@bongos/core 1.19.690 → 1.19.692

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.690",
-  "core_contract": "1.19.690",
-  "source_commit": "60679343d4642880b9d09e266fdf8847948e63c4",
+  "core_version": "1.19.692",
+  "core_contract": "1.19.692",
+  "source_commit": "012d6894a38ec2863be3f253053d3e6bcb153e6e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T00:15:19.171Z",
+  "built_at": "2026-09-13T01:33:50.871Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2126,
+    "functional_verbatim": 2127,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2627,
-  "tree_sha256": "62df4f01b358cfb184df394a6f373977f6638d2b4ce8f58df8e78f66259bfb95",
+  "file_count": 2628,
+  "tree_sha256": "5094b3b7495543b7ffaed3e1fc5f1b10c24356b3e227ad469461127b5cbefec7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a8b10d6556ee013925b76fab635bbf14e1299216be69b54959b07de8cf47b8da"
+      "sha256": "ecd1242e375b1219b305ac16e2c3da7bfd8bdaa6812fd595b1ff9c68e84a8883"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5952,7 +5952,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "456b1d53d2349a499e1b07897dc6e16c72d26156a71347382c5a2508dc94d28d"
+      "sha256": "6d48a213e2ab334720833c174f4d5a1b9f8133404dbb21898305ae1c1a5db9d7"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "260ff5666981dd27b2112c4e0ed8618761d10fe9c505630e3b75eaac3d588f73"
+      "sha256": "5551c94d2db16d2ca8587eb4eeb10a6a92c03f303c578440ecda87bdbd8d96f8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6164b80832d080ed4ec27d8e4678ffbbab1344cf876af1b46702e5e4e2988924"
+      "sha256": "ee34bdc1c10e92539590e5df75dddd41aca8db38e79579ba97fb78511f096558"
     },
     {
       "path": "public-docs/index.html",
@@ -8922,7 +8922,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "8bf28a3d4d15e83a1e94416ec2519d39bc2a3faa71303a4f2d22d429b6afaa95"
+      "sha256": "7f6c46f56fcd54c01b5dd0bd6fecd712962c87ed693a44bea1746cf4c6aacebb"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8937,7 +8937,7 @@
     {
       "path": "scripts/gds/ship-grade.js",
       "mode": "0000644",
-      "sha256": "51b9132fc77f5f639a4597b26a6a5d083bf43c56944bf6710c939cafa074ba90"
+      "sha256": "79fcf45dd254681e7f91fe83fbb8a208b30c93eebe77df569aae505a025daa68"
     },
     {
       "path": "scripts/gds/ship-honesty.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-resume.js",
       "mode": "0000644",
-      "sha256": "4d56098b0b7df003e7efece23b8d1bca55dd272774117cd75074a1c7609939ec"
+      "sha256": "20b91c52c75fae6355165941d1467081424614d46063f87137870ef291d442b9"
     },
     {
       "path": "scripts/gds/ship-session-upload.js",
@@ -9002,7 +9002,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "6fd0329b8ad7d45fbb93deda02142c2b766c9e01b669d2d94eeafcb1caa225b0"
+      "sha256": "a64455fdf9771e4ccb04b49d42b9bb0cb0fe45bc6cb36d4e5f3abe0c31fe99ff"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9422,7 +9422,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "074cded727667d864b1849d8d5505736895a69a6bdf7132375fd358d66c2e6fd"
+      "sha256": "d02ccda5895a3662fe1ebb74785fd1b4745351f2a1532e2bd45aab7b18c297a1"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -9552,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3db8b41741ace6b9070683824e39c1fa8e7c2724bef4585e91734ffd43afa382"
+      "sha256": "2e95562bb87ada79174e5014569717a5583925c9d2de108e1fb2e74763cf531b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11034,6 +11034,11 @@
       "mode": "0000644",
       "sha256": "f32c3de05d534befef5f2b5e199b77e11fa7d7a20bdf65ff70cba0c32b8d2060"
     },
+    {
+      "path": "tests/grade_body_limit.mjs",
+      "mode": "0000644",
+      "sha256": "7bd3fecff64c1fb2b4abbbd3bd7e836a7317d1018845a69f2c4adde05ea15273"
+    },
     {
       "path": "tests/grade_diff_hash.mjs",
       "mode": "0000644",
@@ -12677,7 +12682,7 @@
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
-      "sha256": "2b2ef91bda46ab9a764709ab30b97de6e184a3ab2b86c4b7cb8f1c168fc0a5b7"
+      "sha256": "e5305fa140de31d7e646e328b4a3956f845f62b335bf14285a91cc38a20f8e0f"
     },
     {
       "path": "tests/ship_smoke_gate.mjs",

