@bongos/core 1.19.218 → 1.19.220

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.218",
-  "core_contract": "1.19.218",
-  "source_commit": "a00e409d98973f59f934543251e819a2b9deabd5",
+  "core_version": "1.19.220",
+  "core_contract": "1.19.220",
+  "source_commit": "c0428ccbca81e3243f981295653e2996e9cda202",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T01:00:37.333Z",
+  "built_at": "2026-08-18T03:14:10.378Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1302,
+    "functional_verbatim": 1303,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1634,
-  "tree_sha256": "fe7773c1c51b74af666fd1bd0db3495ae383d717ca65af9a4ef310f9e252efb0",
+  "file_count": 1635,
+  "tree_sha256": "aac7f97a1131f16c75b768382681a70085520bf75be38b35124497b3d734e097",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2697,7 +2697,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "9357b423836c4e8d2cd3c9144d294c3cd3b498ac30755a9e6f62b5bbaa2add5e"
+      "sha256": "870976966de7c48be4172390dc8e4f7d2eb6ac53e20dfb3fd5d40b08cfcd7850"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -2964,6 +2964,11 @@
       "mode": "0000644",
       "sha256": "75913af702d6529c9a5cf2e2c42d9c329eea92ae99274fb71f2524520de4cfbf"
     },
+    {
+      "path": "modules/government/migrations/government_005_seeded_rank_descriptions.sql",
+      "mode": "0000644",
+      "sha256": "dc570f8871b578a8af965ffbc91fc4e195f2e7fce7d7886166f0025ac2b47bce"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4287,12 +4292,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "199faf243475315d256fab355abdc1bfa2547a1d42d0ac623080b44be144de26"
+      "sha256": "352bfdf3484cd27c33da65632970d50a1b99e164008d45b2689cb365fee16720"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "81b98db9ae28ac2606efa211fe791632c1857e796c4d7e00cddbcf26daf76362"
+      "sha256": "719aa0ff0ff7323f96ad1257c3505c5929943f64d3e00f9cdb6f4fce78dc150e"
     },
     {
       "path": "public-docs/index.html",
@@ -5907,7 +5912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "559f382c12c7f37bc85227630cd5670d9f4b7749e9994036d85c221a5d3d3b43"
+      "sha256": "6f39901735ba86e7abd2b5770b36146104ac47dec250131ac24eeca6754ef5f2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6202,7 +6207,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "694153e377a78d4325aa4ff9b947f691d71362f843da25815b9740821903802c"
+      "sha256": "1e4db680c5925e473fff9ad6247e797bd9089fdf3696c3ffb161903bda41dcda"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -6907,7 +6912,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "e7f980f02abfb057d725beaf5730fdd71f4e8249af2180bf4a355632481330d6"
+      "sha256": "8240fef8ed5b7e9a4c16e17e8dd5ffa522a99e320d41229f58f2214e00bcf160"
     },
     {
       "path": "tests/government_session_scope.mjs",

