@bongos/core 1.19.888 → 1.19.890

package/scripts/gds/run-unit-tests.js

@@ -171,6 +171,14 @@ const INTEGRATION = new Set([
   // real engine can show the CASE guard leaving a NULL alone on an actual use,
   // which is exactly where the removed timeout would come back.
   'auth_session_expiry_db',
+  // task 1003372 (audit A1, core_249): that hashing the bearer at rest does not
+  // sign anybody out. The DB-free sibling (session_token_hash) stands in front of
+  // the pool and proves the plaintext never reaches a query — the negative that
+  // matters — but it cannot show that Postgres accepts the migration, nor that
+  // the digest the backfill computes in SQL equals the one the kernel computes in
+  // Node. That mismatch would leave every new session working and every migrated
+  // one dead, which is the failure a source-reading test walks straight past.
+  'session_token_hash_db',
   'scouting_rollup_fanout', 'session_records',
   // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
   // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a

package/scripts/gds/ship-grade.js

@@ -12,6 +12,14 @@ const crypto = require('node:crypto');
 const { spawn } = require('node:child_process');
 const { cliClient } = require('./cli-lib');
 const grader = require('../../modules/grading/grader');
+// task 1003977: the ONE definition of "does this ship put copy in front of a
+// person". It lives in the lifecycle module and the grading module may not
+// require a sibling (ADR 0083), so this script — which is not a module and
+// already requires grading directly — is the seam where the two meet. Writing a
+// second predicate inside grading would let the at-ship reader lens and the
+// after-the-fact artist review disagree about what they cover, and widening the
+// set would then have to be done twice.
+const { hasCopyOrVisualWork } = require('../../modules/lifecycle/cascade.js');
 const { resolveBuilderModel } = require('./ship-memory-sync.js');
 const { argvOut, gitArgvOk, gitOk, shellOk } = require('./ship-git.js');
 const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, REPO_ROOT, noteServerReward } = require('./ship-state.js');
@@ -285,9 +293,16 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       lenses_dropped: ['hacker', 'efficiency'],
     };
   } else {
-    const panel = grader.WORKERS.DEFAULT_PANEL;
+    // task 1003977: the advisory Reader rides along on copy-bearing diffs only.
+    // Where the predicate says no, `panel` is byte-identical to DEFAULT_PANEL
+    // and the ship costs exactly what it costs today.
+    const copyBearing = hasCopyOrVisualWork(task);
+    const panel = grader.WORKERS.panelFor({ copyBearing });
     console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
-    console.log(`  gate: every worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
+    console.log(`  gate: every GATING worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
+    console.log(copyBearing
+      ? `  copy lens: ON — this task is copy-bearing, so the advisory 'reader' reads the changed strings against docs/voice.md. It is NON-GATING: nothing it reports, and no error or timeout it hits, can stop this ship.`
+      : `  copy lens: off — not a copy-bearing task (no copy-proposal source, not artist-discipline, module not in COPY_VISUAL_MODULES), so the panel is the usual four.`);
     if (priorRound) {
       console.log(`  delta re-grade (task 1002662): prior round's findings + builder response ride along, fenced; answered findings can only re-veto with NEW evidence`);
     }
@@ -300,8 +315,19 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       builderRank,          // SEC #863: drives the permission-path pre-pass
       builderModel,         // task 1002659: real session model → cross-model grader pick
       priorRound,           // task 1002662: delta-aware re-grade context (panel path only)
+      workers: panel,       // task 1003977: DEFAULT_PANEL, plus the advisory reader when copy-bearing
       runOpts,
     });
+    // A SKIPPED LENS IS RECORDED, NEVER SILENT. Without this a grade with no
+    // copy_score is indistinguishable from one where the copy was read and
+    // found clean — a missing score would read as a passing one. Same pattern
+    // and same reason as the trivial path's `lenses_dropped` above.
+    if (!copyBearing) {
+      result.signals = {
+        ...(result.signals || {}),
+        reader_skipped: 'not_copy_bearing',
+      };
+    }
   }
   const wallMs = Date.now() - t0;
   // Decorate signals with the local shortstat — useful in audit-trail.

package/src/bongos/db-kernel.js

@@ -23,6 +23,7 @@
 
 'use strict';
 
