@bongos/core 1.19.690 → 1.19.691

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.690",
-  "core_contract": "1.19.690",
-  "source_commit": "60679343d4642880b9d09e266fdf8847948e63c4",
+  "core_version": "1.19.691",
+  "core_contract": "1.19.691",
+  "source_commit": "d6f9d26e0e431f817085c4f3e93cba48e534c2e7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T00:15:19.171Z",
+  "built_at": "2026-09-13T00:51:33.922Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2627,
-  "tree_sha256": "62df4f01b358cfb184df394a6f373977f6638d2b4ce8f58df8e78f66259bfb95",
+  "tree_sha256": "c8d122583fff727fc928395a6e21c2ec230528b5163e89020d1b5506c39376be",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a8b10d6556ee013925b76fab635bbf14e1299216be69b54959b07de8cf47b8da"
+      "sha256": "d15899aa7ccc7cf1c4746843d0bc37487fcfaf1dabcbb6c9cac6ea8ccac49865"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "260ff5666981dd27b2112c4e0ed8618761d10fe9c505630e3b75eaac3d588f73"
+      "sha256": "8ef95c8bad02f83fa9d831818ab483bc1fbf18fbaf3392f5d03ab82dea4a3a7b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6164b80832d080ed4ec27d8e4678ffbbab1344cf876af1b46702e5e4e2988924"
+      "sha256": "88f4f66604d980452d57d66d581170a45fd7e07464cf3699e390b34773105504"
     },
     {
       "path": "public-docs/index.html",
@@ -8922,7 +8922,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "8bf28a3d4d15e83a1e94416ec2519d39bc2a3faa71303a4f2d22d429b6afaa95"
+      "sha256": "7f6c46f56fcd54c01b5dd0bd6fecd712962c87ed693a44bea1746cf4c6aacebb"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-resume.js",
       "mode": "0000644",
-      "sha256": "4d56098b0b7df003e7efece23b8d1bca55dd272774117cd75074a1c7609939ec"
+      "sha256": "20b91c52c75fae6355165941d1467081424614d46063f87137870ef291d442b9"
     },
     {
       "path": "scripts/gds/ship-session-upload.js",
@@ -9002,7 +9002,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "6fd0329b8ad7d45fbb93deda02142c2b766c9e01b669d2d94eeafcb1caa225b0"
+      "sha256": "a64455fdf9771e4ccb04b49d42b9bb0cb0fe45bc6cb36d4e5f3abe0c31fe99ff"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9552,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3db8b41741ace6b9070683824e39c1fa8e7c2724bef4585e91734ffd43afa382"
+      "sha256": "97d34718e5b331dc33b78b070ed6760c8113f383faf0a90cd8076f1ac5047fbb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12677,7 +12677,7 @@
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
-      "sha256": "2b2ef91bda46ab9a764709ab30b97de6e184a3ab2b86c4b7cb8f1c168fc0a5b7"
+      "sha256": "e5305fa140de31d7e646e328b4a3956f845f62b335bf14285a91cc38a20f8e0f"
     },
     {
       "path": "tests/ship_smoke_gate.mjs",

package/docs/module-api-changelog.md

@@ -1839,5 +1839,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.688 with no explicit bump. run 34726470555. (task 1002620)
   1.19.690 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.689 with no explicit bump. run 34727464797. (task 1002620)
+  1.19.691 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.690 with no explicit bump. run 34729018766. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.690",
+  "version": "1.19.691",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.690",
+      "version": "1.19.691",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.690",
+  "version": "1.19.691",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-flow.js

@@ -27,7 +27,7 @@ const { apiErrorLine, normalizeApiError, isUnknownFieldRejection } = require('./
 const { pushVia } = require('./ship-deploy-target.js');
 
 const { diffstatFor, finishShip } = require('./ship-finish.js');
-const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { noteServerReward } = require('./ship-state.js');
 
