@bongos/core 1.19.920 → 1.19.922

package/modules/lifecycle/removal-targets.js

@@ -0,0 +1,217 @@
+'use strict';
+
+// modules/lifecycle/removal-targets.js — WHOSE WORK a removal proposal is about
+// (task 1004099 / BV2.R16 brightness, goal 1000095; ADR 0321, under ADR 0313 +
+// ADR 0319).
+//
+// THE ONE FACT THIS FILE CARRIES. lifecycle_009 stores the VERDICT on a removal
+// proposal and the SHIP that deleted the files, and says outright that the list
+// of tasks whose work was removed is "deliberately not here — brightness designs
+// its own storage for targets when it needs one". Brightness needs one, because
+// the direction it reads is the opposite of the one the verdict row holds: it
+// asks "which previously-shipped tasks stopped counting", and `ship_task_id`
+// answers "which ship did the deleting". Those are different tasks, usually under
+// different ideas, and confusing them dims the wrong star.
+//
+// THE PROSE IS NOT THE RECORD. `cascade.js:removalProposalBody` already renders
+// the attribution for a person to read. removal-proposals.js refuses to parse it
+// back — "a body is written for a person to read, and a reader that silently
+// depends on its line shape breaks the day somebody improves the wording" — and
+// that refusal is only safe because of this table. Both the prose and these rows
+// are rendered from the SAME derivation output (`{ taskId, title, paths }` off
+// removal-derivation.js), so there is one source and they cannot disagree.
+//
+// WRITTEN WITH THE QUESTION, READ AFTER THE ANSWER. The attribution is only
+// available while the cascade runs: it comes from GitHub commit-history reads,
+// capped at eight paths per ship, on the server's shared push credential. Storing
+// it at proposal time and joining the verdict later is what keeps `confirm` a
+// pure database write instead of a second trip to GitHub against a history that
+// has since moved.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../src/module-api`. Nothing here imports another module; the economy module
+// reads it through the `lifecycle.removals` port, never by require (ADR 0083
+// rule 1).
+
+const api = require('../../src/module-api');
+
+const { pool } = api;
+
+// A positive integer id as it arrives off a row, a caller or a derivation —
+// where it may be a bigint serialised to a string. Anything else is dropped
+// rather than sent to the database, and never coerced with Number(), which
+// loses bigint precision. The same guard idea-size.js uses, for the same reason.
+function idOf(v) {
+  return /^[1-9]\d*$/.test(String(v)) ? String(v) : null;
+}
+
+// Paths as the derivation hands them: an array of non-empty strings. Anything
+// else becomes an empty array rather than a null, because the column is NOT NULL
+// and because the paths are the receipt, not the load-bearing half — a malformed
+// path list must not cost us the attribution it came with.
+function pathsOf(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter((p) => typeof p === 'string' && p.length > 0).map(String);
+}
+
+// recordRemovalTargets — store the attribution for ONE proposal.
+//
+//   proposalTaskId  the task the removal cascade filed
+//   removals        the derivation's output: [{ taskId, title, paths }]
+//
+// Returns the number of rows written (0 when there was nothing to attribute).
+//
+// IDEMPOTENT, because its caller is. The cascade re-runs on a re-ship and on a
+// reconciler sweep, and `createTask`'s (source, source_ref) idempotency hands
+// back the ORIGINAL proposal row rather than minting a second one — so this
+// writer is called again with the same proposal id. ON CONFLICT DO NOTHING makes
+// that a no-op instead of a duplicate-key throw that would surface as a cascade
+// error on every re-ship.
+//
+// DO NOTHING, NOT DO UPDATE, and that is a decision rather than a shortcut. A
+// second derivation of the same ship can legitimately find FEWER paths — the
+// commit-history walk is capped and rate-limited, and an exhausted page yields
+// no attribution at all. Overwriting would let a degraded second read erase a
+// good first one. The first attribution is the one taken while the diff was
+// freshest; it stands.
+//
+// A `title` in the derivation output is deliberately NOT stored: it is the
+// task's own title, which lives on `tasks` and can be joined for. Copying it
+// here would be a second copy that goes stale the first time a title is edited.
+//
+// NEVER THROWS INTO THE SHIP. The cascade runner catches everything and turns it
+// into a report, and this is called from inside that guard — but the ship has
+// already landed, been graded and been paid before any of this runs, so an
+// attribution that cannot be stored must cost the ship nothing. The caller
+// reports; it does not fail.
+async function recordRemovalTargets({ proposalTaskId, removals } = {}, { client = null } = {}) {
+  const proposal = idOf(proposalTaskId);
+  if (!proposal) return 0;
+
+  // De-duplicated on the way in. The derivation groups paths by task, so a
+  // repeat is not expected — but the primary key would reject the whole
+  // statement rather than the offending row, and a doubled pair inside ONE
+  // insert is not something ON CONFLICT rescues.
+  const byTask = new Map();
+  for (const r of Array.isArray(removals) ? removals : []) {
+    const taskId = idOf(r && r.taskId);
+    if (!taskId) continue;