package/docs/module-api-changelog.md

@@ -1839,5 +1839,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.688 with no explicit bump. run 34726470555. (task 1002620)
   1.19.690 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.689 with no explicit bump. run 34727464797. (task 1002620)
+  1.19.691 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.690 with no explicit bump. run 34729018766. (task 1002620)
+  1.19.692 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.691 with no explicit bump. run 34730821372. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/tasks.js

@@ -56,6 +56,10 @@ const { branding } = api;
 // above the 20 MB decoded ceiling. The decoded bytes are re-checked in the
 // handler (the JSON `limit` only bounds the ENCODED payload — SR-17 posture).
 const PUBLISH_BODY_LIMIT = '32mb';
+// The grade body is committed_files (one entry per changed path) + the panel's findings.
+// 1 MB covers a repo-wide change with room to spare and still bounds the route; the global
+// 64 KB cap is skipped for this path in src/bongos/routes.js. See task 1003850.
+const GRADE_BODY_LIMIT = '1mb';
 const PUBLISH_BUNDLE_B64_MAX = 30 * 1024 * 1024;   // validator guard on the b64 string
 const PUBLISH_BUNDLE_MAX_BYTES = 20 * 1024 * 1024; // 20 MB decoded bundle
 
@@ -881,6 +885,11 @@ module.exports = function buildTasksRouter() {
     }
   });
 
+  // Declared ABOVE the doc-comment on purpose: gen-api-docs.js reads only the `//`
+  // lines immediately preceding `router.post(`, so a const wedged between them blanks
+  // this endpoint's whole description in docs/api-reference.md and openapi.json.
+  const gradeUpload = express.json({ limit: GRADE_BODY_LIMIT });
+
   // GDS-V3 task V3.R18 (#209). Subagent grader credits gate.
   //
   // ship.js (or any caller) spawns an Opus subagent against the diff + task
@@ -905,7 +914,7 @@ module.exports = function buildTasksRouter() {
   // rank: any-builder — grader writes a row + auto-promotes only if grade clears
   // threshold; the grader subagent is the objectivity guarantee. Supervisor hot
   // path (preserved per CRITICAL §4 — no requireRank).
-  router.post('/tasks/:id/grade', auth.requireBuilder, async (req, res) => {
+  router.post('/tasks/:id/grade', auth.requireBuilder, gradeUpload, async (req, res) => {
     // Permissive on subagent_output type — the grader handles both object AND
     // JSON-string forms (see tests/grader.mjs "accepts JSON-string input").
     // Only enforce presence + light shape on signals (extras pass through).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.690",
+  "version": "1.19.692",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.690",
+      "version": "1.19.692",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.690",
+  "version": "1.19.692",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-flow.js

@@ -27,7 +27,7 @@ const { apiErrorLine, normalizeApiError, isUnknownFieldRejection } = require('./
 const { pushVia } = require('./ship-deploy-target.js');
 
 const { diffstatFor, finishShip } = require('./ship-finish.js');
-const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { noteServerReward } = require('./ship-state.js');
 