+const crypto = require('node:crypto');
 const { pool } = require('./pool');
 const seams = require('../module-seams');
 
@@ -277,8 +278,37 @@ async function accessStateByLogin(login) {
 // code agree on one number.
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
+// sessionTokenHash — the ONE place a bearer becomes the value this table stores
+// (task 1003372, audit A1, migration core_249). SHA-256 hex, matching the
+// migration's `encode(sha256(token::bytea), 'hex')` byte for byte, so a row
+// backfilled in SQL and a row minted here resolve identically.
+//
+// WHY A FAST HASH. A session token is 256 bits of CSPRNG, not a password: there
+// is no dictionary to run, so a KDF would buy nothing and cost real latency on
+// every authenticated request. Same reasoning, written out at length, in
+// modules/platform-identity/platform-identity.js (`sha256hex`).
+//
+// WHY NO timingSafeEqual HERE, THOUGH THE TASK NAMED IT. The pattern the task
+// points at compares a presented secret against one it already fetched by
+// client_id, so the comparison happens in JS and must be constant-time. A session
+// has no second identifier — the bearer IS the lookup key — so the comparison is
+// the indexed `WHERE token_hash = $1` below, and there is no JS compare to make
+// constant-time. Adding a timingSafeEqual after that lookup would compare the
+// hash to itself: vacuously true, and worse than nothing, because it would read
+// as a control that is doing something. The property the task wanted — a guessed
+// token leaks no information about how close it was — holds here because the
+// index is probed with a full digest, never a prefix.
+function sessionTokenHash(token) {
+  return crypto.createHash('sha256').update(String(token), 'utf8').digest('hex');
+}
+
 // createSession — mint a builder_sessions row.
 //
+// THE PLAINTEXT BEARER IS NEVER STORED (task 1003372). `token` is hashed on the
+// way in and the column that held it is gone (core_249). The raw value is
+// returned to the caller — it is their input, handed back so the mint response
+// can carry it to the client — and after that it exists only in the client.
+//
 // A null/undefined expiresAt means NO EXPIRY (expires_at NULL), which
 // lookupSession honours as never-expires. That is the CLI's contract (ADR 0294,
 // restoring 003_pms.sql's original one): a `bongos` sign-in lasts until it is
@@ -290,12 +320,15 @@ const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 async function createSession({ builderId, token, source, userAgent, expiresAt }) {
   const effectiveExpiresAt = expiresAt ?? null;
   const { rows } = await pool.query(
-    `INSERT INTO builder_sessions (builder_id, token, source, user_agent, expires_at)
+    `INSERT INTO builder_sessions (builder_id, token_hash, source, user_agent, expires_at)
      VALUES ($1, $2, $3, $4, $5)
-     RETURNING id, builder_id, token, source, created_at, expires_at`,
-    [builderId, token, source, userAgent ?? null, effectiveExpiresAt]
+     RETURNING id, builder_id, source, created_at, expires_at`,
+    [builderId, sessionTokenHash(token), source, userAgent ?? null, effectiveExpiresAt]
   );
-  return rows[0];
+  // `token` is re-attached from the ARGUMENT, never read back from the row — the
+  // row no longer holds it. Callers that pass a token and read one back are
+  // unchanged; what changed is that the database never saw the plaintext.
+  return { ...rows[0], token };
 }
 
 // lookupSession — resolve a live (unrevoked, unexpired) session token to its
@@ -346,8 +379,8 @@ async function lookupSession(token) {
             b.rank, b.status, b.system_role, b.anthropic_user_id${sessionPermsSelect()}
        FROM builder_sessions s
        JOIN builders b ON b.id = s.builder_id
-      WHERE s.token = $1`,
-    [token]
+      WHERE s.token_hash = $1`,
+    [sessionTokenHash(token)]
   );
   const row = rows[0];
   if (!row) return null;
@@ -376,6 +409,9 @@ async function lookupSession(token) {
 module.exports = {
   withTx,
   sessionPermsSelect,
+  // Exported for db.js's revokeSession (which is handed a bearer, not an id) and
+  // for the tests that assert the plaintext never reaches a query parameter.
+  sessionTokenHash,
   getBuilderById,
   getFoundingBuilder,
   listActiveBuilders,

