@bongos/core 1.19.32 → 1.19.34

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.32",
-  "core_contract": "1.19.32",
-  "source_commit": "a4f8a4de7d7d7ba6d7799a4d20c54e83abf3e5fe",
+  "core_version": "1.19.34",
+  "core_contract": "1.19.34",
+  "source_commit": "4c7df27cafa52b11076549985f3b270f52a4b83d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T15:03:03.893Z",
+  "built_at": "2026-08-11T15:15:18.155Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 286,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1207,
+    "functional_verbatim": 1208,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1514,
-  "tree_sha256": "e1a52404d82bbbff5229cd5f74279ae8499982944367cf7102600a9169f2faba",
+  "file_count": 1515,
+  "tree_sha256": "36e160fe7d3ed2db78dea0705bbd6c0da8af094f50ef11a921e88f1ef5e670cb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -87,7 +87,7 @@
     {
       "path": ".claude/skills/builder-sequence/SKILL.md",
       "mode": "0000644",
-      "sha256": "7772f3a12d76e6872ae4ae7b6cd16e9af839a0698b6ca89769429b38363157b2"
+      "sha256": "4284bc0184dd27752202ce02974fa8909fc462f546ee3cae38fa26b4ca071f81"
     },
     {
       "path": ".claude/skills/builder-setup/SKILL.md",
@@ -97,7 +97,7 @@
     {
       "path": ".claude/skills/builder-ship/SKILL.md",
       "mode": "0000644",
-      "sha256": "c9ad7867f8cb4be347dde8b33ff5f3ae64ac6812a06209205f2d0c98fc16374d"
+      "sha256": "b21b28bc173431adbaf8c98faec0d32c84808258099a35c346b2cff6612f9f51"
     },
     {
       "path": ".claude/skills/builder-stage/SKILL.md",
@@ -142,7 +142,7 @@
     {
       "path": ".claude/skills/fix-task/SKILL.md",
       "mode": "0000644",
-      "sha256": "ffae88604d885ab93557d315f82351c737df831e790cf4084c695172a73f0106"
+      "sha256": "1cb690260144b33fe2c149348d5f048454a90c525285aa768de326cf097a7be9"
     },
     {
       "path": ".claude/skills/goal-create/SKILL.md",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "b2927d0be39718b274dda102c0d9d9035d323d1c60937ea7cd7a216315d5dc64"
+      "sha256": "77528182c408edf2b8f3e07382bb83f97a7d668b979e97e60e4ff0c2e1bc7109"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4012,12 +4012,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ef48567990e07bdcd64ae5199d809b152d43b9bcae316adc4ddf6f9358f02d18"
+      "sha256": "0a1787d27918736a0349bf2963267b7b164b874fa36cead87070f4ef72216385"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9078dd247c8d55e21bf2fb79a2b406a9d4901498284713e56954610b2b45e58"
+      "sha256": "b720c31ba0ccf0ef270d7342c8cc3b0e99a9d93e720145176b4f86fc2dfa266a"
     },
     {
       "path": "public-docs/index.html",
@@ -5637,7 +5637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b5517fa6cc30948cc76d4acecb2171d2f5a9854f557c4c6ee41e1e2315db643e"
+      "sha256": "aec58f6fb1a7383beb03097fc4acea896237d45f75246101f0db10e573fc4725"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6832,7 +6832,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "10b1faf40cef2a3872c44109b63680e79922446b573bb476c79540d44a5622ac"
+      "sha256": "08db201ebec44ea5a711e3c86e36dda63ec22881a400e910dd7c64961c80f6e9"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -7439,6 +7439,11 @@
       "mode": "0000644",
       "sha256": "7e4f4270188771f1fc1fa7d68e9730b4562fb772ee9ecbd04b65fd1738ee9795"
     },
+    {
+      "path": "tests/skill_docs_unavailable_regrade.mjs",
+      "mode": "0000644",
+      "sha256": "0eeccae9320f419667cf9ede3c13671a5b03571f7f2f17067bff1857234ddf91"
+    },
     {
       "path": "tests/skill_prefs.mjs",
       "mode": "0000644",

package/.claude/skills/builder-sequence/SKILL.md

@@ -60,7 +60,7 @@ Between passes, report progress in one line — which task landed, what is next,
 
