@bongos/core 1.19.49 → 1.19.50

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.49",
-  "core_contract": "1.19.49",
-  "source_commit": "fd920fff3c9a5107c7e7d198f6e09d04c5f66f5b",
+  "core_version": "1.19.50",
+  "core_contract": "1.19.50",
+  "source_commit": "1a7b11b4377e9fefb36560c0cda9d4b1030a05c9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:36:50.229Z",
+  "built_at": "2026-08-11T18:44:57.114Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1529,
-  "tree_sha256": "94afa19b71a022c6b15c9ce95d71b3c76fe6ed87758e5b38dbfa259e7215ca5b",
+  "tree_sha256": "e96a0d29e2d6adc516aaa0d095dbb1c4d543dbec0508228b2cbcf16a1b400dbd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1572,7 +1572,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "1aafe7dafea94084c381e7ea1e91fad533ca379f9560da6f9f9f4a2cf4db4fc5"
+      "sha256": "5bfca9628859f1cdd79d741bdd50f3fe415430ee3380a2ac7f46b97ebe082d0e"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
@@ -2862,12 +2862,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "2e080d8d50383a24d77f9cf166f6e93e05e7bccc8775d14bbf68f2d6733eecd4"
+      "sha256": "6a0a2205fee2a4b0efc422c884826a9fd2af3d8785b393d5f7123e1758f1ebfc"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
       "mode": "0000644",
-      "sha256": "3e3721289ceb8c9c14e7aff7dc9569cbf01be3f2363bcaedc04aaee01d3fca3a"
+      "sha256": "ab85c9c7b167e710b07af1d4beb1579a593aa617e1c1990238d329fdb0362035"
     },
     {
       "path": "modules/grading/grader-workers/extract-json.js",
@@ -2882,22 +2882,22 @@
     {
       "path": "modules/grading/grader-workers/hacker.js",
       "mode": "0000644",
-      "sha256": "650914c1f726c02ee19c80f72676c2bf86d99b9aded6cff1210905db52cb48d8"
+      "sha256": "c7177625382e2ea61ee706c6b9b8669d9d452cdc0a92235695438b249c1ab6fc"
     },
     {
       "path": "modules/grading/grader-workers/index.js",
       "mode": "0000644",
-      "sha256": "232dc6b3c2d97282cce8032a1c671c89bb8e1e8936b4bb0acbd3ec4471e74f0a"
+      "sha256": "8ec5e91341ec5247ee643c6ce75fb5ec21a62b3bba176fdde060cdb352edb808"
     },
     {
       "path": "modules/grading/grader-workers/narc.js",
       "mode": "0000644",
-      "sha256": "eeb9545d638d58958049c7889401f1cd49a2fb03607c25bfbef3625a0c7dd9fd"
+      "sha256": "f35c3fce7feb6198df0011a9d22533038ca0766733c97a31841a184251800d39"
     },
     {
       "path": "modules/grading/grader-workers/quality.js",
       "mode": "0000644",
-      "sha256": "fa73a1d68c0126a2c109e9b7ef8692df29cbb41bbb800ab64e127f20e0a5865e"
+      "sha256": "003b51b4a5eab34bb634ceaad5ae9c1ae6f2566423fe0d15cef79b936dc6756b"
     },
     {
       "path": "modules/grading/grader-workers/rubric.js",
@@ -2907,7 +2907,7 @@
     {
       "path": "modules/grading/grader-workers/worker-prompt.js",
       "mode": "0000644",
-      "sha256": "9821a36e9a11be805cf806d83edd4be8cf8c0b5d40fe63276b50f18d8eff8a74"
+      "sha256": "5b614e96ed951c5eebb5c40c93612f59ff79da768055233b59790599421a70ec"
     },
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
@@ -2917,7 +2917,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "f6b80df54bb7634a9effb1cbe51b3ff99b05b0b7912be5a06690f63d237689f9"
+      "sha256": "edf6ecc725b37fe2c515174e6b06025f82fae10172e6f13d8fcfbb060c11474a"
     },
     {
       "path": "modules/grading/module.json",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7124698435e257f65256f4d3ab34277211b216cece5849b932368eccde73330f"
+      "sha256": "ffd1f91d40f2098324c3054cd3accdfdf210a668972dcb8702104cd11ed6c4dc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "16fecf0cf1d4f688f452ad27d37ba05776dd028444cd6cc9a2ab68deba3bb693"
+      "sha256": "cd444deb3940b96b8afedb89f5ece513d842d4a9148b3a50304d8d77866dd904"
     },
     {
       "path": "public-docs/index.html",
@@ -4957,7 +4957,7 @@
     {
       "path": "scripts/gds/npmrc.js",
       "mode": "0000644",
-      "sha256": "115af471c497515927528927da78793400e7181476c23c724479bccd079baa3c"
+      "sha256": "9dfd27e75def392a73d7de7fd23d462afc97b17a8199acfe6563a80692570026"
     },
     {
       "path": "scripts/gds/oauth-secret.js",
@@ -5232,7 +5232,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "94f343beba33727cb83367555c35a699f53c8efa5d59e3b65d3f6a1cf3e0e3b0"
+      "sha256": "aa77aef41188c5ef596c9c5e7e89f54f97c93b6e889e1c776b8fe34c8af66cce"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "902071a6283cfb63ca5cc90c8ca201cd97e14490a380b4e4a51c231a89b02e3f"
+      "sha256": "2d8b78d34893b1e4c25d081c343ad1b0d1deb2a675cae9a3c4e96500c6cea821"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6632,7 +6632,7 @@
     {
       "path": "tests/grade_diff_hash.mjs",
       "mode": "0000644",
-      "sha256": "a661c482da391651dbf85fe92fe2a588802f8855560251cdc2074ae1b46d4425"
+      "sha256": "170b816aa9032e6eccba415f67ce60c10da5f2f706a1b1ee458a5d8578679535"
     },
     {
       "path": "tests/grade_server_authoritative.mjs",
@@ -6647,7 +6647,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "227d71aaab363d9346c3034f41cfb518e866b49bb460802b32626f288ecdcd76"
+      "sha256": "31557b08f8886f5d76201b5afbe0332e834504b67a391699798170aede9541e8"
     },
     {
       "path": "tests/grader_bypass.mjs",