package/src/bongos/db.js

@@ -44,6 +44,9 @@ const {
   // internal uses (setBuilderRank's RANKS.indexOf, etc.) stay byte-identical.
   RANKS, SESSION_TTL_MS, upsertBuilder, seatFirstAdminIfUnclaimed,
   getBuilderByGithubId, hasInvitedAccessRequest, createSession, lookupSession,
+  // The bearer → stored-value transform (task 1003372, core_249). revokeSession
+  // below is the one helper here still handed a raw bearer rather than an id.
+  sessionTokenHash,
 } = require('./db-kernel');
 
 // gradePassCount removed with builderRollingAvgGrade (its only core user) — that
@@ -728,10 +731,14 @@ async function hasCliSession(builderId) {
 // lookupSession — carved to ./db-kernel (ADR 0102). Re-exported above.
 
 
+// Takes the raw bearer (its callers are sign-out paths holding a cookie or an
+// Authorization header, not a session id) and matches on the stored hash —
+// core_249 dropped the plaintext column, so the bearer itself is no longer
+// something this table can be searched by.
 async function revokeSession(token) {
   await pool.query(
-    `UPDATE builder_sessions SET revoked_at = now() WHERE token = $1 AND revoked_at IS NULL`,
-    [token]
+    `UPDATE builder_sessions SET revoked_at = now() WHERE token_hash = $1 AND revoked_at IS NULL`,
+    [sessionTokenHash(token)]
   );
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.888'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.890'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_session_expiry_db.mjs

@@ -67,7 +67,7 @@ await pool.query(`
     display_name text, avatar_url text, total_credits int DEFAULT 0, rank text DEFAULT 'archon',
     status text DEFAULT 'active', system_role text, anthropic_user_id text);
   CREATE TABLE builder_sessions (id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id),
-    token text UNIQUE, source text, user_agent text, created_at timestamptz DEFAULT now(),
+    token_hash text UNIQUE, source text, user_agent text, created_at timestamptz DEFAULT now(),
     last_used_at timestamptz DEFAULT now(), expires_at timestamptz, revoked_at timestamptz);
   INSERT INTO builders (github_login) VALUES ('probe');
 `);
@@ -86,6 +86,11 @@ const t = async (name, fn) => {
   catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
 };
 const row = async (sql, p) => (await client.query(sql, p)).rows[0];
+// core_249: the bearer is no longer a column, so a probe that wants "the row for
+// this token" has to ask by the stored digest. Uses the kernel's OWN helper, so a
+// change to the hash cannot leave this file quietly matching nothing — a mismatch
+// would make every assertion below read a missing row and fail loudly.
+const h = (token) => kernel.sessionTokenHash(token);
 // refresh-on-use is fire-and-forget: let the UPDATE land before reading it back.
 const settle = () => new Promise((r) => setTimeout(r, 300));
 
@@ -110,67 +115,67 @@ await t('lookupSession resolves a CLI bearer to its builder', async () => {
 await t('after a real use, a CLI session STILL has no expiry (the CASE guard)', async () => {
   await kernel.lookupSession('cli-tok');
   await settle();
-  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='cli-tok'`)).expires_at, null);
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('cli-tok')}'`)).expires_at, null);
 });
 
 await t('refresh-on-use still bumps last_used_at on that same row', async () => {
-  const before = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
-  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '1 hour' WHERE token='cli-tok'`);
+  const before = (await row(`SELECT last_used_at FROM builder_sessions WHERE token_hash='${h('cli-tok')}'`)).last_used_at;
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '1 hour' WHERE token_hash='${h('cli-tok')}'`);
   await kernel.lookupSession('cli-tok');
   await settle();
-  const after = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
+  const after = (await row(`SELECT last_used_at FROM builder_sessions WHERE token_hash='${h('cli-tok')}'`)).last_used_at;
   assert.ok(after > new Date(Date.now() - 60_000), `last_used_at did not move: ${after} (was ${before})`);
 });
 
