@bongos/core 1.19.527 → 1.19.528

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.527",
-  "core_contract": "1.19.527",
-  "source_commit": "2ba9b8a5084d24406c9f56813939dd3abd17aac3",
+  "core_version": "1.19.528",
+  "core_contract": "1.19.528",
+  "source_commit": "f6d2603506a4eaa27fbddbddc75a6119738b71a6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T01:56:03.997Z",
+  "built_at": "2026-09-04T02:27:38.586Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 434,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1975,
+    "functional_verbatim": 1976,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2433,
-  "tree_sha256": "8864a6693cfc3aef15a04ae8938af1ff50dca2d6714eedc418c494739f486b57",
+  "file_count": 2434,
+  "tree_sha256": "965d514d2cf50b0b282abb1e8171fb9a9d78b10f11f043086fa2f2af7083ef76",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2612,7 +2612,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3fc93c649eb03183fdb896888121536f092f896aa26d203371968340ea2d8149"
+      "sha256": "4f91a1b18b26d90010d2f78214ed38f9c2f469e53a04e08e8b398bbd753998a9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4417,7 +4417,7 @@
     {
       "path": "modules/grading/grader-subagent.js",
       "mode": "0000644",
-      "sha256": "2f8d48c2eace701ef6e4c256be74a0893e45476eb46b20763a442e9dc6c21214"
+      "sha256": "8a100cca2391e018cf257e178c253cb21f514a07abda1a8f07da754b76aa83ad"
     },
     {
       "path": "modules/grading/grader-workers/efficiency.js",
@@ -4472,7 +4472,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "53001adcb058742f39bdb475fca023809c239f50bf9dddc61ccef966d5d01d6a"
+      "sha256": "4c664f5080513169c35369e5406f32efa64ce24259fefc47f527a94ff8001b1f"
     },
     {
       "path": "modules/grading/module.json",
@@ -5257,7 +5257,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "dcfbe3bf4cb7fc2731991d94cfac509ccd25f56f3c14c81aada1680c907bb0fb"
+      "sha256": "2192c61c606a37b4782db0646242ac969bcd318d4305b1247adf028b14f2e484"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "modules/lifecycle/tests/cascade.mjs",
       "mode": "0000644",
-      "sha256": "e932d203a4306a7d8dfe16301a6481a31f34b431a6eaa44c055c3d1a2a67c4b0"
+      "sha256": "af00ee4629002c8df2448e2146a24108407a36b062859ee1afee293aa60cb209"
     },
     {
       "path": "modules/lifecycle/version-close.js",
@@ -7322,12 +7322,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "dc5f5840b004b4b41aad0c07fdc120a887bad3dce2824cea30e5e54da61400d6"
+      "sha256": "dceea98bb14779f8b25de5d336677be85b46644d37eab685a2846de68f3bbc99"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4b3a6ce000af625608a1cd4362413e7a57f409ab5cac66b05e7fafa98759e09c"
+      "sha256": "a551e83f0029826d20ab7a280ca4cda7da3aeb98f06d064b1592e84b278c7882"
     },
     {
       "path": "public-docs/index.html",
@@ -9007,7 +9007,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b1507f297c0f31d4df05c3826028c841d188eb75a824db8ed7ef1d53a4472b58"
+      "sha256": "a530f0345672c3ba330cec9e0056eccf02041ef54f932d6f9959bd24d5fc6178"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10389,6 +10389,11 @@
       "mode": "0000644",
       "sha256": "50a785eb6e2c71d5a043c2ec2c37a835777da6397dac3ffc2542acdde14b57a8"
     },
+    {
+      "path": "tests/grader_root_outage.mjs",
+      "mode": "0000644",
+      "sha256": "409b21de4ac729cf90c792be28fcc358349e80dca67e47255a0105377d2cfcf8"
+    },
     {
       "path": "tests/grader_severity_gate.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1491,5 +1491,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.525 with no explicit bump. run 33824700579. (task 1002620)
   1.19.527 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.526 with no explicit bump. run 33827382028. (task 1002620)
+  1.19.528 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.527 with no explicit bump. run 33829339717. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/grading/grader-subagent.js

