@bongos/core 1.19.48 → 1.19.50

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.48",
-  "core_contract": "1.19.48",
-  "source_commit": "55b3c049db775bb60d3749a998a44110a340f3fa",
+  "core_version": "1.19.50",
+  "core_contract": "1.19.50",
+  "source_commit": "1a7b11b4377e9fefb36560c0cda9d4b1030a05c9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:28:57.362Z",
+  "built_at": "2026-08-11T18:44:57.114Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 290,
+    "docs_redacted": 291,
     "agent_docs_stubbed": 21,
     "functional_verbatim": 1217,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1528,
-  "tree_sha256": "be96d3ccab1f445af630ea28b9609a9dc3dfba76aa75b5bc394a97e9d9a1d166",
+  "file_count": 1529,
+  "tree_sha256": "e96a0d29e2d6adc516aaa0d095dbb1c4d543dbec0508228b2cbcf16a1b400dbd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1294,10 +1294,15 @@
       "mode": "0000644",
       "sha256": "64fb6e129cf5484266e1b6a9cddd8ba88ff7438b9646c3f4d9ffd0cda3cce642"
     },
+    {
+      "path": "docs/adr/0165-instances-hookless-by-default.md",
+      "mode": "0000644",
+      "sha256": "d422e10adc391127a7f39b9eb8b5927c149ee455402bc5e4641f55e8b31b2d15"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "ceb8639779cb8f8f43c261800607ff47b90a70489d8f5b5c7e8e0e2c5244bdb1"
+      "sha256": "09a7ba734571fbb304c60a488fe9ccdb6ca06d01127cfb87f07b1cbb54d69408"
     },
     {
       "path": "docs/api-reference.md",
@@ -1327,7 +1332,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "3cc48fe7b291976d819450202090b0df0c165d2470f5895a16febb7cdd5834a2"
+      "sha256": "b7f66c6f1fbed274e5ba3295c06db8fc8edb84edd44f6ce92f6734e18267e3d9"
     },
     {
       "path": "docs/design-contract.md",
@@ -1567,7 +1572,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "1aafe7dafea94084c381e7ea1e91fad533ca379f9560da6f9f9f4a2cf4db4fc5"
+      "sha256": "5bfca9628859f1cdd79d741bdd50f3fe415430ee3380a2ac7f46b97ebe082d0e"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
@@ -2857,12 +2862,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "2e080d8d50383a24d77f9cf166f6e93e05e7bccc8775d14bbf68f2d6733eecd4"
+      "sha256": "6a0a2205fee2a4b0efc422c884826a9fd2af3d8785b393d5f7123e1758f1ebfc"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
       "mode": "0000644",
-      "sha256": "3e3721289ceb8c9c14e7aff7dc9569cbf01be3f2363bcaedc04aaee01d3fca3a"
+      "sha256": "ab85c9c7b167e710b07af1d4beb1579a593aa617e1c1990238d329fdb0362035"
     },
     {
       "path": "modules/grading/grader-workers/extract-json.js",
@@ -2877,22 +2882,22 @@
     {
       "path": "modules/grading/grader-workers/hacker.js",
       "mode": "0000644",
-      "sha256": "650914c1f726c02ee19c80f72676c2bf86d99b9aded6cff1210905db52cb48d8"
+      "sha256": "c7177625382e2ea61ee706c6b9b8669d9d452cdc0a92235695438b249c1ab6fc"
     },
     {
       "path": "modules/grading/grader-workers/index.js",
       "mode": "0000644",
-      "sha256": "232dc6b3c2d97282cce8032a1c671c89bb8e1e8936b4bb0acbd3ec4471e74f0a"
+      "sha256": "8ec5e91341ec5247ee643c6ce75fb5ec21a62b3bba176fdde060cdb352edb808"
     },
     {
       "path": "modules/grading/grader-workers/narc.js",
       "mode": "0000644",
-      "sha256": "eeb9545d638d58958049c7889401f1cd49a2fb03607c25bfbef3625a0c7dd9fd"
+      "sha256": "f35c3fce7feb6198df0011a9d22533038ca0766733c97a31841a184251800d39"
     },
     {
       "path": "modules/grading/grader-workers/quality.js",
       "mode": "0000644",
-      "sha256": "fa73a1d68c0126a2c109e9b7ef8692df29cbb41bbb800ab64e127f20e0a5865e"
+      "sha256": "003b51b4a5eab34bb634ceaad5ae9c1ae6f2566423fe0d15cef79b936dc6756b"
     },
     {
       "path": "modules/grading/grader-workers/rubric.js",
@@ -2902,7 +2907,7 @@
     {
       "path": "modules/grading/grader-workers/worker-prompt.js",
       "mode": "0000644",
-      "sha256": "9821a36e9a11be805cf806d83edd4be8cf8c0b5d40fe63276b50f18d8eff8a74"
+      "sha256": "5b614e96ed951c5eebb5c40c93612f59ff79da768055233b59790599421a70ec"
     },
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
@@ -2912,7 +2917,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "f6b80df54bb7634a9effb1cbe51b3ff99b05b0b7912be5a06690f63d237689f9"
+      "sha256": "edf6ecc725b37fe2c515174e6b06025f82fae10172e6f13d8fcfbb060c11474a"
     },
     {
       "path": "modules/grading/module.json",
@@ -4032,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "132fd0ff1d19c5dc9ed4fddbcab4d6ca1754214e00da32fcd4bf06fd42cf0b05"
+      "sha256": "ffd1f91d40f2098324c3054cd3accdfdf210a668972dcb8702104cd11ed6c4dc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f8aec45507128cd1060537a8aae479db0806b9adbc9f2b1024e601fe181bce32"
+      "sha256": "cd444deb3940b96b8afedb89f5ece513d842d4a9148b3a50304d8d77866dd904"
     },
     {
       "path": "public-docs/index.html",
@@ -4952,7 +4957,7 @@
     {
       "path": "scripts/gds/npmrc.js",
       "mode": "0000644",
-      "sha256": "115af471c497515927528927da78793400e7181476c23c724479bccd079baa3c"
+      "sha256": "9dfd27e75def392a73d7de7fd23d462afc97b17a8199acfe6563a80692570026"
     },
     {
       "path": "scripts/gds/oauth-secret.js",
@@ -5227,7 +5232,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "94f343beba33727cb83367555c35a699f53c8efa5d59e3b65d3f6a1cf3e0e3b0"
+      "sha256": "aa77aef41188c5ef596c9c5e7e89f54f97c93b6e889e1c776b8fe34c8af66cce"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5657,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "59777605e64fb494479971b94c25cf91ef601c21b5f4153d0856d6281c31db39"
+      "sha256": "2d8b78d34893b1e4c25d081c343ad1b0d1deb2a675cae9a3c4e96500c6cea821"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6627,7 +6632,7 @@
     {
       "path": "tests/grade_diff_hash.mjs",
       "mode": "0000644",
-      "sha256": "a661c482da391651dbf85fe92fe2a588802f8855560251cdc2074ae1b46d4425"
+      "sha256": "170b816aa9032e6eccba415f67ce60c10da5f2f706a1b1ee458a5d8578679535"
     },
     {
       "path": "tests/grade_server_authoritative.mjs",
@@ -6642,7 +6647,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "227d71aaab363d9346c3034f41cfb518e866b49bb460802b32626f288ecdcd76"
+      "sha256": "31557b08f8886f5d76201b5afbe0332e834504b67a391699798170aede9541e8"
     },
     {
       "path": "tests/grader_bypass.mjs",

