@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/ship-git.js

@@ -1,100 +1,6 @@
-// scripts/gds/ship-git.js — the shell/git/argv runners and the injection-safe merge-argv builders.
-//
-// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
-// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
-// original ship.js lines 560-638 unchanged. ship.js remains the facade that
-// re-exports every name and owns the CLI entry point, so the ship contract and
-// every flag are untouched, and the other scripts that import from it are too.
-
+// scripts/gds/ship-git.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/ship-git.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { execSync, execFileSync } = require('node:child_process');
-
-function gitOk(cmd, opts = {}) {
-  try {
-    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], ...opts }).trim();
-  } catch (_) {
-    return null;
-  }
-}
-
-function shellOk(cmd, opts = {}) {
-  try {
-    execSync(cmd, { stdio: 'inherit', ...opts });
-    return true;
-  } catch (_) {
-    return false;
-  }
-}
-
-// argvOk / argvOut — the two no-shell exec primitives behind the git/gh wrappers.
-// Run `<cmd> <args...>` so each arg reaches the program as a literal argv element
-// (never interpolated into a shell string) — the discipline that closes the
-// autoMerge injection (#681), since branch names + DB-sourced value_summary flow
-// through here. `shell: false` is forced AFTER the opts spread so a caller can
-// never pass `{ shell: true }` and silently re-enable shell interpretation — the
-// no-shell guarantee is the whole point and must not be overridable.
-//   argvOk  — exit status only → boolean (gitArgvOk / ghArgvOk). stdio 'inherit'.
-//   argvOut — capture trimmed stdout → string|null (ghJson / fetchDeployedVersion).
-//             Default stdio captures BOTH stdout and stderr; a caller that must
-//             DISCARD stderr passes its own `stdio: ['ignore','pipe','ignore']`.
-function argvOk(cmd, args, opts = {}) {
-  try {
-    execFileSync(cmd, args, { stdio: 'inherit', ...opts, shell: false });
-    return true;
-  } catch (_) {
-    return false;
-  }
-}
-
-function argvOut(cmd, args, opts = {}) {
-  try {
-    return execFileSync(cmd, args, {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-      ...opts,
-      shell: false,
-    }).trim();
-  } catch (_) {
-    return null;
-  }
-}
-
-// gitArgvOk — the git boolean runner. The boolean/`stdio:'inherit'` contract
-// matches shellOk so callers can swap one for the other; see buildMergeArgv + the
-// #681 regression test.
-function gitArgvOk(args, opts = {}) {
-  return argvOk('git', args, opts);
-}
-
-// sanitizeGitHubRefs — rewrite "#NNN" → "task NNN" in any text that lands on a
-// GitHub-rendered surface that can't carry a markdown link (commit messages,
-// PR titles). GitHub autolinks every bare "#NNN" there to its OWN PR/issue
-// number space, which our GDS task ids long since diverged from — so a value
-// summary like "#914 player straw hat" rendered a dead link to issues/914 on
-// every merge commit (task 916). Pure + exported for the regression test.
-function sanitizeGitHubRefs(text) {
-  return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-}
-
-// buildMergeArgv — construct the argv for the auto-merge commit. Pure +
-// exported so the regression test can assert the untrusted value_summary lands
-// as a single literal argv element (never spliced into a shell string). The
-// merge message is `Merge <branch>: <summary>` with task refs de-#-ed (commit
-// messages can't carry markdown links, so a bare "#NNN" would autolink to a
-// dead GitHub issue — task 916); transport stays argv, never a shell string.
-function buildMergeArgv(branch, valueSummary) {
-  const summary = sanitizeGitHubRefs(valueSummary) || `(no value summary)`;
-  const mergeMsg = `Merge ${branch}: ${summary}`;
-  return ['merge', '--no-ff', branch, '-m', mergeMsg];
-}
-
-module.exports = {
-  argvOk,
-  argvOut,
-  buildMergeArgv,
-  gitArgvOk,
-  gitOk,
-  sanitizeGitHubRefs,
-  shellOk,
-};
+require('../bongos/forwarder.js').forward(module, 'ship-git.js');

package/scripts/gds/ship-grade-steps.js

@@ -1,547 +1,6 @@
-// scripts/gds/ship-grade-steps.js — the grade step shared by shipMain and regradeMain: payload, reuse, scoring, printing.