 // ---------- Main flow ----------
@@ -850,8 +850,66 @@ async function regradeMain() {
   const graderBaseline = computeGraderBaseline(claimLike);
   const committedFiles = computeChangedFiles(graderBaseline);
   if (committedFiles.length === 0) {
+    // task 1003147: a DELIBERATELY artifact-free task used to dead-end here.
+    // shipMain routes every 'completed' task to this re-grade BEFORE reading any
+    // flag (evaluateResumeAction takes none), so --allow-empty / --skip-grade never
+    // reached the manual-confirm path that a no-artifact task actually needs — and
+    // that path is unreachable from 'completed' any other way. Hit for real on task
+    // 1003146: a kind=verify task landed at 'completed' with no grade row, and
+    // --allow-empty, --skip-grade and --verified all bailed on this same line.
+    //
+    // BOTH conditions are required, and the diff emptiness is MEASURED, not taken
+    // on the builder's word. A flag alone must not reach confirm: a task with a
+    // real diff whose grade failed would then bypass the grader by passing
+    // --allow-empty, which is a quality hole, not a fix. Here the grader has
+    // nothing to read, so there is no verdict to dodge. Confirming is additionally
+    // permission-gated server-side on task.confirm.grade_bypass, so this widens
+    // no authority — it only stops the ONE shape that had no exit at all.
+    if (shouldConfirmWithoutGrade({ committedFileCount: committedFiles.length, args })) {
+      console.log('');
+      console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
+      console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
+      // A kind='verify' task cannot reach here without --verified: the gate above
+      // exits first, so the server's verify_attestation_required can't fire below.
+      const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
+      if (!confirm.ok) {
+        const errObj = confirm.data && confirm.data.error;
+        const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+        if (confirm.status === 403 && errCode === 'permission_forbidden') {
+          const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+          const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+          console.error('');
+          console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floor ? ` (floor: ${floor})` : ''}.`);
+          console.error('  This is an authorization wall, not a verdict on your work.');
+          console.error(`  Ask a builder whose role holds it to POST /api/gds/tasks/${taskId}/confirm.`);
+          process.exit(1);
+        }
+        console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);
+        process.exit(1);
+      }
+      const confirmedStatus = confirm.data.taskStatus;
+      printCreditsAndAchievements({
+        postGradeStatus: confirmedStatus,
+        credits: confirm.data.creditsAwarded ?? 0,
+        creditsRaw: null,
+        creditsMultiplier: null,
+        ideaBonusInfo: confirm.data.ideaBonus ?? null,
+        justUnlocked: confirm.data.just_unlocked || [],
+      });
+      // The same confirmed→shipped tail a normal ship runs, so a no-artifact resume
+      // lands identically instead of stopping one step short.
+      await finishShip({
+        taskId, summary, advanceToMerge: confirmedStatus === 'confirmed', skipMerge, dbOnly: true,
+        postGradeStatus: confirmedStatus,
+        doneLine: 'Done — confirmed with no artifact (grader had nothing to read).',
+        card: { title: task.title, valueSummary: summary, notes: '' },
+      });
+      return;
+    }
     console.error(`Nothing to grade: the committed diff vs ${graderBaseline || 'baseline'} is empty.`);
     console.error('The grader reads committed history, not the working tree — commit your fixes on this branch, then re-run --regrade.');
+    console.error('If this task is DELIBERATELY artifact-free (a DB-only close, an ops verification), say so:');
+    console.error(`  node scripts/gds/ship.js ${taskId} --allow-empty`);
     process.exit(1);
   }
 

package/scripts/gds/ship-resume.js

@@ -106,6 +106,27 @@ function evaluateResumeAction({ task, lastClaim, builder }) {
   return { action: 'error', reason: `Task #${task.id} is '${status}'. Nothing to resume.` };
 }
 
+// task 1003147: may a re-grade that has NOTHING to grade manual-confirm instead of
+// dead-ending? Pure + exported so the truth table is unit-tested with no git or
+// network, the same contract evaluateResumeAction above carries.
+//
+// Both halves are required, and they are different KINDS of evidence. The empty
+// diff is MEASURED (the caller passes what `git diff --name-only` actually
+// returned); the flag is the builder's DECLARATION that artifact-free is intended.
+// A declaration alone must never be enough — a task with a real diff whose grade
+// failed would otherwise bypass the grader by passing --allow-empty, turning a
+// deadlock fix into a quality hole. When the diff is genuinely empty the grader has
+// nothing to read, so there is no verdict being dodged.
+//
+// A bare re-run (neither flag) keeps dead-ending, deliberately: the overwhelmingly
+// common cause of an empty diff is uncommitted work, and silently confirming that
+// would ship nothing while reporting success.
+function shouldConfirmWithoutGrade({ committedFileCount, args = [] }) {
+  const emptyDiff = Number(committedFileCount) === 0;
+  const declaredNoArtifact = args.includes('--allow-empty') || args.includes('--skip-grade');
+  return emptyDiff && declaredNoArtifact;
+}
+
 // task 941: resume a `confirmed`-but-unshipped task — the merge/deploy leg only
 // (it already passed the grade + earned credits; this is the leg that stalls when
 // a box can't reach the server publish, a poll window expires, etc.). Mirrors the
@@ -148,4 +169,5 @@ module.exports = {
   evaluateRegradeEligibility,
   evaluateResumeAction,
   resumeMerge,
+  shouldConfirmWithoutGrade,
 };