package/docs/adr/0165-instances-hookless-by-default.md

@@ -0,0 +1,40 @@
+# 0165 — Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in
+
+- **Status:** Accepted
+- **Date:** 2026-08-11
+- **Deciders:** Claude (jaxri session), under the bug-wave mandate — flagged owner-adjacent; the ADR is the revisit point
+
+**Track:** `internal` (provisioning / trust boundary). Task [1002641](https://cloudbongos.com/builders#/task/1002641), from idea 1000655. Relates to [ADR 0043](<redacted>.md) (Layer 1), [ADR 0055](<redacted>.md) (server-mediated publish), [ADR 0162](<redacted>.md) (CI-only gates).
+
+---
+
+## Context
+
+Task 1002608 delivered `.husky/pre-push` — the ADR 0043 **Layer 1** local permission gate — for **this core repo**, and `scripts/gds/install-git-hooks.js` (run by `/builder-setup`) activates whatever hooks a clone's `.husky/` tracks by setting `core.hooksPath`.
+
+But nothing delivers Layer 1 to a **scaffolded standalone instance**: `init.js` / `provision.js` / `onboard.js` materialize no `.husky/`, and `publish-manifest.js` excludes `.husky/` from the published core artifact **by design** (`PROTECTED_TOPOLOGY_EXCLUDE` — a core update must never silently rewrite an instance's local gate topology). So instances run with no pre-push permission gate and no pre-commit secrets hook. Task 1002641 asks: is that a gap to fill, or the accepted posture?
+
+## Decision
+
+**Hookless-by-default is the accepted posture for instances. Provisioning scaffolds no `.husky/`. Local hooks are an instance-owned opt-in: an instance that wants them commits its own `.husky/`, and the core's existing `install-git-hooks.js` activates them on every builder's machine.**
+
+Four structural reasons:
+
+1. **The population Layer 1 constrains holds no push credential on an instance.** Sub-Metic builders work dev boxes where the git origin is credential-less and landing goes through **server-mediated publish** (ADR 0053/0055): the box uploads a bundle, the *server* pushes and opens the PR. A client-side pre-push hook on the box guards a push that cannot happen. Metic+ builders with real push access are inside the trust boundary, and their pushes meet the server-side gates that actually enforce: branch protection, the required `unit` check (fitness, gate-review tests, the authorship gate — task 1002640), and the every-push `main-audit`.
+2. **A client hook is not a security boundary** (ADR 0016: the DB and server enforce; local edits grant nothing). On the core repo, `.husky/pre-push` is defense-in-depth for contributors with direct push access — a materially different population than instance builders. Scaffolding it onto instances would *look* like a control while a hostile clone deletes it in one command.
+3. **The core cannot maintain what it deliberately does not ship.** `.husky/` is `PROTECTED_TOPOLOGY_EXCLUDE`d from the artifact, so scaffolded hooks would be born orphans — no upgrade path, rotting silently until they misfire. A written control that no longer runs teaches builders to ignore controls (the audit-authorship lesson, task 1002640).
+4. **ADR 0162 (owner directive): gates live in CI, rank-consistent and hands-free.** Instance-side client gates re-introduce the blocked-builder friction class that ADR retired — a broken hook strands a legitimate land until a human intervenes.
+
+**Secrets hooks follow the same rule.** A pre-commit secrets guard needs per-machine tooling and gives false local confidence; the PR-time CI secret scan is the enforcing control on every land.
+
+**The opt-in stays real, and stays instance-owned.** `install-git-hooks.js` ships in the core and already runs at `/builder-setup` on every instance; it activates whatever `.husky/` the *instance's own repo* tracks. Policy (which hooks, if any) is the instance's; the activation mechanism is the core's. That split mirrors the branding contract (ADR 0062 §7).
+
+## Rejected
+
+- **Scaffold `.husky/` wrappers at `init`/provision** — orphaned gate topology the core can't update (reason 3), guarding a push path instance builders don't have (reason 1).
+- **An `init --with-hooks` flag** — speculative surface; no instance has asked. If one does, it composes trivially on the opt-in path above.
+- **Treating hooklessness as a security regression to hotfix** — the enforcing controls on instances are server-side and already in place; Layer 1 was always the advisory outermost layer, not the wall.
+
+## When to revisit
+
+An instance model where builders routinely push directly with their own credentials (no server-mediated publish, no branch protection) would remove reasons 1–2; revisit then.

package/docs/adr/README.md

@@ -237,5 +237,6 @@ This keeps the decision history honest and traceable.
 
