a dead end below Archon. A naive proof-only gate would have made 1002478 strictly worse; naming no-artifact as a KIND turns it from an absence the gate must be talked out of into a recorded answer. Both carry a reason, audited post-commit and best-effort (an audit miss must never roll back a landed ship). `ship.js` now declares its own `--db-only`/`--allow-empty` lands, without which this fix would have regressed the very flow CLAUDE.md calls supported. Rejected: (b) gate only the route — leaves the write unguarded; (c) record the residual as tolerable — defensible on blast radius and genuinely close, but it would have been the FOURTH record asserting this was handled with nothing checkable behind it. Does NOT gate confirm: a codeless confirm is still accepted, it simply cannot reach `shipped` or pay.](<redacted>.md) | lifecycle / integrity |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/api/openapi.json

@@ -12938,6 +12938,18 @@
             "description": "Path parameter `id`."
           }
         ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success.",
@@ -12950,7 +12962,7 @@
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"

package/docs/api-reference.md

@@ -516,7 +516,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/tasks/:id/promote` | `metic+archon` | — | backlog→ready promotion; scope mutation; ADR 0090 (was archon). |
 | POST | `/api/bongos/tasks/:id/publish-branch` | `any-builder` | `branch`, `head_sha`, `bundle_b64`, `value_summary` |  |
 | GET | `/api/bongos/tasks/:id/publish-status` | `any-builder` | — | GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy state for a server-mediated publish so ship.js can confirm the … |
-| POST | `/api/bongos/tasks/:id/ship` | `any-builder` | — | confirmed → shipped. |
+| POST | `/api/bongos/tasks/:id/ship` | `any-builder` | validated | confirmed → shipped. |
 | POST | `/api/bongos/tasks/:id/vote` | `metic+archon` | `vote` | POST /tasks/:id/vote { vote: 1 \| -1 \| 0 } — cast/change/clear a peer vote on a confirmed/shipped task. |
 | GET | `/api/bongos/tasks/claimable` | `any-builder` | — | NOTE: /tasks/claimable must come BEFORE /tasks/:id or Express will route 'claimable' to the :id param. |
 | GET | `/api/bongos/tasks/newcomer-floor` | `any-builder` | — | GET /tasks/newcomer-floor — supply gauge for the newcomer queue (task 614). |

package/modules/lifecycle/db.js

@@ -30,6 +30,7 @@
 
 const api = require('../../src/module-api');
 const { pool, withTx, insertAuditLog, LIVE_RANK_LADDER, RANK_TIER } = api;
+const log = api.logger('lifecycle'); // namespaced; the ratchet counts bare console calls
 // The seam registry (resolveOptional/emit/emitAsync) — the doorway re-exports it,
 // so the module reaches the `reward`/`onboarding` ports + emits kernel events
 // (task.shipped, builder.box-reconcile-needed) without importing core.
@@ -2377,22 +2378,6 @@ async function removeDependency(fromKind, fromId, toKind, toId) {
   return rowCount > 0;
 }
 
-// Edges for a node. reverse=false: what (kind,id) depends on; reverse=true: what
-// depends on (kind,id).
-
-async function getDependencies(kind, id, { reverse = false } = {}) {
-  const selfKind = reverse ? 'to_kind' : 'from_kind';
-  const selfId = reverse ? 'to_id' : 'from_id';
-  const { rows } = await pool.query(
-    `SELECT from_kind, from_id, to_kind, to_id, created_at
-       FROM dependencies
-      WHERE ${selfKind} = $1 AND ${selfId} = $2
-      ORDER BY from_kind, from_id, to_kind, to_id`,
-    [kind, id]
-  );
-  return rows;
-}
-
 // ---------------------------------------------------------------------------
 // Task ↔ criterion links (task_criteria, migration 055 / ADR 0025; populated on
 // task-create + manage endpoints by task 438). Mirrors the task_dependencies
@@ -3725,7 +3710,11 @@ async function needsRebaseTasksForBuilder(builderId, client = pool) {
   return rows;
 }
 