package/docs/recipes/private-npm-distribution.md

@@ -20,7 +20,7 @@ Both carry `publishConfig: { access: "restricted" }`, so **publishing them is pr
 These involve payment and permanent, account-level actions. They are **not** done inside a build session.
 
 1. **Put the `bongos` npm org on a paid plan.** Private scoped publishing requires it. On npmjs.com → your org → Billing → upgrade to a plan that allows private packages (npm Teams, ~$7/member/month). Add as members only the people who need to publish or install during pre-launch — each is a billed seat.
-2. **Create an access token.** npmjs.com → Access Tokens → *Generate New Token* → **Classic → Automation** (bypasses 2FA, which npm requires to publish), with **read-write** on the `@bongos` packages — a **read-only** token is enough for machines that only install. Store it as an environment variable, never in a committed file:
+2. **Create an access token.** npm retired classic (Automation/Publish) tokens — use a **granular access token**: npmjs.com → Access Tokens → *Generate New Token* → **Granular Access Token**, scoped to the `@bongos` packages with **Read and write** permission, and — for a token that publishes — enable **"Bypass two-factor authentication"** (npm otherwise requires interactive 2FA at publish). A **Read-only** granular token is enough for machines that only install. Granular tokens **expire** (pick the longest expiry the policy allows and calendar the rotation — a silently expired token is a 404 on the private package, the same symptom as a missing one). Store it as an environment variable, never in a committed file:
    ```sh
    export NPM_TOKEN=<redacted>
    ```
@@ -59,7 +59,7 @@ The steps below remain as the **manual fallback** (lane disarmed, npm outage, or
 2. **Publish** (owner, from a clean checkout of the released commit):
    ```sh
    node scripts/gds/package-core.js --publish        # DRY-RUN: runs the fail-closed no-leak gate, previews @bongos/core@<version>
-   npm login                                          # once per machine (+ 2FA), or use a Classic Automation token
+   npm login                                          # once per machine (+ 2FA), or use a granular token with 2FA bypass
    node scripts/gds/package-core.js --publish --live  # permanent; the no-leak gate must pass or nothing is built/uploaded
    ```
    The no-leak / mirror-redact gate is **built into the build** — a leaking artifact is never produced, so `--publish` cannot upload one.
@@ -89,7 +89,7 @@ Without a valid token + org membership the install 404s — that is the private
 
 Provisioning defaults to installing the core from a **vendored tarball** committed into each instance repo (task 2053) — offline, needs no token, and stays the default/fallback until the registry path is proven on a real greenfield standup. The registry pull is **opt-in and fail-soft**:
 
-- **Turn it on** by setting `PROVISION_CORE_FROM_REGISTRY=1` in the control-plane runner's environment (e.g. `/etc/cloudbongos/box.env`) **and** providing a read-only `NPM_TOKEN` (a Classic **Automation** token — read-only — from the paid `bongos` org). With both present, the standalone scaffold pins `@bongos/core@<version>` from the registry and writes an env-fed `.npmrc` (`_authToken=<redacted> instead of vendoring a tarball; `npm ci` then pulls the private package (the token is inherited from the runner env — never committed).
+- **Turn it on** by setting `PROVISION_CORE_FROM_REGISTRY=1` in the control-plane runner's environment (e.g. `/etc/cloudbongos/box.env`) **and** providing a read-only `NPM_TOKEN` (a **granular access token** — Read-only on the `@bongos` packages — from the paid `bongos` org; mind its expiry). With both present, the standalone scaffold pins `@bongos/core@<version>` from the registry and writes an env-fed `.npmrc` (`_authToken=<redacted> instead of vendoring a tarball; `npm ci` then pulls the private package (the token is inherited from the runner env — never committed).
 - **Fail-soft**: if the flag is set but `NPM_TOKEN` is absent, provisioning logs a notice and **falls back to the vendored tarball**, so a tokenless standup still works.
 - **Directly**: `bongos init --registry-core` scaffolds the registry shape (caret pin + `.npmrc`; generates the lockfile when `NPM_TOKEN` is set). `bongos upgrade --to <v> --registry` bumps a consumer to a registry version. Both are mutually exclusive with the vendored `--vendor-core` / `--from` inputs.
 

package/modules/grading/grader-rubric.json

@@ -12,6 +12,8 @@
     "assumed_builder_model": "claude-fable-5",
     "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
+    "worker_model_tiers": { "quality": "claude-haiku-4-5-20251001" },
+    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens runs on the haiku tier. workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-workers/efficiency.js

@@ -107,7 +107,7 @@ No prose, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound, contextBundle }) {
   const t = task || {};
 