 | 0163 | [**Pre-197 display names: a transitional 'legacy' source, resolved at first sign-in** ([task 1002643](https://cloudbongos.com/builders#/task/1002643); idea 1000659). Amends [ADR 0156](<redacted>.md), whose migration defaulted every pre-existing row to `'github'` — false for builders who renamed after their last sign-in but before 197 landed, so their names kept reverting. No audit trail exists to backfill precisely, so `core_214` marks every pre-197 `'github'` row `'legacy'` (scoped by 197's `applied_at` on the instance — portable) and the upsert resolves each at its first sign-in: stored = incoming GitHub name → provably GitHub-derived → `'github'`; differs → treated as builder-set → kept, stamped `'user'`. Accepted misclassification: a GitHub-side rename in the window freezes a stale label (visible, self-fixable in Settings) — preferred over silently destroying deliberate renames. Rejected: `display_name <> github_login` heuristic (freezes nearly everyone), comparing forever on all `'github'` rows (turns every future GitHub rename into a frozen name).](<redacted>.md) | GDS / builder experience |
 | 0164 | [**The implausible-pass guard reads substance + evidence; the Metic+ honor-system residual is explicit** ([task 1002658](https://cloudbongos.com/builders#/task/1002658); grader-hardening goal 1000056). The guard fired only on `issues.length===0` — one fabricated `{}` defeated it, its magnitude inputs are client-supplied, and every in-sample firing (eval 2-for-2, tasks 1002643 ×2, 1002663) was a false positive on an honest unanimous zero-issue panel PASS. Redesign: count only SUBSTANTIVE issues (known severity + non-empty summary — padding trips the guard regardless), and waive the zero-issue pass when `signals.workers` carries the full &ge;3-worker panel shape, stamped `implausible_pass_waived` for /grade-audit. The residual is named, not hidden: every grade-time input is client-authored, so plausibility at grade time is honest-mistake hygiene; the binding authorities on the real diff are land-time (CI unit, gate-review, main audit) — Metic+ grade-time honesty is accepted honor-system per this ADR. The ADR-0042 CI grade-gate (land it vs record permanent deferral) goes to the owner as a blocker, not decided here. No approval step added or removed (ADR 0162).](<redacted>.md) | GDS / grading |
+| 0165 | [**Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in** ([task 1002641](https://cloudbongos.com/builders#/task/1002641); idea 1000655). Task 1002608 delivered the ADR 0043 Layer 1 pre-push gate for the CORE repo, but nothing materializes `.husky/` on a scaffolded standalone instance (`publish-manifest.js` excludes it by design). Decision: that is the accepted posture, not a gap. Sub-Metic instance builders hold no push credential at all (server-mediated publish, ADR 0053/0055) — a client pre-push hook guards a push that cannot happen; a client hook is not a security boundary (ADR 0016); the core cannot maintain hooks it deliberately does not ship (scaffolded hooks would be born orphans — the audit-authorship rot lesson, task 1002640); and ADR 0162 puts gates in CI, rank-consistent and hands-free. Secrets hooks follow the same rule (the PR-time CI secret scan enforces). The opt-in stays real and instance-owned: an instance commits its own `.husky/` and the core's `install-git-hooks.js` (already run by `/builder-setup`) activates it. Rejected: scaffolding wrappers at init, an `--with-hooks` flag (speculative), treating hooklessness as a regression. Revisit if an instance model has builders pushing directly with their own credentials.](<redacted>.md) | provisioning / trust boundary |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/canonical-permissions.md

@@ -265,7 +265,9 @@ pre-merge gate misses, independent of the builder's cooperation:
   [`src/bongos/permission-path-check.js`](../src/bongos/permission-path-check.js) (source of truth).
 - **Nobody pushes `main` directly.** The pre-push hook (`.husky/pre-push`, tracked in this repo and
   activated per-clone by `/builder-setup` via `install-git-hooks.js` — inert on a clone that never
-  activated it; ADR 0043 §"G-2/G-17 resolution") blocks it; the graded
+  activated it; ADR 0043 §"G-2/G-17 resolution") blocks it. This hook is a CORE-repo control:
+  scaffolded standalone instances are hookless by default — deliberate, not a gap
+  ([ADR 0165](adr/<redacted>.md)); the graded
   pipeline pushes only via `scripts/gds/push-main.js` (which carries the `OTB_ALLOW_MAIN_PUSH`
   override). A raw push is caught and reverted by the **post-push main audit**
   (`scripts/gds/main-audit.js`) — nightly and as the `~/deploy.sh` deploy gate — which is the

package/docs/recipes/private-npm-distribution.md

@@ -20,7 +20,7 @@ Both carry `publishConfig: { access: "restricted" }`, so **publishing them is pr
 These involve payment and permanent, account-level actions. They are **not** done inside a build session.
 
 1. **Put the `bongos` npm org on a paid plan.** Private scoped publishing requires it. On npmjs.com → your org → Billing → upgrade to a plan that allows private packages (npm Teams, ~$7/member/month). Add as members only the people who need to publish or install during pre-launch — each is a billed seat.
-2. **Create an access token.** npmjs.com → Access Tokens → *Generate New Token* → **Classic → Automation** (bypasses 2FA, which npm requires to publish), with **read-write** on the `@bongos` packages — a **read-only** token is enough for machines that only install. Store it as an environment variable, never in a committed file:
+2. **Create an access token.** npm retired classic (Automation/Publish) tokens — use a **granular access token**: npmjs.com → Access Tokens → *Generate New Token* → **Granular Access Token**, scoped to the `@bongos` packages with **Read and write** permission, and — for a token that publishes — enable **"Bypass two-factor authentication"** (npm otherwise requires interactive 2FA at publish). A **Read-only** granular token is enough for machines that only install. Granular tokens **expire** (pick the longest expiry the policy allows and calendar the rotation — a silently expired token is a 404 on the private package, the same symptom as a missing one). Store it as an environment variable, never in a committed file:
    ```sh
    export NPM_TOKEN=<redacted>
    ```
@@ -59,7 +59,7 @@ The steps below remain as the **manual fallback** (lane disarmed, npm outage, or
 2. **Publish** (owner, from a clean checkout of the released commit):
    ```sh
    node scripts/gds/package-core.js --publish        # DRY-RUN: runs the fail-closed no-leak gate, previews @bongos/core@<version>
-   npm login                                          # once per machine (+ 2FA), or use a Classic Automation token
+   npm login                                          # once per machine (+ 2FA), or use a granular token with 2FA bypass
    node scripts/gds/package-core.js --publish --live  # permanent; the no-leak gate must pass or nothing is built/uploaded
    ```
    The no-leak / mirror-redact gate is **built into the build** — a leaking artifact is never produced, so `--publish` cannot upload one.
@@ -89,7 +89,7 @@ Without a valid token + org membership the install 404s — that is the private
 
 Provisioning defaults to installing the core from a **vendored tarball** committed into each instance repo (task 2053) — offline, needs no token, and stays the default/fallback until the registry path is proven on a real greenfield standup. The registry pull is **opt-in and fail-soft**:
 
