@bongos/core 1.19.383 → 1.19.385

package/modules/grading/grader-workers/index.js

@@ -70,6 +70,35 @@ const WORKER_MAX_TIMEOUT_MS = {
   efficiency: 360_000, // Read-heavy on a large diff: traces perf across every changed file
 };
 
+// task 1003313: the diagnostic a dark panel used to throw away.
+//
+// runSubagent attaches exit_code + stdout + stderr to every subprocess error,
+// but the catch below kept only err.code — so a TOTAL outage stored four
+// identical `SUBAGENT_NONZERO_EXIT` rows and nothing else, and two builders sat
+// dark for days with a 0/10 card that could not name its own cause. At least two
+// known environmental faults produce that exact signature (a logged-out `claude`
+// CLI — preflight.js claudeAuthFinding; the Windows WindowsApps alias stub —
+// learning 42) and the stored grade could not tell them apart.
+//
+// The tail is REDACTED and BOUNDED because it lands in a grade row that the hall
+// renders: CLI stderr can carry an auth header or a key echoed back in an error.
+const STDERR_TAIL_MAX = 400;
+// eslint-disable-next-line no-control-regex -- stripping ANSI SGR from CLI stderr
+const ANSI_RE = /\x1B\[[0-9;]*[A-Za-z]/g;
+const SECRET_RES = [
+  /sk-ant-[A-Za-z0-9_-]+/g,
+  /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{12,}=*/g,
+];
+function redactStderrTail(raw) {
+  let s = String(raw || '').replace(ANSI_RE, '').trim();
+  if (!s) return null;
+  for (const re of SECRET_RES) s = s.replace(re, '[redacted]');
+  s = s.slice(-STDERR_TAIL_MAX);
+  return s || null;
+}
+
 // Resolve the timeout for a worker: explicit module override > KIND map >
 // caller's runOpts > undefined (runSubagent applies its own default).
 function timeoutForWorker(worker, runOpts) {
@@ -127,6 +156,9 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
     let runMs = null;
     let costUsd = null;
     let subprocessError = null;
+    // task 1003313: the WHY behind subprocessError. Null on a clean run.
+    let exitCode = null;
+    let stderrTail = null;
     const t0 = Date.now();
     try {
       const { stdout, run_ms, cost_usd } = await runSubagentFn({ prompt, opts: { ...runOpts, model, timeoutMs } });
@@ -139,6 +171,11 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
     } catch (err) {
       runMs = err.run_ms ?? (Date.now() - t0);
       subprocessError = err.code || 'UNKNOWN';
+      exitCode = Number.isInteger(err.exit_code) ? err.exit_code : null;
+      // A CLI that dies before writing JSON often says why on stdout, not stderr
+      // (`claude` prints its "not logged in" line there) — fall back so the tail
+      // is never empty when the subprocess did explain itself.
+      stderrTail = redactStderrTail(err.stderr) ?? redactStderrTail(err.stdout);
     }
     const parsed = subprocessError
       ? null
@@ -148,10 +185,10 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
       run_ms: runMs,
       subprocess_error: subprocessError,
     });
-    return { verdict, runMs, costUsd };
+    return { verdict, runMs, costUsd, exitCode, stderrTail };
   }
 
-  let { verdict, runMs, costUsd } = await attempt();
+  let { verdict, runMs, costUsd, exitCode, stderrTail } = await attempt();
   // #465: retry ONCE on a transient error (the freshest attempt wins, even if it
   // also errored — one retry only). A real verdict or a SUBAGENT_TIMEOUT is
   // never retried. NB (#486): the freshest attempt's cost wins; a transient
@@ -159,7 +196,7 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
   let retried = false;
   if (TRANSIENT_WORKER_ERRORS.has(verdict.error)) {
     retried = true;
-    ({ verdict, runMs, costUsd } = await attempt());
+    ({ verdict, runMs, costUsd, exitCode, stderrTail } = await attempt());
   }
 