-//
-// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
-// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
-// original ship.js lines 2580-2927 unchanged. ship.js remains the facade that
-// re-exports every name and owns the CLI entry point, so the ship contract and
-// every flag are untouched, and the other scripts that import from it are too.
-
+// scripts/gds/ship-grade-steps.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/ship-grade-steps.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-const { getServerReward } = require('./ship-state.js');
-
-const fs = require('node:fs');
-const os = require('node:os');
-const { cliClient, rewardPolicy } = require('./cli-lib');
-const { gitOk } = require('./ship-git.js');
-const { resolveInstanceBase } = require('./ship-deploy-target.js');
-const { plainCardLines } = require('./plain-cards.js');
-// task 1003313: the shared onboarding/doctor preflight — reused (not duplicated)
-// so the grader outage explains itself with the same `claude CLI` verdict doctor
-// gives, and the two can never drift.
-const { preflightChecks } = require('./preflight.js');
-const { computeRawDiffHash, reconstructPanelIssues, runNoArtifactGrader, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
-// task 1002903: the severity gate's own reading of which low scores had no finding.
-const { unbackedLowScores } = require('../../modules/grading/grader-workers/worker-verdict.js');
-
-// ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
-//
-// #678: the grade step is factored out of shipMain so the `--regrade` recovery
-// path can reuse it verbatim instead of replicating ~50 lines (the trap that
-// learning #43 warned about — "runSubagentGrader in ship.js is NOT exported, so
-// replicate its ~10 lines"). These helpers are behavior-preserving lifts of the
-// inline blocks shipMain used before; both paths now share one implementation.
-
-// Map a grader result into the POST /tasks/:id/grade request body. Forwards the
-// advisory sub-scores (economy/security/efficiency) only when present so the
-// server's validateAndScore re-records them (back-compat: omitted when null).
-function buildGradePayload(gradeResult, committedFiles = null) {
-  return {
-    // touches[] cleanup [3/8] (task 878): pass the real committed changed-files
-    // so the server keys the shipper badges off the diff, not touches[].
-    ...(Array.isArray(committedFiles) && committedFiles.length > 0
-      ? { committed_files: committedFiles }
-      : {}),
-    subagent_output: {
-      functional_fidelity: gradeResult.rubric_scores?.functional_fidelity,
-      code_quality: gradeResult.rubric_scores?.code_quality,
-      ...(gradeResult.rubric_scores?.economy != null
-        ? { economy: gradeResult.rubric_scores.economy }
-        : {}),
-      ...(gradeResult.rubric_scores?.security_score != null
-        ? { security_score: gradeResult.rubric_scores.security_score }
-        : {}),
-      ...(gradeResult.rubric_scores?.efficiency_score != null
-        ? { efficiency_score: gradeResult.rubric_scores.efficiency_score }
-        : {}),
-      notes_md: gradeResult.notes_md,
-      confidence: gradeResult.signals?.confidence ?? null,
-      issues: gradeResult.issues,
-    },
-    signals: gradeResult.signals,
-  };
-}
-
-// Log the grader panel's own API spend (#486 / ADR 0028 path 1). Best-effort +
-// idempotent on (source, source_ref): a cost-log failure must never block a
-// ship/re-grade, and re-grading at the same HEAD is a no-op.
-async function logGraderPanelCost(taskId, gradeResult) {
-  const panelCostUsd = Number(gradeResult.panel_cost_usd) || 0;
-  if (panelCostUsd <= 0) return;
-  const headSha = gitOk('git rev-parse --short HEAD') || 'nohead';
-  const costPost = await (await cliClient()).cost.postCost({
-    body: {
-      task_id: Number(taskId),
-      amount_usd: panelCostUsd,
-      category: 'api',
-      source: 'grader',
-      source_ref: `grade-${taskId}-${headSha}`,
-      description: `grader panel (${gradeResult.grader_kind || 'subagent'}) on #${taskId}`,
-    },
-  });
-  // An idempotent conflict returns HTTP 200 {skipped:true} (cost.js), so
-  // costPost.ok is TRUE on a skip — check `skipped` first.
