@bongos/core 1.19.1008 → 1.19.1009

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1008",
-  "core_contract": "1.19.1008",
-  "source_commit": "e583787f8d0336097d7d222b97215439dc14af27",
+  "core_version": "1.19.1009",
+  "core_contract": "1.19.1009",
+  "source_commit": "f333a382d30859ea9dd83b8e0413b1bcf4e38b66",
   "source_ref": "HEAD",
-  "built_at": "2026-09-24T20:09:45.504Z",
+  "built_at": "2026-09-24T20:42:02.062Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 521,
+    "docs_redacted": 522,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2417,
+    "functional_verbatim": 2420,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2964,
-  "tree_sha256": "6758f1a3f507c3dbda7433c115fecd8580630e00ab560c84bb7021951cc24e93",
+  "file_count": 2968,
+  "tree_sha256": "aa0d298bf24c87953cdd7448f2b0a543b2fbcbbdde10b5f805773313dd535202",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2722,7 +2722,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "70b574fec22d599e3301b9f53d0710f57842eb04f7fb641ea89adc0f4a1737c0"
+      "sha256": "6edfd1a8650655c13f38f17ce919839b0ff0d2412f64dd8c0bb2c415d594450c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8217,12 +8217,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bf1d76df4fece9153f951a23a4ff641653f334bda04faced44eb6de8a24d6191"
+      "sha256": "19c087c0a7b0792f92c2de05f05d8aec5c231d14c79d31cdecc3d4c0c90fa51b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ed55e75f15d377f4174476d8e74c973b4a111597872a33c3e5ac44979a3e6f26"
+      "sha256": "fb7688b54f3876cd4282c13c0d192ee507646c83f6348a4ec761534b7dc8d5a4"
     },
     {
       "path": "public-docs/index.html",
@@ -10267,7 +10267,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ee01cc7f65d099be7ec9803c9c43ec6df476f129a39e37d1efb948173055f8ff"
+      "sha256": "7e3b7c7ffca3404a92e817e76b48a4963a9da6c72c1723318d45761c65ae97ad"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11599,6 +11599,21 @@
       "mode": "0000644",
       "sha256": "8fd3ae3efc2a2c7f47e605925fec881c76dabe1fe8242ca67354b0a6a346e5e6"
     },
+    {
+      "path": "tests/fixtures/ideator-prefold/README.md",
+      "mode": "0000644",
+      "sha256": "d7f6de3e72863a605f75f1de7b8e73bdac7e6dce13c1e89afd9cb314a4c2aa66"
+    },
+    {
+      "path": "tests/fixtures/ideator-prefold/ideas.html.baseline",
+      "mode": "0000644",
+      "sha256": "d7a88db7d9c561dc923a6e80b0573ad7d95aec8ab9ff5a7013eb1c946a8a5827"
+    },
+    {
+      "path": "tests/fixtures/ideator-prefold/ideas.js.baseline",
+      "mode": "0000644",
+      "sha256": "2f532cacb06f0f074c15101c16578f3183104042644d6c8aa0d2e80fdb425b2f"
+    },
     {
       "path": "tests/fixtures/session-506-digest.json",
       "mode": "0000644",
@@ -12554,6 +12569,11 @@
       "mode": "0000644",
       "sha256": "7b13dcdfb215890100a37f7a88722e4dd937b761fe9fa527b1a549de7016b7e8"
     },
+    {
+      "path": "tests/ideator_one_line_path_proof.mjs",
+      "mode": "0000644",
+      "sha256": "f1a131105d64c1c0490c814c13e2e6d067e6649c488c33ad60d9c046bb3d29a9"
+    },
     {
       "path": "tests/ideator_traceable_proof.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2490,5 +2490,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1006 with no explicit bump. run 36043267244. (task 1002620)
   1.19.1008 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1007 with no explicit bump. run 36052924171. (task 1002620)
+  1.19.1009 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1008 with no explicit bump. run 36056558236. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1008",
+  "version": "1.19.1009",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1008",
+      "version": "1.19.1009",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1008",
+  "version": "1.19.1009",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1008'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1009'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fixtures/ideator-prefold/README.md

@@ -0,0 +1,36 @@
+# The pre-fold ideas page — a frozen baseline
+
+Byte copies of `modules/hall-ui/public/ideas.html` and `ideas.js` as they stood at commit
+**`f375a1f9`**, the commit immediately before the Full Idea form was folded behind a
+disclosure (task [#1004087](https://cloudbongos.com/builders#/task/1004087), spec R04).
