@bongos/core 1.19.52 → 1.19.54

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.52",
-  "core_contract": "1.19.52",
-  "source_commit": "ce8e0d15694aed30b1640891c4256c96322a2a6f",
+  "core_version": "1.19.54",
+  "core_contract": "1.19.54",
+  "source_commit": "e2b4fc873e01aa41550165626426c3ef649b58a0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T19:06:37.776Z",
+  "built_at": "2026-08-11T20:06:11.854Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1218,
+    "functional_verbatim": 1219,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1530,
-  "tree_sha256": "72953759b072de03029b81979095699aeb2d45b2363ba7047d8503457761956f",
+  "file_count": 1531,
+  "tree_sha256": "38fdb87b02fa9c74f9de182cf78ba53c058873b93498cb731f5840c876d30fc2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a5b9642b383c8c415158e091785ff40f28490d8341b4010f4c051b1a68942daf"
+      "sha256": "5c89524ec76f5f5df365a188541d50aa31167ae7920124baf562fb32ad30632c"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1312,7 +1312,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "612c7a81756f61f2c18d4b35540379cf63f32a4caa9e8d84a64b247d497ad7a3"
+      "sha256": "0076d08133c342fa905fa90682e606eefa02747d5b11aea9f0bdb3563b293f76"
     },
     {
       "path": "docs/architecture.md",
@@ -2229,6 +2229,11 @@
       "mode": "0000644",
       "sha256": "5d970696a87e6f663f9fda83a268dbe99ced00ac02fb805d91114f54d4a8fece"
     },
+    {
+      "path": "migrations/core_219_grade_attempts_attempted_at_idx.sql",
+      "mode": "0000644",
+      "sha256": "80ff025953285762f9fdfc8de813db3471ade4d02cb6db5a65f72fa13797a0fc"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -3317,7 +3322,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "31dc79e6aaf72260cae3b46eb0fbb356e4e2bb01e3a2cbce3c420dad5221f25e"
+      "sha256": "e8821ce2c96b637e703879ea3e4840622f2f1846bf8d726d05c455f9bcfbf13e"
     },
     {
       "path": "modules/hall-ui/public/work.css",
@@ -3387,7 +3392,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "8e67cd1325da44cf95d5d8c34427222e555e0458bb17f23f33c1055b1ae7e211"
+      "sha256": "89febe6a0002d2277a61b14cc08c4076d1ab6c738fdea8f8a4a1348e330c0b9e"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3422,7 +3427,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "7d1be0defe08ca1905b04b646b988f9be3baae519ca2393166ce91f5a31e0c5d"
+      "sha256": "5c0d0da5d6a8bcfb920bc432558066840e649cbc624e064dc4e55a926a3d8bb4"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -4037,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "37bb9183f916ffafd19c5c88408f5f776bdb091afc46b1bfbad64669d642102f"
+      "sha256": "f8dd394f37580dfb0ced82e0d1d4a2b2bcc123af04ef1abb4f4d3de54e6a1d87"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "80465cb4506affe5fc47c835df7a0f4f1634a0743c2de6d14f843f342d487c45"
+      "sha256": "af388d2580a869d00473d4905e52b17f35954f6f9142a0faca178cee0033f205"
     },
     {
       "path": "public-docs/index.html",
@@ -5612,7 +5617,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "fd3dd30a194cd4638e7ef6fe34d17c1e94183926543f3c662b8cb9ec2b4a6e97"
+      "sha256": "fbfc3422f111e6d3f1429cefec78741d4a919c89985bc9d69f0a7a8e070c52b5"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -5662,7 +5667,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fc779475caf64dd09a7a3f952b4dadfcf2f123ca1a3d0ea9af20762b3de5e6c8"
+      "sha256": "db31f3722a0328065e9c7ded61857e1501cb356e148c17ade17d9987edde4674"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6627,7 +6632,7 @@
     {
       "path": "tests/grade_attempts.mjs",
       "mode": "0000644",
-      "sha256": "2fe60fa9d070ba6946509413561ae5a273d902ed3b24ff113bb089fd9d9097f1"
+      "sha256": "68792cfc57d211958190732e5c20051ff66c4b4d2ee3e39431db66e9dbfceae0"
     },
     {
       "path": "tests/grade_attribution.mjs",

