@bongos/core 1.19.30 → 1.19.32

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.30",
-  "core_contract": "1.19.30",
-  "source_commit": "103b0c420b448f90a8f42f923f4e67891c45b210",
+  "core_version": "1.19.32",
+  "core_contract": "1.19.32",
+  "source_commit": "a4f8a4de7d7d7ba6d7799a4d20c54e83abf3e5fe",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T14:41:56.292Z",
+  "built_at": "2026-08-11T15:03:03.893Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 286,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1206,
+    "functional_verbatim": 1207,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1513,
-  "tree_sha256": "66f1b7a904b38f7980ead45fe34e98228990e4be951b312f807251687b13d098",
+  "file_count": 1514,
+  "tree_sha256": "e1a52404d82bbbff5229cd5f74279ae8499982944367cf7102600a9169f2faba",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7e6732aedaf7aaa3c657fc05e2dfd1dcc63e0fb06586d4077248d79d6198297e"
+      "sha256": "649065862779b6a9b871607debfee5ca18bde8cccbde4d00ea42b0d175938c9d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1282,12 +1282,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "e28575936d1cb0cce684b20723743fd0d801ccd0a7ec58fff5360e160b23b5e7"
+      "sha256": "8f83ea78edb348688196414bf2fb7352df3de0ded6abbbe44f2371c099431016"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b232ca69ae97842be312b76f6ac49ca66090c5c8fef392f609bb857e5f5c2979"
+      "sha256": "27cf9c2b8548168f13dd2add1633bc9b3ca57f2fd5aa3b42ac8dbfb5cf60c41f"
     },
     {
       "path": "docs/architecture.md",
@@ -2837,12 +2837,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "52dfa2cde50170d982cc816da444fe1d1cf79814104cc9452aee1d658474556e"
+      "sha256": "6917875f2be5c39248b44caf7bf8d50f68cbe8effbc2bfdef3ba11e5ac17fc6c"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
       "mode": "0000644",
-      "sha256": "6163aa89c558269267decf1ed91d6fc65939f27a34baf67364af01f8e6204cc1"
+      "sha256": "9b8bbb51c5d8641d1c145d90ad8d0d96d19466abd8777bd10d5819630a6b7066"
     },
     {
       "path": "modules/grading/grader-workers/extract-json.js",
@@ -2857,7 +2857,7 @@
     {
       "path": "modules/grading/grader-workers/hacker.js",
       "mode": "0000644",
-      "sha256": "be6e82997286141f1c561c496ce1a717591d2b2bed9d5cee1f7af73770bc526c"
+      "sha256": "99f64187efc56c2edf5a41626f87ee4083e83da43f1a00628d3506929d42e3c2"
     },
     {
       "path": "modules/grading/grader-workers/index.js",
@@ -2867,12 +2867,12 @@
     {
       "path": "modules/grading/grader-workers/narc.js",
       "mode": "0000644",
-      "sha256": "c034baa7e0973cbbf09f54305ed1ee8cb90c9642088edd6b45b63504ba267435"
+      "sha256": "4e881e6d04bafcf6093be0e1c653979d00c174b6f7966fb9cd3d833a994f48d3"
     },
     {
       "path": "modules/grading/grader-workers/quality.js",
       "mode": "0000644",
-      "sha256": "7a64a9c4bb97b791be3e7ca8fe17164b80ae30aca968ac05a0229a6e4926b05e"