-- **Turn it on** by setting `PROVISION_CORE_FROM_REGISTRY=1` in the control-plane runner's environment (e.g. `/etc/cloudbongos/box.env`) **and** providing a read-only `NPM_TOKEN` (a Classic **Automation** token — read-only — from the paid `bongos` org). With both present, the standalone scaffold pins `@bongos/core@<version>` from the registry and writes an env-fed `.npmrc` (`_authToken=<redacted> instead of vendoring a tarball; `npm ci` then pulls the private package (the token is inherited from the runner env — never committed).
+- **Turn it on** by setting `PROVISION_CORE_FROM_REGISTRY=1` in the control-plane runner's environment (e.g. `/etc/cloudbongos/box.env`) **and** providing a read-only `NPM_TOKEN` (a **granular access token** — Read-only on the `@bongos` packages — from the paid `bongos` org; mind its expiry). With both present, the standalone scaffold pins `@bongos/core@<version>` from the registry and writes an env-fed `.npmrc` (`_authToken=<redacted> instead of vendoring a tarball; `npm ci` then pulls the private package (the token is inherited from the runner env — never committed).
 - **Fail-soft**: if the flag is set but `NPM_TOKEN` is absent, provisioning logs a notice and **falls back to the vendored tarball**, so a tokenless standup still works.
 - **Directly**: `bongos init --registry-core` scaffolds the registry shape (caret pin + `.npmrc`; generates the lockfile when `NPM_TOKEN` is set). `bongos upgrade --to <v> --registry` bumps a consumer to a registry version. Both are mutually exclusive with the vendored `--vendor-core` / `--from` inputs.
 

package/modules/grading/grader-rubric.json

@@ -12,6 +12,8 @@
     "assumed_builder_model": "claude-fable-5",
     "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
+    "worker_model_tiers": { "quality": "claude-haiku-4-5-20251001" },
+    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens runs on the haiku tier. workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-workers/efficiency.js

@@ -107,7 +107,7 @@ No prose, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound, contextBundle }) {
   const t = task || {};
 
   // Efficiency Monger shows diff size as informational context (its axis is
@@ -127,6 +127,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorR
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/hacker.js

@@ -117,7 +117,7 @@ No prose, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFindings, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFindings, priorRound, contextBundle }) {
   const t = task || {};
   const findings = Array.isArray(deterministicFindings) ? deterministicFindings : [];
 
@@ -155,6 +155,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFind
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/index.js

@@ -108,14 +108,15 @@ function resolvePanel(kinds) {
 // without knowing about the runSubagent internals. ("shot" is v3 multi-shot
 // terminology; v4 calls these workers — but the subprocess plumbing is the
 // same shape underneath.)
-async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffStats, model, runOpts, runSubagentFn, extractAssistantResultFn, deterministicFindings, priorRound }) {
+async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffStats, model, runOpts, runSubagentFn, extractAssistantResultFn, deterministicFindings, priorRound, contextBundle }) {
   // deterministicFindings (route-rank pre-pass, #475) is forwarded to every
   // worker's buildPrompt; only the Hacker reads it — the others ignore the
   // extra field, so this is a no-op for narc/quality/efficiency.
   // priorRound (task 1002662) rides the same way: the prior grade's findings +
   // builder response for a delta-aware re-grade; every worker renders it via
-  // the shared scaffold.
-  const prompt = worker.buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, deterministicFindings, priorRound });
+  // the shared scaffold. contextBundle (task 1002660) likewise: the post-change
+  // file contents read once by the caller, rendered by the shared scaffold.
+  const prompt = worker.buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, deterministicFindings, priorRound, contextBundle });
 
   // One subagent attempt → verdict. Pulled out so #465 can re-run it once on a
   // transient error without duplicating the spawn/parse/verdict plumbing.

package/modules/grading/grader-workers/narc.js

@@ -91,7 +91,7 @@ No prose before or after, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound, contextBundle }) {
   const t = task || {};
   // Narc's description fallback is uniquely "(no description — set confidence
   // LOW)" (the others use "(no description)"); the shared scaffold defaults to
@@ -100,6 +100,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound }) {
   // stays byte-identical to the inlined version.
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: { ...t, description: t.description || '(no description — set confidence LOW)' },
     valueSummary,

package/modules/grading/grader-workers/quality.js

@@ -80,7 +80,7 @@ No prose, no markdown fences:
 
 You have a Read tool. Spend reads checking that removed code is unreferenced elsewhere, that new helpers match surrounding style, and that invariants the diff touches are still preserved in the post-merge state. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound, contextBundle }) {
   const t = task || {};
 
   // Quality owns a diff-size section (the economy axis) before the diff.
@@ -101,6 +101,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorR
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/worker-prompt.js

@@ -62,7 +62,7 @@ const REGRADE_DELTA_POLICY = [
 function buildWorkerPrompt({
   header, task, valueSummary, diff, changedFiles,
   taskHeader, descLabel, emptyFilesText, readFilesHint, finalInstruction,
-  afterKindLines = [], beforeDiffLines = [], priorRound = null,
+  afterKindLines = [], beforeDiffLines = [], priorRound = null, contextBundle = null,
 }) {
   const t = task || {};
   const desc = (t.description || '(no description)').trim();
@@ -106,6 +106,29 @@ function buildWorkerPrompt({
   lines.push('');
   lines.push(readFilesHint);
   lines.push('');
+  // task 1002660: the shared context bundle — post-change file contents read
+  // ONCE by the caller so four workers don't each re-explore the repo (the
+  // dominant panel cost). Untrusted builder-authored content → fenced, one
+  // block per file. The trusted lead line tells the worker Read is only
+  // needed for files NOT bundled.
+  if (contextBundle && Array.isArray(contextBundle.files) && contextBundle.files.length > 0) {
+    lines.push('---');
+    lines.push(`## Post-change file contents (${contextBundle.files.length} of ${(changedFiles || []).length} changed files, bundled)`);
+    lines.push('');
+    lines.push('The post-change contents of the changed files below are included inline — use your Read tool ONLY for files not bundled here (listed after the blocks) or for unchanged context files.');
+    lines.push('');
+    for (const f of contextBundle.files) {
+      // The filename is builder-controlled — scrub it like every other
+      // untrusted string that lands OUTSIDE a fence (panel hacker finding).
+      const label = `FILE: ${scrubUntrusted(String(f.file))}${f.truncated ? ' (truncated)' : ''}`;
+      lines.push(...fenceBlock(label, f.content));
+      lines.push('');
+    }
+    if (Array.isArray(contextBundle.skipped) && contextBundle.skipped.length > 0) {
+      lines.push(`Not bundled (deleted, binary, or over the size cap — Read them if needed): ${contextBundle.skipped.map((s) => scrubUntrusted(String(s))).join(', ')}`);
+      lines.push('');
+    }
+  }
   // task 1002662: prior panel round context for a delta-aware re-grade. The
   // findings/response/interim summary are builder-adjacent data → fenced; the
   // policy that governs them is trusted text outside the fences.