+    if (byTask.has(taskId)) {
+      // Merge rather than drop: two entries for one task means the derivation
+      // split its paths, and losing half of them loses half the receipt.
+      const merged = new Set([...byTask.get(taskId), ...pathsOf(r.paths)]);
+      byTask.set(taskId, [...merged]);
+      continue;
+    }
+    byTask.set(taskId, pathsOf(r && r.paths));
+  }
+  if (byTask.size === 0) return 0;
+
+  const q = client || pool;
+  const payload = [...byTask.entries()].map(([taskId, paths]) => ({ taskId, paths }));
+
+  // ONE jsonb parameter, not two parallel arrays — and the reason is a trap
+  // worth naming. The obvious shape is `unnest($2::bigint[])` joined by
+  // ORDINALITY to `unnest($3::text[][])`, and it is wrong: a Postgres
+  // multidimensional array is rectangular and `unnest` FLATTENS it completely,
+  // so a task with two paths and a task with one do not even produce the same
+  // number of rows as their ids, and the ordinality join silently pairs the
+  // wrong path with the wrong task. jsonb keeps each task's paths nested where
+  // they belong, and it costs the same single round trip.
+  const { rowCount } = await q.query(
+    `INSERT INTO lifecycle_removal_targets (proposal_task_id, removed_task_id, paths)
+     SELECT $1::bigint,
+            (e->>'taskId')::bigint,
+            COALESCE(ARRAY(SELECT jsonb_array_elements_text(e->'paths')), '{}')
+       FROM jsonb_array_elements($2::jsonb) AS e
+     ON CONFLICT (proposal_task_id, removed_task_id) DO NOTHING`,
+    [proposal, JSON.stringify(payload)]
+  );
+  return rowCount || 0;
+}
+
+// confirmedRemovalsForTasks — of these tasks, which are named by a CONFIRMED
+// removal, and by which proposal.
+//
+// This is the read brightness is built on. Returns
+// Map<removedTaskIdString, { proposalTaskId, shipTaskId, paths, decidedAt }>;
+// a task absent from the map is alive. Only 'confirmed' rows join — a dismissed
+// proposal is a refactor or a move and must dim nothing, which is the entire
+// reason the verdict is a person's answer rather than a derived signal
+// (ADR 0313).
+//
+// ONE QUERY FOR THE WHOLE SET, not one per task: this runs behind a page of
+// ideas, each with a descent, and a per-task lookup would be a round trip per
+// node of every descent on screen.
+//
+// A task named by SEVERAL confirmed proposals collapses to the EARLIEST verdict.
+// Work can be deleted, re-added and deleted again, and the question brightness
+// asks is binary — is this alive — so the count of times it died is not the
+// fact. The earliest is kept because it is the one whose paths describe the
+// original removal rather than a later re-removal of something restored in
+// between, and because a stable pick makes the read deterministic.
+async function confirmedRemovalsForTasks(taskIds, { client = null } = {}) {
+  const ids = [...new Set((Array.isArray(taskIds) ? taskIds : []).map(idOf).filter(Boolean))];
+  const out = new Map();
+  if (ids.length === 0) return out;
+
+  const q = client || pool;
+  const { rows } = await q.query(
+    `SELECT tg.removed_task_id,
+            tg.proposal_task_id,
+            tg.paths,
+            v.ship_task_id,
+            v.decided_at
+       FROM lifecycle_removal_targets tg
+       JOIN lifecycle_removal_verdicts v ON v.proposal_task_id = tg.proposal_task_id
+      WHERE v.verdict = 'confirmed'
+        AND tg.removed_task_id = ANY($1::bigint[])
+      ORDER BY tg.removed_task_id, v.decided_at ASC, tg.proposal_task_id ASC`,
+    [ids]
+  );
+  for (const row of rows) {
+    const key = idOf(row.removed_task_id);
+    if (!key || out.has(key)) continue;   // ORDER BY put the earliest first
+    out.set(key, {
+      proposalTaskId: String(row.proposal_task_id),
+      shipTaskId: row.ship_task_id == null ? null : String(row.ship_task_id),
+      paths: Array.isArray(row.paths) ? row.paths : [],
+      decidedAt: row.decided_at || null,
+    });
+  }
+  return out;
+}
+
+// countUnattributedConfirmed — how many CONFIRMED removals name no target at all.
+//
+// The number nothing else can tell you, and the reason it is exported rather
+// than left implicit. A confirmed removal with no target rows is invisible to
+// brightness by construction: the work is genuinely gone, and no star dims for
+// it. That happens for proposals filed before lifecycle_010, for attributions
+// where every deletion predates `claims.published_head_sha`, and for a
+// derivation outage.
+//
+// Brightness cannot fix that — it does not know which idea to dim, and guessing
+// is worse than not dimming. What it can do is refuse to let the gap be silent.
+// A surface over the sky (BV2.R17/R18) can say "the sky may read brighter than
+// the truth by up to N confirmed removals", which is an honest caveat, where a
+// silently-optimistic picture is the quiet lie the spec names.
+async function countUnattributedConfirmed({ client = null } = {}) {
+  const q = client || pool;
+  const { rows } = await q.query(
+    `SELECT COUNT(*)::int AS n
+       FROM lifecycle_removal_verdicts v
+      WHERE v.verdict = 'confirmed'
+        AND NOT EXISTS (
+          SELECT 1 FROM lifecycle_removal_targets tg
+           WHERE tg.proposal_task_id = v.proposal_task_id
+        )`
+  );
+  return (rows[0] && rows[0].n) || 0;
+}
+
+module.exports = {
+  recordRemovalTargets,
+  confirmedRemovalsForTasks,
+  countUnattributedConfirmed,
+};