 // ---------- Main flow ----------
@@ -850,8 +850,66 @@ async function regradeMain() {
   const graderBaseline = computeGraderBaseline(claimLike);
   const committedFiles = computeChangedFiles(graderBaseline);
   if (committedFiles.length === 0) {
+    // task 1003147: a DELIBERATELY artifact-free task used to dead-end here.
+    // shipMain routes every 'completed' task to this re-grade BEFORE reading any
+    // flag (evaluateResumeAction takes none), so --allow-empty / --skip-grade never
+    // reached the manual-confirm path that a no-artifact task actually needs — and
+    // that path is unreachable from 'completed' any other way. Hit for real on task
+    // 1003146: a kind=verify task landed at 'completed' with no grade row, and
+    // --allow-empty, --skip-grade and --verified all bailed on this same line.
+    //
+    // BOTH conditions are required, and the diff emptiness is MEASURED, not taken
+    // on the builder's word. A flag alone must not reach confirm: a task with a
+    // real diff whose grade failed would then bypass the grader by passing
+    // --allow-empty, which is a quality hole, not a fix. Here the grader has
+    // nothing to read, so there is no verdict to dodge. Confirming is additionally
+    // permission-gated server-side on task.confirm.grade_bypass, so this widens
+    // no authority — it only stops the ONE shape that had no exit at all.
+    if (shouldConfirmWithoutGrade({ committedFileCount: committedFiles.length, args })) {
+      console.log('');
+      console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
+      console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
+      // A kind='verify' task cannot reach here without --verified: the gate above
+      // exits first, so the server's verify_attestation_required can't fire below.
+      const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
+      if (!confirm.ok) {
+        const errObj = confirm.data && confirm.data.error;
+        const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+        if (confirm.status === 403 && errCode === 'permission_forbidden') {
+          const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+          const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+          console.error('');
+          console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floor ? ` (floor: ${floor})` : ''}.`);
+          console.error('  This is an authorization wall, not a verdict on your work.');
+          console.error(`  Ask a builder whose role holds it to POST /api/gds/tasks/${taskId}/confirm.`);
+          process.exit(1);
+        }
+        console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);
+        process.exit(1);
+      }
+      const confirmedStatus = confirm.data.taskStatus;
+      printCreditsAndAchievements({
+        postGradeStatus: confirmedStatus,
+        credits: confirm.data.creditsAwarded ?? 0,
+        creditsRaw: null,
+        creditsMultiplier: null,
+        ideaBonusInfo: confirm.data.ideaBonus ?? null,
+        justUnlocked: confirm.data.just_unlocked || [],
+      });
+      // The same confirmed→shipped tail a normal ship runs, so a no-artifact resume
+      // lands identically instead of stopping one step short.
+      await finishShip({
+        taskId, summary, advanceToMerge: confirmedStatus === 'confirmed', skipMerge, dbOnly: true,
+        postGradeStatus: confirmedStatus,
+        doneLine: 'Done — confirmed with no artifact (grader had nothing to read).',
+        card: { title: task.title, valueSummary: summary, notes: '' },
+      });
+      return;
+    }
     console.error(`Nothing to grade: the committed diff vs ${graderBaseline || 'baseline'} is empty.`);
     console.error('The grader reads committed history, not the working tree — commit your fixes on this branch, then re-run --regrade.');
+    console.error('If this task is DELIBERATELY artifact-free (a DB-only close, an ops verification), say so:');
+    console.error(`  node scripts/gds/ship.js ${taskId} --allow-empty`);
     process.exit(1);
   }
 

package/scripts/gds/ship-grade.js

@@ -111,10 +111,34 @@ function computeChangedFiles(baseline) {
   return out ? out.split('\n').map((s) => s.trim()).filter(Boolean) : [];
 }
 
