@bongos/core 1.19.691 → 1.19.692

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.691",
-  "core_contract": "1.19.691",
-  "source_commit": "d6f9d26e0e431f817085c4f3e93cba48e534c2e7",
+  "core_version": "1.19.692",
+  "core_contract": "1.19.692",
+  "source_commit": "012d6894a38ec2863be3f253053d3e6bcb153e6e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T00:51:33.922Z",
+  "built_at": "2026-09-13T01:33:50.871Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2126,
+    "functional_verbatim": 2127,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2627,
-  "tree_sha256": "c8d122583fff727fc928395a6e21c2ec230528b5163e89020d1b5506c39376be",
+  "file_count": 2628,
+  "tree_sha256": "5094b3b7495543b7ffaed3e1fc5f1b10c24356b3e227ad469461127b5cbefec7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d15899aa7ccc7cf1c4746843d0bc37487fcfaf1dabcbb6c9cac6ea8ccac49865"
+      "sha256": "ecd1242e375b1219b305ac16e2c3da7bfd8bdaa6812fd595b1ff9c68e84a8883"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5952,7 +5952,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "456b1d53d2349a499e1b07897dc6e16c72d26156a71347382c5a2508dc94d28d"
+      "sha256": "6d48a213e2ab334720833c174f4d5a1b9f8133404dbb21898305ae1c1a5db9d7"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8ef95c8bad02f83fa9d831818ab483bc1fbf18fbaf3392f5d03ab82dea4a3a7b"
+      "sha256": "5551c94d2db16d2ca8587eb4eeb10a6a92c03f303c578440ecda87bdbd8d96f8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "88f4f66604d980452d57d66d581170a45fd7e07464cf3699e390b34773105504"
+      "sha256": "ee34bdc1c10e92539590e5df75dddd41aca8db38e79579ba97fb78511f096558"
     },
     {
       "path": "public-docs/index.html",
@@ -8937,7 +8937,7 @@
     {
       "path": "scripts/gds/ship-grade.js",
       "mode": "0000644",
-      "sha256": "51b9132fc77f5f639a4597b26a6a5d083bf43c56944bf6710c939cafa074ba90"
+      "sha256": "79fcf45dd254681e7f91fe83fbb8a208b30c93eebe77df569aae505a025daa68"
     },
     {
       "path": "scripts/gds/ship-honesty.js",
@@ -9422,7 +9422,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "074cded727667d864b1849d8d5505736895a69a6bdf7132375fd358d66c2e6fd"
+      "sha256": "d02ccda5895a3662fe1ebb74785fd1b4745351f2a1532e2bd45aab7b18c297a1"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -9552,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "97d34718e5b331dc33b78b070ed6760c8113f383faf0a90cd8076f1ac5047fbb"
+      "sha256": "2e95562bb87ada79174e5014569717a5583925c9d2de108e1fb2e74763cf531b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11034,6 +11034,11 @@
       "mode": "0000644",
       "sha256": "f32c3de05d534befef5f2b5e199b77e11fa7d7a20bdf65ff70cba0c32b8d2060"
     },
+    {
+      "path": "tests/grade_body_limit.mjs",
+      "mode": "0000644",
+      "sha256": "7bd3fecff64c1fb2b4abbbd3bd7e836a7317d1018845a69f2c4adde05ea15273"
+    },
     {
       "path": "tests/grade_diff_hash.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1841,5 +1841,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.689 with no explicit bump. run 34727464797. (task 1002620)
   1.19.691 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.690 with no explicit bump. run 34729018766. (task 1002620)
+  1.19.692 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.691 with no explicit bump. run 34730821372. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/tasks.js