 await t('a web session still rolls its expiry forward (refresh-on-use intact)', async () => {
   await kernel.lookupSession('web-tok');
   await settle();
-  const got = (await row(`SELECT expires_at FROM builder_sessions WHERE token='web-tok'`)).expires_at;
+  const got = (await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('web-tok')}'`)).expires_at;
   assert.ok(got !== null && got < thirtyDays, `expected a rolled-forward date below 30d, got ${got}`);
 });
 
 await t('an expired session is still REFUSED (expiry honoured where present)', async () => {
-  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at)
-                      VALUES (1,'dead-tok','web', now() - interval '1 hour')`);
+  await client.query(`INSERT INTO builder_sessions (builder_id, token_hash, source, expires_at)
+                      VALUES (1,'${h('dead-tok')}','web', now() - interval '1 hour')`);
   assert.equal(await kernel.lookupSession('dead-tok'), null);
 });
 
 await t('a revoked CLI session is still REFUSED', async () => {
-  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, revoked_at)
-                      VALUES (1,'revoked-tok','cli', now())`);
+  await client.query(`INSERT INTO builder_sessions (builder_id, token_hash, source, revoked_at)
+                      VALUES (1,'${h('revoked-tok')}','cli', now())`);
   assert.equal(await kernel.lookupSession('revoked-tok'), null);
 });
 
 // The migration, against rows shaped like the ones live instances actually hold.
 const migrationSql = readFileSync(MIGRATION, 'utf8');
-await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at) VALUES
-  (1,'old-cli','cli', now() + interval '24 hours'),
-  (1,'old-web','web', now() + interval '30 days'),
-  (1,'old-revoked','cli', now() + interval '24 hours')`);
-await client.query(`UPDATE builder_sessions SET revoked_at = now() WHERE token='old-revoked'`);
+await client.query(`INSERT INTO builder_sessions (builder_id, token_hash, source, expires_at) VALUES
+  (1,'${h('old-cli')}','cli', now() + interval '24 hours'),
+  (1,'${h('old-web')}','web', now() + interval '30 days'),
+  (1,'${h('old-revoked')}','cli', now() + interval '24 hours')`);
+await client.query(`UPDATE builder_sessions SET revoked_at = now() WHERE token_hash='${h('old-revoked')}'`);
 await client.query(migrationSql);
 
 await t('core_243 clears a pre-existing CLI expiry', async () => {
-  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-cli')}'`)).expires_at, null);
 });
 
 await t('core_243 leaves a WEB row dated — the source filter is its safety property', async () => {
-  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-web')}'`)).expires_at, null);
 });
 
 await t('core_243 leaves a revoked row alone (it is the audit trail)', async () => {
-  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-revoked'`)).expires_at, null);
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-revoked')}'`)).expires_at, null);
 });
 
 await t('core_243 is idempotent — a re-run changes nothing', async () => {
   await client.query(migrationSql);
-  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
-  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-cli')}'`)).expires_at, null);
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-web')}'`)).expires_at, null);
 });
 
 // The whole point of the task, stated as a test.
 await t('a CLI session idle for 21 DAYS still authenticates', async () => {
-  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '21 days' WHERE token='cli-tok'`);
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '21 days' WHERE token_hash='${h('cli-tok')}'`);
   assert.notEqual(await kernel.lookupSession('cli-tok'), null);
 });
 

package/tests/extract_json.mjs

@@ -128,11 +128,19 @@ test('nothing parseable is null', () => {
 test('GRADE_SHAPE_KEYS is the exported score-key list', () => {
   // Exported so workers and grader.js agree on what "grade-shaped" means; the
   // preference test above depends on functional_fidelity being in this list.
+  //
+  // ONE ENTRY PER WORKER THAT REPORTS A SCORE. task 1003977 added copy_score
+  // with the reader: reader.js re-exports this extractJson, so a worker missing
+  // from this list silently loses the score-based disambiguation every other
+  // worker gets. Kept as an exact list rather than loosened, because that
+  // silence is the whole reason to pin it — a new worker must appear here in
+  // the same change that adds it.
   assert.deepEqual(GRADE_SHAPE_KEYS, [
     'functional_fidelity',
     'code_quality',
     'security_score',
     'efficiency_score',
+    'copy_score',
   ]);
 });
 

package/tests/government_live_proof.mjs

@@ -42,6 +42,9 @@ if (!process.env.DATABASE_URL) {
 }
 
 const { Pool } = require('pg');
+// The kernel's own bearer → stored-digest transform (core_249), so this fixture
+// cannot drift from how production mints a session.
+const { sessionTokenHash } = require('../src/bongos/db-kernel.js');
 const pool = new Pool({ connectionString: process.env.DATABASE_URL });
 