   return {
@@ -176,6 +213,10 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
     cost_usd: costUsd, // #486: this worker's own subprocess API spend (USD)
     retried,
     error: verdict.error ?? null,
+    // task 1003313: on an errored worker, WHY. Omitted entirely on a clean run so
+    // a healthy grade row keeps its existing shape.
+    ...(verdict.error && exitCode != null ? { exit_code: exitCode } : {}),
+    ...(verdict.error && stderrTail ? { stderr_tail: stderrTail } : {}),
     // Narc-specific (carried opaquely; aggregatePanel doesn't need to know):
     ...(verdict.ac_checklist ? { ac_checklist: verdict.ac_checklist } : {}),
   };
@@ -188,6 +229,8 @@ module.exports = {
   runWorker,
   timeoutForWorker, // public surface; WORKER_MAX_TIMEOUT_MS stays module-internal
   TRANSIENT_WORKER_ERRORS,
+  redactStderrTail, // task 1003313: exported so the redaction contract is pinned
+  STDERR_TAIL_MAX,
   // re-export per-worker modules for direct access by tests
   narc,
   quality,

package/modules/grading/grader.js

@@ -88,6 +88,27 @@ const { buildPrompt, extractJson } = require('./grader-prompt.js');
 const { aggregateShots, changeMagnitude, hasPanelEvidence, isSubstantiveIssue, serverSideGuards, validateAndScore } = require('./grader-score.js');
 const { buildContextBundle, diffAddedLinesByFile, extractAssistantResult, extractCostUsd, runOneShot, runSubagent, runSubagentCached } = require('./grader-subagent.js');
 
+// task 1003313: render the WHY of a total outage into the verdict line.
+//
+// Exists because "GRADER UNAVAILABLE — all 4 workers failed to run" is not a
+// diagnosis: a logged-out `claude` CLI, a Windows app-execution-alias stub, and a
+// genuine API outage all produce it, and the builder sees no way to tell which.
+// runWorker now carries exit_code + a redacted stderr_tail off each dead worker;
+// this puts the shared exit code and the first distinct CLI error line into the
+// text the builder actually reads. Silent when the workers carry no detail
+// (a grade from a server predating the propagation).
+const OUTAGE_TAIL_MAX = 300;
+function describeOutage(gating) {
+  const dead = gating.filter((w) => w.error);
+  const codes = [...new Set(dead.map((w) => w.exit_code).filter((c) => c != null))];
+  const tails = [...new Set(dead.map((w) => w.stderr_tail).filter(Boolean))];
+  if (!codes.length && !tails.length) return '';
+  const parts = [];
+  if (codes.length) parts.push(`exit ${codes.join('/')}`);
+  if (tails.length) parts.push(`subprocess said: ${tails[0].slice(-OUTAGE_TAIL_MAX)}`);
+  return ` Diagnostic — ${parts.join('; ')}`;
+}
+
 function aggregatePanel(workerResults, meta = {}) {
   const N = workerResults.length;
 
@@ -232,6 +253,10 @@ function aggregatePanel(workerResults, meta = {}) {
     const erroredKinds = gating.filter((w) => w.error).map((w) => w.kind);
     verdict =
       `GRADER UNAVAILABLE — all ${gatingError}/${gating.length} gating worker(s) failed to run (${erroredKinds.join(', ')}); no quality signal was produced. This is an infra/outage condition, NOT a quality rejection — manual-confirm available.` +
+      // task 1003313: name the cause. Without this the card said only "failed to
+      // run" four times over, and two builders sat dark for days because nothing
+      // stored — or showed — the exit code and the CLI's own error line.
+      describeOutage(gating) +
       advisoryNote;
     panelOutcome = 'unavailable';
     forwardedConfidence = FALLTHROUGH_CONFIDENCE;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.383",
+  "version": "1.19.385",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.383",
+      "version": "1.19.385",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.383",
+  "version": "1.19.385",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/adr-namespace.js

