@bongos/core 1.19.46 → 1.19.47

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.46",
-  "core_contract": "1.19.46",
-  "source_commit": "435360b40bbcf1f8b67e811825d20c78a80fd441",
+  "core_version": "1.19.47",
+  "core_contract": "1.19.47",
+  "source_commit": "db1b5f6d74e9840d6f87d3cf3c8c5a4b16f5a667",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:01:18.461Z",
+  "built_at": "2026-08-11T18:11:51.578Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 290,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1214,
+    "functional_verbatim": 1216,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1525,
-  "tree_sha256": "3a3587819ec4fe0e5609aee28a9d9b8bd3bc11af62addc3d85d760946f0882f0",
+  "file_count": 1527,
+  "tree_sha256": "7183ad3d761a851cbc20b435a3b193c60c242e90bf4808ea3d0c68bbb798a1d0",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1372,7 +1372,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "15801d1c51e7e46ccf4e52dad5d3d34e4adc96b72eed60e3ef2c9ccccf94d1da"
+      "sha256": "01f8ff6aaa583d333b466f4d5cff849c09327653c33dcb3d82d60cc46f913cb8"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2857,7 +2857,7 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "6917875f2be5c39248b44caf7bf8d50f68cbe8effbc2bfdef3ba11e5ac17fc6c"
+      "sha256": "2e080d8d50383a24d77f9cf166f6e93e05e7bccc8775d14bbf68f2d6733eecd4"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -2912,7 +2912,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "8073955da873ca3fa779ef614368af52e9f0be93b800f0590f07d34fceca5545"
+      "sha256": "f6b80df54bb7634a9effb1cbe51b3ff99b05b0b7912be5a06690f63d237689f9"
     },
     {
       "path": "modules/grading/module.json",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aed2f26ebe4fe2b47756e44e59e7860370bc7915772c5cd8dcf409861e87f6c7"
+      "sha256": "c91ae553a7cd336d399c802db07c4aac4fb744633cf5c26a6da00a5c65b02a18"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "615ec3ed94ced936891d834826b98bbfeae529dad7c1886d13c6230c6d63d88a"
+      "sha256": "cac25ff2006b5e47c3a22049068c6c155b3c9026860bda78a5c952996b050304"
     },
     {
       "path": "public-docs/index.html",
@@ -5227,7 +5227,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "616d72a72f4603fe303434f3302b9a227d1dbb81215c5e35ee37133fb8ce06c0"
+      "sha256": "94f343beba33727cb83367555c35a699f53c8efa5d59e3b65d3f6a1cf3e0e3b0"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "430e72a0dc3b4e87e8a1edee33314295aae624c736065d69f5c9ea5efbb7c41b"
+      "sha256": "ac8f21f650da5da4f71f922b918e87bc5bfcf530c1b0b6210623bf7edd9433b0"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6637,7 +6637,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "9c8525b85be898be30d6034902b34fcdedb16cf4b37fa8d79fbd5d1fb89898cb"
+      "sha256": "227d71aaab363d9346c3034f41cfb518e866b49bb460802b32626f288ecdcd76"
     },
     {
       "path": "tests/grader_bypass.mjs",
@@ -6789,6 +6789,11 @@
       "mode": "0000644",
       "sha256": "7fa36152b6dbb17b2855d261ddbea96af63d26f97001273cd131104235ea431d"
     },
+    {
+      "path": "tests/linkify_check.mjs",
+      "mode": "0000644",
+      "sha256": "810683a5283bd5fd7ef66b4f183b4fe8f978b03e156736c5c7cb91fc4f906c99"
+    },
     {
       "path": "tests/linkify_refs.mjs",
       "mode": "0000644",
@@ -7424,6 +7429,11 @@
       "mode": "0000644",
       "sha256": "2bb81a2649402bc2c17b04d17a4d749ff674f1bf5ac101d168412e709bea8550"
     },
+    {
+      "path": "tests/ship_builder_model.mjs",
+      "mode": "0000644",
+      "sha256": "afdb09a3ee072fea82390a187c12c42d8249fce0ce84644a4b8dff6a643dd009"
+    },
     {
       "path": "tests/ship_card.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -157,7 +157,7 @@
 │       ├── dev.js               ← `bongos dev`: one-command LOCAL launcher for a standalone instance (Postgres → createdb → migrate → server on the branding port → sign-in); up/stop/status (ADR 0149)
 │       ├── dev-lib.js           ← pure + injectable core of `bongos dev` (branding→port/db/env resolution, managed detached server pid/health); unit-tested by tests/dev_lib.mjs (ADR 0149)
 │       ├── session-eval.js      ← BFG session-inefficiency analysis engine (6D.3): classify turns, compute ceremony-vs-work, detect footguns, file systemic findings (ADR 0027)
-│       ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: .github/workflows/doc-ref-linkify.yml) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
+│       ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: tests/linkify_check.mjs, in the required `unit` check) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
 │       ├── release.js           ← resolve claim as abandoned (`/builder-release`)
 │       ├── cost.js              ← log a cost entry (`/builder-cost`)
 │       ├── me.js                ← current builder profile + leaderboard

