@bongos/core 1.19.248 → 1.19.249

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.248",
-  "core_contract": "1.19.248",
-  "source_commit": "bae0bacddfbacf9522b52c969f70eba97a404999",
+  "core_version": "1.19.249",
+  "core_contract": "1.19.249",
+  "source_commit": "992220580b9a449998b6c24f857cf0e770bb05cb",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T23:41:54.166Z",
+  "built_at": "2026-08-18T23:57:42.981Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 312,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1663,
-  "tree_sha256": "e28385efcc78d3c913d04bce79e44e95394413c2e484ed96abffa7e8269d377c",
+  "tree_sha256": "b7562afed829bda45658ec0e21c2c045fd7d4828b7074f2d4834937bb15d0121",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4347,12 +4347,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "16750ea8ecab7425183daae2d05d8f4aceb3769a03651b812ca520b5e1323801"
+      "sha256": "72b91522dadad774aa718d0b832f77d942d427175b52285eb15416e4f95a1337"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2dcfaaa9223a22671c43afcc5f0d3abac0db6d73193fc4a402e6d46bd04c519c"
+      "sha256": "480de6ffb6a5f6da702e74843627d5083d9dec4a76e9efcb6a1e49f97ade8cbb"
     },
     {
       "path": "public-docs/index.html",
@@ -5802,7 +5802,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "277097c686b695688dee35d158c4bb8384b4a5a89c61f30c7bda7d9f4b477bee"
+      "sha256": "e0c20565bb59c93fa9fff0aafa5eb246a0b16564604d18b5ae9ca350dd9e1a44"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5972,7 +5972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "63a931fbe395426e0eaa09e2bb10cbbbdc247de66fcbdd836226dceaa45cac22"
+      "sha256": "79234cc30c410a215492f897139bf042c2ff58f778e490d18ec3f65a6fd860f8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7442,7 +7442,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "9eb05d38e5138e0da16d57d1d4c8768528dbc052acbc1a9d5d5e7cef7d38f06c"
+      "sha256": "2b7bc9594489401b3dd67070c3e549d0a81347abb625a04fe19a41a178af8857"
     },
     {
       "path": "tests/module_api.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.248",
+  "version": "1.19.249",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.248",
+      "version": "1.19.249",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.248",
+  "version": "1.19.249",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -274,6 +274,27 @@ const MODULE_GLOBS = {
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
   ],
+  // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
+  //     hook files, git hooks, root manifests, and the fitness/entropy tooling
+  //     (task 1003124, goal 1000076). Before this key, NO key resolved these paths,
+  //     so the continuous-red-team goal could not wall its own work (the
+  //     1002690/1002736 precedent). Most of these paths were ALREADY in the
+  //     protected-surfaces registry (ADR 0043) — what was missing was ownership —
+  //     so `protected` DERIVES true via the .github/ / package.json / .husky/ /
+  //     .claude-hooks overlap. Boundaries: '.claude/scheduled-tasks/' stays with
+  //     autonomy and '.claude/agents/' with agents (their source surfaces);
+  //     '.claude/skills/' stays with whichever module ships the skill.
+  //     '.npmrc' and '.gitleaks.toml' are pre-carved territory for goal 1000076's
+  //     R-tasks (the carve precedes the feature — ADR 0086 §4).
+  devsecops: [
+    '.github/',
+    '.claude/settings.json', '.claude/hooks/',
+    '.husky/',
+    '.npmrc', '.gitleaks.toml',
+    'package.json', 'package-lock.json',
+    'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
+    'scripts/gds/redteam-patrol.js',
+  ],
 };
 
 // A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one

package/src/module-api.js

@@ -923,8 +923,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.246 with no explicit bump. run 32197488065. (task 1002620)
 //   1.19.248 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.247 with no explicit bump. run 32198208766. (task 1002620)
+//   1.19.249 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.248 with no explicit bump. run 32199293372. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.248'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.249'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -166,3 +166,43 @@ test('agents joined the roster (task 1002736) — the territory goals 1000038/39
   assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
   assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not agents');
 });
+
+test('devsecops joined the roster (task 1003124) — the enforcement territory goal 1000076 walls', () => {
+  // Before this, .github/, .claude/settings.json + hooks, .husky/, the root
+  // manifests, and the fitness/entropy tooling were covered by NO key, so the
+  // continuous-red-team goal (1000076) could not wall its own work.
+  assert.ok(scope.isModuleKey('devsecops'), 'roster missing module "devsecops"');
+  const globs = scope.globsForModules(['devsecops']);
+  assert.ok(globs.includes('.github/'), 'devsecops owns the CI workflow surface');
+  assert.ok(globs.includes('.claude/hooks/'), 'devsecops owns the agent hook surface');
+  assert.ok(globs.includes('scripts/gds/fitness.js'), 'the fitness tool travels with the domain');
+  // Derived, not hand-set: .github/, package.json, .husky/, .claude/hooks/ and
+  // .claude/settings.json all sit in the ADR 0043 protected-surfaces registry, so
+  // this key MUST derive protected — creating/widening a goal into it is Archon-only.
+  assert.equal(scope.isProtectedModule('devsecops'), true, 'devsecops must derive protected (trust-core overlap)');
+  assert.equal(
+    scope.scopeForModule('devsecops').protected,
+    scope.isProtected(globs),
+    'protected must be the faithful derivation, never a literal',
+  );
+  // Asserted through the REAL consumer (directional containment), not re-implemented.
+  const covers = (touch) => gsc.scopeSubset(['devsecops'], [touch]).ok;
+  for (const touch of [
+    '.github/workflows/unit.yml',        // the CI gate R03/R04 extend
+    '.claude/settings.json',             // the deny rules R02 adds
+    '.claude/hooks/secret-gate.js',      // the PreToolUse hook R02 adds
+    '.npmrc',                            // the install-script policy R04 lands
+    'package.json',                      // dependency manifest (R04/R07)
+    '.gitleaks.toml',                    // the scanner config R03 lands
+    'scripts/gds/fitness.js',            // the ratchet pack R06 extends
+    'scripts/gds/docs-entropy.js',       // the entropy scanner behind the ratchet
+  ]) {
+    assert.equal(covers(touch), true, `wall does not cover ${touch}`);
+  }
+  // …and still BOUNDS: the trust kernel, the sibling .claude surfaces, and the
+  // lifecycle CLIs stay outside this wall.
+  assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
+  assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not devsecops');
+  assert.equal(covers('.claude/skills/builder-ship/SKILL.md'), false, 'skills stay with the module that ships them');
+  assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle, not devsecops');
+});