+
+They exist so `tests/ideator_one_line_path_proof.mjs` can measure the current filing path
+against **the page that actually existed**, rather than against a description of it. A
+described baseline agrees with the current page because whoever wrote it made it agree;
+these can only agree if the code does.
+
+Re-cut them to check they have not drifted:
+
+```bash
+git show f375a1f9:modules/hall-ui/public/ideas.js > tests/fixtures/ideator-prefold/ideas.js.baseline
+git show f375a1f9:modules/hall-ui/public/ideas.html > tests/fixtures/ideator-prefold/ideas.html.baseline
+```
+
+## Do not edit these, and do not "fix" them
+
+They are **evidence, not source**. Every finding in
+[`docs/governance/<redacted>.md`](../../../docs/governance/<redacted>.md)
+is a comparison against them, so editing one silently turns a measurement into a tautology.
+The proof's last claim exists for exactly that: it asserts the baseline still fetches the
+template unconditionally, still knows nothing about a disclosure, and is still a different
+file from the live page — so tidying these into agreement reds the suite instead of passing
+quietly.
+
+## Why the `.baseline` extension
+
+Not decoration, and not a way around a gate. `scripts/gds/fitness-ratchets.js` measures
+cross-file duplication over `git ls-files '*.js'`, and a frozen copy of a live file is, by
+construction, ~500 duplicate windows against it. That metric exists to find copy/paste a
+maintainer should collapse; collapsing *this* copy would destroy the only thing it is for.
+The extension states what the file is — recorded evidence, never loaded, never edited — and
+keeps the duplication ratchet honest about the code it was written to police.

package/tests/fixtures/ideator-prefold/ideas.html.baseline

@@ -0,0 +1,210 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Ideas — {{worldName}}</title>
+  <meta name="description" content="Write a Full Idea: five questions that turn a thought into a baseline scope of work someone else can deliver against, with a live completeness score.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/ideas.css">
+</head>
+<body data-page="ideas" data-page-title="Ideas">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <!-- --railed reserves the room the meter occupies (style.css, "the right
+         rail"). This page used to take that room by overriding
+         `.app-content > main` from its own sheet, which is a page editing shell
+         layout — invisible from the shell, and it hard-coded a topbar height. -->
+    <div class="app-content app-content--railed">
+      <!-- The page's own name, in the LABEL voice — the display face is saved for
+           section headings (the work.html precedent, task 1003304). The page had
+           no h1 at all, so it failed one-header-main-h1 on every render. -->
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Ideas</h1>
+        <p class="page-head__sub" id="fi-sub">Loading the idea template…</p>
+      </div>
+
+      <main id="hall-main">
+        <!-- The spark queue (task 1002930 / R154). ABOVE the composer, because
+             "what is already waiting" is the thing to scan before starting
+             something new — and because a queue nobody sees is not a pickup
+             surface. Collapsed to a single line when empty so it never pushes the
+             composer down the page for nothing. -->
+        <section class="scroll" id="fi-queue-scroll" aria-labelledby="fi-queue-h">
+          <h2 id="fi-queue-h" class="scroll__h">Waiting to be developed</h2>
+          <p class="scroll__lede">
+            Ideas whose author has said "I had the thought but not the full picture".
+            Anyone can develop one — the author keeps the credit for having had it,
+            and you are recorded as its developer.