@@ -23,6 +23,25 @@ function runSubagent({ prompt, opts = {} }) {
     // isn't named `claude` on PATH — covers any OS, not just Windows.
     const bin = opts.claudeBin ?? process.env.OTB_CLAUDE_BIN ?? process.env.CLAUDE_BIN ?? 'claude';
 
+    // THE PERMISSION MODE IS ROOT-DEPENDENT (task 1003574). `bypassPermissions` maps
+    // to --dangerously-skip-permissions, and the CLI REFUSES that when euid is 0:
+    //   "--dangerously-skip-permissions cannot be used with root/sudo privileges"
+    // It exits non-zero before doing any work, so under root EVERY worker returns
+    // SUBAGENT_NONZERO_EXIT and the whole panel dies. A root container is an ordinary
+    // CI/sandbox shape, not an exotic one — this was hit on a real ship (task 1003280).
+    //
+    // `acceptEdits` is the fallback because it is the closest mode the CLI accepts as
+    // root, and it grants this worker NOTHING extra: the tool list is `Read` alone, so
+    // there are no edits to accept. Verified as root that a worker under acceptEdits
+    // still reads files inside its cwd (which is all a grader worker ever does) while
+    // a path outside the project is refused without hanging — in -p there is no prompt
+    // to answer, so a denial returns rather than blocking.
+    //
+    // Non-root keeps bypassPermissions exactly as before: this narrows the mode only
+    // where the wider one cannot run at all.
+    const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
+    const permissionMode = isRoot ? 'acceptEdits' : 'bypassPermissions';
+
     const args = [
       '-p',
       '--print',
@@ -30,7 +49,7 @@ function runSubagent({ prompt, opts = {} }) {
       '--output-format', 'json',
       '--tools', 'Read',
       '--disable-slash-commands',
-      '--permission-mode', 'bypassPermissions',
+      '--permission-mode', permissionMode,
     ];
 
     const startedAt = Date.now();

package/modules/grading/grader.js

@@ -183,6 +183,11 @@ function aggregatePanel(workerResults, meta = {}) {
   // If the panel were somehow advisory-only, fall back to gating on everyone so
   // a lone Narc still counts (defensive — the default panel always has 3+
   // gating workers).
+  // A pseudo-worker produced by a deterministic check rather than an LLM subagent
+  // (route-rank, permission-path — both stamp model:'deterministic'). It cannot be
+  // taken out by a grader outage, so it is not evidence either way about whether the
+  // panel ran. Task 1003574.
+  const isDeterministic = (w) => w && w.model === 'deterministic';
   const nonAdvisory = workerResults.filter((w) => !isAdvisory(w));
   const gating = nonAdvisory.length ? nonAdvisory : workerResults;
   const gatingFail = gating.filter((w) => w.verdict === 'fail' && !isMissingSignal(w)).length;
@@ -202,7 +207,25 @@ function aggregatePanel(workerResults, meta = {}) {
   // is an infra/outage condition, NOT a 0/10 quality rejection. Distinguished
   // from the partial-error case (some gating workers errored, others reported)
   // so callers (ship.js) can present "grader unavailable" instead of a FAIL.
-  const gatingErrorAll = gating.length > 0 && gating.every((w) => isMissingSignal(w));
+  //
+  // TASK 1003574 — WHY THIS COUNTS ONLY THE SUBAGENT WORKERS. When #943 was written
+  // every gating worker was an LLM subagent, so "all of them are missing signal" and
+  // "the grader could not run" were the same sentence. They stopped being the same
+  // the moment the DETERMINISTIC pseudo-workers (route-rank, permission-path) were
+  // appended to workerResults: those never spawn a subprocess, so an outage cannot
+  // touch them, and a passing route-rank made `gating.every(isMissingSignal)`
+  // permanently false. The effect was that a TOTAL subagent outage could no longer
+  // reach this branch at all — it fell through to securityLensErrored and was
+  // reported as `FAIL · 0/10` with zero issues and every rubric axis null, which is
+  // indistinguishable from a real rejection and routes the builder to a re-grade
+  // that cannot clear it. Observed end-to-end on task 1003280.
+  //
+  // Excluding the deterministic checks here does NOT weaken the gate: a
+  // deterministic worker that FAILS is a real finding and is caught by `gatingFail`,
+  // which is the first branch and takes precedence over this one. All this says is
+  // that a deterministic check PASSING is not evidence the grader ran.
+  const subagentGating = gating.filter((w) => !isDeterministic(w));
+  const gatingErrorAll = subagentGating.length > 0 && subagentGating.every((w) => isMissingSignal(w));
   // Advisory-worker outcomes — never a hard block. Uses isAdvisory so a Narc
   // that DID raise a blocker is treated as gating (in `nonAdvisory`), not here.
   const advisoryFail = workerResults.some((w) => isAdvisory(w) && w.verdict === 'fail' && !isMissingSignal(w));

