@bongos/core 1.19.2 → 1.19.4

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.2",
-  "core_contract": "1.19.2",
-  "source_commit": "8f1fb3183aa242e5ee3d48edc8c30e908772074f",
-  "source_ref": "HEAD",
-  "built_at": "2026-08-08T18:43:18.345Z",
+  "core_version": "1.19.4",
+  "core_contract": "1.19.4",
+  "source_commit": "9064a9274ab0a846896a2474abaea9b3c801db4f",
+  "source_ref": "origin/main",
+  "built_at": "2026-08-08T20:06:49.516Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 283,
+    "docs_redacted": 284,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1197,
+    "functional_verbatim": 1202,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1501,
-  "tree_sha256": "1aebd39558b67cc2836d00f9d5e4e038b92a9769b93fc1ef2ffea23caf25c5c3",
+  "file_count": 1507,
+  "tree_sha256": "4857f4b5f49e21f2a49f5c23537e5e489dc073ef08769ed60c1a38c0678b9759",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -327,7 +327,7 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000644",
-      "sha256": "a733ab81dadf0281828f4d824eeb10b3037ccb8fb94bdbf0082a506a37b8e7fb"
+      "sha256": "b976a94f0879fd4fe0cdc1eb82209b446cdc7a39186ea1300f4b535bec8f1d00"
     },
     {
       "path": "clients/bongos-client/README.md",
@@ -1142,7 +1142,7 @@
     {
       "path": "docs/adr/0137-upstream-publish-policy-manual-owner-gated.md",
       "mode": "0000644",
-      "sha256": "0479b6f9cf7235bee6d464a4ede0dd1c50521394d66ec0461cb4c79b236966c3"
+      "sha256": "f56c0106d45ac95b6c506680db609859fac109c7b63b52ae8761440d8144871e"
     },
     {
       "path": "docs/adr/0138-bundled-module-deps-declared-per-module.md",
@@ -1259,10 +1259,15 @@
       "mode": "0000644",
       "sha256": "3a23a8e64dc258397aea1ecff0c4aa75bf05067be9e1c96c678bf95d66c0c0fb"
     },
+    {
+      "path": "docs/adr/0161-publish-on-merge.md",
+      "mode": "0000644",
+      "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "99b095e94122a721f5fe45def82486d7ebfe78b8c530095b7e04f463e4bb1e56"
+      "sha256": "165327e0c447cf9e549ba9389bc7eed6406a64631a9e2d714f7eb3ee80af8be0"
     },
     {
       "path": "docs/api-reference.md",
@@ -1447,7 +1452,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "e9a61435d70b81d634a37686c06e27dfe49f52b6dced7f04420c49e0413f6cb9"
+      "sha256": "c544204fb13188ac17bdb8841866fcd61df2cd8a9a033f73bbca04b4cd1202e2"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -1532,7 +1537,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "cfc5b14e966f614bbee72ff125b8db028a8e587f5457fd1cfc7172a922130518"
+      "sha256": "1aafe7dafea94084c381e7ea1e91fad533ca379f9560da6f9f9f4a2cf4db4fc5"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
@@ -2179,6 +2184,11 @@
       "mode": "0000644",
       "sha256": "614def05feaeefe06de81de73523bbc42da4ffd095a8a71ad4f80af7bf61d878"
     },
+    {
+      "path": "migrations/core_205_versions_track_default.sql",
+      "mode": "0000644",
+      "sha256": "cfc4208327550710a64e44a401f552d78ab28814f033627f5fccc174f1c15b9d"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -3442,7 +3452,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "fc4e72f719b66aafe87bbd52db64a468d87069e24afe73eeb93318ff74ac9877"
+      "sha256": "14320bb5a3257a422854c41362f010042ed390bdd7efcf1b4959ed72f0ee1f9f"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -3987,12 +3997,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "33af861149a0ee55d9ae6f3c5f0558c625ca233dbdac4421ac5ba399c0ab985a"
+      "sha256": "70ab73355f797cae5b2c277c408cd72a5c9d20d553c465094000ad529d176305"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e6e7e25cb92c85152be56c6f63123d2f47d3e7026b2953d6c020dc4dbacaa82a"
+      "sha256": "6ce4caca6f095f694494c7eca0c39de6f522b4a4ba1ee7ecfb8d9013491907cb"
     },
     {
       "path": "public-docs/index.html",
@@ -4489,6 +4499,11 @@
       "mode": "0000644",
       "sha256": "6a696f9291da2d071d8a8aa0f92bf0be08445569a73196f9204f696bf6cb6cb5"
     },
+    {
+      "path": "scripts/gds/bump-version.js",
+      "mode": "0000644",
+      "sha256": "91664a0a1338ded41b780179c16040e2c686f6ab92304891cb1bc6ef3ca805b6"
+    },
     {
       "path": "scripts/gds/capture.js",
       "mode": "0000644",
@@ -4767,7 +4782,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "036429e68c840759ba9edf95ce6e17e501011e440b4b6d9a71e2344442f4f0d9"
+      "sha256": "a58a741f11ea7d34396dcb9e242825bf88326ca2709b7c726a91b06f60f9c24c"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -5607,7 +5622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f1a2dcb784a9ec64a77a89ce49cee1ff74338c70c0c524a3db78cfcfb84fb084"
+      "sha256": "49ff422c2caafd8a1a78b6be322bc89cfb82ffce77b37bbd2c68919e3dc432eb"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5859,6 +5874,11 @@
       "mode": "0000644",
       "sha256": "76380b52738c3ca2d452742f0b4316de765c39d68bc101ce6a90ea9d115842ef"
     },
+    {
+      "path": "tests/bongos_cli.mjs",
+      "mode": "0000644",
+      "sha256": "e017ee497f5aaf041cf18d8bc2b12faed4e3cd71418e14d55eee630ebb4282d3"
+    },
     {
       "path": "tests/bongos_dispatch.mjs",
       "mode": "0000644",
@@ -5974,6 +5994,11 @@
       "mode": "0000644",
       "sha256": "e3d8c5ac45d59f5d566547e2c406cf44ffa60f1b243afcb222b09eee68f5ee0d"
     },
+    {
+      "path": "tests/bump_version.mjs",
+      "mode": "0000644",
+      "sha256": "d8493f101a0009dd550c1ccf126e5ceb6433013257aa4f307ca68b00788dc77e"
+    },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
       "mode": "0000644",
@@ -6642,7 +6667,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "02b7753faee3c1b8a193d1f85a15e846e6b0a2eb3166f20e3f3387c458905e04"
+      "sha256": "ed99a7b7d925d9f202ab90f861cc4b761c0e58bb7eb79b189a6366591faeb388"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -6974,6 +6999,11 @@
       "mode": "0000644",
       "sha256": "fd69c44ebf3d246ecedf527275448389cca809e231d1c6cb34e4c12bfdc38111"
     },
+    {
+      "path": "tests/patch_gate_ordering.mjs",
+      "mode": "0000644",
+      "sha256": "4472cc00b1bc62c47a2f3121d0b5ec08f0b5b3bca6cebc3aaef179093eccffe8"
+    },
     {
       "path": "tests/path_match.mjs",
       "mode": "0000644",

package/bin/bongos.js

@@ -62,18 +62,22 @@ let VERSION = '0.0.0';
 try { VERSION = require('../config/bongos-cli.json').version || VERSION; } catch { /* best-effort */ }
 if (VERSION === '0.0.0') { try { VERSION = require('../package.json').version || VERSION; } catch { /* best-effort */ } }
 
