@bongos/core 1.19.30 → 1.19.31

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.30",
-  "core_contract": "1.19.30",
-  "source_commit": "103b0c420b448f90a8f42f923f4e67891c45b210",
+  "core_version": "1.19.31",
+  "core_contract": "1.19.31",
+  "source_commit": "2e9b2abd8b182334b2eeb52e9815f499f340a3e3",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T14:41:56.292Z",
+  "built_at": "2026-08-11T14:47:58.633Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 286,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1206,
+    "functional_verbatim": 1207,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1513,
-  "tree_sha256": "66f1b7a904b38f7980ead45fe34e98228990e4be951b312f807251687b13d098",
+  "file_count": 1514,
+  "tree_sha256": "46bd790b34d0d3e1c2884f43eecf20fa747ddd57fb76ad0331f24dfb362fc6a2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2837,12 +2837,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "52dfa2cde50170d982cc816da444fe1d1cf79814104cc9452aee1d658474556e"
+      "sha256": "6917875f2be5c39248b44caf7bf8d50f68cbe8effbc2bfdef3ba11e5ac17fc6c"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
       "mode": "0000644",
-      "sha256": "6163aa89c558269267decf1ed91d6fc65939f27a34baf67364af01f8e6204cc1"
+      "sha256": "9b8bbb51c5d8641d1c145d90ad8d0d96d19466abd8777bd10d5819630a6b7066"
     },
     {
       "path": "modules/grading/grader-workers/extract-json.js",
@@ -2857,7 +2857,7 @@
     {
       "path": "modules/grading/grader-workers/hacker.js",
       "mode": "0000644",
-      "sha256": "be6e82997286141f1c561c496ce1a717591d2b2bed9d5cee1f7af73770bc526c"
+      "sha256": "99f64187efc56c2edf5a41626f87ee4083e83da43f1a00628d3506929d42e3c2"
     },
     {
       "path": "modules/grading/grader-workers/index.js",
@@ -2867,12 +2867,12 @@
     {
       "path": "modules/grading/grader-workers/narc.js",
       "mode": "0000644",
-      "sha256": "c034baa7e0973cbbf09f54305ed1ee8cb90c9642088edd6b45b63504ba267435"
+      "sha256": "4e881e6d04bafcf6093be0e1c653979d00c174b6f7966fb9cd3d833a994f48d3"
     },
     {
       "path": "modules/grading/grader-workers/quality.js",
       "mode": "0000644",
-      "sha256": "7a64a9c4bb97b791be3e7ca8fe17164b80ae30aca968ac05a0229a6e4926b05e"
+      "sha256": "de6003eb2af2abca2e6d68ebab729c8a3e18f0b8514d9f14e65b9442c21df253"
     },
     {
       "path": "modules/grading/grader-workers/rubric.js",
@@ -2882,12 +2882,12 @@
     {
       "path": "modules/grading/grader-workers/worker-prompt.js",
       "mode": "0000644",
-      "sha256": "017536ca8d35b1bb9b893a4fa7402d1f13f36c2e4c12585b9f296971080fa19c"
+      "sha256": "f691b0a42984a9e768477ab694bf7d7bc92264d4bb6d5f50ea52fc0e79abbfb1"
     },
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
       "mode": "0000644",
-      "sha256": "8185aa753112fe66a13c2ce650ef21b9a832413e70fbebc8ff048aa8e7aae5d1"
+      "sha256": "9c3abb069cfdee124b4fd5c521fe1c11b44177f7af941c9ab7bbb2a4a3718bab"
     },
     {
       "path": "modules/grading/grader.js",
@@ -4012,12 +4012,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f1d885c73d1c6d6c7a1b5762e022f575045e320aa8e0fcfcaf3e9f00153fe8d5"
+      "sha256": "bb741853a2f1a9a62c27bfa769492a653a975103458dd872c4e51f7a7e4e6b9a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ef7a211fb70fc0316e3146e7a35a09617ea7fc2e275e8b06af61da04da94db51"
+      "sha256": "1d0695ec7d2636aab3ca123aff5dfb89e5ccc6ddfd3cb3692b4570fd114e4f97"
     },
     {
       "path": "public-docs/index.html",
@@ -5637,7 +5637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "696cdcbb043dc4b0792302807c0130d348e83d7d2e8b2fc992805f31a4a3d677"
+      "sha256": "1b4208d337a8dd0b88ba82cb42f5685537be1e4d12824c4972564cecbf84ce32"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6607,7 +6607,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "4832bcffc7385cdd8deb0c1ff9bb44542190a3da106d2f00ccacd823c90103ec"
+      "sha256": "9c8525b85be898be30d6034902b34fcdedb16cf4b37fa8d79fbd5d1fb89898cb"
     },
     {
       "path": "tests/grader_bypass.mjs",
@@ -6624,6 +6624,11 @@
       "mode": "0000644",
       "sha256": "fa155f3c5faa3763d1a51d56b7746ad870e826e3249f5e9b08108a3cfbfcbd72"
     },
+    {
+      "path": "tests/grader_severity_gate.mjs",
+      "mode": "0000644",
+      "sha256": "956384c2334742858dba987fe042b6c26581875ed5981a7565d43e46b55dfc49"
+    },
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",