+          </p>
+          <div id="fi-queue"><p class="fi-note">Loading…</p></div>
+        </section>
+
+        <!-- Quick filing (task 1003069 / R08, goal 1000071 "Idea routing") —
+             the hall's first bug/idea report, separate from the Full Idea
+             composer below: title + kind + optional body + a goal picker fed
+             by the R07 suggester. A routed capture must never carry
+             grade='full' (routing.js NEVER_ROUTE_GRADE), so this cannot share
+             a submit with the form below it. Hidden while developing a spark
+             (?develop=<id>) — that surface always turns someone else's
+             existing thought into a Full Idea, never a fresh quick report. -->
+        <section class="scroll" id="fq-compose-scroll" aria-labelledby="fq-compose-h">
+          <h2 id="fq-compose-h" class="scroll__h">File a bug or idea</h2>
+          <p class="scroll__lede">
+            A quick report — title, what's going on, and where it belongs. Pick a goal
+            and it lands there as a task the moment you file; leave it on "no goal" and
+            it waits in the inbox for triage.
+          </p>
+
+          <form id="fq-form" novalidate>
+            <label class="fi-label" for="fq-title">Title</label>
+            <input type="text" id="fq-title" class="fi-input" maxlength="200" autocomplete="off"
+                   placeholder="what's wrong, or what you'd like to see">
+
+            <label class="fi-label" for="fq-kind">Kind</label>
+            <!-- task 1003453: the options are FILLED from /me.task_kinds at boot
+                 (ideas.js), not written here. This markup used to spell the whole
+                 vocabulary and had gone stale against the DB CHECK exactly as the
+                 two board filters had — a third copy nobody was watching. The one
+                 option left is the degraded fallback: if the read never lands, a
+                 bug can still be filed. -->
+            <select id="fq-kind" class="fi-input">
+              <option value="bug" selected>Bug</option>
+            </select>
+
+            <label class="fi-label" for="fq-body">Details <span class="fi-hint">(optional)</span></label>
+            <textarea id="fq-body" class="fi-text" rows="4"
+                      placeholder="repro steps, context, anything that helps…"></textarea>
+
+            <label class="fi-label" for="fq-goal">
+              Goal
+              <span class="fi-hint">Suggested as you type; leave it on "no goal" and it waits for triage.</span>
+            </label>
+            <select id="fq-goal" class="fi-input"></select>
+
+            <!-- GRAVITY (task 1004083 / spec R02) — what will actually catch this
+                 thought, stated before it is released. It sits under the picker
+                 because it is the picker's consequence, and because the picker's
+                 own option labels cannot carry it: "No goal (homeless)" is false
+                 for a bug (ADR 0262 routes it to the maintenance goal), and a
+                 named goal is false for a judgment kind (routing.js
+                 NEVER_ROUTE_KINDS). The verdict comes from the server's real
+                 landing matrix — see POST /inbox/preview-landing — never from a
+                 second copy of the rules in ideas.js. Hidden until there is
+                 something true to say. -->
+            <p class="fi-gravity" id="fq-gravity" role="status" aria-live="polite" hidden></p>
+
+            <p class="fi-err" id="fq-err" role="alert"></p>
+            <p class="fi-result" id="fq-result" role="status" aria-live="polite"></p>
+
+            <!-- The receipt that outlives the confirmation above (task 1004082 /
+                 spec R01). #fq-result is the live announcement for the filing
+                 just made and dies with the page; this list is the durable
+                 record of the last few, read back from localStorage on load so
+                 a thought filed before a reload is still traceable here. -->
+            <section class="fi-receipts" id="fq-receipts" aria-labelledby="fq-receipts-h" hidden>
+              <h3 class="fi-receipts__h" id="fq-receipts-h">Recent filings</h3>
+              <ol class="fi-receipts__list" id="fq-receipts-list"></ol>
+              <p class="fi-receipts__note" id="fq-receipts-note" hidden></p>
+            </section>
+
+            <div class="fi-actions">
+              <button type="submit" class="btn" id="fq-submit">File it</button>
+            </div>
+          </form>
+        </section>
+
+        <!-- The composer. The idea detail view lives on its own page (R153). -->
+        <section class="scroll" id="fi-compose-scroll" aria-labelledby="fi-compose-h">
+          <h2 id="fi-compose-h" class="scroll__h">Write a Full Idea</h2>
+          <p class="scroll__lede">
+            A Full Idea answers five questions, so that someone else can deliver against it
+            without having to interview you first. Open to every role — the score below is
+            the only filter, and it counts substance, not who you are.