+// How much diff we are willing to CAPTURE. Distinct from GRADER_DIFF_CHAR_CAP, which is
+// how much we are willing to SHOW the panel: the capture has to succeed first, and a
+// capture that FAILS is indistinguishable from "nothing changed" unless we look.
+const DIFF_CAPTURE_MAX_BYTES = 512 * 1024 * 1024;
+
 function computeDiffText(baseline) {
   if (!baseline) return '';
   // -M to track renames; --no-color so the subagent gets clean diff lines.
-  const diff = gitOk(`git diff --no-color -M ${baseline}...HEAD`);
+  //
+  // maxBuffer is set EXPLICITLY, and that is the whole point of this function. execSync
+  // defaults to 1 MB and gitOk swallows the resulting ENOBUFS as null, so a large change
+  // silently produced an EMPTY diff: the panel then graded a zero-character string and
+  // would have returned a verdict on nothing at all, reporting diff_chars=0 in a log line
+  // that reads like an ordinary stat rather than an error. A 1,141-file rename (task
+  // 1003705) measured 9,808,703 chars and is what surfaced it; every big change had the
+  // same hole. The GRADER_DIFF_CHAR_CAP truncation below still bounds what the subagent is
+  // asked to read — this only stops the capture itself from failing.
+  const diff = gitOk(`git diff --no-color -M ${baseline}...HEAD`, { maxBuffer: DIFF_CAPTURE_MAX_BYTES });
+  if (diff === null) {
+    // Capture failed even at that size. Fall back to the stat summary so the panel gets the
+    // SHAPE of the change and can Read any file in its post-resolve state — strictly better
+    // than an empty string, which reads as "no changes" and grades as a pass.
+    // gitOk returns null ONLY on failure; a genuinely empty diff comes back as ''.
+    const stat = gitOk(`git diff --no-color -M --stat ${baseline}...HEAD`, { maxBuffer: 64 * 1024 * 1024 });
+    return stat
+      ? `[diff too large to capture in full — stat summary only. Read any file for its post-resolve state.]\n\n${stat}`
+      : '';
+  }
   if (!diff) return '';
   if (diff.length > GRADER_DIFF_CHAR_CAP) {
     const head = diff.slice(0, GRADER_DIFF_CHAR_CAP);
@@ -147,11 +171,25 @@ function diffHash(rawDiff) {
 }
 
 // Compute the hash of the full (untruncated) diff against baseline. Returns
-// null when baseline is unavailable so callers can treat null as "unknown".
+// null when baseline is unavailable, OR when the diff cannot be captured, so
+// callers can treat null as "unknown".
+//
+// SAME BUFFER BUG AS computeDiffText, AND A WORSE CONSEQUENCE. This ran gitOk at
+// execSync's default 1 MB, so a large diff came back null and the old
+// `diffHash(raw || '')` hashed the EMPTY STRING — the same fixed SHA-256 for every
+// large diff. shouldReuseGrade compares that hash against the stored grade's
+// diff_hash, so two genuinely different large diffs on one task collided and a stale
+// PASS could be reused on changed code, skipping the panel outright. That is the
+// silent-pass failure this task exists to remove, reappearing in the reuse path.
+//
+// Returning null on a failed capture is the fail-safe answer, not a cosmetic one:
+// shouldReuseGrade already refuses a falsy currentDiffHash, so "unknown" now means
+// "run the panel", where "" meant "matches every other unknown".
 function computeRawDiffHash(baseline) {
   if (!baseline) return null;
-  const raw = gitOk(`git diff --no-color -M ${baseline}...HEAD`);
-  return diffHash(raw || '');
+  const raw = gitOk(`git diff --no-color -M ${baseline}...HEAD`, { maxBuffer: DIFF_CAPTURE_MAX_BYTES });
+  if (raw === null) return null; // capture failed — never collapse that to hash('')
+  return diffHash(raw);
 }
 
 // Pure predicate: should we reuse the stored grade instead of running the

package/scripts/gds/ship-resume.js

@@ -106,6 +106,27 @@ function evaluateResumeAction({ task, lastClaim, builder }) {
   return { action: 'error', reason: `Task #${task.id} is '${status}'. Nothing to resume.` };
 }
 