package/modules/grading/grader-rubric.json

@@ -8,8 +8,9 @@
     "grader_kind": "subagent-panel",
     "threshold": 6.0,
     "gate": "All workers in the active panel must independently report verdict='pass' for confirmed→credits. Any worker reporting 'fail' (or erroring out) keeps the task at completed. Any worker reporting 'concerns' (low confidence, partial AC, advisory economy below threshold, major non-blocker issue, etc.) falls through to the manual-confirm path (POST /tasks/:id/confirm) — same release-valve as v3 low-confidence. The 'concerns' verdict is forwarded to the server-side validateAndScore as confidence=fallthrough_confidence (0.3 by default, below LOW_CONFIDENCE=0.4) so the existing server gate aligns without protocol changes.",
-    "default_model": "claude-sonnet-4-6",
-    "assumed_builder_model": "claude-opus-4-7",
+    "default_model": "claude-sonnet-5",
+    "assumed_builder_model": "claude-fable-5",
+    "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,

package/modules/grading/grader.js

@@ -99,8 +99,8 @@ const LOW_CONFIDENCE = V4.low_confidence_threshold;
 // DEFAULT_SHOTS is kept for the v3 multi-shot path (still exported for
 // diagnostics); v4 doesn't use shots — it uses workers.
 const DEFAULT_SHOTS = V3.shots || 3;
-const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-opus-4-7';
-const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-4-6';
+const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
+const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
 const workers = require('./grader-workers');
 // Carved into modules/grading/ (BV1.R73 / ADR 0091 §1+§4): the two deterministic
@@ -208,27 +208,31 @@ function isTrivialDiff({ changedFiles, diffStats } = {}) {
 
 // ---------- v3: cross-family model selection (ADR 0024) ----------
 
-// Returns the grader model given the builder's model — a DIFFERENT family from
-// the builder is the cross-family adversarial guarantee. With no builderModel
-// the caller is assuming the default Opus builder (CLAUDE.md §2), so it resolves
-// through the opus branch to Sonnet — that is the legitimate default path the
-// live callers (selectGraderModel({})) take.
+// Returns the grader model given the builder's model — a DIFFERENT model from
+// the builder is the cross-model adversarial guarantee (ADR 0024). With no
+// builderModel the caller assumes the owner-top-model builder (CLAUDE.md §2),
+// resolving to the default grader — the path selectGraderModel({}) takes.
 //
-// #117: an EXPLICITLY-supplied model we don't recognize is a misconfiguration,
-// not a default. We used to silently fall back to Sonnet, which would mask a
-// future model family (one whose id lacks 'opus'/'sonnet'/'haiku') and quietly
-// grade it on the wrong cross-family assumption. Throw loudly instead so the
-// caller fixes the input rather than getting a silently-wrong grader model.
+// task 1002659 (Claude 5 refresh): top-tier builders (fable/mythos, opus)
+// grade on the current mid tier; sonnet/haiku builders grade on the tier
+// above. #117's throw-on-unknown is reversed: the throw fired INSIDE the
+// grade step, stranding any ship whose builder id lacked an opus/sonnet/haiku
+// substring (claude-fable-5 was exactly that) — a worse failure than the
+// misconfiguration it guarded. Unknown ids now warn loudly and grade on
+// DEFAULT_GRADER_MODEL; the id still reaches signals.builder_model_assumed,
+// so /grader-health can spot the drift.
 function selectGraderModel({ builderModel } = {}) {
   const bm = (builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
-  if (bm.includes('opus')) return 'claude-sonnet-4-6';
-  if (bm.includes('sonnet')) return 'claude-opus-4-7';
-  if (bm.includes('haiku')) return 'claude-opus-4-7';
-  throw new Error(
+  if (bm.includes('fable') || bm.includes('mythos')) return 'claude-sonnet-5';
+  if (bm.includes('opus')) return 'claude-sonnet-5';
+  if (bm.includes('sonnet')) return 'claude-opus-5';
+  if (bm.includes('haiku')) return 'claude-opus-5';
+  console.error(
     `selectGraderModel: unrecognized builder model ${JSON.stringify(builderModel)} — ` +
-    `expected an id containing 'opus', 'sonnet', or 'haiku'. Refusing to silently ` +
-    `fall back to a default grader model (#117).`
+    `no 'fable'/'mythos'/'opus'/'sonnet'/'haiku' token; grading on the default ` +
+    `${DEFAULT_GRADER_MODEL} (cross-model unverifiable — task 1002659, was a #117 throw)`
   );
+  return DEFAULT_GRADER_MODEL;
 }
 