-// verb -> { script, prefixArgs?, group, summary }
+// verb -> { script, prefixArgs?, group, summary, selfHelp? }
 //   `script`     a file under scripts/gds/ (or api.js for actions with no
 //                dedicated builder script yet).
 //   `prefixArgs` inserted before the user's args — used to drive the generic
 //                api.js caller (e.g. waking your box is just POST /box/ensure).
+//   `selfHelp`   the script prints its own (richer) usage on --help/-h, so the
+//                dispatcher forwards the flag instead of answering it (task
+//                1002625). Only set it after verifying the script really does —
+//                the default (intercept here) is the one that can never block.
 const VERBS = {
   start:   { script: 'start.js',   group: 'work', summary: 'List tasks you can claim right now' },
-  task:    { script: 'task.js',    group: 'work', summary: 'Create or show a task  (bongos task new --title … --description …)' },
+  task:    { script: 'task.js',    group: 'work', summary: 'Create or show a task  (bongos task new --title … --description …)', selfHelp: true },
   claim:   { script: 'claim.js',   group: 'work', summary: 'Claim a task by id  (bongos claim 1246)' },
   ship:    { script: 'ship.js',    group: 'work', summary: 'Grade, merge, and deploy your claimed task' },
   release: { script: 'release.js', group: 'work', summary: 'Cancel a claim — task returns to ready (no credits)' },
-  status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)' },
+  status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
   recall:  { script: 'recall.js',  group: 'work', summary: 'Search the docs + project knowledge  (bongos recall "x")' },
   cost:    { script: 'cost.js',    group: 'work', summary: 'Log a cost entry' },
 
@@ -86,10 +90,10 @@ const VERBS = {
   code:    { script: 'code.js',  group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH  (--local for a local clone)' },
 
   init:    { script: 'init.js', group: 'instance', summary: 'Scaffold a new instance (config + first version + kickoff tasks)' },
-  dev:     { script: 'dev.js', group: 'instance', summary: 'Run THIS instance locally in one command (Postgres + migrate + server + sign-in)' },
+  dev:     { script: 'dev.js', group: 'instance', summary: 'Run THIS instance locally in one command (Postgres + migrate + server + sign-in)', selfHelp: true },
   onboard: { script: 'onboard.js', group: 'instance', summary: 'Guided zero-to-live walkthrough: init → scaffold → provision → OAuth → verify → brand' },
-  module:  { script: 'module.js', group: 'instance', summary: 'Scaffold a new module  (bongos module new <key>)' },
-  upgrade: { script: 'upgrade.js', group: 'instance', summary: 'Pull the core to a new version (bump pin→install→migrate→materialize→restart); bare = module-compat pre-check' },
+  module:  { script: 'module.js', group: 'instance', summary: 'Scaffold a new module  (bongos module new <key>)', selfHelp: true },
+  upgrade: { script: 'upgrade.js', group: 'instance', summary: 'Pull the core to a new version (bump pin→install→migrate→materialize→restart); bare = module-compat pre-check', selfHelp: true },
   'package-core': { script: 'package-core.js', group: 'instance', summary: 'Package the core as a versioned, installable artifact (+ pin manifest)' },
   exec:    { script: null, group: 'instance', summary: 'Run a core script inside the package  (bongos exec scripts/gds/<x>.js [args])' },
 };
@@ -134,6 +138,17 @@ function helpText() {
   return lines.join('\n');
 }
 
+// One verb's help card — what `bongos <verb> --help` prints for verbs whose
+// script has no usage printer of its own (see selfHelp above).
+function verbHelpText(verb, def) {
+  return [
+    `bongos ${verb} — ${def.summary}`,
+    '',
+    `Forwards to scripts/gds/${def.script}; extra arguments are passed through.`,
+    'Run `bongos help` to see every command.',
+  ].join('\n');
+}
+
 // Returns the process exit code (does not call process.exit, so it's testable).
 function main(argv) {
   const args = argv.slice(2);
@@ -154,6 +169,17 @@ function main(argv) {
     return 2;
   }
 
+  // `bongos <verb> --help` (task 1002625): never spawn a script that doesn't
+  // recognise the flag — init.js, for one, treated `--help` as the start of its
+  // interactive interview and BLOCKED on "Project name?" (hostile in a terminal,
+  // fatal in CI). Verbs marked selfHelp print their own richer usage, so the
+  // flag is forwarded to them; `exec` always forwards (the flag belongs to the
+  // child script the user named).
+  if (verb !== 'exec' && !def.selfHelp && args.slice(1).some((a) => a === '--help' || a === '-h')) {
+    process.stdout.write(verbHelpText(verb, def) + '\n');
+    return 0;
+  }
+
   // `bongos exec <relpath> [args]` — run a core script by its package-relative path (see above).
   if (verb === 'exec') {
     if (COMPILED) {
@@ -221,4 +247,4 @@ if (require.main === module) {
   if (typeof code === 'number') process.exit(code);
 }
 
-module.exports = { VERBS, GROUPS, helpText, main, VERSION, GDS_DIR, COMPILED, BUNDLED_RUNNERS, resolveExecTarget };
+module.exports = { VERBS, GROUPS, helpText, verbHelpText, main, VERSION, GDS_DIR, COMPILED, BUNDLED_RUNNERS, resolveExecTarget };

package/docs/adr/0137-upstream-publish-policy-manual-owner-gated.md

@@ -1,6 +1,6 @@
 # 0137 — Upstream publish policy: `@bongos/core` patches are published manually (owner-gated), not auto-published on merge
 
-- **Status:** Accepted
+- **Status:** Superseded by [ADR 0161](<redacted>.md) (2026-08-08) — after two measured stale-production incidents (171 commits/10 days, 104 commits/5 days), the owner chose publish-on-merge; the "When to revisit" clause below fired.
 - **Date:** 2026-07-10
 - **Deciders:** example-owner (owner/Archon), Claude. Presented the manual-vs-auto fork; the owner chose to keep publishing a manual, owner-triggered step.
 - **Task:** [#2158](https://example.com/builders#/task/2158) (BONGOS-V1, goal 26) — the **supply** half split out of [ADR 0136](<redacted>.md) §5 / [#2150](https://example.com/builders#/task/2150).