-async function shipTask({ taskId, builderId }, deps = {}) {
+// The ship gate (task 1002483, ADR 0184) — see ./ship-assurance for the why.
+const { normalizeShipAssurance, assertShipAssurance, recordShipAssurance, SHIP_ASSURANCE_KINDS } = require('./ship-assurance');
+
+async function shipTask({ taskId, builderId, landAssurance }, deps = {}) {
+  const shipAssuranceValue = assertShipAssurance(landAssurance); // FAIL-CLOSED, ADR 0184
   // #538 test seam (mirrors confirmTask): a caller-supplied pool is honored ONLY
   // under NODE_ENV==='test', so a regression test can drive the txn with a
   // SQL-aware fakeClient. Production callers omit deps → module pool.
@@ -3888,8 +3877,11 @@ async function shipTask({ taskId, builderId }, deps = {}) {
       builderId: actualShipperId, rank: 'thetes', status: rankGraduation.status, actor: 'auto-graduation:#692',
     }).catch(() => {});
   }
+  await recordShipAssurance({ insertAuditLog, taskId, builderId: actualShipperId, assurance: shipAssuranceValue, log });
   return {
     ...shipRow,
+    shipAssurance: shipAssuranceValue, // echoed so a caller can show it, not guess
+
     graduatedTo: rankGraduation ? 'thetes' : null,
     // ADR 0120: the per-task reward that landed on THIS ship (0 on a re-ship /
     // reconciler re-sweep — idempotent). The ship route surfaces it so the
@@ -5700,7 +5692,6 @@ module.exports = {
   findCycle,
   addDependency,
   removeDependency,
-  getDependencies,
   unsatisfiedDeps,
   parseCriterionRef,
   resolveCriterionIds,
@@ -5719,6 +5710,7 @@ module.exports = {
   restoreTask, // ADR 0152 — the abandoned→backlog undo that pairs with the Metic+ abandon grant
   applyGrade,
   shipTask,
+  normalizeShipAssurance, SHIP_ASSURANCE_KINDS, // ADR 0184 — re-exported from ./ship-assurance
   flagTaskNeedsRebase, // ADR 0120 part 2 — reconciler flags an unlandable confirmed task for its builder
   needsRebaseTasksForBuilder, // ADR 0120 part 3/5 — the claim gate + hall/CLI read the builder's owed rebases
   listConfirmedTasksForReconcile, // task 1134 — server-owned publish reconciler feed

package/modules/lifecycle/publish-reconciler.js

@@ -705,7 +705,14 @@ async function runSweep(deps = {}) {
     }
 
     try {
-      const shipped = await db.shipTask({ taskId: r.task_id, builderId: r.builder_id });
+      // task 1002483: the sweep only reaches here on a PROVEN land (the `if
+      // (!landed) … continue` above), so it hands that proof to the gate rather
+      // than letting shipTask re-derive it. landNote carries which probe proved it.
+      const shipped = await db.shipTask({
+        taskId: r.task_id,
+        builderId: r.builder_id,
+        landAssurance: { kind: 'proof', reason: landNote || 'reconciler: land proven' },
+      });
       reconciled++;
       dispositions.push(`${r.task_id}:shipped`);
       logFn(

package/modules/lifecycle/routes/tasks.js

@@ -14,6 +14,8 @@ const { buildGoalAdvisory } = require('../goal-advisory');
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
 const githubPush = require('../github-push');
+const shipAssurance = require('../ship-assurance');
+const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
 const seams = api;
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
@@ -1138,8 +1140,12 @@ module.exports = function buildTasksRouter() {
     // OWN confirmed task. allowSupervisor lets Metic+ (who run /merge-mode) ship
     // across builders; the claim holder ships their own; everyone else is 403'd.
     if (!(await gateTaskOwnership(req, res, id, { allowSupervisor: true }))) return;
+    if (validateOrRespond(req, res, shipAssurance.SHIP_BODY_SCHEMA)) return; // ADR 0184
     try {
-      const task = await db.shipTask({ taskId: id, builderId: req.builder.id });
+      // The ship gate (ADR 0184) — this route is the path that had none.
+      const landAssurance = await shipAssurance.gateManualShip(res, { taskId: id, body: req.body || {}, db, githubPush, log: api.logger('lifecycle') });
+      if (!landAssurance) return;
+      const task = await db.shipTask({ taskId: id, builderId: req.builder.id, landAssurance });
       // task 1749: emit task.shipped on THIS entry point too, not just the
       // publish-status reconcile-on-read path (line ~1545) + the reconciler
       // sweep. A direct ship here (e.g. /merge-mode sweeping the confirmed
@@ -1718,7 +1724,7 @@ module.exports = function buildTasksRouter() {
       }
       if (githubPush.landConfirmed(status) && !reconcile_blocked) {
         try {
-          const shipped = await db.shipTask({ taskId: id, builderId: req.builder.id });
+          const shipped = await db.shipTask({ taskId: id, builderId: req.builder.id, landAssurance: RECONCILE_PROOF }); // ADR 0184
           reconciled = true;
           // task 1045: the box that published can't post the Discord broadcast —
           // it holds no webhook secret (ADR 0053 "box holds nothing"), so a box