-  if (costPost.data && costPost.data.skipped) {
-    console.log(`  grader cost already logged for ${headSha} (idempotent skip)`);
-  } else if (costPost.ok) {
-    console.log(`  grader cost logged: $${panelCostUsd.toFixed(4)} → cost_log (category=api, source=grader)`);
-  } else {
-    console.log(`  grader cost log skipped (non-fatal): HTTP ${costPost.status}`);
-  }
-}
-
-// task 1002662: assemble the delta-aware prior-round context for a --regrade.
-// Pure (no git/network) so the payload shape is unit-tested. Returns null when
-// there is no prior grade worth being delta-aware of; otherwise:
-//   forPanel — { round, findings_md, response_md, interim_md } for the worker
-//              prompts (fenced as untrusted by the shared scaffold);
-//   audit    — the compact regrade block recorded into the new grade's signals
-//              so grade_attempts rounds read as remediation history (the
-//              task-1002661 reader consumes this).
-// The prior round's findings, from EITHER grade shape (task 1003488).
-//
-// A grade exists in two shapes and this function is handed both. The in-memory
-// result `validateAndScore`/`serverSideGuards` return carries `issues` at the top
-// level; a grade READ BACK from the API does not, because `task_grades` has no
-// `issues` column and `db-grade.js` deliberately writes them into the signals
-// jsonb instead. `--regrade` passes the DB row (`ship-flow.js`: `tRes.data.grade`),
-// so reading only the top-level key silently yielded [] on every re-grade — the
-// panel was told it was on round N while being handed nothing about round N-1,
-// and the "answered findings can only re-veto with NEW evidence" protection
-// (task 1002662) cannot hold when the answered findings are invisible.
-//
-// Top level wins when present so an in-memory result keeps its exact behaviour;
-// `signals.issues` is the stored fallback. Mirrors how the caller already reaches
-// for `signals.graded_head_sha` three lines from where it passes this row in.
-function priorFindings(storedGrade) {
-  if (Array.isArray(storedGrade.issues)) return storedGrade.issues;
-  const fromSignals = storedGrade.signals && storedGrade.signals.issues;
-  return Array.isArray(fromSignals) ? fromSignals : [];
-}
-
-const PRIOR_ROUND_TEXT_CAP = 4000;
-function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits = '', interimDiffStat = '' }) {
-  if (!storedGrade || typeof storedGrade !== 'object') return null;
-  const issues = priorFindings(storedGrade);
-  const notes = typeof storedGrade.notes_md === 'string' ? storedGrade.notes_md.trim() : '';
-  if (issues.length === 0 && !notes) return null;
-  const verdictLine = `Prior verdict: ${storedGrade.passed ? 'PASS' : 'FAIL'} · score ${storedGrade.score ?? '?'}/10 · ${issues.length} finding(s)`;
-  const findingLines = issues.map((it) => `- [${it.severity || '?'}] ${it.worker || 'panel'} · ${it.file || '?'} — ${it.summary || ''}`);
-  const findings_md = [
-    verdictLine,
-    '',
-    ...(findingLines.length ? findingLines : ['(no per-finding rows — see the prior notes below)']),
-    ...(notes ? ['', 'Prior panel notes:', notes.slice(0, PRIOR_ROUND_TEXT_CAP)] : []),
-  ].join('\n');
-  const interimParts = [];
-  if (interimCommits) interimParts.push('Interim commits since the prior grade:', String(interimCommits).slice(0, PRIOR_ROUND_TEXT_CAP));
-  if (interimDiffStat) interimParts.push('', 'Interim diffstat:', String(interimDiffStat).slice(0, PRIOR_ROUND_TEXT_CAP));
-  const response = String(responseText || '').trim();
-  // Round numbering is self-consistent across regrades: the first grade is
-  // round 1; each regrade reads the prior signals.regrade.round when present.
-  const round = (Number(storedGrade.signals?.regrade?.round) || 1) + 1;
-  return {
-    forPanel: {
-      round,
-      findings_md,
-      response_md: response ? response.slice(0, PRIOR_ROUND_TEXT_CAP) : null,
-      interim_md: interimParts.length ? interimParts.join('\n') : null,
-    },
-    audit: {
-      round,
-      prior_passed: storedGrade.passed === true,
-      prior_score: storedGrade.score ?? null,
-      prior_findings_count: issues.length,
-      response_present: Boolean(response),
-      interim_present: Boolean(interimCommits || interimDiffStat),
-    },
-  };
-}
-
-// Run the subagent grader against the committed diff, POST the result to the
-// rank-open /tasks/:id/grade endpoint, and log the panel cost on success.