 Two more halts are yours to detect, not the script's:
 
-- **`ship_failed`** — the ship bounced, the grade failed, or the task did not reach `shipped`.
+- **`ship_failed`** — the ship bounced, the grade failed, or the task did not reach `shipped`. Tell the two non-pass grade shapes apart first: **`GRADER UNAVAILABLE`** (`panel_outcome='unavailable'`) is **not a quality rejection** — the panel could not run, there is nothing to fix, and `node scripts/gds/ship.js <id> --regrade` re-runs the grade once the grader is reachable (a recoverable pause, not a halt). A genuine **`FAIL`** has findings: fix, commit, re-run `node scripts/gds/ship.js <id> --regrade`; if it still will not land, halt and report.
 - **`scope_surprise`** — the task turns out to need work outside its `touches[]`, or its premise is wrong (the thing it describes is already done, or no longer true). Do not quietly widen the scope; that is a new task.
 
 **On any halt:** leave the current task claimed, stop, and report — what you hit, which task, and what it needs from a human. Then say plainly what already landed. Everything shipped stays shipped; a halt costs the rest of the run, not the work done.

package/.claude/skills/builder-ship/SKILL.md

@@ -19,6 +19,11 @@ The CLI drives a **three-state lifecycle** with a subagent grader between states
 
 `/builder-ship` runs steps 1 + 2 inline; on auto-confirm it chains into step 3 (push, merge on main, smoke, deploy).
 
+**Two non-pass grade shapes — tell them apart before reacting:**
+
+- **`GRADER UNAVAILABLE`** (`panel_outcome='unavailable'`) — the grading panel could not run (worker infra outage or a pre-spawn bypass). This is **not a quality rejection**: no quality signal was produced, there are no findings to fix, and the task parks at `completed` ungraded (aggregates exclude these rounds as `n_unavailable` — an outage never counts as a zero). Recovery: when the grader is reachable again, re-run just the grade step — `node scripts/gds/ship.js <id> --regrade`.
+- **A genuine `FAIL`** — the panel ran and returned findings. Fix the real issues, commit on the claim branch (the grader reads committed history, not the working tree), then re-grade with the same command: `node scripts/gds/ship.js <id> --regrade`.
+
 (Dev-box game changes, `--approved`) Persists the builder's sandbox self-approval to `tasks.sandbox_review` — `{ by, at, stamp, url, method }`, with `by`/`at` stamped server-side ([#1048](https://example.com/builders#/task/1048), ADR 0046).
 
 ## How to use

package/.claude/skills/fix-task/SKILL.md

@@ -48,7 +48,9 @@ Runs the recurring "claim, fix, and ship task NNNN" macro end to end. Its own va
    node scripts/gds/api.js GET /api/gds/tasks/<id>
    ```
    - `shipped` (or `confirmed`, awaiting `/merge-mode`) → done; relay the completion card per `/builder-ship`.
-   - Still `completed` → the grader bounced it. **Surface its feedback verbatim** — don't paraphrase or summarize away the specifics — then loop back to step 4 with that feedback in hand.
+   - Still `completed` → read the grade shape before reacting; two distinct outcomes park a task here:
+     - **`GRADER UNAVAILABLE`** (`panel_outcome='unavailable'`) — the panel could not run (infra outage/bypass). **Not a quality rejection**: there are no findings to fix. Re-run the grade when the grader is reachable: `node scripts/gds/ship.js <id> --regrade`.
+     - **A genuine `FAIL`** — the grader bounced it with findings. **Surface its feedback verbatim** — don't paraphrase or summarize away the specifics — then loop back to step 4 with that feedback in hand; fix, commit, and re-grade: `node scripts/gds/ship.js <id> --regrade`.
 