 // ---------- v3: prompt builder (default-fail framing) ----------

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.46",
+  "version": "1.19.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.46",
+      "version": "1.19.47",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.46",
+  "version": "1.19.47",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -251,6 +251,39 @@ function resolveTranscriptPath(sessionId, projectDirs, opts = {}) {
   return null;
 }
 
+// resolveBuilderModel — the REAL model that authored this session's work, read
+// from the session transcript (dominant by output tokens, synthetic turns
+// skipped), so selectGraderModel gets a true cross-model input instead of the
+// ASSUMED_BUILDER_MODEL fallback (task 1002659 — everything graded on the
+// assumed-builder default before this). Best-effort: no session id, no
+// transcript, or any read error → null → the grader assumes, as before.
+function resolveBuilderModel(opts = {}) {
+  try {
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    // Same path-traversal guard as uploadSessionOnShip: the id lands in a path.
+    if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
+    const transcriptPath = resolveTranscriptPath(sessionId, [process.cwd(), REPO_ROOT].filter(Boolean), opts);
+    if (!transcriptPath) return null;
+    const perModel = new Map();
+    for (const line of fs.readFileSync(transcriptPath, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      let o;
+      try { o = JSON.parse(line); } catch (_) { continue; }
+      const msg = o && o.message;
+      if (!msg || !msg.model || msg.model === '<synthetic>' || !msg.usage) continue;
+      perModel.set(msg.model, (perModel.get(msg.model) || 0) + (Number(msg.usage.output_tokens) || 0));
+    }
+    let best = null;
+    let bestTokens = 0;
+    for (const [model, tokens] of perModel) {
+      if (tokens > bestTokens) { best = model; bestTokens = tokens; }
+    }
+    return best;
+  } catch (_) {
+    return null;
+  }
+}
+
 function resolveMemoryDir() {
   // REPO_ROOT is the main worktree (canonical project checkout). The memory dir
   // is keyed to that path, not the per-task feature worktree we're shipping from.
@@ -1812,11 +1845,10 @@ function mergeMainIntoBranch() {
 
