@bongos/core 1.19.189 → 1.19.190

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.189",
-  "core_contract": "1.19.189",
-  "source_commit": "106408b1519091ef056ef82d9bd542a68308e363",
+  "core_version": "1.19.190",
+  "core_contract": "1.19.190",
+  "source_commit": "99bc31cf263be3e12b7260e97be6d86b95d7d210",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T00:49:35.464Z",
+  "built_at": "2026-08-17T00:54:57.379Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 309,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1612,
-  "tree_sha256": "386f81ead8236148579f8ab7743305bf0e2edbd8d0349ad9125e23d90eba84fe",
+  "tree_sha256": "2c7de5d40b0d85e5c39e5f55c8c0f340cdf45df52687019751d2ec3088194d14",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2977,7 +2977,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "63e80d002e09d05a93238e15491a82dd733baea219814e8f7e2961ecb5373e1f"
+      "sha256": "c229aec4f02fe970f4a3f798d370eef9b080cd0837f906b574362abda57107ad"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4262,12 +4262,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "15ace363831ad92eff83b61408618af68029feb1701bc757dc007390cfbc13f7"
+      "sha256": "b63d0bd77af72944106d5b482777b258187917342097cae72ad09078747b411c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "31315335f0107717d68755300632cd57b25f62b6d58a6b5309ba82030bf894ce"
+      "sha256": "b5675fea41d22048c57fe51577a36330597e91b1864051a1537aa37f18e1bc16"
     },
     {
       "path": "public-docs/index.html",
@@ -4892,7 +4892,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "65648d6d05b73dafc08194e843850b460b738a17b565a69a5234dd817386eea8"
+      "sha256": "5cc94859033c924884efa60f50f8a1f7810a85382c42d785d62b804181a195f5"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5872,7 +5872,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a47c1e24a6e69d6b109956b1fe0e9acc34905fc148de1199a132301d66e3d597"
+      "sha256": "3b8d188039825cd1f1a64e7d33246152e293e452df2f2bee8a586acfc22ccfc4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6852,7 +6852,7 @@
     {
       "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "099954d8dbfa1fd3d503ee1b4825f9a3f10d5ae1e3694c600dd3f06e6a21a127"
+      "sha256": "3b2e0ca134737992590132f089d5f93b479ad6cec83a5d2a932412b3edaf4547"
     },
     {
       "path": "tests/government_seed.mjs",

package/modules/government/routes/government.js

@@ -185,11 +185,11 @@ module.exports = function buildGovernmentRouter() {
   const ARCHON_REASON = 'the Archon rank-rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
   const ASSIGN_REASON = 'a seeded rank-rank is assigned by rank (R95b sync); change the builder\'s rank instead';
 