package/modules/grading/grader-rubric.json

@@ -32,17 +32,18 @@
       "concerns": "ANY worker.verdict='concerns' (and no fails) → overall passed=false, forwarded confidence = fallthrough_confidence (manual-confirm available).",
       "pass": "ALL workers.verdict='pass' → overall passed=true, advance to confirmed."
     },
+    "severity_gate_policy": "Task 1002663: style findings (comment style/length/placement, naming conventions, doc placement, test-name conventions) are ADVISORY — severity nit, recorded in issues[] for the audit trail, never a verdict driver. Enforced deterministically in grader-workers/worker-verdict.js applySeverityGatePolicy for narc/quality/efficiency: a worker 'fail' whose only basis is a sub-threshold score with NO major/blocker finding is an inconsistent self-report and downgrades to 'concerns' (manual-confirm pause) — a worker whose findings are all nit/minor can never verdict fail. The HACKER is deliberately EXEMPT: the security lens stays fail-closed on an unbacked sub-threshold score (a real finding mislabeled minor must still hard-fail). Untouched everywhere: blocker-driven fails, non-score fail triggers (Narc missing-AC), error short-circuits. Every worker prompt carries the matching STYLE_ADVISORY paragraph (worker-prompt.js).",
     "active_workers": {
       "narc": {
         "specialty": "semantic completion (description vs diff, line-level)",
         "scores_reported": ["functional_fidelity"],
-        "verdict_rules": "fail if any blocker issue, any AC marked 'missing', or ff < 6; concerns if any AC 'partial' OR confidence < 0.4; pass otherwise",
+        "verdict_rules": "fail if any blocker issue, any AC marked 'missing', or ff < 6; concerns if any AC 'partial' OR confidence < 0.4; pass otherwise; severity_gate_policy: an ff < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "prompt_lives_in": "modules/grading/grader-workers/narc.js"
       },
       "quality": {
         "specialty": "code quality (idiom, dead code, tests, invariants) + economy (advisory)",
         "scores_reported": ["code_quality", "economy"],
-        "verdict_rules": "fail if any blocker issue or cq < 6; concerns if confidence < 0.4, economy < 6 (advisory nudge), or any major issue; pass otherwise",
+        "verdict_rules": "fail if any blocker issue or cq < 6; concerns if confidence < 0.4, economy < 6 (advisory nudge), or any major issue; pass otherwise; severity_gate_policy: a cq < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "prompt_lives_in": "modules/grading/grader-workers/quality.js"
       },
       "hacker": {
@@ -55,7 +56,7 @@
       "efficiency": {
         "specialty": "runtime cost / hot-path performance (N+1, O(n²), sync I/O, unbounded queries)",
         "scores_reported": ["efficiency_score"],
-        "verdict_rules": "fail if any blocker (critical/high) runtime-cost issue or efficiency_score < 6; concerns if confidence < 0.4 or any major (medium-severity) finding; pass otherwise",
+        "verdict_rules": "fail if any blocker (critical/high) runtime-cost issue or efficiency_score < 6; concerns if confidence < 0.4 or any major (medium-severity) finding; pass otherwise; severity_gate_policy: an efficiency_score < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "distinct_from_economy": "Quality's `economy` axis measures DIFF SIZE (was this change bigger than the task needed?). Efficiency Monger's `efficiency_score` measures RUNTIME COST (will this code be expensive when it runs?). Both axes can be high (small AND fast); either can be low (small but slow, or large but fast). The panel records both separately.",
         "prompt_lives_in": "modules/grading/grader-workers/efficiency.js"
       }