package/clients/bongos-client/index.d.ts

@@ -77,7 +77,7 @@ export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
 export interface GetPublicBountyTableResponse { table: unknown; currency: unknown }
-export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; threshold: unknown; grader_version: unknown }
+export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; attempts: unknown; threshold: unknown; grader_version: unknown }
 export interface GetPublicIdeasIdResponse { idea: unknown }
 export interface GetPublicLeaderboardResponse { leaderboard: unknown; page: PageInfo }
 export interface GetPublicProgressResponse { progress: unknown }

package/docs/api/openapi.json

@@ -13070,6 +13070,7 @@
           "window_days": {},
           "rolling": {},
           "trend": {},
+          "attempts": {},
           "threshold": {},
           "grader_version": {}
         },
@@ -13077,6 +13078,7 @@
           "window_days",
           "rolling",
           "trend",
+          "attempts",
           "threshold",
           "grader_version"
         ]

package/migrations/core_219_grade_attempts_attempted_at_idx.sql

@@ -0,0 +1,7 @@
+-- lifecycle_003_grade_attempts_attempted_at_idx.sql — task 1002661 (panel finding).
+--
+-- gradeAttemptStats windows grade_attempts on attempted_at, but migration 064
+-- only indexed task_id — every /public/grades call would seq-scan an
+-- append-only table that grows on every grader run. Index the window column.
+CREATE INDEX IF NOT EXISTS idx_grade_attempts_attempted_at
+  ON grade_attempts (attempted_at DESC);

package/modules/hall-ui/public/watch.js

@@ -644,11 +644,21 @@
     const rolling = data.rolling || {};
     const n = num(rolling.n);
     const passRate = n > 0 ? num(rolling.n_passed) / n : null;
+    // task 1002661: grade_attempts remediation reader — attempts per graded
+    // task and, of tasks that failed a round, the share that ended passed.
+    const at = data.attempts || null;
+    const meanAttempts = at && at.graded_tasks > 0
+      ? Math.round((at.total_attempts / at.graded_tasks) * 10) / 10
+      : null;
     stats.innerHTML = statCards([
       { num: (rolling.avg_score ?? '—') === '—' ? '—' : escapeHtml(String(rolling.avg_score)), label: 'Avg score' },
       { num: fmtPct(passRate), label: 'Pass rate' },
       { num: fmtInt(n), label: 'Sample size' },
       { num: data.threshold !== undefined && data.threshold !== null ? escapeHtml(String(data.threshold)) : '—', label: 'Threshold' },
+      ...(at ? [
+        { num: meanAttempts === null ? '—' : escapeHtml(String(meanAttempts)), label: 'Attempts/task' },
+        { num: at.remediation_rate === null ? '—' : fmtPct(at.remediation_rate), label: 'Remediation' },
+      ] : []),
     ]);
 
     const trend = Array.isArray(data.trend) ? data.trend.slice(-14) : [];

package/modules/lifecycle/db.js

@@ -5309,6 +5309,56 @@ async function countGradeAttempts(taskId, queryFn) {
   return rows[0] ? rows[0].n : 0;
 }
 