+      "sha256": "de6003eb2af2abca2e6d68ebab729c8a3e18f0b8514d9f14e65b9442c21df253"
     },
     {
       "path": "modules/grading/grader-workers/rubric.js",
@@ -2882,12 +2882,12 @@
     {
       "path": "modules/grading/grader-workers/worker-prompt.js",
       "mode": "0000644",
-      "sha256": "017536ca8d35b1bb9b893a4fa7402d1f13f36c2e4c12585b9f296971080fa19c"
+      "sha256": "f691b0a42984a9e768477ab694bf7d7bc92264d4bb6d5f50ea52fc0e79abbfb1"
     },
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
       "mode": "0000644",
-      "sha256": "8185aa753112fe66a13c2ce650ef21b9a832413e70fbebc8ff048aa8e7aae5d1"
+      "sha256": "9c3abb069cfdee124b4fd5c521fe1c11b44177f7af941c9ab7bbb2a4a3718bab"
     },
     {
       "path": "modules/grading/grader.js",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "85c856016e548399538734098d2f08d3920fb52814759ffa314ed26d98bf32eb"
+      "sha256": "b2927d0be39718b274dda102c0d9d9035d323d1c60937ea7cd7a216315d5dc64"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3467,7 +3467,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "aa179ab79508a002e8f580fb839767d8aaa8b6f02a46d021bb61633dd9f8f9a4"
+      "sha256": "8a6ecd6c7ecadcbec79483a589fef11957d13e2c94b569a9ff9da97f2908b713"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4012,12 +4012,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f1d885c73d1c6d6c7a1b5762e022f575045e320aa8e0fcfcaf3e9f00153fe8d5"
+      "sha256": "ef48567990e07bdcd64ae5199d809b152d43b9bcae316adc4ddf6f9358f02d18"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ef7a211fb70fc0316e3146e7a35a09617ea7fc2e275e8b06af61da04da94db51"
+      "sha256": "d9078dd247c8d55e21bf2fb79a2b406a9d4901498284713e56954610b2b45e58"
     },
     {
       "path": "public-docs/index.html",
@@ -5637,7 +5637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "696cdcbb043dc4b0792302807c0130d348e83d7d2e8b2fc992805f31a4a3d677"
+      "sha256": "b5517fa6cc30948cc76d4acecb2171d2f5a9854f557c4c6ee41e1e2315db643e"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6607,7 +6607,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "4832bcffc7385cdd8deb0c1ff9bb44542190a3da106d2f00ccacd823c90103ec"
+      "sha256": "9c8525b85be898be30d6034902b34fcdedb16cf4b37fa8d79fbd5d1fb89898cb"
     },
     {
       "path": "tests/grader_bypass.mjs",
@@ -6624,6 +6624,11 @@
       "mode": "0000644",
       "sha256": "fa155f3c5faa3763d1a51d56b7746ad870e826e3249f5e9b08108a3cfbfcbd72"
     },
+    {
+      "path": "tests/grader_severity_gate.mjs",
+      "mode": "0000644",
+      "sha256": "956384c2334742858dba987fe042b6c26581875ed5981a7565d43e46b55dfc49"
+    },
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
@@ -6827,7 +6832,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "f014dee000483e41d01d41bc53361b81deba8ff1b21e5810aaf9200d65b8f366"
+      "sha256": "10b1faf40cef2a3872c44109b63680e79922446b573bb476c79540d44a5622ac"
     },
     {
       "path": "tests/migration_namespace.mjs",