 // ── THE READINESS GUARD, AND WHY ITS SHAPE MATTERS (task 1003091) ────────────
@@ -137,9 +140,12 @@ async function seed() {
     [ARCHON, THETES]
   );
   await q(
-    `INSERT INTO builder_sessions (builder_id, token, source)
+    // core_249: the bearer is stored as its SHA-256, so a fixture session has to
+    // be seeded the same way the kernel mints one — otherwise the HTTP calls
+    // below authenticate as nobody.
+    `INSERT INTO builder_sessions (builder_id, token_hash, source)
      VALUES ($1,$2,'web'), ($3,$4,'web')`,
-    [ARCHON, ARCHON_TOKEN, THETES, THETES_TOKEN]
+    [ARCHON, sessionTokenHash(ARCHON_TOKEN), THETES, sessionTokenHash(THETES_TOKEN)]
   );
   const [idea] = await q(
     `INSERT INTO idea_inbox (title, body_md, captured_by)

package/tests/grader_reader_lens.mjs

@@ -0,0 +1,257 @@
+// tests/grader_reader_lens.mjs — the advisory Reader lens (task 1003977, ADR 0298).
+//
+// The owner settled three terms on 2026-09-17 and each is pinned here:
+//   SCOPE      copy-bearing diffs only, keyed off the ONE existing predicate.
+//   AUTHORITY  advisory, full stop — it cannot fail, cannot reach 'concerns',
+//              and cannot block via an error or a timeout.
+//   STANDARD   docs/voice.md, cited by rule id.
+//
+// The task names the error exemption as "the single most important test in this
+// task", because a worker error normally HARD-FAILS the panel
+// (panel_gate: 'ANY worker.error != null → passed=false'). It is §2 below.
+//
+// The subtlest case is §3: a HEALTHY reader must not mask a total grader
+// outage. Before the non-gating partition, a passing fifth worker would make
+// "every gating worker is missing signal" false, and a total outage would
+// present as FAIL · 0/10 with every axis null — the exact regression class
+// task 1003574 documents, where a builder sat dark on an unclearable re-grade.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const grader = require('../modules/grading/grader.js');
+const WORKERS = require('../modules/grading/grader-workers/index.js');
+const reader = require('../modules/grading/grader-workers/reader.js');
+const { hasPanelEvidence } = require('../modules/grading/grader-score.js');
+const { hasCopyOrVisualWork } = require('../modules/lifecycle/cascade.js');
+
+const W = (kind, verdict, extra = {}) => ({
+  kind, name: kind, verdict, scores: {}, issues: [], confidence: 0.9, error: null, ...extra,
+});
+const healthyFour = () => [
+  W('narc', 'pass', { scores: { functional_fidelity: 9 } }),
+  W('quality', 'pass', { scores: { code_quality: 9, economy: 9 } }),
+  W('hacker', 'pass', { scores: { security_score: 9 } }),
+  W('efficiency', 'pass', { scores: { efficiency_score: 9 } }),
+];
+const agg = (ws) => grader.aggregatePanel(ws, {});
+
+// ---- 1. AUTHORITY: the verdict itself cannot be a blocking one -------------
+
+test('computeVerdict returns "advisory" on EVERY path, including its own failures', () => {
+  // Structural, not a filter: there is no branch that returns pass/concerns/fail,
+  // so "it cannot block" is a property of the function rather than a promise
+  // kept by its callers.
+  const paths = [
+    ['clean', [{ copy_score: 10, issues: [] }, {}]],
+    ['bad copy', [{ copy_score: 0, issues: [{ severity: 'major', kind: 'break', rule: 'V1' }] }, {}]],
+    ['subagent error', [null, { subprocess_error: 'SUBAGENT_TIMEOUT' }]],
+    ['spawn failure', [null, { subprocess_error: 'SUBAGENT_SPAWN_FAILED' }]],
+    ['unparseable', ['not json at all', {}]],
+    ['schema error', [{ copy_score: 'banana', issues: [] }, {}]],
+    ['null parse', [null, {}]],
+  ];
+  for (const [name, [parsed, meta]] of paths) {
+    const v = reader.computeVerdict(parsed, meta);
