@bongos/core 1.19.152 → 1.19.154

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.152",
-  "core_contract": "1.19.152",
-  "source_commit": "57dc9f163cb5625cf780805c8beca257e40771a9",
+  "core_version": "1.19.154",
+  "core_contract": "1.19.154",
+  "source_commit": "fbe11785041864be4c61ec8bb98507574cdd5f10",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T15:32:33.424Z",
+  "built_at": "2026-08-16T15:55:19.456Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1579,
-  "tree_sha256": "08344ee3c5fade79cafd7d56d0de9e5a08d542c27b67e1c7362213fb51fe6eb1",
+  "tree_sha256": "b118dbf9bacb9695248f0821386defeac7d1498742efe7e907383359eb1f070b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bd55eac572b5c23a50a7e53328e42984a7b5f14a62bbe038648792c6ddf6b92f"
+      "sha256": "9f78c537cd7c7914c01ae8fd732fa039c2c749e9ee7f4cf3395d6ce71d0070c8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e04229a40fcabca2604e6eec41b7b3c6a1c393701f2191f85b12bce1ac19faa1"
+      "sha256": "d5a00856ea454cdbf92b96b9a2d536272b3dd0481cdf8ecdb92c6e5bff9ec6eb"
     },
     {
       "path": "public-docs/index.html",
@@ -4877,12 +4877,12 @@
     {
       "path": "scripts/gds/gen-repo-map.js",
       "mode": "0000644",
-      "sha256": "5b5a3a160dcf65745e052bb08a85a707cdae67ecab2228487fce15872783a673"
+      "sha256": "138c53e17099ef3d5f8809f1be6311e07c4bdd4bd7dd6def2c7c6c57a2e8ba67"
     },
     {
       "path": "scripts/gds/gen-session-index.js",
       "mode": "0000644",
-      "sha256": "93b76f22c490a28cdf64a62795c3e7f67bf3b86d2a5331d8d4eed2550a2d89db"
+      "sha256": "c7bdbd7f7a4d2647be17ad37b540afc35913db80d121000346256d57c065f9fa"
     },
     {
       "path": "scripts/gds/git-merge-regen.js",
@@ -5032,7 +5032,7 @@
     {
       "path": "scripts/gds/newcomer-floor.templates.json",
       "mode": "0000644",
-      "sha256": "84abea5b31457611ed8fa27d33e492d513535ba373f47ba1144c06a56923d1d0"
+      "sha256": "71aea42030aaba504d29841b67de74e2c7c58d62d3a2cfc90996734e35c4236b"
     },
     {
       "path": "scripts/gds/newcomer-floor.test.js",
@@ -5782,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "31253b17c39aa10433fe72daffaf8e1591082cb5d8bbac470957be0b2aea125f"
+      "sha256": "0ab78138a36bd9d516a9dd8e3fed336297b4c87387fa6a2254811d5286d938ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7457,7 +7457,7 @@
     {
       "path": "tests/repo_map.mjs",
       "mode": "0000644",
-      "sha256": "b88208852062b4e8c8efcb44380e13205cd4d5ece7eed4e6c340a0ea969b33a9"
+      "sha256": "12fe5a30bfebce58aa179767590df53cc5f220a1f7257bded08aef94fbe43507"
     },
     {
       "path": "tests/reward_gate.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.152",
+  "version": "1.19.154",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.152",
+      "version": "1.19.154",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.152",
+  "version": "1.19.154",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-repo-map.js