@@ -56,6 +56,10 @@ const { branding } = api;
 // above the 20 MB decoded ceiling. The decoded bytes are re-checked in the
 // handler (the JSON `limit` only bounds the ENCODED payload — SR-17 posture).
 const PUBLISH_BODY_LIMIT = '32mb';
+// The grade body is committed_files (one entry per changed path) + the panel's findings.
+// 1 MB covers a repo-wide change with room to spare and still bounds the route; the global
+// 64 KB cap is skipped for this path in src/bongos/routes.js. See task 1003850.
+const GRADE_BODY_LIMIT = '1mb';
 const PUBLISH_BUNDLE_B64_MAX = 30 * 1024 * 1024;   // validator guard on the b64 string
 const PUBLISH_BUNDLE_MAX_BYTES = 20 * 1024 * 1024; // 20 MB decoded bundle
 
@@ -881,6 +885,11 @@ module.exports = function buildTasksRouter() {
     }
   });
 
+  // Declared ABOVE the doc-comment on purpose: gen-api-docs.js reads only the `//`
+  // lines immediately preceding `router.post(`, so a const wedged between them blanks
+  // this endpoint's whole description in docs/api-reference.md and openapi.json.
+  const gradeUpload = express.json({ limit: GRADE_BODY_LIMIT });
+
   // GDS-V3 task V3.R18 (#209). Subagent grader credits gate.
   //
   // ship.js (or any caller) spawns an Opus subagent against the diff + task
@@ -905,7 +914,7 @@ module.exports = function buildTasksRouter() {
   // rank: any-builder — grader writes a row + auto-promotes only if grade clears
   // threshold; the grader subagent is the objectivity guarantee. Supervisor hot
   // path (preserved per CRITICAL §4 — no requireRank).
-  router.post('/tasks/:id/grade', auth.requireBuilder, async (req, res) => {
+  router.post('/tasks/:id/grade', auth.requireBuilder, gradeUpload, async (req, res) => {
     // Permissive on subagent_output type — the grader handles both object AND
     // JSON-string forms (see tests/grader.mjs "accepts JSON-string input").
     // Only enforce presence + light shape on signals (extras pass through).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.691",
+  "version": "1.19.692",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.691",
+      "version": "1.19.692",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.691",
+  "version": "1.19.692",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-grade.js

@@ -111,10 +111,34 @@ function computeChangedFiles(baseline) {
   return out ? out.split('\n').map((s) => s.trim()).filter(Boolean) : [];
 }
 
+// How much diff we are willing to CAPTURE. Distinct from GRADER_DIFF_CHAR_CAP, which is
+// how much we are willing to SHOW the panel: the capture has to succeed first, and a
+// capture that FAILS is indistinguishable from "nothing changed" unless we look.
+const DIFF_CAPTURE_MAX_BYTES = 512 * 1024 * 1024;
+
 function computeDiffText(baseline) {
   if (!baseline) return '';
   // -M to track renames; --no-color so the subagent gets clean diff lines.
-  const diff = gitOk(`git diff --no-color -M ${baseline}...HEAD`);
+  //
+  // maxBuffer is set EXPLICITLY, and that is the whole point of this function. execSync
+  // defaults to 1 MB and gitOk swallows the resulting ENOBUFS as null, so a large change
+  // silently produced an EMPTY diff: the panel then graded a zero-character string and
+  // would have returned a verdict on nothing at all, reporting diff_chars=0 in a log line
+  // that reads like an ordinary stat rather than an error. A 1,141-file rename (task
+  // 1003705) measured 9,808,703 chars and is what surfaced it; every big change had the
+  // same hole. The GRADER_DIFF_CHAR_CAP truncation below still bounds what the subagent is
+  // asked to read — this only stops the capture itself from failing.
+  const diff = gitOk(`git diff --no-color -M ${baseline}...HEAD`, { maxBuffer: DIFF_CAPTURE_MAX_BYTES });
+  if (diff === null) {
+    // Capture failed even at that size. Fall back to the stat summary so the panel gets the
+    // SHAPE of the change and can Read any file in its post-resolve state — strictly better
+    // than an empty string, which reads as "no changes" and grades as a pass.
+    // gitOk returns null ONLY on failure; a genuinely empty diff comes back as ''.
+    const stat = gitOk(`git diff --no-color -M --stat ${baseline}...HEAD`, { maxBuffer: 64 * 1024 * 1024 });
+    return stat
+      ? `[diff too large to capture in full — stat summary only. Read any file for its post-resolve state.]\n\n${stat}`
+      : '';
+  }
   if (!diff) return '';
   if (diff.length > GRADER_DIFF_CHAR_CAP) {
     const head = diff.slice(0, GRADER_DIFF_CHAR_CAP);
@@ -147,11 +171,25 @@ function diffHash(rawDiff) {
 }
 