 ## Constraints
 

package/modules/lifecycle/db.js

@@ -1474,6 +1474,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
+  'needs_migration', 'module_key',
 ]);
 
 async function updateTaskColumn(id, column, value) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.32",
+  "version": "1.19.34",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.32",
+      "version": "1.19.34",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.32",
+  "version": "1.19.34",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -491,8 +491,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.30 with no explicit bump. run 31503461332. (task 1002620)
 //   1.19.32 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.31 with no explicit bump. run 31504858325. (task 1002620)
+//   1.19.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.32 with no explicit bump. run 31505528205. (task 1002620)
+//   1.19.34 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.33 with no explicit bump. run 31505952506. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.32'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.34'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migration_allocation.mjs

@@ -177,6 +177,41 @@ function shouldReserveMigrationNumber(task) {
     }
   });
 
+  // Runtime wiring, not source text: every column setter must clear the
+  // TASK_SETTER_COLUMNS allowlist inside updateTaskColumn. The needs_migration
+  // setter shipped throwing at runtime because only a source-regex test covered
+  // it — and the same gap had silently broken updateTaskModuleKey (module_key
+  // was never allowlisted). Stub the shared pool and drive the real functions.
+  await test('every task column setter clears the updateTaskColumn allowlist at runtime', async () => {
+    const { pool } = require('../src/bongos/pool.js');
+    const realQuery = pool.query;
+    const seen = [];
+    pool.query = async (sql, params) => { seen.push({ sql, params }); return { rows: [{}] }; };
+    try {
+      const db = require('../modules/lifecycle/db.js');
+      const setters = [
+        [() => db.updateTaskKind(1, 'bug'), 'kind'],
+        [() => db.updateTaskDiscipline(1, 'engineer'), 'discipline'],
+        [() => db.updateTaskNewcomerFriendly(1, true), 'newcomer_friendly'],
+        [() => db.updateTaskParallelSafe(1, true), 'parallel_safe'],
+        [() => db.updateTaskAutomationTag(1, 'live-only'), 'automation_tag'],
+        [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
+        [() => db.updateTaskModuleKey(1, null), 'module_key'],
+      ];
+      for (const [call, column] of setters) {
+        const before = seen.length;
+        await call(); // throws here if the column is missing from the allowlist
+        assert.ok(seen.length > before, `${column} setter must reach pool.query`);
+        assert.ok(
+          seen[seen.length - 1].sql.includes(`SET ${column} =`),
+          `${column} setter must UPDATE its own column`
+        );
+      }
+    } finally {
+      pool.query = realQuery;
+    }
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),

package/tests/skill_docs_unavailable_regrade.mjs

@@ -0,0 +1,35 @@
+// tests/skill_docs_unavailable_regrade.mjs — the builder-facing skills teach
+// unavailable-vs-fail + the --regrade recovery command (task 1002654, Wave 2 of
+// the grader-hardening evaluation). A GRADER UNAVAILABLE outcome
+// (panel_outcome='unavailable', R01/R02) is not a quality rejection, and every
+// skill that walks a builder through shipping must say so and name the recovery:
+//   node scripts/gds/ship.js <id> --regrade
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILLS = ['builder-ship', 'fix-task', 'builder-sequence'];
+
+// .claude/skills is INSTANCE-materialized; a neutral core checkout carries none
+// (task 1002470) — check what exists, with a non-vacuity guard like file_map.mjs.
+const present = SKILLS
+  .map((name) => ({ name, file: path.join(ROOT, '.claude', 'skills', name, 'SKILL.md') }))
+  .filter(({ file }) => existsSync(file));
+
+test('ship-path skills name the unavailable-vs-fail distinction and the --regrade recovery', () => {
+  for (const { name, file } of present) {
+    const md = readFileSync(file, 'utf8');
+    assert.ok(md.includes("panel_outcome='unavailable'"),
+      `${name}: must name the grader-outage outcome (panel_outcome='unavailable')`);
+    assert.match(md, /not a quality rejection/i,
+      `${name}: must say an unavailable grade is NOT a quality rejection`);
+    assert.match(md, /node scripts\/gds\/ship\.js <(?:task-)?id> --regrade/,
+      `${name}: must name the recovery command: node scripts/gds/ship.js <id> --regrade`);
+  }
+  if (existsSync(path.join(ROOT, '.claude', 'skills'))) {
+    assert.ok(present.length > 0, '.claude/skills exists but none of the ship-path skills were found — the check went vacuous');
+  }
+});