@@ -24,6 +24,9 @@
 //   node scripts/gds/gen-repo-map.js --check       # write nothing; exit 2 if EITHER bucket would change
 //   node scripts/gds/gen-repo-map.js --check-block # exit 2 only if a TRACKED nested block would change (the CI gate)
 //   node scripts/gds/gen-repo-map.js --check-whole # exit 2 only if docs/repo-map.md would change
+//   node scripts/gds/gen-repo-map.js --whole-only  # WRITE docs/repo-map.md only; never touch the
+//                                                  # tracked nested blocks (what a SPARSE dev-box
+//                                                  # checkout must use — task 1002962)
 // docs/repo-map.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926);
 // only the nested-doc symbol blocks stay tracked, so CI gates the block bucket, not the whole file.
 //   node scripts/gds/gen-repo-map.js --json       # print the extracted model as JSON (debug)
@@ -463,6 +466,21 @@ function main() {
   const checkAll = process.argv.includes('--check');
   const checkWhole = process.argv.includes('--check-whole');
   const checkBlock = process.argv.includes('--check-block');
+  // WRITE-side bucket selection, the sibling of the --check-* flags above (task
+  // 1002962). --whole-only regenerates the GITIGNORED docs/repo-map.md and leaves
+  // the TRACKED nested blocks alone.
+  //
+  // WHY a caller ever needs this: a dev box is a SPARSE checkout (box-access.js
+  // materializes only the claim's module cone). The block ordering is
+  // `b.refs - a.refs || name`, and `refs` counts references across the VISIBLE
+  // corpus — so a box with 7 of 20 modules computes different counts and emits a
+  // legitimately different block. Written into a tracked file that dirties the
+  // working tree, and box-source-fetch.sh's NEXT `git pull` aborts with "local
+  // changes would be overwritten" — a silent, permanent sync deadlock (one box sat
+  // 257 commits behind for three days). A box CONSUMES these blocks; they arrive
+  // correct with the pull, generated by CI from the whole tree. Only a full
+  // checkout may produce them.
+  const wholeOnly = process.argv.includes('--whole-only');
   const model = buildModel();
 
   if (process.argv.includes('--json')) {
@@ -478,8 +496,9 @@ function main() {
   const mapCur = fs.existsSync(mapPath) ? fs.readFileSync(mapPath, 'utf8') : '';
   if (!sameContent(mapCur, mapNext)) writes.push({ full: mapPath, content: mapNext, rel: 'docs/repo-map.md', bucket: 'whole' });
 
-  // 2) nested CLAUDE.md generated blocks (tracked; the HARD-gated bucket)
-  for (const dir of NESTED_DIRS) {
+  // 2) nested CLAUDE.md generated blocks (tracked; the HARD-gated bucket).
+  //     Skipped entirely under --whole-only — see the flag's rationale above.
+  for (const dir of (wholeOnly ? [] : NESTED_DIRS)) {
     const docPath = path.join(REPO_ROOT, dir, 'CLAUDE.md');
     if (!fs.existsSync(docPath)) {
       console.error(`gen-repo-map: WARN nested doc missing, skipping: ${dir}/CLAUDE.md`);

package/scripts/gds/gen-session-index.js

@@ -25,6 +25,8 @@
 //   node scripts/gds/gen-session-index.js --check       # write nothing; exit 2 if EITHER bucket would change
 //   node scripts/gds/gen-session-index.js --check-block # exit 2 only if the tracked CLAUDE.md §13 snippet drifts (CI gate)
 //   node scripts/gds/gen-session-index.js --check-whole # exit 2 only if docs/session-log-index.md drifts
+//   node scripts/gds/gen-session-index.js --whole-only  # WRITE the index only; never touch the tracked
+//                                                       # CLAUDE.md snippet (sparse dev-box use; task 1002962)
 // docs/session-log-index.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926).
 //   node scripts/gds/gen-session-index.js --json       # print the parsed entries as JSON (debug)
 