package/modules/grading/grader.js

@@ -102,6 +102,11 @@ const DEFAULT_SHOTS = V3.shots || 3;
 const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
 const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
+// task 1002660: per-worker model tier overrides (rubric-configured). The
+// Quality worker was 41% of panel spend with 75% nit findings — its cq/economy
+// judgment doesn't need the full cross-model tier. Keys are worker kinds;
+// values are model ids. workerModelFor guards the cross-model invariant.
+const WORKER_MODEL_TIERS = V4.worker_model_tiers || {};
 const workers = require('./grader-workers');
 // Carved into modules/grading/ (BV1.R73 / ADR 0091 §1+§4): the two deterministic
 // trust classifiers are KERNEL (KERNEL_FILES, R70) — reached through the doorway,
@@ -235,6 +240,20 @@ function selectGraderModel({ builderModel } = {}) {
   return DEFAULT_GRADER_MODEL;
 }
 
+// task 1002660: resolve one worker's model — the rubric tier override when one
+// exists, else the panel's cross-model pick. The override is refused (falls
+// back to graderModel) when it lands on the BUILDER's own family: tiering is
+// a cost lever, never a hole in the ADR 0024 cross-model guarantee.
+const MODEL_FAMILY_TOKENS = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+function workerModelFor(kind, graderModel, builderModel) {
+  const tier = WORKER_MODEL_TIERS[kind];
+  if (!tier) return graderModel;
+  const bm = String(builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
+  const tierFamily = MODEL_FAMILY_TOKENS.find((t) => String(tier).toLowerCase().includes(t));
+  if (tierFamily && bm.includes(tierFamily)) return graderModel;
+  return tier;
+}
+
 // ---------- v3: prompt builder (default-fail framing) ----------
 
 // The instance's project name, injected into the grader's identity line so a
@@ -1135,6 +1154,60 @@ function runSubagent({ prompt, opts = {} }) {
   });
 }
 
+// ---------- task 1002660: shared context bundle ----------
+//
+// ~90% of panel cost was fixed re-exploration: four subprocesses each spending
+// agentic Read turns re-opening the same changed files. Read them ONCE here
+// and hand every worker the post-change contents inline (fenced, untrusted),
+// so a worker's Read tool is only needed for files beyond the bundle.
+const CONTEXT_BUNDLE_MAX_FILES = 24;
+const CONTEXT_BUNDLE_MAX_TOTAL_CHARS = 120_000;
+const CONTEXT_BUNDLE_MAX_FILE_CHARS = 16_000;
+// Binary-ish extensions never worth inlining (the diff already names them).
+const CONTEXT_BUNDLE_SKIP_RE = /\.(?:png|jpe?g|gif|webp|ico|svgz|woff2?|ttf|eot|zip|gz|tgz|tar|pdf|mp[34]|wav|ogg|bin|exe|dll|node)$/i;
+
+// Pure-ish (fs reads only, injectable): returns { files: [{file, content,
+// truncated}], skipped: [file...], total_chars } for the post-change contents
+// of changedFiles under cwd. Deleted/unreadable files land in skipped —
+// their absence from the bundle is visible, never silent.
+//
+// Security (panel hacker finding, this task): changedFiles is builder-
+// controlled and git commits symlinks, so a naive readFileSync would follow a
+// committed link OUT of the repo (SSH keys, session tokens) and inject the
+// target into worker prompts + the stored grade. lstat-refuse symlinks and
+// non-files, and require the resolved path to stay under cwd (containment) —
+// a refused entry lands in skipped, visible like every other exclusion.
+function buildContextBundle({ changedFiles, cwd, fsImpl = fs } = {}) {
+  const files = [];
+  const skipped = [];
+  let total = 0;
+  const root = path.resolve(cwd || process.cwd());
+  for (const rel of (Array.isArray(changedFiles) ? changedFiles : [])) {
+    if (files.length >= CONTEXT_BUNDLE_MAX_FILES || total >= CONTEXT_BUNDLE_MAX_TOTAL_CHARS) {
+      skipped.push(rel);
+      continue;
+    }
+    if (CONTEXT_BUNDLE_SKIP_RE.test(rel)) { skipped.push(rel); continue; }
+    let content;
+    try {
+      const abs = path.resolve(root, rel);
+      if (abs !== root && !abs.startsWith(root + path.sep)) { skipped.push(rel); continue; }
+      const st = fsImpl.lstatSync(abs);
+      if (!st.isFile() || st.isSymbolicLink()) { skipped.push(rel); continue; }
+      content = fsImpl.readFileSync(abs, 'utf8');
+    } catch (_) { skipped.push(rel); continue; } // deleted by the diff, or unreadable
+    let truncated = false;
+    if (content.length > CONTEXT_BUNDLE_MAX_FILE_CHARS) {
+      content = content.slice(0, CONTEXT_BUNDLE_MAX_FILE_CHARS);
+      truncated = true;
+    }
+    if (total + content.length > CONTEXT_BUNDLE_MAX_TOTAL_CHARS) { skipped.push(rel); continue; }
+    total += content.length;
+    files.push({ file: rel, content, truncated });
+  }
+  return { files, skipped, total_chars: total };
+}
+
 // System 5 (task 1359): an OPT-IN cached path around runSubagent. When the caller
 // supplies a `cache` spec (from llm-cache.makeCacheSpec), a hit replays the stored
 // result at cost_usd:0 (so $0 flows naturally into extractCostUsd → session-cost);
@@ -1652,6 +1725,20 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
     ...(permPath ? permPath.findings : []),
   ];
 
+  // task 1002660: one read of the changed files, shared by all four workers —
+  // kills the per-worker re-exploration that dominated panel cost.
+  const contextBundle = buildContextBundle({ changedFiles, cwd: runOpts.cwd });
+  // task 1002660: cache-wrapped spawns. Same prompt + model replays at $0
+  // (llm-cache, System 5) — the prompt embeds the diff + bundle, so the key
+  // needs no separate scope sha. Absent llm-cache → plain runSubagent.
+  const runSubagentPanelCached = ({ prompt, opts }) => runSubagentCached({
+    prompt,
+    opts,
+    cache: api.llmCache
+      ? api.llmCache.makeCacheSpec({ prompt, model: opts?.model, task_type: 'grade_worker' })
+      : null,
+  });
+
   const startedAt = Date.now();
   const workerPromises = panel.map((worker) => workers.runWorker(worker, {
     task,
@@ -1659,12 +1746,14 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
     diff,
     changedFiles,
     diffStats,
-    model: graderModel,
+    // task 1002660: rubric tier override per worker (cross-model-guarded).
+    model: workerModelFor(worker.KIND, graderModel, builderModel),
     runOpts,
-    runSubagentFn: runSubagent,
+    runSubagentFn: runSubagentPanelCached,
     extractAssistantResultFn: extractAssistantResult,
     deterministicFindings: deterministicFindings.length ? deterministicFindings : null,
     priorRound: priorRound || null, // task 1002662: delta-aware re-grade context
+    contextBundle, // task 1002660: post-change file contents, read once
   }));
   const workerResults = await Promise.all(workerPromises);
   // Append the deterministic checks as pseudo-workers so the any-fail gate
@@ -1906,6 +1995,8 @@ module.exports = {
   // v3 surface (kept exported for diagnostics + tests)
   buildPrompt,
   selectGraderModel,
+  workerModelFor,                 // task 1002660: per-worker tier override (cross-model-guarded)
+  buildContextBundle,             // task 1002660: shared post-change file contents, read once per panel
   validateAndScore,
   aggregateShots,
   runSubagent,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.48",
+  "version": "1.19.50",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.48",
+      "version": "1.19.50",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.48",
+  "version": "1.19.50",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/npmrc.js