@@ -0,0 +1,273 @@
+#!/usr/bin/env node
+'use strict';
+// adr-namespace.js — ADR numbering discipline (task 1003164). The ADR half of the guard
+// `migration-namespace.js` already gives migrations. Pure helpers over file lists + index
+// text, plus the fitness check that reads the tree.
+//
+// PROBLEM. An ADR number is a CITATION TARGET. ADRs cite each other by number, prose and
+// task notes cite them by number, and `docs/adr/README.md` is the index every agent is
+// told to consult. Two files can carry the same number and NOTHING notices: the filenames
+// differ (`0181-ship-requires-an-assurance.md` vs
+// `0181-teardown-state-gate-and-address-retention.md`), so there is no path collision, no
+// merge conflict, and git adds both cleanly. README.md auto-merges too, ending up with two
+// `| 0181 |` rows. Unit, fitness, docs-entropy and the grader all passed; it was found on
+// 2026-08-22 only because a human read `ls docs/adr/`. By then task 1000900's
+// close-rationale had already cited "ADR 0180", which the collision had made point at an
+// unrelated document — a citation that is wrong forever.
+//
+// THE ASYMMETRY THIS CLOSES. Migrations have exactly this protection already: a re-used
+// migration number silently SKIPS a migration, so `stemCollisions()` hard-fails CI. ADRs
+// got `next-number.js` — which computes the next free number at claim time, on a
+// possibly-stale tree, best-effort — and then nothing enforced it afterwards. Same shared,
+// monotonic, human-allocated number line; one guarded, one not. A stale claim card, two
+// builders claiming the same day, or a branch that sits long enough all reproduce it.
+//
+// WHY GRANDFATHER RATHER THAN RENUMBER. When this landed the live tree already held TWENTY
+// colliding numbers, not the one the bug report found. Renumbering nineteen pairs would
+// break every existing citation to them — which is the very harm this check exists to
+// prevent — and README.md states the rule outright: a number, once assigned, is never
+// reused. So the existing pairs are frozen into LEGACY_DUPLICATE_ADRS by their EXACT
+// filenames (the shape migration-namespace.js uses for its own grandfathering, and for
+// RENAMED_MODULE_PREFIXES). Frozen by exact filename, not by number, is the load-bearing
+// part: a THIRD file joining a legacy number still fails, and so does a rename of either
+// half. The list can only shrink. See ADR 0195.
+//
+// The index half is checked by LINK TARGET, not by number, because a number rule alone
+// cannot express the grandfathered pairs: the invariant is that every ADR file has exactly
+// one row and every row points at a file that exists. That catches the dangling row AND
+// the duplicated row AND the file nobody indexed — the last of which is how a collision
+// actually hides, since the second file of a colliding pair is the one that never gets a
+// row.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { CORE_ROOT } = require('./fitness-lib.js');
+
+// ---- parsing ---------------------------------------------------------------
+
+// `NNNN-kebab-title.md` — the naming rule in docs/adr/README.md §File naming.
+const ADR_RE = /^(\d{4})-(.+)\.md$/;
+
+// Parse an ADR basename into { number, num, slug, ok }. `number` is the 4-digit STRING
+// (the citation form, zero-padded); `num` is the integer for ordering/allocation. A
+// non-ADR name (README.md, a draft) returns { ok: false }.
+function parseAdrName(basename) {
+  const m = ADR_RE.exec(String(basename == null ? '' : basename));
+  if (!m) return { number: null, num: null, slug: null, ok: false };
+  return { number: m[1], num: parseInt(m[1], 10), slug: m[2], ok: true };
+}
+
+// The 4-digit number string of an ADR basename, or null if it is not an ADR.
+function adrNumberOf(basename) {
+  const p = parseAdrName(basename);
+  return p.ok ? p.number : null;
+}
+
+// ---- grandfathered collisions ---------------------------------------------
+
+// Numbers already shared by two files when this check landed (task 1003164, 2026-08-27).
+// Frozen by EXACT filename: a third file on one of these numbers, or a rename of either
+// half, is still a hard failure. This list may shrink (if a pair is ever consolidated) and
+// must never grow — a new collision is the bug the check exists to catch.
+const LEGACY_DUPLICATE_ADRS = Object.freeze({
+  '0008': Object.freeze(['0008-family-based-tile-generation.md', '0008-google-chat-oauth-user-auth.md']),
+  '0024': Object.freeze(['0024-cloneable-repo-local-first-memory.md', '0024-multi-agent-system-architecture.md']),
+  '0025': Object.freeze(['0025-offsite-backup-vendor-digitalocean-spaces.md', '0025-structured-criterion-task-link.md']),
+  '0044': Object.freeze(['0044-mediterranean-palette-replacement.md', '0044-per-box-live-game-preview.md']),
