@bongos/core 1.19.43 → 1.19.44

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.43",
-  "core_contract": "1.19.43",
-  "source_commit": "05c2bc1f374ff18405ce4b57b143272651a69fc4",
+  "core_version": "1.19.44",
+  "core_contract": "1.19.44",
+  "source_commit": "8977d1fd08e8b805bc0322ba60414afb27f6af9a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T17:22:46.634Z",
+  "built_at": "2026-08-11T17:35:45.947Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 290,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1524,
-  "tree_sha256": "eb5d84a56e1d201e95d819069e5ded36815bf9fb42f87cc3e010519919ca6782",
+  "tree_sha256": "e598e5acc03b2b1f6de9186840fddf8d59bebc82acbc22c8a4915485c52f14da",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2912,7 +2912,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "3d16940e2bb354bc029893abc5cdd1a3e4868d51c65e5fed22cabf6610c69533"
+      "sha256": "8073955da873ca3fa779ef614368af52e9f0be93b800f0590f07d34fceca5545"
     },
     {
       "path": "modules/grading/module.json",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "db2480e2132dffe5cc11ccdcf5871afaeabd1fe07fcacd68acf85179ad5169f6"
+      "sha256": "04a8db8a6fe00295eda2dfc32a50ee78e14010f0ea4edc2519ea81be19d0768a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "29562210449cebade43e9b7a27da435784bdabd3313f6b41e05ff0059f0bd2d3"
+      "sha256": "dd4b705a9876034077010b79006d60c356cb50b4cb1e3bfe3bc3585c55d3bb7d"
     },
     {
       "path": "public-docs/index.html",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ec430cc3f3ca679123babbd62b5e512bc542ac4c0ff28d3970450d226180c9f9"
+      "sha256": "c29bd1491d2a2ebb5dd7f27f3be44aa3052bab88caa02e5825c7e74560b9b261"
     },
     {
       "path": "src/module-loader/loader.js",

package/modules/grading/grader.js

@@ -23,8 +23,9 @@
 //
 // ## What's new in v4
 //
-//   3. WORKER PANEL. gradeSubagent runs DEFAULT_PANEL (narc + quality) in
-//      parallel; aggregatePanel applies the gate. Each worker has its own
+//   3. WORKER PANEL. gradeSubagent runs DEFAULT_PANEL in parallel (narc +
+//      quality at v4; hacker + efficiency joined in Phase 2.1/2.2 — 4 workers
+//      today); aggregatePanel applies the gate. Each worker has its own
 //      prompt, parser, scoring, and per-worker pass/concerns/fail verdict.
 //   4. STRUCTURED VERDICTS. pass | concerns | fail (not just pass/fail).
 //      'concerns' falls through to the manual-confirm path the same way
@@ -42,8 +43,10 @@
 //   gradeSubagent({task, valueSummary, diff, changedFiles, diffStats,
 //                  workers?, builderModel, runOpts})
 //       → end-to-end panel grade-result. workers? defaults to DEFAULT_PANEL
-//       (narc + quality). Wraps subprocess failures so resolveClaim/applyGrade
-//       can always write task_grades.
+//       (narc + quality + hacker + efficiency — the full 4-worker panel, so an
+//       honest ship always clears hasPanelEvidence's ≥3-worker floor). Wraps
+//       subprocess failures so resolveClaim/applyGrade can always write
+//       task_grades.
 //
 //   aggregatePanel(workerResults, meta)
 //       → final grade-result from per-worker WorkerResults. Applies the
@@ -1606,8 +1609,11 @@ function graderUnavailableResult({ reason, note, meta = {} } = {}) {
 // End-to-end v4 grader. Runs the worker panel through the cross-family
 // grader model and returns the panel-aggregated grade-result.
 //
-// workers: defaults to DEFAULT_PANEL (narc + quality). An array of worker
-//   kinds (strings) like ['narc', 'quality']. Phase 2.1/2.2 will extend.
+// workers: defaults to DEFAULT_PANEL (narc + quality + hacker + efficiency —
+//   the full 4-worker panel since Phase 2.1/2.2). An array of worker kinds
+//   (strings) like ['narc', 'quality']. A default-panel run always satisfies
+//   hasPanelEvidence's ≥3-worker floor, so an honest unanimous zero-issue
+//   PASS is waived, never manual-confirm-gated (task 1002664 / ADR 0164).
 // builderModel: the model the builder used. Defaults to ASSUMED_BUILDER_MODEL
 //   (Opus, per CLAUDE.md §2). Drives selectGraderModel — workers pick the
 //   cross-family alternative.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.43",
+  "version": "1.19.44",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.43",
+      "version": "1.19.44",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.43",
+  "version": "1.19.44",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -513,8 +513,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.41 with no explicit bump. run 31515200576. (task 1002620)
 //   1.19.43 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.42 with no explicit bump. run 31517196176. (task 1002620)
+//   1.19.44 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.43 with no explicit bump. run 31518312009. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.43'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.44'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');