package/modules/lifecycle/cascade.js

@@ -77,10 +77,85 @@
 //               a throw is caught and treated as "no match", because a broken
 //               predicate must not stop the other rules.
 //   title(task) / body(task)  the generated task's title and description.
-//   kind        optional task kind; defaults to 'chore'.
+//   kind        optional task kind; must be one the classifier knows
+//               (task-classifier.VALID_KINDS). Defaults to 'unclassified' —
+//               which is right for generated work anyway, because a request the
+//               board has not triaged has, precisely, no classification yet.
 //
-// Production rules live here. It is empty by design — see the header.
-const CASCADES = Object.freeze([]);
+// ---------------------------------------------------------------------------
+// The first production rule (R04 of goal 1000074, task 1003115).
+// ---------------------------------------------------------------------------
+//
+// THE ARTIST REVIEW. "Every shipped work with copy or visuals becomes a Review
+// task for an artist, in two steps" (the criterion artist-review-task-on-ship).
+// This is the rule that makes that true, and it is the whole of R04's build: the
+// mechanism (ADR 0242) and its four safety properties already exist and are
+// tested; R04 writes the one declaration.
+//
+// TWO GUARDS THAT KEEP IT FROM MISFIRING, both pinned in the tests:
+//   • It excludes `source === CASCADE_SOURCE`. Without that, the artist review
+//     task it generates — discipline 'artist', so it matches its own predicate —
+//     would on ship generate a review OF the review, and so on. The exclusion
+//     makes the generation a single hop, never a chain.
+//   • "Copy or visuals" is a NARROW, explicit predicate (hasCopyOrVisualWork),
+//     not "every ship". A cascade that fired on everything would bury the artist,
+//     and the criterion's "dismissable rather than nagging" would be a lie.
+//
+// It does NOT block anything (ADR 0241 draws the line: an artist may hold a
+// DEPLOY, decided per project, never a builder's ship; that gate is a separate
+// build). The generated task is a `backlog` request that triage may dismiss.
+
+// The modules whose shipped work puts user-facing copy or visuals in front of a
+// person. Kept as an explicit set rather than inferred, because "is this
+// copy/visual work" is a judgement the rule should state out loud and a test
+// should be able to pin — an inferred predicate is the kind that quietly widens.
+const COPY_VISUAL_MODULES = Object.freeze([
+  'copy-desk',    // the copy registry + proposals (goal 1000074's own spine)
+  'hall-ui',      // the builders' hall — the most-seen surface
+  'art-pipeline', // generated visual assets
+  'status-ui',    // the public status dashboard
+  'ui-design',    // the design-system surfaces (ADR 0081)
+]);
+
+// Does this shipped task's work put copy or visuals in front of a person? Pure
+// and total — the runner treats a throw as "no match", but this must not throw.
+function hasCopyOrVisualWork(task) {
+  if (!task) return false;
+  if (task.source === 'copy-proposal') return true;        // a copy change that landed via the copy desk (ADR 0233)
+  if (task.discipline === 'artist') return true;           // work an artist did is, by definition, on their surface
+  if (task.module_key && COPY_VISUAL_MODULES.includes(task.module_key)) return true;
+  return false;
+}
+
+// The two-step artist review body. STEP 1 coaches the grader (the artist trains
+// the grading system, not only the artefact); STEP 2 remakes the copy/visuals
+// with both routes explicitly offered — R04's brief, verbatim in intent.
+function artistReviewBody(task) {
+  return [
+    `This is an ARTIST REVIEW, generated automatically because task ${task.id} put copy or visuals in front of a person. It is a REQUEST, not a gate — it blocks nothing that shipped, and triage may dismiss it.`,
+    '',
+    `STEP 1 — REVIEW THE GRADER, not only the work. Read how the grader judged task ${task.id}'s copy and visuals, and coach it: where was it right, and where did it miss what an artist would catch — slop, an off-voice line, a claim that does not land, a visual that reads as generated? The artist trains the grading system, not just the artefact, so this step is the one that compounds.`,
+    '',
+    'STEP 2 — REMAKE OR TWEAK the copy/visuals if they need it. Your choice of route, both offered on purpose: OUTSIDE the AI chat (edit the surface directly and land it through the copy desk or the normal pipeline), or WITH it (draft in chat, then land). Either way it lands as a claimed, graded, shipped task like everything else — there is no live CMS (goal 1000074\'s hard rule).',
+    '',
+    'If the copy and visuals are fine and the grader judged them well, DISMISS this in triage. That is a real, expected outcome — not a failure.',
+  ].join('\n');
+}
+
+// Production rules. The artist review is the first (R04); add another by
+// appending an entry, never by touching the runner (ADR 0242).
+const CASCADES = Object.freeze([
+  Object.freeze({
+    key: 'artist-review-on-ship',
+    discipline: 'artist',
+    kind: 'unclassified',
+    // The anti-recursion guard (source !== CASCADE_SOURCE) is FIRST so a
+    // cascade-generated task is rejected before any other test runs.
+    when: (t) => t.source !== CASCADE_SOURCE && hasCopyOrVisualWork(t),
+    title: (t) => `Artist review: the copy and visuals that shipped in task ${t.id}`,
+    body: artistReviewBody,
+  }),
+]);
 