-// Returns the raw apiCall response so the caller can branch on .ok / read the
-// grade. Shared by the ship path and the --regrade path.
-//
-// V4.R08: before spawning the adversarial panel we compute the raw diff hash
-// and check whether a stored PASS grade exists for the same hash. On a match
-// we re-POST the stored grade (marking it reused in signals) and skip the
-// panel entirely — cheap re-ships with an unchanged diff stay fast.
-// task 1002660: the COMPUTE half — the reuse lookup + the panel run. No server
-// writes, so shipMain can start it before the smoke gate and overlap the
-// multi-minute panel with smoke + the claim resolve. Returns
-// { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
-// `runNoArtifact` / `runDiffGrader` are injection seams, defaulted to the real
-// runners. The routing decision and the diff-hash policy below are the parts worth
-// testing, and BOTH real runners spawn a model — a test that had to spawn one to
-// reach them would be slow, billable and non-deterministic, so it would not be
-// written, so they would not be covered. Both seams exist because the negative case
-// matters as much as the positive one: "an ordinary ship must NOT reach the
-// no-artifact grader" is only assertable if the ordinary path can be reached
-// without paying for a panel. Production passes neither.
-async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null, noArtifact = null, runNoArtifact = runNoArtifactGrader, runDiffGrader = runSubagentGrader }) {
-  // task 1004011: the no-artifact species. There is no diff, so every step below
-  // this is inapplicable rather than merely empty — the hash is of nothing, the
-  // reuse lookup would match any other empty-diff grade on this task, and the
-  // panel has no subject. Return early with the claim graded instead.
-  //
-  // `noArtifact` carries the notes, because they are the EVIDENCE here and this
-  // function is otherwise handed only the diff-derived inputs.
-  //
-  // `priorRound` is DELIBERATELY not threaded through. It is the delta-aware re-grade
-  // context (task 1002662): the prior round's findings, the builder's response, and
-  // the INTERIM DIFF between the previously graded HEAD and now. On a no-artifact
-  // ship there is no interim diff by construction, and --regrade refuses an empty
-  // diff anyway (task 1003950), so there is no path that reaches here with a
-  // meaningful prior round. Passing it would look like remediation context while
-  // carrying nothing that applies. Named here so the omission reads as a decision.
-  if (noArtifact) {
-    const gradeResult = await runNoArtifact({
-      task, valueSummary: summary, notes: noArtifact.notes,
-    });
-    // currentHash stays null on purpose: diff_hash is the reuse key for a grade
-    // over a diff, and storing a hash of the empty diff would let the NEXT
-    // empty-diff ship of this task reuse THIS grade — a different claim,
-    // different notes, silently inheriting a pass it never earned.
-    return { kind: 'fresh', currentHash: null, gradeResult };
-  }
-
-  // Compute the fingerprint of the raw (untruncated) diff so we can compare
-  // against any stored grade, independent of the display-truncation cap.
-  const currentHash = computeRawDiffHash(baseline);
-
-  if (currentHash) {
-    const storedGradeRes = await (await cliClient()).tasks.getTasksId({ id: taskId, query: { include: 'grade' } });
-    const storedGrade = storedGradeRes.ok ? (storedGradeRes.data.grade ?? null) : null;
-
-    if (shouldReuseGrade(storedGrade, currentHash)) {
-      console.log('  Grade reuse: stored PASS grade matches current diff hash — skipping panel.');
-      // Reuse the stored result with a reused marker so the audit trail is
-      // complete. We keep the original grader_kind and inject reuse metadata
-      // into signals so a bare table scan can spot reused grades.
-      const reusedSignals = {
-        ...(storedGrade.signals || {}),
-        reused_from_diff_hash: storedGrade.diff_hash,
-        reused_at: new Date().toISOString(),
-      };
-      const reusedResult = {
-        passed:        storedGrade.passed,
-        score:         storedGrade.score,
-        threshold:     storedGrade.threshold,
-        grader_kind:   storedGrade.grader_kind,
-        grader_version: storedGrade.grader_version,
-        rubric_scores: storedGrade.rubric_scores,
-        notes_md:      storedGrade.notes_md,
-        signals:       reusedSignals,
-        // task 1002660: carry the original panel's issues (rebuilt from
-        // signals.workers[].issues — the row stores them nowhere else) so the
-        // reused PASS stands on the same substance/evidence it passed with.