-  // ── one-release compatibility aliases: /governance/* -> /government/* ──────
+  // ── the one-release LEGACY path aliases: /governance/* -> /government/* ────
   // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
   // release. The case this actually protects is narrow but real: a browser that
   // still has the OLD hall page open when the instance upgrades will keep calling
-  // /governance/* against the new server. Everything else that consumed these
+  // the legacy /governance/* paths against the new server. Everything else that
   // paths (the hall bundle, the generated client) ships INSIDE the same core
   // package and moves in lockstep.
   //
@@ -201,11 +201,39 @@ module.exports = function buildGovernmentRouter() {
   // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
   // The `alias` counter in the log line is how we tell whether anything still
   // calls them before deleting.
+  //
+  // EXPRESS 4 WILDCARD SYNTAX. This is express 4.22 — the wildcard is a bare `*`
+  // and the captured tail is req.params[0]. Express 5's named form (`/*rest`) is
+  // NOT a wildcard here, it is a literal path segment, so it silently matches
+  // nothing and every legacy path 404s. It shipped that way once (task 1003006)
+  // and was only caught by curling the live site after the cutover — the module
+  // parsed fine, so nothing local failed.
   const LEGACY_PATH_PREFIX = '/governance';
-  router.all(`${LEGACY_PATH_PREFIX}/*rest`, (req, res, next) => {
-    const rest = req.originalUrl.slice(req.originalUrl.indexOf(LEGACY_PATH_PREFIX) + LEGACY_PATH_PREFIX.length);
-    if (!rest) return next();
-    const target = `/government${rest.replace(/^\/ranks(?=\/|$)/, '/ranks')}`;
+  // The legacy noun -> the current one, as a NAMED DATA PAIR rather than an
+  // inline regex literal. An inline pattern here was silently rewritten by a
+  // repo-wide sweep so that both sides matched, turning the translation into an
+  // identity function that redirected to a path which does not exist. Naming the
+  // pair and asserting they differ makes that class of damage loud.
+  //
+  // Every line in this block that spells the legacy vocabulary carries the word
+  // LEGACY on purpose: that is what the ADR 0174 fitness allowlist keys on, so
+  // the shim can name what it is compatible with without excusing the whole file.
+  const LEGACY_SEGMENT = 'roles';   // legacy
+  const CURRENT_SEGMENT = 'ranks';
+  if (LEGACY_SEGMENT === CURRENT_SEGMENT) {
+    throw new Error('government legacy alias: the rename pair collapsed to an identity — a sweep has eaten it');
+  }
+  router.all(`${LEGACY_PATH_PREFIX}/*`, (req, res, next) => {
+    const tail = req.params[0] || '';            // express 4: bare * captures here
+    if (!tail) return next();
+    // Translate the leading segment, keep everything after it, keep the query.
+    const translated = tail === LEGACY_SEGMENT || tail.startsWith(`${LEGACY_SEGMENT}/`)
+      ? CURRENT_SEGMENT + tail.slice(LEGACY_SEGMENT.length)
+      : tail;
+    const qs = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
+    // req.baseUrl is the router's MOUNT point (/api/gds). Redirecting without it
+    // sends the caller to /government/... at the site root, which 404s.
+    const target = `${req.baseUrl}/government/${translated}${qs}`;
     console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
     return res.redirect(308, target);
   });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.189",
+  "version": "1.19.190",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.189",
+      "version": "1.19.190",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.189",
+  "version": "1.19.190",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1690,11 +1690,13 @@ const VOCAB_ALLOW = [
   },
   {
     file: 'modules/government/routes/government.js',
-    match: '/governance',
+    match: 'legacy',
     why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
-       + 'compatibility shim has to name the thing it is compatible with. Note the '
-       + 'match requires the leading SLASH — this permits citing the legacy PATH, not '
-       + 'the bare word. Delete with the alias block one release after the rename ships.',
+       + 'compatibility shim has to name the thing it is compatible with. The match is '
+       + 'the word LEGACY, and the shim block is written so that every line spelling the '
+       + 'old vocabulary carries it — so the exemption is scoped to the shim rather than '
+       + 'to the whole file, and a stray "role" elsewhere in this file still reds the '
+       + 'build. Delete with the alias block one release after the rename ships.',
   },
   {
     file: 'modules/government/module.json',

package/src/module-api.js

@@ -805,8 +805,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.187 with no explicit bump. run 31978931152. (task 1002620)
 //   1.19.189 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.188 with no explicit bump. run 31983108640. (task 1002620)
+//   1.19.190 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.189 with no explicit bump. run 31983360426. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.189'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.190'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_routes.mjs

@@ -151,16 +151,19 @@ after(() => {
   seams._reset();
 });
 
-async function call(method, p, body) {
+async function call(method, p, body, opts = {}) {
   calls.length = 0;
   const res = await fetch(`${BASE}${p}`, {
     method,
     headers: body === undefined ? {} : { 'content-type': 'application/json' },
     body: body === undefined ? undefined : JSON.stringify(body),
+    // `redirect: 'manual'` lets a caller assert the 308 itself rather than
+    // silently following it — required by the legacy-alias tests at the bottom.
+    ...(opts.redirect ? { redirect: opts.redirect } : {}),
   });
   let json = null;
   try { json = await res.json(); } catch { /* no body */ }
-  return { status: res.status, json };
+  return { status: res.status, json, headers: res.headers };
 }
 
