@bongos/core 1.19.33 → 1.19.35

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.33",
-  "core_contract": "1.19.33",
-  "source_commit": "53e6567ae132484c597ea9f16ed141b3f38c4d98",
+  "core_version": "1.19.35",
+  "core_contract": "1.19.35",
+  "source_commit": "ed10537c5e177fa94fe6d62f3d22010b21b96309",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T15:10:31.561Z",
+  "built_at": "2026-08-11T15:30:07.990Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 286,
+    "docs_redacted": 287,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1208,
+    "functional_verbatim": 1209,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1515,
-  "tree_sha256": "c4eb5d8939b2cfefc3bddc6b97e016418d2fd5a7c99a9090116183a407bfc937",
+  "file_count": 1517,
+  "tree_sha256": "5aed9fd6f14ef47f488c966238b31f4909eab157cc8052ddc3ff5279553f63b4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -154,6 +154,11 @@
       "mode": "0000644",
       "sha256": "e789b9157c9817bac354eaeed8152b53f3013f677934b062bca1c8e07f1f2dc8"
     },
+    {
+      "path": ".claude/skills/grade-recover/SKILL.md",
+      "mode": "0000644",
+      "sha256": "e0bf90fa006499aee0a7d75f10fe4b5972c9501129b1e432e7d6e192b367a54c"
+    },
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
       "mode": "0000644",
@@ -1352,7 +1357,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "4907ddeca728a5060f25f091f325daac85120cefb41f49aa67a7291f2c20d1c8"
+      "sha256": "a499551f07ce8f6382aba46641fb06fa8e499d486433ee3bf266f264abac29ca"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3362,7 +3367,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "b2927d0be39718b274dda102c0d9d9035d323d1c60937ea7cd7a216315d5dc64"
+      "sha256": "77528182c408edf2b8f3e07382bb83f97a7d668b979e97e60e4ff0c2e1bc7109"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4012,12 +4017,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3b7b3283efe27724944d786e894dffd69731c4aca5f10c72c4dd318f2e05e1bf"
+      "sha256": "5d9d99834a61e13a39b7a79c6c337259d36475945e2616810418464e9e27c3b2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "854d15e8cf4e81bf848db848280b88dfc40a3836858a0ad1ab008f808f96677b"
+      "sha256": "c5d824c553faff45e6fe3c4210711ba5bf898f876fcb7f87899912d0a335e6b6"
     },
     {
       "path": "public-docs/index.html",
@@ -5637,7 +5642,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "229087cbc698ed7d1a71aa3cea5b210528e2d5d1fcc7232ee6a536e9a2ca2010"
+      "sha256": "c1c97e893073f2c398cc2a792b338b28dd18cd78824186bcb875b279fc587ec1"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6832,7 +6837,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "10b1faf40cef2a3872c44109b63680e79922446b573bb476c79540d44a5622ac"
+      "sha256": "08db201ebec44ea5a711e3c86e36dda63ec22881a400e910dd7c64961c80f6e9"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -7444,6 +7449,11 @@
       "mode": "0000644",
       "sha256": "0eeccae9320f419667cf9ede3c13671a5b03571f7f2f17067bff1857234ddf91"
     },
+    {
+      "path": "tests/skill_grade_recover.mjs",
+      "mode": "0000644",
+      "sha256": "76bed8e6fae3bd77d4b45be14d9f80bda71b2f92323fa5697a7e4f07b65d3ba2"
+    },
     {
       "path": "tests/skill_prefs.mjs",
       "mode": "0000644",