package/docs/adr/0161-publish-on-merge.md

@@ -0,0 +1,34 @@
+# 0161 — Publish on merge: every merge to core `main` auto-publishes `@bongos/core`
+
+- **Status:** Accepted
+- **Date:** 2026-08-08
+- **Deciders:** the owner (Archon), Claude. The owner chose this directly after reviewing the pipeline end-to-end: "any merge can publish, we can add in more complexity later."
+- **Task:** task 1002620 (BONGOS-V1, goal 1000024 — build-pipeline integrity)
+- **Supersedes:** [ADR 0137](<redacted>.md) (manual owner-gated publish)
+- **Builds on:** [ADR 0134](<redacted>.md) (private-first npm), [ADR 0136](<redacted>.md) (channel policy), [ADR 0159](<redacted>.md) (the required `unit` check)
+
+## Context
+
+ADR 0137 kept publishing a manual, owner-gated step: no npm write token at rest, the owner runs `package-core.js --publish --live` when they decide to cut a release. Its own "When to revisit" clause said to re-evaluate when the manual step becomes a real bottleneck.
+
+It became one twice in three weeks, measured:
+
+- **171 commits / 10 days** unreleased (blocker 1000097) — an entire governance permission system sat on `main` while the live platform served the previous version and every pipeline layer reported success.
+- **104 commits / 5 days** unreleased immediately after — including a `CORE_VERSION` bump (`1.19.0`) that was landed but never packaged, so the version number existed while no artifact carried it.
+
+The consumption side (ADR 0136's subscription) was never the problem; supply was. The owner reviewed the full pipeline on 2026-08-08 and reversed 0137's trade-off explicitly.
+
+## Decision
+
+1. **Every merge to `main` publishes.** A `publish` workflow fires on the `unit` check succeeding on a main push (never on a red suite), builds via `package-core` — the fail-closed no-leak gate and `--self-verify` pin check run inside the build — publishes (restricted), and tags `core-v<version>`.
+2. **CI bumps PATCH only.** When a merge lands without a human bump, `scripts/gds/bump-version.js` bumps the patch and writes the changelog line (shape-preserving; pinned by `tests/bump_version.mjs`). A **minor or major stays a deliberate in-task human edit** — it is a statement about the doorway surface, and it decides what patch-channel subscribers receive unattended (ADR 0136). CI is not allowed to make that call.
+3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
+4. **Idempotent by version-compare.** The bump commit re-triggers `unit` → `publish`, which then finds HEAD's version already on npm and no-ops. npm's duplicate-version rejection is the backstop; concurrent merges queue behind a no-cancel concurrency group.
+
+## Consequences
+
+- A merged change is on npm within minutes, unattended. Combined with the subscription (ADR 0136), patch-channel instances take it on their next sweep — the full merge→live path has no human step for patches.
+- The bump commit is authored by `github-actions[bot]` directly on `main` (admin-exempt push, `enforce_admins: false`). It re-runs `unit` as a safety net.
+- `deploy-divergence.js`'s UNRELEASED gap should now hover near zero; a growing gap means the lane is disarmed or red — both loud.
+- One-time owner arming step (filed as a blocker): create the two secrets, set `PUBLISH_ON_MERGE=1`.
+- Revisit toward *more* ceremony (environments, provenance attestation, trusted publishing/OIDC to npm — which would retire the standing token) when the fleet grows; revisit toward *less* (auto-minor) never without a human surface-diff check.

package/docs/adr/README.md

@@ -232,5 +232,6 @@ This keeps the decision history honest and traceable.
 | 0159 | [**Merge-gate reconciliation: required checks match reality, CODEOWNERS becomes real, protection stays the owner's switch** ([task 1002611](https://cloudbongos.com/builders#/task/1002611)). Findings D-12 + G-5 from the choke-point map: `gating.js` hardcoded three required status checks (`unit`, `trufflehog`, `gate-review`) of which two have never had a workflow — running `gating.js on` would have required contexts nothing can report, blocking every merge indefinitely instead of gating them — and CODEOWNERS was described as a live control by ADR 0042, `protected-surfaces.json`, `publish-manifest.js` and gating.js itself while not existing anywhere in the tree. Now that the `unit` lane exists (task 1002610), `DEFAULT_PROTECTION` requires ONLY `[unit]`; the future contexts are fixed as `secret-scan` + `gate-review` (the `CORE_EXPECTED_CHECKS` names — a context is named for what it asserts, not the tool asserting it) and return when their ADR 0058 workflows ship; CODEOWNERS becomes a real root file scoped to `gate-review.js`'s `HARD_FLOOR_GLOBS` + gating.js (inert until protection is on); branch protection itself stays OFF — flipping it remains the owner's explicit act, this only makes the switch safe. Rider: the unit lane is hardened so `unit` is actually requirable — `fetch-depth: 0` (depth-1 broke `tests/main_audit.mjs` on the lane's first run), two clean-env-red tests parked in `KNOWN_FAILING` with diagnoses + exit tracked in [task 1002617](https://cloudbongos.com/builders#/task/1002617), and `publish_manifest` (the public-mirror boundary test) fixed in-claim rather than parked — its ≥7-host-tests non-vacuity floor went stale when ADR 0107 moved host tests into `modules/<key>/tests/`, replaced by a regex specimen self-test. Rejected: deleting `GATE_WORKFLOWS`' forward-looking names (the switch handles absence gracefully; deleting them un-covers the workflows the moment they ship) and watering down the four CODEOWNERS descriptions instead of creating the one file.](<redacted>.md) | governance / build pipeline |
 
