@bongos/core 1.19.256 → 1.19.257

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.256",
-  "core_contract": "1.19.256",
-  "source_commit": "c59b2d80defd16a675d8cb51cd7dcaf5ff1ca234",
+  "core_version": "1.19.257",
+  "core_contract": "1.19.257",
+  "source_commit": "89cf609c2e7581b6e48f1783d1f641e8c3993b54",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T02:25:48.410Z",
+  "built_at": "2026-08-19T02:39:24.112Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 315,
+    "docs_redacted": 316,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1348,
+    "functional_verbatim": 1350,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1685,
-  "tree_sha256": "442984caa92378f234d5808a753846264279dbdd313ab7ec9224a3c775f743f8",
+  "file_count": 1688,
+  "tree_sha256": "78b0f8d12d8e15a2e9b640ce7aec3ea9cbee0ae53c0da8483946f7c261323434",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1379,10 +1379,15 @@
       "mode": "0000644",
       "sha256": "782900e7a2e49c14d7796d94e2b63493659e3c6c3ad8eb8bd721fa589307612b"
     },
+    {
+      "path": "docs/adr/0180-dependency-intake-and-drift-policy.md",
+      "mode": "0000644",
+      "sha256": "62de8180208c3945c7a040b2b2799dceafd59b1c5a117aab7db56a57eb538e44"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "bf9dddba0e72ab43ee6124fbba2a0479f1cb7dfc35ea4005f3382aae98e0066f"
+      "sha256": "798471e95b27664e775d12dbf008fc1aa12edff0b115942a3632ecb0f2da24b5"
     },
     {
       "path": "docs/api-reference.md",
@@ -4437,12 +4442,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a8f006af597e3ee7dd622b463716fa7132ae871d1955443c61f2f2afb40af36f"
+      "sha256": "8810ea843995b1ca69fb9f14db1a394b00f3cf46b5460a167be62a2b634195b2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "244edf862f99c7c918722240e97193b52773200fd9bb1cc81a0b879e978a7ccc"
+      "sha256": "78242b8e21dce2136eded28a2a19b70f2447bf6bdefac4e8cc22ec508569fff8"
     },
     {
       "path": "public-docs/index.html",
@@ -4819,6 +4824,11 @@
       "mode": "0000644",
       "sha256": "7085afc3cc1f636027e1d1c7413cf6a346090de4717fd0fc2ae51d27ee766fd8"
     },
+    {
+      "path": "scripts/gds/audit-gate.js",
+      "mode": "0000644",
+      "sha256": "df91d5e2514ea8c2e79d00a2386e878404ac572f111b2fb5c80ae6f2e53bd85a"
+    },
     {
       "path": "scripts/gds/audit-replay.sh",
       "mode": "0000644",
@@ -5892,7 +5902,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "39fe7b2e08a64d038a2f4b5b0807a6803bf19196fe8b43d0c3ec4989fe9cbb6b"
+      "sha256": "e8a6050abfd191b0afd79c1b4990d4d0ad0a1836f8f83bf31823ec46a4ab14c8"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -6062,7 +6072,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "187e079a50ea8d3f643cf2f33560880b86708a600109b386698425a92a55099e"
+      "sha256": "c56a890ac70423925ba2b32d431db24ee9d88ff2f0dc484ff6057d5e18862849"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6219,6 +6229,11 @@
       "mode": "0000644",
       "sha256": "917a10994a3c6b1f849953bf66fdbabf298a0fb4f07438dd51f513cff806a981"
     },
+    {
+      "path": "tests/audit_gate.mjs",
+      "mode": "0000644",
+      "sha256": "af91c6018f572d9cb0a213b40ec7953f9f81cc20a33634fb5a66615a1649fee8"
+    },
     {
       "path": "tests/audit_middleware.mjs",
       "mode": "0000644",