package/modules/lifecycle/ship-assurance.js

@@ -0,0 +1,159 @@
+'use strict';
+
+// modules/lifecycle/ship-assurance.js — WHY a ship was allowed (task 1002483,
+// ADR 0184). A sibling of ship-preflight.js / ship-card.js: pure, DB-free, and
+// deliberately NOT inside db.js, which is already an oversized file the quality
+// ratchet measures.
+//
+// THE HOLE THIS CLOSES. db.shipTask is the confirmed→shipped flip and, since
+// ADR 0120, where the CREDIT is booked. Its only precondition was
+// `WHERE status = 'confirmed'` — nothing about whether any code reached main. The
+// two AUTOMATED paths each proved the land before calling; the MANUAL route
+// passed nothing, so a task confirmed with no pushed code could be flipped to
+// shipped by its claim holder or by any Metic+ sweeping /merge-mode, booking its
+// task.shipped credit.
+//
+// TWO KINDS, and the second is the reason this gate does not make things worse:
+//
+//   proof        the caller verified THIS task's own commit is on main.
+//   no_artifact  a deliberate DB-only ship — an explicitly supported shape
+//                (CLAUDE.md, "Direct DB writes are work too") that task 1002478
+//                documents as a DEAD END below Archon today. Naming it a KIND is
+//                what keeps this gate from worsening that: a no-artifact ship
+//                becomes a recorded answer, not an absence the gate has to be
+//                talked out of.
+//
+// Both carry a `reason`, so the audit row says WHY a ship was allowed rather than
+// merely that it happened — which is exactly what was missing when this hole went
+// unnoticed for two months behind an incorrect closure note.
+
+// The write-schema for the manual ship route's declaration fields (ADR 0118
+// requires every write route to validate its body). Declared beside the gate
+// that consumes them.
+const SHIP_BODY_SCHEMA = Object.freeze({
+  no_artifact: { type: 'boolean' },
+  no_artifact_reason: { type: 'string', maxLength: 500 },
+});
+
+const KINDS = Object.freeze(['proof', 'no_artifact']);
+const MAX_REASON_CHARS = 500;
+
+// Validate an assurance. Returns { ok, value } | { ok:false, code, allowed }.
+// FAIL-CLOSED by construction: every unhappy shape returns a code, and shipTask
+// throws on any of them, so a caller that cannot say why this is a legitimate
+// ship never reaches the write.
+function normalizeShipAssurance(a) {
+  if (!a || typeof a !== 'object' || Array.isArray(a)) {
+    return { ok: false, code: 'ship_assurance_required' };
+  }
+  if (!KINDS.includes(a.kind)) {
+    return { ok: false, code: 'ship_assurance_bad_kind', allowed: KINDS };
+  }
+  const reason = String(a.reason == null ? '' : a.reason).replace(/\s+/g, ' ').trim();
+  if (!reason) return { ok: false, code: 'ship_assurance_reason_required' };
+  return { ok: true, value: { kind: a.kind, reason: reason.slice(0, MAX_REASON_CHARS) } };
+}
+
+// Derive the assurance for a MANUAL ship (POST /tasks/:id/ship) — the path that
+// had no gate at all. Returns { assurance } to proceed, or { refusal } the route
+// answers verbatim.
+//
+// Order matters: PROVE first, and only fall back to the declaration. A caller who
+// pushed real work should never have to declare anything, and a declaration must
+// never be able to override an available proof.
+//
+// A probe miss is NOT a licence to ship. It means "no proof yet", which lands on
+// the same refusal — the fail direction is to wait, never to pay.
+//
+// `deps` is injected so this is unit-testable with no network and no DB.
+async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeError }) {
+  try {
+    const publishedSha = await db.getClaimPublishedSha(taskId);
+    const status = await githubPush.getPublishStatus({ taskId, publishedSha });
+    const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
+    if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };
+  } catch (e) {
+    if (onProbeError) onProbeError(e);
+  }
+
+  if (body.no_artifact === true) {
+    const reason = String(body.no_artifact_reason || '').trim();
+    if (!reason) {
