@bongos/core 1.19.141 → 1.19.142

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.141",
-  "core_contract": "1.19.141",
-  "source_commit": "b945e540f7d2e847172a7d529a393ef7ed3cd181",
+  "core_version": "1.19.142",
+  "core_contract": "1.19.142",
+  "source_commit": "34ee06f88922e1b277d1d8780b0da9c9fa7edd2a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T15:22:10.867Z",
+  "built_at": "2026-08-15T15:39:26.241Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "ebfb642cad8b628d4485648012f4b179c33923d35f37dd4f4be28e87245f99b9",
+  "tree_sha256": "c544fb023102eaf104fa988b33f2cb9c70a2d8817edf0549e3e5608ba47be6e4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e2dbef1b10a02d42af480300fa0be08f86312d8be984a64e1f0522f5f70b1152"
+      "sha256": "9c082e0279aa72767e3167df6277a3f34247a7d600bc184f00a4ca9380b97da5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "624eb72a1cc5d8f63b33038e823818c93159c0f92351f011c88202618c2aff45"
+      "sha256": "b3d152773025a6478d933888ade55e094a55016f8260989361ef426838700d03"
     },
     {
       "path": "public-docs/index.html",
@@ -4422,7 +4422,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "a55b4dd516485060edb4f1cd0be5164bd2026d77186d9b19c1f728a64eda9c7b"
+      "sha256": "0e023e2e98babfd7d748b2f7542af13c41be96cbcc84f2853110410a57fe7816"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "1823d08908672433c4ef47c9320598fd1e6c949836daf8f874b5b802fc43f9c5"
+      "sha256": "eb36261b21198d9217d96408de5ee898083aaf0d5f62368f1be3b4af9a908dcb"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "851121766a8f979a937d436e38efa09f77dae45687c464d7a5a8185373a0fcbe"
+      "sha256": "6eaa713a395bf793d4e07c0d68ae86a29473e410d393b859dcfd1d52bacb2811"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6277,7 +6277,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "3689ce2b23d0baedb5a277676e939af712cea8d0cb3c07857e33f36eb12e1233"
+      "sha256": "15ebf10ea627a32e943d139f1a713ff46cfda14fa1a39a12d87bcc78934516c0"
     },
     {
       "path": "tests/cost.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.141",
+  "version": "1.19.142",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.141",
+      "version": "1.19.142",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.141",
+  "version": "1.19.142",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -98,6 +98,7 @@
   --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
   --rule:#5e3521; --rule-soft:#3f2317;
   --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+  --link-ink:color-mix(in srgb, var(--accent) 51%, #ffffff);
   --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
   --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
   --on-ok:#0b2e18;
@@ -125,6 +126,7 @@
     --ink:#fdeedd; --ink-soft:#dcb693; --ink-faint:#b89272;
     --rule:#5e3521; --rule-soft:#3f2317;
     --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
+    --link-ink:color-mix(in srgb, var(--accent) 51%, #ffffff);
     --sea-ink:color-mix(in srgb, var(--sea) 65%, #ffffff);
     --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
     --on-ok:#0b2e18;
@@ -160,6 +162,15 @@
      --sea as-is; dark derives brighter (the --accent-deep pattern) so a pack's
      light-tuned sea clears WCAG 1.4.11's 3:1 on the near-black card too */
   --sea-ink:var(--sea);
+  /* TEXT LINKS ONLY (task 1002822). Light is --accent-deep unchanged; dark needs
+     its own mix because --accent-deep and --ink-soft land 2 lightness points
+     apart there (#e9ad8f vs #dcb693, ΔE76 9.7) — the same colour, and dark links
+     carry no underline until hover, so weight was the only cue left. 51% is the
+     ceiling, not a preference: --accent-deep can't simply be pushed (it also
+     feeds --chrome-accent/--glass-ink/--hero-b/--foot-code), and past 51% a dark
+     navy pack accent falls under 4.5:1 on --bg-deep. Chrome keeps --accent-deep;
+     only rules that paint a link inside prose take this. */
+  --link-ink:var(--accent-deep);
   --neutral-soft:color-mix(in srgb, var(--ink) 8%, var(--bg-card));
   /* ink-derived so the shadow is a WARM brown on the marigold ground instead of
      the cold navy it used to cast. The dark blocks override it with a plain black
@@ -211,7 +222,7 @@ body{font-family:var(--font-body);color:var(--ink);background:var(--page-bg);min
 .card{background:var(--card);border-radius:26px;box-shadow:var(--shadow-card);padding:clamp(22px,3.6vw,40px);}
 h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32px);letter-spacing:-0.5px;line-height:1.15;margin-bottom:8px;}
 .lede{font-size:15.5px;color:var(--ink-soft);font-weight:500;line-height:1.55;margin-bottom:24px;max-width:62ch;}
-.lede a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.lede a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .lede a:hover{text-decoration:underline;}
 