@@ -33,7 +33,7 @@ function npmrcContent({ scope = CORE_SCOPE, host = REGISTRY_HOST, tokenEnv = TOK
   return [
     `; Cloud Bongos — env-fed auth for the PRIVATE ${scope}/* packages (ADR 0134, task 2090).`,
     `; The token EXPANDS FROM THE ENVIRONMENT at install time; nothing secret is committed here.`,
-    `; \`npm ci\` needs ${tokenEnv} set (a read-only automation token from the paid \`bongos\` org);`,
+    `; \`npm ci\` needs ${tokenEnv} set (a read-only npm access token from the paid \`bongos\` org);`,
     `; without it the private package 404s — that is the expected tokenless outcome.`,
     `${scope}:registry=https://${host}/`,
     `//${host}/:_authToken=\${${tokenEnv}}`,

package/scripts/gds/ship.js

@@ -56,7 +56,7 @@
 //                                                       # staged-fresh (a re-run); it can't pre-approve.
 
 const crypto = require('node:crypto');
-const { execSync, execFileSync, spawnSync } = require('node:child_process');
+const { execSync, execFileSync, spawnSync, spawn } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -2066,6 +2066,28 @@ function shouldReuseGrade(storedGrade, currentDiffHash) {
   return storedGrade.diff_hash === currentDiffHash;
 }
 
+// task 1002660: task_grades has no issues column — the panel's deduped
+// issues[] survive only inside signals.workers[].issues. Rebuild them (same
+// (file, summary) dedupe as aggregatePanel) so the reuse re-POST carries the
+// substance the original PASS carried. Before this, the reused body posted
+// issues: undefined, so every reused PASS with findings read as a zero-issue
+// pass server-side and tripped the SR-9 plausibility guard into
+// manual-confirm — 0/106 successful uses, the feature defeated itself.
+function reconstructPanelIssues(signals) {
+  const out = [];
+  const seen = new Set();
+  for (const w of (Array.isArray(signals?.workers) ? signals.workers : [])) {
+    for (const it of (Array.isArray(w?.issues) ? w.issues : [])) {
+      if (!it || typeof it !== 'object') continue;
+      const key = `${it.file || ''}|${it.summary || ''}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(it);
+    }
+  }
+  return out;
+}
+
 // --- Subagent grader runner ---
 // Wraps grader.gradeSubagent so ship.js callers see a single function with
 // progress logging. MAS Phase 2.0 #410: gradeSubagent now runs the WORKER
@@ -2118,6 +2140,15 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       builderModel, // task 1002659: real session model → cross-model grader pick
       runOpts,
     });
+    // task 1002660: the single generalist shot has no Hacker or Efficiency
+    // lens — acceptable for genuinely inert copy/docs files, but never
+    // silently. The marker makes the dropped lenses queryable by /grade-audit
+    // (same pattern as implausible_pass_waived, ADR 0164).
+    result.signals = {
+      ...(result.signals || {}),
+      trivial_path: true,
+      lenses_dropped: ['hacker', 'efficiency'],
+    };
   } else {
     const panel = grader.WORKERS.DEFAULT_PANEL;
     console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
@@ -2160,6 +2191,21 @@ function runSmoke() {
   return { ran: true, clean: okPms };
 }
 
+// task 1002660: the async twin of runSmoke for the PRE-RESOLVE gate only. The
+// sync runSmoke blocks the event loop (execSync), which would freeze the
+// overlapped grade-panel promise mid-flight; awaiting this one keeps the loop
+// free so the panel's subprocess callbacks progress while smoke runs. The
+// post-merge smoke call keeps the sync form (nothing overlaps there).
+function runSmokeAsync() {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, ['scripts/gds/smoke-gds.js'], {
+      cwd: REPO_ROOT, stdio: 'inherit', windowsHide: true,
+    });
+    child.on('error', () => resolve({ ran: true, clean: false }));
+    child.on('close', (code) => resolve({ ran: true, clean: code === 0 }));
+  });
+}
+
 // task 1002605 (G-18): the pre-resolve smoke gate's two message sets, pure so the
 // wording is pinned by a DB-free unit test (tests/ship_smoke_gate.mjs). A smoke
 // FAIL used to fall silently through into the claim resolve — claim consumed,
@@ -2827,7 +2873,11 @@ function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits
 // and check whether a stored PASS grade exists for the same hash. On a match
 // we re-POST the stored grade (marking it reused in signals) and skip the
 // panel entirely — cheap re-ships with an unchanged diff stay fast.
-async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
+// task 1002660: the COMPUTE half — the reuse lookup + the panel run. No server
+// writes, so shipMain can start it before the smoke gate and overlap the
+// multi-minute panel with smoke + the claim resolve. Returns
+// { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
+async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
   // Compute the fingerprint of the raw (untruncated) diff so we can compare
   // against any stored grade, independent of the display-truncation cap.
   const currentHash = computeRawDiffHash(baseline);
@@ -2838,7 +2888,7 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
 
     if (shouldReuseGrade(storedGrade, currentHash)) {
       console.log('  Grade reuse: stored PASS grade matches current diff hash — skipping panel.');
-      // Re-POST the stored result with a reused marker so the audit trail is
+      // Reuse the stored result with a reused marker so the audit trail is
       // complete. We keep the original grader_kind and inject reuse metadata
       // into signals so a bare table scan can spot reused grades.
       const reusedSignals = {
@@ -2855,10 +2905,12 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
         rubric_scores: storedGrade.rubric_scores,
         notes_md:      storedGrade.notes_md,
         signals:       reusedSignals,
+        // task 1002660: carry the original panel's issues (rebuilt from
+        // signals.workers[].issues — the row stores them nowhere else) so the
+        // reused PASS stands on the same substance/evidence it passed with.
+        issues:        reconstructPanelIssues(storedGrade.signals),
       };
-      const payload = { ...buildGradePayload(reusedResult, committedFiles), diff_hash: currentHash };
-      return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
-      // No logGraderPanelCost — the panel didn't run, there's no cost to log.
+      return { kind: 'reuse', currentHash, reusedResult };
     }
   }
 