+      return {
+        refusal: {
+          code: 'no_artifact_reason_required',
+          status: 400,
+          details: {
+            what_this_means: 'A no-artifact ship is legitimate, but the ledger records WHY. Say what was delivered (a DB row, a config change, a decision) in no_artifact_reason.',
+          },
+        },
+      };
+    }
+    return { assurance: { kind: 'no_artifact', reason } };
+  }
+
+  return {
+    refusal: {
+      code: 'ship_land_not_proven',
+      status: 409,
+      details: {
+        what_this_means: 'This task has no commit provably on main, so shipping it here would book a credit for work nobody can point at.',
+        your_options: [
+          'Push the branch and let it land — the reconciler ships it automatically once the merge is provable.',
+          'If this task genuinely has no code artifact, re-send with { "no_artifact": true, "no_artifact_reason": "…" } so the ledger records the declaration.',
+        ],
+      },
+    },
+  };
+}
+
+
+// Record WHY a ship was allowed, not merely that it happened. POST-COMMIT and
+// best-effort by design: insertAuditLog uses the module pool rather than the
+// ship's transaction client, and an audit miss must never roll back a landed ship
+// (the posture src/bongos/middleware/audit.js already takes).
+async function recordShipAssurance({ insertAuditLog, taskId, builderId, assurance, log }) {
+  try {
+    await insertAuditLog({
+      builderId,
+      route: `/tasks/${taskId}/ship`,
+      method: 'SHIP',
+      requestBodyRedacted: { ship_assurance: assurance },
+      responseStatus: 200,
+      surface: 'lifecycle',
+    });
+  } catch (e) {
+    if (log) log.warn('shipTask: ship-assurance audit write failed (non-blocking):', e && e.message);
+  }
+}
+
+// Throwing form, so the caller is one line. Returns the normalized value or
+// throws with the named code — shipTask's FAIL-CLOSED precondition.
+function assertShipAssurance(landAssurance) {
+  const a = normalizeShipAssurance(landAssurance);
+  if (a.ok) return a.value;
+  const e = new Error('ship assurance required');
+  e.code = a.code;
+  e.allowed = a.allowed;
+  throw e;
+}
+
+// Route form: derive, or answer the refusal on `res` and return null. Keeps the
+// gate a two-line concern in the (oversized) route file.
+async function gateManualShip(res, opts) {
+  const { log, taskId } = opts;
+  const derived = await deriveShipAssurance({
+    ...opts,
+    onProbeError: (e) => log && log.warn(`POST /tasks/${taskId}/ship: land probe failed (${e && e.message}) — no proof`),
+  });
+  if (derived.refusal) {
+    res.fail(derived.refusal.code, derived.refusal.status, derived.refusal.details);
+    return null;
+  }
+  return derived.assurance;
+}
+
+module.exports = {
+  normalizeShipAssurance, deriveShipAssurance, recordShipAssurance,
+  assertShipAssurance, gateManualShip, SHIP_BODY_SCHEMA, SHIP_ASSURANCE_KINDS: KINDS, MAX_REASON_CHARS,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.292",
+  "version": "1.19.293",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.292",
+      "version": "1.19.293",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.292",
+  "version": "1.19.293",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -1193,7 +1193,8 @@ function shouldBailOnFetchFailure(fetchedMain, deployMode, via) {
 //                      `n` the command that recovers it.
 // Only landBailed makes the card say NOT landed. Purely additive: no bail site
 // changes what it DOES, only what it now reports back.
-function landed() { return { ok: true, pending: false, reason: null, nextStep: null }; }
+// ADR 0184: an EMPTY ship has no commit to prove, so it must DECLARE itself.
+function landed(o = {}) { return { ok: true, pending: false, reason: null, nextStep: null, noArtifact: o.noArtifact === true, noArtifactReason: o.noArtifactReason || null }; }
 function landPending() { return { ok: false, pending: true, reason: null, nextStep: null }; }
 function landBailed(reason, nextStep = null) { return { ok: false, pending: false, reason, nextStep }; }
 