 | 0160 | [**The authoritative main audit gets a repo-verifiable caller** ([task 1002612](https://cloudbongos.com/builders#/task/1002612)). Findings G-3 + G-8, honest limit S-1: `main-audit.js` — the post-push layer [ADR 0043](<redacted>.md) designates authoritative — had two declared invokers that never existed in this git history, and `audit-authorship.sh` (the no-hardcoded-Archon-identity enforcer) had no caller either and turned out red with 340 pre-existing hits on untouched main (idea 1000653). Now a `main-audit` workflow audits every push to `main` over exactly the pushed `before..after` range (clamped-window fallback); the roster comes from the public leaderboard when no session exists (server-authoritative, login-only keying, an absent builder resolves as unresolved — never falsely trusted); new `--require-roster` makes an empty roster a loud DID-NOT-RUN exit 2 (an audit that cannot fire a blocker must not exit green); the lane runs non-strict per the audit's own zero-false-positive calibration; and `audit-authorship.sh` rides as an advisory job until the 1000653 triage. Detective lane, not a merge gate — deliberately outside the required PR contexts. Rider: the known-failing ratchet caught task 1002611's publish_manifest fix exactly as designed — entry removed, ceiling ratcheted 3 → 2, remaining entries re-owned to [task 1002617](https://cloudbongos.com/builders#/task/1002617), idea 1000542 superseded. Rejected: a GDS token secret (silent-fail dependency the devcontainer lane warned about), `--strict` in CI (permanent red rots into wallpaper), enforcing authorship before triage.](<redacted>.md) | governance / build pipeline |
+| 0161 | [**Publish on merge: every merge to core `main` auto-publishes `@bongos/core`** (task 1002620). Supersedes ADR 0137's manual owner-gated publish after its own "when to revisit" clause fired twice in three weeks: 171 commits/10 days, then 104 commits/5 days, sat on `main` reachable by no pin while every layer reported success. A `publish` workflow rides behind the required `unit` check (`workflow_run`, success-gated): when HEAD's `CORE_VERSION` is already on npm, CI bumps a PATCH via the shape-preserving `bump-version.js` (+ changelog line; pinned by `tests/bump_version.mjs`) and pushes the carrier commit; `package-core --self-verify --publish --live` builds through the fail-closed no-leak gate; the release is tagged `core-v<v>`. A MINOR/MAJOR stays a human in-task edit — it decides what patch-channel subscribers receive unattended (ADR 0136), a call CI must not make. Token custody knowingly reverses (owner-accepted): `NPM_TOKEN` write + `RELEASE_PUSH_TOKEN` PAT as Actions secrets, mitigated by the lane shipping INERT behind the `PUBLISH_ON_MERGE=1` repo variable — an owner kill-switch symmetrical to `gating.js`. Idempotent by version-compare; npm duplicate rejection is the backstop; queued no-cancel concurrency collapses merge races.](<redacted>.md) | build pipeline / distribution |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/recipes/core-release-pipeline.md

@@ -97,16 +97,18 @@ node scripts/gds/package-core.js --ref main --self-verify
 
 > ⚠️ **Packaging a mid-flight `main` produces a stale version number.** If `CORE_VERSION` at your ref is still the previous value, your tarball is stamped with a version the fleet may already have. `bongos upgrade` refuses only the **equal** case (`already on <v>`, and `--force` bypasses even that) — it has **no downgrade guard**, so a target *below* what is installed proceeds and silently installs older code. Confirm the bump is actually in your ref before packaging.
 
-### 2c. Publish — only for the registry path
+### 2c. Publish — automatic on merge
 
-Publishing to npm is a **manual, owner-gated step**; merges do not auto-publish and **no npm write token exists in CI or the repo** ([ADR 0137](../adr/<redacted>.md) §3).
+**Every merge to `main` publishes** ([ADR 0161](../adr/<redacted>.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, changelog line included), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
+
+The lane is armed by the owner via the `PUBLISH_ON_MERGE=1` repo variable + two secrets (`NPM_TOKEN`, `RELEASE_PUSH_TOKEN`); while disarmed it no-ops loudly. Manual fallback, same command CI runs:
 
 ```bash
 node scripts/gds/package-core.js --publish          # DRY-RUN — runs the no-leak gate, previews
 node scripts/gds/package-core.js --publish --live   # permanent
 ```
 
-**`--publish` is not needed for a vendored-tarball instance** — see gate 3. Chasing an npm publish to move a `file:`-pinned instance is a documented dead end.
+**A publish is not what moves a vendored-tarball instance** — see gate 3. Chasing an npm publish to move a `file:`-pinned instance is a documented dead end.
 
 ## Gate 3 — move the instance's pin
 
@@ -162,7 +164,7 @@ Exit codes: `0` aligned, `1` diverged, `2` undetermined.
 | Land a change on `main` | 1 | any builder holding a claim, behind the required `unit` check (protected paths are Metic+; hard-floor paths need owner review per [`CODEOWNERS`](../../CODEOWNERS); [canonical-permissions](../canonical-permissions.md)) |
 | Bump `CORE_VERSION` | 2a | a builder, inside a claimed task |
 | Build the artifact | 2b | any builder — `package-core` is tokenless and network-free |
-| Publish to npm | 2c | **owner only** — needs `npm login` + 2FA; no write token exists anywhere else |
+| Publish to npm | 2c | **automatic on merge** once the owner arms the lane ([ADR 0161](../adr/<redacted>.md)); the manual `--publish --live` fallback stays owner-only |
 | Move an instance's pin | 3 | whoever operates that instance |
 
 Automating gate 2c (a tag-triggered CI publish) is deliberately deferred until a real fleet makes the manual step a bottleneck — see [ADR 0137](../adr/<redacted>.md) "When to revisit".