package/modules/dev-box/box-access.js

@@ -171,24 +171,63 @@ const BASE_SPARSE_PATHS = [
 // globs come in two shapes: directory globs (trailing '/', e.g. 'modules/dev-box/')
 // and file-list globs (exact paths, e.g. the kernel key's 'src/bongos/db.js'). We
 // KEEP the directory globs (normalized to no trailing slash, matching the BASE
-// style) and DROP the file globs — every file glob in the map sits under a BASE
-// directory (src/bongos, scripts) or is a top-level/ancestor file cone mode pulls
-// automatically, so base already materializes it. (A future non-cone sparse move
-// could pull individual files; out of scope — cone mode stays.) Deterministic:
-// BASE in declared order, then the module dirs sorted + deduped.
+// style). A FILE glob cannot be emitted as-is, so it contributes its PARENT
+// DIRECTORY instead — unless BASE or another emitted dir already covers it.
+//
+// It used to be dropped outright, on the reasoning that "every file glob in the
+// map sits under a BASE directory (src/bongos, scripts) or is a top-level file
+// cone mode pulls automatically". That was true when written and **silently
+// stopped being true**: ADR 0174 gave the `government` key the file globs
+// `config/government.json` + `config/government.neutral.json`, and `config` is
+// not in BASE. The result was a goal walled to `government` whose box could never
+// see two files inside its own scope wall — which released task 1003018 (R05 of
+// goal 1000069), whose entire deliverable was one of them. Rather than restore an
+// invariant that expires again the next time a module claims a config file, the
+// parent is emitted and the class is covered by construction.
+//
+// TRADE-OFF, stated rather than implied: the parent directory is a SUPERSET of
+// the glob — asking for `config/government.json` materializes all of `config/`.
+// The box's view is already a superset of the wall (BASE hands out `scripts`,
+// `docs` and `tests` wholesale regardless of scope), so this is consistent with
+// the existing posture, not a new concession. The WALL is unchanged: what a
+// builder may author is still decided by goal-scope-check against the globs, not
+// by what happens to be on disk.
+//
+// Top-level file globs (no '/') contribute nothing — cone mode includes root
+// files automatically. Deterministic: BASE in declared order, then the module
+// dirs sorted + deduped.
 function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
   const base = [...BASE_SPARSE_PATHS];
   const seen = new Set(base);
   const extra = [];
+  // Cone mode materializes a directory and everything under it, so a path is
+  // already covered when IT or any ancestor has been emitted. This is what keeps
+  // `scripts/gds/box.js` from adding `scripts/gds` — BASE's `scripts` covers it.
+  const covered = (dir) => {
+    let p = dir;
+    for (;;) {
+      if (seen.has(p)) return true;
+      const cut = p.lastIndexOf('/');
+      if (cut < 0) return false;
+      p = p.slice(0, cut);
+    }
+  };
+  const add = (dir) => {
+    if (!dir || covered(dir)) return;
+    seen.add(dir);
+    extra.push(dir);
+  };
   for (const key of Array.isArray(scopeKeys) ? scopeKeys : []) {
     const entry = moduleScopeMap && typeof moduleScopeMap.scopeForModule === 'function'
       ? moduleScopeMap.scopeForModule(key)
       : null;
     if (!entry || !Array.isArray(entry.globs)) continue;
     for (const glob of entry.globs) {
-      if (typeof glob !== 'string' || !glob.endsWith('/')) continue; // dirs only (cone mode)
-      const dir = glob.replace(/\/+$/, '');
-      if (!seen.has(dir)) { seen.add(dir); extra.push(dir); }
+      if (typeof glob !== 'string' || !glob) continue;
+      if (glob.endsWith('/')) { add(glob.replace(/\/+$/, '')); continue; }
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode already includes it
+      add(glob.slice(0, cut));
     }
   }
   extra.sort();

package/modules/government/migrations/government_005_seeded_rank_descriptions.sql