package/modules/lifecycle/routes/lifecycle.js

@@ -29,6 +29,7 @@ const lifecycle = require('../lifecycle');
 const db = require('../db');
 const cascade = require('../cascade');
 const removalDerivation = require('../removal-derivation');
+const removalTargets = require('../removal-targets');
 
 // task 1003549 — the cross-role cascade listener. `task.shipped` already exists
 // as a kernel event (emitted post-commit by the publish reconciler and the ship
@@ -102,6 +103,14 @@ function registerSeams() {
     removalCandidates: (task) => removalDerivation.removalCandidatesForTask(task, {
       shippedTasksByPublishedSha: (shas) => db.shippedTasksByPublishedSha(shas),
     }),
+    // WHOSE WORK IT WAS, stored (task 1004099 / BV2.R16 brightness). The
+    // derivation above already computed the attribution and the proposal body
+    // renders it as prose; this persists the same objects so brightness can
+    // read them structured. Passed as the NAMED function rather than wrapped in
+    // a closure, for the reason the note above gives: a closure here is not
+    // reachable from a test, and that is how the `number`/`pr_number` bug lived
+    // in production with a green suite.
+    recordRemovalTargets: removalTargets.recordRemovalTargets,
     log: api.logger ? api.logger('lifecycle') : null,
   }));
 }

package/modules/lifecycle/routes/removal-proposals.js

@@ -32,9 +32,34 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const proposals = require('../removal-proposals');
+const removalTargets = require('../removal-targets');
 
 const log = api.logger('lifecycle');
 