 /* ── buttons ── */
@@ -225,7 +236,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .btn.danger{background:transparent;color:var(--err);box-shadow:none;border:2px solid color-mix(in srgb,var(--err) 35%,transparent);}
 .btn.danger:hover{background:var(--err-soft);border-color:var(--err);}
 .btn .gh{width:17px;height:17px;fill:currentColor;}
-.linklike{background:none;border:none;cursor:pointer;font-family:var(--font-body);font-weight:700;font-size:13.5px;color:var(--accent-deep);text-decoration:underline;padding:6px 4px;}
+.linklike{background:none;border:none;cursor:pointer;font-family:var(--font-body);font-weight:700;font-size:13.5px;color:var(--link-ink);text-decoration:underline;padding:6px 4px;}
 
 /* ── chips: the one status vocabulary (direction §4). Recency rides inside
    (.rec) — "live" always says when it was last verified. ── */
@@ -271,7 +282,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projMeta{font-size:13px;font-weight:600;color:var(--ink-faint);margin-top:6px;display:flex;gap:14px;flex-wrap:wrap;}
 .projMeta code{font-family:var(--font-mono);font-size:12.5px;background:var(--bg-deep);border-radius:6px;padding:1px 6px;color:var(--accent-deep);}
 .addr{margin-top:12px;font-size:14.5px;font-weight:600;color:var(--ink-soft);}
-.addr a{color:var(--accent-deep);font-weight:700;text-decoration:none;font-family:var(--font-mono);font-size:13.5px;}
+.addr a{color:var(--link-ink);font-weight:700;text-decoration:none;font-family:var(--font-mono);font-size:13.5px;}
 .addr a:hover{text-decoration:underline;}
 .addr .none{color:var(--ink-faint);font-style:italic;}
 .addr code{font-family:var(--font-mono);font-size:13px;background:var(--bg-deep);border-radius:6px;padding:1px 7px;color:var(--accent-deep);}
@@ -282,7 +293,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}
-.projMsg a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.projMsg a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .projMsg a:hover{text-decoration:underline;}
 .projMsg details{margin-top:8px;}
 .projMsg summary{cursor:pointer;font-size:12.5px;font-weight:700;color:var(--ink-faint);}
@@ -293,7 +304,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .finePrint{font-size:12.5px;color:var(--ink-faint);font-weight:600;margin-top:16px;line-height:1.5;}
 /* a link in fine print still has to look like one — without this it fell back to
    the browser's default blue, the one colour in the page that is not ours */
-.finePrint a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.finePrint a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .finePrint a:hover{text-decoration:underline;}
 
 /* ── progress strips: one visual, per-flow vocabularies (direction §4).
@@ -315,7 +326,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .strip .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
 .strip .stages li.now .slbl,.strip .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
 .strip .pnote{text-align:center;font-size:13px;font-weight:600;color:var(--ink-soft);min-height:18px;line-height:1.5;}
-.strip .pnote a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.strip .pnote a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .strip.isLive{border-color:var(--ok-soft);background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);}
 .strip.isLive .stages li.done:not(:first-child)::before{background:var(--ok);}
 .strip.isLive .stages li.done .sdot{border-color:var(--ok);background:var(--ok);}

package/public-landing/projects.html

@@ -161,7 +161,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .humanSteps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
 /* a repo the platform already handled is named as a plain inline link (task 1002855) —
    the .ghbtn treatment reads as an action to take, and there is nothing here to do */
-.humanSteps p a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.humanSteps p a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .humanSteps p a:hover{text-decoration:underline;}
 /* live checklist states (task 1002694): a step the platform has verified done, and a
    step that can't be performed yet (its prerequisite — usually the domain — is missing) */
@@ -222,7 +222,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .prog .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
 .prog .stages li.now .slbl,.prog .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
 .prog .pnote{text-align:center;font-size:13px;font-weight:600;color:color-mix(in srgb,var(--sea) 45%,var(--ink-soft));min-height:18px;}
-.prog .pnote a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.prog .pnote a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .prog .pnote a:hover{text-decoration:underline;}
 .prog.isLive{background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));}
 .prog.isLive .stages li.done:not(:first-child)::before{background:var(--ok);}

package/src/module-api.js

@@ -709,8 +709,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.139 with no explicit bump. run 31891805999. (task 1002620)
 //   1.19.141 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.140 with no explicit bump. run 31892484952. (task 1002620)
+//   1.19.142 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.141 with no explicit bump. run 31893298770. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.141'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.142'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -135,6 +135,25 @@ const contrast = (fg, bg) => {
 
 const hex = (c) => '#' + c.slice(0, 3).map((v) => Math.round(v).toString(16).padStart(2, '0')).join('');
 