+    assert.equal(v.verdict, 'advisory', `${name} → ${v.verdict}`);
+    assert.equal(v.verdict, reader.ADVISORY_VERDICT);
+  }
+});
+
+test('an errored Reader reports NO score rather than a zero', () => {
+  // 0/10 is a real reading ("would embarrass the project in front of a user").
+  // An outage is missing signal, not a bad signal — the distinction #943 draws
+  // for the whole panel, applied to one worker.
+  const v = reader.computeVerdict(null, { subprocess_error: 'SUBAGENT_TIMEOUT' });
+  assert.deepEqual(v.scores, {});
+  assert.equal(v.error, 'SUBAGENT_TIMEOUT');
+});
+
+test('a blocker severity is FLOORED to major, not dropped', () => {
+  // Dropping would hide a real observation; honouring would hand this lens the
+  // veto the owner's term denies it.
+  const v = reader.computeVerdict({ copy_score: 3, issues: [{ severity: 'blocker', kind: 'break', rule: 'V2' }] }, {});
+  assert.equal(v.issues.length, 1, 'the finding survives');
+  assert.equal(v.issues[0].severity, 'major');
+  assert.equal(v.issues[0].severity_floored_from, 'blocker');
+});
+
+// ---- 2. THE EXEMPTION THE TASK CALLS THE MOST IMPORTANT --------------------
+
+test('NO Reader outcome can stop a ship — including an error, which normally hard-fails', () => {
+  const baseline = agg(healthyFour());
+  assert.equal(baseline.passed, true);
+
+  const cases = {
+    'clean reader': W('reader', 'advisory', { scores: { copy_score: 9 } }),
+    'copy_score 0': W('reader', 'advisory', { scores: { copy_score: 0 } }),
+    'errored (timeout)': W('reader', 'advisory', { error: 'SUBAGENT_TIMEOUT' }),
+    'errored (prompt too long)': W('reader', 'advisory', { error: 'PROMPT_TOO_LONG' }),
+    'two major findings': W('reader', 'advisory', { scores: { copy_score: 2 }, issues: [{ severity: 'major' }, { severity: 'major' }] }),
+    // Belt AND braces: even if a future edit made the worker emit a gating
+    // verdict, the panel partition still refuses to read it.
+    'ILLEGALLY emits fail': W('reader', 'fail', { issues: [{ severity: 'blocker' }] }),
+  };
+  for (const [name, row] of Object.entries(cases)) {
+    const r = agg([...healthyFour(), row]);
+    assert.equal(r.passed, true, `${name} must not block the ship`);
+    assert.equal(r.signals.panel_outcome, 'pass', `${name} must not move the outcome`);
+  }
+});
+
+test('the Reader is absent from every gate count', () => {
+  const r = agg([...healthyFour(), W('reader', 'advisory', { error: 'SUBAGENT_TIMEOUT' })]);
+  assert.equal(r.signals.worker_count, 4, 'the gate denominator counts gating workers only');
+  assert.equal(r.signals.error_count, 0, "an errored Reader is not a gate error");
+  assert.equal(r.signals.fail_count, 0);
+  assert.equal(r.signals.pass_count, 4);
+});
+
+// ---- 3. THE SUBTLE ONE -----------------------------------------------------
+
+test('a HEALTHY Reader does not mask a total grader outage', () => {
+  const allErrored = ['narc', 'quality', 'hacker', 'efficiency'].map((k) => W(k, 'fail', { error: 'SUBAGENT_SPAWN_FAILED' }));
+  const without = agg(allErrored);
+  assert.equal(without.signals.panel_outcome, 'unavailable', 'baseline: a total outage is an outage');
+
+  const with_ = agg([...allErrored, W('reader', 'advisory', { scores: { copy_score: 9 } })]);
+  assert.equal(with_.signals.panel_outcome, 'unavailable',
+    'a passing fifth worker must not turn an outage into a FAIL 0/10 (the task-1003574 class)');
+  assert.equal(with_.passed, false);
+});
+
+test("the Reader's confidence cannot move the server-gate median", () => {
+  const four = healthyFour();
+  const noReader = agg(four).signals.confidence;
+  const withReader = agg([...four, W('reader', 'advisory', { confidence: 0.01, scores: { copy_score: 1 } })]).signals.confidence;