+// THE `lifecycle.removals` PORT (task 1004099 / BV2.R16 brightness).
+//
+// Brightness is the live share of an idea's descent, and it lives in the ECONOMY
+// module beside size — because it is a share of the same payouts, and putting it
+// in lifecycle would mean economy asking lifecycle for money arithmetic. That
+// makes "which of these tasks were removed" a cross-module read, and the one-way
+// rule (ADR 0083 rule 1) says it crosses through a kernel-mediated port, never a
+// require. This is the same shape as `ideas.descent`, which economy already
+// resolves for the descent walk itself.
+//
+// REGISTERED HERE, in a route file, because that is where a module's ports are
+// registered (the `ideas.capture` / `lifecycle.kickoffSeed` precedent) — the
+// registration runs when the module mounts, so nothing resolves a port from a
+// module that is switched off.
+//
+// RESOLVED OPTIONALLY on the far side. Economy degrades to "cannot attribute"
+// when lifecycle is absent rather than failing the read, so this is not declared
+// in economy's `consumes` — the same treatment `ideas.descent` gets, and the
+// reason `consumes` there is still `[]`.
+const removalsPort = Object.freeze({
+  confirmedRemovalsForTasks: removalTargets.confirmedRemovalsForTasks,
+  countUnattributedConfirmed: removalTargets.countUnattributedConfirmed,
+});
+
 // The floor: `task.promote` is Metic+ and is the atom the nod already carries,
 // which is what makes 'the same floor as the nod' a fact about the gate rather
 // than a claim in a comment.
@@ -48,6 +73,14 @@ const log = api.logger('lifecycle');
 module.exports = function buildRemovalProposalsRouter() {
   const router = express.Router();
 
+  // Guarded, because the router factory runs again every time a test rebuilds
+  // it and registerProvider THROWS on a duplicate — a port is single-provider by
+  // design. The `lifecycle` port's own registration in routes/lifecycle.js uses
+  // the identical guard for the identical reason.
+  if (!api.hasProvider('lifecycle.removals')) {
+    api.registerProvider('lifecycle.removals', removalsPort);
+  }
+
   // GET /removal-proposals — the removal questions nobody has answered yet.
   //
   // rank: metic+archon (task.promote). No client-side rank gate is needed or wanted in the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.920",
+  "version": "1.19.922",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.920",
+      "version": "1.19.922",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.920",
+  "version": "1.19.922",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -30,7 +30,7 @@
 