+// gradeAttemptStats — the grade_attempts READER (task 1002661). The table has
+// been written on every grade since 6D.6 and read by nothing, leaving
+// remediation rate structurally unmeasurable. Windowed per-task rollup:
+// remediation_rate = of the tasks that FAILED at least one attempt, the share
+// whose latest attempt passed (null when no task failed — no denominator).
+// waived_zero_issue_passes counts the ADR 0164 implausible_pass_waived audit
+// markers in the same window, so the views can tell "waived on panel
+// evidence" from "never evaluated" at a glance.
+async function gradeAttemptStats(days = 7, queryFn) {
+  const q = queryFn || ((text, params) => pool.query(text, params));
+  const d = Number.isFinite(Number(days)) && Number(days) > 0 ? Math.min(Number(days), 90) : 7;
+  const [{ rows }, waived] = await Promise.all([q(
+    `SELECT
+        COALESCE(SUM(n), 0)::int                              AS total_attempts,
+        COUNT(*)::int                                         AS graded_tasks,
+        COUNT(*) FILTER (WHERE n > 1)::int                    AS retried_tasks,
+        COUNT(*) FILTER (WHERE had_fail)::int                 AS tasks_with_fail,
+        COUNT(*) FILTER (WHERE had_fail AND last_passed)::int AS remediated_tasks
+       FROM (
+         SELECT task_id,
+                COUNT(*) AS n,
+                BOOL_OR(NOT passed) AS had_fail,
+                (ARRAY_AGG(passed ORDER BY attempted_at DESC))[1] AS last_passed
+           FROM grade_attempts
+          WHERE attempted_at > now() - ($1 * interval '1 day')
+          GROUP BY task_id
+       ) t`,
+    [d]
+  ), q(
+    `SELECT COUNT(*)::int AS n
+       FROM task_grades
+      WHERE graded_at > now() - ($1 * interval '1 day')
+        AND signals->'server_guard'->>'implausible_pass_waived' IS NOT NULL`,
+    [d]
+  )]);
+  const s = rows[0] || {};
+  const tasksWithFail = Number(s.tasks_with_fail) || 0;
+  const remediated = Number(s.remediated_tasks) || 0;
+  return {
+    window_days: d,
+    total_attempts: Number(s.total_attempts) || 0,
+    graded_tasks: Number(s.graded_tasks) || 0,
+    retried_tasks: Number(s.retried_tasks) || 0,
+    tasks_with_fail: tasksWithFail,
+    remediated_tasks: remediated,
+    remediation_rate: tasksWithFail > 0 ? Math.round((remediated / tasksWithFail) * 100) / 100 : null,
+    waived_zero_issue_passes: (waived.rows[0] && Number(waived.rows[0].n)) || 0,
+  };
+}
+
 // ---- security_docs: Archon-only sensitive security documents (task 991) -----
 //
 // The DATED security engagement reports (exploit detail) live in the DB, NOT in
@@ -5561,6 +5611,7 @@ module.exports = {
   decideOverrideRequest,
   logGradeAttempt,
   countGradeAttempts,
+  gradeAttemptStats, // task 1002661: the grade_attempts remediation-rate reader
   acquireMergeLease,
   releaseMergeLease,
   mergeLeaseStatus,

package/modules/lifecycle/lifecycle.js

@@ -41,6 +41,7 @@ module.exports = {
   recentShippedTasks: (...a) => db.recentShippedTasks(...a),
   estimationDriftSummary: (...a) => db.estimationDriftSummary(...a),
   rollingAvgGrade: (...a) => db.rollingAvgGrade(...a),
+  gradeAttemptStats: (...a) => db.gradeAttemptStats(...a), // task 1002661: remediation-rate reader
   gradeTrendByDay: (...a) => db.gradeTrendByDay(...a),
   // me.js (the profile reader): per-builder claims + estimation + grade reads.
   getActiveClaimsForBuilder: (...a) => db.getActiveClaimsForBuilder(...a),

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.52",
+  "version": "1.19.54",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.52",
+      "version": "1.19.54",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.52",
+  "version": "1.19.54",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/public.js