 // Compute the hash of the full (untruncated) diff against baseline. Returns
-// null when baseline is unavailable so callers can treat null as "unknown".
+// null when baseline is unavailable, OR when the diff cannot be captured, so
+// callers can treat null as "unknown".
+//
+// SAME BUFFER BUG AS computeDiffText, AND A WORSE CONSEQUENCE. This ran gitOk at
+// execSync's default 1 MB, so a large diff came back null and the old
+// `diffHash(raw || '')` hashed the EMPTY STRING — the same fixed SHA-256 for every
+// large diff. shouldReuseGrade compares that hash against the stored grade's
+// diff_hash, so two genuinely different large diffs on one task collided and a stale
+// PASS could be reused on changed code, skipping the panel outright. That is the
+// silent-pass failure this task exists to remove, reappearing in the reuse path.
+//
+// Returning null on a failed capture is the fail-safe answer, not a cosmetic one:
+// shouldReuseGrade already refuses a falsy currentDiffHash, so "unknown" now means
+// "run the panel", where "" meant "matches every other unknown".
 function computeRawDiffHash(baseline) {
   if (!baseline) return null;
-  const raw = gitOk(`git diff --no-color -M ${baseline}...HEAD`);
-  return diffHash(raw || '');
+  const raw = gitOk(`git diff --no-color -M ${baseline}...HEAD`, { maxBuffer: DIFF_CAPTURE_MAX_BYTES });
+  if (raw === null) return null; // capture failed — never collapse that to hash('')
+  return diffHash(raw);
 }
 
 // Pure predicate: should we reuse the stored grade instead of running the

package/src/bongos/routes.js

@@ -94,7 +94,15 @@ function buildGdsRouter() {
       // task 1003109: the ship-time task visual — a base64 image up to ~5.3 MB
       // encoded (4 MB decoded). Same dynamic-:id pattern as publish-branch above;
       // modules/lifecycle/routes/task-visuals.js mounts its own 8 MB parser.
-      /^\/tasks\/\d+\/visual$/.test(req.path)
+      /^\/tasks\/\d+\/visual$/.test(req.path) ||
+      // task 1003850: the grade body carries committed_files — EVERY changed path, tens of
+      // KB on its own for a mass change — plus the panel's findings. A 1,141-file rename
+      // (task 1003705) produced a body over the 64 KB cap, so the grade could not be
+      // recorded at all (413 payload_too_large) and fully verified work stranded at
+      // 'completed'. The list is NOT trimmable to fit: modules/grading/grader-score.js runs
+      // the server-side permission-path pre-pass against it (SR-9 / SEC #863), so a short
+      // list would quietly weaken a security check rather than merely lose detail.
+      /^\/tasks\/\d+\/grade$/.test(req.path)
     ) return next();
     return globalJson(req, res, next);
   });

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.691'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.692'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grade_body_limit.mjs