package/clients/bongos-client/index.d.ts

@@ -131,7 +131,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
 export interface PostAuthAppPairApproveRequest { pair_code: string }

package/docs/api/openapi.json

@@ -13789,6 +13789,9 @@
             "type": "string",
             "maxLength": 64
           },
+          "needs_migration": {
+            "type": "boolean"
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -463,7 +463,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — | reads (filtered task list); preserved per CRITICAL §4. |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/grading/grader-rubric.json

@@ -32,17 +32,18 @@
       "concerns": "ANY worker.verdict='concerns' (and no fails) → overall passed=false, forwarded confidence = fallthrough_confidence (manual-confirm available).",
       "pass": "ALL workers.verdict='pass' → overall passed=true, advance to confirmed."
     },
+    "severity_gate_policy": "Task 1002663: style findings (comment style/length/placement, naming conventions, doc placement, test-name conventions) are ADVISORY — severity nit, recorded in issues[] for the audit trail, never a verdict driver. Enforced deterministically in grader-workers/worker-verdict.js applySeverityGatePolicy for narc/quality/efficiency: a worker 'fail' whose only basis is a sub-threshold score with NO major/blocker finding is an inconsistent self-report and downgrades to 'concerns' (manual-confirm pause) — a worker whose findings are all nit/minor can never verdict fail. The HACKER is deliberately EXEMPT: the security lens stays fail-closed on an unbacked sub-threshold score (a real finding mislabeled minor must still hard-fail). Untouched everywhere: blocker-driven fails, non-score fail triggers (Narc missing-AC), error short-circuits. Every worker prompt carries the matching STYLE_ADVISORY paragraph (worker-prompt.js).",
     "active_workers": {
       "narc": {
         "specialty": "semantic completion (description vs diff, line-level)",
         "scores_reported": ["functional_fidelity"],
-        "verdict_rules": "fail if any blocker issue, any AC marked 'missing', or ff < 6; concerns if any AC 'partial' OR confidence < 0.4; pass otherwise",
+        "verdict_rules": "fail if any blocker issue, any AC marked 'missing', or ff < 6; concerns if any AC 'partial' OR confidence < 0.4; pass otherwise; severity_gate_policy: an ff < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "prompt_lives_in": "modules/grading/grader-workers/narc.js"
       },
       "quality": {
         "specialty": "code quality (idiom, dead code, tests, invariants) + economy (advisory)",
         "scores_reported": ["code_quality", "economy"],
-        "verdict_rules": "fail if any blocker issue or cq < 6; concerns if confidence < 0.4, economy < 6 (advisory nudge), or any major issue; pass otherwise",
+        "verdict_rules": "fail if any blocker issue or cq < 6; concerns if confidence < 0.4, economy < 6 (advisory nudge), or any major issue; pass otherwise; severity_gate_policy: a cq < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "prompt_lives_in": "modules/grading/grader-workers/quality.js"
       },
       "hacker": {
@@ -55,7 +56,7 @@
       "efficiency": {
         "specialty": "runtime cost / hot-path performance (N+1, O(n²), sync I/O, unbounded queries)",
         "scores_reported": ["efficiency_score"],
-        "verdict_rules": "fail if any blocker (critical/high) runtime-cost issue or efficiency_score < 6; concerns if confidence < 0.4 or any major (medium-severity) finding; pass otherwise",
+        "verdict_rules": "fail if any blocker (critical/high) runtime-cost issue or efficiency_score < 6; concerns if confidence < 0.4 or any major (medium-severity) finding; pass otherwise; severity_gate_policy: an efficiency_score < 6 with no major/blocker finding downgrades fail → concerns (style findings are advisory)",
         "distinct_from_economy": "Quality's `economy` axis measures DIFF SIZE (was this change bigger than the task needed?). Efficiency Monger's `efficiency_score` measures RUNTIME COST (will this code be expensive when it runs?). Both axes can be high (small AND fast); either can be low (small but slow, or large but fast). The panel records both separately.",
         "prompt_lives_in": "modules/grading/grader-workers/efficiency.js"
       }

package/modules/grading/grader-workers/efficiency.js

@@ -17,7 +17,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // SR-15 / G1 (#995): scrub + fence all builder-controlled inputs. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'efficiency';
 const NAME = 'Efficiency Monger';
@@ -191,7 +191,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Efficiency Monger — PASS (eff=${effR}/10, ${patternsChecked.length} pattern${patternsChecked.length === 1 ? '' : 's'} checked, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: { efficiency_score: effR },
     issues,
@@ -199,7 +199,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+  }), { threshold: THRESHOLD });
 }
 
 module.exports = {

package/modules/grading/grader-workers/hacker.js

@@ -217,6 +217,11 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Hacker — PASS (sec=${secR}/10, ${surfacesChecked.length} surface${surfacesChecked.length === 1 ? '' : 's'} checked, conf=${conf ?? '?'})`;
   }
 
+  // #1002663: the Hacker is deliberately EXEMPT from applySeverityGatePolicy.
+  // The security lens stays fail-closed on an unbacked sub-threshold score —
+  // a real finding the model mislabels as minor must still hard-fail, and the
+  // nit-churn evidence that motivated the policy was style/Quality-side, never
+  // security-score-driven.
   return finalizeVerdict({
     verdict,
     scores: { security_score: secR },

package/modules/grading/grader-workers/narc.js

@@ -16,7 +16,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // block the model is told to treat as DATA, never instructions. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'narc';
 const NAME = 'Narc';
@@ -185,7 +185,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix = `Narc — PASS (ff=${ffR}/10, ${verifiedStr}, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: { functional_fidelity: ffR },
     issues,
@@ -193,7 +193,9 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+    // A missing AC is a substantive non-score fail basis — it routinely
+    // co-occurs with a sub-threshold ff and must never be downgraded.
+  }), { threshold: THRESHOLD, substantiveFail: missingCount > 0 });
 }
 
 module.exports = {

package/modules/grading/grader-workers/quality.js

@@ -14,7 +14,7 @@ const { THRESHOLD, LOW_CONF } = require('./rubric');
 // SR-15 / G1 (#995): scrub + fence all builder-controlled inputs. The shared
 // scaffold (worker-prompt) owns fenceBlock/scrubUntrusted/NOFOLLOW_PREAMBLE.
 const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
-const { failResult, parseCommon, finalizeVerdict } = require('./worker-verdict');
+const { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy } = require('./worker-verdict');
 
 const KIND = 'quality';
 const NAME = 'Quality';
@@ -174,7 +174,7 @@ function computeVerdict(parsed, meta = {}) {
       + `, conf=${conf ?? '?'})`;
   }
 
