@bongos/core 1.19.148 → 1.19.150

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.148",
-  "core_contract": "1.19.148",
-  "source_commit": "7e339c95065a311ed8124d03557ded14bca9446a",
+  "core_version": "1.19.150",
+  "core_contract": "1.19.150",
+  "source_commit": "ba28eaba03c65c990128c56929d0e30a18a2cb14",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T14:24:46.637Z",
+  "built_at": "2026-08-16T14:43:24.321Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1579,
-  "tree_sha256": "8cab3bae4120d167d296a253ea3e0b6064a55de4ea9188fa52a09217898cd086",
+  "tree_sha256": "5429ba0237ab985ff79be4a1b9a03dd24cacd6260fdc604247b7eef8a36583dc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3162,7 +3162,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "fcfe94b3e0cd00ddc881283d9897121518a7acc00b3d05b0715552911e2a0705"
+      "sha256": "f24cfdca48676d882cfa51754fcf1519ade4646a760cb2be1db71fbc27571bca"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3197,7 +3197,7 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "672ef980513a150a81773ad674750e7d1560535dd08cbf2e1463155fbe00d7f6"
+      "sha256": "4d5ec8f334fc00f23e81fe21283b7ea2fb173b253c638a08ef48b97111cc654f"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -3407,7 +3407,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "2430a3b351d80ae55724c1bfd1c514855e9a5c04ceaa1012e4475d2dc09b9d84"
+      "sha256": "ac6bfa459924a43005625e9c2655a5a1397c941dfa0727594bb25f930180d36a"
     },
     {
       "path": "modules/hall-ui/public/watch.css",
@@ -3427,7 +3427,7 @@
     {
       "path": "modules/hall-ui/public/work.css",
       "mode": "0000644",
-      "sha256": "8ad8c570a2196aabb46c86e8efcfab2b0d22451b4f23aa10a02b4f52d1415690"
+      "sha256": "e5dd2fd84b31174d10bb6558920cbbc9e34b1776d775db3c69518810a1c7b96c"
     },
     {
       "path": "modules/hall-ui/public/work.html",
@@ -3437,7 +3437,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "eb7e5919af8d60c5ae6f68e05a5d97e4b7ca97fa17941b79086eec39c9af7faf"
+      "sha256": "8ee189def6ded1c8669212d7233f57948ac58bf23ad8277422996ffd8914e537"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "354de77e768f98c77062278cead6271a3249cfe4ed35d811fb76b497f3028d8b"
+      "sha256": "86e259a725603b58d5659d630124568731893e6497d933327cbc29ab733955b8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "23c72c88771c78d76a61334a4710e6ce77a146331de749c944f6bf2890602162"
+      "sha256": "cf358f722d2710aa11787645b256c890c6508e5c34ff735044ef8a9b28951d7e"
     },
     {
       "path": "public-docs/index.html",
@@ -5612,7 +5612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "c42e08fd814524fd022f74ba651393cd8b3e5ac1418b7cb7c5ea647251af3dc2"
+      "sha256": "dde61de24af4bdb3ed0d00267873ee700c959166a4f86ab3a3283e8813f65bc6"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5782,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f6ad6d7407077ad6166646472601151847a96f338de366e0de4daa692957b205"
+      "sha256": "6cdc6cf28bcb58d18a41a575a253e9066e4fc6d1f86b8d1f7be60e12b99784db"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7107,7 +7107,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "e858ff2ae89fbd1577dc00f988c97b71e91f06ee754f5513ba8c18c214d3e181"
+      "sha256": "9eb05d38e5138e0da16d57d1d4c8768528dbc052acbc1a9d5d5e7cef7d38f06c"
     },
     {
       "path": "tests/module_api.mjs",

package/modules/hall-ui/public/goals-page.js

@@ -529,6 +529,9 @@
     const touchesChip = touches.length
       ? `<span class="task__touches" title="${escapeHtml(touches.join('\n'))}">✎ ${touches.length} file${touches.length === 1 ? '' : 's'}</span>`
       : '';
+    // task 1002955: same age chip the board renders — reviewing a goal for stale
+    // work is the case that needed it most.
+    const ageChip = window.OTBKit.ageChipHtml(t.created_at);
     const claim = state.claimsByTask.get(id);
     const isReady = t.status === 'ready' && !!state.me;
     const mineActive = t.status === 'active' && claim && sameId(claim.builder_id, selfId());
@@ -569,6 +572,7 @@
             <span>${minutesText}</span>
             <span>${cpmText}</span>
             ${touchesChip}
+            ${ageChip}
           </div>
         </div>
         <div class="task__credits">