 // The (source, source_ref) pair the generated task is keyed on. `source` is a
 // constant so every cascade-generated row is findable as a class; the ref pins
@@ -171,7 +246,11 @@ function cascadeTaskSpec(rule, task) {
     title: String(rule.title(task) || '').trim(),
     description: `${preamble}\n\n${body}`,
     discipline: rule.discipline,
-    kind: rule.kind || 'chore',
+    // 'unclassified', not 'chore' (task 1003115): the cascade calls db.createTask
+    // directly, bypassing the route's kind validation, and 'chore' is not in
+    // task-classifier.VALID_KINDS — it would have written an invalid kind. A
+    // generated request the board has not triaged is genuinely unclassified.
+    kind: rule.kind || 'unclassified',
     status: 'backlog',
     source: CASCADE_SOURCE,
     sourceRef: cascadeSourceRef(rule.key, task.id),
@@ -229,6 +308,9 @@ async function runCascadesForShip(shipped, deps = {}) {
 module.exports = {
   CASCADES,
   CASCADE_SOURCE,
+  COPY_VISUAL_MODULES,
+  hasCopyOrVisualWork,
+  artistReviewBody,
   cascadeSourceRef,
   assertRuleShape,
   validateCascades,

package/modules/lifecycle/tests/cascade.mjs

@@ -185,12 +185,69 @@ await test('the production table is valid, and a duplicate key is refused', () =
   assert.ok(shape.some((p) => /body/.test(p)));
 });
 
