@bongos/core 1.19.46 → 1.19.48

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.46",
-  "core_contract": "1.19.46",
-  "source_commit": "435360b40bbcf1f8b67e811825d20c78a80fd441",
+  "core_version": "1.19.48",
+  "core_contract": "1.19.48",
+  "source_commit": "55b3c049db775bb60d3749a998a44110a340f3fa",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:01:18.461Z",
+  "built_at": "2026-08-11T18:28:57.362Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 290,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1214,
+    "functional_verbatim": 1217,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1525,
-  "tree_sha256": "3a3587819ec4fe0e5609aee28a9d9b8bd3bc11af62addc3d85d760946f0882f0",
+  "file_count": 1528,
+  "tree_sha256": "be96d3ccab1f445af630ea28b9609a9dc3dfba76aa75b5bc394a97e9d9a1d166",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1327,7 +1327,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "dd85972912629d370d8fc79eff1661001e6b4ba9abe9866181c14fb0782c3131"
+      "sha256": "3cc48fe7b291976d819450202090b0df0c165d2470f5895a16febb7cdd5834a2"
     },
     {
       "path": "docs/design-contract.md",
@@ -1372,7 +1372,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "15801d1c51e7e46ccf4e52dad5d3d34e4adc96b72eed60e3ef2c9ccccf94d1da"
+      "sha256": "01f8ff6aaa583d333b466f4d5cff849c09327653c33dcb3d82d60cc46f913cb8"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "modules/economy/achievements.js",
       "mode": "0000644",
-      "sha256": "a68a7a4a1fcb5fd8c0f0fb0e5ee7222ad69796dd3a74eabe080916c36c42892a"
+      "sha256": "387c37df8b65bab755e8f006722e6665d9e5aafea29eabf868d1e2dfc4720e99"
     },
     {
       "path": "modules/economy/cost-classify.js",
@@ -2857,7 +2857,7 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "6917875f2be5c39248b44caf7bf8d50f68cbe8effbc2bfdef3ba11e5ac17fc6c"
+      "sha256": "2e080d8d50383a24d77f9cf166f6e93e05e7bccc8775d14bbf68f2d6733eecd4"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -2912,7 +2912,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "8073955da873ca3fa779ef614368af52e9f0be93b800f0590f07d34fceca5545"
+      "sha256": "f6b80df54bb7634a9effb1cbe51b3ff99b05b0b7912be5a06690f63d237689f9"
     },
     {
       "path": "modules/grading/module.json",
@@ -3447,7 +3447,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "ad57ad242956c6ee3dc4aeddd66e980af48737fab644765aa3c400720f4a9668"
+      "sha256": "3f7f65007955c419ccce1c89cb1f6da6eeca6daa8a76a738540db2858ebff4e6"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3472,7 +3472,7 @@
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
       "mode": "0000644",
-      "sha256": "e88256fd506eafbecde48704f6eee72141451f38107fa10630257a171122d67a"
+      "sha256": "e65687656da193f9d23b398a94061f927cfbf8a63b5263c7e6ee48c5ef50f6e5"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
@@ -4022,7 +4022,7 @@
     {
       "path": "modules/status-ui/public/status.js",
       "mode": "0000644",
-      "sha256": "7d21fcc9d685f12d90147008b8eb385d5b86c8c50ecd0347072c9aa9a2492f20"
+      "sha256": "bd0fcd32548c7b2cc7c6d36b0f31cba3e0575c95ff3dc85fdb15b11decbdfe42"
     },
     {
       "path": "modules/status-ui/public/style.css",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aed2f26ebe4fe2b47756e44e59e7860370bc7915772c5cd8dcf409861e87f6c7"
+      "sha256": "132fd0ff1d19c5dc9ed4fddbcab4d6ca1754214e00da32fcd4bf06fd42cf0b05"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "615ec3ed94ced936891d834826b98bbfeae529dad7c1886d13c6230c6d63d88a"
+      "sha256": "f8aec45507128cd1060537a8aae479db0806b9adbc9f2b1024e601fe181bce32"
     },
     {
       "path": "public-docs/index.html",
@@ -4457,7 +4457,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "eeeb1471e46e5b62ec95dd4d856ec2e6f48fd110f5a0ac86e6b0895d2aa0bfa8"
+      "sha256": "6922f6008c72db47855172fce7e40df0953575b7bead0504758648e2cf2859e9"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -5007,7 +5007,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "79c45444d67985ba0e6bc5e4d5cbff79f28a1490badf3bcfc7b39d8d1d47f7d5"
+      "sha256": "93a5c4a6d6f76cf1fa8ca4c902b19d6ef94f9147488f1c01d3413f692a196942"
     },
     {
       "path": "scripts/gds/publish-manifest.js",
@@ -5227,7 +5227,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "616d72a72f4603fe303434f3302b9a227d1dbb81215c5e35ee37133fb8ce06c0"
+      "sha256": "94f343beba33727cb83367555c35a699f53c8efa5d59e3b65d3f6a1cf3e0e3b0"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5352,7 +5352,7 @@
     {
       "path": "scripts/setup-builder.sh",
       "mode": "0000644",
-      "sha256": "4bcbee9a407d41839b8dc01551cb580e86b2a387a9308db2d4da039ea762d9ff"
+      "sha256": "5860bf9daef3dd83a5ff4d3ee5e017e3cbd465ebda0c00df4ca622d629468ec4"
     },
     {
       "path": "scripts/snapshots/backfill-history.mjs",
@@ -5422,7 +5422,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "95428c88621510a97a5bfaf89a836508501b1db0f0910f529a260fa2dafce3b5"
+      "sha256": "a8215fa2659638d5850acb787eb3b193b18b545bc7e86f801764cab328b0c837"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5597,7 +5597,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "62018ff2d9a9ed274a789c6141edce3dfe90a282f99f99965dcbf513e3f55037"
+      "sha256": "30be4d5a235cc704d4e1db264fb4e976ef6c614bc680fe90e05f3a199b62fd3d"
     },
     {
       "path": "src/bongos/routes/optimizer.js",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "430e72a0dc3b4e87e8a1edee33314295aae624c736065d69f5c9ea5efbb7c41b"
+      "sha256": "59777605e64fb494479971b94c25cf91ef601c21b5f4153d0856d6281c31db39"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5854,6 +5854,11 @@
       "mode": "0000644",
       "sha256": "92b7033ab16d9d4472fcca4695d9df47938a45bdc62feda87b8771f5a2d59ff2"
     },
+    {
+      "path": "tests/authorship_audit.mjs",
+      "mode": "0000644",
+      "sha256": "4697e7e264023c148d1f18cac9695157de56b5dd3db4b60f2ab94d73a8d7af65"
+    },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
       "mode": "0000644",
@@ -6637,7 +6642,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "9c8525b85be898be30d6034902b34fcdedb16cf4b37fa8d79fbd5d1fb89898cb"
+      "sha256": "227d71aaab363d9346c3034f41cfb518e866b49bb460802b32626f288ecdcd76"
     },
     {
       "path": "tests/grader_bypass.mjs",
@@ -6789,6 +6794,11 @@
       "mode": "0000644",
       "sha256": "7fa36152b6dbb17b2855d261ddbea96af63d26f97001273cd131104235ea431d"
     },
+    {
+      "path": "tests/linkify_check.mjs",
+      "mode": "0000644",
+      "sha256": "810683a5283bd5fd7ef66b4f183b4fe8f978b03e156736c5c7cb91fc4f906c99"
+    },
     {
       "path": "tests/linkify_refs.mjs",
       "mode": "0000644",
@@ -7424,6 +7434,11 @@
       "mode": "0000644",
       "sha256": "2bb81a2649402bc2c17b04d17a4d749ff674f1bf5ac101d168412e709bea8550"
     },
+    {
+      "path": "tests/ship_builder_model.mjs",
+      "mode": "0000644",
+      "sha256": "afdb09a3ee072fea82390a187c12c42d8249fce0ce84644a4b8dff6a643dd009"
+    },
     {
       "path": "tests/ship_card.mjs",
       "mode": "0000644",