@@ -293,9 +293,12 @@ module.exports = function buildPublicRouter() {
     const rawDays = parseInt(req.query.days, 10);
     const days = Number.isFinite(rawDays) && rawDays > 0 && rawDays <= 90 ? rawDays : 7;
     const trendDays = days >= 30 ? days : 30;
-    const [rolling, trend] = await Promise.all([
+    const [rolling, trend, attempts] = await Promise.all([
       lc().rollingAvgGrade(days),
       lc().gradeTrendByDay(trendDays),
+      // task 1002661: grade_attempts remediation reader. Best-effort — a
+      // mid-migration instance without the table must not break the tile.
+      lc().gradeAttemptStats(days).catch(() => null),
     ]);
     // Rubric meta via the `grade` kernel PORT (BV1.R73). resolveOptional → null
     // when grading is disabled, so the tile still renders (threshold/version null)
@@ -307,6 +310,7 @@ module.exports = function buildPublicRouter() {
       window_days: days,
       rolling,
       trend,
+      attempts, // task 1002661: attempt counts + remediation rate (null pre-migration)
       threshold: rubric ? rubric.threshold : null, // single source of truth — grader-rubric.json
       grader_version: rubric ? rubric.version : null,
     });

package/src/module-api.js

@@ -531,8 +531,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.50 with no explicit bump. run 31525032273. (task 1002620)
 //   1.19.52 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.51 with no explicit bump. run 31526131183. (task 1002620)
+//   1.19.53 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.52 with no explicit bump. run 31527057565. (task 1002620)
+//   1.19.54 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.53 with no explicit bump. run 31531157867. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.52'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.54'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_attempts.mjs

@@ -68,6 +68,51 @@ await test('countGradeAttempts returns the count (0 when none)', async () => {
   assert.equal(await db.countGradeAttempts(999, () => Promise.resolve({ rows: [] })), 0);
 });
 
+// ---- task 1002661: gradeAttemptStats — the remediation-rate reader ----
+
+function statsQueryFn({ agg, waived }) {
+  return (text, params) => {
+    if (/FROM grade_attempts/.test(text)) return Promise.resolve({ rows: [{ ...agg, _params: params }] });
+    if (/implausible_pass_waived/.test(text)) return Promise.resolve({ rows: [{ n: waived }] });
+    return Promise.reject(new Error(`unexpected SQL: ${text.slice(0, 60)}`));
+  };
+}
+
+await test('gradeAttemptStats maps the rollup + computes remediation rate', async () => {
+  const s = await db.gradeAttemptStats(7, statsQueryFn({
+    agg: { total_attempts: 14, graded_tasks: 10, retried_tasks: 3, tasks_with_fail: 4, remediated_tasks: 3 },
+    waived: 2,
+  }));
+  assert.equal(s.window_days, 7);
+  assert.equal(s.total_attempts, 14);
+  assert.equal(s.graded_tasks, 10);
+  assert.equal(s.retried_tasks, 3);
+  assert.equal(s.tasks_with_fail, 4);
+  assert.equal(s.remediated_tasks, 3);
+  assert.equal(s.remediation_rate, 0.75, '3 of 4 failed-at-least-once tasks ended passed');
+  assert.equal(s.waived_zero_issue_passes, 2, 'ADR 0164 waived markers counted in-window');
+});
+
+await test('gradeAttemptStats: no failed tasks → remediation_rate null (no denominator)', async () => {
+  const s = await db.gradeAttemptStats(7, statsQueryFn({
+    agg: { total_attempts: 5, graded_tasks: 5, retried_tasks: 0, tasks_with_fail: 0, remediated_tasks: 0 },
+    waived: 0,
+  }));
+  assert.equal(s.remediation_rate, null);
+});
+
+await test('gradeAttemptStats clamps the window (bad input → 7, oversize → 90)', async () => {
+  const seen = [];
+  const qf = (text, params) => {
+    seen.push(params[0]);
+    if (/FROM grade_attempts/.test(text)) return Promise.resolve({ rows: [{}] });
+    return Promise.resolve({ rows: [{ n: 0 }] });
+  };
+  await db.gradeAttemptStats('junk', qf);
+  await db.gradeAttemptStats(500, qf);
+  assert.deepEqual(seen, [7, 7, 90, 90], 'both queries share the clamped window');
+});
+
 console.log('');
 console.log(`Grade-attempts (6D.6) tests: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);