 const path = require('path');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
-const { standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, dbName, instanceUser, standaloneRoot } = require('./provision-repo.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 
 // The shapes whose box this runner can actually reach. Mirrors UPGRADE_SHAPES in the
@@ -186,7 +186,31 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // the silent thirteen-release revert upgrade.js's own header records.
   const healthUrl = `http://127.0.0.1:${inst.port}/healthz`;
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
-  const sudoP = privileged ? 'sudo ' : '';
+  // WHO THE UPGRADE RUNS AS, AND WHICH DATABASE IT NAMES (task 1004119).
+  //
+  // A bare `sudo` runs as ROOT, and both halves of the upgrade resolve against the
+  // CURRENT OS USER rather than a flag:
+  //
+  //   • migrate.sh peer-auths over the local socket as whoever invoked it, and `root`
+  //     is almost never a Postgres role — pre-flight refuses with "Postgres has no
+  //     role root" before the pin moves (correctly; the pin must not move for a
+  //     migrate that cannot run).
+  //   • with no PGDATABASE, resolveInstanceDb() has to FIND the database by loading
+  //     node_modules/@bongos/core/src/bongos/pool from the instance root. An adopted
+  //     repo that installs its workspaces rather than its root has no core there, so
+  //     the name cannot be resolved at all.
+  //
+  // Both were live on 2026-09-20: four presses of the owner's Upgrade button, four
+  // pre-flight refusals, no instance ever moved. The helpers to fix it already sat in
+  // provision-repo.js — this leg simply never used them.
+  //
+  // The account is the instance's own (`bongos-<slug>`), which is ALSO the name of its
+  // Postgres login role (instanceDbRole), so peer auth lands on a role that owns
+  // exactly that instance's database. The control plane is the exception: it is not a
+  // provisioned tenant and has no `bongos-` account — it runs as APP_USER, the operator
+  // the recipe's gate-3 invocation names.
+  const runAs = inst.hosting_shape === 'control-plane' ? APP_USER : instanceUser(inst);
+  const sudoP = privileged ? `sudo -u ${runAs} env PGDATABASE=${dbName(inst)} ` : '';
   // WHERE THE CLI LIVES AND WHERE THE TARGET LIVES ARE DIFFERENT PLACES (task 1004053).
   //
   // `scripts/gds/upgrade.js` ships in the CORE checkout. A provisioned instance root holds

package/scripts/gds/run-unit-tests.js

@@ -231,9 +231,25 @@ const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
 // line so a suite that prints skips without a summary suffix is still surfaced.
 const SKIP_LINE_RE = /^\s*SKIP\b/;
 
+// node:test suites print no SKIP line at all — they report `ℹ skipped N` in their own summary
+// (task 1004112). Until this, every skip in a node:test suite was INVISIBLE to the roll-up whose
+// entire purpose is to say "a skipped case is not a passing one": the suite printed `ok`, the
+// roll-up counted nothing, and the unrun coverage vanished without a trace.
+//
+// Found while fixing this counter's own subject. Gating four unevaluable cases in
+// tests/skip_is_not_pass.mjs turned four honest FAILURES into four invisible skips — the 1003993
+// defect reappearing one layer up, in the file written to prevent it. A skip that nothing counts
+// is a pass with extra steps.
+const NODE_TEST_SKIP_RE = /^\s*(?:ℹ|#)\s*skipped\s+(\d+)\s*$/m;
+
 function countSkips(stdout) {
   if (!stdout) return 0;
-  return stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+  const lines = stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+  // The two formats are mutually exclusive in practice (a suite is either the project's own
+  // harness or node:test), but SUM rather than branch: a suite that grew both would otherwise
+  // report whichever we happened to check first, and under-reporting is the failure mode here.
+  const m = stdout.match(NODE_TEST_SKIP_RE);
+  return lines + (m ? Number(m[1]) : 0);
 }
 