   // Efficiency Monger shows diff size as informational context (its axis is
@@ -127,6 +127,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorR
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/hacker.js

@@ -117,7 +117,7 @@ No prose, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFindings, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFindings, priorRound, contextBundle }) {
   const t = task || {};
   const findings = Array.isArray(deterministicFindings) ? deterministicFindings : [];
 
@@ -155,6 +155,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, deterministicFind
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/index.js

@@ -108,14 +108,15 @@ function resolvePanel(kinds) {
 // without knowing about the runSubagent internals. ("shot" is v3 multi-shot
 // terminology; v4 calls these workers — but the subprocess plumbing is the
 // same shape underneath.)
-async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffStats, model, runOpts, runSubagentFn, extractAssistantResultFn, deterministicFindings, priorRound }) {
+async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffStats, model, runOpts, runSubagentFn, extractAssistantResultFn, deterministicFindings, priorRound, contextBundle }) {
   // deterministicFindings (route-rank pre-pass, #475) is forwarded to every
   // worker's buildPrompt; only the Hacker reads it — the others ignore the
   // extra field, so this is a no-op for narc/quality/efficiency.
   // priorRound (task 1002662) rides the same way: the prior grade's findings +
   // builder response for a delta-aware re-grade; every worker renders it via
-  // the shared scaffold.
-  const prompt = worker.buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, deterministicFindings, priorRound });
+  // the shared scaffold. contextBundle (task 1002660) likewise: the post-change
+  // file contents read once by the caller, rendered by the shared scaffold.
+  const prompt = worker.buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, deterministicFindings, priorRound, contextBundle });
 
   // One subagent attempt → verdict. Pulled out so #465 can re-run it once on a
   // transient error without duplicating the spawn/parse/verdict plumbing.

package/modules/grading/grader-workers/narc.js

@@ -91,7 +91,7 @@ No prose before or after, no markdown fences:
 
 You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound, contextBundle }) {
   const t = task || {};
   // Narc's description fallback is uniquely "(no description — set confidence
   // LOW)" (the others use "(no description)"); the shared scaffold defaults to
@@ -100,6 +100,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, priorRound }) {
   // stays byte-identical to the inlined version.
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: { ...t, description: t.description || '(no description — set confidence LOW)' },
     valueSummary,

package/modules/grading/grader-workers/quality.js

@@ -80,7 +80,7 @@ No prose, no markdown fences:
 
 You have a Read tool. Spend reads checking that removed code is unreferenced elsewhere, that new helpers match surrounding style, and that invariants the diff touches are still preserved in the post-merge state. Do not run tests, do not edit files, do not call the network.`;
 
-function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound }) {
+function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound, contextBundle }) {
   const t = task || {};
 
   // Quality owns a diff-size section (the economy axis) before the diff.
@@ -101,6 +101,7 @@ function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorR
 
   return buildWorkerPrompt({
     priorRound,
+    contextBundle, // task 1002660: shared post-change file contents
     header: PROMPT_HEADER,
     task: t,
     valueSummary,

package/modules/grading/grader-workers/worker-prompt.js

@@ -62,7 +62,7 @@ const REGRADE_DELTA_POLICY = [
 function buildWorkerPrompt({
   header, task, valueSummary, diff, changedFiles,
   taskHeader, descLabel, emptyFilesText, readFilesHint, finalInstruction,
-  afterKindLines = [], beforeDiffLines = [], priorRound = null,
+  afterKindLines = [], beforeDiffLines = [], priorRound = null, contextBundle = null,
 }) {
   const t = task || {};
   const desc = (t.description || '(no description)').trim();
@@ -106,6 +106,29 @@ function buildWorkerPrompt({
   lines.push('');
   lines.push(readFilesHint);
   lines.push('');
+  // task 1002660: the shared context bundle — post-change file contents read
+  // ONCE by the caller so four workers don't each re-explore the repo (the
+  // dominant panel cost). Untrusted builder-authored content → fenced, one
+  // block per file. The trusted lead line tells the worker Read is only
+  // needed for files NOT bundled.
+  if (contextBundle && Array.isArray(contextBundle.files) && contextBundle.files.length > 0) {
+    lines.push('---');
+    lines.push(`## Post-change file contents (${contextBundle.files.length} of ${(changedFiles || []).length} changed files, bundled)`);
+    lines.push('');
+    lines.push('The post-change contents of the changed files below are included inline — use your Read tool ONLY for files not bundled here (listed after the blocks) or for unchanged context files.');
+    lines.push('');
+    for (const f of contextBundle.files) {
+      // The filename is builder-controlled — scrub it like every other
+      // untrusted string that lands OUTSIDE a fence (panel hacker finding).
+      const label = `FILE: ${scrubUntrusted(String(f.file))}${f.truncated ? ' (truncated)' : ''}`;
+      lines.push(...fenceBlock(label, f.content));
+      lines.push('');
+    }
+    if (Array.isArray(contextBundle.skipped) && contextBundle.skipped.length > 0) {
+      lines.push(`Not bundled (deleted, binary, or over the size cap — Read them if needed): ${contextBundle.skipped.map((s) => scrubUntrusted(String(s))).join(', ')}`);
+      lines.push('');
+    }
+  }
   // task 1002662: prior panel round context for a delta-aware re-grade. The
   // findings/response/interim summary are builder-adjacent data → fenced; the
   // policy that governs them is trusted text outside the fences.