@@ -2534,7 +2535,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     if (dbOnly && shellOk('git fetch origin main')
         && zeroCommitVerdict(gitOk('git rev-list origin/main..HEAD --count'), true) === 'db-only') {
       console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) from the main checkout - nothing to merge; advancing to shipped without merge/deploy.');
-      return landed();
+      return landed({ noArtifact: true, noArtifactReason: 'empty ship from the main checkout — no commits to merge' });
     }
     console.log(`  auto-merge: skipped (current branch is ${branch})`);
     // The merge source IS the current branch, so on main there is nothing to
@@ -2599,7 +2600,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   }
   if (verdict === 'db-only') {
     console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) - no commits ahead of main; advancing to shipped without merge/deploy.');
-    return landed();
+    return landed({ noArtifact: true, noArtifactReason: 'empty ship — no commits ahead of main' });
   }
 
   // #679 / ADR 0042: in 'ci' deploy mode the operator's machine never merges or
@@ -3236,7 +3237,8 @@ async function mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOn
   // task that never landed.
   if (!merged.ok) return merged;
 
-  const ship = await (await cliClient()).tasks.postTasksIdShip({ id: taskId, body: {} });
+  const shipBody = merged.noArtifact ? { no_artifact: true, no_artifact_reason: merged.noArtifactReason || 'deliberate empty ship (--db-only)' } : {}; // ADR 0184
+  const ship = await (await cliClient()).tasks.postTasksIdShip({ id: taskId, body: shipBody });
   if (!ship.ok) {
     // task 1049 / 1002809: the server may have already flipped this task to
     // shipped (reconcile-on-read, or the reconciler racing this call). Verify

package/src/module-api.js

@@ -1011,8 +1011,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.290 with no explicit bump. run 32580353000. (task 1002620)
 //   1.19.292 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.291 with no explicit bump. run 32582800234. (task 1002620)
+//   1.19.293 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.292 with no explicit bump. run 32586174253. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.292'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.293'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/orphaned_claim_ship.mjs

@@ -79,9 +79,14 @@ const idxOf = (queries, re) => queries.findIndex((q) => re.test(String(q.sql).re
 const CLAIMS_CLOSE = /^UPDATE claims SET released_at = now\(\), outcome = COALESCE\(outcome, 'shipped'\) WHERE task_id = \$1 AND released_at IS NULL/;
 const SHIP_TASK = /^UPDATE tasks SET status = 'shipped'/;
 
+// task 1002483: shipTask now requires a landAssurance and is fail-closed.
+// These tests exercise what happens AFTER the gate, so they pass the same
+// 'proof' shape the reconciler and reconcile-on-read do.
+const LAND_PROOF = { kind: 'proof', reason: 'test fixture: land proven' };
+
 await test('ship heals a strand: open claim on the shipped task is closed', async () => {
   const pool = fakePool({ confirmed: true, orphanClaimIds: [1292] });
-  const result = await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID }, { pool });
+  const result = await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID, landAssurance: LAND_PROOF }, { pool });
 
   // the ship itself succeeded and the shipRow is returned
   assert.equal(result.id, TASK_ID);
@@ -95,7 +100,7 @@ await test('ship heals a strand: open claim on the shipped task is closed', asyn
 
 await test('claims-close runs in-txn: after BEGIN + the ship UPDATE, before COMMIT', async () => {
   const pool = fakePool({ confirmed: true, orphanClaimIds: [1292] });
-  await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID }, { pool });
+  await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID, landAssurance: LAND_PROOF }, { pool });
   const q = pool._client.queries;
 