-  return finalizeVerdict({
+  return applySeverityGatePolicy(finalizeVerdict({
     verdict,
     scores: {
       code_quality: cqR,
@@ -184,7 +184,7 @@ function computeVerdict(parsed, meta = {}) {
     notesPrefix,
     notesFromSubagent,
     confidence: conf,
-  });
+  }), { threshold: THRESHOLD });
 }
 
 module.exports = {

package/modules/grading/grader-workers/worker-prompt.js

@@ -29,6 +29,18 @@ const LLM_PROJECT = (() => {
   catch { return 'this project'; }
 })();
 
+// #1002663 severity-gate policy, stated to every worker: style findings are
+// advisory and must never drive the verdict. Enforced deterministically in
+// worker-verdict.js applySeverityGatePolicy — this paragraph keeps the model's
+// self-reports consistent with that gate so downgrades stay rare.
+const STYLE_ADVISORY = [
+  '## Severity policy — style findings are ADVISORY',
+  '',
+  'Comment style/length/placement, naming conventions, documentation placement, and test-name conventions are severity `nit`, always. Record them in `issues[]` for the audit trail, but:',
+  '- never report a style finding at `major` or `blocker`;',
+  '- never let style concerns depress a numeric score below the pass threshold — a sub-threshold score MUST be backed by at least one `major` or `blocker` finding, or the verdict machinery downgrades your fail to concerns as an inconsistent self-report.',
+].join('\n');
+
 function buildWorkerPrompt({
   header, task, valueSummary, diff, changedFiles,
   taskHeader, descLabel, emptyFilesText, readFilesHint, finalInstruction,
@@ -82,6 +94,8 @@ function buildWorkerPrompt({
   lines.push('');
   lines.push(...fenceBlock('UNIFIED DIFF', diffText));
   lines.push('');
+  lines.push(STYLE_ADVISORY);
+  lines.push('');
   lines.push(finalInstruction);
   return lines.join('\n');
 }

package/modules/grading/grader-workers/worker-verdict.js

@@ -47,4 +47,33 @@ function finalizeVerdict({ verdict, scores, issues, extra = {}, notesPrefix, not
   };
 }
 
-module.exports = { failResult, parseCommon, finalizeVerdict };
+// #1002663 severity-gate policy: style findings are advisory, and a
+// sub-threshold score must be BACKED by a substantive finding. Every worker
+// prompt already demands "a score below threshold must be accompanied by a
+// major-or-blocker issue"; this makes that contract deterministic instead of
+// advisory prose the model can ignore. A 'fail' whose only basis is a
+// sub-threshold score with NO major/blocker finding is an inconsistent
+// self-report (style gripes leaking into the score channel — the task-1002653
+// regrade-churn class) and downgrades to 'concerns', which routes to the
+// manual-confirm pause rather than a hard panel FAIL. Deliberately untouched:
+// blocker-driven fails, non-score fail triggers (e.g. Narc's missing-AC),
+// and the error short-circuits — no per-worker security trigger is flattened.
+// `substantiveFail`: a worker whose fail has a NON-SCORE basis the policy
+// cannot see in issues[] (Narc's missing-AC — which routinely CO-OCCURS with a
+// sub-threshold ff) passes true so the downgrade never touches it. Without
+// this, missing-AC + low ff + no major issue read as an unbacked score fail.
+function applySeverityGatePolicy(result, { threshold, substantiveFail = false }) {
+  if (!result || result.error || result.verdict !== 'fail' || substantiveFail) return result;
+  const issues = Array.isArray(result.issues) ? result.issues : [];
+  if (issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'))) return result;
+  const reported = Object.values(result.scores || {}).filter((v) => Number.isFinite(v));
+  if (!reported.some((v) => v < threshold)) return result;
+  return {
+    ...result,
+    verdict: 'concerns',
+    policy_downgrade: 'subthreshold_score_without_substantive_finding',
+    notes_md: `${result.notes_md}\n[severity-gate] sub-threshold score with no major/blocker finding — fail downgraded to concerns (style findings are advisory)`.trim(),
+  };
+}
+
+module.exports = { failResult, parseCommon, finalizeVerdict, applySeverityGatePolicy };