package/modules/grading/grader-workers/efficiency.js

@@ -17,7 +17,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // SR-15 / G1 (#995): scrub + fence all builder-controlled inputs. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'efficiency';
 const NAME = 'Efficiency Monger';
@@ -191,7 +191,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Efficiency Monger — PASS (eff=${effR}/10, ${patternsChecked.length} pattern${patternsChecked.length === 1 ? '' : 's'} checked, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: { efficiency_score: effR },
     issues,
@@ -199,7 +199,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+  }), { threshold: THRESHOLD });
 }
 
 module.exports = {

package/modules/grading/grader-workers/hacker.js

@@ -217,6 +217,11 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Hacker — PASS (sec=${secR}/10, ${surfacesChecked.length} surface${surfacesChecked.length === 1 ? '' : 's'} checked, conf=${conf ?? '?'})`;
   }
 
+  // #1002663: the Hacker is deliberately EXEMPT from applySeverityGatePolicy.
+  // The security lens stays fail-closed on an unbacked sub-threshold score —
+  // a real finding the model mislabels as minor must still hard-fail, and the
+  // nit-churn evidence that motivated the policy was style/Quality-side, never
+  // security-score-driven.
   return finalizeVerdict({
     verdict,
     scores: { security_score: secR },

package/modules/grading/grader-workers/narc.js

@@ -16,7 +16,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // block the model is told to treat as DATA, never instructions. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'narc';
 const NAME = 'Narc';
@@ -185,7 +185,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Narc — PASS (ff=${ffR}/10, ${verifiedStr}, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: { functional_fidelity: ffR },
     issues,
@@ -193,7 +193,9 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+    // A missing AC is a substantive non-score fail basis — it routinely
+    // co-occurs with a sub-threshold ff and must never be downgraded.
+  }), { threshold: THRESHOLD, substantiveFail: missingCount > 0 });
 }
 
 module.exports = {

package/modules/grading/grader-workers/quality.js

@@ -14,7 +14,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // SR-15 / G1 (#995): scrub + fence all builder-controlled inputs. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'quality';
 const NAME = 'Quality';
@@ -174,7 +174,7 @@ function computeVerdict(parsed, meta = {}) {
       + `, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: {
       code_quality: cqR,
@@ -184,7 +184,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+  }), { threshold: THRESHOLD });
 }
 
 module.exports = {

package/modules/grading/grader-workers/worker-prompt.js

@@ -29,6 +29,18 @@ const LLM_PROJECT = (() => {
   catch { return 'this project'; }
 })();
 
+// #1002663 severity-gate policy, stated to every worker: style findings are
+// advisory and must never drive the verdict. Enforced deterministically in
+// worker-verdict.js applySeverityGatePolicy — this paragraph keeps the model's
+// self-reports consistent with that gate so downgrades stay rare.
+const STYLE_ADVISORY = [
+  '## Severity policy — style findings are ADVISORY',
+  '',
+  'Comment style/length/placement, naming conventions, documentation placement, and test-name conventions are severity `nit`, always. Record them in `issues[]` for the audit trail, but:',
+  '- never report a style finding at `major` or `blocker`;',
+  '- never let style concerns depress a numeric score below the pass threshold — a sub-threshold score MUST be backed by at least one `major` or `blocker` finding, or the verdict machinery downgrades your fail to concerns as an inconsistent self-report.',
+].join('\n');
+
 function buildWorkerPrompt({
   header, task, valueSummary, diff, changedFiles,
   taskHeader, descLabel, emptyFilesText, readFilesHint, finalInstruction,
@@ -82,6 +94,8 @@ function buildWorkerPrompt({
   lines.push('');
   lines.push(...fenceBlock('UNIFIED DIFF', diffText));
   lines.push('');
+  lines.push(STYLE_ADVISORY);
+  lines.push('');
   lines.push(finalInstruction);
   return lines.join('\n');
 }