package/modules/hall-ui/public/hall-kit.js

@@ -417,6 +417,66 @@
     };
   }
 
+  // ---- age (task 1002955) ------------------------------------------------------
+  // How old is this row? The board, the goal Work card and the task panel all
+  // render a task's kind/estimate/credits but never said when it was written, so
+  // a queue of 40 ready tasks read as equally fresh whether it was filed
+  // yesterday or three months ago. Kit-level because the card markup is
+  // duplicated across work.js + goals-page.js (task 1002463) and a third
+  // hand-rolled date helper is exactly what this file exists to prevent.
+
+  // Coarse buckets on purpose: past a week nobody cares about the hour, and the
+  // exact day is one hover away (ageChipHtml puts it on title=). Anything in the
+  // future — a clock skew, a seeded row — clamps to "new" rather than "-3d".
+  const AGE_STALE_DAYS = 30;
+  function fmtAge(iso) {
+    if (!iso) return '';
+    const ms = Date.now() - new Date(iso).getTime();
+    if (!Number.isFinite(ms)) return '';
+    const days = Math.floor(ms / 86400000);
+    if (days < 0) return 'new';
+    if (days === 0) return 'today';
+    if (days === 1) return '1d';
+    if (days < 14) return `${days}d`;
+    if (days < 60) return `${Math.floor(days / 7)}w`;
+    // Clamped at 11: 30-day months overshoot, so days 330-364 would otherwise
+    // print "12mo" immediately before the year bucket takes over at 365.
+    if (days < 365) return `${Math.min(11, Math.floor(days / 30))}mo`;
+    const years = Math.floor(days / 365);
+    const rem = Math.floor((days % 365) / 30);
+    return rem ? `${years}y ${rem}mo` : `${years}y`;
+  }
+
+  // Absolute date for the tooltip — locale-formatted, no time (the age chip is
+  // about which week something was filed, not which minute).
+  function fmtAbsDate(iso) {
+    if (!iso) return '';
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime())) return '';
+    try {
+      return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
+    } catch (_) { return d.toISOString().slice(0, 10); }
+  }
+
+  function ageDays(iso) {
+    if (!iso) return null;
+    const ms = Date.now() - new Date(iso).getTime();
+    return Number.isFinite(ms) ? Math.floor(ms / 86400000) : null;
+  }
+
+  // ageChipHtml(iso, opts?) → the meta-row chip. Past AGE_STALE_DAYS it gains
+  // .task__age--stale, so scanning a goal's queue for work that has been sitting
+  // is a glance rather than an API call. `label` names the date in the tooltip
+  // ("Created" by default) so the same chip can carry other timestamps.
+  function ageChipHtml(iso, { label = 'Created' } = {}) {
+    const text = fmtAge(iso);
+    if (!text) return '';
+    const days = ageDays(iso);
+    const stale = days != null && days >= AGE_STALE_DAYS;
+    const abs = fmtAbsDate(iso);
+    return `<span class="task__age${stale ? ' task__age--stale' : ''}" title="${esc(label)} ${esc(abs)}">${esc(text)}</span>`;
+  }
+
   // ---- empty state / skeleton / collapsible ------------------------------------
 
   // One standard empty pattern: a short line + at most one action link. An
@@ -465,6 +525,8 @@
     makeLedger, makeFilterBar, makeTabs, makeSectionRail,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
+    // age (task 1002955)
+    fmtAge, fmtAbsDate, ageChipHtml, AGE_STALE_DAYS,
   };
 
   // Node-require-safe (the dom-utils.js pattern): assignment is the only

package/modules/hall-ui/public/task.js

@@ -184,6 +184,14 @@
     if (t.est_minutes) meta.push(`${t.est_minutes}m`);
     parts.push(`<p class="deeplink-card__meta">${meta.join(' · ')}</p>`);
 
+    // task 1002955: when was this written? The panel showed a shipped date but
+    // never a created one, so an untouched task carried no age at all. Absolute
+    // date first (the panel has the room the card chip doesn't), age after it.
+    if (t.created_at) {
+      const age = fmtRel(t.created_at);
+      parts.push(`<p class="deeplink-card__note">Created ${escapeHtml(fmtDate(t.created_at))}${age ? ` — ${escapeHtml(age)}` : ''}.</p>`);
+    }
+
     if (t.goal_id) {
       parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a></p>`);
     }