package/modules/lifecycle/db.js

@@ -1686,6 +1686,11 @@ async function updateTaskParallelSafe(id, parallelSafe) { return updateTaskColum
 
 async function updateTaskAutomationTag(id, automationTag) { return updateTaskColumn(id, 'automation_tag', automationTag); }
 
+// task 1002648: correct the create-time migration heuristic's verdict — a false
+// flag makes claiming reserve a migration number that goes unused (task 1002614
+// burned 213 that way). Boolean only; the route validates.
+async function updateTaskNeedsMigration(id, needsMigration) { return updateTaskColumn(id, 'needs_migration', needsMigration === true); }
+
 // BV1.R53 (task 1422): assign (or clear) the module_key that declares which
 // module this task's work belongs to. Drives module-disjointness at claim time
 // and diff⊆module enforcement at ship time. Accepts any key in MODULE_SCOPE_MAP,
@@ -5441,6 +5446,7 @@ module.exports = {
   updateTaskParallelSafe,
   updateTaskSecuritySensitive,
   updateTaskAutomationTag,
+  updateTaskNeedsMigration,
   updateTaskModuleKey,
   listClaimableTasks,
   capNewcomerTasks,

package/modules/lifecycle/routes/tasks.js

@@ -69,8 +69,27 @@ const VALID_FITS = new Set(['autonomous', 'parallel']);
 const MIGRATION_KEYWORD_RE =
   /\bmigrations?\b|\bschema\b|\balter\s+table\b|\bcreate\s+table\b/i;
 
+// task 1002648 (idea 1000642): compounds where the keyword is qualified by a
+// NON-database noun are refactor/API language, not schema work, and are blanked
+// before the keyword test. Two families surfaced in the wild: "gate/route/code
+// migration" (code-migration phrasing) and "request/PATCH/:NNN schema"
+// (API-shape phrasing — the task-1002614 false positive, which reserved
+// migration 213 for zero schema change). Bare "migration"/"schema" and every
+// DB-shaped compound ("schema migration", "DB schema") still flag.
+const NON_DB_COMPOUND_RE = new RegExp(
+  [
+    /\b(?:gate|route|code)s?[-\s]+migrations?\b/.source,
+    /\bmigrations?\s+of\s+(?:gate|route|code)s?\b/.source,
+    /\b(?:request|response|body|validation|patch|post|put|delete|json|openapi|api|error)[-\s]+schemas?\b/.source,
+    /:\d+[-\s]+schemas?\b/.source,
+  ].join('|'),
+  'gi'
+);
+
 function detectsMigration(...texts) {
-  return texts.some((t) => typeof t === 'string' && MIGRATION_KEYWORD_RE.test(t));
+  return texts.some(
+    (t) => typeof t === 'string' && MIGRATION_KEYWORD_RE.test(t.replace(NON_DB_COMPOUND_RE, ' '))
+  );
 }
 