package/modules/grading/grader-workers/worker-verdict.js

@@ -47,4 +47,33 @@ function finalizeVerdict({ verdict, scores, issues, extra = {}, notesPrefix, not
   };
 }
 
-module.exports = { failResult, parseCommon, finalizeVerdict };
+// #1002663 severity-gate policy: style findings are advisory, and a
+// sub-threshold score must be BACKED by a substantive finding. Every worker
+// prompt already demands "a score below threshold must be accompanied by a
+// major-or-blocker issue"; this makes that contract deterministic instead of
+// advisory prose the model can ignore. A 'fail' whose only basis is a
+// sub-threshold score with NO major/blocker finding is an inconsistent
+// self-report (style gripes leaking into the score channel — the task-1002653
+// regrade-churn class) and downgrades to 'concerns', which routes to the
+// manual-confirm pause rather than a hard panel FAIL. Deliberately untouched:
+// blocker-driven fails, non-score fail triggers (e.g. Narc's missing-AC),
+// and the error short-circuits — no per-worker security trigger is flattened.
+// `substantiveFail`: a worker whose fail has a NON-SCORE basis the policy
+// cannot see in issues[] (Narc's missing-AC — which routinely CO-OCCURS with a
+// sub-threshold ff) passes true so the downgrade never touches it. Without
+// this, missing-AC + low ff + no major issue read as an unbacked score fail.
+function applySeverityGatePolicy(result, { threshold, substantiveFail = false }) {
+  if (!result || result.error || result.verdict !== 'fail' || substantiveFail) return result;
+  const issues = Array.isArray(result.issues) ? result.issues : [];
+  if (issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'))) return result;
+  const reported = Object.values(result.scores || {}).filter((v) => Number.isFinite(v));
+  if (!reported.some((v) => v < threshold)) return result;
+  return {
+    ...result,
+    verdict: 'concerns',
+    policy_downgrade: 'subthreshold_score_without_substantive_finding',
+    notes_md: `${result.notes_md}\n[severity-gate] sub-threshold score with no major/blocker finding — fail downgraded to concerns (style findings are advisory)`.trim(),
+  };
+}
+
+module.exports = { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.30",
+  "version": "1.19.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.30",
+      "version": "1.19.31",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.30",
+  "version": "1.19.31",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -487,8 +487,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.28 with no explicit bump. run 31500810303. (task 1002620)
 //   1.19.30 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.29 with no explicit bump. run 31502880105. (task 1002620)
+//   1.19.31 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.30 with no explicit bump. run 31503461332. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.30'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.31'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -1267,12 +1267,15 @@ test('v4 narc: any partial AC → concerns', () => {
   assert.equal(v.verdict, 'concerns');
 });
 
