@bongos/core 1.19.487 → 1.19.488

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.487",
-  "core_contract": "1.19.487",
-  "source_commit": "71ab4261b5804066611e986c2372ef9f5b21ab3f",
+  "core_version": "1.19.488",
+  "core_contract": "1.19.488",
+  "source_commit": "47b82e47bd160e9d3c6f92ff6ab3979d5638c3c4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T21:17:37.696Z",
+  "built_at": "2026-09-02T21:47:00.422Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 422,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2299,
-  "tree_sha256": "ee7902bc51f7b7081ed0e074ba5656fb11df18e76286e01cce5b10f25016402e",
+  "tree_sha256": "a6f60f8c438272d2d5fc31bcc2529b65883daa934f70e98c65d09f616f7eae19",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2162,7 +2162,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "25fc5fcc358a52f1cbd1e6b0b3d6c1ec5636a9bc35bf0d0a6448b8b3b4f386ee"
+      "sha256": "9398d4da8d9cb14b453d1c71e991bd2cd32f0e33dcf4aa9d2e462584340c295b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4812,7 +4812,7 @@
     {
       "path": "modules/lifecycle/db-claim-reads.js",
       "mode": "0000644",
-      "sha256": "7aafa6f538811bd29d7f8ce3ebbf59fea72a90fea99de1fdfb6c62124eff23d5"
+      "sha256": "f927a56ba06659ffb51bf744edd80352da52fd0e7eac9c705cfaa00aaaba2ec7"
     },
     {
       "path": "modules/lifecycle/db-claims.js",
@@ -6792,12 +6792,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0f4dc55c4ca65e7ae596a287086fd476260cb20e767f21294a089bba4b217e78"
+      "sha256": "4300998231014d004c90c769abca14044ffc689e0fd5545162fd5532e4f3797e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7f5e6da8cdf0dfc5b93b8589469aef923a150ddf6bf4e2b7584d503646797ed1"
+      "sha256": "f3b425c5aedc4856ef43f5f525d1fb7d42abe1ae4624fc5a0bfa978ed3b01394"
     },
     {
       "path": "public-docs/index.html",
@@ -7862,7 +7862,7 @@
     {
       "path": "scripts/gds/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "f47c4a0d6a6dfdc386e3b7e1da456c0c983b727672646cb1d033d8b11c03f5f0"
+      "sha256": "1c30c7ff4cd52cbf53004e196436ad51cc3d5205e9697567747a7f7380236335"
     },
     {
       "path": "scripts/gds/ship-grade.js",
@@ -7932,7 +7932,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "7264827d7dc6a5d8babf5b0f6aa8384fa9c14fca71ba07a649226ce98dd84e0d"
+      "sha256": "a612a450145476ea8d6705d7a45b8a84e2dc861ad8cb5be8c6aa69252b5c54c5"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -8457,7 +8457,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ff62f569bf6ffc073ef475c0460eb315f1161aef08287569e8c0049bc72a74a6"
+      "sha256": "4c4a1ef880078313e11a941039e614270cbde15b4e4cdf015927d286f8fe531d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9822,7 +9822,7 @@
     {
       "path": "tests/grader_regrade_delta.mjs",
       "mode": "0000644",
-      "sha256": "9532fa686519ebfef7e5d3c3b323cafbf9e8a467c24da3ddc9257d29a5a3b942"
+      "sha256": "50a785eb6e2c71d5a043c2ec2c37a835777da6397dac3ffc2542acdde14b57a8"
     },
     {
       "path": "tests/grader_severity_gate.mjs",

package/docs/module-api-changelog.md

@@ -1411,5 +1411,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.485 with no explicit bump. run 33682949187. (task 1002620)
   1.19.487 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.486 with no explicit bump. run 33684267982. (task 1002620)
+  1.19.488 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.487 with no explicit bump. run 33686951657. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-claim-reads.js