package/modules/grading/grader.js

@@ -102,6 +102,11 @@ const DEFAULT_SHOTS = V3.shots || 3;
 const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
 const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
+// task 1002660: per-worker model tier overrides (rubric-configured). The
+// Quality worker was 41% of panel spend with 75% nit findings — its cq/economy
+// judgment doesn't need the full cross-model tier. Keys are worker kinds;
+// values are model ids. workerModelFor guards the cross-model invariant.
+const WORKER_MODEL_TIERS = V4.worker_model_tiers || {};
 const workers = require('./grader-workers');
 // Carved into modules/grading/ (BV1.R73 / ADR 0091 §1+§4): the two deterministic
 // trust classifiers are KERNEL (KERNEL_FILES, R70) — reached through the doorway,
@@ -235,6 +240,20 @@ function selectGraderModel({ builderModel } = {}) {
   return DEFAULT_GRADER_MODEL;
 }
 
+// task 1002660: resolve one worker's model — the rubric tier override when one
+// exists, else the panel's cross-model pick. The override is refused (falls
+// back to graderModel) when it lands on the BUILDER's own family: tiering is
+// a cost lever, never a hole in the ADR 0024 cross-model guarantee.
+const MODEL_FAMILY_TOKENS = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+function workerModelFor(kind, graderModel, builderModel) {
+  const tier = WORKER_MODEL_TIERS[kind];
+  if (!tier) return graderModel;
+  const bm = String(builderModel || ASSUMED_BUILDER_MODEL).toLowerCase();
+  const tierFamily = MODEL_FAMILY_TOKENS.find((t) => String(tier).toLowerCase().includes(t));
+  if (tierFamily && bm.includes(tierFamily)) return graderModel;
+  return tier;
+}
+
 // ---------- v3: prompt builder (default-fail framing) ----------
 
 // The instance's project name, injected into the grader's identity line so a
@@ -1135,6 +1154,60 @@ function runSubagent({ prompt, opts = {} }) {
   });
 }
 
+// ---------- task 1002660: shared context bundle ----------
+//
+// ~90% of panel cost was fixed re-exploration: four subprocesses each spending
+// agentic Read turns re-opening the same changed files. Read them ONCE here
+// and hand every worker the post-change contents inline (fenced, untrusted),
+// so a worker's Read tool is only needed for files beyond the bundle.
+const CONTEXT_BUNDLE_MAX_FILES = 24;
+const CONTEXT_BUNDLE_MAX_TOTAL_CHARS = 120_000;
+const CONTEXT_BUNDLE_MAX_FILE_CHARS = 16_000;
+// Binary-ish extensions never worth inlining (the diff already names them).
+const CONTEXT_BUNDLE_SKIP_RE = /\.(?:png|jpe?g|gif|webp|ico|svgz|woff2?|ttf|eot|zip|gz|tgz|tar|pdf|mp[34]|wav|ogg|bin|exe|dll|node)$/i;
+
+// Pure-ish (fs reads only, injectable): returns { files: [{file, content,
+// truncated}], skipped: [file...], total_chars } for the post-change contents
+// of changedFiles under cwd. Deleted/unreadable files land in skipped —
+// their absence from the bundle is visible, never silent.
+//
+// Security (panel hacker finding, this task): changedFiles is builder-
+// controlled and git commits symlinks, so a naive readFileSync would follow a
+// committed link OUT of the repo (SSH keys, session tokens) and inject the
+// target into worker prompts + the stored grade. lstat-refuse symlinks and
+// non-files, and require the resolved path to stay under cwd (containment) —
+// a refused entry lands in skipped, visible like every other exclusion.
+function buildContextBundle({ changedFiles, cwd, fsImpl = fs } = {}) {
+  const files = [];
+  const skipped = [];
+  let total = 0;
+  const root = path.resolve(cwd || process.cwd());
+  for (const rel of (Array.isArray(changedFiles) ? changedFiles : [])) {
+    if (files.length >= CONTEXT_BUNDLE_MAX_FILES || total >= CONTEXT_BUNDLE_MAX_TOTAL_CHARS) {
+      skipped.push(rel);
+      continue;
+    }
+    if (CONTEXT_BUNDLE_SKIP_RE.test(rel)) { skipped.push(rel); continue; }
+    let content;
+    try {
+      const abs = path.resolve(root, rel);
+      if (abs !== root && !abs.startsWith(root + path.sep)) { skipped.push(rel); continue; }
+      const st = fsImpl.lstatSync(abs);
+      if (!st.isFile() || st.isSymbolicLink()) { skipped.push(rel); continue; }
+      content = fsImpl.readFileSync(abs, 'utf8');
+    } catch (_) { skipped.push(rel); continue; } // deleted by the diff, or unreadable
+    let truncated = false;
+    if (content.length > CONTEXT_BUNDLE_MAX_FILE_CHARS) {
+      content = content.slice(0, CONTEXT_BUNDLE_MAX_FILE_CHARS);
+      truncated = true;
+    }
+    if (total + content.length > CONTEXT_BUNDLE_MAX_TOTAL_CHARS) { skipped.push(rel); continue; }
+    total += content.length;
+    files.push({ file: rel, content, truncated });
+  }
+  return { files, skipped, total_chars: total };
+}
+
 // System 5 (task 1359): an OPT-IN cached path around runSubagent. When the caller
 // supplies a `cache` spec (from llm-cache.makeCacheSpec), a hit replays the stored
 // result at cost_usd:0 (so $0 flows naturally into extractCostUsd → session-cost);
@@ -1652,6 +1725,20 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
     ...(permPath ? permPath.findings : []),
   ];
 