package/.claude/skills/grade-recover/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: grade-recover
+description: Walk a stuck, unavailable, or wrongly-failed grade to resolution — the "my grade failed, now what" loop. Diagnoses which of three shapes parked the task at completed (grader outage, fabricated/server-shape fail, or genuine quality fail), names the right recovery, and runs it. Triggers when the user says "/grade-recover N", "my grade failed", "the grader bounced my ship", "grader unavailable", "recover the grade on task N", "why did task N fail its grade", or after a /builder-ship lands at completed with a non-pass grade. Describes and recovers only — it adds no gate to the ship path (ADR 0162).
+---
+
+You are recovering a task whose ship parked at `completed` because of its grade. Your job is to diagnose WHICH of three distinct shapes did it — they look similar in a terminal scrollback and need opposite responses — then run the right recovery. You never add a new approval step: everything here is a documented, existing path (ADR 0162).
+
+## What this skill does
+
+Reads the persisted grade, branches on `panel_outcome` FIRST, then walks exactly one of three recovery branches. The re-grade command every branch eventually reaches is:
+
+```bash
+node scripts/gds/ship.js <id> --regrade
+```
+
+`--regrade` re-runs ONLY the grade step (no smoke/scanner re-run), reads **committed history, not the working tree**, applies only to a task at `completed`, is gated to the task's most-recent claim holder or an Archon, and has no attempt cap.
+
+## Step 1 — Read the grade
+
+```bash
+node scripts/gds/api.js GET "/api/gds/tasks/<id>?include=grade,last_claim"
+```
+
+- Task not at `completed` → stop; there is nothing to recover. `confirmed`/`shipped` means the grade passed (a `confirmed` strand lands via the ~5-min reconciler; `/merge-mode` is the rare manual fallback). `active` means ship first.
+- `grade: null` → the ship never reached the grade step; re-run `/builder-ship`, not `--regrade`.
+- Otherwise diagnose from the grade row: `signals.panel_outcome`, `signals.server_guard`, `passed`, `rubric_scores`, `issues[]`.
+
+## Step 2 — Diagnose, in this order
+
+### Branch A — grader outage: `panel_outcome='unavailable'`
+
+The panel could not run (worker infra outage or a pre-spawn bypass). This is **not a quality verdict** — no quality signal was produced, there are no findings to fix, and nothing about the work is being judged. Grade aggregates exclude these rounds (`n_unavailable`); an outage never counts as a zero.
+
+1. Do NOT edit code. There is nothing to fix.
+2. Check the grader can run now: the panel spawns `claude -p` subprocesses locally, so confirm the CLI is present and authenticated, and the instance API is reachable (`signals.grader_unavailable_reason` usually names the leg that died).
+3. Re-grade: `node scripts/gds/ship.js <id> --regrade`.
+
+### Branch B — fabricated / server-shape fail: the guard tripped or an axis was forged by an error
+
+Two known sub-shapes, both recognizable because the "fail" carries **no substantive findings**:
+
+- **Server-guard trip** (`signals.server_guard.tripped` non-empty, e.g. `implausible_pass`): the server downgraded a client-asserted pass it found implausible — historically this guard has fired on genuinely clean, unanimous zero-issue passes. Explain the downgrade honestly, then re-grade: `node scripts/gds/ship.js <id> --regrade`.
+- **A FAIL scored around 4.5/10 with zero issues and a null/zero axis** (the errored-worker class): a worker error was forwarded as a real axis score. Same response — re-grade; the panel rerun replaces the forged shape with a real verdict.
+
+If an honest re-grade re-trips the guard on a diff you can defend, use the **auditable override path** — file an override-request with a real rationale (≥20 chars; only the task's most-recent claim holder or an Archon may file; an Archon then decides it):
+
+```bash
+node scripts/gds/api.js POST /api/gds/tasks/<id>/override-request --body '{"rationale":"<why this grade is wrong, specifically>"}'
+```
+
+**Never volunteer the raw Archon confirm curl.** The override-request is the sanctioned exit precisely because it records who asked, why, and who decided — the raw confirm records none of that.
+
+### Branch C — genuine quality fail: real findings in `issues[]`
+
+The panel ran and rejected the work. Recover by fixing, not by re-rolling:
+
+1. **Group `issues[]` by severity, then by worker.** Nit/minor findings are advisory by rubric policy — they cannot have caused the fail on their own, so do not start there. The fail came from blocker/major findings (or a gating axis under threshold).
+2. **For each blocker/major finding, add a checked-in `tests/*.mjs` case** that reproduces it, then fix until green. The grader treats throwaway verification as unverified — the committed test is what makes the fix real.
+3. **Fix real findings once; do not chase re-worded restatements** of a point you already answered (answer it in the commit or with a tracked task ref instead).
+4. Commit on the claim branch — the grader reads committed history — then:
+
+```bash
+node scripts/gds/ship.js <id> --regrade
+```
+
+### Not recoverable here — `REFUSED (authorization)`
+
+A grade block naming protected surfaces above your rank is an authorization wall, not a quality verdict: no re-grade at your rank can land that diff as-is. Split the protected files out of the diff and re-ship the rest, or hand the task to a builder at/above the floor the refusal names.
+
+## Constraints
+
+- **ADR 0162 — no new gates.** This skill describes and recovers; it never inserts a human-approval step into the ship path, and it never invents a new checkpoint.
+- **Diagnose before touching code.** Editing code in response to an outage (Branch A) or a guard trip (Branch B) wastes a panel round and muddies the audit trail.
+- **`--regrade` is claim-scoped**: most-recent claim holder or Archon. If you are neither, the recovery belongs to whoever is.
+- **Honest re-grade before any override.** The override-request path is for a grade that is *wrong*, not a grade that is *inconvenient*.
+
+## Files this skill touches
+
+- Reads: `GET /api/gds/tasks/:id?include=grade,last_claim` (the persisted grade row + regrade eligibility).
+- Runs: `node scripts/gds/ship.js <id> --regrade` (the grade step only).
+- Writes (Branch B escalation only): `POST /api/gds/tasks/:id/override-request`.

