@bongos/core 1.19.107 → 1.19.108

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.107",
-  "core_contract": "1.19.107",
-  "source_commit": "85d496250f3a30925cf27a4601462f516e6de778",
+  "core_version": "1.19.108",
+  "core_contract": "1.19.108",
+  "source_commit": "bafad9a6b64800aa591f105f14a5a67cf39a54d9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T02:08:28.305Z",
+  "built_at": "2026-08-14T13:14:28.346Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1558,
-  "tree_sha256": "61133ba38baa892b82011a8424092f2ccd2d26b485d9d8043d9c20d0d3abae17",
+  "tree_sha256": "7130b0e01712f13175140a4ddc52041177b8f660fab0029699212a445ebf59ad",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4147,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bd7f6faf78443413a2f0142bd9f72e4fff1eb31fefd2225697f0011599f1a218"
+      "sha256": "f205db41eab8846e667c61aad6739b8194db55326d38562f0e6a674ecb0cd8ce"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d14fe248ed9e458a9ebc3a9c7c75101082f44861712860800f341d6218ccb61f"
+      "sha256": "afc15cf17f555b46d2e616cea755061e6d6751e06b582ad9253ff9dc257a203d"
     },
     {
       "path": "public-docs/index.html",
@@ -5727,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8fb4486e1a47e0c244cec140b06db1175ce7c3b1418b7dd27d71073020a189ca"
+      "sha256": "309c33b07e1c5391726d8bf73d2c0d595cab3b9624244df0f7cd8fcbe068e3a5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7052,7 +7052,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "005e784feb96676ada71399fae94e7b11c579159cd80a7fac0ba0ac79bda1e5d"
+      "sha256": "092c9d9ffeed7faed34cfb49ffec6de64d86e45a8fda129444345924313b8fd7"
     },
     {
       "path": "tests/module_manifest.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.107",
+  "version": "1.19.108",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.107",
+      "version": "1.19.108",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.107",
+  "version": "1.19.108",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -641,8 +641,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.105 with no explicit bump. run 31759315328. (task 1002620)
 //   1.19.107 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.106 with no explicit bump. run 31762781737. (task 1002620)
+//   1.19.108 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.107 with no explicit bump. run 31803763842. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.107'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.108'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module_loader.mjs

@@ -170,16 +170,34 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // then status-ui (R84) + hall-ui (R85) the two web-surface carves; and
   // provisioning (ADR 0111 / task 1942) — a net-new feature module (instance hosting);
   // platform-identity (ADR 0141) the hub IdP; and governance (ADR 0151 / BV1.R94) the
-  // configurable roles/permissions module. All are discovered; none has validation
+  // configurable roles/permissions module; and agents (ADR 0083 / goal 1000038) the
+  // declarative agent registry — the first module to ship default:false, which is
+  // why it is DISCOVERED here (discovery is enablement-independent) while staying
+  // off in enabledModules(). All are discovered; none has validation
   // errors or coreVersion mismatches. Order is the readdir sort.
   //
   // NB this is the CORE package tree: game / art-pipeline / character-anim / demo are
   // instance/content-excluded from the published core (ADR 0098) so they are not
-  // present here — the discovered set is the 17 always-shipped core-domain + feature
+  // present here — the discovered set is the 18 always-shipped core-domain + feature
   // modules below.
+  //
+  // ⚠ ADDING A MODULE? This roster is HARDCODED and you must extend it — otherwise
+  // this test reds and your PR cannot land (task 1002787: the agents manifest hit
+  // exactly this). It stays hardcoded on purpose: unlike the fitness roster check,
+  // which compares two INDEPENDENT disk reads (tests/helpers.mjs onDiskModuleKeys vs
+  // fitness.js discoveredModuleKeys), this assertion pins what the PUBLISHED CORE
+  // ships (ADR 0098 content-exclusion). Deriving it from the same disk the loader
+  // just read would make it tautological — it could no longer catch the loader
+  // silently dropping or duplicating a module, which is the thing it exists to catch.
+  //
+  // ⚠ AND CHECK WHICH TESTS FAIL, NOT HOW MANY FILES. On Windows, origin/main already
+  // fails ~21 test FILES, this one among them (see the dedupeRoots test below — a path
+  // -resolution env issue). A before/after run compared at FILE granularity therefore
+  // reads 21 = 21 and looks clean while a NEW failure hides inside an already-red file.
+  // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'governance', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();