+  // task 1002660: one read of the changed files, shared by all four workers —
+  // kills the per-worker re-exploration that dominated panel cost.
+  const contextBundle = buildContextBundle({ changedFiles, cwd: runOpts.cwd });
+  // task 1002660: cache-wrapped spawns. Same prompt + model replays at $0
+  // (llm-cache, System 5) — the prompt embeds the diff + bundle, so the key
+  // needs no separate scope sha. Absent llm-cache → plain runSubagent.
+  const runSubagentPanelCached = ({ prompt, opts }) => runSubagentCached({
+    prompt,
+    opts,
+    cache: api.llmCache
+      ? api.llmCache.makeCacheSpec({ prompt, model: opts?.model, task_type: 'grade_worker' })
+      : null,
+  });
+
   const startedAt = Date.now();
   const workerPromises = panel.map((worker) => workers.runWorker(worker, {
     task,
@@ -1659,12 +1746,14 @@ async function gradeSubagent({ task, valueSummary, diff, changedFiles, diffStats
     diff,
     changedFiles,
     diffStats,
-    model: graderModel,
+    // task 1002660: rubric tier override per worker (cross-model-guarded).
+    model: workerModelFor(worker.KIND, graderModel, builderModel),
     runOpts,
-    runSubagentFn: runSubagent,
+    runSubagentFn: runSubagentPanelCached,
     extractAssistantResultFn: extractAssistantResult,
     deterministicFindings: deterministicFindings.length ? deterministicFindings : null,
     priorRound: priorRound || null, // task 1002662: delta-aware re-grade context
+    contextBundle, // task 1002660: post-change file contents, read once
   }));
   const workerResults = await Promise.all(workerPromises);
   // Append the deterministic checks as pseudo-workers so the any-fail gate
@@ -1906,6 +1995,8 @@ module.exports = {
   // v3 surface (kept exported for diagnostics + tests)
   buildPrompt,
   selectGraderModel,
+  workerModelFor,                 // task 1002660: per-worker tier override (cross-model-guarded)
+  buildContextBundle,             // task 1002660: shared post-change file contents, read once per panel
   validateAndScore,
   aggregateShots,
   runSubagent,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.49",
+  "version": "1.19.50",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.49",
+      "version": "1.19.50",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.49",
+  "version": "1.19.50",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/npmrc.js

@@ -33,7 +33,7 @@ function npmrcContent({ scope = CORE_SCOPE, host = REGISTRY_HOST, tokenEnv = TOK
   return [
     `; Cloud Bongos — env-fed auth for the PRIVATE ${scope}/* packages (ADR 0134, task 2090).`,
     `; The token EXPANDS FROM THE ENVIRONMENT at install time; nothing secret is committed here.`,
-    `; \`npm ci\` needs ${tokenEnv} set (a read-only automation token from the paid \`bongos\` org);`,
+    `; \`npm ci\` needs ${tokenEnv} set (a read-only npm access token from the paid \`bongos\` org);`,
     `; without it the private package 404s — that is the expected tokenless outcome.`,
     `${scope}:registry=https://${host}/`,
     `//${host}/:_authToken=\${${tokenEnv}}`,

package/scripts/gds/ship.js

@@ -56,7 +56,7 @@
 //                                                       # staged-fresh (a re-run); it can't pre-approve.
 
 const crypto = require('node:crypto');
-const { execSync, execFileSync, spawnSync } = require('node:child_process');
+const { execSync, execFileSync, spawnSync, spawn } = require('node:child_process');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -2066,6 +2066,28 @@ function shouldReuseGrade(storedGrade, currentDiffHash) {
   return storedGrade.diff_hash === currentDiffHash;
 }
 
+// task 1002660: task_grades has no issues column — the panel's deduped
+// issues[] survive only inside signals.workers[].issues. Rebuild them (same
+// (file, summary) dedupe as aggregatePanel) so the reuse re-POST carries the
+// substance the original PASS carried. Before this, the reused body posted
+// issues: undefined, so every reused PASS with findings read as a zero-issue
+// pass server-side and tripped the SR-9 plausibility guard into
+// manual-confirm — 0/106 successful uses, the feature defeated itself.
+function reconstructPanelIssues(signals) {
+  const out = [];
+  const seen = new Set();
+  for (const w of (Array.isArray(signals?.workers) ? signals.workers : [])) {
+    for (const it of (Array.isArray(w?.issues) ? w.issues : [])) {
+      if (!it || typeof it !== 'object') continue;
+      const key = `${it.file || ''}|${it.summary || ''}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(it);
+    }
+  }
+  return out;
+}
+
 // --- Subagent grader runner ---
 // Wraps grader.gradeSubagent so ship.js callers see a single function with
 // progress logging. MAS Phase 2.0 #410: gradeSubagent now runs the WORKER
@@ -2118,6 +2140,15 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       builderModel, // task 1002659: real session model → cross-model grader pick
       runOpts,
     });
+    // task 1002660: the single generalist shot has no Hacker or Efficiency
+    // lens — acceptable for genuinely inert copy/docs files, but never
+    // silently. The marker makes the dropped lenses queryable by /grade-audit
+    // (same pattern as implausible_pass_waived, ADR 0164).
+    result.signals = {
+      ...(result.signals || {}),
+      trivial_path: true,
+      lenses_dropped: ['hacker', 'efficiency'],
+    };
   } else {
     const panel = grader.WORKERS.DEFAULT_PANEL;
     console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
@@ -2160,6 +2191,21 @@ function runSmoke() {
   return { ran: true, clean: okPms };
 }
 