+  assert.equal(withReader, noReader, 'a low-confidence Reader must not drag the forwarded confidence');
+});
+
+// ---- 4. THE SIGNAL STILL LANDS ---------------------------------------------
+
+test('copy_score and the findings reach the RECORD even though the gate ignores them', () => {
+  const r = agg([...healthyFour(), W('reader', 'advisory', { scores: { copy_score: 4 }, issues: [{ severity: 'major', rule: 'V1' }] })]);
+  assert.equal(r.rubric_scores.copy_score, 4, 'the score is recorded');
+  assert.ok(r.signals.workers.some((w) => w.kind === 'reader'), 'the Reader row is in the record');
+  assert.equal(agg(healthyFour()).rubric_scores.copy_score, null, 'and is null when no Reader ran');
+});
+
+test('a Reader row still counts as evidence that the panel ran', () => {
+  // hasPanelEvidence is an `every` over the worker verdicts. Leave 'advisory'
+  // out of WORKER_VERDICTS and a fully-healthy five-worker panel reads as NO
+  // evidence, firing the implausible-pass guard on exactly the ships carrying
+  // the most lenses.
+  const rows = (extra = []) => ({ workers: [
+    { kind: 'narc', verdict: 'pass' }, { kind: 'quality', verdict: 'pass' },
+    { kind: 'hacker', verdict: 'pass' }, { kind: 'efficiency', verdict: 'pass' }, ...extra,
+  ] });
+  assert.equal(hasPanelEvidence(rows()), true);
+  assert.equal(hasPanelEvidence(rows([{ kind: 'reader', verdict: 'advisory' }])), true);
+  assert.equal(hasPanelEvidence(rows([{ kind: 'reader', verdict: 'nonsense' }])), false, 'the vocabulary is still closed');
+});
+
+// ---- 5. SCOPE --------------------------------------------------------------
+
+test('the panel is byte-identical to today when the diff is not copy-bearing', () => {
+  assert.deepEqual(WORKERS.panelFor({ copyBearing: false }), WORKERS.DEFAULT_PANEL);
+  assert.deepEqual(WORKERS.panelFor(), WORKERS.DEFAULT_PANEL, 'and when the caller says nothing');
+  assert.deepEqual(WORKERS.panelFor({ copyBearing: true }), [...WORKERS.DEFAULT_PANEL, 'reader']);
+});
+
+test('scope keys off the ONE existing predicate, not a second copy', () => {
+  // The at-ship lens and the after-the-fact artist review must never disagree
+  // about what they cover. Widening COPY_VISUAL_MODULES must widen both at once,
+  // which it only does while there is one predicate.
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  assert.match(src, /hasCopyOrVisualWork/, 'the caller asks lifecycle for the answer');
+  assert.match(src, /panelFor\(\{ copyBearing \}\)/, 'and passes it down');
+  // RECURSIVE. A readdirSync of modules/grading alone skips grader-workers/,
+  // which holds reader.js — the file this assertion is most about. The first
+  // version of this test did exactly that and proved nothing it claimed.
+  const walk = (dir) => fs.readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
+    const full = path.join(dir, e.name);
+    return e.isDirectory() ? walk(full) : (e.name.endsWith('.js') ? [full] : []);
+  });
+  const gradingFiles = walk(path.join(ROOT, 'modules', 'grading'));
+  assert.ok(gradingFiles.some((f) => f.endsWith(`grader-workers${path.sep}reader.js`)),
+    'the scan reaches grader-workers/reader.js — otherwise it checks everything except the file in question');
+  for (const f of gradingFiles) {
+    const body = fs.readFileSync(f, 'utf8').replace(/^\s*\/\/.*$/gm, '');
+    assert.ok(!/COPY_VISUAL_MODULES|copy-proposal/.test(body),
+      `${path.relative(ROOT, f)} must not re-implement the copy predicate — grading cannot require lifecycle (ADR 0083), so the CALLER decides`);
+  }
+  // Sanity: the predicate really does discriminate.
+  assert.equal(hasCopyOrVisualWork({ discipline: 'artist' }), true);
+  assert.equal(hasCopyOrVisualWork({ module_key: 'hall-ui' }), true);