 function isCleanTeardownAbort(stdout, stderr) {

package/scripts/gds/ship-flow.js

@@ -74,6 +74,11 @@ async function shipMain() {
   // task 1003950: set only when the empty-diff guard below classifies this ship as a
   // deliberate no-artifact close. Gates the auto-escalation at the confirm wall.
   let noArtifactClose = false;
+  // task 1004011: this ship has no committed diff, so the grade's subject is the
+  // builder's CLAIM (notes + value summary) rather than a diff. Distinct from
+  // noArtifactClose, which marks the older "reached the archon gate" case: a ship
+  // can now be no-artifact and still fully graded, which is the point.
+  let noArtifactGrade = false;
   // task 1002605 (G-18): explicit opt-in to continue past a FAILED production
   // smoke run. Without it a smoke FAIL now ABORTS before the claim resolves
   // (claim intact); with it, the resolve proceeds and the task deliberately
@@ -267,16 +272,45 @@ async function shipMain() {
       process.exit(1);
     }
     // verdict.reason === 'allow-empty': a deliberate no-artifact / DB-only ship.
-    // There is no committed diff for the subagent grader to read, so confirm
-    // directly (this is the DB-only path the old --skip-grade route served).
-    if (!skipGrade) skipGrade = true;
+    //
+    // task 1004011 (ADR 0320): this used to force `skipGrade = true` — no grade at
+    // all, then the Archon-only `task.confirm.grade_bypass` gate. Both halves were
+    // wrong. An empty diff is not an UNGRADED diff, it is a diff the grader has
+    // nothing to say about, so it should not need the key that ratifies past a
+    // FAILING grade. And something here does deserve adversarial scrutiny: not the
+    // absent diff, but the CLAIM that nothing was needed. "The premise was already
+    // fixed", "this was a pure ops verification" are assertions the ledger records
+    // and, until now, nothing checked.
+    //
+    // So the grader is no longer skipped — it is re-pointed at the notes. A pass is
+    // a REAL passing grade and confirms through the ordinary rank-open path; a fail
+    // is a real fail, and the builder fixes the evidence rather than reaching for a
+    // permission. skipGrade stays false; only an explicit --skip-grade still skips.
+    // Set only when a grade will actually run. With --skip-grade (or the server-side
+    // grader_bypass, which forces skipGrade above) the `if (!skipGrade)` gate below
+    // skips grading entirely and this flag would be inert — but an inert flag makes a
+    // reader trace two of them to see why nothing happened, and invites a later
+    // refactor to treat it as "this ship graded its notes" when it graded nothing.
+    noArtifactGrade = !skipGrade;
     // task 1003950: mark WHY the grader is being skipped. A --skip-grade ship past a
     // failing grade and a genuinely artifact-free close both reach the same archon
     // gate below, but only the second one may be escalated automatically — the first
     // has a diff the grader DID read and reject, and auto-filing a blocker for it
     // would be a builder routing their own rejected work to an override queue.
+    //
+    // Still set, and still needed: since task 1004011 this close reaches the archon
+    // gate only when the builder ALSO passed --skip-grade, or the server bypassed
+    // the grader for them. Those are the cases where the escalation split still
+    // decides which refusal is printed.
     noArtifactClose = true;
-    console.log('--allow-empty: no committed diff (no-artifact / DB-only ship) — confirming directly without the subagent grader.');
+    console.log('--allow-empty: no committed diff (no-artifact / DB-only ship).');
+    if (noArtifactGrade) {
+      console.log('  The grader is not skipped — it is re-pointed: your handoff notes and value summary are graded');
+      console.log('  against the task description, so the claim that nothing was needed is what gets checked (task 1004011).');
+    } else {
+      console.log('  The grader is skipped (--skip-grade / server bypass), so the claim is NOT checked — this close');
+      console.log('  routes to the archon confirm gate. Drop --skip-grade to have your notes graded instead.');
+    }
   }
 
   // ---- Module drift check (BV1.R53, task 1422) ----
@@ -411,10 +445,15 @@ async function shipMain() {
   if (!skipGrade) {
     const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
     fullTaskForGrade = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
-    console.log('Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
+    console.log(noArtifactGrade
+      ? 'Starting the no-artifact grader over your notes (overlaps the smoke run — task 1002660)...'
+      : 'Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
     gradeCompute = computeGradeResult({
       taskId, task: fullTaskForGrade, summary,
       baseline: graderBaseline, committedFiles,
+      // task 1004011: present ⇒ grade the claim, not the (empty) diff. The notes
+      // are the evidence, so they have to travel with it.
+      noArtifact: noArtifactGrade ? { notes } : null,
     });
     gradeCompute.catch(() => {}); // an abort path must not die on an unhandled rejection
   }
@@ -613,12 +652,16 @@ async function shipMain() {
     gradePassed = true; // by builder fiat, not by grader
   } else if (passed && taskStatus === 'completed') {
     console.log('');
-    console.log('Running subagent quality grader...');
+    console.log(noArtifactGrade
+      ? 'Running the no-artifact grader (subject: your claim that nothing was needed)...'
+      : 'Running subagent quality grader...');
 