package/docs/recipes/private-npm-distribution.md

@@ -49,9 +49,11 @@ npm pack ./clients/bongos-client --dry-run        # token-free content preview
 npm publish ./clients/bongos-client               # real (publishConfig makes it restricted; needs npm login)
 ```
 
-## Cutting a core release (the policy — [ADR 0137](../adr/<redacted>.md))
+## Cutting a core release (the policy — [ADR 0161](../adr/<redacted>.md), superseding ADR 0137)
 
-Publishing is a **manual, owner-gated step** — merges to `main` do **not** auto-publish (no npm write-token lives in CI). The update subscription ([ADR 0136](../adr/<redacted>.md)) consumes whatever the owner has published, so a release is exactly: bump → publish → the subscription picks it up on its next sweep.
+**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it (repo variable `PUBLISH_ON_MERGE=1` + secrets `NPM_TOKEN`, `RELEASE_PUSH_TOKEN`). A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/<redacted>.md)) consumes whatever is published, on its next sweep.
+
+The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 
 1. **Bump `CORE_VERSION`** in [`src/module-api.js`](../../src/module-api.js) (semver; a **patch** for a fix, **minor** for additive surface — a **major** is a deliberate, human-only event) and add a one-line changelog entry in the same file. This bump is a normal claimed task, not a release-tool side effect — the version's provenance stays in the git history + changelog.
 2. **Publish** (owner, from a clean checkout of the released commit):

package/migrations/core_205_versions_track_default.sql

@@ -0,0 +1,28 @@
+-- core_205_versions_track_default.sql — task 1002627 (decision follow-up to 1002623).
+--
+-- versions.track is NOT NULL + CHECK ('product'|'internal') and had NO default
+-- (003_pms.sql). Task 1002623 fixed the standup-blocking consequence in code —
+-- createVersion + POST /versions now always supply track — but the column
+-- itself still refused any insert that omitted it.
+--
+-- DECISION (recorded here + in the task): add DEFAULT 'product'. The failure
+-- this prevents — a fresh instance that cannot seed its first version, or any
+-- future insert path 500ing — is strictly worse than the failure it introduces
+-- (a forgotten track silently classifying as 'product': cosmetic, one UPDATE to
+-- fix). 'product' matches the code default: an instance's own version is
+-- product work; 'internal' is the platform's opt-in track.
+--
+-- Core migration (not modules/lifecycle/) because versions is a core table —
+-- a module migration may only touch its own namespaced tables (ADR 0083 §5).
+--
+-- Forward-safe: adds a default only — old code inserting an explicit track is
+-- unaffected, and no existing rows change.
+
+BEGIN;
+
+ALTER TABLE versions ALTER COLUMN track SET DEFAULT 'product';
+
+INSERT INTO schema_migrations (version) VALUES ('core_205_versions_track_default')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/lifecycle/routes/tasks.js

@@ -797,18 +797,20 @@ module.exports = function buildTasksRouter() {
     if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
       return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
-    let updated = null;
-    if (hasParallelSafe) {
-      if (body.parallel_safe !== null && typeof body.parallel_safe !== 'boolean') {
-        return res.fail('bad_parallel_safe', { status: 400, message: 'parallel_safe must be true, false, or null' });
-      }
-      try {
-        updated = await db.updateTaskParallelSafe(id, body.parallel_safe);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id parallel_safe', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
+    // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
+    // ---- FIRST write. The previous shape validated-and-wrote per field in ----
+    // sequence, so a body mixing a valid early field with a refused later one
+    // committed the early write and then 403/400'd — state changed on a request
+    // the caller was told was refused (a Metic sending { parallel_safe,
+    // security_sensitive } had parallel_safe committed before rank_forbidden).
+    // Authorization, type/enum checks, and the goal existence/version reads all
+    // run here; writes begin only after the last validation `return`.
+    // (Documented residual: parent_task_id validates inside hierarchy.attachParent
+    // at the end — its checks are atomic with its OWN write, but a refusal there
+    // still lands after the field writes below. No authorization gate is
+    // involved in that path; the handler's only rank gate is hoisted here.)
+    if (hasParallelSafe && body.parallel_safe !== null && typeof body.parallel_safe !== 'boolean') {
+      return res.fail('bad_parallel_safe', { status: 400, message: 'parallel_safe must be true, false, or null' });
     }
     if (hasSecuritySensitive) {
       // task 990: explicit Archon-only-broadcast flag. Boolean only (no null) —
@@ -826,41 +828,19 @@ module.exports = function buildTasksRouter() {
       if (typeof body.security_sensitive !== 'boolean') {
         return res.fail('bad_security_sensitive', { status: 400, message: 'security_sensitive must be a boolean' });
       }
-      try {
-        updated = await db.updateTaskSecuritySensitive(id, body.security_sensitive);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id security_sensitive', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
+    const VALID_AUTOMATION_TAGS = new Set(['overnight-safe', 'live-only', 'needs-input']);
     if (hasAutomationTag) {
       const tag = body.automation_tag;
-      const VALID_AUTOMATION_TAGS = new Set(['overnight-safe', 'live-only', 'needs-input']);
       if (tag !== null && (typeof tag !== 'string' || !VALID_AUTOMATION_TAGS.has(tag))) {
         return res.fail('bad_automation_tag', { status: 400, message: 'automation_tag must be one of overnight-safe | live-only | needs-input, or null to clear', details: { valid: Array.from(VALID_AUTOMATION_TAGS) } });
       }
-      try {
-        updated = await db.updateTaskAutomationTag(id, tag);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id automation_tag', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
     if (hasModuleKey) {
       // BV1.R53 (task 1422): assign or clear the module affinity label. null clears.
-      const key = body.module_key;
-      if (key !== null && !isModuleKey(key)) {
+      if (body.module_key !== null && !isModuleKey(body.module_key)) {
         return res.fail('bad_module_key', { status: 400, message: `module_key must be one of the known module keys, or null to clear. Valid keys: ${moduleKeys().join(', ')}.`, details: { valid: moduleKeys() } });
       }
-      try {
-        updated = await db.updateTaskModuleKey(id, key ?? null);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id module_key', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
     if (hasGoalId) {
       // task 1763: (re)assign the task's goal — the documented "Archon/Metic
@@ -882,8 +862,6 @@ module.exports = function buildTasksRouter() {
         if (String(goal.version_id) !== String(task.version_id)) {
           return res.fail('goal_version_mismatch', { status: 409, message: `Goal #${goalId} is in version '${goal.version_id}' but task #${id} is in '${task.version_id}'. A task can only join a goal in its own version.` });
         }
-        updated = await db.updateTaskGoal(id, goalId);
-        if (!updated) return res.fail('task_not_found', 404);
       } catch (err) {
         console.error('[gds] PATCH /tasks/:id goal_id', err);
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
@@ -893,13 +871,77 @@ module.exports = function buildTasksRouter() {
       // task 1498 / ADR 0084: the Archon override of the per-task rank floor.