+// task 1003147: may a re-grade that has NOTHING to grade manual-confirm instead of
+// dead-ending? Pure + exported so the truth table is unit-tested with no git or
+// network, the same contract evaluateResumeAction above carries.
+//
+// Both halves are required, and they are different KINDS of evidence. The empty
+// diff is MEASURED (the caller passes what `git diff --name-only` actually
+// returned); the flag is the builder's DECLARATION that artifact-free is intended.
+// A declaration alone must never be enough — a task with a real diff whose grade
+// failed would otherwise bypass the grader by passing --allow-empty, turning a
+// deadlock fix into a quality hole. When the diff is genuinely empty the grader has
+// nothing to read, so there is no verdict being dodged.
+//
+// A bare re-run (neither flag) keeps dead-ending, deliberately: the overwhelmingly
+// common cause of an empty diff is uncommitted work, and silently confirming that
+// would ship nothing while reporting success.
+function shouldConfirmWithoutGrade({ committedFileCount, args = [] }) {
+  const emptyDiff = Number(committedFileCount) === 0;
+  const declaredNoArtifact = args.includes('--allow-empty') || args.includes('--skip-grade');
+  return emptyDiff && declaredNoArtifact;
+}
+
 // task 941: resume a `confirmed`-but-unshipped task — the merge/deploy leg only
 // (it already passed the grade + earned credits; this is the leg that stalls when
 // a box can't reach the server publish, a poll window expires, etc.). Mirrors the
@@ -148,4 +169,5 @@ module.exports = {
   evaluateRegradeEligibility,
   evaluateResumeAction,
   resumeMerge,
+  shouldConfirmWithoutGrade,
 };

package/scripts/gds/ship.js

@@ -152,7 +152,7 @@ const {
   formatGradeOutcome,
   gradeAndRecord,
 } = require('./ship-grade-steps.js');
-const { evaluateRegradeEligibility, evaluateResumeAction } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { regradeMain, shipMain } = require('./ship-flow.js');
 const { fatalRecoveryLines, smokeGateMessages } = require('./ship-honesty.js');
 const { chooseBroadcastTargets } = require('../../modules/discord/ship-broadcast');
@@ -213,6 +213,10 @@ module.exports = {
   // re-run — exported so the truth table (completed→grade, confirmed→merge,
   // ownership, terminal states) is unit-tested with no git/network.
   evaluateResumeAction,
+  // task 1003147: whether a re-grade with NOTHING to grade may manual-confirm
+  // instead of dead-ending — exported so the truth table (empty diff + declared
+  // no-artifact → confirm; a real diff, or no declaration → never) is unit-tested.
+  shouldConfirmWithoutGrade,
   // #747: pre-ship auto-linkify of the ship's own changed docs. The path
   // predicate is pure + exported so the regression test can assert which
   // changed files fall in the linkifier's domain without git/fs/API.

package/src/bongos/routes.js

@@ -94,7 +94,15 @@ function buildGdsRouter() {
       // task 1003109: the ship-time task visual — a base64 image up to ~5.3 MB
       // encoded (4 MB decoded). Same dynamic-:id pattern as publish-branch above;
       // modules/lifecycle/routes/task-visuals.js mounts its own 8 MB parser.
-      /^\/tasks\/\d+\/visual$/.test(req.path)
+      /^\/tasks\/\d+\/visual$/.test(req.path) ||
+      // task 1003850: the grade body carries committed_files — EVERY changed path, tens of
+      // KB on its own for a mass change — plus the panel's findings. A 1,141-file rename
+      // (task 1003705) produced a body over the 64 KB cap, so the grade could not be
+      // recorded at all (413 payload_too_large) and fully verified work stranded at
+      // 'completed'. The list is NOT trimmable to fit: modules/grading/grader-score.js runs
+      // the server-side permission-path pre-pass against it (SR-9 / SEC #863), so a short
+      // list would quietly weaken a security check rather than merely lose detail.
+      /^\/tasks\/\d+\/grade$/.test(req.path)
     ) return next();
     return globalJson(req, res, next);
   });

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.690'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.692'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_body_limit.mjs