@@ -0,0 +1,78 @@
+-- government_005_seeded_rank_descriptions.sql — the last "role" on the government
+-- side: the four seeded ranks still DESCRIBE themselves as rank-roles
+-- (task 1003083 / goal 1000068, criterion govt-ranks-not-roles). Decision of
+-- record: ADR 0174.
+--
+-- ── WHAT WAS MISSED, AND WHY ────────────────────────────────────────────────
+-- The rename cleaned the CONFIG TEMPLATE but never the LIVE ROWS.
+-- config/government.neutral.json already reads "Seeded rank — …" for all four,
+-- so the repo looks correct and a fresh instance boots with the right words in
+-- its template. But `GET /api/bongos/government/ranks` reads the DB, and on the
+-- live database every seeded row still carries the text governance_002 wrote:
+--
+--   archon : 'Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers.'
+--   metic  : 'Seeded rank-role — the trusted working rank. Adds review/triage/authoring.'
+--   thetes : 'Seeded rank-role — graduated newcomer. Adds the general claim queue.'
+--   xenos  : 'Seeded rank-role — the sandboxed entry rank. Own-work + public read.'
+--
+-- government_001 renamed the TABLES and government_002 renamed the permission
+-- KEYS; neither touched this column. The hall's Government tab renders these
+-- strings, so the surface goal 1000068 renamed has been displaying the reserved
+-- word to the Owner ever since.
+--
+-- ── WHY THE FITNESS WALL DID NOT CATCH IT ───────────────────────────────────
+-- Check 19 (checkVocabularyWall, scripts/gds/fitness.js) scans FILES on the
+-- government surface, and only .js/.json/.html/.css at that. It cannot see DB
+-- row text. That is the rule working as designed, not a hole in it — which is
+-- precisely why this needed a migration rather than a lint fix.
+--
+-- ── WHY THIS CORRECTS FORWARD INSTEAD OF EDITING governance_002 ─────────────
+-- governance_002 is applied and run-once (schema_migrations is stem-keyed), so
+-- editing its text would change history without changing any database. It also
+-- stays deliberately spelled the old way: it is the factual record of what was
+-- once true, which is exactly the carve-out ADR 0174 grants the historical
+-- migrations. government_002 (the permission-key rename) is the worked example
+-- this copies. On a FRESH install the two converge — governance_002 seeds the
+-- old text, this rewrites it — so both paths end identically.
+--
+-- ── THE GUARD IS LOAD-BEARING ───────────────────────────────────────────────
+-- The WHERE clause matches the OLD SEEDED TEXT EXACTLY rather than blanket-
+-- updating by rank_key. A host may have relabelled a seeded rank through
+-- config (config/government.json may relabel a seeded rank — it may never
+-- re-grant one), and overwriting a deliberate customisation with our template
+-- would be a silent regression dressed as a typo fix. Matching the exact string
+-- governance_002 wrote touches only rows nobody has edited. It also makes this
+-- migration idempotent: re-running it matches nothing.
+--
+-- NAMING ONLY. No grant, floor, or authority change; is_system and seeded_rank
+-- are untouched; no row is inserted or deleted. Safe to run against a database
+-- where some or all four have already been corrected by hand.
+--
+-- ROLLBACK — reverse the mapping (lossless; restores the governance_002 text):
+--   UPDATE government_ranks SET description = replace(description, 'Seeded rank —', 'Seeded rank-role —')
+--    WHERE is_system AND rank_key IN ('xenos','thetes','metic','archon')
+--      AND description LIKE 'Seeded rank —%';
+
+BEGIN;
+
+UPDATE government_ranks AS g
+   SET description = v.new_description
+  FROM (VALUES
+    ('xenos',
+     'Seeded rank-role — the sandboxed entry rank. Own-work + public read.',
+     'Seeded rank — the sandboxed entry rank. Own-work + public read.'),
+    ('thetes',
+     'Seeded rank-role — graduated newcomer. Adds the general claim queue.',
+     'Seeded rank — graduated newcomer. Adds the general claim queue.'),
+    ('metic',
+     'Seeded rank-role — the trusted working rank. Adds review/triage/authoring.',
+     'Seeded rank — the trusted working rank. Adds review/triage/authoring.'),
+    ('archon',
+     'Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers.',
+     'Seeded rank — top authority. Adds the admin + system (non-grantable) powers.')
+  ) AS v(rank_key, old_description, new_description)
+ WHERE g.rank_key = v.rank_key
+   AND g.is_system
+   AND g.description = v.old_description;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.218",
+  "version": "1.19.220",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.218",
+      "version": "1.19.220",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.218",
+  "version": "1.19.220",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -863,8 +863,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.216 with no explicit bump. run 32084927511. (task 1002620)
 //   1.19.218 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.217 with no explicit bump. run 32086598601. (task 1002620)
+//   1.19.219 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
+//   1.19.220 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.219 with no explicit bump. run 32094701831. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.218'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.220'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -221,14 +221,69 @@ t('cone-filter: dev-box keeps its DIRS, DROPS its file globs (scripts/gds/box.js
   assert.ok(out.includes('devbox-app'), 'the app dir is kept');
   assert.ok(!out.some((p) => p.endsWith('.js') || p.endsWith('.sh')), 'no file globs survive the cone filter');
   assert.ok(!out.includes('scripts/gds/box.js'), 'the box CLI file is dropped (BASE scripts covers it)');
+  // …and its PARENT is not added either: BASE's `scripts` already covers it, so
+  // the ancestor check must stop `scripts/gds` from appearing. This is the half
+  // that keeps the file-glob rescue below from over-sharing.
+  assert.ok(!out.includes('scripts/gds'), 'a covered parent is not re-emitted');
+});
+
+// A file glob whose parent is NOT already covered must contribute that parent.
+// Regression for the live failure that released task 1003018 (R05 of goal
+// 1000069): the `government` key's config/government*.json globs were dropped on
+// the reasoning that every file glob sits under a BASE directory — true when
+// written, false once ADR 0174 added them, since `config` is not in BASE. The box
+// could not see two files inside its own scope wall.
+t('file-glob rescue: government contributes `config` for its config/*.json globs', () => {
+  const out = access.sparsePathsForScopeKeys(['government'], scopeMap);
+  assert.ok(out.includes('modules/government'), 'the module dir is kept');
+  assert.ok(out.includes('config'), 'config/government.neutral.json must reach the box via its parent');
+  assert.ok(!out.some((p) => p.endsWith('.json')), 'still no file paths — cone mode would reject one');
+});
+
+t('file-glob rescue holds for EVERY key in the map — no module can silently lose one', () => {
+  // Enumerated, never sampled: a module that gains a file glob under a new parent
+  // is covered the day it lands, which is exactly how this bug escaped before.
+  for (const key of scopeMap.moduleKeys()) {
+    const out = access.sparsePathsForScopeKeys([key], scopeMap);
+    for (const glob of scopeMap.scopeForModule(key).globs) {
+      if (glob.endsWith('/')) continue;
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode includes it automatically
+      const parent = glob.slice(0, cut);
+      const reachable = out.some((p) => parent === p || parent.startsWith(`${p}/`));
+      assert.ok(reachable, `${key}: no cone path materializes ${glob} (parent ${parent})`);
+    }
+  }
+});
+
+t('the emitted set stays directories only, for every key', () => {
+  // A leading dot is a DIRECTORY here ('.devcontainer', '.claude'), so the
+  // extension test must require a non-dot character before the dot — otherwise
+  // every BASE dotfile-dir reads as a file and this assertion fires on healthy
+  // input. (It did, on first write.)
+  const looksLikeFile = (seg) => /[^.]\.[a-z0-9]+$/i.test(seg);
+  for (const key of scopeMap.moduleKeys()) {
+    for (const p of access.sparsePathsForScopeKeys([key], scopeMap)) {
+      assert.ok(!looksLikeFile(p.split('/').pop()),
+        `${key}: ${p} looks like a file — git sparse-checkout set would abort on it`);
+    }
+  }
 });
 
