@bongos/core 1.19.42 → 1.19.44

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.42",
-  "core_contract": "1.19.42",
-  "source_commit": "5cea0fff406cf86e912a25149eb87986656d0f73",
+  "core_version": "1.19.44",
+  "core_contract": "1.19.44",
+  "source_commit": "8977d1fd08e8b805bc0322ba60414afb27f6af9a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T16:59:23.559Z",
+  "built_at": "2026-08-11T17:35:45.947Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 290,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1524,
-  "tree_sha256": "5b305916c72de8b21549272bd98177ea5d5598835afc836cdc64702446d656c0",
+  "tree_sha256": "e598e5acc03b2b1f6de9186840fddf8d59bebc82acbc22c8a4915485c52f14da",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2912,7 +2912,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "3d16940e2bb354bc029893abc5cdd1a3e4868d51c65e5fed22cabf6610c69533"
+      "sha256": "8073955da873ca3fa779ef614368af52e9f0be93b800f0590f07d34fceca5545"
     },
     {
       "path": "modules/grading/module.json",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a5b5936de1fcb8708812f735062af5181aed26a928aa43cdc1eebf4ffa64d46e"
+      "sha256": "04a8db8a6fe00295eda2dfc32a50ee78e14010f0ea4edc2519ea81be19d0768a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6ab80483db4f5b74e73501ef1ea545add3f10ad0456dd3d223b1421b66bbc85"
+      "sha256": "dd4b705a9876034077010b79006d60c356cb50b4cb1e3bfe3bc3585c55d3bb7d"
     },
     {
       "path": "public-docs/index.html",
@@ -4667,7 +4667,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "1de7bfa7bcd4201cc24b3ab3afb714b0356e175174767e77d2491bcbfab58508"
+      "sha256": "8c6d81c0495d05833bf5cb3d0be8ff6a29fabc24231206391f36b0c85f36b121"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -4767,7 +4767,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "33ed6d0a1a829b2312925e379bcc6f49282e707aec28377fbc23464e0d846a70"
+      "sha256": "569a06e7cb448dab63a3acbcbf9c5366e394252c38edbe477d4d58282a9984c4"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "01e90353c87403bb4ec9f8be30139147e6178bb86ca2d24954e4cd4dc3fd274f"
+      "sha256": "c29bd1491d2a2ebb5dd7f27f3be44aa3052bab88caa02e5825c7e74560b9b261"
     },
     {
       "path": "src/module-loader/loader.js",

package/modules/grading/grader.js

@@ -23,8 +23,9 @@
 //
 // ## What's new in v4
 //
-//   3. WORKER PANEL. gradeSubagent runs DEFAULT_PANEL (narc + quality) in
-//      parallel; aggregatePanel applies the gate. Each worker has its own
+//   3. WORKER PANEL. gradeSubagent runs DEFAULT_PANEL in parallel (narc +
+//      quality at v4; hacker + efficiency joined in Phase 2.1/2.2 — 4 workers
+//      today); aggregatePanel applies the gate. Each worker has its own
 //      prompt, parser, scoring, and per-worker pass/concerns/fail verdict.
 //   4. STRUCTURED VERDICTS. pass | concerns | fail (not just pass/fail).
 //      'concerns' falls through to the manual-confirm path the same way
@@ -42,8 +43,10 @@
 //   gradeSubagent({task, valueSummary, diff, changedFiles, diffStats,
 //                  workers?, builderModel, runOpts})
 //       → end-to-end panel grade-result. workers? defaults to DEFAULT_PANEL
-//       (narc + quality). Wraps subprocess failures so resolveClaim/applyGrade
-//       can always write task_grades.
+//       (narc + quality + hacker + efficiency — the full 4-worker panel, so an
+//       honest ship always clears hasPanelEvidence's ≥3-worker floor). Wraps
+//       subprocess failures so resolveClaim/applyGrade can always write
+//       task_grades.
 //
 //   aggregatePanel(workerResults, meta)
 //       → final grade-result from per-worker WorkerResults. Applies the
@@ -1606,8 +1609,11 @@ function graderUnavailableResult({ reason, note, meta = {} } = {}) {
 // End-to-end v4 grader. Runs the worker panel through the cross-family
 // grader model and returns the panel-aggregated grade-result.
 //
-// workers: defaults to DEFAULT_PANEL (narc + quality). An array of worker
-//   kinds (strings) like ['narc', 'quality']. Phase 2.1/2.2 will extend.
+// workers: defaults to DEFAULT_PANEL (narc + quality + hacker + efficiency —
+//   the full 4-worker panel since Phase 2.1/2.2). An array of worker kinds
+//   (strings) like ['narc', 'quality']. A default-panel run always satisfies
+//   hasPanelEvidence's ≥3-worker floor, so an honest unanimous zero-issue
+//   PASS is waived, never manual-confirm-gated (task 1002664 / ADR 0164).
 // builderModel: the model the builder used. Defaults to ASSUMED_BUILDER_MODEL
 //   (Opus, per CLAUDE.md §2). Drives selectGraderModel — workers pick the
 //   cross-family alternative.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.42",
+  "version": "1.19.44",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.42",
+      "version": "1.19.44",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.42",
+  "version": "1.19.44",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -160,7 +160,7 @@ const CONCEPTUAL_TASK_IDS = {
   273: 'R54 — builder_memory store schema',
   274: 'R55 — sync-on-ship (push)',
   275: 'R56 — pull-on-session-start',
-  276: 'R57 — per-builder isolation + Archon audited forensic read',
+  276: 'R57 — per-builder isolation + forensic read at Metic+ (ADR 0157)',
   // 03-drachmae-karma — bounty.
   284: 'R65 — bounty payout rate card (src/bongos/security.js + /builders)',
   286: 'R67 — auto-confirmation flow that awards drachmae (the awarding gate)',

package/scripts/gds/gen-diagrams.js

@@ -439,7 +439,7 @@ function architectureMmd(f) {
     '        CORE["@bongos/core — the build platform, VENDORED as a pinned dependency\\n(ADR 0108: central updates are a version-pin bump via `bongos upgrade`, not a merge)"]',
     '        DB["Postgres — tasks · claims · versions · builders.rank\\ncredit_log · grades · idea_inbox · builder_memory\\n(KING for work-state + permissions; CLAUDE.md only describes it)"]',
     '        RANK["auth.requireRank — checked per request, NO caching\\n(ADR 0016: a demotion takes effect on the next request)"]',
-    `        SRVMEM["server-side builder_memory store\\n${memLead}: per-builder · isolated · Archon-audited forensic read\\nyour memory follows you across machines & worktrees\\n/recall fetches only the relevant subset (ADR 0060)\\n(${memStatus})"]`,
+    `        SRVMEM["server-side builder_memory store\\n${memLead}: per-builder · isolated · forensic read at Metic+ (ADR 0157)\\nyour memory follows you across machines & worktrees\\n/recall fetches only the relevant subset (ADR 0060)\\n(${memStatus})"]`,
     `        PUSHTOK["server-held push credential\\n(${pushCred} — the box never holds it)"]`,
     '        DEPLOY["auto-pull deploy (ADR 0129)\\na timer pulls THIS instance repo every ~2 min →\\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]',
     '    end',

package/src/module-api.js

@@ -511,8 +511,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.40 with no explicit bump. run 31513793491. (task 1002620)
 //   1.19.42 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.41 with no explicit bump. run 31515200576. (task 1002620)
+//   1.19.43 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.42 with no explicit bump. run 31517196176. (task 1002620)
+//   1.19.44 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.43 with no explicit bump. run 31518312009. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.42'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.44'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');