+// CIE Lab (D65) + ΔE76 — for ink-vs-ink questions contrast() cannot answer.
+// Two colors can each clear 8:1 over the same ground and still BE the same
+// color; a ratio between them only sees lightness, and the collision this file
+// now guards is a chroma one.
+const labF = (t) => (t > 216 / 24389 ? Math.cbrt(t) : (841 / 108) * t + 4 / 29);
+const lab = ([r, g, b]) => {
+  const [R, G, B] = [lin(r), lin(g), lin(b)];
+  const [fx, fy, fz] = [
+    labF((0.4124 * R + 0.3576 * G + 0.1805 * B) / 0.95047),
+    labF(0.2126 * R + 0.7152 * G + 0.0722 * B),
+    labF((0.0193 * R + 0.1192 * G + 0.9505 * B) / 1.08883),
+  ];
+  return [116 * fy - 16, 500 * (fx - fy), 200 * (fy - fz)];
+};
+const deltaE76 = (a, b) => {
+  const [A, B] = [lab(a), lab(b)];
+  return Math.hypot(A[0] - B[0], A[1] - B[1], A[2] - B[2]);
+};
+
 // ── the pairs cosmos.css actually paints ─────────────────────────────────────
 // need: 4.5 normal text · 3.0 large text and meaningful non-text
 const CARD = 'var(--bg-card)';
@@ -143,14 +162,22 @@ const PAIRS = [
   ['.btn label on its fill',            '#ffffff',              'var(--accent)',        4.5],
   ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
   ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
-  // Inline links, code chips, pills, the now-step number: every accent-colored
-  // text consumer paints --accent-deep in BOTH modes (task 1002750 deleted the
-  // dark --sun-lit recolors — they pinned the locked space palette over the
-  // branding pack, so a re-themed instance got Cloud Bongos orange links).
-  // The dark blocks derive --accent-deep from the pack-settable --accent.
-  ['inline link on a card',             'var(--accent-deep)',   CARD,                   4.5],
-  ['inline link on the page ground',    'var(--accent-deep)',   'var(--bg)',            4.5],
+  // Code chips, pills, the now-step number, the hover inks: --accent-deep is
+  // CHROME ink in both modes since task 1002822 moved the text links off it
+  // (task 1002750 had already deleted the dark --sun-lit recolors — they pinned
+  // the locked space palette over the branding pack, so a re-themed instance got
+  // Cloud Bongos orange links). The dark blocks derive it from --accent.
+  ['--accent-deep ink on a card',       'var(--accent-deep)',   CARD,                   4.5],
+  ['--accent-deep ink on the ground',   'var(--accent-deep)',   'var(--bg)',            4.5],
   ['code chip on --bg-deep',            'var(--accent-deep)',   'var(--bg-deep)',       4.5],
+  // --link-ink: the text links' own pack-derived token (task 1002822). Nothing
+  // measured --accent-deep as a link ink against the copy AROUND it, and in dark
+  // the two had collapsed into one color — see the separation test below.
+  // --bg-deep is not a link ground today; it is the review panel's robustness
+  // floor, so a link dropped into a --bg-deep panel can never ship under AA.
+  ['--link-ink on a card',              'var(--link-ink)',      CARD,                   4.5],
+  ['--link-ink on the page ground',     'var(--link-ink)',      'var(--bg)',            4.5],
+  ['--link-ink on --bg-deep',           'var(--link-ink)',      'var(--bg-deep)',       4.5],
   // body copy
   ['--ink body copy',                   'var(--ink)',           CARD,                   4.5],
   ['--ink-soft secondary copy',         'var(--ink-soft)',      CARD,                   4.5],
@@ -227,6 +254,103 @@ for (const mode of ['light', 'dark']) {
   });
 }
 