-        issues:        reconstructPanelIssues(storedGrade.signals),
-      };
-      return { kind: 'reuse', currentHash, reusedResult };
-    }
-  }
-
-  const gradeResult = await runDiffGrader({
-    task,
-    valueSummary: summary,
-    baseline,
-    changedFiles: committedFiles,
-    priorRound: priorRound?.forPanel ?? null,
-  });
-  // task 1002662: record the regrade audit block on the new grade's signals so
-  // this round is readable as remediation history (grade_attempts keeps one row
-  // per round; the latest grade's signals.regrade names what it responded to).
-  if (priorRound?.audit) {
-    gradeResult.signals = { ...(gradeResult.signals || {}), regrade: priorRound.audit };
-  }
-  return { kind: 'fresh', currentHash, gradeResult };
-}
-
-// The RECORD half: POST the computed grade + log the panel cost. `precomputed`
-// (a promise from computeGradeResult, task 1002660) lets the ship path hand in
-// the overlapped computation; the --regrade path passes nothing and computes
-// inline — behavior identical to the pre-split gradeAndRecord either way.
-async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null, noArtifact = null }) {
-  // task 1004011: forwarded so the two entry points cannot diverge. The ship path
-  // hands in `precomputed` (the overlapped promise) and never reaches the inline
-  // call; anything computing inline must be able to reach the no-artifact species
-  // too, or the next caller silently grades an empty diff with the panel.
-  const computed = await (precomputed
-    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound, noArtifact }));
-
-  if (computed.kind === 'reuse') {
-    const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };
-    return (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
-    // No logGraderPanelCost — the panel didn't run, there's no cost to log.
-  }
-
-  const { gradeResult } = computed;
-  const payload = { ...buildGradePayload(gradeResult, committedFiles), diff_hash: computed.currentHash ?? undefined };
-  const gradePost = await (await cliClient()).tasks.postTasksIdGrade({ id: taskId, body: payload });
-  // Log the panel's cost once the grade is recorded — independent of the
-  // pass/fail VERDICT (the panel ran, and cost money, either way), but only
-  // when the POST itself succeeded (a failed POST means nothing was recorded).
-  if (gradePost.ok) await logGraderPanelCost(taskId, gradeResult);
-  return gradePost;
-}
-
-// Build the grade verdict display block as a string (per-axis scores + notes +
-// issues + next-step hints). Pure + exported so the #943 grader-unavailable vs
-// FAIL branch is unit-tested without capturing stdout. printGradeOutcome just
-// prints what this returns.
-// task 1003313: the per-worker diagnostic lines for a total outage, plus the
-// local `claude` CLI verdict. Pure over its inputs (cliFinding is INJECTED, never
-// spawned here) so formatGradeOutcome stays unit-testable without a subprocess.
-function formatOutageDiagnostic(g, cliFinding) {
-  const out = [];
-  const dead = (g.signals?.workers || []).filter((w) => w && w.error);
-  const detailed = dead.filter((w) => w.exit_code != null || w.stderr_tail);
-  if (detailed.length) {
-    out.push('');
-    out.push('What the grader subprocess actually did:');
-    for (const w of detailed) {
-      const code = w.exit_code != null ? `exit ${w.exit_code}` : w.error;
-      out.push(`  ${String(w.kind || '?').padEnd(11)} ${code}${w.stderr_tail ? ` — ${w.stderr_tail.split('\n')[0]}` : ''}`);
-    }
-  }
-  if (cliFinding && cliFinding.level !== 'ok') {
-    out.push('');
-    out.push(`Local \`claude\` CLI: ${cliFinding.detail}`);
-    if (cliFinding.fix) out.push(`  Fix: ${cliFinding.fix}`);
-  }
-  return out;
-}
-
-// cliFinding: the preflight `claude CLI` row, injected by printGradeOutcome so a
-// dark panel can say "your CLI is logged out" instead of leaving the builder to
-// guess. Report-only — it never changes the outcome: it explains an outage, it does not decide one.