+  assert.equal(hasCopyOrVisualWork({ module_key: 'grading', discipline: 'engineer' }), false);
+});
+
+// ---- 6. STANDARD -----------------------------------------------------------
+
+test('the prompt sends the worker to the written guide, and forbids an uncited finding', () => {
+  const p = reader.PROMPT_HEADER;
+  assert.match(p, /docs\/voice\.md/, 'the rubric is the voice guide');
+  assert.match(p, /cites no rule id is not a finding/i, "the guide's own rule travels with it");
+  // The hard/judgement split is what stops an advisory lens recording taste as
+  // fact, so it is pinned rather than left to the prompt's good intentions.
+  assert.match(p, /V1-V5/, 'hard rules may be asserted');
+  assert.match(p, /V6-V11/, 'judgement rules may only be flagged');
+  assert.match(p, /ADVISORY/, 'the worker is told it cannot block');
+  assert.ok(!/blocker/.test(p.split('## Return ONLY JSON')[1] || ''),
+    'the JSON schema offers no blocker severity');
+});
+
+test('docs/voice.md exists — the lens has a standard to judge against', () => {
+  // The hard dependency (task 1003976). A copy lens with no written standard
+  // records taste and calls it a finding.
+  const guide = fs.readFileSync(path.join(ROOT, 'docs', 'voice.md'), 'utf8');
+  for (const id of ['V1', 'V2', 'V3', 'V4', 'V5']) {
+    assert.ok(guide.includes(`## ${id} —`) || guide.includes(`## ${id} `), `${id} is a rule in the guide`);
+  }
+});
+
+// ---- 7. THE DONE-WHEN CLAUSE THAT LIVES IN ANOTHER FILE ---------------------
+
+test('the artist review now coaches the reader, because there is a lens listening', () => {
+  // The task's own DONE WHEN: "Then STEP 1 of the artist review reverts to true
+  // coaching — see the comment in modules/lifecycle/cascade.js, which says so
+  // and asks not to be reverted early." The interim wording was explicitly a
+  // signal for which world we are in, so shipping the lens without turning it
+  // leaves the instruction to artists describing a panel that no longer exists.
+  const { artistReviewBody } = require('../modules/lifecycle/cascade.js');
+  const body = artistReviewBody({ id: '1234' });
+  assert.match(body, /COACH THE READER/, 'STEP 1 asks for coaching again');
+  assert.match(body, /docs\/voice\.md/, 'and names the standard to coach against');
+  assert.ok(!/none of them reads a sentence/.test(body),
+    'the interim claim that no lens reads a sentence is gone — it is no longer true');
+  // Still a request, never a gate (ADR 0241) — unchanged by this task.
+  assert.match(body, /REQUEST, not a gate/);
+});
+
+test('the cascade and the copy lens cover the SAME set by construction', () => {
+  // Both key off hasCopyOrVisualWork, so an artist review exists for exactly
+  // the ships a reader ran on. If these ever diverge, an artist is asked to
+  // coach a lens that never looked.
+  const cascadeSrc = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'cascade.js'), 'utf8');
+  const shipSrc = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  assert.match(cascadeSrc, /hasCopyOrVisualWork/);
+  assert.match(shipSrc, /hasCopyOrVisualWork/);
+});
+
+// ---- 8. COST ---------------------------------------------------------------
+
+test('the Reader sits at the heavy timeout tier, so it cannot change worst-case wall time', () => {
+  // The four already sit at 360s and workers run in parallel, so the panel's
+  // wall time is max() and a fifth at the same budget does not move it.
+  const t = WORKERS.timeoutForWorker(reader, {});
+  assert.equal(t, 360_000);
+  for (const k of ['narc', 'quality', 'hacker', 'efficiency']) {
+    assert.equal(WORKERS.timeoutForWorker(WORKERS.REGISTRY[k], {}), t, `${k} shares the tier`);
+  }
+});