   const iBegin = idxOf(q, /^BEGIN$/);
@@ -113,7 +118,7 @@ await test('normal ship is a no-op safety net: UPDATE runs, nothing to close', a
   // resolveClaim already closed the claim on the happy path — the UPDATE matches
   // zero rows. The ship must still succeed and still issue the (harmless) UPDATE.
   const pool = fakePool({ confirmed: true, orphanClaimIds: [] });
-  const result = await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID }, { pool });
+  const result = await shipTask({ taskId: TASK_ID, builderId: BUILDER_ID, landAssurance: LAND_PROOF }, { pool });
 
   assert.equal(result.status, 'shipped');
   const close = pool._client.queries.find((q) => CLAIMS_CLOSE.test(String(q.sql).replace(/\s+/g, ' ').trim()));
@@ -123,7 +128,7 @@ await test('normal ship is a no-op safety net: UPDATE runs, nothing to close', a
 await test('rejected ship (not confirmed) never closes claims, and rolls back', async () => {
   const pool = fakePool({ confirmed: false });
   await assert.rejects(
-    () => shipTask({ taskId: TASK_ID, builderId: BUILDER_ID }, { pool }),
+    () => shipTask({ taskId: TASK_ID, builderId: BUILDER_ID, landAssurance: LAND_PROOF }, { pool }),
     (e) => e.code === 'TASK_NOT_CONFIRMED',
   );
   const q = pool._client.queries;

package/tests/pay_on_land.mjs

@@ -82,12 +82,17 @@ const RECONCILER = 999;  // the builder_id the reconciler passes to shipTask
 const WORKER = 25;       // the claim holder who actually did the work
 const TASK = { id: 660, title: 'fixture task' };
 
+// task 1002483: shipTask now requires a landAssurance and is fail-closed.
+// These tests exercise what happens AFTER the gate, so they pass the same
+// 'proof' shape the reconciler and reconcile-on-read do.
+const LAND_PROOF = { kind: 'proof', reason: 'test fixture: land proven' };
+
 // =========================================================================
 await test('ship: the per-task credit lands at SHIP (reason=task.shipped), attributed to the claim holder', async () => {
   // shipped_by was set to the claim holder at confirm; the reconciler triggers
   // the ship with its own builderId — attribution must still be the worker.
   const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 15, kind: 'feature' });
-  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER, landAssurance: LAND_PROOF }, { pool });
 
   assert.equal(out.status, 'shipped', 'task flips to shipped');
   assert.equal(out.creditedBuilderId, WORKER, 'credit attributed to the claim holder, not the reconciler');
@@ -103,14 +108,14 @@ await test('ship: the per-task credit lands at SHIP (reason=task.shipped), attri
 
 await test('ship: idempotent — a prior task.shipped credit means no second INSERT', async () => {
   const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, priorShipCredit: true });
-  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER, landAssurance: LAND_PROOF }, { pool });
   assert.equal(out.creditsAwarded, 0, 'no fresh credit on a re-ship / reconciler re-sweep');
   assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'must not double-insert credit');
 });
 
 await test('ship: credits_reward = 0 → no credit_log INSERT', async () => {
   const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 0 });
-  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER, landAssurance: LAND_PROOF }, { pool });
   assert.equal(out.creditsAwarded, 0, 'a zero-reward task pays nothing');
   assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'no INSERT for a 0-reward task');
 });
@@ -118,7 +123,7 @@ await test('ship: credits_reward = 0 → no credit_log INSERT', async () => {
 await test('ship: not in confirmed state → throws TASK_NOT_CONFIRMED, awards nothing', async () => {
   const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, confirmed: false });
   await assert.rejects(
-    () => shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool }),
+    () => shipTask({ taskId: TASK.id, builderId: RECONCILER, landAssurance: LAND_PROOF }, { pool }),
     (err) => err.code === 'TASK_NOT_CONFIRMED',
     'must throw TASK_NOT_CONFIRMED when the UPDATE matches no confirmed row'
   );