+  '0057': Object.freeze(['0057-container-cost-ledger.md', '0057-discord-archon-approval-channels.md']),
+  '0072': Object.freeze(['0072-bongos-app-mac-signed-first-windows-deferred.md', '0072-dev-box-code-staleness-visibility.md']),
+  '0073': Object.freeze(['0073-builder-needs-signal-and-byok-gemini-key.md', '0073-secrets-scan-exclude-uri-detector.md']),
+  '0082': Object.freeze(['0082-productized-key-storage-provisioning.md', '0082-server-side-merge-conflict-auto-resolution.md']),
+  '0087': Object.freeze(['0087-bongos-app-architecture-and-handoff-contract.md', '0087-compete-on-governance-not-tooling-cursor.md']),
+  '0095': Object.freeze(['0095-borrowed-memory-and-retrieval-concepts.md', '0095-cross-agent-context-management.md']),
+  '0097': Object.freeze(['0097-one-active-claim-per-session-and-worktree-binding.md', '0097-retroactive-reward-backfill.md']),
+  '0103': Object.freeze(['0103-core-first-extraction-cloud-bongos-trunk.md', '0103-gdsv4-bongos-consolidation.md']),
+  '0144': Object.freeze(['0144-devbox-rehome-onto-cloudbongos-plane.md', '0144-federated-single-logout-backchannel.md']),
+  '0145': Object.freeze(['0145-devbox-app-branding-driven-module.md', '0145-free-hosted-project-tier-isolation-and-domain-separation.md']),
+  '0152': Object.freeze(['0152-landing-gate-served-by-the-core-app.md', '0152-metic-task-abandonment.md']),
+  '0167': Object.freeze(['0167-gate-trust-link-agpl-default.md', '0167-module-catalog-source-vs-provenance.md']),
+  '0172': Object.freeze(['0172-editable-rank-roles-substrate-axis.md', '0172-per-craft-compensation-ideator-credit-lane.md']),
+  '0184': Object.freeze(['0184-a-task-visual-inherits-its-summary-audience.md', '0184-ship-requires-an-assurance.md']),
+  '0187': Object.freeze(['0187-collab-four-decisions.md', '0187-oauth-handshake-cookie-lifetime.md']),
+  '0192': Object.freeze(['0192-a-category-orients-and-authorises-nothing.md', '0192-platform-visibility-member-door.md']),
+});
+
+// Is this exact set of files the frozen legacy pair for that number? Set-equality, so
+// adding a third file or renaming either half stops being grandfathered.
+function isGrandfathered(number, files) {
+  const legacy = LEGACY_DUPLICATE_ADRS[number];
+  if (!legacy) return false;
+  if (files.length !== legacy.length) return false;
+  const a = [...files].sort();
+  const b = [...legacy].sort();
+  return a.every((f, i) => f === b[i]);
+}
+
+// ---- collision detector ----------------------------------------------------
+
+// Given ADR basenames, return [{ number, files[] }] for every number claimed by more than
+// one file, EXCLUDING the frozen legacy pairs. The direct analogue of
+// migration-namespace.js stemCollisions().
+function numberCollisions(basenames) {
+  const byNumber = new Map();
+  for (const name of basenames || []) {
+    const p = parseAdrName(name);
+    if (!p.ok) continue;
+    if (!byNumber.has(p.number)) byNumber.set(p.number, new Set());
+    byNumber.get(p.number).add(name);
+  }
+  const out = [];
+  for (const [number, set] of byNumber) {
+    const files = [...set].sort();
+    if (files.length > 1 && !isGrandfathered(number, files)) out.push({ number, files });
+  }
+  return out.sort((a, b) => a.number.localeCompare(b.number));
+}
+
+// The next free ADR number (integer): max + 1, 1 on an empty tree. Mirrors next-number.js
+// nextFree so a caller can allocate without reaching for git.
+function nextAdrNumber(basenames) {
+  let max = 0;
+  for (const name of basenames || []) {
+    const p = parseAdrName(name);
+    if (p.ok && p.num > max) max = p.num;
+  }
+  return max + 1;
+}
+
+// ---- index (docs/adr/README.md) --------------------------------------------
+
+// An index row: `| NNNN | [Title](NNNN-slug.md) | topic |`. The leading cell may carry a
+// disambiguating suffix (`0008-a`) for a grandfathered pair, so the number is read from
+// the leading cell and the row's OWN file from the link target that starts with it — row
+// prose cites other ADRs by link too, and only the own-number target is the row's subject.
+const INDEX_ROW_RE = /^\|\s*(\d{4})(?:-[a-z])?\s*\|/;
+const INDEX_LINK_RE = /\]\((\d{4}-[^)]*\.md)\)/g;
+
+// Parse README text into [{ number, target, targets, lineNo, ok }]. `target` is the row's
+// own ADR filename, or null when the row names none (or names more than one of its own
+// number, which is ambiguous and reported as a violation).
+function parseIndexRows(readmeText) {
+  const rows = [];
+  const lines = String(readmeText == null ? '' : readmeText).split('\n');
+  lines.forEach((line, i) => {
+    const m = INDEX_ROW_RE.exec(line);
+    if (!m) return;
+    const number = m[1];
+    INDEX_LINK_RE.lastIndex = 0;
+    const own = [...line.matchAll(INDEX_LINK_RE)].map((x) => x[1]).filter((t) => t.startsWith(number + '-'));