 // --- the deny wall -----------------------------------------------------------
@@ -392,3 +395,67 @@ test('DELETE /governance/assignments validates the builder id param', async () =
   const r = await call('DELETE', '/government/assignments/not-a-number/triage-helper');
   assert.equal(r.status, 400);
 });
+
+// ── the one-release /governance/* compatibility alias (ADR 0174) ──────────────
+//
+// This block exists because the alias shipped BROKEN and nothing caught it.
+// Three independent defects, none visible to a parse check or a unit test that
+// only imports the module:
+//   1. it was written with express 5's named-wildcard syntax (`/*rest`) on an
+//      express 4.22 router, where that is a literal segment — so it matched
+//      nothing and every legacy path 404'd;
+//   2. the redirect omitted req.baseUrl, sending callers to /government/... at
+//      the site root instead of under the /api/gds mount;
+//   3. a repo-wide roles->ranks sweep rewrote the SOURCE side of the
+//      /^\/roles/ -> '/ranks' translation, turning it into an identity that
+//      redirected to a path which does not exist.
+//
+// All three only surfaced when the running site was curled after the cutover.
+// These tests drive a real router so they cannot repeat that.
+
+// A SECOND server, mounted at /api/gds exactly as production does. The main
+// harness above mounts at the root, so it cannot see a missing req.baseUrl —
+// which was one of the three real defects. Mounting like production is the
+// whole point of these three tests.
+const aliasApp = express();
+aliasApp.use(express.json());
+aliasApp.use(attachFail);
+aliasApp.use('/api/gds', buildGovernmentRouter());
+const aliasServer = aliasApp.listen(0);
+await new Promise((r) => aliasServer.once('listening', r));
+const ALIAS_BASE = `http://127.0.0.1:${aliasServer.address().port}`;
+after(() => aliasServer.close());
+
+const hop = (method, p) =>
+  fetch(`${ALIAS_BASE}${p}`, { method, redirect: 'manual' });
+
+test('the legacy /governance/* alias redirects, under the mount, with the noun translated', async () => {
+  const cases = [
+    ['GET', '/api/gds/governance/roles', '/api/gds/government/ranks'],
+    ['GET', '/api/gds/governance/permissions', '/api/gds/government/permissions'],
+    ['GET', '/api/gds/governance/assignments', '/api/gds/government/assignments'],
+    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage',
+            '/api/gds/government/ranks/metic/permissions/idea.triage'],
+    ['POST', '/api/gds/governance/roles/metic/reset', '/api/gds/government/ranks/metic/reset'],
+  ];
+  for (const [method, from, expected] of cases) {
+    const r = await hop(method, from);
+    assert.equal(r.status, 308, `${method} ${from} must 308 — a 404 means the wildcard is not matching`);
+    assert.equal(r.headers.get('location'), expected,
+      `${method} ${from} must keep the /api/gds mount AND translate roles→ranks`);
+  }
+});
+
+test('the alias preserves the query string', async () => {
+  const r = await hop('GET', '/api/gds/governance/roles?x=1&y=2');
+  assert.equal(r.headers.get('location'), '/api/gds/government/ranks?x=1&y=2');
+});
+
+test('the alias carries no gate of its own — the followed request re-runs the real one', async () => {
+  // A 308 preserves method and body, so the wall is enforced on the FOLLOWED
+  // request by the real route. The alias must never become a way around it.
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'), 'utf8');
+  const block = src.slice(src.indexOf('LEGACY_PATH_PREFIX'), src.indexOf('res.redirect(308'));
+  assert.ok(!/requirePermission|requireBuilder/.test(block),
+    'the alias must not carry its own gate — it redirects, and the real route gates the followed request');
+});