@bongos/core 1.19.148 → 1.19.149

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.148",
-  "core_contract": "1.19.148",
-  "source_commit": "7e339c95065a311ed8124d03557ded14bca9446a",
+  "core_version": "1.19.149",
+  "core_contract": "1.19.149",
+  "source_commit": "38bb790f0c03376979720a73d20e7a966749e06c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T14:24:46.637Z",
+  "built_at": "2026-08-16T14:37:21.742Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1579,
-  "tree_sha256": "8cab3bae4120d167d296a253ea3e0b6064a55de4ea9188fa52a09217898cd086",
+  "tree_sha256": "4d4238a80aa501af9cdf8257ebb99f5f51c806b2f9a87c9b02adcb878cda1af0",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "354de77e768f98c77062278cead6271a3249cfe4ed35d811fb76b497f3028d8b"
+      "sha256": "4683e76f97deb0d808cc94b82abc8bba5b4332646d073cbb95155a305dce7bac"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "23c72c88771c78d76a61334a4710e6ce77a146331de749c944f6bf2890602162"
+      "sha256": "0ba329b9178e83c2d379bc65d0defde57428ae8b317a4c9ad0d900c872eb1d64"
     },
     {
       "path": "public-docs/index.html",
@@ -5612,7 +5612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "c42e08fd814524fd022f74ba651393cd8b3e5ac1418b7cb7c5ea647251af3dc2"
+      "sha256": "dde61de24af4bdb3ed0d00267873ee700c959166a4f86ab3a3283e8813f65bc6"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5782,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f6ad6d7407077ad6166646472601151847a96f338de366e0de4daa692957b205"
+      "sha256": "f551b1a40bb56bfbdef3ad3f40cbbae092c6ac42ac0683c43db63d033aa0a1bb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7107,7 +7107,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "e858ff2ae89fbd1577dc00f988c97b71e91f06ee754f5513ba8c18c214d3e181"
+      "sha256": "9eb05d38e5138e0da16d57d1d4c8768528dbc052acbc1a9d5d5e7cef7d38f06c"
     },
     {
       "path": "tests/module_api.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.148",
+  "version": "1.19.149",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.148",
+      "version": "1.19.149",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.148",
+  "version": "1.19.149",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -207,6 +207,19 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- the declarative agent registry (goal 1000038, ADR 0083 default:false):
+  //     agent definitions reconciled at deploy into agents_definitions + a per-fire
+  //     agents_runs ledger. Carved to modules/agents/ at foundation time, so the
+  //     glob is its module home. `.claude/agents/` is the module's SOURCE surface
+  //     (files-are-source — the committed definitions ARE the input agents-sync
+  //     upserts), listed alongside it on the autonomy precedent, which likewise
+  //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
+  //     with the domain but stays under scripts/gds/ (the dev-box/provisioning
+  //     precedent). Without this key the three Agents goals (1000038/39/40) could
+  //     declare no wall at all (task 1002736).
+  agents: [
+    'modules/agents/', '.claude/agents/', 'scripts/gds/agents-sync.js',
+  ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
   //     platform_identity_projects rows the Explore feed reads. Carved already, so the

package/src/module-api.js

@@ -723,8 +723,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.146 with no explicit bump. run 31950807165. (task 1002620)
 //   1.19.148 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.147 with no explicit bump. run 31952592623. (task 1002620)
+//   1.19.149 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.148 with no explicit bump. run 31953207683. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.148'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.149'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -136,3 +136,33 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
   assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
   assert.equal(scope.scopeIncludesProtected(wall), false, 'goal 1000046 wall stays non-protected (governance widens it later)');
 });
+
+test('agents joined the roster (task 1002736) — the territory goals 1000038/39/40 wall', () => {
+  // Before this, modules/agents/ was covered by NO key, so the three Agents goals
+  // had to stay wall-less: scope_modules:[] resolves to zero globs, and
+  // goal-scope-check then denies EVERY member-authored task (empty_scope).
+  assert.ok(scope.isModuleKey('agents'), 'roster missing module "agents"');
+  const globs = scope.globsForModules(['agents']);
+  assert.ok(globs.includes('modules/agents/'), 'agents owns its module directory');
+  assert.ok(globs.includes('.claude/agents/'), 'the committed definitions are the module source surface');
+  // Derived, not hand-set: none of the agents globs appear in PROTECTED_GLOBS.
+  assert.equal(scope.isProtectedModule('agents'), false);
+  assert.equal(
+    scope.scopeForModule('agents').protected,
+    scope.isProtected(globs),
+    'protected must be the faithful derivation, never a literal',
+  );
+  // Asserted through the REAL consumer (directional containment), not re-implemented.
+  const covers = (touch) => gsc.scopeSubset(['agents'], [touch]).ok;
+  for (const touch of [
+    'modules/agents/module.json',
+    'modules/agents/migrations/agents_001_definitions.sql',
+    '.claude/agents/reviewer.md',
+    'scripts/gds/agents-sync.js',
+  ]) {
+    assert.equal(covers(touch), true, `wall does not cover ${touch}`);
+  }
+  // …and still BOUNDS: the trust core and the sibling definition dir stay outside.
+  assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
+  assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not agents');
+});