@@ -140,9 +140,19 @@ async function getLastClaimHolder(taskId) {
 
 // getTaskGrade — fetch the current grade row for a task (V4.R08 diff-hash
 // reuse). Returns { diff_hash, passed, score, threshold, grader_kind,
-// grader_version, rubric_scores, signals, notes_md } or null when no grade
-// exists yet. Used by ship.js before the grade step to detect "same diff →
+// grader_version, rubric_scores, signals, notes_md, issues } or null when no
+// grade exists yet. Used by ship.js before the grade step to detect "same diff →
 // skip the panel".
+//
+// `issues` is LIFTED out of the signals jsonb (task 1003488). The panel's
+// findings are stored there because `task_grades` has no column for them
+// (db-grade.js), but every in-memory grade carries them at the top level, so a
+// reader that did not know the storage detail saw an empty `grade.issues` on a
+// row that in fact held findings — which is how the delta re-grade was silently
+// running with no prior-round context, and how a builder following
+// /grade-recover reads a failed grade as having no findings at all. Lifting is
+// additive: `signals.issues` stays exactly where it is for anything already
+// reading it.
 async function getTaskGrade(taskId) {
   const { rows } = await pool.query(
     `SELECT diff_hash, passed, score, threshold, grader_kind, grader_version,
@@ -152,7 +162,10 @@ async function getTaskGrade(taskId) {
       LIMIT 1`,
     [taskId]
   );
-  return rows[0] ?? null;
+  const row = rows[0] ?? null;
+  if (!row) return null;
+  const fromSignals = row.signals && row.signals.issues;
+  return { ...row, issues: Array.isArray(fromSignals) ? fromSignals : [] };
 }
 
 module.exports = {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.487",
+  "version": "1.19.488",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.487",
+      "version": "1.19.488",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.487",
+  "version": "1.19.488",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-grade-steps.js

@@ -94,10 +94,31 @@ async function logGraderPanelCost(taskId, gradeResult) {
 //   audit    — the compact regrade block recorded into the new grade's signals
 //              so grade_attempts rounds read as remediation history (the
 //              task-1002661 reader consumes this).
+// The prior round's findings, from EITHER grade shape (task 1003488).
+//
+// A grade exists in two shapes and this function is handed both. The in-memory
+// result `validateAndScore`/`serverSideGuards` return carries `issues` at the top
+// level; a grade READ BACK from the API does not, because `task_grades` has no
+// `issues` column and `db-grade.js` deliberately writes them into the signals
+// jsonb instead. `--regrade` passes the DB row (`ship-flow.js`: `tRes.data.grade`),
+// so reading only the top-level key silently yielded [] on every re-grade — the
+// panel was told it was on round N while being handed nothing about round N-1,
+// and the "answered findings can only re-veto with NEW evidence" protection
+// (task 1002662) cannot hold when the answered findings are invisible.
+//
+// Top level wins when present so an in-memory result keeps its exact behaviour;
+// `signals.issues` is the stored fallback. Mirrors how the caller already reaches
+// for `signals.graded_head_sha` three lines from where it passes this row in.
+function priorFindings(storedGrade) {
+  if (Array.isArray(storedGrade.issues)) return storedGrade.issues;
+  const fromSignals = storedGrade.signals && storedGrade.signals.issues;
+  return Array.isArray(fromSignals) ? fromSignals : [];
+}
+
 const PRIOR_ROUND_TEXT_CAP = 4000;
 function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits = '', interimDiffStat = '' }) {
   if (!storedGrade || typeof storedGrade !== 'object') return null;
-  const issues = Array.isArray(storedGrade.issues) ? storedGrade.issues : [];
+  const issues = priorFindings(storedGrade);
   const notes = typeof storedGrade.notes_md === 'string' ? storedGrade.notes_md.trim() : '';
   if (issues.length === 0 && !notes) return null;
   const verdictLine = `Prior verdict: ${storedGrade.passed ? 'PASS' : 'FAIL'} · score ${storedGrade.score ?? '?'}/10 · ${issues.length} finding(s)`;
@@ -436,6 +457,7 @@ function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, cre
 module.exports = {
   buildGradePayload,
   buildPriorRoundContext,
+  priorFindings,
   computeGradeResult,
   formatGradeOutcome,
   gradeAndRecord,

package/scripts/gds/ship.js

@@ -145,6 +145,7 @@ const {
   buildGradePayload,
   buildPriorRoundContext,
   computeGradeResult,
+  priorFindings,
   formatGradeOutcome,
   gradeAndRecord,
 } = require('./ship-grade-steps.js');
@@ -195,6 +196,9 @@ module.exports = {
   // task 1002662: delta-aware re-grade — the prior-round payload builder,
   // exported pure so the panel/audit shapes are pinned without git/network.
   buildPriorRoundContext,
+  // task 1003488: the two-shape finding reader behind it (a stored grade keeps
+  // its findings in signals.issues; an in-memory one at the top level).
+  priorFindings,
   // #943: pure grade-outcome formatter — exported so the grader-unavailable vs
   // FAIL display branch is unit-tested without capturing stdout.
   formatGradeOutcome,