-function formatGradeOutcome(g, taskId, cliFinding = null) {
-  const out = [];
-  // #943: a TOTAL grader outage (every gating worker failed to spawn / the
-  // grader was bypassed pre-spawn) is NOT a quality rejection — it's "the grader
-  // could not run". Present it distinctly so a worker-infra failure never reaches
-  // the builder as a misleading "FAIL · 0/10 — fix the issues" (the session-1659
-  // false-FAIL). There are no issues to fix; the path forward is re-grade when the
-  // grader is reachable, or manual-confirm.
-  if (g.signals?.panel_outcome === 'unavailable') {
-    const reason = g.signals?.grader_unavailable_reason;
-    out.push('');
-    out.push(`Subagent grade: GRADER UNAVAILABLE${reason ? ` (${reason})` : ''}  ·  no quality signal produced — NOT a quality rejection`);
-    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
-    out.push(...formatOutageDiagnostic(g, cliFinding));
-    out.push('');
-    out.push('The grader could not run (infra/outage/bypass) — there are no findings to fix. Task stays at completed.');
-    out.push('When the grader is reachable again, re-grade:');
-    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
-    out.push('Or land it now via manual-confirm:');
-    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/bongos/tasks/${taskId}/confirm`);
-    out.push(...plainCardLines('grade_unavailable'));
-    return out.join('\n');
-  }
-
-  // task 1002614 (map P-2): a protected-path refusal used to render as an
-  // ordinary quality FAIL — "fix the issues and --regrade" — although no rank of
-  // the builder's can land that diff. Present it as the authorization wall it is
-  // (the #943 grader-unavailable branch is the precedent for a distinct shape).
-  // Keyed off the guard name so it also reads grades from servers predating the
-  // authorization_refusal marker.
-  const guardTripped = g.signals?.server_guard?.tripped || [];
-  const permRefusal = g.signals?.server_guard?.authorization_refusal === true
-    || guardTripped.some((t) => t.guard === 'permission_path');
-  if (!g.passed && permRefusal) {
-    out.push('');
-    out.push('Subagent grade: REFUSED (authorization)  ·  not a quality verdict — your work was not judged and rejected');
-    out.push('');
-    out.push('The committed diff touches PROTECTED surfaces above your rank, so the server');
-    out.push('refused to accept it — no re-attempt at your rank can land this diff as-is.');
-    if ((g.issues || []).length > 0) {
-      out.push('');
-      out.push('What was refused (file · rule):');
-      for (const it of g.issues.filter((i) => String(i.worker || '').includes('permission-path'))) {
-        out.push(`  ${it.file || '?'} — ${it.summary || ''}`);
-      }
-    }
-    out.push('');
-    out.push('Ways forward:');
-    out.push('  - Split the protected files out of your diff and re-ship the rest, or');
-    out.push('  - hand this task to a builder at/above the floor the refusal names.');
-    out.push(`(--regrade re-runs the same server check and will refuse again unless the diff changes.)`);
-    out.push(...plainCardLines('grade_refused_authorization'));
-    return out.join('\n');
-  }
-
-  // task 1003318: ONE gating lens went dark (the Quality worker died on a
-  // context-window overflow before it started) while the rest of the panel
-  // judged the diff and found nothing substantive. The server records that axis
-  // as unavailable instead of fabricating a 0 (validateAndScore
-  // cq_lens_unavailable); present it the way #943 presents a total outage —
-  // there are no findings to fix, and the paths forward are re-grade or
-  // manual-confirm. Sits BELOW the authorization wall (a refusal is never an
-  // outage) and steps aside when any lens raised a blocker/major (then the
-  // ordinary FAIL block prints the findings). The task stays at completed.
-  const cqLensOutage = !g.passed
-    && g.signals?.cq_lens_unavailable === true
-    && g.rubric_scores?.code_quality === null
-    && !(g.issues || []).some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
-  if (cqLensOutage) {
-    out.push('');
-    out.push('Subagent grade: QUALITY LENS UNAVAILABLE  ·  the Quality worker did not run — NOT a quality rejection');
-    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
-    out.push(...formatOutageDiagnostic(g, null));
-    out.push('');
-    out.push('The other lenses judged the diff and found nothing substantive; code_quality is recorded as unavailable, not 0. Task stays at completed.');
-    out.push('When the grader is healthy again, re-grade:');
-    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
-    out.push('Or land it now via manual-confirm:');
-    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/bongos/tasks/${taskId}/confirm`);
-    out.push(...plainCardLines('grade_lens_unavailable'));
-    return out.join('\n');
-  }
-
-  // task 1002903: a reviewer scored below threshold and named NO major/blocker
-  // finding, so the severity gate (task 1002663) downgraded it — the ship parks for
-  // a human rather than hard-failing. The ordinary block below would print "FAIL"
-  // and "Fix the issues above" over an empty list, which is how task 1002721's
-  // builder read a real grade as a broken one. Sits below the outage and
-  // authorization shapes, and steps aside when any finding IS substantive or a
-  // gating worker hard-failed (then the ordinary block and its findings apply).