package/docs/file-map.md

@@ -350,6 +350,7 @@ tests/
 ├── fix-task/SKILL.md              ← /fix-task N — claim, fix (test-first), verify, and ship a single GDS task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
 ├── goal-create/SKILL.md           ← /goal-create — plan and create ONE goal (the module-scoped workspace between version and criteria, ADR 0086) in one session: <redacted>, scope wall, 2-4 criteria, seed tasks; also the auto-pickup when a task is created with no goal to live in (goal_advisory); Metic+ (Archon for a protected-module scope)
 ├── goal-review/SKILL.md           ← /goal-review — walk the criterion review queue: each auto-flagged 'met — pending review' criterion gets confirm / reject / defer; confirming a goal's last criterion auto-achieves it (ADR 0086 §6); Metic+
+├── grade-recover/SKILL.md         ← /grade-recover N — the 'my grade failed, now what' loop: diagnose outage vs fabricated fail vs genuine fail from the persisted grade, then run the right recovery (--regrade or the auditable override-request); adds no ship-path gate (ADR 0162, task 1002655)
 ├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the GDS idea_inbox (promote / discard / merge); Metic+
 ├── ideate/SKILL.md                ← /ideate — ideation-session playbook for ideator-discipline tasks; inverts the loop (human drives, Claude is the sounding board) ([#1267](https://example.com/builders#/task/1267))
 ├── merge-mode/SKILL.md            ← /merge-mode — manual fallback for the auto-merge: land every confirmed task (merge + smoke + deploy)

package/modules/lifecycle/db.js

@@ -1474,6 +1474,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
+  'needs_migration', 'module_key',
 ]);
 
 async function updateTaskColumn(id, column, value) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.33",
+  "version": "1.19.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.33",
+      "version": "1.19.35",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.33",
+  "version": "1.19.35",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -493,8 +493,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.31 with no explicit bump. run 31504858325. (task 1002620)
 //   1.19.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.32 with no explicit bump. run 31505528205. (task 1002620)
+//   1.19.34 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.33 with no explicit bump. run 31505952506. (task 1002620)
+//   1.19.35 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.34 with no explicit bump. run 31507293725. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.33'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.35'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migration_allocation.mjs

@@ -177,6 +177,41 @@ function shouldReserveMigrationNumber(task) {
     }
   });
 