-t('cone-filter: the kernel key contributes only its real DIR globs (config, src/module-loader)', () => {
+t('cone-filter: the kernel key materializes its real DIR globs (config, src/module-loader)', () => {
   const out = access.sparsePathsForScopeKeys(['kernel'], scopeMap);
   // kernel is mostly individual src/bongos/*.js FILES (dropped — BASE src/bongos
   // covers them via cone ancestor-inclusion) + a few genuine DIR globs.
   assert.ok(out.includes('config'), 'config/ is a real dir the task needs, not in BASE');
-  assert.ok(out.includes('src/module-loader'), 'src/module-loader/ is a real dir not in BASE');
+  // src/module-loader/ is a real dir not in BASE, but it is NOT emitted verbatim:
+  // kernel also carries the file globs src/instance-config.js, src/branding.js,
+  // src/modules.js and src/module-api.js, whose rescued parent is `src` — and once
+  // `src` is emitted the ancestor check absorbs every path beneath it, this one
+  // included. Asserting literal membership would be asserting emission ORDER, not
+  // reachability. What the box must actually get is the DIRECTORY's contents, so
+  // assert that, using the same idiom as the enumerated rescue test above.
+  const reaches = (dir) => out.some((p) => dir === p || dir.startsWith(`${p}/`));
+  assert.ok(reaches('src/module-loader'), 'src/module-loader must be materialized (here via the rescued `src`)');
   assert.ok(!out.includes('src/bongos/db.js'), 'the kernel FILE globs are dropped');
   assert.ok(!out.includes('server.js'), 'top-level files never enter the sparse set (cone auto-includes them)');
 });