package/docs/canonical-permissions.md

@@ -299,6 +299,6 @@ identity. Use `req.builder.*` server-side, the active session client-side, `$HOM
 - **Infra config, not impersonation:** the droplet's operational identity (`User=lars`,
   `lars@REDACTED_IP`, `/home/lars/example`, `lars@example.com`).
 - **Enforcement:** [`scripts/gds/audit-authorship.sh`](../scripts/gds/audit-authorship.sh) — exits 0
-  clean, exits 1 with a hit list + remediation hints if a new hardcode shows up. Hookable from CI /
-  pre-commit. Re-run after any change that touches identity surfaces; state was clean (0 hits) as of
-  the V3.R12 sweep.
+  clean, exits 1 with a hit list + remediation hints if a new hardcode shows up. Runs on every PR
+  inside the required `unit` check via `tests/authorship_audit.mjs` (task 1002640 — it previously had
+  no caller and its exclusions had rotted to 342 stale hits). State clean (0 hits) as of that rewire.

package/docs/file-map.md

@@ -157,7 +157,7 @@
 │       ├── dev.js               ← `bongos dev`: one-command LOCAL launcher for a standalone instance (Postgres → createdb → migrate → server on the branding port → sign-in); up/stop/status (ADR 0149)
 │       ├── dev-lib.js           ← pure + injectable core of `bongos dev` (branding→port/db/env resolution, managed detached server pid/health); unit-tested by tests/dev_lib.mjs (ADR 0149)
 │       ├── session-eval.js      ← BFG session-inefficiency analysis engine (6D.3): classify turns, compute ceremony-vs-work, detect footguns, file systemic findings (ADR 0027)
-│       ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: .github/workflows/doc-ref-linkify.yml) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
+│       ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: tests/linkify_check.mjs, in the required `unit` check) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
 │       ├── release.js           ← resolve claim as abandoned (`/builder-release`)
 │       ├── cost.js              ← log a cost entry (`/builder-cost`)
 │       ├── me.js                ← current builder profile + leaderboard

package/modules/economy/achievements.js

@@ -239,7 +239,7 @@ async function evaluateAfterCreditAward(client, builderId, totalBefore, totalAft
 // with grader_bypass on only ever unlocked first-claim (the claim path works).
 // And breaking-the-100c-bar was boundary-only (totalBefore<100 && totalAfter>=100)
 // on a credit branch the per-session cost-plus reward (ADR 0054) never hits, so
-// it fired for NOBODY — even lars589 at 22k credits. The whole board looked dead.
+// it fired for NOBODY — even the founding Archon at 22k credits. The whole board looked dead.
 //
 // reconcileBuilderAchievements evaluates every achievement against CURRENT DB
 // state and unlocks any the builder is eligible for but hasn't. It is:

package/modules/grading/grader-rubric.json

@@ -8,8 +8,9 @@
     "grader_kind": "subagent-panel",
     "threshold": 6.0,
     "gate": "All workers in the active panel must independently report verdict='pass' for confirmed→credits. Any worker reporting 'fail' (or erroring out) keeps the task at completed. Any worker reporting 'concerns' (low confidence, partial AC, advisory economy below threshold, major non-blocker issue, etc.) falls through to the manual-confirm path (POST /tasks/:id/confirm) — same release-valve as v3 low-confidence. The 'concerns' verdict is forwarded to the server-side validateAndScore as confidence=fallthrough_confidence (0.3 by default, below LOW_CONFIDENCE=0.4) so the existing server gate aligns without protocol changes.",
-    "default_model": "claude-sonnet-4-6",
-    "assumed_builder_model": "claude-opus-4-7",
+    "default_model": "claude-sonnet-5",
+    "assumed_builder_model": "claude-fable-5",
+    "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,

package/modules/grading/grader.js

@@ -99,8 +99,8 @@ const LOW_CONFIDENCE = V4.low_confidence_threshold;
 // DEFAULT_SHOTS is kept for the v3 multi-shot path (still exported for
 // diagnostics); v4 doesn't use shots — it uses workers.
 const DEFAULT_SHOTS = V3.shots || 3;
-const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-opus-4-7';
-const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-4-6';
+const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
+const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
 const workers = require('./grader-workers');
 // Carved into modules/grading/ (BV1.R73 / ADR 0091 §1+§4): the two deterministic
@@ -208,27 +208,31 @@ function isTrivialDiff({ changedFiles, diffStats } = {}) {
 
 // ---------- v3: cross-family model selection (ADR 0024) ----------
 
-// Returns the grader model given the builder's model — a DIFFERENT family from
-// the builder is the cross-family adversarial guarantee. With no builderModel
-// the caller is assuming the default Opus builder (CLAUDE.md §2), so it resolves
-// through the opus branch to Sonnet — that is the legitimate default path the
-// live callers (selectGraderModel({})) take.
+// Returns the grader model given the builder's model — a DIFFERENT model from
+// the builder is the cross-model adversarial guarantee (ADR 0024). With no
+// builderModel the caller assumes the owner-top-model builder (CLAUDE.md §2),
+// resolving to the default grader — the path selectGraderModel({}) takes.
 //
-// #117: an EXPLICITLY-supplied model we don't recognize is a misconfiguration,
-// not a default. We used to silently fall back to Sonnet, which would mask a
-// future model family (one whose id lacks 'opus'/'sonnet'/'haiku') and quietly
-// grade it on the wrong cross-family assumption. Throw loudly instead so the
-// caller fixes the input rather than getting a silently-wrong grader model.
+// task 1002659 (Claude 5 refresh): top-tier builders (fable/mythos, opus)
+// grade on the current mid tier; sonnet/haiku builders grade on the tier
+// above. #117's throw-on-unknown is reversed: the throw fired INSIDE the
+// grade step, stranding any ship whose builder id lacked an opus/sonnet/haiku
+// substring (claude-fable-5 was exactly that) — a worse failure than the
+// misconfiguration it guarded. Unknown ids now warn loudly and grade on
+// DEFAULT_GRADER_MODEL; the id still reaches signals.builder_model_assumed,
+// so /grader-health can spot the drift.
 function selectGraderModel({ builderModel } = {}) {
   const bm = (builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
-  if (bm.includes('opus')) return 'claude-sonnet-4-6';
-  if (bm.includes('sonnet')) return 'claude-opus-4-7';
-  if (bm.includes('haiku')) return 'claude-opus-4-7';
-  throw new Error(
+  if (bm.includes('fable') || bm.includes('mythos')) return 'claude-sonnet-5';
+  if (bm.includes('opus')) return 'claude-sonnet-5';
+  if (bm.includes('sonnet')) return 'claude-opus-5';
+  if (bm.includes('haiku')) return 'claude-opus-5';
+  console.error(
     `selectGraderModel: unrecognized builder model ${JSON.stringify(builderModel)} — ` +
-    `expected an id containing 'opus', 'sonnet', or 'haiku'. Refusing to silently ` +
-    `fall back to a default grader model (#117).`
+    `no 'fable'/'mythos'/'opus'/'sonnet'/'haiku' token; grading on the default ` +
+    `${DEFAULT_GRADER_MODEL} (cross-model unverifiable — task 1002659, was a #117 throw)`
   );
+  return DEFAULT_GRADER_MODEL;
 }
 
 // ---------- v3: prompt builder (default-fail framing) ----------

package/modules/lifecycle/publish-reconciler.js

@@ -122,8 +122,8 @@ function couldBeStaleGenerated(m) {
 
 // task 1002461 — render the reconciler's operating target: which repo it resolved
 // and whether it holds a credential. This is the line that makes a WRONG repo bind
-// visible without owner access (the live failure: the hub bound
-// cloudbongos/cloudbongos-instance while the PRs were in lars589/cloud-bongos).
+// visible without owner access (the live failure: the hub bound the instance
+// repo while the PRs were in the core repo).
 // Pure — takes the resolved facts, returns the string — so the wording is
 // unit-tested without a boot.
 function describeTarget({ configured, repo } = {}) {

package/modules/lifecycle/routes/gate-approvals.js

@@ -4,7 +4,7 @@
 // WHY. The gate-review CI check (ADR 0058) clears an ESCALATE (hard floor) ONLY on
 // an owner approval, and a NEEDS_TRUST without a Metic+ author likewise blocks until
 // the owner approves. Historically that owner approval was a GitHub APPROVED review
-// by lars589 on the head sha — i.e. the owner had to leave a GitHub/terminal review.
+// by the repo owner on the head sha — i.e. the owner had to leave a GitHub/terminal review.
 // This router gives Archons a browser-only equivalent (feedback: auth flows must be
 // UI-first), trust-consistent with the existing server-set `gate-author-trust`
 // status: the server re-checks the caller's Archon rank server-side (ADR 0016) and