package/tests/ship_assurance.mjs

@@ -0,0 +1,188 @@
+// tests/ship_assurance.mjs — the ship gate (task 1002483, goal 1000024).
+//
+// THE HOLE. db.shipTask is where the ledger says work is delivered AND where the
+// credit is booked (ADR 0120 pays on land). Its only precondition was
+// `WHERE status = 'confirmed'` — nothing about whether any code reached main. The
+// two AUTOMATED paths each proved the land before calling, but the MANUAL route
+// (POST /tasks/:id/ship) called it with nothing. So a task confirmed with no
+// pushed code could be flipped to shipped by its claim holder, or by any Metic+
+// sweeping /merge-mode, and it booked its task.shipped credit.
+//
+// It went untracked for two months because its tracking task (1000900) was closed
+// in June on a rationale asserting task 1001547 had delivered the confirm gate.
+// It had not — blocker 1000047's own final update says so, and the code agreed
+// with the blocker, not the closure note. That is why these tests assert against
+// the CODE and not against anyone's account of it.
+//
+// THE GATE. shipTask now requires a `landAssurance` and is FAIL-CLOSED: no
+// assurance, no ship. Two legitimate kinds:
+//   proof        the caller verified this task's own commit is on main
+//   no_artifact  a deliberate DB-only ship — an explicitly supported shape
+//                (CLAUDE.md, "Direct DB writes are work too") that task 1002478
+//                documents as a dead end below Archon. Naming it as a KIND is
+//                what stops this gate from making 1002478 worse: a no-artifact
+//                ship becomes a recorded answer rather than an absence.
+//
+// DB-free: the validator is pure, and the fail-closed refusal happens before any
+// pool use, so shipTask can be called with no database at all.
+//
+// Run:  node tests/ship_assurance.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
+const db = require(path.join(ROOT, 'modules/lifecycle/db.js'));
+const { normalizeShipAssurance, SHIP_ASSURANCE_KINDS } = db;
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${e.message}`); }
+}
+
+console.log('the ship assurance — what counts as a shippable reason');
+
+await t('a missing assurance is refused', () => {
+  for (const bad of [undefined, null, '', 0, false, [], 'proof']) {
+    const r = normalizeShipAssurance(bad);
+    assert.equal(r.ok, false, `${JSON.stringify(bad)} must not pass`);
+    assert.equal(r.code, 'ship_assurance_required');
+  }
+});
+
+await t('an unknown kind is refused, and the refusal lists what is allowed', () => {
+  const r = normalizeShipAssurance({ kind: 'trust_me', reason: 'it landed, honest' });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'ship_assurance_bad_kind');
+  assert.deepEqual(r.allowed, SHIP_ASSURANCE_KINDS);
+});
+
+await t('a reasonless assurance is refused — the ledger records WHY, not just that', () => {
+  for (const reason of [undefined, null, '', '    ', '\n\t ']) {
+    const r = normalizeShipAssurance({ kind: 'proof', reason });
+    assert.equal(r.ok, false, `${JSON.stringify(reason)} is not a reason`);
+    assert.equal(r.code, 'ship_assurance_reason_required');
+  }
+});
+
+await t('both legitimate kinds pass, and the reason is tidied', () => {
+  const p = normalizeShipAssurance({ kind: 'proof', reason: '  published tip abc1234   in main \n' });
+  assert.equal(p.ok, true);
+  assert.deepEqual(p.value, { kind: 'proof', reason: 'published tip abc1234 in main' });
+
+  const n = normalizeShipAssurance({ kind: 'no_artifact', reason: 'DB-only: widened a goal scope wall' });
+  assert.equal(n.ok, true);
+  assert.equal(n.value.kind, 'no_artifact');
+});
+
+await t('a runaway reason is capped rather than refused', () => {
+  const r = normalizeShipAssurance({ kind: 'proof', reason: 'x'.repeat(5000) });
+  assert.equal(r.ok, true, 'a long reason is still a reason — cap it, do not lose the ship');
+  assert.equal(r.value.reason.length, 500);
+});
+
+console.log('\nshipTask is FAIL-CLOSED, before it touches a database');
+
+await t('shipTask with NO assurance throws ship_assurance_required', async () => {
+  // No DB is configured here on purpose: the gate must refuse before any pool
+  // use, so a caller that cannot account for the ship never even opens a txn.
+  await assert.rejects(
+    () => db.shipTask({ taskId: 1, builderId: 1 }),
+    (e) => e.code === 'ship_assurance_required',
+  );
+});
+
