@bongos/core 1.19.487 → 1.19.489

package/modules/hall-ui/public/profile.states.json

@@ -1,15 +1,116 @@
 {
-  "_": "The hall's PROFILE page through modules/ui-design/kit/render.js (task 1003308). The identity band, the shelf and the three activity ledgers only exist once a profile has LOADED, so the floors run against the hall-preview harness (see settings.states.json for the two commands; pass --base-in/--base-out at it). `out` is a real state here rather than a redirect: a signed-out visitor with no ?id= gets the empty state, not a bounce — under the harness's --fixture-me the /me read still answers, so `out` renders the own profile there and the empty state only under the kit's own stub.",
+  "_": "The hall's PROFILE page through modules/ui-design/kit/render.js (task 1003308; four screens behind the section rail since task 1003489 — overview, works, activity, connections). The identity band, the charts, the works ledger and the activity ledgers only exist once a profile has LOADED, so the floors run against the hall-preview harness (see settings.states.json for the two commands; pass --base-in/--base-out at it). One rail key renders at a time, so each key is its own state. `out` is a real state here rather than a redirect: a signed-out visitor with no ?id= gets the empty state, not a bounce — under the harness's --fixture-me the /me read still answers, so `out` renders the own profile there and the empty state only under the kit's own stub.",
   "page": "/profile",
   "surface": "hall-ui",
-  "stub": { "prefix": "/builders/" },
+  "stub": {
+    "prefix": "/builders/"
+  },
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreRequests": [
+    "/api/(gds|bongos)/"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/",
+    "\\b401\\b",
+    "\\b404\\b",
+    "Unauthorized",
+    "Not Found",
+    "load failed"
+  ],
   "states": {
-    "own": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#profile-h1", "#profile-head", "#numbers-body", "#works-table", "#activity-tabs"] } },
-    "other": { "auth": true, "url": "/profile?id=1000025", "actions": [["wait", 900]], "expect": { "visible": ["#profile-head", "#ach-grid"] } },
-    "out": { "auth": false, "actions": [["wait", 600]], "expect": { "visible": ["#profile-h1", "#profile-head"] } }
+    "own": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          1200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#profile-h1",
+          "#profile-rail",
+          "#profile-head",
+          "#numbers-body",
+          "#charts-controls",
+          "#charts-grid",
+          "#ach-grid"
+        ]
+      }
+    },
+    "works": {
+      "auth": true,
+      "url": "/profile#works",
+      "actions": [
+        [
+          "wait",
+          1200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#profile-rail",
+          "#works-table"
+        ]
+      }
+    },
+    "activity": {
+      "auth": true,
+      "url": "/profile#activity",
+      "actions": [
+        [
+          "wait",
+          1200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#profile-rail",
+          "#activity-tabs",
+          "#activity-tasks"
+        ]
+      }
+    },
+    "other": {
+      "auth": true,
+      "url": "/profile?id=1000025",
+      "actions": [
+        [
+          "wait",
+          1200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#profile-head",
+          "#charts-grid",
+          "#ach-grid"
+        ]
+      }
+    },
+    "out": {
+      "auth": false,
+      "actions": [
+        [
+          "wait",
+          600
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#profile-h1",
+          "#profile-head"
+        ]
+      }
+    }
   },
-  "reducedMotion": { "auth": true, "actions": [["wait", 900]] }
+  "reducedMotion": {
+    "auth": true,
+    "actions": [
+      [
+        "wait",
+        1200
+      ]
+    ]
+  }
 }