package/modules/status-ui/public/status.js

@@ -4,7 +4,7 @@
 // API base for the public read endpoints (#737). Empty = same-origin, the case
 // when this file is served by the droplet itself (status.amazonprimea.com
 // proxies /api/* to the same Node process). The OFF-BOX GitHub Pages mirror
-// (lars589/amazonprimea-status, ADR 0029) injects window.STATUS_API_BASE =
+// (the owner's status-mirror repo, ADR 0029) injects window.STATUS_API_BASE =
 // 'https://amazonprimea.com' in its <head> so the same byte-identical file
 // fetches cross-origin from the droplet there (CORS is open). Keeping this file
 // identical on both hosts is what lets the mirror sync be a pure copy.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.46",
+  "version": "1.19.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.46",
+      "version": "1.19.48",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.46",
+  "version": "1.19.48",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-authorship.sh

@@ -34,14 +34,24 @@
 #   * GitHub remote `lars589/amazonprimea` — actual repo owner; cloning
 #     anything else would clone a different project.
 #   * Comments that document who decided something or who originally ran a
-#     one-time backfill — historical decision-attribution.
+#     one-time backfill — historical decision-attribution. Allowlisted
+#     PER FILE below (a content-level "looks like a comment" filter would
+#     also match live code — a JS private class field, a //host literal —
+#     so it could be gamed; file entries with justifications can't).
+#   * Test data that pins a real contract, allowlisted PER FILE below: owner
+#     approval RECORDS the Archon's login, the terminal-URL guard validates
+#     term-<login> hostnames — identity in an assertion is the contract.
+#     New test files are still scanned (no blanket tests/ exclusion).
+#   * Sample API payloads (fixtures/) and gitignored build output (dist/).
 #
 # Usage:
 #   bash scripts/gds/audit-authorship.sh           # check, exit 1 on new hits
 #   bash scripts/gds/audit-authorship.sh --verbose # print every hit (incl.
 #                                                  # allowlisted) for review
 #
-# Hookable from CI / pre-commit. No writes, no network.
+# CI lane: tests/authorship_audit.mjs runs this inside the required `unit`
+# check (task 1002640 — it previously had no caller and 342 stale hits).
+# No writes, no network.
 
 set -uo pipefail
 
@@ -72,6 +82,10 @@ done
 EXCLUDE_DIRS=(
   --exclude-dir=node_modules
   --exclude-dir=.git
+  --exclude-dir=dist               # gitignored build/package output (a stale
+                                   # core tarball tree re-reports every hit in
+                                   # it — task 1002640); grep -R walks the
+                                   # filesystem, not the git index.
   --exclude-dir=iterations         # under art/, historical cost ledger
   --exclude-dir=generated          # under art/, generated PNGs / metadata
   --exclude-dir=docs               # human prose: ADRs, recipes, plans,
@@ -79,6 +93,9 @@ EXCLUDE_DIRS=(
                                    # naming the founder by intent
   --exclude-dir=blockers           # blockers ARE the things stuck on Lars
   --exclude-dir=limitations        # archives + scope-truth docs
+  --exclude-dir=fixtures           # sample API payloads (hall-preview) mirror
+                                   # real prod rows, which name real builders —
+                                   # frozen sample data, not runtime code.
   --exclude-dir=worktrees          # .claude/worktrees/ holds N full repo
                                    # copies (one per builder worktree); from
                                    # the main checkout, recursing them is slow
@@ -151,6 +168,53 @@ ALLOWLIST=(
   # leaks in setup.js — the string appearing in the comment IS the
   # specification of what's forbidden in implementation code.
   'tests/setup_smoke.mjs'
+
+  # Test DATA that pins a real contract (task 1002640) — identity in an
+  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
+  # the Archon's login (gate_approvals), the terminal-URL SSRF guard validates
+  # term-<login> hostnames (box_terminal_ssrf), packaging/provisioning tests
+  # exercise the real repo owner + the mirror-redaction floor. Listed per file
+  # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
+  'tests/provision.mjs'
+  'tests/package_core.mjs'
+  'tests/init.mjs'
+  'tests/box_terminal_ssrf.mjs'
+  'tests/gate_approvals.mjs'
+  'tests/publish_reconciler.mjs'
+  'tests/dev_lib.mjs'
+  'tests/ship_card.mjs'
+  'tests/scrubber_corpus.mjs'
+  'tests/module_submissions.mjs'
+  'tests/boxes.mjs'
+  'tests/provisioning_onboard_mode.mjs'
+  'tests/instance_manifest.mjs'
+  'tests/bongos_downloads.mjs'
+  'tests/status_mirror_sync.mjs'
+  'tests/search_isolation.mjs'
+  'tests/grade_aggregates_unavailable.mjs'
+  'tests/first_admin_bootstrap.mjs'
+  'tests/discord_approvals.mjs'
+  'tests/currency_label.mjs'
+  'tests/cloud_bongos_pack.mjs'
+  'tests/bump_version.mjs'
+  'tests/box_scope_session.mjs'
+  'tests/auth_inactive_builder.mjs'
+  'tests/auth_anthropic_identity.mjs'
+  'modules/dev-box/app/test/unit.mjs'
+
+  # The public landing page links the open-source repo by URL — repo-hosting
+  # identity (the provision-staging.sh class), not a builder identity.
+  'public-landing/create.html'
+
+  # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
+  # instance's owner literal precisely so packaging can SCRUB it from every
+  # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
+  'scripts/gds/package-core.js'
+
+  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
+  # Archon literal as the thing that task exists to remove (the
+  # seed-v3-tasks.js class: stripping it would lose the task history).
+  'scripts/gds/seed-medusa-tasks.js'
 )
 