+// task 1002660: the async twin of runSmoke for the PRE-RESOLVE gate only. The
+// sync runSmoke blocks the event loop (execSync), which would freeze the
+// overlapped grade-panel promise mid-flight; awaiting this one keeps the loop
+// free so the panel's subprocess callbacks progress while smoke runs. The
+// post-merge smoke call keeps the sync form (nothing overlaps there).
+function runSmokeAsync() {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, ['scripts/gds/smoke-gds.js'], {
+      cwd: REPO_ROOT, stdio: 'inherit', windowsHide: true,
+    });
+    child.on('error', () => resolve({ ran: true, clean: false }));
+    child.on('close', (code) => resolve({ ran: true, clean: code === 0 }));
+  });
+}
+
 // task 1002605 (G-18): the pre-resolve smoke gate's two message sets, pure so the
 // wording is pinned by a DB-free unit test (tests/ship_smoke_gate.mjs). A smoke
 // FAIL used to fall silently through into the claim resolve — claim consumed,
@@ -2827,7 +2873,11 @@ function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits
 // and check whether a stored PASS grade exists for the same hash. On a match
 // we re-POST the stored grade (marking it reused in signals) and skip the
 // panel entirely — cheap re-ships with an unchanged diff stay fast.
-async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
+// task 1002660: the COMPUTE half — the reuse lookup + the panel run. No server
+// writes, so shipMain can start it before the smoke gate and overlap the
+// multi-minute panel with smoke + the claim resolve. Returns
+// { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
+async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
   // Compute the fingerprint of the raw (untruncated) diff so we can compare
   // against any stored grade, independent of the display-truncation cap.
   const currentHash = computeRawDiffHash(baseline);
@@ -2838,7 +2888,7 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
 
     if (shouldReuseGrade(storedGrade, currentHash)) {
       console.log('  Grade reuse: stored PASS grade matches current diff hash — skipping panel.');
-      // Re-POST the stored result with a reused marker so the audit trail is
+      // Reuse the stored result with a reused marker so the audit trail is
       // complete. We keep the original grader_kind and inject reuse metadata
       // into signals so a bare table scan can spot reused grades.
       const reusedSignals = {
@@ -2855,10 +2905,12 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
         rubric_scores: storedGrade.rubric_scores,
         notes_md:      storedGrade.notes_md,
         signals:       reusedSignals,
+        // task 1002660: carry the original panel's issues (rebuilt from
+        // signals.workers[].issues — the row stores them nowhere else) so the
+        // reused PASS stands on the same substance/evidence it passed with.
+        issues:        reconstructPanelIssues(storedGrade.signals),
       };
-      const payload = { ...buildGradePayload(reusedResult, committedFiles), diff_hash: currentHash };
-      return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
-      // No logGraderPanelCost — the panel didn't run, there's no cost to log.
+      return { kind: 'reuse', currentHash, reusedResult };
     }
   }
 
@@ -2875,7 +2927,25 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
   if (priorRound?.audit) {
     gradeResult.signals = { ...(gradeResult.signals || {}), regrade: priorRound.audit };
   }
-  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: currentHash ?? undefined };
+  return { kind: 'fresh', currentHash, gradeResult };
+}
+
+// The RECORD half: POST the computed grade + log the panel cost. `precomputed`
+// (a promise from computeGradeResult, task 1002660) lets the ship path hand in
+// the overlapped computation; the --regrade path passes nothing and computes
+// inline — behavior identical to the pre-split gradeAndRecord either way.
+async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null }) {
+  const computed = await (precomputed
+    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound }));
+
+  if (computed.kind === 'reuse') {
+    const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };
+    return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
+    // No logGraderPanelCost — the panel didn't run, there's no cost to log.
+  }
+
+  const { gradeResult } = computed;
+  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: computed.currentHash ?? undefined };
   const gradePost = await (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
   // Log the panel's cost once the grade is recorded — independent of the
   // pass/fail VERDICT (the panel ran, and cost money, either way), but only
@@ -3844,8 +3914,30 @@ async function shipMain() {
   // on the actual ship: the --approved re-run, or a laptop / non-game ship the
   // gate waved straight through. (#1061 — the gate is a no-op for those, so this
   // is the same single smoke run as before, just sequenced after it.)
+
+  // task 1002660: start the grade COMPUTATION now, so the multi-minute panel
+  // overlaps the smoke run + claim resolve instead of serializing behind them.
+  // computeGradeResult performs no server writes — the grade POST stays in the
+  // grade step below, after the resolve lands the task at 'completed'. On a
+  // smoke abort the in-flight panel is discarded (its partial spend is lost —
+  // rare, and cheaper than serializing every ship behind smoke).
+  let gradeCompute = null;
+  let fullTaskForGrade = null;
+  if (!skipGrade) {
+    const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
+    fullTaskForGrade = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
+    console.log('Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
+    gradeCompute = computeGradeResult({
+      taskId, task: fullTaskForGrade, summary,
+      baseline: graderBaseline, committedFiles,
+    });
+    gradeCompute.catch(() => {}); // an abort path must not die on an unhandled rejection
+  }
+
   console.log('Running smoke tests against production...');
-  const smoke = runSmoke();
+  // task 1002660: the async twin — awaiting keeps the event loop free so the
+  // overlapped panel's subprocess callbacks progress while smoke runs.
+  const smoke = await runSmokeAsync();
   const passed = smoke.clean;
   console.log('');
   console.log(`Verification: smoke=${smoke.clean ? 'clean' : 'FAIL'}, overall=${passed ? 'PASS' : 'FAIL'}`);
@@ -3977,24 +4069,22 @@ async function shipMain() {
     console.log('');
     console.log('Running subagent quality grader...');
 