@@ -0,0 +1,154 @@
+// tests/grade_body_limit.mjs — the grade body is not capped at 64 KB (task 1003850).
+//
+// WHAT BROKE. A 1,141-file rename produced a grade body over the global 64 KB JSON cap,
+// so POST /tasks/:id/grade came back 413 payload_too_large and fully verified work was
+// stranded at 'completed' with no way to record its grade. --regrade fails identically:
+// the size is deterministic, not transient.
+//
+// WHY THE BODY CANNOT SIMPLY BE TRIMMED. committed_files carries EVERY changed path, and
+// it is not decoration: modules/grading/grader-score.js runs the server-side
+// permission-path pre-pass against that exact list (SR-9 / SEC #863), so a shortened list
+// would quietly weaken a security check rather than just lose detail. The body gets its
+// own parser instead — the same shape memory/sync, sessions, publish-branch and the task
+// visual already use.
+//
+// Two halves, and BOTH are required: the global parser must SKIP this path (otherwise it
+// 413s before the route-scoped one ever runs — the comment in routes.js says exactly
+// this), and the route must mount a larger parser of its own.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const GRADE_PATH = '/tasks/1003850/grade';
+
+test('the global 64 KB parser SKIPS the grade path', () => {
+  const src = read('src/bongos/routes.js');
+
+  // The cap itself is still 64 KB for everything else — this test is about the exemption,
+  // not about loosening the default.
+  assert.match(src, /express\.json\(\{ limit: '64kb' \}\)/,
+    'the global cap should stay 64 KB; only named paths are exempt');
+
+  // Pull the skip predicate's path patterns straight out of the source and run them, so
+  // this asserts the REAL routing decision rather than the presence of a comment.
+  const block = src.slice(src.indexOf('const globalJson'), src.indexOf('// Audit middleware'));
+  // Regex LITERALS of the form /^...$/ — the body may contain escaped slashes, so the
+  // scan has to allow `\.` rather than stopping at the first `/`.
+  const patterns = [...block.matchAll(/\/\^(?:\\.|[^/\n])*\$\//g)].map((m) => m[0]);
+  assert.ok(patterns.length >= 3, `expected the skip list to carry several path regexes, saw ${patterns.length}`);
+
+  const matched = patterns.some((lit) => {
+    // eslint-disable-next-line no-new-func -- the literal comes from our own source
+    const re = new Function(`return ${lit}`)();
+    return re.test(GRADE_PATH);
+  });
+  assert.ok(matched, `no skip-list pattern matches ${GRADE_PATH} — the global parser would 413 the body before the route's own parser runs`);
+});
+
+test('the grade route mounts its own, larger parser', () => {
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  const m = /const GRADE_BODY_LIMIT = '(\d+)(kb|mb)';/.exec(src);
+  assert.ok(m, 'GRADE_BODY_LIMIT is gone — the route would fall back to whatever parser ran first');
+
+  const bytes = Number(m[1]) * (m[2] === 'mb' ? 1024 * 1024 : 1024);
+  assert.ok(bytes > 64 * 1024,
+    `GRADE_BODY_LIMIT (${m[1]}${m[2]}) must exceed the 64 KB global cap or the exemption buys nothing`);
+
+  // Mounted ON the route, ahead of the handler.
+  assert.match(src, /const gradeUpload = express\.json\(\{ limit: GRADE_BODY_LIMIT \}\);/,
+    'the route-scoped parser is not built from GRADE_BODY_LIMIT');
+  // Mounted ON the route. The ORDER (auth first) is asserted separately below; pinning it
+  // here too would mean changing the same fact in two places.
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade',[^)]*gradeUpload,/,
+    'the grade route must run its own parser before the handler');
+});
+
+test('a realistic mass-change body fits the new limit', () => {
+  // The shape that broke it: one path per changed file, plus the panel's findings. 1,141
+  // paths measured ~38 KB of JSON on their own — comfortably over 64 KB once the grade
+  // output is added, and comfortably under 1 MB.
+  const files = Array.from({ length: 1200 }, (_, i) => `scripts/gds/some-fairly-long-script-name-${i}.js`);
+  const body = JSON.stringify({
+    committed_files: files,
+    subagent_output: { functional_fidelity: 9, code_quality: 9, notes: 'x'.repeat(20_000) },
+  });
+  assert.ok(body.length > 64 * 1024,
+    'this fixture is meant to EXCEED the old cap — if it does not, it is not reproducing the bug');