 # ----------------------------------------------------------------------------
@@ -212,7 +276,11 @@ else
 fi
 
 # Apply operational-identity + spec-string pattern allowlists (both match on
-# line content, not file path).
+# line content, not file path). NB deliberately NO comment-line filter: a
+# content pattern like `^\s*(//|#)` also matches live code (a JS private class
+# field `#name = ...`, a protocol-relative `//host` continuation line), so a
+# real hardcode could dress as a comment to slip through. Historical-
+# attribution comments get per-file ALLOWLIST entries instead (task 1002640).
 grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
   | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
 

package/scripts/gds/provision.js

@@ -851,7 +851,7 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // <prefix>_FIRST_ADMIN before branding.firstAdmin). WITHOUT it a provisioned instance
   // has NO owner — first sign-in is refused / lands rankless and the owner can never
   // claim their own instance (goal 35 / criterion 165 regression, caught live 2026-07-07:
-  // demo had every origin override but no FIRST_ADMIN, so lars589 could not be seated).
+  // demo had every origin override but no FIRST_ADMIN, so the owner could not be seated).
   // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
   // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
   // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a

package/scripts/gds/ship.js

@@ -251,6 +251,39 @@ function resolveTranscriptPath(sessionId, projectDirs, opts = {}) {
   return null;
 }
 
+// resolveBuilderModel — the REAL model that authored this session's work, read
+// from the session transcript (dominant by output tokens, synthetic turns
+// skipped), so selectGraderModel gets a true cross-model input instead of the
+// ASSUMED_BUILDER_MODEL fallback (task 1002659 — everything graded on the
+// assumed-builder default before this). Best-effort: no session id, no
+// transcript, or any read error → null → the grader assumes, as before.
+function resolveBuilderModel(opts = {}) {
+  try {
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    // Same path-traversal guard as uploadSessionOnShip: the id lands in a path.
+    if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
+    const transcriptPath = resolveTranscriptPath(sessionId, [process.cwd(), REPO_ROOT].filter(Boolean), opts);
+    if (!transcriptPath) return null;
+    const perModel = new Map();
+    for (const line of fs.readFileSync(transcriptPath, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      let o;
+      try { o = JSON.parse(line); } catch (_) { continue; }
+      const msg = o && o.message;
+      if (!msg || !msg.model || msg.model === '<synthetic>' || !msg.usage) continue;
+      perModel.set(msg.model, (perModel.get(msg.model) || 0) + (Number(msg.usage.output_tokens) || 0));
+    }
+    let best = null;
+    let bestTokens = 0;
+    for (const [model, tokens] of perModel) {
+      if (tokens > bestTokens) { best = model; bestTokens = tokens; }
+    }
+    return best;
+  } catch (_) {
+    return null;
+  }
+}
+
 function resolveMemoryDir() {
   // REPO_ROOT is the main worktree (canonical project checkout). The memory dir
   // is keyed to that path, not the per-task feature worktree we're shipping from.
@@ -1812,11 +1845,10 @@ function mergeMainIntoBranch() {
 
 // ---------- Pre-verify: auto-linkify the ship's own changed docs ----------
 //
-// The doc-ref-linkify CI gate (.github/workflows/doc-ref-linkify.yml) runs on
-// push:main — i.e. AFTER ship's auto-merge has already landed the commit. So a
-// single bare "#NNN" task ref that slips into a doc red-Xes the build and
-// emails a failure for an already-merged commit. Caught post-merge, the gate is
-// pure noise: it can't prevent the leak, only complain about it (#747).
+// The doc-ref-linkify CI gate (tests/linkify_check.mjs, in the required `unit`
+// check — task 1002639; a standalone doc-ref-linkify.yml workflow never
+// actually existed) red-Xes a PR carrying a bare "#NNN" task ref in a doc. A
+// red-X after the builder walked away still strands the land (#747).
 //
 // The structural cure is to fix the ship's OWN changed docs here, before the
 // merge, and commit the rewrite. The gate then stays as the backstop for refs
@@ -2062,6 +2094,9 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
     timeoutMs: GRADER_TIMEOUT_MS,
     cwd: process.cwd(), // grade the FEATURE worktree, not REPO_ROOT
   };
+  // task 1002659: the real session model (transcript-derived) drives the
+  // cross-model grader pick; null → the grader assumes, as before.
+  const builderModel = resolveBuilderModel();
   const t0 = Date.now();
   let result;
   // #513: a small copy/docs-only diff gets a SINGLE generalist grader shot
@@ -2071,7 +2106,7 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
   // inefficiency of running a 4-worker panel on a +1/-1 copy tweak.
   if (grader.isTrivialDiff({ changedFiles, diffStats: shortstat })) {
     const totalLines = (shortstat.lines_added || 0) + (shortstat.lines_removed || 0);
-    console.log(`  subagent grader ${grader.VERSION}: TRIVIAL diff (${shortstat.files_changed} file(s), ${totalLines} line(s), copy/docs only) → single generalist shot, model=${grader.selectGraderModel({})} — instead of the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel (#513)`);
+    console.log(`  subagent grader ${grader.VERSION}: TRIVIAL diff (${shortstat.files_changed} file(s), ${totalLines} line(s), copy/docs only) → single generalist shot, model=${grader.selectGraderModel({ builderModel })} — instead of the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel (#513)`);
     console.log(`  gate: the shot must return functional_fidelity>=${grader.THRESHOLD} AND code_quality>=${grader.THRESHOLD} AND confidence>=0.4`);
     result = await grader.gradeSubagentV3MultiShot({
       task,
@@ -2080,11 +2115,12 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       changedFiles,
       diffStats: shortstat,
       shots: 1,
+      builderModel, // task 1002659: real session model → cross-model grader pick
       runOpts,
     });
   } else {
     const panel = grader.WORKERS.DEFAULT_PANEL;
-    console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.DEFAULT_GRADER_MODEL} (assumed builder ${grader.ASSUMED_BUILDER_MODEL}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
+    console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
     console.log(`  gate: every worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
     if (priorRound) {
       console.log(`  delta re-grade (task 1002662): prior round's findings + builder response ride along, fenced; answered findings can only re-veto with NEW evidence`);
@@ -2096,6 +2132,7 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       changedFiles,
       diffStats: shortstat, // V3.R92 #353: feed diff size into the economy axis
       builderRank,          // SEC #863: drives the permission-path pre-pass
+      builderModel,         // task 1002659: real session model → cross-model grader pick
       priorRound,           // task 1002662: delta-aware re-grade context (panel path only)
       runOpts,
     });
@@ -3647,8 +3684,8 @@ async function shipMain() {
 