 // ---- peer votes (V3.R25 #245) ---------------------------------------------
@@ -773,6 +792,7 @@ module.exports = function buildTasksRouter() {
       xenos_claimable: { type: 'boolean' },              // pre-rename alias for newcomer_friendly
       security_sensitive: { type: 'boolean' },           // task 990 — Archon-only ship broadcast
       automation_tag: { type: 'string', maxLength: 64 },
+      needs_migration: { type: 'boolean' },              // task 1002648 — correct the create-time heuristic's flag (the claim-time allocator keys off it)
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -794,6 +814,7 @@ module.exports = function buildTasksRouter() {
     const hasParallelSafe = Object.prototype.hasOwnProperty.call(body, 'parallel_safe');
     const hasSecuritySensitive = Object.prototype.hasOwnProperty.call(body, 'security_sensitive');
     const hasAutomationTag = Object.prototype.hasOwnProperty.call(body, 'automation_tag');
+    const hasNeedsMigration = Object.prototype.hasOwnProperty.call(body, 'needs_migration');
     const hasRequiresRank = Object.prototype.hasOwnProperty.call(body, 'requires_rank');
     const hasModuleKey = Object.prototype.hasOwnProperty.call(body, 'module_key');
     const hasGoalId = Object.prototype.hasOwnProperty.call(body, 'goal_id');
@@ -808,8 +829,8 @@ module.exports = function buildTasksRouter() {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -937,6 +958,15 @@ module.exports = function buildTasksRouter() {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasNeedsMigration) {
+      try {
+        updated = await db.updateTaskNeedsMigration(id, body.needs_migration);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id needs_migration', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasModuleKey) {
       try {
         updated = await db.updateTaskModuleKey(id, body.module_key ?? null);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.30",
+  "version": "1.19.32",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.30",
+      "version": "1.19.32",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.30",
+  "version": "1.19.32",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -487,8 +487,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.28 with no explicit bump. run 31500810303. (task 1002620)
 //   1.19.30 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.29 with no explicit bump. run 31502880105. (task 1002620)
+//   1.19.31 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.30 with no explicit bump. run 31503461332. (task 1002620)
+//   1.19.32 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.31 with no explicit bump. run 31504858325. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.30'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.32'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -1267,12 +1267,15 @@ test('v4 narc: any partial AC → concerns', () => {
   assert.equal(v.verdict, 'concerns');
 });
 
-test('v4 narc: ff < threshold → fail', () => {
+// #1002663 severity-gate policy: a sub-threshold score must be BACKED by a
+// major/blocker finding to hard-fail; unbacked it downgrades to concerns
+// (tests/grader_severity_gate.mjs covers the downgrade shapes).
+test('v4 narc: ff < threshold backed by a major finding → fail', () => {
   const v = grader.WORKERS.narc.computeVerdict({
     functional_fidelity: 4,
     confidence: 0.9,
     ac_checklist: [{ ac: 'A', status: 'satisfied' }],
-    issues: [],
+    issues: [{ severity: 'major', file: 'x.js', summary: 'scope gap' }],
     notes_md: 'low score',
   }, {});
   assert.equal(v.verdict, 'fail');
@@ -1316,9 +1319,10 @@ test('v4 quality: blocker issue → fail', () => {
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 quality: cq < threshold → fail', () => {
+test('v4 quality: cq < threshold backed by a major issue → fail (#1002663 policy)', () => {
   const v = grader.WORKERS.quality.computeVerdict({
-    code_quality: 4, economy: 7, confidence: 0.9, issues: [], notes_md: '',
+    code_quality: 4, economy: 7, confidence: 0.9,
+    issues: [{ severity: 'major', file: 'x.js', summary: 'dead code path' }], notes_md: '',
   }, {});
   assert.equal(v.verdict, 'fail');
 });
@@ -1685,7 +1689,7 @@ test('v4 hacker: blocker (critical/high) issue → fail', () => {
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 hacker: security_score below threshold → fail', () => {
+test('v4 hacker: security_score below threshold → fail (EXEMPT from the #1002663 downgrade — fail-closed)', () => {
   const v = grader.WORKERS.hacker.computeVerdict({
     security_score: 4, confidence: 0.9, surfaces_checked: [], issues: [], notes_md: '',
   }, {});
@@ -1821,9 +1825,10 @@ test('v4 efficiency: blocker (N+1, O(n²), sync-I/O-on-hot-path) → fail', () =
   assert.equal(v.verdict, 'fail');
 });
 
-test('v4 efficiency: efficiency_score below threshold → fail', () => {
+test('v4 efficiency: efficiency_score below threshold backed by a major finding → fail (#1002663 policy)', () => {
   const v = grader.WORKERS.efficiency.computeVerdict({
-    efficiency_score: 4, confidence: 0.9, expensive_patterns_checked: [], issues: [], notes_md: '',
+    efficiency_score: 4, confidence: 0.9, expensive_patterns_checked: [],
+    issues: [{ severity: 'major', file: 'x.js', summary: 'N+1 in list view' }], notes_md: '',
   }, {});
   assert.equal(v.verdict, 'fail');
 });