@@ -2875,7 +2927,25 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
   if (priorRound?.audit) {
     gradeResult.signals = { ...(gradeResult.signals || {}), regrade: priorRound.audit };
   }
-  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: currentHash ?? undefined };
+  return { kind: 'fresh', currentHash, gradeResult };
+}
+
+// The RECORD half: POST the computed grade + log the panel cost. `precomputed`
+// (a promise from computeGradeResult, task 1002660) lets the ship path hand in
+// the overlapped computation; the --regrade path passes nothing and computes
+// inline — behavior identical to the pre-split gradeAndRecord either way.
+async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null }) {
+  const computed = await (precomputed
+    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound }));
+
+  if (computed.kind === 'reuse') {
+    const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };
+    return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
+    // No logGraderPanelCost — the panel didn't run, there's no cost to log.
+  }
+
+  const { gradeResult } = computed;
+  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: computed.currentHash ?? undefined };
   const gradePost = await (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
   // Log the panel's cost once the grade is recorded — independent of the
   // pass/fail VERDICT (the panel ran, and cost money, either way), but only
@@ -3844,8 +3914,30 @@ async function shipMain() {
   // on the actual ship: the --approved re-run, or a laptop / non-game ship the
   // gate waved straight through. (#1061 — the gate is a no-op for those, so this
   // is the same single smoke run as before, just sequenced after it.)
+
+  // task 1002660: start the grade COMPUTATION now, so the multi-minute panel
+  // overlaps the smoke run + claim resolve instead of serializing behind them.
+  // computeGradeResult performs no server writes — the grade POST stays in the
+  // grade step below, after the resolve lands the task at 'completed'. On a
+  // smoke abort the in-flight panel is discarded (its partial spend is lost —
+  // rare, and cheaper than serializing every ship behind smoke).
+  let gradeCompute = null;
+  let fullTaskForGrade = null;
+  if (!skipGrade) {
+    const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
+    fullTaskForGrade = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
+    console.log('Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
+    gradeCompute = computeGradeResult({
+      taskId, task: fullTaskForGrade, summary,
+      baseline: graderBaseline, committedFiles,
+    });
+    gradeCompute.catch(() => {}); // an abort path must not die on an unhandled rejection
+  }
+
   console.log('Running smoke tests against production...');
-  const smoke = runSmoke();
+  // task 1002660: the async twin — awaiting keeps the event loop free so the
+  // overlapped panel's subprocess callbacks progress while smoke runs.
+  const smoke = await runSmokeAsync();
   const passed = smoke.clean;
   console.log('');
   console.log(`Verification: smoke=${smoke.clean ? 'clean' : 'FAIL'}, overall=${passed ? 'PASS' : 'FAIL'}`);
@@ -3977,24 +4069,22 @@ async function shipMain() {
     console.log('');
     console.log('Running subagent quality grader...');
 
-    // Fetch the full task (description, kind, discipline, etc.) so the
-    // grader prompt has the intent the subagent is grading against.
-    const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
-    const fullTask = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
-
     // #513 + #536: the grader reads COMMITTED history (baseline...HEAD), not
     // the working tree. The empty-committed-diff guard now runs earlier — BEFORE
     // the claim is resolved (see above) — so by the time we reach here the diff
     // is guaranteed non-empty on the grader path. Reuse the baseline + file list
-    // computed there so we don't diff twice. #678: gradeAndRecord runs the
-    // subagent grader, POSTs the result, and logs the panel cost — the same unit
-    // the --regrade path reuses.
+    // computed there so we don't diff twice. #678: gradeAndRecord POSTs the
+    // result and logs the panel cost — the same unit the --regrade path reuses.
+    // task 1002660: the panel computation was started BEFORE the smoke gate
+    // (gradeCompute above) — hand it in so this step only waits out whatever
+    // panel time smoke + resolve didn't already absorb.
     const gradePost = await gradeAndRecord({
       taskId,
-      task: fullTask,
+      task: fullTaskForGrade || { id: taskId, title: ac.title },
       summary,
       baseline: graderBaseline,
       committedFiles,
+      precomputed: gradeCompute,
     });
 
     if (!gradePost.ok) {
@@ -4281,7 +4371,8 @@ module.exports = {
   // V4.R08: diff fingerprint + grade-reuse helpers — exported pure so the
   // truth table (same hash+pass→reuse, fail→no reuse, mismatch→re-grade,
   // null→re-grade) is unit-tested without git/network.
-  diffHash, computeRawDiffHash, shouldReuseGrade, gradeAndRecord,
+  diffHash, computeRawDiffHash, shouldReuseGrade, reconstructPanelIssues, gradeAndRecord,
+  computeGradeResult, // task 1002660: the no-server-write compute half, overlapped with smoke
   // task 1002662: delta-aware re-grade — the prior-round payload builder,
   // exported pure so the panel/audit shapes are pinned without git/network.
   buildPriorRoundContext,

package/src/module-api.js

@@ -523,8 +523,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.46 with no explicit bump. run 31521404176. (task 1002620)
 //   1.19.48 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.47 with no explicit bump. run 31522865111. (task 1002620)
+//   1.19.49 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.48 with no explicit bump. run 31523559509. (task 1002620)
+//   1.19.50 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.48'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.50'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_diff_hash.mjs

@@ -15,7 +15,7 @@ import { createRequire } from 'node:module';
 import { makeSqlAwareClient } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { diffHash, shouldReuseGrade } = require('../scripts/gds/ship.js');
+const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/gds/ship.js');
 const db = require('../modules/lifecycle/db.js');
 // applyGrade resolves the 'reward' kernel port; register it so calls in the
 // passed=true path don't blow up on null (mirrors grade_attribution.mjs).
@@ -111,6 +111,34 @@ test('shouldReuseGrade → false when currentDiffHash is null (no baseline)', ()
   assert.equal(shouldReuseGrade({ passed: true, diff_hash: HASH_A }, null), false);
 });
 