   // ---- Pre-verify: auto-linkify this ship's own changed docs (#747) ----
   // Fix bare "#NNN" task refs in the docs this ship changed BEFORE the merge,
-  // so they never reach main and red-X the post-merge doc-ref-linkify gate.
-  // Best-effort.
+  // so they never red-X the doc-ref-linkify gate (tests/linkify_check.mjs in
+  // the `unit` check). Best-effort.
   autoLinkifyChangedDocs(ac);
 
   // ---- Empty-diff / phantom-ship guard (must run BEFORE the review gate + resolve) ----
@@ -4221,6 +4258,9 @@ async function regradeMain() {
 // exported: it does I/O + network and is covered by the live smoke at ship.)
 module.exports = {
   scrubSecrets, snippetOf, buildSessionDigest, resolveTranscriptPath,
+  // task 1002659: transcript-derived real builder model (dominant by output
+  // tokens) — exported pure-ish (fs read only, opts-injectable) for the test.
+  resolveBuilderModel,
   // task 1002471: the project-path encoder, exported pure so the win32 shapes
   // (drive colon, backslash separators, spaces) are pinned cross-platform —
   // resolveTranscriptPath itself runs path.resolve, which can't carry a Windows

package/scripts/setup-builder.sh

@@ -14,15 +14,15 @@
 #   ./scripts/setup-builder.sh [--skip-keys] [--no-auth] [--help]
 #
 # Run this from INSIDE a clone of the repo. If you don't have the code yet,
-# do "Step 0 — get the project onto your machine" first (see README.md):
-#   git clone https://github.com/lars589/amazonprimea.git && cd amazonprimea
+# do "Step 0 — get the project onto your machine" first (see README.md) —
+# clone YOUR instance's repo, then cd into it.
 set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Guard: this shim must run from inside the repo (where setup-builder.js lives).
 if [ ! -f "$SCRIPT_DIR/setup-builder.js" ]; then
   echo "setup-builder: can't find setup-builder.js next to this script." >&2
   echo "Did you clone the repo and cd into it? See README.md 'Step 0 — get the project onto your machine'." >&2
-  echo "  git clone https://github.com/lars589/amazonprimea.git && cd amazonprimea" >&2
+  echo "  (clone YOUR instance's repo, then cd into it and re-run this script)" >&2
   exit 1
 fi
 exec node "$SCRIPT_DIR/setup-builder.js" "$@"

package/src/bongos/auth.js

@@ -63,7 +63,7 @@ const SCOPE = 'read:user';
 // support is needed". It is needed. `public_repo` grants write to PUBLIC repos
 // only, so ADOPTING an existing PRIVATE repo dies at the provisioner's scaffold
 // push with GitHub 403 "Write access to repository not granted" — observed live on
-// lars589/hermeslines-marketing. ADR 0155 takes the reversal at the owner's
+// a private repo of the owner's. ADR 0155 takes the reversal at the owner's
 // explicit call, accepting the cost it names: a token we persist can now write to
 // EVERY repo the user owns, not just their public ones.
 const REPO_SCOPE = 'repo';

package/src/bongos/routes/modules.js

@@ -65,7 +65,7 @@ function ownProjectName() {
   try { return require('../../branding').branding().identity.productName; } catch { return null; }
 }
 
-// "owner/name", e.g. "lars589/amazonprimea" — the provenance a submission
+// "owner/name", e.g. "some-owner/their-repo" — the provenance a submission
 // carries (ADR 0107 §2: attribution/provenance travels WITH the module as a
 // portable record, not a cross-GDS link). null if the branding pack has none.
 function sourceRepoLabel() {

package/src/module-api.js

@@ -519,8 +519,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.44 with no explicit bump. run 31519500533. (task 1002620)
 //   1.19.46 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.45 with no explicit bump. run 31520432748. (task 1002620)
+//   1.19.47 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.46 with no explicit bump. run 31521404176. (task 1002620)
+//   1.19.48 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.47 with no explicit bump. run 31522865111. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.46'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.48'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/authorship_audit.mjs