+  assert.ok(body.length < 1024 * 1024,
+    `a mass-change body (${body.length} bytes) must fit the route limit`);
+});
+
+// ── the two findings the panel raised on the first round ────────────────────────────────
+
+test('the LARGER parser runs AFTER auth, like every other exempted route here', () => {
+  // Raised by the panel, round 1. Mounting the 1 MB parser before requireBuilder lets an
+  // UNAUTHENTICATED caller make the server parse up to 1 MB — sixteen times the global cap
+  // — before it is rejected. This file already had the right shape twice over; the new
+  // route simply diverged from it.
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade', auth\.requireBuilder, gradeUpload,/,
+    'the grade route must authenticate BEFORE parsing a larger body');
+
+  // The convention this follows, asserted so the three stay in step.
+  assert.match(src, /router\.post\('\/tasks\/:id\/publish-branch', auth\.requireBuilder, publishUpload,/,
+    'publish-branch is the precedent for auth-then-parser');
+});
+
+test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', () => {
+  // The worse half of the same buffer bug, and the panel caught it: computeDiffText was
+  // fixed while its sibling was not. At the default 1 MB buffer a large diff returned null
+  // and the old code hashed the EMPTY STRING — one fixed SHA-256 shared by every large
+  // diff. shouldReuseGrade compares that hash to the stored grade's, so two different large
+  // diffs on one task collided and a stale PASS could be reused on changed code, skipping
+  // the panel entirely.
+  const src = read('scripts/gds/ship-grade.js');
+
+  const fn = src.slice(src.indexOf('function computeRawDiffHash'), src.indexOf('function shouldReuseGrade'));
+  assert.ok(fn.length > 0, 'computeRawDiffHash is gone');
+  assert.match(fn, /maxBuffer: DIFF_CAPTURE_MAX_BYTES/,
+    'computeRawDiffHash must capture at the same size as computeDiffText');
+  assert.match(fn, /if \(raw === null\) return null;/,
+    'a failed capture must be "unknown" (null), never hash(\'\')');
+  assert.doesNotMatch(fn, /diffHash\(raw \|\| ''\)/,
+    'hashing `raw || \'\'` is the bug: every uncapturable diff hashes identically');
+
+  // And "unknown" must actually refuse reuse, which is what makes null the safe answer.
+  const reuse = src.slice(src.indexOf('function shouldReuseGrade'), src.indexOf('function shouldReuseGrade') + 400);
+  assert.match(reuse, /!currentDiffHash/, 'shouldReuseGrade must refuse a null/absent current hash');
+});
+
+test('both diff captures use one shared size, not two drifting numbers', () => {
+  // The two call sites are the same decision; a second literal is how one gets fixed and
+  // the other does not — which is exactly what happened here.
+  const src = read('scripts/gds/ship-grade.js');
+  assert.match(src, /const DIFF_CAPTURE_MAX_BYTES = /, 'the capture size must be named once');
+  const uses = (src.match(/maxBuffer: DIFF_CAPTURE_MAX_BYTES/g) || []).length;
+  assert.equal(uses, 2, `both diff captures must share the constant, saw ${uses}`);
+});
+
+test('the grade endpoint keeps its full generated description', () => {
+  // Panel finding, round 1 — and I doubted it before measuring, which was the wrong
+  // instinct. gen-api-docs' commentBlockAbove reads only the `//` lines IMMEDIATELY above
+  // `router.post(`, so declaring the parser between the doc-comment and the route collapses
+  // this endpoint's description from 1251 chars to 94: the rank line survives and every
+  // word about what the endpoint does, and how it fails, is dropped from BOTH
+  // docs/api-reference.md and openapi.json. Measured both ways before believing it.
+  //
+  // Pinned on LENGTH rather than exact prose so ordinary edits to the comment do not red
+  // this, while the collapse (which is an order-of-magnitude drop) still does.
+  const spec = JSON.parse(read('docs/api/openapi.json'));
+  const desc = spec.paths['/tasks/{id}/grade']?.post?.description || '';
+  assert.ok(desc.length > 400,
+    `the grade endpoint's generated description collapsed to ${desc.length} chars — `
+    + 'something now sits between its doc-comment and router.post(');
+  assert.match(desc, /[Ss]ubagent grader/,
+    'the description should still explain what the endpoint is');
+});