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.487'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.488'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader_regrade_delta.mjs

@@ -184,5 +184,62 @@ test('buildPriorRoundContext caps oversized notes/response/interim text', () =>
   assert.ok(ctx.forPanel.interim_md.length < 5000, 'interim capped');
 });
 
+// ---- task 1003488: the prior round is read from a STORED grade, not just an
+// ---- in-memory one. A grade exists in two shapes and this function is handed
+// ---- both; reading only the top-level key made every --regrade run blind.
+
+test('prior round: a STORED grade carries its findings under signals.issues and they still reach the panel', () => {
+  // exactly what ship-flow.js passes on --regrade: tRes.data.grade, a DB row.
+  // task_grades has no issues column, so db-grade.js writes them into signals.
+  const dbRow = {
+    passed: false, score: 5, notes_md: '',
+    signals: {
+      issue_count: 2,
+      issues: [
+        { severity: 'major', worker: 'efficiency', file: 'a.js', summary: 'redundant sync reads' },
+        { severity: 'nit', worker: 'quality', file: 'b.js', summary: 'label drift' },
+      ],
+    },
+  };
+  const ctx = ship.buildPriorRoundContext({ storedGrade: dbRow });
+  assert.ok(ctx, 'a stored grade with findings is delta-aware context, not null');
+  assert.equal(ctx.audit.prior_findings_count, 2, 'the count is the stored findings, not 0');
+  assert.match(ctx.forPanel.findings_md, /2 finding\(s\)/);
+  assert.match(ctx.forPanel.findings_md, /redundant sync reads/, 'the finding text rides to the panel');
+  assert.match(ctx.forPanel.findings_md, /\[major\] efficiency · a\.js/, 'severity, worker and file survive');
+  assert.ok(!/no per-finding rows/.test(ctx.forPanel.findings_md),
+    'it must not fall through to the "no rows" placeholder');
+});
+
+test('prior round: an IN-MEMORY grade keeps its exact top-level behaviour', () => {
+  const inMemory = {
+    passed: false, score: 5, notes_md: '',
+    issues: [{ severity: 'major', worker: 'quality', file: 'c.js', summary: 'top level wins' }],
+    signals: { issues: [{ severity: 'nit', worker: 'x', file: 'd.js', summary: 'must not be preferred' }] },
+  };
+  const ctx = ship.buildPriorRoundContext({ storedGrade: inMemory });
+  assert.equal(ctx.audit.prior_findings_count, 1);
+  assert.match(ctx.forPanel.findings_md, /top level wins/);
+  assert.ok(!/must not be preferred/.test(ctx.forPanel.findings_md),
+    'top-level issues take precedence over signals.issues');
+});
+
+test('priorFindings: reads either shape, and never throws on a malformed one', () => {
+  const f = ship.priorFindings;
+  assert.deepEqual(f({ issues: [{ severity: 'nit' }] }).length, 1, 'top level');
+  assert.deepEqual(f({ signals: { issues: [{ severity: 'nit' }, { severity: 'major' }] } }).length, 2, 'stored');
+  for (const bad of [{}, { issues: null }, { signals: null }, { signals: {} },
+                     { signals: { issues: 'nope' } }, { issues: 'nope', signals: { issues: [{ severity: 'nit' }] } }]) {
+    const out = f(bad);
+    assert.ok(Array.isArray(out), `array for ${JSON.stringify(bad)}`);
+  }
+  // a non-array top level must fall through to the stored shape, not swallow it
+  assert.equal(f({ issues: 'nope', signals: { issues: [{ severity: 'nit' }] } }).length, 1);
+});
+
+test('prior round: a stored grade with NO findings anywhere is still null (unchanged)', () => {
+  assert.equal(ship.buildPriorRoundContext({ storedGrade: { passed: true, notes_md: '', signals: {} } }), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);