+// ======================================================================
+// 2b. reconstructPanelIssues — the reuse re-POST carries the original
+//     panel's issues, rebuilt from signals.workers[].issues (task 1002660)
+// ======================================================================
+
+test('reconstructPanelIssues rebuilds deduped issues from workers', () => {
+  const issues = reconstructPanelIssues({
+    workers: [
+      { kind: 'narc', issues: [{ severity: 'nit', file: 'a.js', summary: 'style' }] },
+      { kind: 'quality', issues: [
+        { severity: 'nit', file: 'a.js', summary: 'style' },          // dupe of narc's
+        { severity: 'minor', file: 'b.js', summary: 'dead code' },
+      ] },
+      { kind: 'hacker', issues: [] },
+      { kind: 'efficiency' },                                         // no issues field
+    ],
+  });
+  assert.equal(issues.length, 2, 'dupes collapse on (file, summary)');
+  assert.deepEqual(issues.map((i) => i.file), ['a.js', 'b.js']);
+});
+
+test('reconstructPanelIssues → [] on missing/empty/junk signals', () => {
+  assert.deepEqual(reconstructPanelIssues(null), []);
+  assert.deepEqual(reconstructPanelIssues({}), []);
+  assert.deepEqual(reconstructPanelIssues({ workers: 'junk' }), []);
+  assert.deepEqual(reconstructPanelIssues({ workers: [null, { issues: [null, 'junk'] }] }), []);
+});
+
 // ======================================================================
 // 3. db.applyGrade stores diff_hash (SQL-aware fake pool, NODE_ENV=test)
 // ======================================================================

package/tests/grader.mjs

@@ -840,6 +840,128 @@ test('selectGraderModel: builder Haiku → grader Opus', () => {
   assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-5');
 });
 
+// --- task 1002660: per-worker model tiering (cross-model-guarded) ---
+
+test('workerModelFor: Quality tiers down to haiku; other workers keep the panel model', () => {
+  assert.equal(
+    grader.workerModelFor('quality', 'claude-sonnet-5', 'claude-fable-5'),
+    'claude-haiku-4-5-20251001'
+  );
+  for (const kind of ['narc', 'hacker', 'efficiency']) {
+    assert.equal(grader.workerModelFor(kind, 'claude-sonnet-5', 'claude-fable-5'), 'claude-sonnet-5');
+  }
+});
+
+test('workerModelFor: a tier override landing on the BUILDER family is refused (cross-model guarantee)', () => {
+  // A haiku builder must not be quality-judged by haiku — fall back to the panel model.
+  assert.equal(
+    grader.workerModelFor('quality', 'claude-opus-5', 'claude-haiku-4-5-20251001'),
+    'claude-opus-5'
+  );
+});
+
+// --- task 1002660: shared context bundle ---
+
+const plainFileStat = { isFile: () => true, isSymbolicLink: () => false };
+function fakeFsFor(files, { symlinks = [] } = {}) {
+  const relOf = (p) => Object.keys(files).find((k) => String(p).replace(/\\/g, '/').endsWith(k));
+  return {
+    lstatSync: (p) => {
+      const rel = relOf(p);
+      if (!rel) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+      return symlinks.includes(rel)
+        ? { isFile: () => false, isSymbolicLink: () => true }
+        : plainFileStat;
+    },
+    readFileSync: (p) => {
+      const rel = relOf(p);
+      if (!rel) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+      return files[rel];
+    },
+  };
+}
+
+test('buildContextBundle reads changed files once, skips binaries/missing, respects caps', () => {
+  const files = {
+    'src/a.js': 'const a = 1;\n',
+    'docs/b.md': '# b\n',
+    'art/pic.png': 'binarybytes',
+  };
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['src/a.js', 'docs/b.md', 'art/pic.png', 'gone/deleted.js'],
+    cwd: '/repo',
+    fsImpl: fakeFsFor(files),
+  });
+  assert.deepEqual(bundle.files.map((f) => f.file), ['src/a.js', 'docs/b.md']);
+  assert.deepEqual(bundle.skipped, ['art/pic.png', 'gone/deleted.js'], 'binary + deleted → skipped, visibly');
+  assert.equal(bundle.files[0].content, 'const a = 1;\n');
+  assert.equal(bundle.total_chars, files['src/a.js'].length + files['docs/b.md'].length);
+});
+
+test('buildContextBundle truncates oversized files and marks them', () => {
+  const big = 'x'.repeat(20_000);
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['big.js'], cwd: '/r',
+    fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
+  });
+  assert.equal(bundle.files[0].truncated, true);
+  assert.ok(bundle.files[0].content.length <= 16_000);
+});
+
+test('buildContextBundle REFUSES symlinks — a committed link cannot pull out-of-repo content into prompts (hacker finding)', () => {
+  const files = { 'src/a.js': 'ok', 'evil-link.js': 'should never be read' };
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['src/a.js', 'evil-link.js'],
+    cwd: '/repo',
+    fsImpl: fakeFsFor(files, { symlinks: ['evil-link.js'] }),
+  });
+  assert.deepEqual(bundle.files.map((f) => f.file), ['src/a.js']);
+  assert.ok(bundle.skipped.includes('evil-link.js'), 'symlink refused, visibly');
+});
+
+test('buildContextBundle REFUSES path escapes — a ../ entry cannot leave cwd (containment)', () => {
+  let readAttempted = false;
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['../outside/secrets.txt'],
+    cwd: '/repo/inner',
+    fsImpl: {
+      lstatSync: () => plainFileStat,
+      readFileSync: () => { readAttempted = true; return 'secret'; },
+    },
+  });
+  assert.deepEqual(bundle.files, []);
+  assert.deepEqual(bundle.skipped, ['../outside/secrets.txt']);
+  assert.equal(readAttempted, false, 'the escape is refused before any read');
+});
+
+test('worker prompts render the context bundle fenced, with the skipped list visible', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 'v',
+    diff: 'diff --git a/x b/x',
+    changedFiles: ['src/a.js', 'art/pic.png'],
+    contextBundle: {
+      files: [{ file: 'src/a.js', content: 'const a = 1;', truncated: false }],
+      skipped: ['art/pic.png'],
+      total_chars: 12,
+    },
+  });
+  assert.ok(prompt.includes('Post-change file contents'), 'bundle section renders');
+  assert.ok(prompt.includes('const a = 1;'), 'bundled content is present');
+  assert.ok(prompt.includes('FILE: src/a.js'), 'per-file fence label present');
+  assert.ok(/Not bundled .*art\/pic\.png/.test(prompt), 'skipped files are named, never silent');
+});
+
+test('worker prompts without a bundle are unchanged (no bundle section)', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 'v',
+    diff: 'diff --git a/x b/x',
+    changedFiles: ['src/a.js'],
+  });
+  assert.ok(!prompt.includes('Post-change file contents'));
+});
+
 test('selectGraderModel: missing builder → default (assumed-Fable builder → Sonnet 5); unknown id FALLS BACK, never throws (task 1002659)', () => {
   // No builderModel is the legitimate default path (the caller assumes the
   // owner-top-model builder per CLAUDE.md §2), resolving to the default grader.