 // ---------- Pre-verify: auto-linkify the ship's own changed docs ----------
 //
-// The doc-ref-linkify CI gate (.github/workflows/doc-ref-linkify.yml) runs on
-// push:main — i.e. AFTER ship's auto-merge has already landed the commit. So a
-// single bare "#NNN" task ref that slips into a doc red-Xes the build and
-// emails a failure for an already-merged commit. Caught post-merge, the gate is
-// pure noise: it can't prevent the leak, only complain about it (#747).
+// The doc-ref-linkify CI gate (tests/linkify_check.mjs, in the required `unit`
+// check — task 1002639; a standalone doc-ref-linkify.yml workflow never
+// actually existed) red-Xes a PR carrying a bare "#NNN" task ref in a doc. A
+// red-X after the builder walked away still strands the land (#747).
 //
 // The structural cure is to fix the ship's OWN changed docs here, before the
 // merge, and commit the rewrite. The gate then stays as the backstop for refs
@@ -2062,6 +2094,9 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
     timeoutMs: GRADER_TIMEOUT_MS,
     cwd: process.cwd(), // grade the FEATURE worktree, not REPO_ROOT
   };
+  // task 1002659: the real session model (transcript-derived) drives the
+  // cross-model grader pick; null → the grader assumes, as before.
+  const builderModel = resolveBuilderModel();
   const t0 = Date.now();
   let result;
   // #513: a small copy/docs-only diff gets a SINGLE generalist grader shot
@@ -2071,7 +2106,7 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
   // inefficiency of running a 4-worker panel on a +1/-1 copy tweak.
   if (grader.isTrivialDiff({ changedFiles, diffStats: shortstat })) {
     const totalLines = (shortstat.lines_added || 0) + (shortstat.lines_removed || 0);
-    console.log(`  subagent grader ${grader.VERSION}: TRIVIAL diff (${shortstat.files_changed} file(s), ${totalLines} line(s), copy/docs only) → single generalist shot, model=${grader.selectGraderModel({})} — instead of the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel (#513)`);
+    console.log(`  subagent grader ${grader.VERSION}: TRIVIAL diff (${shortstat.files_changed} file(s), ${totalLines} line(s), copy/docs only) → single generalist shot, model=${grader.selectGraderModel({ builderModel })} — instead of the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel (#513)`);
     console.log(`  gate: the shot must return functional_fidelity>=${grader.THRESHOLD} AND code_quality>=${grader.THRESHOLD} AND confidence>=0.4`);
     result = await grader.gradeSubagentV3MultiShot({
       task,
@@ -2080,11 +2115,12 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       changedFiles,
       diffStats: shortstat,
       shots: 1,
+      builderModel, // task 1002659: real session model → cross-model grader pick
       runOpts,
     });
   } else {
     const panel = grader.WORKERS.DEFAULT_PANEL;
-    console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.DEFAULT_GRADER_MODEL} (assumed builder ${grader.ASSUMED_BUILDER_MODEL}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
+    console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
     console.log(`  gate: every worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
     if (priorRound) {
       console.log(`  delta re-grade (task 1002662): prior round's findings + builder response ride along, fenced; answered findings can only re-veto with NEW evidence`);
@@ -2096,6 +2132,7 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       changedFiles,
       diffStats: shortstat, // V3.R92 #353: feed diff size into the economy axis
       builderRank,          // SEC #863: drives the permission-path pre-pass
+      builderModel,         // task 1002659: real session model → cross-model grader pick
       priorRound,           // task 1002662: delta-aware re-grade context (panel path only)
       runOpts,
     });
@@ -3647,8 +3684,8 @@ async function shipMain() {
 
   // ---- Pre-verify: auto-linkify this ship's own changed docs (#747) ----
   // Fix bare "#NNN" task refs in the docs this ship changed BEFORE the merge,
-  // so they never reach main and red-X the post-merge doc-ref-linkify gate.
-  // Best-effort.
+  // so they never red-X the doc-ref-linkify gate (tests/linkify_check.mjs in
+  // the `unit` check). Best-effort.
   autoLinkifyChangedDocs(ac);
 
   // ---- Empty-diff / phantom-ship guard (must run BEFORE the review gate + resolve) ----
@@ -4221,6 +4258,9 @@ async function regradeMain() {
 // exported: it does I/O + network and is covered by the live smoke at ship.)
 module.exports = {
   scrubSecrets, snippetOf, buildSessionDigest, resolveTranscriptPath,
+  // task 1002659: transcript-derived real builder model (dominant by output
+  // tokens) — exported pure-ish (fs read only, opts-injectable) for the test.
+  resolveBuilderModel,
   // task 1002471: the project-path encoder, exported pure so the win32 shapes
   // (drive colon, backslash separators, spaces) are pinned cross-platform —
   // resolveTranscriptPath itself runs path.resolve, which can't carry a Windows