-  // The record's own list wins; the workers are the fallback for a grade written
-  // before signals.unbacked_scores existed.
-  const gradeThreshold = Number(g.threshold);
-  const unbacked = Array.isArray(g.signals?.unbacked_scores)
-    ? g.signals.unbacked_scores
-    : Number.isFinite(gradeThreshold) ? unbackedLowScores(g.signals?.workers, { threshold: gradeThreshold }) : [];
-  const hasSubstantive = (g.issues || []).some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
-  if (!g.passed && unbacked.length > 0 && !hasSubstantive && g.signals?.panel_outcome !== 'fail') {
-    out.push('');
-    out.push(`Subagent grade: NOT PASSED — UNBACKED LOW SCORE  ·  a reviewer scored below ${g.threshold ?? '?'} without naming a finding — NOT a findings-backed rejection`);
-    for (const u of unbacked) {
-      out.push(`  ${u.kind}: ${u.axis} ${u.score}/10 — no major or blocker finding stands behind it`);
-    }
-    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
-    out.push('');
-    out.push('There is nothing listed to fix. The severity gate does not let an unbacked score hard-fail a ship, so the task stays at completed for a human instead.');
-    out.push('Re-grade once — an unbacked score often does not repeat:');
-    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
-    out.push('If it repeats on work you can defend, file an override-request with your evidence (recorded; an Archon decides):');
-    out.push(`  node scripts/gds/api.js POST /api/bongos/tasks/${taskId}/override-request --body-file rationale.json   # {"rationale":"<why the grade is wrong, specifically>"}`);
-    out.push(...plainCardLines('grade_unbacked_score'));
-    return out.join('\n');
-  }
-
-  const verdict = g.passed ? 'PASS' : 'FAIL';
-  out.push('');
-  out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);
-  if (g.rubric_scores) {
-    const ff = g.rubric_scores.functional_fidelity;
-    const cq = g.rubric_scores.code_quality;
-    if (ff != null) out.push(`  functional_fidelity: ${ff}/10`);
-    if (cq != null) out.push(`  code_quality:        ${cq}/10`);
-  }
-  if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
-  if ((g.issues || []).length > 0) {
-    out.push('');
-    out.push(`Issues (${g.issues.length}):`);
-    for (const it of g.issues) {
-      const sev = String(it.severity || '?').padEnd(7);
-      out.push(`  [${sev}] ${it.file || '?'} — ${it.summary || ''}`);
-    }
-  }
-  if (!g.passed) {
-    out.push('');
-    out.push('Grade failed — task stays at completed. Fix the issues above, commit, then re-grade:');
-    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
-    out.push('Last resort (only if the grade was wrong):');
-    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/bongos/tasks/${taskId}/confirm`);
-    out.push(...plainCardLines('grade_failed'));
-  }
-  return out.join('\n');
-}
-
-// Print the grade verdict + per-axis scores + notes + issues. On a FAIL, print
-// both the re-grade hint (the cheap default) and the Archon override curl (the
-// last resort — see feedback_prefer_regrade_over_override). #943: a total grader
-// outage prints as "GRADER UNAVAILABLE", not a 0/10 FAIL — see formatGradeOutcome.
-function printGradeOutcome(g, taskId) {
-  // task 1003313: on a TOTAL outage only, ask the existing preflight whether the
-  // local `claude` CLI is launchable and logged in — the two faults that produce
-  // this exact all-workers-dead signature. Report-only and outage-only, so the
-  // happy path pays nothing and no ship's outcome depends on the probe.
-  let cliFinding = null;
-  if (g?.signals?.panel_outcome === 'unavailable') {
-    try {
-      cliFinding = preflightChecks().find((r) => r.title === 'claude CLI') || null;
-    } catch (_) { /* best-effort: a broken probe must never mask the grade output */ }
-  }
-  console.log(formatGradeOutcome(g, taskId, cliFinding));
-}
-
-// Print the credits line + multiplier breakdown + idea bonus + unlocked
-// achievements from a grade/confirm response.