       // Validate the enum here; db.updateTaskRequiresRank clamps the value UP to
       // the auto-derived floor (touches + security_sensitive), so a PATCH can
-      // only RAISE the gate — never open a sensitive task to a lower rank. Runs
-      // AFTER the security_sensitive block above, so a same-request flag flip is
-      // already reflected in the derived floor.
+      // only RAISE the gate — never open a sensitive task to a lower rank.
       const LIVE_RANKS = new Set(db.LIVE_RANK_LADDER);
       if (typeof body.requires_rank !== 'string' || !LIVE_RANKS.has(body.requires_rank)) {
         return res.fail('bad_requires_rank', { status: 400, message: `requires_rank must be one of ${db.LIVE_RANK_LADDER.join(' | ')}. An override can only raise the floor; it is clamped up to the auto-derived minimum.`, details: { valid: db.LIVE_RANK_LADDER } });
       }
+    }
+    if (hasKind && !VALID_KINDS.has(body.kind)) {
+      return badKind(res);
+    }
+    if (hasDiscipline && !VALID_DISCIPLINES.has(body.discipline)) {
+      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    }
+    if (hasNewcomerOrXenos) {
+      // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to
+      // xenos_claimable (pre-rename alias). Both map to the same DB column.
+      const incoming = hasNewcomerFriendly ? body.newcomer_friendly : body.xenos_claimable;
+      if (typeof incoming !== 'boolean') {
+        const field = hasNewcomerFriendly ? 'newcomer_friendly' : 'xenos_claimable';
+        return res.fail(`bad_${field}`, { status: 400, message: `${field} must be a boolean` });
+      }
+    }
+    // ---- all gates passed: apply the writes. Order preserved from the old ----
+    // shape — requires_rank still runs AFTER security_sensitive so a
+    // same-request flag flip is already reflected in the derived floor.
+    let updated = null;
+    if (hasParallelSafe) {
+      try {
+        updated = await db.updateTaskParallelSafe(id, body.parallel_safe);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id parallel_safe', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasSecuritySensitive) {
+      try {
+        updated = await db.updateTaskSecuritySensitive(id, body.security_sensitive);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id security_sensitive', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasAutomationTag) {
+      try {
+        updated = await db.updateTaskAutomationTag(id, body.automation_tag);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id automation_tag', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasModuleKey) {
+      try {
+        updated = await db.updateTaskModuleKey(id, body.module_key ?? null);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id module_key', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasGoalId) {
+      try {
+        updated = await db.updateTaskGoal(id, body.goal_id);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id goal_id', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasRequiresRank) {
       try {
         updated = await db.updateTaskRequiresRank(id, body.requires_rank);
         if (!updated) return res.fail('task_not_found', 404);
@@ -909,9 +951,6 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasKind) {
-      if (!VALID_KINDS.has(body.kind)) {
-        return badKind(res);
-      }
       try {
         updated = await db.updateTaskKind(id, body.kind);
         if (!updated) return res.fail('task_not_found', 404);
@@ -921,9 +960,6 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasDiscipline) {
-      if (!VALID_DISCIPLINES.has(body.discipline)) {
-        return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
-      }
       try {
         updated = await db.updateTaskDiscipline(id, body.discipline);
         if (!updated) return res.fail('task_not_found', 404);
@@ -933,13 +969,7 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasNewcomerOrXenos) {
-      // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to
-      // xenos_claimable (pre-rename alias). Both map to the same DB column.
       const incoming = hasNewcomerFriendly ? body.newcomer_friendly : body.xenos_claimable;
-      if (typeof incoming !== 'boolean') {
-        const field = hasNewcomerFriendly ? 'newcomer_friendly' : 'xenos_claimable';
-        return res.fail(`bad_${field}`, { status: 400, message: `${field} must be a boolean` });
-      }
       try {
         updated = await db.updateTaskNewcomerFriendly(id, incoming);
         if (!updated) return res.fail('task_not_found', 404);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.2",
+  "version": "1.19.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.2",
+      "version": "1.19.4",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.2",
+  "version": "1.19.4",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// scripts/gds/bump-version.js — the mechanical CORE_VERSION patch bump for the
+// publish-on-merge lane (ADR 0161, task 1002620).
+//
+// WHY THIS EXISTS. ADR 0161 makes every merge to main publishable: when a merge
+// lands without a human version bump, CI bumps a PATCH itself so the release
+// has a unique version. The bump edits src/module-api.js in the two places the
+// repo's version discipline lives — the `const CORE_VERSION` literal and the
+// changelog comment block above it — because a bare literal change with no
+// changelog line is exactly the drift the discipline exists to prevent.
+//
+// POLICY (deliberately narrow): this script only ever bumps PATCH. A MINOR or
+// MAJOR is a statement about the doorway surface that only a human (or a far
+// smarter check) can make — it stays an in-task hand edit, exactly as before.
+//
+// SHAPE-PRESERVING: deploy-divergence.js finds bump commits with
+// `git log -G"^const CORE_VERSION = "` and reads the literal with a regex; the
+// rewrite here keeps that exact line shape. tests/bump_version.mjs pins this.
+//
+// Usage:
+//   node scripts/gds/bump-version.js                # dry-run: print the plan
+//   node scripts/gds/bump-version.js --apply        # rewrite src/module-api.js
+//   node scripts/gds/bump-version.js --apply --note "run 123456"  # extra provenance
+// stdout (both modes): one JSON line { from, to, applied } for CI to capture.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TARGET = path.join(__dirname, '..', '..', 'src', 'module-api.js');
+const CONST_RE = /^const CORE_VERSION = '(\d+)\.(\d+)\.(\d+)';.*$/m;
+// The changelog block's closing divider sits immediately above the const line.
+const DIVIDER = '// ---------------------------------------------------------------------------';
+
+// Pure transform: (source text, optional note) -> { from, to, text }.
+// Throws with a precise message on any shape it does not recognize — a silent
+// mis-edit of the version literal is the worst possible failure mode here.
+function bumpPatch(src, { note = '' } = {}) {
+  const m = src.match(CONST_RE);
+  if (!m) throw new Error(`bump-version: could not find the CORE_VERSION literal in ${TARGET} (expected: const CORE_VERSION = 'x.y.z';)`);
+  const [major, minor, patch] = [Number(m[1]), Number(m[2]), Number(m[3])];
+  const from = `${major}.${minor}.${patch}`;
+  const to = `${major}.${minor}.${patch + 1}`;
+
+  // 1. The changelog entry — inserted just above the divider that closes the
+  //    changelog block, matching the existing two-line entry style.
+  const constLineStart = src.search(CONST_RE);
+  const dividerStart = src.lastIndexOf(DIVIDER, constLineStart);
+  if (dividerStart === -1) throw new Error('bump-version: could not find the changelog closing divider above CORE_VERSION');
+  const noteSuffix = note ? ` ${note}.` : '';
+  const entry =