package/src/module-api.js

@@ -519,8 +519,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.44 with no explicit bump. run 31519500533. (task 1002620)
 //   1.19.46 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.45 with no explicit bump. run 31520432748. (task 1002620)
+//   1.19.47 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.46 with no explicit bump. run 31521404176. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.46'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.47'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -192,8 +192,8 @@ test('v4 exports the expected surface (current panel-based gate)', () => {
   assert.ok(grader.THRESHOLD >= 5.0 && grader.THRESHOLD <= 10.0);
   assert.ok(grader.VERSION.startsWith('v4'), `expected v4.*, got ${grader.VERSION}`);
   assert.equal(grader.DEFAULT_SHOTS, 3); // kept for v3 multi-shot diagnostic path
-  assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-4-6');
-  assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-opus-4-7');
+  assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-5'); // task 1002659: Claude 5 family pin
+  assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-fable-5');
   assert.equal(grader.FALLTHROUGH_CONFIDENCE, 0.3);
   // Worker registry sanity — Phase 2.2 added efficiency as the 4th worker
   // (after Phase 2.1's hacker).
@@ -819,32 +819,36 @@ test('v2 extractAssistantResult: passes-through non-envelope output', () => {
 // v3 — cross-family selection + multi-shot aggregation (MAS Phase 1 / #395)
 // ========================================================================
 
-test('v3 selectGraderModel: builder Opus → grader Sonnet (cross-family)', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-7' }), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-8' }), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel({ builderModel: 'opus' }), 'claude-sonnet-4-6');
+test('selectGraderModel: builder Fable/Mythos → grader Sonnet 5 (cross-model, task 1002659)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-fable-5' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-mythos-5' }), 'claude-sonnet-5');
 });
 
-test('v3 selectGraderModel: builder Sonnet → grader Opus (cross-family)', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-sonnet-4-6' }), 'claude-opus-4-7');
-  assert.equal(grader.selectGraderModel({ builderModel: 'sonnet' }), 'claude-opus-4-7');
+test('selectGraderModel: builder Opus → grader Sonnet (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-5' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-8' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'opus' }), 'claude-sonnet-5');
 });
 
-test('v3 selectGraderModel: builder Haiku → grader Opus', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-haiku-4-5-20251001' }), 'claude-opus-4-7');
-  assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-4-7');
+test('selectGraderModel: builder Sonnet → grader Opus (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-sonnet-5' }), 'claude-opus-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'sonnet' }), 'claude-opus-5');
 });
 
-test('selectGraderModel: missing builder → default Sonnet (assumed-Opus builder); explicit unknown THROWS (#117)', () => {
-  // No builderModel is the legitimate default path (the caller assumes the Opus
-  // builder per CLAUDE.md §2), so it resolves through the opus branch to Sonnet.
-  // This is the path the live callers — selectGraderModel({}) — take.
-  assert.equal(grader.selectGraderModel({}), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel(), 'claude-sonnet-4-6');
-  // An explicitly-supplied unrecognized model is a misconfiguration: loud-throw
-  // instead of silently grading on the wrong cross-family assumption (#117).
-  assert.throws(() => grader.selectGraderModel({ builderModel: 'gpt-4' }), /unrecognized builder model/);
-  assert.throws(() => grader.selectGraderModel({ builderModel: 'llama-3' }), /unrecognized builder model/);
+test('selectGraderModel: builder Haiku → grader Opus', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-haiku-4-5-20251001' }), 'claude-opus-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-5');
+});
+
+test('selectGraderModel: missing builder → default (assumed-Fable builder → Sonnet 5); unknown id FALLS BACK, never throws (task 1002659)', () => {
+  // No builderModel is the legitimate default path (the caller assumes the
+  // owner-top-model builder per CLAUDE.md §2), resolving to the default grader.
+  assert.equal(grader.selectGraderModel({}), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel(), 'claude-sonnet-5');
+  // task 1002659 reverses #117's throw: an unknown id used to strand the ship
+  // inside the grade step. Now it warns loudly and grades on the default model.
+  assert.equal(grader.selectGraderModel({ builderModel: 'gpt-4' }), grader.DEFAULT_GRADER_MODEL);
+  assert.equal(grader.selectGraderModel({ builderModel: 'llama-3' }), grader.DEFAULT_GRADER_MODEL);
 });
 