-test('v4 narc: ff < threshold → fail', () => {
+// #1002663 severity-gate policy: a sub-threshold score must be BACKED by a
+// major/blocker finding to hard-fail; unbacked it downgrades to concerns
+// (tests/grader_severity_gate.mjs covers the downgrade shapes).
+test('v4 narc: ff < threshold backed by a major finding → fail', () => {
   const v = grader.WORKERS.narc.computeVerdict({
     functional_fidelity: 4,
     confidence: 0.9,
     ac_checklist: [{ ac: 'A', status: 'satisfied' }],
-    issues: [],
+    issues: [{ severity: 'major', file: 'x.js', summary: 'scope gap' }],
     notes_md: 'low score',
   }, {});
   assert.equal(v.verdict, 'fail');
@@ -1316,9 +1319,10 @@ test('v4 quality: blocker issue → fail', () => {
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 quality: cq < threshold → fail', () => {
+test('v4 quality: cq < threshold backed by a major issue → fail (#1002663 policy)', () => {
   const v = grader.WORKERS.quality.computeVerdict({
-    code_quality: 4, economy: 7, confidence: 0.9, issues: [], notes_md: '',
+    code_quality: 4, economy: 7, confidence: 0.9,
+    issues: [{ severity: 'major', file: 'x.js', summary: 'dead code path' }], notes_md: '',
   }, {});
   assert.equal(v.verdict, 'fail');
 });
@@ -1685,7 +1689,7 @@ test('v4 hacker: blocker (critical/high) issue → fail', () => {
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 hacker: security_score below threshold → fail', () => {
+test('v4 hacker: security_score below threshold → fail (EXEMPT from the #1002663 downgrade — fail-closed)', () => {
   const v = grader.WORKERS.hacker.computeVerdict({
     security_score: 4, confidence: 0.9, surfaces_checked: [], issues: [], notes_md: '',
   }, {});
@@ -1821,9 +1825,10 @@ test('v4 efficiency: blocker (N+1, O(n²), sync-I/O-on-hot-path) → fail', () =
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 efficiency: efficiency_score below threshold → fail', () => {
+test('v4 efficiency: efficiency_score below threshold backed by a major finding → fail (#1002663 policy)', () => {
   const v = grader.WORKERS.efficiency.computeVerdict({
-    efficiency_score: 4, confidence: 0.9, expensive_patterns_checked: [], issues: [], notes_md: '',
+    efficiency_score: 4, confidence: 0.9, expensive_patterns_checked: [],
+    issues: [{ severity: 'major', file: 'x.js', summary: 'N+1 in list view' }], notes_md: '',
   }, {});
   assert.equal(v.verdict, 'fail');
 });