+    rows.push({ number, target: own.length === 1 ? own[0] : null, targets: own, lineNo: i + 1, ok: own.length === 1 });
+  });
+  return rows;
+}
+
+// The index invariant, checked by LINK TARGET: every ADR file has exactly one row, and
+// every row points at a file that exists. Returns violation strings.
+function indexViolations({ basenames = [], rows = [] } = {}) {
+  const violations = [];
+  const files = new Set((basenames || []).filter((n) => parseAdrName(n).ok));
+
+  const rowsByTarget = new Map();
+  for (const r of rows) {
+    if (!r.ok) {
+      violations.push(
+        `docs/adr/README.md:${r.lineNo}: the index row for ${r.number} names ${r.targets.length} link(s) to its own number `
+        + `(${r.targets.join(', ') || 'none'}) — a row must link its own ADR file exactly once so the index can be checked against the tree.`);
+      continue;
+    }
+    if (!rowsByTarget.has(r.target)) rowsByTarget.set(r.target, []);
+    rowsByTarget.get(r.target).push(r.lineNo);
+  }
+
+  for (const [target, lineNos] of [...rowsByTarget.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    if (!files.has(target)) {
+      violations.push(
+        `docs/adr/README.md:${lineNos[0]}: index row points at docs/adr/${target}, which does not exist — a dangling index row `
+        + `(the other half of the collision problem: a merge can leave a row behind after the file it named moved or was renumbered).`);
+    }
+    if (lineNos.length > 1) {
+      violations.push(
+        `docs/adr/README.md: ${target} has ${lineNos.length} index rows (lines ${lineNos.join(', ')}) — exactly one row per ADR; `
+        + 'a duplicated row is what an auto-merged index leaves behind.');
+    }
+  }
+
+  for (const f of [...files].sort()) {
+    if (!rowsByTarget.has(f)) {
+      violations.push(
+        `docs/adr/${f} has no row in docs/adr/README.md — every ADR is indexed. (This is how a number collision hides: the `
+        + 'second file of a colliding pair is the one that never gets indexed, so the tree and the index quietly disagree.)');
+    }
+  }
+
+  return violations;
+}
+
+// Rows should read in ascending number order. WARNING only, never a hard failure: the live
+// index carries legacy rows an auto-merge placed out of order, and blocking on history
+// would fail every PR for a mess nobody's diff created (the ADR 0189 split — declaration
+// rot hard-fails, inherited drift warns).
+function indexOrderWarnings(rows) {
+  const warnings = [];
+  let prev = null;
+  for (const r of rows) {
+    if (prev !== null && r.number < prev) {
+      warnings.push(`docs/adr/README.md:${r.lineNo}: row ${r.number} sits after ${prev} — the index reads in ascending order.`);
+    }
+    if (prev === null || r.number > prev) prev = r.number;
+  }
+  return warnings;
+}
+
+// ---- the fitness check -----------------------------------------------------
+
+const ADR_DIR = path.join(CORE_ROOT, 'docs', 'adr');
+
+function adrFilesIn(absDir) {
+  try { return fs.readdirSync(absDir).filter((f) => parseAdrName(f).ok).sort(); }
+  catch { return []; } // no docs/adr in a vanilla instance → nothing to check
+}
+
+// Check 31 — two ADRs may not share a number, and the index must agree with the tree.
+function checkAdrNumbering() {
+  const files = adrFilesIn(ADR_DIR);
+  const violations = [];
+
+  for (const c of numberCollisions(files)) {
+    violations.push(
+      `ADR number ${c.number} is claimed by ${c.files.length} files (${c.files.map((f) => `docs/adr/${f}`).join(', ')}) — `
+      + 'an ADR number is a citation target, so a duplicate makes every citation to it ambiguous forever. Renumber the NEWER '
+      + 'file to the next free number (node scripts/gds/next-number.js) and move its README row with it.');
+  }
+
+  let readme = null;
+  try { readme = fs.readFileSync(path.join(ADR_DIR, 'README.md'), 'utf8'); } catch { /* no index → nothing to reconcile */ }
+  const rows = readme === null ? [] : parseIndexRows(readme);
+  if (readme !== null) violations.push(...indexViolations({ basenames: files, rows }));
+  const warnings = readme === null ? [] : indexOrderWarnings(rows);
+
+  return {
+    name: 'ADR numbers unique + index agrees with the tree (task 1003164)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `${files.length} ADR file(s), ${rows.length} index row(s), `
+      + `${Object.keys(LEGACY_DUPLICATE_ADRS).length} grandfathered duplicate number(s) (frozen by exact filename — the list may only shrink). `
+      + `Next free number: ${String(nextAdrNumber(files)).padStart(4, '0')}.`,
+  };
+}
+
+module.exports = {
+  ADR_RE,
+  LEGACY_DUPLICATE_ADRS,
+  parseAdrName,
+  adrNumberOf,
+  isGrandfathered,
+  numberCollisions,
+  nextAdrNumber,
+  parseIndexRows,
+  indexViolations,
+  indexOrderWarnings,
+  checkAdrNumbering,
+};