package/tests/ship_resume.mjs

@@ -17,9 +17,11 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
+import { shipCliSource } from './helpers.mjs';
+
 const require = createRequire(import.meta.url);
 const ship = require('../scripts/gds/ship.js');
-const { evaluateResumeAction } = ship;
+const { evaluateResumeAction, shouldConfirmWithoutGrade } = ship;
 
 let passed = 0;
 let failed = 0;
@@ -124,6 +126,57 @@ test('completed + owner with low rank still resumes (ownership, not rank)', () =
   assert.equal(a.via, 'owner');
 });
 
+// ---- task 1003147: the artifact-free resume that used to deadlock ----------
+// HIT FOR REAL on task 1003146. A kind=verify task landed at 'completed' with no
+// grade row; every documented escape (--allow-empty, --skip-grade, --verified) was
+// swallowed by the same "Nothing to grade" bail, because shipMain routes ANY
+// 'completed' task into the re-grade before reading a flag. The manual-confirm
+// path a no-artifact task needs is unreachable from 'completed' any other way.
+
+test('empty diff + --allow-empty → confirm instead of bailing (the 1003146 shape)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--allow-empty'] }), true);
+});
+
+test('empty diff + --skip-grade → confirm (the other documented no-artifact flag)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--skip-grade'] }), true);
+});
+
+test('a REAL diff + --allow-empty still grades — the flag is not a grader bypass', () => {
+  // The hole this guard exists to avoid: if a declaration alone were enough, a task
+  // whose grade FAILED could dodge the verdict by re-running with --allow-empty.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, args: ['1003146', '--allow-empty'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, args: ['1003146', '--skip-grade'] }), false);
+});
+
+test('empty diff with NO flag keeps dead-ending — uncommitted work must not "ship"', () => {
+  // The overwhelmingly common cause of an empty diff is forgetting to commit.
+  // Confirming that silently would report success having shipped nothing.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146'] }), false);
+});
+
+test('the empty-diff guard is actually WIRED to the decision, not just exporting it', () => {
+  // A pure truth table proves the decision, not that anything calls it. Without
+  // this, the guard could revert to its unconditional `process.exit(1)` and every
+  // case above would still pass — the deadlock back, the tests still green.
+  const src = shipCliSource();
+  // Match the CALL, not the declaration. shipCliSource() spans the whole ship
+  // family including ship-resume.js, where the function is DEFINED as
+  // `shouldConfirmWithoutGrade({ committedFileCount, args })` — a looser pattern
+  // matches that signature and passes even with the call site deleted. Verified:
+  // with the guard stubbed to `if (false)`, the loose form stayed green.
+  // `committedFiles.length` exists only at the call site.
+  assert.match(src, /shouldConfirmWithoutGrade\(\{\s*committedFileCount:\s*committedFiles\.length/,
+    'the re-grade empty-diff guard must CALL shouldConfirmWithoutGrade, not merely export it');
+  assert.match(src, /postTasksIdConfirm\(\{ id: taskId, body: \{ verified \} \}\)/,
+    'and reaching it must land on the manual-confirm route a no-artifact task needs');
+});
+
+test('shouldConfirmWithoutGrade: defaults and odd inputs never throw', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }), false, 'no args → no declaration');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }), true, 'a numeric string still counts as empty');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }), false, 'an unknown count is not an empty one');
+});
+
 console.log('');
 console.log(`ship_resume: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);