-    // Fetch the full task (description, kind, discipline, etc.) so the
-    // grader prompt has the intent the subagent is grading against.
-    const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
-    const fullTask = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
-
     // #513 + #536: the grader reads COMMITTED history (baseline...HEAD), not
     // the working tree. The empty-committed-diff guard now runs earlier — BEFORE
     // the claim is resolved (see above) — so by the time we reach here the diff
     // is guaranteed non-empty on the grader path. Reuse the baseline + file list
-    // computed there so we don't diff twice. #678: gradeAndRecord runs the
-    // subagent grader, POSTs the result, and logs the panel cost — the same unit
-    // the --regrade path reuses.
+    // computed there so we don't diff twice. #678: gradeAndRecord POSTs the
+    // result and logs the panel cost — the same unit the --regrade path reuses.
+    // task 1002660: the panel computation was started BEFORE the smoke gate
+    // (gradeCompute above) — hand it in so this step only waits out whatever
+    // panel time smoke + resolve didn't already absorb.
     const gradePost = await gradeAndRecord({
       taskId,
-      task: fullTask,
+      task: fullTaskForGrade || { id: taskId, title: ac.title },
       summary,
       baseline: graderBaseline,
       committedFiles,
+      precomputed: gradeCompute,
     });
 
     if (!gradePost.ok) {
@@ -4281,7 +4371,8 @@ module.exports = {
   // V4.R08: diff fingerprint + grade-reuse helpers — exported pure so the
   // truth table (same hash+pass→reuse, fail→no reuse, mismatch→re-grade,
   // null→re-grade) is unit-tested without git/network.
-  diffHash, computeRawDiffHash, shouldReuseGrade, gradeAndRecord,
+  diffHash, computeRawDiffHash, shouldReuseGrade, reconstructPanelIssues, gradeAndRecord,
+  computeGradeResult, // task 1002660: the no-server-write compute half, overlapped with smoke
   // task 1002662: delta-aware re-grade — the prior-round payload builder,
   // exported pure so the panel/audit shapes are pinned without git/network.
   buildPriorRoundContext,

package/src/module-api.js

@@ -525,8 +525,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.47 with no explicit bump. run 31522865111. (task 1002620)
 //   1.19.49 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.48 with no explicit bump. run 31523559509. (task 1002620)
+//   1.19.50 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.49'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.50'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_diff_hash.mjs

@@ -15,7 +15,7 @@ import { createRequire } from 'node:module';
 import { makeSqlAwareClient } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { diffHash, shouldReuseGrade } = require('../scripts/gds/ship.js');
+const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/gds/ship.js');
 const db = require('../modules/lifecycle/db.js');
 // applyGrade resolves the 'reward' kernel port; register it so calls in the
 // passed=true path don't blow up on null (mirrors grade_attribution.mjs).
@@ -111,6 +111,34 @@ test('shouldReuseGrade → false when currentDiffHash is null (no baseline)', ()
   assert.equal(shouldReuseGrade({ passed: true, diff_hash: HASH_A }, null), false);
 });
 
+// ======================================================================
+// 2b. reconstructPanelIssues — the reuse re-POST carries the original
+//     panel's issues, rebuilt from signals.workers[].issues (task 1002660)
+// ======================================================================
+
+test('reconstructPanelIssues rebuilds deduped issues from workers', () => {
+  const issues = reconstructPanelIssues({
+    workers: [
+      { kind: 'narc', issues: [{ severity: 'nit', file: 'a.js', summary: 'style' }] },
+      { kind: 'quality', issues: [
+        { severity: 'nit', file: 'a.js', summary: 'style' },          // dupe of narc's
+        { severity: 'minor', file: 'b.js', summary: 'dead code' },
+      ] },
+      { kind: 'hacker', issues: [] },
+      { kind: 'efficiency' },                                         // no issues field
+    ],
+  });
+  assert.equal(issues.length, 2, 'dupes collapse on (file, summary)');
+  assert.deepEqual(issues.map((i) => i.file), ['a.js', 'b.js']);
+});
+
+test('reconstructPanelIssues → [] on missing/empty/junk signals', () => {
+  assert.deepEqual(reconstructPanelIssues(null), []);
+  assert.deepEqual(reconstructPanelIssues({}), []);
+  assert.deepEqual(reconstructPanelIssues({ workers: 'junk' }), []);
+  assert.deepEqual(reconstructPanelIssues({ workers: [null, { issues: [null, 'junk'] }] }), []);
+});
+
 // ======================================================================
 // 3. db.applyGrade stores diff_hash (SQL-aware fake pool, NODE_ENV=test)
 // ======================================================================

package/tests/grader.mjs

@@ -840,6 +840,128 @@ test('selectGraderModel: builder Haiku → grader Opus', () => {
   assert.equal(grader.selectGraderModel({ builderModel: 'haiku' }), 'claude-opus-5');
 });
 