package/scripts/gds/ship.js

@@ -152,7 +152,7 @@ const {
   formatGradeOutcome,
   gradeAndRecord,
 } = require('./ship-grade-steps.js');
-const { evaluateRegradeEligibility, evaluateResumeAction } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { regradeMain, shipMain } = require('./ship-flow.js');
 const { fatalRecoveryLines, smokeGateMessages } = require('./ship-honesty.js');
 const { chooseBroadcastTargets } = require('../../modules/discord/ship-broadcast');
@@ -213,6 +213,10 @@ module.exports = {
   // re-run — exported so the truth table (completed→grade, confirmed→merge,
   // ownership, terminal states) is unit-tested with no git/network.
   evaluateResumeAction,
+  // task 1003147: whether a re-grade with NOTHING to grade may manual-confirm
+  // instead of dead-ending — exported so the truth table (empty diff + declared
+  // no-artifact → confirm; a real diff, or no declaration → never) is unit-tested.
+  shouldConfirmWithoutGrade,
   // #747: pre-ship auto-linkify of the ship's own changed docs. The path
   // predicate is pure + exported so the regression test can assert which
   // changed files fall in the linkifier's domain without git/fs/API.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.690'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.691'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_resume.mjs

@@ -17,9 +17,11 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
+import { shipCliSource } from './helpers.mjs';
+
 const require = createRequire(import.meta.url);
 const ship = require('../scripts/gds/ship.js');
-const { evaluateResumeAction } = ship;
+const { evaluateResumeAction, shouldConfirmWithoutGrade } = ship;
 
 let passed = 0;
 let failed = 0;
@@ -124,6 +126,57 @@ test('completed + owner with low rank still resumes (ownership, not rank)', () =
   assert.equal(a.via, 'owner');
 });
 
+// ---- task 1003147: the artifact-free resume that used to deadlock ----------
+// HIT FOR REAL on task 1003146. A kind=verify task landed at 'completed' with no
+// grade row; every documented escape (--allow-empty, --skip-grade, --verified) was
+// swallowed by the same "Nothing to grade" bail, because shipMain routes ANY
+// 'completed' task into the re-grade before reading a flag. The manual-confirm
+// path a no-artifact task needs is unreachable from 'completed' any other way.
+
+test('empty diff + --allow-empty → confirm instead of bailing (the 1003146 shape)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--allow-empty'] }), true);
+});
+
+test('empty diff + --skip-grade → confirm (the other documented no-artifact flag)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--skip-grade'] }), true);
+});
+
+test('a REAL diff + --allow-empty still grades — the flag is not a grader bypass', () => {
+  // The hole this guard exists to avoid: if a declaration alone were enough, a task
+  // whose grade FAILED could dodge the verdict by re-running with --allow-empty.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, args: ['1003146', '--allow-empty'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, args: ['1003146', '--skip-grade'] }), false);
+});
+
+test('empty diff with NO flag keeps dead-ending — uncommitted work must not "ship"', () => {
+  // The overwhelmingly common cause of an empty diff is forgetting to commit.
+  // Confirming that silently would report success having shipped nothing.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146'] }), false);
+});
+
+test('the empty-diff guard is actually WIRED to the decision, not just exporting it', () => {
+  // A pure truth table proves the decision, not that anything calls it. Without
+  // this, the guard could revert to its unconditional `process.exit(1)` and every
+  // case above would still pass — the deadlock back, the tests still green.
+  const src = shipCliSource();
+  // Match the CALL, not the declaration. shipCliSource() spans the whole ship
+  // family including ship-resume.js, where the function is DEFINED as
+  // `shouldConfirmWithoutGrade({ committedFileCount, args })` — a looser pattern
+  // matches that signature and passes even with the call site deleted. Verified:
+  // with the guard stubbed to `if (false)`, the loose form stayed green.
+  // `committedFiles.length` exists only at the call site.
+  assert.match(src, /shouldConfirmWithoutGrade\(\{\s*committedFileCount:\s*committedFiles\.length/,
+    'the re-grade empty-diff guard must CALL shouldConfirmWithoutGrade, not merely export it');
+  assert.match(src, /postTasksIdConfirm\(\{ id: taskId, body: \{ verified \} \}\)/,
+    'and reaching it must land on the manual-confirm route a no-artifact task needs');
+});
+
+test('shouldConfirmWithoutGrade: defaults and odd inputs never throw', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }), false, 'no args → no declaration');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }), true, 'a numeric string still counts as empty');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }), false, 'an unknown count is not an empty one');
+});
+
 console.log('');
 console.log(`ship_resume: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);