+          </p>
+
+          <form id="fi-form" novalidate>
+            <!-- DEVELOP MODE (R154): when the composer was opened from a spark,
+                 this block carries the spark's own words and the title becomes a
+                 read-only fact rather than a field — developing an idea must not
+                 quietly rename it out from under its author. -->
+            <div class="fi-develop" id="fi-develop" hidden>
+              <p class="fi-develop__label">Developing a Big Idea Spark</p>
+              <p class="fi-develop__title" id="fi-develop-title"></p>
+              <p class="fi-develop__body" id="fi-develop-body"></p>
+              <p class="fi-develop__who" id="fi-develop-who"></p>
+            </div>
+
+            <label class="fi-label" for="fi-title" id="fi-title-label">
+              Title
+              <span class="fi-hint">One line. This is what the idea is called everywhere else.</span>
+            </label>
+            <input type="text" id="fi-title" class="fi-input" maxlength="200" autocomplete="off"
+                   placeholder="what the idea is, in one line">
+
+            <!-- The five fields are rendered from GET /inbox/template — the R141
+                 declaration — never hand-written here. A hard-coded form is the
+                 same "second copy of the rules" defect as a hard-coded scorer,
+                 one step earlier, and it would silently ignore a per-project
+                 template (R156). -->
+            <div id="fi-fields" class="fi-fields">
+              <p class="fi-note">Loading the five questions…</p>
+            </div>
+
+            <!-- The scope recommendation (BV2.R13). Rendered from the same
+                 GET /inbox/template read as the fields above, and for the same
+                 reason: the two values are a closed vocabulary the database
+                 enforces, so a hand-written pair of radios here would be a
+                 second copy of it, free to drift. -->
+            <div id="fi-rec" class="fi-rec"></div>
+
+            <p class="fi-err" id="fi-err" role="alert"></p>
+
+            <div class="fi-actions">
+              <button type="submit" class="btn" id="fi-submit" disabled>File this idea</button>
+              <button type="button" class="btn btn--ghost" id="fi-clear">Discard draft</button>
+              <span class="fi-draft" id="fi-draft" role="status" aria-live="polite"></span>
+            </div>
+          </form>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<!-- The meter rides along beside the form on a wide screen and above it on a
+     narrow one (the shell's .app-rail decides). It is a READOUT, never an input:
+     every number in it comes from the server's own scorer. -->
+<aside class="fi-meter app-rail" id="fi-meter" aria-labelledby="fi-meter-h" hidden>
+  <h2 class="fi-meter__h" id="fi-meter-h">Completeness</h2>
+  <div class="fi-gauge">
+    <div class="fi-gauge__track"><div class="fi-gauge__fill" id="fi-gauge-fill"></div></div>
+    <p class="fi-gauge__n" id="fi-gauge-n" role="status" aria-live="polite">—</p>
+  </div>
+  <ul class="fi-meter__list" id="fi-meter-list"></ul>
+  <p class="fi-meter__note">
+    Counted, not judged: each question is worth the same, and earns its share in
+    proportion to how much real text it carries. Whitespace and padding score nothing.
+  </p>
+</aside>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
+<script src="/builders/palette.js" defer></script>
+<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
+<!-- task 1003069 (R08) — the quick-filing form's routed result links a task
+     through window.OTBTaskDetail.href(); guarded if this ever loads without it. -->
+<script src="/builders/task-detail.js?v=2026-07-03-taskdetail2" defer></script>
+<script src="/builders/ideas.js?v=2026-08-22-r154"></script>
+</body>
+</html>