package/modules/hall-ui/public/work.css

@@ -66,6 +66,21 @@
   cursor: help;
 }
 
+/* How old the task is (task 1002955, OTBKit.ageChipHtml). Quiet by default —
+   it's orientation, not a call to act — but a task past the stale threshold
+   steps up from faint to soft+bold so a queue that has been sitting reads at a
+   glance instead of needing the API. The exact date is on the tooltip, hence
+   `cursor: help`. Deliberately NOT --warn: that token is a dark amber paired
+   with --warn-weak behind it, and as bare text it loses contrast on the dark
+   theme's card. --ink-soft steps up legibly in both. */
+.task__age {
+  color: var(--ink-faint);
+  font-size: 12px;
+  white-space: nowrap;
+  cursor: help;
+}
+.task__age--stale { color: var(--ink-soft); font-weight: 600; }
+
 .task__tag--newcomer {
   background: var(--ok-weak);
   color: var(--ok);

package/modules/hall-ui/public/work.js

@@ -360,6 +360,9 @@
       const touchesChip = touches.length
         ? `<span class="task__touches" title="${escapeHtml(touches.join('\n'))}">✎ ${touches.length} file${touches.length === 1 ? '' : 's'}</span>`
         : '';
+      // task 1002955: how old is this task? A ready queue reads as equally fresh
+      // without it; the exact date rides the tooltip.
+      const ageChip = window.OTBKit.ageChipHtml(t.created_at);
       const selected = selection.claim.has(String(t.id));
       return `
         <div class="task${selected ? ' task--selected' : ''}" data-task-id="${t.id}">
@@ -380,6 +383,7 @@
               <span>${minutesText}</span>
               <span>${cpmText}</span>
               ${touchesChip}
+              ${ageChip}
             </div>
           </div>
           <div class="task__credits">

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.148",
+  "version": "1.19.150",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.148",
+      "version": "1.19.150",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.148",
+  "version": "1.19.150",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -207,6 +207,19 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- the declarative agent registry (goal 1000038, ADR 0083 default:false):
+  //     agent definitions reconciled at deploy into agents_definitions + a per-fire
+  //     agents_runs ledger. Carved to modules/agents/ at foundation time, so the
+  //     glob is its module home. `.claude/agents/` is the module's SOURCE surface
+  //     (files-are-source — the committed definitions ARE the input agents-sync
+  //     upserts), listed alongside it on the autonomy precedent, which likewise
+  //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
+  //     with the domain but stays under scripts/gds/ (the dev-box/provisioning
+  //     precedent). Without this key the three Agents goals (1000038/39/40) could
+  //     declare no wall at all (task 1002736).
+  agents: [
+    'modules/agents/', '.claude/agents/', 'scripts/gds/agents-sync.js',
+  ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
   //     platform_identity_projects rows the Explore feed reads. Carved already, so the

package/src/module-api.js

@@ -723,8 +723,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.146 with no explicit bump. run 31950807165. (task 1002620)
 //   1.19.148 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.147 with no explicit bump. run 31952592623. (task 1002620)
+//   1.19.149 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.148 with no explicit bump. run 31953207683. (task 1002620)
+//   1.19.150 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.149 with no explicit bump. run 31953504697. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.148'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.150'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -136,3 +136,33 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
   assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
   assert.equal(scope.scopeIncludesProtected(wall), false, 'goal 1000046 wall stays non-protected (governance widens it later)');
 });
+
+test('agents joined the roster (task 1002736) — the territory goals 1000038/39/40 wall', () => {
+  // Before this, modules/agents/ was covered by NO key, so the three Agents goals
+  // had to stay wall-less: scope_modules:[] resolves to zero globs, and
+  // goal-scope-check then denies EVERY member-authored task (empty_scope).
+  assert.ok(scope.isModuleKey('agents'), 'roster missing module "agents"');
+  const globs = scope.globsForModules(['agents']);
+  assert.ok(globs.includes('modules/agents/'), 'agents owns its module directory');
+  assert.ok(globs.includes('.claude/agents/'), 'the committed definitions are the module source surface');
+  // Derived, not hand-set: none of the agents globs appear in PROTECTED_GLOBS.
+  assert.equal(scope.isProtectedModule('agents'), false);
+  assert.equal(
+    scope.scopeForModule('agents').protected,
+    scope.isProtected(globs),
+    'protected must be the faithful derivation, never a literal',
+  );
+  // Asserted through the REAL consumer (directional containment), not re-implemented.
+  const covers = (touch) => gsc.scopeSubset(['agents'], [touch]).ok;
+  for (const touch of [
+    'modules/agents/module.json',
+    'modules/agents/migrations/agents_001_definitions.sql',
+    '.claude/agents/reviewer.md',
+    'scripts/gds/agents-sync.js',
+  ]) {
+    assert.equal(covers(touch), true, `wall does not cover ${touch}`);
+  }
+  // …and still BOUNDS: the trust core and the sibling definition dir stay outside.
+  assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
+  assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not agents');
+});