@@ -0,0 +1,44 @@
+// tests/authorship_audit.mjs — the no-hardcoded-Archon-identity gate (task 1002640).
+//
+// scripts/gds/audit-authorship.sh (named as THE enforcement in
+// docs/canonical-permissions.md) had no caller — no CI lane, no test, no skill
+// — and 342 stale hits on a clean tree. This test makes it a real gate: it runs
+// inside the required `unit` check, so a new hardcoded founder-identity
+// reference in implementation code fails the PR. The script is local-only (grep
+// over the tree — no DB, no network). Fail-open only where the RUNTIME is
+// missing: a builder machine without bash on PATH (the gen-diagrams render-step
+// precedent) skips with a warning; Linux CI always has bash, so the gate is
+// always live where it matters.
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(REPO, 'scripts', 'gds', 'audit-authorship.sh');
+const SPAWN_TIMEOUT_MS = 75_000; // under run-unit-tests' 90s cap
+
+const r = spawnSync('bash', [SCRIPT], {
+  cwd: REPO,
+  encoding: 'utf8',
+  timeout: SPAWN_TIMEOUT_MS,
+  maxBuffer: 8 * 1024 * 1024,
+});
+
+if (r.error && r.error.code === 'ENOENT') {
+  console.warn('authorship_audit: bash not on PATH — skipping (the gate runs on Linux CI; a bash-less builder box cannot run a .sh).');
+  process.exit(0);
+}
+
+// NO timeout fail-open: the audit is local-only (grep over the tree — no DB,
+// no network), so unlike an infra-dependent check there is no innocent reason
+// for it to hang; a diff engineered to make the scan slow must FAIL the gate,
+// not slip through it. spawnSync's ETIMEDOUT falls through to the assertions.
+assert.equal(r.error, undefined, `audit-authorship.sh failed to run: ${r.error && r.error.message}`);
+assert.equal(
+  r.status,
+  0,
+  `audit-authorship.sh found hardcoded founder-identity references in implementation code:\n${r.stdout}\n${r.stderr}`
+);
+console.log('authorship_audit: clean — no hardcoded Archon-identity references in implementation code.');

package/tests/grader.mjs

@@ -192,8 +192,8 @@ test('v4 exports the expected surface (current panel-based gate)', () => {
   assert.ok(grader.THRESHOLD >= 5.0 && grader.THRESHOLD <= 10.0);
   assert.ok(grader.VERSION.startsWith('v4'), `expected v4.*, got ${grader.VERSION}`);
   assert.equal(grader.DEFAULT_SHOTS, 3); // kept for v3 multi-shot diagnostic path
-  assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-4-6');
-  assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-opus-4-7');
+  assert.equal(grader.DEFAULT_GRADER_MODEL, 'claude-sonnet-5'); // task 1002659: Claude 5 family pin
+  assert.equal(grader.ASSUMED_BUILDER_MODEL, 'claude-fable-5');
   assert.equal(grader.FALLTHROUGH_CONFIDENCE, 0.3);
   // Worker registry sanity — Phase 2.2 added efficiency as the 4th worker
   // (after Phase 2.1's hacker).
@@ -819,32 +819,36 @@ test('v2 extractAssistantResult: passes-through non-envelope output', () => {
 // v3 — cross-family selection + multi-shot aggregation (MAS Phase 1 / #395)
 // ========================================================================
 
-test('v3 selectGraderModel: builder Opus → grader Sonnet (cross-family)', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-7' }), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-8' }), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel({ builderModel: 'opus' }), 'claude-sonnet-4-6');
+test('selectGraderModel: builder Fable/Mythos → grader Sonnet 5 (cross-model, task 1002659)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-fable-5' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-mythos-5' }), 'claude-sonnet-5');
 });
 
-test('v3 selectGraderModel: builder Sonnet → grader Opus (cross-family)', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-sonnet-4-6' }), 'claude-opus-4-7');
-  assert.equal(grader.selectGraderModel({ builderModel: 'sonnet' }), 'claude-opus-4-7');
+test('selectGraderModel: builder Opus → grader Sonnet (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-5' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-opus-4-8' }), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'opus' }), 'claude-sonnet-5');
 });
 
-test('v3 selectGraderModel: builder Haiku → grader Opus', () => {
-  assert.equal(grader.selectGraderModel({ builderModel: 'claude-haiku-4-5-20251001' }), 'claude-opus-4-7');
-  assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-4-7');
+test('selectGraderModel: builder Sonnet → grader Opus (cross-family)', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-sonnet-5' }), 'claude-opus-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'sonnet' }), 'claude-opus-5');
 });
 
-test('selectGraderModel: missing builder → default Sonnet (assumed-Opus builder); explicit unknown THROWS (#117)', () => {
-  // No builderModel is the legitimate default path (the caller assumes the Opus
-  // builder per CLAUDE.md §2), so it resolves through the opus branch to Sonnet.
-  // This is the path the live callers — selectGraderModel({}) — take.
-  assert.equal(grader.selectGraderModel({}), 'claude-sonnet-4-6');
-  assert.equal(grader.selectGraderModel(), 'claude-sonnet-4-6');
-  // An explicitly-supplied unrecognized model is a misconfiguration: loud-throw
-  // instead of silently grading on the wrong cross-family assumption (#117).
-  assert.throws(() => grader.selectGraderModel({ builderModel: 'gpt-4' }), /unrecognized builder model/);
-  assert.throws(() => grader.selectGraderModel({ builderModel: 'llama-3' }), /unrecognized builder model/);
+test('selectGraderModel: builder Haiku → grader Opus', () => {
+  assert.equal(grader.selectGraderModel({ builderModel: 'claude-haiku-4-5-20251001' }), 'claude-opus-5');
+  assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-5');
+});
+
+test('selectGraderModel: missing builder → default (assumed-Fable builder → Sonnet 5); unknown id FALLS BACK, never throws (task 1002659)', () => {
+  // No builderModel is the legitimate default path (the caller assumes the
+  // owner-top-model builder per CLAUDE.md §2), resolving to the default grader.
+  assert.equal(grader.selectGraderModel({}), 'claude-sonnet-5');
+  assert.equal(grader.selectGraderModel(), 'claude-sonnet-5');
+  // task 1002659 reverses #117's throw: an unknown id used to strand the ship
+  // inside the grade step. Now it warns loudly and grades on the default model.
+  assert.equal(grader.selectGraderModel({ builderModel: 'gpt-4' }), grader.DEFAULT_GRADER_MODEL);
+  assert.equal(grader.selectGraderModel({ builderModel: 'llama-3' }), grader.DEFAULT_GRADER_MODEL);
 });
 