+// ── ink vs ADJACENT ink ──────────────────────────────────────────────────────
+// Every PAIRS row above is (ink, ground), so the suite was structurally blind to
+// a link that measured 8.74:1 on its card and was STILL the same color as the
+// prose it sat in. That is exactly what dark mode shipped: --accent-deep
+// resolved to #e9ad8f beside --ink-soft #dcb693 — ΔE76 9.7, two lightness points
+// apart — and dark links carry text-decoration:none until hover, so font-weight
+// was the only cue left. The live repro was .projMsg a.
+//
+// ΔE76 and not a luminance ratio, even though contrast() is right there: light
+// mode's ACCEPTED separation is ΔE76 40.9 but only 1.10:1 in luminance. The
+// light pair is told apart by chroma, so a luminance floor would fail the good
+// case and pass the bad one.
+//
+// The floor is 12, not light mode's 40.9: dark's warm ink IS a desaturated
+// ember, and srgb color-mix can only slide the accent along the line toward
+// white, so 51% is the most chroma --link-ink can hold before a dark navy pack
+// accent falls under 4.5:1 on --bg-deep. Shipped: 14.1 dark, 40.9 light.
+const LINK_SEPARATION = 12;
+
+test('the link ink never collapses into the copy around it', () => {
+  const failures = [];
+  for (const mode of ['light', 'dark']) {
+    const card = over(resolve(CARD, mode), resolve('var(--page-bg)', mode));
+    const link = over(resolve('var(--link-ink)', mode), card);
+    for (const ink of ['--ink-soft', '--ink-faint']) {
+      const beside = over(resolve(`var(${ink})`, mode), card);
+      const got = deltaE76(link, beside);
+      if (got < LINK_SEPARATION) {
+        failures.push(
+          `${mode}: --link-ink ${hex(link)} vs ${ink} ${hex(beside)} — ` +
+          `ΔE76 ${got.toFixed(1)} (needs ${LINK_SEPARATION})`
+        );
+      }
+    }
+  }
+  assert.deepEqual(failures, [], `\n  ${failures.join('\n  ')}\n`);
+});
+
+// The accent packs the rest of this file never sees. Everything above measures
+// the ONE pack config/branding.neutral.json ships — but --link-ink is DERIVED
+// from --accent in dark, so its tuning has to survive whatever accent a host
+// sets. These four are the review panel's own sweep (task 1002822); each is dark
+// enough to carry white .btn text, which any pack's --accent must already do.
+// DARK only: in light --link-ink is var(--accent-deep), a value the pack ships
+// directly rather than derives, so light is the pack author's own contract.
+const ACCENT_SWEEP = {
+  navy: '#1a237e', forest: '#14532d', red: '#b91c1c', magenta: '#a21caf',
+};
+
+test('--link-ink survives a re-theme in dark mode', () => {
+  const failures = [];
+  const shipped = RAW.dark['--accent'];
+  try {
+    for (const [name, accent] of Object.entries(ACCENT_SWEEP)) {
+      RAW.dark['--accent'] = accent;
+      const page = resolve('var(--page-bg)', 'dark');
+      for (const groundExpr of [CARD, 'var(--bg)', 'var(--bg-deep)']) {
+        const bg = over(resolve(groundExpr, 'dark'), page);
+        const got = contrast(over(resolve('var(--link-ink)', 'dark'), bg), bg);
+        if (got < 4.5) failures.push(`${name} on ${groundExpr}: ${got.toFixed(2)}:1 (needs 4.5)`);
+      }
+      const card = over(resolve(CARD, 'dark'), page);
+      const link = over(resolve('var(--link-ink)', 'dark'), card);
+      for (const ink of ['--ink-soft', '--ink-faint']) {
+        const got = deltaE76(link, over(resolve(`var(${ink})`, 'dark'), card));
+        if (got < LINK_SEPARATION) {
+          failures.push(`${name} vs ${ink}: ΔE76 ${got.toFixed(1)} (needs ${LINK_SEPARATION})`);
+        }
+      }
+    }
+  } finally {
+    RAW.dark['--accent'] = shipped;
+  }
+  assert.deepEqual(failures, [], `\n  ${failures.join('\n  ')}\n`);
+});
+
+test('no text link is left painting --accent-deep', () => {
+  // The migration's own regression net. A token only helps the rules that take
+  // it, and the rules are spread across two sheets: re-pointing cosmos.css alone
+  // left projects.html's own `.humanSteps p a` — a plain inline link sitting in
+  // `.humanSteps p{color:var(--ink-soft)}` — on the colliding ink. Anchor
+  // selectors only: --accent-deep is still the right ink for the chrome that
+  // never sits inside prose (code chips, .tbl/.cardRel pills, .btn.ghost:hover,
+  // .filters button:hover, the .steps/.humanSteps number chips), and each of
+  // those is measured by its own PAIRS row above.
+  const strays = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (!/\ba\b/.test(m[1])) continue;
+      if (/(?:^|[;{\s])color\s*:\s*var\(\s*--accent-deep\s*\)/.test(m[2])) {
+        strays.push(`${where}: ${m[1].trim().slice(0, 70)}`);
+      }
+    }
+  }
+  assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
+});
+
 // The gate's LOCKED sky palette — deliberately absent from COLOR_VARS, so a
 // branding pack can never re-theme these. Dark GROUNDS are allowed (dark mode IS
 // the gate's space, by design); text painted with one shows Cloud Bongos orange