+    `//   ${to} — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges\n` +
+    `//         landed since ${from} with no explicit bump.${noteSuffix} (task 1002620)\n`;
+
+  // 2. The literal — same line shape deploy-divergence greps for.
+  const newConstLine = `const CORE_VERSION = '${to}'; // CI auto-patch carrier (ADR 0161); see changelog above`;
+
+  const text = src.slice(0, dividerStart) + entry + src.slice(dividerStart).replace(CONST_RE, newConstLine);
+  return { from, to, text };
+}
+
+function main() {
+  const apply = process.argv.includes('--apply');
+  const noteIdx = process.argv.indexOf('--note');
+  const note = noteIdx !== -1 ? (process.argv[noteIdx + 1] || '') : '';
+
+  const src = fs.readFileSync(TARGET, 'utf8');
+  const { from, to, text } = bumpPatch(src, { note });
+  if (apply) fs.writeFileSync(TARGET, text);
+  else console.error(`bump-version: would bump ${from} → ${to} (dry-run; pass --apply to write)`);
+  console.log(JSON.stringify({ from, to, applied: apply }));
+}
+
+module.exports = { bumpPatch, CONST_RE };
+if (require.main === module) main();

package/scripts/gds/init.js

@@ -258,6 +258,13 @@ function buildBrandingConfig(spec) {
     firstAdmin: spec.firstAdmin,
     currency: { label: (spec.currency && spec.currency.label) || 'credits', symbol: (spec.currency && spec.currency.symbol) || '' },
     envPrefix: spec.envPrefix || 'CLOUDBONGOS',
+    // Every instance gets its OWN session/config dir (task 1002626). Without
+    // this, instance-config.js falls back to the shared 'cloudbongos' dir, so
+    // every un-branded instance on a machine reads/writes the SAME
+    // ~/.config/cloudbongos/gds-session.json — signing in to one silently
+    // evicts the CLI session of every other, including the hub. Same slug
+    // family as the package name + provisioning slug.
+    configDir: spec.configDir ? String(spec.configDir).trim() : slugify(productName, 'instance'),
   };
   if (spec.tagline) branding.copy = { tagline: spec.tagline };
   return branding;

package/src/module-api.js

@@ -423,8 +423,20 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         and the Metic-floor string sweep (1002604). The doorway surface is
 //         unchanged (an optional request field, no export change) → PATCH.
 //         (task 1002624)
+//   1.19.3 — CLI/init ergonomics carrier: `bongos <verb> --help` is answered by
+//         the dispatcher instead of blocking on init's interview (1002625),
+//         `bongos init` defaults branding configDir from the product slug so
+//         instances stop sharing ~/.config/cloudbongos and evicting each
+//         other's CLI sessions (1002626), versions.track gains DB DEFAULT
+//         'product' via core_205 so no insert path can reproduce the
+//         fresh-instance standup blocker (1002627). Also sweeps PATCH
+//         /tasks/:id gate atomicity (1002609) and the publish-on-merge lane
+//         (1002620, ADR 0161). git diff 1.19.2..main on this file was empty —
+//         the doorway surface is byte-identical → PATCH. (task 1002631)
+//   1.19.4 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.3 with no explicit bump. run 31275959473. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.2'; // init-blocker fixes + carrier (task 1002624); see changelog above
+const CORE_VERSION = '1.19.4'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -0,0 +1,91 @@
+// tests/bongos_cli.mjs
+//
+// The `bongos` dispatcher's --help contract (task 1002625). The regression that
+// motivates this file: `bongos init --help` used to FORWARD the flag to init.js,
+// which doesn't recognise it and dropped into its interactive interview —
+// printing "Project name?" and blocking forever (fatal in CI). The dispatcher
+// now answers --help/-h itself for every verb whose script has no usage printer
+// of its own; the five that do (selfHelp) keep their richer output, and `exec`
+// always forwards (the flag belongs to the child script).
+//
+// Run:  node tests/bongos_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const cli = require('../bin/bongos.js');
+
+const BIN = join(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'bongos.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// Every spawn gets a hard timeout — the exact failure this file guards against
+// is a verb BLOCKING on interactive input, and a hung test is that bug escaping.
+const run = (...args) => spawnSync(process.execPath, [BIN, ...args], {
+  encoding: 'utf8', timeout: 30_000, input: '',
+});
+
+// ---- pure: the help card + the selfHelp roster ----
+
+test('verbHelpText: names the verb, its summary, and the full-help pointer', () => {
+  const out = cli.verbHelpText('claim', cli.VERBS.claim);
+  assert.match(out, /^bongos claim — /);
+  assert.match(out, /Claim a task by id/);
+  assert.match(out, /bongos help/);
+});
+
+test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {
+  // Verified by reading each script (they all branch on --help/-h to a usage()
+  // printer). If a verb is added here, verify its script first — a wrong
+  // selfHelp:true recreates the blocking-interview bug for that verb.
+  const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
+  assert.deepEqual(selfHelp, ['dev', 'module', 'status', 'task', 'upgrade']);
+});
+
+// ---- spawned: the dispatcher answers --help without touching the script ----
+
+test('bongos --help (first arg) prints the dispatcher help, exit 0', () => {
+  const r = run('--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /bongos — the Cloud Bongos CLI/);
+});
+
+test('bongos init --help answers instantly — no interview, no blocking (the 1002625 regression)', () => {
+  const r = run('init', '--help');
+  assert.equal(r.signal, null, 'must not die on the spawn timeout — that means it blocked on input');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^bongos init — /);
+  assert.ok(!/Project name\?/.test(r.stdout + r.stderr), 'the interactive interview must not start');
+});
+
+test('bongos claim -h is answered by the dispatcher too (short flag, non-selfHelp verb)', () => {
+  const r = run('claim', '-h');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^bongos claim — /);
+});
+
+test('bongos task --help forwards to task.js (selfHelp) and gets its richer usage', () => {
+  const r = run('task', '--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.ok(!/^bongos task — .*\n\nForwards to/.test(r.stdout), 'must NOT be the dispatcher card');
+  assert.match(r.stdout + r.stderr, /new|usage/i, 'task.js prints its own usage');
+});
+
+test('bongos exec still refuses a missing path with exit 2 (--help interception must not swallow exec)', () => {
+  const r = run('exec');
+  assert.equal(r.status, 2);
+  assert.match(r.stderr, /package-relative script path/);
+});
+
+console.log('');
+console.log(`bongos CLI tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/bump_version.mjs

@@ -0,0 +1,71 @@
+// tests/bump_version.mjs — the CI auto-patch bump is shape-preserving (task 1002620).
+//
+// bump-version.js rewrites the single most load-bearing literal in the repo.
+// These tests pin the three properties that must survive any refactor:
+//   1. the bumped literal keeps the exact `^const CORE_VERSION = '…';` shape
+//      deploy-divergence.js greps and regex-reads;
+//   2. a changelog entry lands inside the comment block, not after the const;
+//   3. unrecognizable input throws instead of silently mis-editing.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { bumpPatch, CONST_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+
+const SAMPLE = [
+  '// prologue',
+  '//   1.19.0 — some entry. (task 1)',
+  '//   1.19.1 — another entry. (task 2)',
+  '// ---------------------------------------------------------------------------',