     // #513 + #536: the grader reads COMMITTED history (baseline...HEAD), not
     // the working tree. The empty-committed-diff guard now runs earlier — BEFORE
     // the claim is resolved (see above) — so by the time we reach here the diff
-    // is guaranteed non-empty on the grader path. Reuse the baseline + file list
+    // is guaranteed non-empty on the grader path, EXCEPT on the task 1004011
+    // no-artifact species, where it is guaranteed empty and the notes are the
+    // subject instead. Reuse the baseline + file list
     // computed there so we don't diff twice. #678: gradeAndRecord POSTs the
     // result and logs the panel cost — the same unit the --regrade path reuses.
     // task 1002660: the panel computation was started BEFORE the smoke gate
@@ -631,6 +674,10 @@ async function shipMain() {
       baseline: graderBaseline,
       committedFiles,
       precomputed: gradeCompute,
+      // No `noArtifact` here on purpose: `precomputed` is ALWAYS set on this path, and
+      // gradeAndRecord only falls back to computing inline when it is absent. Passing it would be
+      // unreachable by construction — defensive symmetry that reads like a live argument. The
+      // species reaches the grader through gradeCompute above, which was built with it.
     });
 
     if (!gradePost.ok) {

package/scripts/gds/ship-grade-steps.js

@@ -19,7 +19,7 @@ const { plainCardLines } = require('./plain-cards.js');
 // so the grader outage explains itself with the same `claude CLI` verdict doctor
 // gives, and the two can never drift.
 const { preflightChecks } = require('./preflight.js');
-const { computeRawDiffHash, reconstructPanelIssues, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
+const { computeRawDiffHash, reconstructPanelIssues, runNoArtifactGrader, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
 
 // ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
 //
@@ -168,7 +168,41 @@ function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits
 // writes, so shipMain can start it before the smoke gate and overlap the
 // multi-minute panel with smoke + the claim resolve. Returns
 // { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
-async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
+// `runNoArtifact` / `runDiffGrader` are injection seams, defaulted to the real
+// runners. The routing decision and the diff-hash policy below are the parts worth
+// testing, and BOTH real runners spawn a model — a test that had to spawn one to
+// reach them would be slow, billable and non-deterministic, so it would not be
+// written, so they would not be covered. Both seams exist because the negative case
+// matters as much as the positive one: "an ordinary ship must NOT reach the
+// no-artifact grader" is only assertable if the ordinary path can be reached
+// without paying for a panel. Production passes neither.
+async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null, noArtifact = null, runNoArtifact = runNoArtifactGrader, runDiffGrader = runSubagentGrader }) {
+  // task 1004011: the no-artifact species. There is no diff, so every step below
+  // this is inapplicable rather than merely empty — the hash is of nothing, the
+  // reuse lookup would match any other empty-diff grade on this task, and the
+  // panel has no subject. Return early with the claim graded instead.
+  //
+  // `noArtifact` carries the notes, because they are the EVIDENCE here and this
+  // function is otherwise handed only the diff-derived inputs.
+  //
+  // `priorRound` is DELIBERATELY not threaded through. It is the delta-aware re-grade
+  // context (task 1002662): the prior round's findings, the builder's response, and
+  // the INTERIM DIFF between the previously graded HEAD and now. On a no-artifact
+  // ship there is no interim diff by construction, and --regrade refuses an empty
+  // diff anyway (task 1003950), so there is no path that reaches here with a
+  // meaningful prior round. Passing it would look like remediation context while
+  // carrying nothing that applies. Named here so the omission reads as a decision.
+  if (noArtifact) {
+    const gradeResult = await runNoArtifact({
+      task, valueSummary: summary, notes: noArtifact.notes,
+    });
+    // currentHash stays null on purpose: diff_hash is the reuse key for a grade
+    // over a diff, and storing a hash of the empty diff would let the NEXT
+    // empty-diff ship of this task reuse THIS grade — a different claim,
+    // different notes, silently inheriting a pass it never earned.
+    return { kind: 'fresh', currentHash: null, gradeResult };
+  }
+
   // Compute the fingerprint of the raw (untruncated) diff so we can compare
   // against any stored grade, independent of the display-truncation cap.
   const currentHash = computeRawDiffHash(baseline);
@@ -205,7 +239,7 @@ async function computeGradeResult({ taskId, task, summary, baseline, committedFi
     }
   }
 