@@ -0,0 +1,154 @@
+// tests/grade_body_limit.mjs — the grade body is not capped at 64 KB (task 1003850).
+//
+// WHAT BROKE. A 1,141-file rename produced a grade body over the global 64 KB JSON cap,
+// so POST /tasks/:id/grade came back 413 payload_too_large and fully verified work was
+// stranded at 'completed' with no way to record its grade. --regrade fails identically:
+// the size is deterministic, not transient.
+//
+// WHY THE BODY CANNOT SIMPLY BE TRIMMED. committed_files carries EVERY changed path, and
+// it is not decoration: modules/grading/grader-score.js runs the server-side
+// permission-path pre-pass against that exact list (SR-9 / SEC #863), so a shortened list
+// would quietly weaken a security check rather than just lose detail. The body gets its
+// own parser instead — the same shape memory/sync, sessions, publish-branch and the task
+// visual already use.
+//
+// Two halves, and BOTH are required: the global parser must SKIP this path (otherwise it
+// 413s before the route-scoped one ever runs — the comment in routes.js says exactly
+// this), and the route must mount a larger parser of its own.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const GRADE_PATH = '/tasks/1003850/grade';
+
+test('the global 64 KB parser SKIPS the grade path', () => {
+  const src = read('src/bongos/routes.js');
+
+  // The cap itself is still 64 KB for everything else — this test is about the exemption,
+  // not about loosening the default.
+  assert.match(src, /express\.json\(\{ limit: '64kb' \}\)/,
+    'the global cap should stay 64 KB; only named paths are exempt');
+
+  // Pull the skip predicate's path patterns straight out of the source and run them, so
+  // this asserts the REAL routing decision rather than the presence of a comment.
+  const block = src.slice(src.indexOf('const globalJson'), src.indexOf('// Audit middleware'));
+  // Regex LITERALS of the form /^...$/ — the body may contain escaped slashes, so the
+  // scan has to allow `\.` rather than stopping at the first `/`.
+  const patterns = [...block.matchAll(/\/\^(?:\\.|[^/\n])*\$\//g)].map((m) => m[0]);
+  assert.ok(patterns.length >= 3, `expected the skip list to carry several path regexes, saw ${patterns.length}`);
+
+  const matched = patterns.some((lit) => {
+    // eslint-disable-next-line no-new-func -- the literal comes from our own source
+    const re = new Function(`return ${lit}`)();
+    return re.test(GRADE_PATH);
+  });
+  assert.ok(matched, `no skip-list pattern matches ${GRADE_PATH} — the global parser would 413 the body before the route's own parser runs`);
+});
+
+test('the grade route mounts its own, larger parser', () => {
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  const m = /const GRADE_BODY_LIMIT = '(\d+)(kb|mb)';/.exec(src);
+  assert.ok(m, 'GRADE_BODY_LIMIT is gone — the route would fall back to whatever parser ran first');
+
+  const bytes = Number(m[1]) * (m[2] === 'mb' ? 1024 * 1024 : 1024);
+  assert.ok(bytes > 64 * 1024,
+    `GRADE_BODY_LIMIT (${m[1]}${m[2]}) must exceed the 64 KB global cap or the exemption buys nothing`);
+
+  // Mounted ON the route, ahead of the handler.
+  assert.match(src, /const gradeUpload = express\.json\(\{ limit: GRADE_BODY_LIMIT \}\);/,
+    'the route-scoped parser is not built from GRADE_BODY_LIMIT');
+  // Mounted ON the route. The ORDER (auth first) is asserted separately below; pinning it
+  // here too would mean changing the same fact in two places.
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade',[^)]*gradeUpload,/,
+    'the grade route must run its own parser before the handler');
+});
+
+test('a realistic mass-change body fits the new limit', () => {
+  // The shape that broke it: one path per changed file, plus the panel's findings. 1,141
+  // paths measured ~38 KB of JSON on their own — comfortably over 64 KB once the grade
+  // output is added, and comfortably under 1 MB.
+  const files = Array.from({ length: 1200 }, (_, i) => `scripts/gds/some-fairly-long-script-name-${i}.js`);
+  const body = JSON.stringify({
+    committed_files: files,
+    subagent_output: { functional_fidelity: 9, code_quality: 9, notes: 'x'.repeat(20_000) },
+  });
+  assert.ok(body.length > 64 * 1024,
+    'this fixture is meant to EXCEED the old cap — if it does not, it is not reproducing the bug');