package/tests/grader_severity_gate.mjs

@@ -0,0 +1,156 @@
+// tests/grader_severity_gate.mjs
+//
+// Unit tests for task 1002663 — the severity-gate policy: style findings are
+// ADVISORY, and a sub-threshold score must be BACKED by a major/blocker
+// finding. Evidence class (task 1002653, 2026-08-11): panel rounds hung on
+// comment-style nits, and the prompt line "a score below 6 must be accompanied
+// by a major-or-blocker issue" was advisory prose the model could ignore.
+// applySeverityGatePolicy (grader-workers/worker-verdict.js) makes it
+// deterministic: an unbacked sub-threshold 'fail' downgrades to 'concerns'
+// (manual-confirm pause), never a hard panel FAIL — while blocker-driven
+// fails, non-score triggers (Narc's missing-AC), and error short-circuits
+// stay exactly as they were.
+//
+// Run:  node tests/grader_severity_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { applySeverityGatePolicy, failResult } = require('../modules/grading/grader-workers/worker-verdict.js');
+const narc = require('../modules/grading/grader-workers/narc.js');
+const quality = require('../modules/grading/grader-workers/quality.js');
+const hacker = require('../modules/grading/grader-workers/hacker.js');
+const efficiency = require('../modules/grading/grader-workers/efficiency.js');
+
+const THRESHOLD = 6;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const nit = { severity: 'nit', file: 'x.js', summary: 'comment style' };
+const minor = { severity: 'minor', file: 'x.js', summary: 'small thing' };
+const major = { severity: 'major', file: 'x.js', summary: 'real problem' };
+const blocker = { severity: 'blocker', file: 'x.js', summary: 'must fix' };
+
+// ---- applySeverityGatePolicy unit ----------------------------------------
+
+test('unbacked sub-threshold fail (only nits/minors) → concerns with policy_downgrade', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 5 }, issues: [nit, minor], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'concerns');
+  assert.equal(r.policy_downgrade, 'subthreshold_score_without_substantive_finding');
+  assert.match(r.notes_md, /severity-gate/);
+});
+
+test('sub-threshold fail BACKED by a major stays fail', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 5 }, issues: [major], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('blocker-driven fail with passing scores stays fail (no security trigger flattened)', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { security_score: 9 }, issues: [blocker], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+});
+
+test('non-score fail trigger (no sub-threshold score, no issues) stays fail — the Narc missing-AC shape', () => {
+  const r = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { functional_fidelity: 7 }, issues: [], notes_md: 'n', confidence: 0.9, error: null },
+    { threshold: THRESHOLD }
+  );
+  assert.equal(r.verdict, 'fail');
+});
+
+test('error short-circuits are untouched', () => {
+  const r = applySeverityGatePolicy(failResult({ notesMd: 'boom', error: 'subprocess_error' }), { threshold: THRESHOLD });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.error, 'subprocess_error');
+});
+
+test('pass and concerns verdicts are untouched', () => {
+  for (const verdict of ['pass', 'concerns']) {
+    const r = applySeverityGatePolicy(
+      { verdict, scores: { code_quality: 5 }, issues: [nit], notes_md: 'n', confidence: 0.9, error: null },
+      { threshold: THRESHOLD }
+    );
+    assert.equal(r.verdict, verdict);
+  }
+});
+
+// ---- worker integration ---------------------------------------------------
+
+test('quality: cq=5 with only nits → concerns (not fail)', () => {
+  const r = quality.computeVerdict({ code_quality: 5, economy: 8, confidence: 0.9, issues: [nit], notes_md: '' });
+  assert.equal(r.verdict, 'concerns');
+  assert.equal(r.policy_downgrade, 'subthreshold_score_without_substantive_finding');
+});
+
+test('quality: cq=5 with a major → fail stays', () => {
+  const r = quality.computeVerdict({ code_quality: 5, economy: 8, confidence: 0.9, issues: [major], notes_md: '' });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('quality: blocker with cq=9 → fail stays', () => {
+  const r = quality.computeVerdict({ code_quality: 9, economy: 8, confidence: 0.9, issues: [blocker], notes_md: '' });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('hacker is EXEMPT: security_score=5 with only a nit stays a hard fail (security lens fail-closed)', () => {
+  const r = hacker.computeVerdict({ security_score: 5, confidence: 0.9, issues: [nit], notes_md: '', surfaces_checked: [] });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('efficiency: eff=5 with only a minor → concerns (not fail)', () => {
+  const r = efficiency.computeVerdict({ efficiency_score: 5, confidence: 0.9, issues: [minor], notes_md: '', expensive_patterns_checked: [] });
+  assert.equal(r.verdict, 'concerns');
+});
+
+test('narc: missing AC with ff=7 and no issues → fail stays (non-score trigger untouched)', () => {
+  const r = narc.computeVerdict({
+    functional_fidelity: 7, confidence: 0.9, issues: [], notes_md: '',
+    ac_checklist: [{ ac: 'does the thing', status: 'missing' }],
+  });
+  assert.equal(r.verdict, 'fail');
+});
+
+test('narc: missing AC CO-OCCURRING with sub-threshold ff and no issues → fail stays (the common shape)', () => {
+  const r = narc.computeVerdict({
+    functional_fidelity: 4, confidence: 0.9, issues: [], notes_md: '',
+    ac_checklist: [{ ac: 'does the thing', status: 'missing' }],
+  });
+  assert.equal(r.verdict, 'fail');
+  assert.equal(r.policy_downgrade, undefined);
+});
+
+test('narc: ff=5 with only nits → concerns (not fail)', () => {
+  const r = narc.computeVerdict({ functional_fidelity: 5, confidence: 0.9, issues: [nit], notes_md: '', ac_checklist: [] });
+  assert.equal(r.verdict, 'concerns');
+});
+
+// ---- prompt carries the policy -------------------------------------------
+
+test('every worker prompt carries the STYLE_ADVISORY paragraph', () => {
+  const args = { task: { id: 1, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' }, valueSummary: 'v', diff: '+ x', changedFiles: ['x.js'] };
+  for (const w of [narc, quality, hacker, efficiency]) {
+    const p = w.buildPrompt(args);
+    assert.match(p, /Severity policy — style findings are ADVISORY/, `${w.KIND || 'worker'} prompt must carry the policy`);
+    assert.match(p, /never report a style finding at `major`/);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/migration_allocation.mjs