-  const gradeResult = await runSubagentGrader({
+  const gradeResult = await runDiffGrader({
     task,
     valueSummary: summary,
     baseline,
@@ -225,9 +259,13 @@ async function computeGradeResult({ taskId, task, summary, baseline, committedFi
 // (a promise from computeGradeResult, task 1002660) lets the ship path hand in
 // the overlapped computation; the --regrade path passes nothing and computes
 // inline — behavior identical to the pre-split gradeAndRecord either way.
-async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null }) {
+async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null, noArtifact = null }) {
+  // task 1004011: forwarded so the two entry points cannot diverge. The ship path
+  // hands in `precomputed` (the overlapped promise) and never reaches the inline
+  // call; anything computing inline must be able to reach the no-artifact species
+  // too, or the next caller silently grades an empty diff with the panel.
   const computed = await (precomputed
-    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound }));
+    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound, noArtifact }));
 
   if (computed.kind === 'reuse') {
     const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };

package/scripts/gds/ship-grade.js

@@ -344,6 +344,41 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
   return result;
 }
 
+// task 1004011: the no-artifact twin of runSubagentGrader. Same station in the
+// ship, different subject — there is no diff, so the thing graded is the builder's
+// CLAIM that none was needed (modules/grading/grader-no-artifact.js, ADR 0320).
+//
+// WHY a separate runner rather than a flag on the one above: every input that one
+// assembles is diff-derived (changed files, the unified diff, the shortstat, the
+// generated-provenance check, the deterministic route-rank and permission-path
+// pre-passes over the changed files). On an empty diff each of those is an empty
+// set, and an empty set fed to a check that reports "no hits" is a check that
+// passes vacuously — the exact failure mode task 1002646's Guard 1b exists to
+// catch server-side. Threading `if (empty)` through all of them would be a wider
+// change with more places to get that wrong than a sibling that never computes
+// them at all.
+async function runNoArtifactGrader({ task, valueSummary, notes, runOpts: extraOpts = {} }) {
+  const builderModel = resolveBuilderModel();
+  const graderModel = grader.selectGraderModel({ builderModel });
+  const runOpts = {
+    timeoutMs: GRADER_TIMEOUT_MS,
+    cwd: process.cwd(), // grade from the FEATURE worktree — the Read tool is the only evidence check here
+    ...extraOpts,
+  };
+  console.log(`  subagent grader ${grader.VERSION}: NO-ARTIFACT grade (empty committed diff) — one generalist shot over the handoff notes + value summary, model=${graderModel}`);
+  console.log(`  subject: the CLAIM that nothing was needed, judged against the task description — not a diff, and not the absence of one`);
+  console.log(`  gate: unchanged — functional_fidelity>=${grader.THRESHOLD} AND code_quality>=${grader.THRESHOLD} AND confidence>=0.4, re-asked for this species (is it genuinely artifact-free / is the evidence checkable)`);
+  const t0 = Date.now();
+  const result = await grader.gradeNoArtifact({ task, valueSummary, notes, builderModel, runOpts });
+  result.signals = {
+    ...(result.signals || {}),
+    wall_ms: Date.now() - t0,
+    changed_files_count: 0,
+    graded_head_sha: gitOk('git rev-parse HEAD') || null,
+  };
+  return result;
+}
+
 function runSmoke() {
   // `cwd: REPO_ROOT` + a relative script path is robust to spaces or other
   // shell metacharacters that may appear in the absolute repo path on some
@@ -376,6 +411,7 @@ module.exports = {
   diffHash,
   reconstructPanelIssues,
   resolveBaseRef,
+  runNoArtifactGrader,
   runSmoke,
   runSmokeAsync,
   runSubagentGrader,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.920'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.922'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');