package/tests/grader_severity_gate.mjs

@@ -0,0 +1,156 @@
+// tests/grader_severity_gate.mjs
+//
+// Unit tests for task 1002663 — the severity-gate policy: style findings are
+// ADVISORY, and a sub-threshold score must be BACKED by a major/blocker
+// finding. Evidence class (task 1002653, 2026-08-11): panel rounds hung on
+// comment-style nits, and the prompt line "a score below 6 must be accompanied
+// by a major-or-blocker issue" was advisory prose the model could ignore.
+// applySeverityGatePolicy (grader-workers/worker-verdict.js) makes it
+// deterministic: an unbacked sub-threshold 'fail' downgrades to 'concerns'
+// (manual-confirm pause), never a hard panel FAIL — while blocker-driven
+// fails, non-score triggers (Narc's missing-AC), and error short-circuits
+// stay exactly as they were.
+//
+// Run:  node tests/grader_severity_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { applySeverityGatePolicy, failResult } = require('../modules/grading/grader-workers/worker-verdict.js');
+const narc = require('../modules/grading/grader-workers/narc.js');
+const quality = require('../modules/grading/grader-workers/quality.js');
+const hacker = require('../modules/grading/grader-workers/hacker.js');
+const efficiency = require('../modules/grading/grader-workers/efficiency.js');
+
+const THRESHOLD = 6;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const nit = { severity: 'nit', file: 'x.js', summary: 'comment style' };
+const minor = { severity: 'minor', file: 'x.js', summary: 'small thing' };
+const major = { severity: 'major', file: 'x.js', summary: 'real problem' };
+const blocker = { severity: 'blocker', file: 'x.js', summary: 'must fix' };
+
+// ---- applySeverityGatePolicy unit ----------------------------------------
+
+test('unbacked sub-threshold fail (only nits/minors) → concerns with policy_downgrade', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 5 }, issues: [nit, minor], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'concerns');
+  assert.equal(r.policy_downgrade, 'subthreshold_score_without_substantive_finding');
+  assert.match(r.notes_md, /severity-gate/);
+});
+
+test('sub-threshold fail BACKED by a major stays fail', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 5 }, issues: [major], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('blocker-driven fail with passing scores stays fail (no security trigger flattened)', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { security_score: 9 }, issues: [blocker], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+});
+
+test('non-score fail trigger (no sub-threshold score, no issues) stays fail — the Narc missing-AC shape', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { functional_fidelity: 7 }, issues: [], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+});
+
+test('error short-circuits are untouched', () => {
+  const r = applySeverityGatePolicy(failResult({ notesMd: 'boom', error: 'subprocess_error' }), { threshold: THRESHOLD });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.error, 'subprocess_error');
+});
+
+test('pass and concerns verdicts are untouched', () => {
+  for (const verdict of ['pass', 'concerns']) {
+    const r = applySeverityGatePolicy(
+      { verdict, scores: { code_quality: 5 }, issues: [nit], notes_md: 'n', confidence: 0.9, error: null },
+      { threshold: THRESHOLD }
+    );
+    assert.equal(r.verdict, verdict);
+  }
+});
+
+// ---- worker integration ---------------------------------------------------
+
+test('quality: cq=5 with only nits → concerns (not fail)', () => {
+  const r = quality.computeVerdict({ code_quality: 5, economy: 8, confidence: 0.9, issues: [nit], notes_md: '' });
+  assert.equal(r.verdict, 'concerns');
+  assert.equal(r.policy_downgrade, 'subthreshold_score_without_substantive_finding');
+});
+
+test('quality: cq=5 with a major → fail stays', () => {
+  const r = quality.computeVerdict({ code_quality: 5, economy: 8, confidence: 0.9, issues: [major], notes_md: '' });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('quality: blocker with cq=9 → fail stays', () => {
+  const r = quality.computeVerdict({ code_quality: 9, economy: 8, confidence: 0.9, issues: [blocker], notes_md: '' });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('hacker is EXEMPT: security_score=5 with only a nit stays a hard fail (security lens fail-closed)', () => {
+  const r = hacker.computeVerdict({ security_score: 5, confidence: 0.9, issues: [nit], notes_md: '', surfaces_checked: [] });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('efficiency: eff=5 with only a minor → concerns (not fail)', () => {
+  const r = efficiency.computeVerdict({ efficiency_score: 5, confidence: 0.9, issues: [minor], notes_md: '', expensive_patterns_checked: [] });
+  assert.equal(r.verdict, 'concerns');
+});
+
+test('narc: missing AC with ff=7 and no issues → fail stays (non-score trigger untouched)', () => {
+  const r = narc.computeVerdict({
+    functional_fidelity: 7, confidence: 0.9, issues: [], notes_md: '',
+    ac_checklist: [{ ac: 'does the thing', status: 'missing' }],
+  });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('narc: missing AC CO-OCCURRING with sub-threshold ff and no issues → fail stays (the common shape)', () => {
+  const r = narc.computeVerdict({
+    functional_fidelity: 4, confidence: 0.9, issues: [], notes_md: '',
+    ac_checklist: [{ ac: 'does the thing', status: 'missing' }],
+  });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('narc: ff=5 with only nits → concerns (not fail)', () => {
+  const r = narc.computeVerdict({ functional_fidelity: 5, confidence: 0.9, issues: [nit], notes_md: '', ac_checklist: [] });
+  assert.equal(r.verdict, 'concerns');
+});
+
+// ---- prompt carries the policy -------------------------------------------
+
+test('every worker prompt carries the STYLE_ADVISORY paragraph', () => {
+  const args = { task: { id: 1, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' }, valueSummary: 'v', diff: '+ x', changedFiles: ['x.js'] };
+  for (const w of [narc, quality, hacker, efficiency]) {
+    const p = w.buildPrompt(args);
+    assert.match(p, /Severity policy — style findings are ADVISORY/, `${w.KIND || 'worker'} prompt must carry the policy`);
+    assert.match(p, /never report a style finding at `major`/);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);