+  // Runtime wiring, not source text: every column setter must clear the
+  // TASK_SETTER_COLUMNS allowlist inside updateTaskColumn. The needs_migration
+  // setter shipped throwing at runtime because only a source-regex test covered
+  // it — and the same gap had silently broken updateTaskModuleKey (module_key
+  // was never allowlisted). Stub the shared pool and drive the real functions.
+  await test('every task column setter clears the updateTaskColumn allowlist at runtime', async () => {
+    const { pool } = require('../src/bongos/pool.js');
+    const realQuery = pool.query;
+    const seen = [];
+    pool.query = async (sql, params) => { seen.push({ sql, params }); return { rows: [{}] }; };
+    try {
+      const db = require('../modules/lifecycle/db.js');
+      const setters = [
+        [() => db.updateTaskKind(1, 'bug'), 'kind'],
+        [() => db.updateTaskDiscipline(1, 'engineer'), 'discipline'],
+        [() => db.updateTaskNewcomerFriendly(1, true), 'newcomer_friendly'],
+        [() => db.updateTaskParallelSafe(1, true), 'parallel_safe'],
+        [() => db.updateTaskAutomationTag(1, 'live-only'), 'automation_tag'],
+        [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
+        [() => db.updateTaskModuleKey(1, null), 'module_key'],
+      ];
+      for (const [call, column] of setters) {
+        const before = seen.length;
+        await call(); // throws here if the column is missing from the allowlist
+        assert.ok(seen.length > before, `${column} setter must reach pool.query`);
+        assert.ok(
+          seen[seen.length - 1].sql.includes(`SET ${column} =`),
+          `${column} setter must UPDATE its own column`
+        );
+      }
+    } finally {
+      pool.query = realQuery;
+    }
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),

package/tests/skill_grade_recover.mjs

@@ -0,0 +1,40 @@
+// tests/skill_grade_recover.mjs — the /grade-recover skill exists and handles
+// the three diagnosis branches from the grader-hardening evaluation §6
+// (task 1002655): outage (panel_outcome='unavailable'), fabricated/server-shape
+// fail, and genuine fail — naming --regrade as the recovery and the auditable
+// override-request path, while never volunteering the raw /confirm curl.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL = path.join(ROOT, '.claude', 'skills', 'grade-recover', 'SKILL.md');
+
+// .claude/skills is INSTANCE-materialized; a neutral core checkout carries none
+// (task 1002470) — skip there, with the same guard shape as file_map.mjs.
+const skillsDirExists = existsSync(path.join(ROOT, '.claude', 'skills'));
+
+test('/grade-recover exists and handles the three diagnosis branches', (t) => {
+  if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
+  assert.ok(existsSync(SKILL), '.claude/skills/grade-recover/SKILL.md must exist (task 1002655)');
+  const md = readFileSync(SKILL, 'utf8');
+
+  // Branch A — outage: unavailable is named and distinguished from a quality verdict.
+  assert.ok(md.includes("panel_outcome='unavailable'"), 'names the outage branch by its signal');
+  assert.match(md, /not a quality (verdict|rejection)/i, 'says an outage is not a quality verdict');
+
+  // Branch B — fabricated / server-shape fail: server guard + the auditable override path.
+  assert.match(md, /server[_ -]guard|implausible_pass/i, 'names the server-guard trip shape');
+  assert.match(md, /override-request/, 'names the auditable override-request path');
+
+  // Branch C — genuine fail: severity/worker grouping and a test per real finding.
+  assert.match(md, /severity/i, 'genuine-fail branch groups findings by severity');
+  assert.match(md, /tests\/\*?\.?mjs|checked-in test/i, 'requires a checked-in test per real finding');
+
+  // The recovery command is named literally, and the raw confirm curl is never volunteered.
+  assert.match(md, /node scripts\/gds\/ship\.js <(?:task-)?id> --regrade/, 'names the --regrade recovery command');
+  assert.match(md, /never volunteer/i, 'states the never-volunteer rule for the raw confirm');
+  assert.ok(!/curl[^\n]*\/confirm/.test(md), 'must not carry a ready-to-paste raw /confirm curl');
+});