-await test('the production table ships EMPTY, deliberately — R04 writes the first rule', () => {
-  // If this fails because a rule was added, that is fine: replace the assertion
-  // with one that pins the new rule's key and discipline. It exists so the
-  // emptiness is a DECISION on the record (see cascade.js's header) rather than
-  // something nobody noticed.
-  assert.equal(cascade.CASCADES.length, 0);
+// --- the first production rule: the artist review (R04, task 1003115) --------
+
+const shippedCopy = (over = {}) => ({
+  id: '7001', version_id: 'BONGOS-V1', goal_id: '1000074',
+  title: 'Reword the hall empty states', discipline: 'engineer',
+  kind: 'feature', status: 'shipped', module_key: 'hall-ui', source: 'manual',
+  ...over,
+});
+
+await test('the artist review is the one production rule, keyed and disciplined', () => {
+  assert.equal(cascade.CASCADES.length, 1);
+  const r = cascade.CASCADES[0];
+  assert.equal(r.key, 'artist-review-on-ship');
+  assert.equal(r.discipline, 'artist', 'the review is FOR the artist, whatever role shipped the work');
+  assert.equal(r.kind, 'unclassified', 'a valid kind — not the invalid "chore" the spec used to default to');
+  assert.deepEqual(cascade.validateCascades(), [], 'and the shipped table is well-formed');
+});
+
+await test('a copy/visual ship generates the two-step artist review', () => {
+  const { matched } = cascade.cascadesFor(shippedCopy());
+  assert.equal(matched.length, 1);
+  const spec = matched[0].spec;
+  assert.equal(spec.discipline, 'artist');
+  assert.equal(spec.kind, 'unclassified');
+  assert.equal(spec.status, 'backlog', 'a request that triage may dismiss — not claimable, not nagging');
+  assert.match(spec.title, /7001/);
+  // Both steps, and both routes of step 2, are in the body.
+  assert.match(spec.description, /STEP 1 — REVIEW THE GRADER/);
+  assert.match(spec.description, /STEP 2 — REMAKE OR TWEAK/);
+  assert.match(spec.description, /OUTSIDE the AI chat/);
+  assert.match(spec.description, /WITH it/);
+  assert.match(spec.description, /DISMISS this in triage/);
+  assert.match(spec.description, /blocks nothing that shipped/, 'it says out loud that it is not a gate');
+});
+
+await test('"copy or visuals" is a NARROW predicate — three ways in, and a default of no', () => {
+  const H = cascade.hasCopyOrVisualWork;
+  assert.equal(H(shippedCopy({ module_key: 'copy-desk' })), true);
+  assert.equal(H(shippedCopy({ module_key: 'art-pipeline' })), true);
+  assert.equal(H(shippedCopy({ module_key: null, source: 'copy-proposal' })), true, 'a landed copy proposal');
+  assert.equal(H(shippedCopy({ module_key: null, source: 'manual', discipline: 'artist' })), true, 'work an artist did');
+  // The default is NO — a backend/infra ship is not an artist review.
+  assert.equal(H(shippedCopy({ module_key: 'lifecycle', discipline: 'engineer', source: 'manual' })), false);
+  assert.equal(H(shippedCopy({ module_key: null, discipline: 'engineer', source: 'manual' })), false);
+  assert.equal(H(null), false);
+});
+
+await test('THE ANTI-RECURSION GUARD: an artist review shipping does NOT generate a review of itself', () => {
+  // The generated review is discipline:'artist' + source:'cascade'. Its own
+  // predicate (discipline artist) would match — so without the source guard it
+  // would cascade forever. This is the test that proves it is a single hop.
+  const reviewTaskThatShipped = shippedCopy({
+    discipline: 'artist', source: cascade.CASCADE_SOURCE, module_key: null, id: '7100',
+  });
+  const { matched } = cascade.cascadesFor(reviewTaskThatShipped);
+  assert.equal(matched.length, 0, 'a cascade-generated task never triggers another cascade');
+});
+
+await test('the review inherits the shipped task goal and version, not goal 1000074 by fiat', () => {
+  // A copy ship in some other goal gets its review filed next to that work.
+  const { matched } = cascade.cascadesFor(shippedCopy({ goal_id: '1000046', version_id: 'BONGOS-V1' }));
+  assert.equal(matched[0].spec.goalId, 1000046);
+  assert.equal(matched[0].spec.versionId, 'BONGOS-V1');
 });
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.527",
+  "version": "1.19.528",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.527",
+      "version": "1.19.528",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.527",
+  "version": "1.19.528",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.527'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.528'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader_root_outage.mjs