@@ -180,7 +182,15 @@ function main() {
     process.stdout.write(JSON.stringify(collectEntries(), null, 2) + '\n');
     return;
   }
-  const { writes } = computeWrites();
+  // WRITE-side bucket selection — the sibling of the --check-* flags (task 1002962,
+  // the gen-repo-map --whole-only twin). A dev box is a SPARSE checkout, so writing
+  // the TRACKED bucket there dirties the tree and the next `git pull` in
+  // box-source-fetch.sh aborts on "local changes would be overwritten" — a silent,
+  // permanent sync deadlock. A box regenerates only the gitignored artifact; the
+  // tracked CLAUDE.md §13 snippet arrives with the pull, generated from the whole tree.
+  const wholeOnly = process.argv.includes('--whole-only');
+  const all = computeWrites().writes;
+  const writes = wholeOnly ? all.filter((w) => w.bucket === 'whole') : all;
   if (checkAll || checkWhole || checkBlock) {
     const wantBlock = checkAll || checkBlock;
     const wantWhole = checkAll || checkWhole;

package/scripts/gds/newcomer-floor.templates.json

@@ -1,9 +1,9 @@
 {
-  "_doc": "The evergreen newcomer chores, grouped BY DISCIPLINE. Each discipline maps to a LIST of chore templates (was a single object before task 1488 — a discipline can now offer several first-builder chores so newcomers are not funnelled into one). The deterministic replenisher (scripts/gds/newcomer-floor.js) and the on-claim restock (modules/onboarding/newcomer-restock.js) stamp disposable claimable COPIES from each template; the TEMPLATE is never claimed and never ships. Each copy's source_ref is tmpl:<discipline>:<template_id>:<seq> (monotonic), so identical-title copies never collide with the dedup. Per-template `floor` sets that chore’s standing pool depth; if a template omits it, the discipline default in newcomer-floor.config.json applies. credits_reward, est_minutes and floor all live here (per chore). version_id is per-template so each chore lands on the correct track (engineer=internal GDS-V4, artist+ideator=product V2); it MUST point at an open (non-shipped) version — update it at version close. touches[] is intentionally empty so multiple same-discipline newcomers can claim copies concurrently; git-merge is the real collision detector. To ADD a chore: append an entry to the discipline's array. To CHANGE one: edit it here — no code change needed. Engineer offers a SAFE coding chore (add a unit test — touches only tests/, which auto-ships) and the docs-hygiene sweep (constrained to non-protected docs so a sub-Metic ship does not stall on the authority core).",
+  "_doc": "The evergreen newcomer chores, grouped BY DISCIPLINE. Each discipline maps to a LIST of chore templates (was a single object before task 1488 — a discipline can now offer several first-builder chores so newcomers are not funnelled into one). The deterministic replenisher (scripts/gds/newcomer-floor.js) and the on-claim restock (modules/onboarding/newcomer-restock.js) stamp disposable claimable COPIES from each template; the TEMPLATE is never claimed and never ships. Each copy's source_ref is tmpl:<discipline>:<template_id>:<seq> (monotonic), so identical-title copies never collide with the dedup. Per-template `floor` sets that chore’s standing pool depth; if a template omits it, the discipline default in newcomer-floor.config.json applies. credits_reward, est_minutes and floor all live here (per chore). version_id is per-template so each chore lands on the correct track; it MUST point at an open (non-shipped) version — update it at version close, or the replenisher's open-version guard refuses to stamp and the floor silently stops refilling (task 1002958: the engineer pins still read the long-shipped GDS-V4 and artist+ideator read V2, a version this ladder never had, so NO discipline could restock). touches[] is intentionally empty so multiple same-discipline newcomers can claim copies concurrently; git-merge is the real collision detector. To ADD a chore: append an entry to the discipline's array. To CHANGE one: edit it here — no code change needed. Engineer offers a SAFE coding chore (add a unit test — touches only tests/, which auto-ships) and the docs-hygiene sweep (constrained to non-protected docs so a sub-Metic ship does not stall on the authority core).",
   "engineer": [
     {
       "template_id": "unit-test-pass",
-      "version_id": "GDS-V4",
+      "version_id": "BONGOS-V1",
       "discipline": "engineer",
       "kind": "feature",
       "est_minutes": 45,
@@ -22,7 +22,7 @@
     },
     {
       "template_id": "docs-hygiene-pass",
-      "version_id": "GDS-V4",
+      "version_id": "BONGOS-V1",
       "discipline": "engineer",
       "kind": "cleanup",
       "est_minutes": 40,
@@ -43,7 +43,7 @@
   "artist": [
     {
       "template_id": "asset-generate-pass",
-      "version_id": "V2",
+      "version_id": "BONGOS-V1",
       "discipline": "artist",
       "kind": "feature",
       "est_minutes": 55,
@@ -64,7 +64,7 @@
   "ideator": [
     {
       "template_id": "idea-seed-pass",
-      "version_id": "V2",
+      "version_id": "BONGOS-V1",
       "discipline": "ideator",
       "kind": "feature",
       "est_minutes": 45,