+await t('shipTask with a MALFORMED assurance throws too — not a silent default', async () => {
+  await assert.rejects(
+    () => db.shipTask({ taskId: 1, builderId: 1, landAssurance: { kind: 'proof' } }),
+    (e) => e.code === 'ship_assurance_reason_required',
+  );
+  await assert.rejects(
+    () => db.shipTask({ taskId: 1, builderId: 1, landAssurance: { kind: 'nope', reason: 'x'.repeat(20) } }),
+    (e) => e.code === 'ship_assurance_bad_kind',
+  );
+});
+
+console.log('\nevery call site accounts for its ship');
+
+// Source tripwires. The behavioural tests above prove the gate refuses; these
+// prove nobody routes AROUND it. A new caller that forgets the assurance would
+// fail at runtime — but only on the path someone exercises, which for a ship path
+// can be weeks later and in production.
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+await t('all three production call sites pass a landAssurance', () => {
+  const sites = [
+    ['modules/lifecycle/publish-reconciler.js', 'the reconciler sweep'],
+    ['modules/lifecycle/routes/tasks.js', 'the manual ship route + reconcile-on-read'],
+  ];
+  let found = 0;
+  for (const [rel, label] of sites) {
+    const src = read(rel);
+    for (const m of src.matchAll(/db\.shipTask\(\{([\s\S]{0,300}?)\}\)/g)) {
+      found++;
+      assert.match(m[1], /landAssurance/,
+        `${label} (${rel}) calls db.shipTask without a landAssurance — that is the hole reopening`);
+    }
+  }
+  assert.equal(found, 3, `expected 3 production shipTask call sites, found ${found}`);
+});
+
+await t('the manual ship path PROVES the land, and refuses when it cannot', () => {
+  // The derivation lives in ship-assurance.js (a sibling of ship-preflight), not
+  // in the already-oversized route file — so the assertions follow it there.
+  const src = read('modules/lifecycle/ship-assurance.js');
+  assert.match(src, /landProvenForTask/,
+    'the manual path must DERIVE a proof — it is the path that had none');
+  assert.match(src, /ship_land_not_proven/,
+    'and it must REFUSE when there is no proof and no declaration');
+  assert.match(src, /no_artifact/,
+    'with the deliberate no-artifact declaration as the only other way through');
+
+  // ORDER: prove first, declaration second. A declaration must never be able to
+  // override a proof that was available, and someone who pushed real work should
+  // never have to declare anything.
+  assert.ok(src.indexOf('landProvenForTask') < src.indexOf('body.no_artifact === true'),
+    'the proof must be attempted BEFORE the declaration is consulted');
+});
+
+await t('the route wires the derivation and answers its refusal verbatim', () => {
+  const src = read('modules/lifecycle/routes/tasks.js');
+  const i = src.indexOf("router.post('/tasks/:id/ship'");
+  assert.ok(i > -1);
+  const handler = src.slice(i, src.indexOf('router.', i + 20));
+  assert.match(handler, /gateManualShip/, 'the route must call the gate');
+  assert.match(handler, /if \(!landAssurance\) return;/,
+    'and must BAIL when the gate refused — the refusal is already on the wire');
+  // The assurance passed to the write must be the DERIVED value, never an inline
+  // literal — `{ kind: 'proof', reason: 'assumed' }` would satisfy the gate's shape
+  // while asserting a land nobody checked. (Found by injecting exactly that and
+  // watching an earlier draft of this test stay green.)
+  assert.match(handler, /db\.shipTask\(\{[^}]*landAssurance\s*\}\)/,
+    'the route must pass the DERIVED landAssurance variable, not an inline literal');
+});
+
+await t('the no-artifact declaration cannot be made silently', () => {
+  const src = read('modules/lifecycle/ship-assurance.js');
+  assert.match(src, /no_artifact_reason_required/,
+    'declaring "no artifact" without saying what was delivered must be refused');
+});
+
+await t('the CLI carries the declaration through its deliberate-empty path', () => {
+  // Without this, the gate would refuse exactly the --db-only / --allow-empty
+  // flow CLAUDE.md calls a supported shape — turning a correctness fix into a
+  // regression for the builders who rely on it.
+  const src = read('scripts/gds/ship.js');
+  assert.match(src, /no_artifact:\s*true/, 'ship.js must send the declaration on an empty land');
+  assert.match(src, /landed\(\{ noArtifact: true/,
+    'and the deliberate-empty land sites must mark themselves as such');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);