-function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, creditsMultiplier, ideaBonusInfo, justUnlocked, held = false }) {
-  console.log('');
-  if (held) {
-    // task 1004379: a page tweak's PASS waits at completed for its artist (ADR
-    // 0341 D7). Reading 'completed' as 'grade not passed' told the reader the
-    // opposite of what happened.
-    console.log(`Credits awarded: ${credits} (none yet — the grade passed; credits land when the artist approves and it merges)`);
-  } else if (postGradeStatus === 'completed') {
-    console.log(`Credits awarded: ${credits} (none — task at completed, grade not passed)`);
-  } else if (postGradeStatus === 'confirmed') {
-    console.log(`Credits awarded: ${credits} (none yet — credits land when the task merges to main)`);
-  } else if (!rewardPolicy(getServerReward()).perTaskCredit) {
-    // cost-plus-only (ADR 0146): the per-task estimate is never paid, so this is
-    // 0 BY DESIGN. Left unexplained it reads as a broken payout — it sent a real
-    // session diagnosing the reward gate on 2026-07-26 (task 1002469).
-    console.log(`Credits awarded: ${credits} — expected: this instance pays cost-plus only.`);
-    console.log("  The task's estimate is a guide, never a payout. You're paid for this session's");
-    console.log('  real cost + 20%, booked separately from your token spend.');
-  } else {
-    console.log(`Credits awarded: ${credits}`);
-  }
-  // Write the credits flag so the NEXT Claude turn plays the credits-awarded
-  // sound via the Stop hook (task 582). Only when credits were actually awarded.
-  if (typeof credits === 'number' && credits > 0) {
-    const tmpDir = process.platform === 'win32'
-      ? (process.env.TEMP || process.env.TMP || os.tmpdir()) : '/tmp';
-    try { fs.writeFileSync(require('path').join(tmpDir, 'otb-credits'), ''); } catch (_) {}
-  }
-  if (creditsRaw != null && creditsMultiplier != null && Number(creditsMultiplier) !== 1.0) {
-    const mult = Number(creditsMultiplier).toFixed(2).replace(/0$/, '').replace(/\.$/, '.0');
-    console.log(`  Kind multiplier: ${creditsRaw}c × ${mult}× → ${credits}c`);
-  }
-  if (ideaBonusInfo && ideaBonusInfo.ideaBonusAwarded > 0) {
-    console.log(
-      `  Idea-promotion bonus: +${ideaBonusInfo.ideaBonusAwarded}c paid to builder #${ideaBonusInfo.bonusBuilderId} (idea #${ideaBonusInfo.ideaId})`
-    );
-  }
-  for (const ach of justUnlocked || []) {
-    const bonus = ach.credit_bonus > 0 ? ` (+${ach.credit_bonus}c bonus)` : '';
-    console.log(`✨ Achievement unlocked: ${ach.name}${bonus}`);
-  }
-}
-
-// chooseBroadcastTargets — the ship-broadcast channel router (task 990) now lives
-// in src/bongos/ship-broadcast.js (task 1045) so the server-mediated publish path
-// shares the exact same security-sensitive routing. Imported at the top of this
-// file; still re-exported below for tests/ship_broadcast_routing.mjs.
-
-// task 1442: play the task-shipped "ship bell". ship.js runs as its own process
-// (not inside a Claude turn), so it plays the sound directly rather than via the
-// Stop hook. Called at the confirmed/shipped success milestone so it rings on
-// the ci/async landing path too — there ship.js exits at 'confirmed' and the
-// deploy finishes later server-side, which is exactly why the old post-deploy
-// call site never fired (bug #1442). Resolve the builder's chosen variant from
-// the local prefs file; fall back to 'ship'. Best-effort: playSound swallows all
-// errors and is a silent no-op with no audio player, so this can never fail a ship.
-
-module.exports = {
-  buildGradePayload,
-  buildPriorRoundContext,
-  priorFindings,
-  computeGradeResult,
-  formatGradeOutcome,
-  gradeAndRecord,
-  printCreditsAndAchievements,
-  printGradeOutcome,
-};
+require('../bongos/forwarder.js').forward(module, 'ship-grade-steps.js');