package/tests/government_seed.mjs

@@ -37,6 +37,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_001_rename_from_governance.sql',     // ADR 0174 table rename (task 1003004)
   'government_002_rename_permission_keys.sql',     // ADR 0174 key rename (task 1003006)
   'government_003_board_tables.sql',               // ADR 0175 Board Room schema (task 1003016)
+  'government_005_seeded_rank_descriptions.sql',   // ADR 0174 seeded-description text fix (task 1003083)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.
@@ -142,6 +143,35 @@ test('later grant migrations are idempotent + transactional', () => {
   }
 });
 
+// The bug this guards (task 1003083): goal 1000068 renamed the government, and
+// config/government.neutral.json was updated to say "Seeded rank — …". The LIVE
+// government_ranks rows were not, so `GET /government/ranks` — and the hall tab
+// that renders it — kept serving governance_002's "Seeded rank-role — …" long
+// after the rename shipped. Two lists of the same strings, only one maintained:
+// exactly the drift this file exists to prevent, in the one column nobody had
+// pointed a test at. The vocabulary fitness wall cannot see it either — Check 19
+// scans .js/.json/.html/.css files, never DB row text or .sql.
+test('the description correction lands EXACTLY the config template text (no second list that drifts)', () => {
+  const correction = fs.readFileSync(path.join(MIG_DIR, 'government_005_seeded_rank_descriptions.sql'), 'utf8');
+  const neutral = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'government.neutral.json'), 'utf8'));
+
+  // Each VALUES row is ('<rank_key>', '<old_description>', '<new_description>').
+  const rows = [...stripComments(correction).matchAll(/\(\s*'([a-z]+)'\s*,\s*'([^']+)'\s*,\s*'([^']+)'\s*\)/g)]
+    .map(([, rankKey, , newDescription]) => [rankKey, newDescription]);
+
+  assert.equal(rows.length, RANK_ORDER.length,
+    'the correction must cover every seeded rank, not a subset');
+
+  for (const [rankKey, newDescription] of rows) {
+    const template = neutral.ranks[rankKey];
+    assert.ok(template, `${rankKey}: not a rank in config/government.neutral.json`);
+    assert.equal(newDescription, template.description,
+      `${rankKey}: the migration writes text the config template does not carry — the two lists have drifted again`);
+    assert.ok(!/\brole/i.test(newDescription),
+      `${rankKey}: "role" is reserved for the crafts (ADR 0174) — a rank describes itself as a rank`);
+  }
+});
+
 test('migration objects are all governance_-namespaced (ADR 0083 §5)', () => {
   for (const sql of [tablesSql, seedSql]) {
     for (const m of sql.matchAll(/CREATE (?:TABLE|INDEX)(?: IF NOT EXISTS)? (\w+)/g)) {