@@ -27,6 +27,7 @@ import { strict as assert } from 'node:assert';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -141,6 +142,56 @@ function shouldReserveMigrationNumber(task) {
     );
   });
 
+  // ---- task 1002648 (idea 1000642): the classifier must not flag non-DB ----
+  // "migration"/"schema" compounds, and a wrong verdict must be correctable
+  // via PATCH. Behavioral tests use the real exported detectsMigration.
+  const require = createRequire(import.meta.url);
+  const { detectsMigration } = require('../modules/lifecycle/routes/tasks.js');
+
+  await test('classifier ignores code-migration and API-schema phrasing (task 1002648)', () => {
+    const falsePositives = [
+      'gate migration cleanup across the router',
+      'finish the route-migration started in R86',
+      'the migration of gates to the new catalog',
+      // the task-1002614 repro — reserved migration 213 for zero schema change:
+      'the PATCH schema declares 11 keys and description is not among them',
+      'status is undeclared in the :751 schema, so strict-mode validation returns unknown_field first',
+      'align the request schema with the response schema',
+    ];
+    for (const text of falsePositives) {
+      assert.equal(detectsMigration(text), false, `must NOT flag: ${JSON.stringify(text)}`);
+    }
+  });
+
+  await test('classifier still flags real schema work (regression)', () => {
+    const truePositives = [
+      'add a migration to backfill the marker',
+      'ALTER TABLE builders add a column',
+      'create table for the new ledger',
+      'schema change on tasks',
+      'a schema migration for the counter floor',
+      'apply migrations/ before deploy',
+    ];
+    for (const text of truePositives) {
+      assert.equal(detectsMigration(text), true, `must flag: ${JSON.stringify(text)}`);
+    }
+  });
+
+  await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
+    assert.ok(
+      /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),
+      'the PATCH schema must declare needs_migration as a boolean'
+    );
+    assert.ok(
+      /db\.updateTaskNeedsMigration\(id, body\.needs_migration\)/.test(routesSrc),
+      'the PATCH handler must write via db.updateTaskNeedsMigration'
+    );
+    assert.ok(
+      /async function updateTaskNeedsMigration/.test(dbSrc) && /updateTaskNeedsMigration,/.test(dbSrc),
+      'db.js must define and export updateTaskNeedsMigration'
+    );
+  });
+
   console.log(`\n${passed} passed, ${failed} failed`);
   if (failed > 0) process.exit(1);
 })();