+  assert.ok(body.length < 1024 * 1024,
+    `a mass-change body (${body.length} bytes) must fit the route limit`);
+});
+
+// ── the two findings the panel raised on the first round ────────────────────────────────
+
+test('the LARGER parser runs AFTER auth, like every other exempted route here', () => {
+  // Raised by the panel, round 1. Mounting the 1 MB parser before requireBuilder lets an
+  // UNAUTHENTICATED caller make the server parse up to 1 MB — sixteen times the global cap
+  // — before it is rejected. This file already had the right shape twice over; the new
+  // route simply diverged from it.
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade', auth\.requireBuilder, gradeUpload,/,
+    'the grade route must authenticate BEFORE parsing a larger body');
+
+  // The convention this follows, asserted so the three stay in step.
+  assert.match(src, /router\.post\('\/tasks\/:id\/publish-branch', auth\.requireBuilder, publishUpload,/,
+    'publish-branch is the precedent for auth-then-parser');
+});
+
+test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', () => {
+  // The worse half of the same buffer bug, and the panel caught it: computeDiffText was
+  // fixed while its sibling was not. At the default 1 MB buffer a large diff returned null
+  // and the old code hashed the EMPTY STRING — one fixed SHA-256 shared by every large
+  // diff. shouldReuseGrade compares that hash to the stored grade's, so two different large
+  // diffs on one task collided and a stale PASS could be reused on changed code, skipping
+  // the panel entirely.
+  const src = read('scripts/gds/ship-grade.js');
+
+  const fn = src.slice(src.indexOf('function computeRawDiffHash'), src.indexOf('function shouldReuseGrade'));
+  assert.ok(fn.length > 0, 'computeRawDiffHash is gone');
+  assert.match(fn, /maxBuffer: DIFF_CAPTURE_MAX_BYTES/,
+    'computeRawDiffHash must capture at the same size as computeDiffText');
+  assert.match(fn, /if \(raw === null\) return null;/,
+    'a failed capture must be "unknown" (null), never hash(\'\')');
+  assert.doesNotMatch(fn, /diffHash\(raw \|\| ''\)/,
+    'hashing `raw || \'\'` is the bug: every uncapturable diff hashes identically');
+
+  // And "unknown" must actually refuse reuse, which is what makes null the safe answer.
+  const reuse = src.slice(src.indexOf('function shouldReuseGrade'), src.indexOf('function shouldReuseGrade') + 400);
+  assert.match(reuse, /!currentDiffHash/, 'shouldReuseGrade must refuse a null/absent current hash');
+});
+
+test('both diff captures use one shared size, not two drifting numbers', () => {
+  // The two call sites are the same decision; a second literal is how one gets fixed and
+  // the other does not — which is exactly what happened here.
+  const src = read('scripts/gds/ship-grade.js');
+  assert.match(src, /const DIFF_CAPTURE_MAX_BYTES = /, 'the capture size must be named once');
+  const uses = (src.match(/maxBuffer: DIFF_CAPTURE_MAX_BYTES/g) || []).length;
+  assert.equal(uses, 2, `both diff captures must share the constant, saw ${uses}`);
+});
+
+test('the grade endpoint keeps its full generated description', () => {
+  // Panel finding, round 1 — and I doubted it before measuring, which was the wrong
+  // instinct. gen-api-docs' commentBlockAbove reads only the `//` lines IMMEDIATELY above
+  // `router.post(`, so declaring the parser between the doc-comment and the route collapses
+  // this endpoint's description from 1251 chars to 94: the rank line survives and every
+  // word about what the endpoint does, and how it fails, is dropped from BOTH
+  // docs/api-reference.md and openapi.json. Measured both ways before believing it.
+  //
+  // Pinned on LENGTH rather than exact prose so ordinary edits to the comment do not red
+  // this, while the collapse (which is an order-of-magnitude drop) still does.
+  const spec = JSON.parse(read('docs/api/openapi.json'));
+  const desc = spec.paths['/tasks/{id}/grade']?.post?.description || '';
+  assert.ok(desc.length > 400,
+    `the grade endpoint's generated description collapsed to ${desc.length} chars — `
+    + 'something now sits between its doc-comment and router.post(');
+  assert.match(desc, /[Ss]ubagent grader/,
+    'the description should still explain what the endpoint is');
+});