@@ -0,0 +1,109 @@
+// tests/grader_root_outage.mjs — a grader that could not START must say so, and it
+// must be able to start as root (task 1003574, goal 1000024).
+//
+// THE BUG THIS PINS. #943 added a 'unavailable' panel outcome for a total grader
+// outage, so a builder sees "grader unavailable" instead of a FAIL nobody produced.
+// It worked when every gating worker was an LLM subagent. Then the DETERMINISTIC
+// pseudo-workers (route-rank, permission-path) were appended to the panel — they
+// never spawn a subprocess, so an outage cannot touch them, and one of them passing
+// made `gating.every(isMissingSignal)` permanently false. The outage branch became
+// unreachable: a total subagent outage fell through to the securityLensErrored branch
+// and was recorded as `FAIL · 0/10` with zero issues and every rubric axis null.
+//
+// That shape is indistinguishable from a real rejection in a terminal, and it routes
+// a builder to /grade-recover Branch A — whose prescribed re-grade cannot clear an
+// outage that is deterministic. Observed end-to-end on task 1003280, whose ship was
+// blocked twice by a panel that never ran.
+//
+// Run:  node --test tests/grader_root_outage.mjs
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const grader = require(path.join(ROOT, 'modules', 'grading', 'grader.js'));
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+// An LLM worker whose subprocess died — no signal at all.
+const errored = (kind) => ({
+  kind, name: kind, specialty: 'x', verdict: 'error', scores: {}, issues: [],
+  notes_md: '', confidence: 0, model: 'claude-sonnet-5', run_ms: 10,
+  error: 'SUBAGENT_NONZERO_EXIT',
+});
+// The deterministic pseudo-worker, exactly as route-rank-check.js stamps it.
+const deterministicPass = (kind = 'route-rank') => ({
+  kind, name: kind, specialty: 'x', verdict: 'pass', scores: {}, issues: [],
+  notes_md: `${kind} pass`, confidence: 1, model: 'deterministic', run_ms: 0, error: null,
+});
+const llmPass = (kind) => ({
+  kind, name: kind, specialty: 'x', verdict: 'pass', scores: { code_quality: 8 }, issues: [],
+  notes_md: '', confidence: 0.8, model: 'claude-sonnet-5', run_ms: 10, error: null,
+});
+
+test('the exact task-1003280 shape: every subagent dead, route-rank passing → unavailable, not fail', () => {
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'unavailable',
+    'a passing deterministic check is not evidence the panel ran');
+  assert.equal(r.passed, false, 'unavailable never auto-passes — it routes to manual-confirm');
+  assert.match(r.notes_md, /GRADER UNAVAILABLE/);
+  // The tell that made this so hard to read in a terminal: no findings at all.
+  assert.equal((r.issues || []).length, 0);
+});
+
+test('two deterministic pseudo-workers do not resurrect the fail either', () => {
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'),
+    deterministicPass('route-rank'), deterministicPass('permission-path'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'unavailable');
+});
+
+test('a DETERMINISTIC FAIL still hard-blocks — the fix does not soften the gate', () => {
+  const detFail = { ...deterministicPass('route-rank'), verdict: 'fail',
+    issues: [{ severity: 'blocker', file: 'r.js', summary: 'ungated write route' }] };
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'), detFail,
+  ]);
+  assert.equal(r.signals.panel_outcome, 'fail',
+    'gatingFail is the first branch and must still win over the outage branch');
+  assert.equal(r.passed, false);
+});
+
+test('a real security-lens outage with the rest of the panel alive still hard-blocks (#574 intact)', () => {
+  const r = grader.aggregatePanel([
+    llmPass('narc'), llmPass('quality'), errored('hacker'), llmPass('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'fail', 'a missing Hacker among live workers is still a block');
+  assert.match(r.notes_md, /SECURITY LENS MISSING/);
+});
+
+test('a healthy panel is unaffected', () => {
+  const r = grader.aggregatePanel([
+    llmPass('narc'), llmPass('quality'), llmPass('hacker'), llmPass('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.passed, true);
+});
+
+// ---- the spawn half -------------------------------------------------------
+
+test('the worker spawn picks a permission mode the CLI accepts as root', () => {
+  const src = read('modules', 'grading', 'grader-subagent.js');
+  // The refusal is euid-based, so the choice must be too.
+  assert.match(src, /process\.getuid\(\) === 0/);
+  assert.match(src, /isRoot \? 'acceptEdits' : 'bypassPermissions'/);
+  // The flag must be passed as the computed value, never the hardcoded wide one.
+  assert.match(src, /'--permission-mode', permissionMode/);
+  assert.doesNotMatch(src, /'--permission-mode', 'bypassPermissions'/);
+  // The tool list is what makes acceptEdits cost nothing: there are no edits.
+  assert.match(src, /'--tools', 'Read'/);
+});