package/scripts/gds/fitness.js

@@ -1319,6 +1319,12 @@ const CHECKS = [
   // doc-comment gate that blocks a ship buys filler prose, not understanding.
   // Making it blocking is an owner decision and needs its own ADR.
   require('./doc-comment-coverage.js').checkDocCommentCoverage,
+  // Check 31 — task 1003164: two ADRs may not share a number, and docs/adr/README.md
+  // must agree with the tree. The ADR half of the guard Check 11b already gives
+  // migrations: same shared, monotonic, human-allocated number line, and until this
+  // landed only one of the two was enforced. An ADR number is a citation target, so a
+  // duplicate is wrong forever (ADR 0195).
+  require('./adr-namespace.js').checkAdrNumbering,
 ];
 
 function runAll() {
@@ -1364,6 +1370,7 @@ module.exports = {
   checkKernelImportsNoDomain,
   checkModuleMigrationsAdditive,
   checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames
+  checkAdrNumbering: require('./adr-namespace.js').checkAdrNumbering, // Check 31 — task 1003164 / ADR 0195: ADR numbers unique + index agrees with the tree
   checkDesignContract,
   checkKernelPromptsNoHardcodedIdentity, // BV1.R76 / task 1705
   scanPromptIdentity,                    // BV1.R76 — negative-test hook

package/scripts/gds/ship-grade-steps.js

@@ -14,6 +14,10 @@ const os = require('node:os');
 const { cliClient, rewardPolicy } = require('./cli-lib');
 const { gitOk } = require('./ship-git.js');
 const { resolveInstanceBase } = require('./ship-deploy-target.js');
+// task 1003313: the shared onboarding/doctor preflight — reused (not duplicated)
+// so the grader outage explains itself with the same `claude CLI` verdict doctor
+// gives, and the two can never drift.
+const { preflightChecks } = require('./preflight.js');
 const { computeRawDiffHash, reconstructPanelIssues, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
 
 // ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
@@ -223,7 +227,33 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
 // issues + next-step hints). Pure + exported so the #943 grader-unavailable vs
 // FAIL branch is unit-tested without capturing stdout. printGradeOutcome just
 // prints what this returns.
-function formatGradeOutcome(g, taskId) {
+// task 1003313: the per-worker diagnostic lines for a total outage, plus the
+// local `claude` CLI verdict. Pure over its inputs (cliFinding is INJECTED, never
+// spawned here) so formatGradeOutcome stays unit-testable without a subprocess.
+function formatOutageDiagnostic(g, cliFinding) {
+  const out = [];
+  const dead = (g.signals?.workers || []).filter((w) => w && w.error);
+  const detailed = dead.filter((w) => w.exit_code != null || w.stderr_tail);
+  if (detailed.length) {
+    out.push('');
+    out.push('What the grader subprocess actually did:');
+    for (const w of detailed) {
+      const code = w.exit_code != null ? `exit ${w.exit_code}` : w.error;
+      out.push(`  ${String(w.kind || '?').padEnd(11)} ${code}${w.stderr_tail ? ` — ${w.stderr_tail.split('\n')[0]}` : ''}`);
+    }
+  }
+  if (cliFinding && cliFinding.level !== 'ok') {
+    out.push('');
+    out.push(`Local \`claude\` CLI: ${cliFinding.detail}`);
+    if (cliFinding.fix) out.push(`  Fix: ${cliFinding.fix}`);
+  }
+  return out;
+}
+
+// cliFinding: the preflight `claude CLI` row, injected by printGradeOutcome so a
+// dark panel can say "your CLI is logged out" instead of leaving the builder to
+// guess. Report-only — it never changes the outcome (ADR 0162: no new gates).
+function formatGradeOutcome(g, taskId, cliFinding = null) {
   const out = [];
   // #943: a TOTAL grader outage (every gating worker failed to spawn / the
   // grader was bypassed pre-spawn) is NOT a quality rejection — it's "the grader
@@ -236,6 +266,7 @@ function formatGradeOutcome(g, taskId) {
     out.push('');
     out.push(`Subagent grade: GRADER UNAVAILABLE${reason ? ` (${reason})` : ''}  ·  no quality signal produced — NOT a quality rejection`);
     if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+    out.push(...formatOutageDiagnostic(g, cliFinding));
     out.push('');
     out.push('The grader could not run (infra/outage/bypass) — there are no findings to fix. Task stays at completed.');
     out.push('When the grader is reachable again, re-grade:');
@@ -308,7 +339,17 @@ function formatGradeOutcome(g, taskId) {
 // last resort — see feedback_prefer_regrade_over_override). #943: a total grader
 // outage prints as "GRADER UNAVAILABLE", not a 0/10 FAIL — see formatGradeOutcome.
 function printGradeOutcome(g, taskId) {
-  console.log(formatGradeOutcome(g, taskId));
+  // task 1003313: on a TOTAL outage only, ask the existing preflight whether the
+  // local `claude` CLI is launchable and logged in — the two faults that produce
+  // this exact all-workers-dead signature. Report-only and outage-only, so the
+  // happy path pays nothing and no ship is newly gated (ADR 0162).
+  let cliFinding = null;
+  if (g?.signals?.panel_outcome === 'unavailable') {
+    try {
+      cliFinding = preflightChecks().find((r) => r.title === 'claude CLI') || null;
+    } catch (_) { /* best-effort: a broken probe must never mask the grade output */ }
+  }
+  console.log(formatGradeOutcome(g, taskId, cliFinding));
 }
 
 // Print the credits line + multiplier breakdown + idea bonus + unlocked

package/src/module-api.js

@@ -1206,8 +1206,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.381 with no explicit bump. run 33094545251. (task 1002620)
 //   1.19.383 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.382 with no explicit bump. run 33101389971. (task 1002620)
+//   1.19.384 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.383 with no explicit bump. run 33116184189. (task 1002620)
+//   1.19.385 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.384 with no explicit bump. run 33118682829. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.383'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.385'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');