+  "const CORE_VERSION = '1.19.1'; // carrier; see changelog above",
+  '',
+  'module.exports = { CORE_VERSION };',
+  '',
+].join('\n');
+
+test('bumps patch and keeps the exact const line shape', () => {
+  const { from, to, text } = bumpPatch(SAMPLE);
+  assert.equal(from, '1.19.1');
+  assert.equal(to, '1.19.2');
+  const m = text.match(CONST_RE);
+  assert.ok(m, 'bumped text must still match the canonical const regex');
+  assert.equal(m[0].startsWith("const CORE_VERSION = '1.19.2';"), true);
+  // exactly one const line survives
+  assert.equal([...text.matchAll(/^const CORE_VERSION = /gm)].length, 1);
+});
+
+test('inserts the changelog entry above the divider, mentioning both versions', () => {
+  const { text } = bumpPatch(SAMPLE, { note: 'run 42' });
+  const dividerAt = text.indexOf('// ------');
+  const entryAt = text.indexOf('1.19.2 — CI auto-patch');
+  assert.ok(entryAt !== -1, 'entry exists');
+  assert.ok(entryAt < dividerAt, 'entry sits inside the changelog block, above the divider');
+  assert.match(text, /landed since 1\.19\.1 with no explicit bump\. run 42\./);
+});
+
+test('a 9→10 patch rollover carries, not truncates', () => {
+  const src = SAMPLE.replace(/1\.19\.1/g, '1.19.9');
+  const { to } = bumpPatch(src);
+  assert.equal(to, '1.19.10');
+});
+
+test('unrecognizable input throws loudly instead of mis-editing', () => {
+  assert.throws(() => bumpPatch('nothing here'), /could not find the CORE_VERSION literal/);
+  assert.throws(
+    () => bumpPatch("const CORE_VERSION = '1.2.3'; // no divider above"),
+    /changelog closing divider/
+  );
+});
+
+test('the REAL src/module-api.js is bumpable right now (shape not drifted)', () => {
+  const real = fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8');
+  const { from, to, text } = bumpPatch(real);
+  assert.match(from, /^\d+\.\d+\.\d+$/);
+  assert.ok(text.includes(`const CORE_VERSION = '${to}';`));
+});

package/tests/init.mjs

@@ -62,6 +62,25 @@ test('buildBrandingConfig: no tagline → no copy block', () => {
   assert.equal(init.buildBrandingConfig(spec).copy, undefined);
 });
 
+// configDir must ALWAYS be set per-instance (task 1002626): the neutral pack's
+// fallback is the shared 'cloudbongos' dir, so an instance that omits it shares
+// ~/.config/cloudbongos/gds-session.json with every other instance on the
+// machine — signing in to one evicts the others' CLI sessions (incl. the hub).
+test('buildBrandingConfig: configDir defaults to the product slug, never the shared fallback', () => {
+  const b = init.buildBrandingConfig(fullSpec());
+  assert.equal(b.configDir, 'cloud-bongos');               // slug of 'Cloud Bongos'
+  const hermes = init.buildBrandingConfig(init.normalizeSpec({
+    identity: { productName: 'Hermeslines Marketing' }, repo: { owner: 'o', name: 'n' }, firstAdmin: 'x',
+  }));
+  assert.equal(hermes.configDir, 'hermeslines-marketing');
+});
+
+test('buildBrandingConfig: an explicit spec.configDir wins over the slug', () => {
+  const spec = fullSpec();
+  spec.configDir = ' custom-dir ';
+  assert.equal(init.buildBrandingConfig(spec).configDir, 'custom-dir');
+});
+
 // ---- buildModulesConfig ----
 test('buildModulesConfig: every known module present, enabled ones true', () => {
   const m = init.buildModulesConfig(fullSpec()).modules;

package/tests/patch_gate_ordering.mjs

@@ -0,0 +1,102 @@
+// tests/patch_gate_ordering.mjs — PATCH /tasks/:id settles gates before writes
+// (task 1002609, choke-point finding G-22).
+//
+// The bug this pins: the handler used to validate-and-write per field in
+// sequence, so a body mixing a valid early field with a refused later one
+// committed the early write and THEN 403/400'd — a Metic sending
+// { parallel_safe: false, security_sensitive: true } had parallel_safe
+// committed before rank_forbidden. Authorization must be settled before any
+// field is written, and the same holds for every validation refusal.
+//
+// Pinned as source-shape assertions on the PATCH handler slice (the
+// goal_advisory.mjs pattern): every refusal code must appear BEFORE the first
+// db.updateTask* write, and the checker itself is proven non-vacuous against a
+// synthetic counter-example shaped like the old bug.
+//
+// Run:  node --test tests/patch_gate_ordering.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+
+const src = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
+
+// The PATCH handler slice: router.patch('/tasks/:id' … up to the next route.
+function patchSlice(source) {
+  const start = source.indexOf("router.patch('/tasks/:id'");
+  assert.ok(start !== -1, 'PATCH /tasks/:id handler not found');
+  const end = source.indexOf('router.post(', start);
+  assert.ok(end !== -1, 'no route follows the PATCH handler');
+  return source.slice(start, end);
+}
+
+// All refusal codes the validation phase can emit, and the first write.
+const REFUSALS = [
+  "'rank_forbidden'",
+  "'bad_parallel_safe'",
+  "'bad_security_sensitive'",
+  "'bad_automation_tag'",
+  "'bad_module_key'",
+  "'bad_goal_id'",
+  "'goal_not_found'",
+  "'goal_version_mismatch'",
+  "'bad_requires_rank'",
+  'badKind(res)',
+  "'bad_discipline'",
+];
+
+function firstWriteIndex(slice) {
+  const m = slice.match(/await db\.updateTask\w+\(/);
+  return m ? m.index : -1;
+}
+
+function refusalsBeforeFirstWrite(slice) {
+  const writeAt = firstWriteIndex(slice);
+  if (writeAt === -1) return { ok: false, offenders: ['no db.updateTask* write found'] };
+  const offenders = REFUSALS.filter((code) => {
+    const at = slice.indexOf(code);
+    return at === -1 || at > writeAt;
+  });
+  return { ok: offenders.length === 0, offenders };
+}
+
+test('every gate and validation refusal precedes the first db write (G-22)', () => {
+  const slice = patchSlice(src);
+  const r = refusalsBeforeFirstWrite(slice);
+  assert.ok(r.ok, `refusal codes missing or after the first write: ${r.offenders.join(', ')}`);
+});
+
+test('the Archon gate on security_sensitive specifically precedes the parallel_safe write', () => {
+  const slice = patchSlice(src);
+  const gate = slice.indexOf("'rank_forbidden'");
+  const write = slice.indexOf('await db.updateTaskParallelSafe(');
+  assert.ok(gate !== -1 && write !== -1, 'gate or write not found');
+  assert.ok(gate < write, 'rank_forbidden must fire before parallel_safe commits — the exact G-22 case');
+});
+
+test('write order keeps requires_rank after security_sensitive (derived-floor dependency)', () => {
+  const slice = patchSlice(src);
+  const ss = slice.indexOf('await db.updateTaskSecuritySensitive(');
+  const rr = slice.indexOf('await db.updateTaskRequiresRank(');
+  assert.ok(ss !== -1 && rr !== -1, 'expected both writes in the handler');
+  assert.ok(ss < rr, 'requires_rank clamps against the derived floor, so its write must follow the security_sensitive write');
+});
+
+test('the ordering checker actually CATCHES the old write-then-refuse shape (not a no-op)', () => {
+  const oldShape = `router.patch('/tasks/:id', async (req, res) => {
+    let updated = null;
+    if (hasParallelSafe) {
+      if (bad) return res.fail('bad_parallel_safe', 400);
+      updated = await db.updateTaskParallelSafe(id, body.parallel_safe);
+    }
+    if (hasSecuritySensitive) {
+      if (!archon) return res.fail('rank_forbidden', 403);
+      if (bad) return res.fail('bad_security_sensitive', 400);
+      updated = await db.updateTaskSecuritySensitive(id, v);
+    }
+  });
+  router.post('/tasks/:id/promote', () => {});`;
+  const r = refusalsBeforeFirstWrite(patchSlice(oldShape));
+  assert.equal(r.ok, false, 'the checker must flag a rank gate that follows a write');
+  assert.ok(r.offenders.includes("'rank_forbidden'"), 'rank_forbidden after the first write must be the offender');
+});