 // --- aggregateShots: helpers ---

package/tests/linkify_check.mjs

@@ -0,0 +1,39 @@
+// tests/linkify_check.mjs — the doc-ref linkify CI gate (task 1002639).
+//
+// docs/file-map.md long claimed a `.github/workflows/doc-ref-linkify.yml` CI
+// gate that never existed (the G-20 phantom-reference shape). This test IS the
+// gate, made real the cheap way: it runs inside the required `unit` check, so a
+// committed doc with a bare `#NNN` ref (which GitHub would mis-autolink to its
+// own issues) fails the PR. linkify-refs.js --check already fails OPEN when the
+// /public/ref-ids allow-list is unreachable (a network blip must not red-X an
+// unrelated build); the spawn timeout below mirrors that posture — infra
+// slowness is a warn + skip, never a false red.
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(REPO, 'scripts', 'gds', 'linkify-refs.js');
+const SPAWN_TIMEOUT_MS = 60_000; // under run-unit-tests' 90s so WE decide the timeout outcome
+
+const r = spawnSync(process.execPath, [SCRIPT, '--check'], {
+  cwd: REPO,
+  encoding: 'utf8',
+  timeout: SPAWN_TIMEOUT_MS,
+  maxBuffer: 8 * 1024 * 1024,
+});
+
+if (r.error && r.error.code === 'ETIMEDOUT') {
+  console.warn(`linkify_check: --check did not finish in ${SPAWN_TIMEOUT_MS}ms — skipping (fail-open on infra, matching the script's own --check posture).`);
+  process.exit(0);
+}
+
+assert.equal(r.error, undefined, `linkify-refs.js --check failed to spawn: ${r.error && r.error.message}`);
+assert.equal(
+  r.status,
+  0,
+  `linkify-refs.js --check found bare/upgradeable refs in committed docs — run \`node scripts/gds/linkify-refs.js --apply\` and commit.\n${r.stdout}\n${r.stderr}`
+);
+console.log('linkify_check: committed docs carry no bare #NNN refs (linkify-refs.js --check exit 0).');

package/tests/ship_builder_model.mjs

@@ -0,0 +1,76 @@
+// tests/ship_builder_model.mjs — task 1002659: resolveBuilderModel reads the
+// session transcript and returns the dominant model by output tokens, so the
+// grader's cross-model pick keys on what actually authored the work.
+import assert from 'node:assert';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (e) {
+    console.error(`FAIL  ${name}\n      ${e.message}`);
+    failed++;
+  }
+}
+
+// Mirror ship.js's transcript layout: <base>/projects/<encoded cwd>/<sessionId>.jsonl
+function writeTranscript(base, sessionId, lines) {
+  const encoded = ship.encodeProjectPath(path.resolve(process.cwd()));
+  const dir = path.join(base, 'projects', encoded);
+  fs.mkdirSync(dir, { recursive: true });
+  const p = path.join(dir, `${sessionId}.jsonl`);
+  fs.writeFileSync(p, lines.map((l) => JSON.stringify(l)).join('\n'));
+  return p;
+}
+
+const msg = (model, outputTokens) => ({
+  message: { model, usage: { output_tokens: outputTokens } },
+});
+
+const base = fs.mkdtempSync(path.join(os.tmpdir(), 'ship-builder-model-'));
+const SESSION = 'test-session-1002659';
+const prevSession = process.env.CLAUDE_CODE_SESSION_ID;
+process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+
+writeTranscript(base, SESSION, [
+  msg('claude-fable-5', 900),
+  msg('claude-haiku-4-5-20251001', 50),
+  msg('claude-fable-5', 800),
+  { message: { model: '<synthetic>', usage: { output_tokens: 99999 } } }, // skipped
+  { not_a_message: true },
+]);
+
+test('dominant-by-output-tokens model wins; synthetic turns are skipped', () => {
+  assert.equal(ship.resolveBuilderModel({ base }), 'claude-fable-5');
+});
+
+test('no transcript for the session → null (grader assumes)', () => {
+  process.env.CLAUDE_CODE_SESSION_ID = 'no-such-session';
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+});
+
+test('missing or path-hostile session id → null', () => {
+  delete process.env.CLAUDE_CODE_SESSION_ID;
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = '../evil';
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+});
+
+if (prevSession === undefined) delete process.env.CLAUDE_CODE_SESSION_ID;
+else process.env.CLAUDE_CODE_SESSION_ID = prevSession;
+fs.rmSync(base, { recursive: true, force: true });
+
+console.log(`\nship_builder_model: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);