package/modules/lifecycle/db-claim-reads.js

@@ -140,9 +140,19 @@ async function getLastClaimHolder(taskId) {
 
 // getTaskGrade — fetch the current grade row for a task (V4.R08 diff-hash
 // reuse). Returns { diff_hash, passed, score, threshold, grader_kind,
-// grader_version, rubric_scores, signals, notes_md } or null when no grade
-// exists yet. Used by ship.js before the grade step to detect "same diff →
+// grader_version, rubric_scores, signals, notes_md, issues } or null when no
+// grade exists yet. Used by ship.js before the grade step to detect "same diff →
 // skip the panel".
+//
+// `issues` is LIFTED out of the signals jsonb (task 1003488). The panel's
+// findings are stored there because `task_grades` has no column for them
+// (db-grade.js), but every in-memory grade carries them at the top level, so a
+// reader that did not know the storage detail saw an empty `grade.issues` on a
+// row that in fact held findings — which is how the delta re-grade was silently
+// running with no prior-round context, and how a builder following
+// /grade-recover reads a failed grade as having no findings at all. Lifting is
+// additive: `signals.issues` stays exactly where it is for anything already
+// reading it.
 async function getTaskGrade(taskId) {
   const { rows } = await pool.query(
     `SELECT diff_hash, passed, score, threshold, grader_kind, grader_version,
@@ -152,7 +162,10 @@ async function getTaskGrade(taskId) {
       LIMIT 1`,
     [taskId]
   );
-  return rows[0] ?? null;
+  const row = rows[0] ?? null;
+  if (!row) return null;
+  const fromSignals = row.signals && row.signals.issues;
+  return { ...row, issues: Array.isArray(fromSignals) ? fromSignals : [] };
 }
 
 module.exports = {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.487",
+  "version": "1.19.489",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.487",
+      "version": "1.19.489",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.487",
+  "version": "1.19.489",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-grade-steps.js

@@ -94,10 +94,31 @@ async function logGraderPanelCost(taskId, gradeResult) {
 //   audit    — the compact regrade block recorded into the new grade's signals
 //              so grade_attempts rounds read as remediation history (the
 //              task-1002661 reader consumes this).
+// The prior round's findings, from EITHER grade shape (task 1003488).
+//
+// A grade exists in two shapes and this function is handed both. The in-memory
+// result `validateAndScore`/`serverSideGuards` return carries `issues` at the top
+// level; a grade READ BACK from the API does not, because `task_grades` has no
+// `issues` column and `db-grade.js` deliberately writes them into the signals
+// jsonb instead. `--regrade` passes the DB row (`ship-flow.js`: `tRes.data.grade`),
+// so reading only the top-level key silently yielded [] on every re-grade — the
+// panel was told it was on round N while being handed nothing about round N-1,
+// and the "answered findings can only re-veto with NEW evidence" protection
+// (task 1002662) cannot hold when the answered findings are invisible.
+//
+// Top level wins when present so an in-memory result keeps its exact behaviour;
+// `signals.issues` is the stored fallback. Mirrors how the caller already reaches
+// for `signals.graded_head_sha` three lines from where it passes this row in.
+function priorFindings(storedGrade) {
+  if (Array.isArray(storedGrade.issues)) return storedGrade.issues;
+  const fromSignals = storedGrade.signals && storedGrade.signals.issues;
+  return Array.isArray(fromSignals) ? fromSignals : [];
+}
+
 const PRIOR_ROUND_TEXT_CAP = 4000;
 function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits = '', interimDiffStat = '' }) {
   if (!storedGrade || typeof storedGrade !== 'object') return null;
-  const issues = Array.isArray(storedGrade.issues) ? storedGrade.issues : [];
+  const issues = priorFindings(storedGrade);
   const notes = typeof storedGrade.notes_md === 'string' ? storedGrade.notes_md.trim() : '';
   if (issues.length === 0 && !notes) return null;
   const verdictLine = `Prior verdict: ${storedGrade.passed ? 'PASS' : 'FAIL'} · score ${storedGrade.score ?? '?'}/10 · ${issues.length} finding(s)`;
@@ -436,6 +457,7 @@ function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, cre
 module.exports = {
   buildGradePayload,
   buildPriorRoundContext,
+  priorFindings,
   computeGradeResult,
   formatGradeOutcome,
   gradeAndRecord,

package/scripts/gds/ship.js

@@ -145,6 +145,7 @@ const {
   buildGradePayload,
   buildPriorRoundContext,
   computeGradeResult,
+  priorFindings,
   formatGradeOutcome,
   gradeAndRecord,
 } = require('./ship-grade-steps.js');
@@ -195,6 +196,9 @@ module.exports = {
   // task 1002662: delta-aware re-grade — the prior-round payload builder,
   // exported pure so the panel/audit shapes are pinned without git/network.
   buildPriorRoundContext,
+  // task 1003488: the two-shape finding reader behind it (a stored grade keeps
+  // its findings in signals.issues; an in-memory one at the top level).
+  priorFindings,
   // #943: pure grade-outcome formatter — exported so the grader-unavailable vs
   // FAIL display branch is unit-tested without capturing stdout.
   formatGradeOutcome,