 // --- aggregateShots: helpers ---

package/tests/linkify_check.mjs

@@ -0,0 +1,39 @@
+// tests/linkify_check.mjs — the doc-ref linkify CI gate (task 1002639).
+//
+// docs/file-map.md long claimed a `.github/workflows/doc-ref-linkify.yml` CI
+// gate that never existed (the G-20 phantom-reference shape). This test IS the
+// gate, made real the cheap way: it runs inside the required `unit` check, so a
+// committed doc with a bare `#NNN` ref (which GitHub would mis-autolink to its
+// own issues) fails the PR. linkify-refs.js --check already fails OPEN when the
+// /public/ref-ids allow-list is unreachable (a network blip must not red-X an
+// unrelated build); the spawn timeout below mirrors that posture — infra
+// slowness is a warn + skip, never a false red.
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(REPO, 'scripts', 'gds', 'linkify-refs.js');
+const SPAWN_TIMEOUT_MS = 60_000; // under run-unit-tests' 90s so WE decide the timeout outcome
+
+const r = spawnSync(process.execPath, [SCRIPT, '--check'], {
+  cwd: REPO,
+  encoding: 'utf8',
+  timeout: SPAWN_TIMEOUT_MS,
+  maxBuffer: 8 * 1024 * 1024,
+});
+
+if (r.error && r.error.code === 'ETIMEDOUT') {
+  console.warn(`linkify_check: --check did not finish in ${SPAWN_TIMEOUT_MS}ms — skipping (fail-open on infra, matching the script's own --check posture).`);
+  process.exit(0);
+}
+
+assert.equal(r.error, undefined, `linkify-refs.js --check failed to spawn: ${r.error && r.error.message}`);
+assert.equal(
+  r.status,
+  0,
+  `linkify-refs.js --check found bare/upgradeable refs in committed docs — run \`node scripts/gds/linkify-refs.js --apply\` and commit.\n${r.stdout}\n${r.stderr}`
+);
+console.log('linkify_check: committed docs carry no bare #NNN refs (linkify-refs.js --check exit 0).');

package/tests/ship_builder_model.mjs

@@ -0,0 +1,76 @@
+// tests/ship_builder_model.mjs — task 1002659: resolveBuilderModel reads the
+// session transcript and returns the dominant model by output tokens, so the
+// grader's cross-model pick keys on what actually authored the work.
+import assert from 'node:assert';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (e) {
+    console.error(`FAIL  ${name}\n      ${e.message}`);
+    failed++;
+  }
+}
+
+// Mirror ship.js's transcript layout: <base>/projects/<encoded cwd>/<sessionId>.jsonl
+function writeTranscript(base, sessionId, lines) {
+  const encoded = ship.encodeProjectPath(path.resolve(process.cwd()));
+  const dir = path.join(base, 'projects', encoded);
+  fs.mkdirSync(dir, { recursive: true });
+  const p = path.join(dir, `${sessionId}.jsonl`);
+  fs.writeFileSync(p, lines.map((l) => JSON.stringify(l)).join('\n'));
+  return p;
+}
+
+const msg = (model, outputTokens) => ({
+  message: { model, usage: { output_tokens: outputTokens } },
+});
+
+const base = fs.mkdtempSync(path.join(os.tmpdir(), 'ship-builder-model-'));
+const SESSION = 'test-session-1002659';
+const prevSession = process.env.CLAUDE_CODE_SESSION_ID;
+process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+
+writeTranscript(base, SESSION, [
+  msg('claude-fable-5', 900),
+  msg('claude-haiku-4-5-20251001', 50),
+  msg('claude-fable-5', 800),
+  { message: { model: '<synthetic>', usage: { output_tokens: 99999 } } }, // skipped
+  { not_a_message: true },
+]);
+
+test('dominant-by-output-tokens model wins; synthetic turns are skipped', () => {
+  assert.equal(ship.resolveBuilderModel({ base }), 'claude-fable-5');
+});
+
+test('no transcript for the session → null (grader assumes)', () => {
+  process.env.CLAUDE_CODE_SESSION_ID = 'no-such-session';
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+});
+
+test('missing or path-hostile session id → null', () => {
+  delete process.env.CLAUDE_CODE_SESSION_ID;
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = '../evil';
+  assert.equal(ship.resolveBuilderModel({ base }), null);
+  process.env.CLAUDE_CODE_SESSION_ID = SESSION;
+});
+
+if (prevSession === undefined) delete process.env.CLAUDE_CODE_SESSION_ID;
+else process.env.CLAUDE_CODE_SESSION_ID = prevSession;
+fs.rmSync(base, { recursive: true, force: true });
+
+console.log(`\nship_builder_model: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);