package/src/module-api.js

@@ -731,8 +731,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.150 with no explicit bump. run 31953827282. (task 1002620)
 //   1.19.152 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.151 with no explicit bump. run 31955923444. (task 1002620)
+//   1.19.153 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.152 with no explicit bump. run 31956560292. (task 1002620)
+//   1.19.154 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.153 with no explicit bump. run 31957052737. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.152'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.154'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/repo_map.mjs

@@ -2,7 +2,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
@@ -94,3 +94,42 @@ test('extractor parses functions, classes, arrow consts, and module.exports', ()
   const apiCall = model.allSyms.find((s) => s.name === 'apiCall' && s.file === 'scripts/gds/cli-lib.js');
   assert.ok(apiCall && apiCall.exported && apiCall.kind === 'fn', 'exported arrow/fn const detected with export flag');
 });
+
+test('--whole-only never writes a TRACKED nested block (the sparse-box deadlock guard, task 1002962)', () => {
+  // A dev box is a SPARSE checkout — box-access.js materializes only the claim's
+  // module cone. The block ordering is `b.refs - a.refs || name` and `refs` counts
+  // references across the VISIBLE corpus, so a box with 7 of 20 modules emits a
+  // legitimately different block. box-source-fetch.sh used to write it, dirtying
+  // tracked files, and the NEXT `git pull` aborted on "local changes would be
+  // overwritten" — a silent permanent sync deadlock (one box sat 257 commits behind
+  // for three days). A box CONSUMES these blocks; only a full checkout may write them.
+  //
+  // Asserted on CONTENT, not on the log line: dirty a tracked block, run --whole-only,
+  // and require the block to come back byte-identical. A regression that re-enabled the
+  // bucket would rewrite it and fail here even if the summary line still looked right.
+  const tracked = path.join(ROOT, 'scripts', 'gds', 'CLAUDE.md');
+  const pristine = readFileSync(tracked, 'utf8');
+  const drifted = `${pristine}\n<!-- simulated sparse-checkout drift -->\n`;
+  writeFileSync(tracked, drifted);
+  try {
+    const r = run(['--whole-only']);
+    assert.equal(r.code, 0, `--whole-only should exit 0, got ${r.code} ${r.stderr || ''}`);
+    assert.equal(
+      readFileSync(tracked, 'utf8'),
+      drifted,
+      '--whole-only rewrote a tracked nested block — this is the deadlock that stranded a box 257 commits behind',
+    );
+    assert.ok(!r.stdout.includes('CLAUDE.md'), `--whole-only must not report a nested-doc write; got: ${r.stdout.trim()}`);
+  } finally {
+    writeFileSync(tracked, pristine);
+  }
+});
+
+test('the default (no-flag) run still owns BOTH buckets', () => {
+  // --whole-only must be strictly opt-in: CI and a full-checkout dev run keep
+  // regenerating the tracked blocks, which is what makes them trustworthy in git.
+  const src = readFileSync(GEN, 'utf8');
+  assert.match(src, /wholeOnly \? \[\] : NESTED_DIRS/, 'bucket skip should be gated on the flag, not unconditional');
+  // and on a clean tree the tracked bucket is genuinely current
+  assert.equal(run(['--check-block']).code, 0, 'tracked blocks must be current on a clean checkout');
+});