+// --- task 1002660: per-worker model tiering (cross-model-guarded) ---
+
+test('workerModelFor: Quality tiers down to haiku; other workers keep the panel model', () => {
+  assert.equal(
+    grader.workerModelFor('quality', 'claude-sonnet-5', 'claude-fable-5'),
+    'claude-haiku-4-5-20251001'
+  );
+  for (const kind of ['narc', 'hacker', 'efficiency']) {
+    assert.equal(grader.workerModelFor(kind, 'claude-sonnet-5', 'claude-fable-5'), 'claude-sonnet-5');
+  }
+});
+
+test('workerModelFor: a tier override landing on the BUILDER family is refused (cross-model guarantee)', () => {
+  // A haiku builder must not be quality-judged by haiku — fall back to the panel model.
+  assert.equal(
+    grader.workerModelFor('quality', 'claude-opus-5', 'claude-haiku-4-5-20251001'),
+    'claude-opus-5'
+  );
+});
+
+// --- task 1002660: shared context bundle ---
+
+const plainFileStat = { isFile: () => true, isSymbolicLink: () => false };
+function fakeFsFor(files, { symlinks = [] } = {}) {
+  const relOf = (p) => Object.keys(files).find((k) => String(p).replace(/\\/g, '/').endsWith(k));
+  return {
+    lstatSync: (p) => {
+      const rel = relOf(p);
+      if (!rel) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+      return symlinks.includes(rel)
+        ? { isFile: () => false, isSymbolicLink: () => true }
+        : plainFileStat;
+    },
+    readFileSync: (p) => {
+      const rel = relOf(p);
+      if (!rel) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+      return files[rel];
+    },
+  };
+}
+
+test('buildContextBundle reads changed files once, skips binaries/missing, respects caps', () => {
+  const files = {
+    'src/a.js': 'const a = 1;\n',
+    'docs/b.md': '# b\n',
+    'art/pic.png': 'binarybytes',
+  };
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['src/a.js', 'docs/b.md', 'art/pic.png', 'gone/deleted.js'],
+    cwd: '/repo',
+    fsImpl: fakeFsFor(files),
+  });
+  assert.deepEqual(bundle.files.map((f) => f.file), ['src/a.js', 'docs/b.md']);
+  assert.deepEqual(bundle.skipped, ['art/pic.png', 'gone/deleted.js'], 'binary + deleted → skipped, visibly');
+  assert.equal(bundle.files[0].content, 'const a = 1;\n');
+  assert.equal(bundle.total_chars, files['src/a.js'].length + files['docs/b.md'].length);
+});
+
+test('buildContextBundle truncates oversized files and marks them', () => {
+  const big = 'x'.repeat(20_000);
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['big.js'], cwd: '/r',
+    fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
+  });
+  assert.equal(bundle.files[0].truncated, true);
+  assert.ok(bundle.files[0].content.length <= 16_000);
+});
+
+test('buildContextBundle REFUSES symlinks — a committed link cannot pull out-of-repo content into prompts (hacker finding)', () => {
+  const files = { 'src/a.js': 'ok', 'evil-link.js': 'should never be read' };
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['src/a.js', 'evil-link.js'],
+    cwd: '/repo',
+    fsImpl: fakeFsFor(files, { symlinks: ['evil-link.js'] }),
+  });
+  assert.deepEqual(bundle.files.map((f) => f.file), ['src/a.js']);
+  assert.ok(bundle.skipped.includes('evil-link.js'), 'symlink refused, visibly');
+});
+
+test('buildContextBundle REFUSES path escapes — a ../ entry cannot leave cwd (containment)', () => {
+  let readAttempted = false;
+  const bundle = grader.buildContextBundle({
+    changedFiles: ['../outside/secrets.txt'],
+    cwd: '/repo/inner',
+    fsImpl: {
+      lstatSync: () => plainFileStat,
+      readFileSync: () => { readAttempted = true; return 'secret'; },
+    },
+  });
+  assert.deepEqual(bundle.files, []);
+  assert.deepEqual(bundle.skipped, ['../outside/secrets.txt']);
+  assert.equal(readAttempted, false, 'the escape is refused before any read');
+});
+
+test('worker prompts render the context bundle fenced, with the skipped list visible', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 'v',
+    diff: 'diff --git a/x b/x',
+    changedFiles: ['src/a.js', 'art/pic.png'],
+    contextBundle: {
+      files: [{ file: 'src/a.js', content: 'const a = 1;', truncated: false }],
+      skipped: ['art/pic.png'],
+      total_chars: 12,
+    },
+  });
+  assert.ok(prompt.includes('Post-change file contents'), 'bundle section renders');
+  assert.ok(prompt.includes('const a = 1;'), 'bundled content is present');
+  assert.ok(prompt.includes('FILE: src/a.js'), 'per-file fence label present');
+  assert.ok(/Not bundled .*art\/pic\.png/.test(prompt), 'skipped files are named, never silent');
+});
+
+test('worker prompts without a bundle are unchanged (no bundle section)', () => {
+  const prompt = grader.WORKERS.narc.buildPrompt({
+    task: { id: 1, title: 't', description: 'd' },
+    valueSummary: 'v',
+    diff: 'diff --git a/x b/x',
+    changedFiles: ['src/a.js'],
+  });
+  assert.ok(!prompt.includes('Post-change file contents'));
+});
+
 test('selectGraderModel: missing builder → default (assumed-Fable builder → Sonnet 5); unknown id FALLS BACK, never throws (task 1002659)', () => {
   // No builderModel is the legitimate default path (the caller assumes the
   // owner-top-model builder per CLAUDE.md §2), resolving to the default grader.