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.487'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.489'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader_regrade_delta.mjs

@@ -184,5 +184,62 @@ test('buildPriorRoundContext caps oversized notes/response/interim text', () =>
   assert.ok(ctx.forPanel.interim_md.length < 5000, 'interim capped');
 });
 
+// ---- task 1003488: the prior round is read from a STORED grade, not just an
+// ---- in-memory one. A grade exists in two shapes and this function is handed
+// ---- both; reading only the top-level key made every --regrade run blind.
+
+test('prior round: a STORED grade carries its findings under signals.issues and they still reach the panel', () => {
+  // exactly what ship-flow.js passes on --regrade: tRes.data.grade, a DB row.
+  // task_grades has no issues column, so db-grade.js writes them into signals.
+  const dbRow = {
+    passed: false, score: 5, notes_md: '',
+    signals: {
+      issue_count: 2,
+      issues: [
+        { severity: 'major', worker: 'efficiency', file: 'a.js', summary: 'redundant sync reads' },
+        { severity: 'nit', worker: 'quality', file: 'b.js', summary: 'label drift' },
+      ],
+    },
+  };
+  const ctx = ship.buildPriorRoundContext({ storedGrade: dbRow });
+  assert.ok(ctx, 'a stored grade with findings is delta-aware context, not null');
+  assert.equal(ctx.audit.prior_findings_count, 2, 'the count is the stored findings, not 0');
+  assert.match(ctx.forPanel.findings_md, /2 finding\(s\)/);
+  assert.match(ctx.forPanel.findings_md, /redundant sync reads/, 'the finding text rides to the panel');
+  assert.match(ctx.forPanel.findings_md, /\[major\] efficiency · a\.js/, 'severity, worker and file survive');
+  assert.ok(!/no per-finding rows/.test(ctx.forPanel.findings_md),
+    'it must not fall through to the "no rows" placeholder');
+});
+
+test('prior round: an IN-MEMORY grade keeps its exact top-level behaviour', () => {
+  const inMemory = {
+    passed: false, score: 5, notes_md: '',
+    issues: [{ severity: 'major', worker: 'quality', file: 'c.js', summary: 'top level wins' }],
+    signals: { issues: [{ severity: 'nit', worker: 'x', file: 'd.js', summary: 'must not be preferred' }] },
+  };
+  const ctx = ship.buildPriorRoundContext({ storedGrade: inMemory });
+  assert.equal(ctx.audit.prior_findings_count, 1);
+  assert.match(ctx.forPanel.findings_md, /top level wins/);
+  assert.ok(!/must not be preferred/.test(ctx.forPanel.findings_md),
+    'top-level issues take precedence over signals.issues');
+});
+
+test('priorFindings: reads either shape, and never throws on a malformed one', () => {
+  const f = ship.priorFindings;
+  assert.deepEqual(f({ issues: [{ severity: 'nit' }] }).length, 1, 'top level');
+  assert.deepEqual(f({ signals: { issues: [{ severity: 'nit' }, { severity: 'major' }] } }).length, 2, 'stored');
+  for (const bad of [{}, { issues: null }, { signals: null }, { signals: {} },
+                     { signals: { issues: 'nope' } }, { issues: 'nope', signals: { issues: [{ severity: 'nit' }] } }]) {
+    const out = f(bad);
+    assert.ok(Array.isArray(out), `array for ${JSON.stringify(bad)}`);
+  }
+  // a non-array top level must fall through to the stored shape, not swallow it
+  assert.equal(f({ issues: 'nope', signals: { issues: [{ severity: 'nit' }] } }).length, 1);
+});
+
+test('prior round: a stored grade with NO findings anywhere is still null (unchanged)', () => {
+  assert.equal(ship.buildPriorRoundContext({ storedGrade: { passed: true, notes_md: '', signals: {} } }), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);