package/docs/adr/0180-dependency-intake-and-drift-policy.md

@@ -0,0 +1,36 @@
+# ADR 0180 — Dependency intake & drift policy
+
+**Date:** 2026-08-19
+**Context:** Task 1003127 (goal 1000076, criterion `dependency-watch`). Grounded in the red-team baseline audit ([`docs/audits/ai-dev-redteam-baseline.md`](../audits/ai-dev-redteam-baseline.md) §3): 18 known advisories (2 high) sat unwatched in the 9 production dependencies, the `undici` override pinned a vulnerable range while also breaking Node 26 CLIs, and nothing gated what an agent may `npm install`. Threat backdrop: the 2025 npm wave (chalk/debug takeover, the Shai-Hulud self-replicating worm, the Nx postinstall stealer) ran on **install-lifecycle scripts** and **stale long-lived publish tokens**.
+**Status:** Accepted.
+
+## Decisions
+
+### 1. CI audit gate with a shrink-only baseline
+
+`scripts/gds/audit-gate.js` runs in the required `unit` workflow: `npm audit --omit=dev --json`, deduped to advisory×package findings, compared against the committed [`config/audit-baseline.json`](../../config/audit-baseline.json).
+
+- A **new high/critical** advisory (not in the baseline) **fails the merge gate**.
+- New low/moderate advisories warn; a baseline entry that stops reproducing prints a ratchet-down nudge.
+- The baseline records **pre-gate debt only** (10 findings, 3 high+ at adoption). It shrinks via fix tasks; adding an entry to silence a *new* advisory defeats the gate and is out of policy.
+- **Fail-open on infrastructure, fail-closed on findings:** a registry outage or unparseable audit output warns and exits 0 — the gate catches new advisories, it does not prove registry uptime.
+- Blanket `npm audit fix` does not run against this tree (`workspace:` protocol in the dependency graph, `EUNSUPPORTEDPROTOCOL`) — one more reason fixes are explicit tasks, not autofix side effects.
+
+### 2. Install-lifecycle scripts are off (`.npmrc ignore-scripts=true`)
+
+The dominant live npm attack vector is the postinstall script. This tree needs none: **sharp** (the only native dep) installs prebuilt binaries via `optionalDependencies`, verified by a script-less `npm ci` followed by a sharp load (`vips 8.17.3`) and the full 430-test suite. `npm test`/`npm run` are unaffected (npm only suppresses install-time lifecycle hooks). A future dependency that genuinely needs an install script is an ADR-level exception with justification, not a reason to flip the flag.
+
+### 3. Update cooldown: patrol-enforced now, npm-native later
+
+The consensus post-Shai-Hulud control is a **release-age cooldown** (don't install versions younger than a few days; let the ecosystem catch registry malware first). npm supports this natively from 11.10 (`minimum-release-age`), but the CI toolchain (Node 22 → npm 10) would warn on the unknown key for every builder. So:
+
+- **Now:** the weekly red-team patrol (task 1003128) flags any dependency bumped to a version **younger than 7 days** at install time, plus stale overrides (the `undici ^6.27.0` case — pinned inside a vulnerable range) and unpinned workflow actions.
+- **Later:** when the toolchain floor reaches npm ≥ 11.10, move the cooldown into `.npmrc` and drop the patrol's version-age check.
+
+### 4. Publish auth: OIDC trusted publishing, token as documented exception
+
+The publish-on-merge lane (ADR 0161) authenticates with a long-lived `NPM_TOKEN` repository secret — exactly the credential class the Sept-2025 attacks monetized, and why GitHub revoked classic tokens and capped granular ones at 90 days. Decision: **adopt npm trusted publishing (OIDC)** — no long-lived secret, provenance for free. It needs a one-time owner action on npmjs.com (register the repo+workflow as a trusted publisher for `@bongos/core`), filed as a blocker. **Until then** the granular `NPM_TOKEN` remains a *documented exception*: 90-day expiry, publish-only scope, rotated on expiry.
+
+## What this deliberately does not cover
+
+New-dependency *intake vetting* (registry existence/age/download checks — the slopsquatting defense) lives in the weekly patrol (task 1003128), and one-off vulnerability *fixes* (sharp ≥ 0.35 for the libvips CVEs, the colyseus chain for nanoid) are ordinary tasks that shrink the baseline — filed in the idea inbox at adoption time.

package/docs/adr/README.md

@@ -253,5 +253,6 @@ This keeps the decision history honest and traceable.
 | 0177 | [**A goal membership is a `membership_kind`, and the rename ships expand-then-contract** ([task 1003013](https://cloudbongos.com/builders#/task/1003013), goal 1000068). ADR 0174 reserved `role` for the three crafts and enforced it on the GOVERNMENT surface only — by design, since `builders.system_role` and Discord's own noun are legitimate. That left a **fourth** use uncatalogued: `goal_members.role` (`'lead' | 'member'`), the MANAGER predicate behind goal authorization. Renamed to **`membership_kind`** — values unchanged, because the noun was the problem; `rank` is wrong (not a ladder position) and `position` is worse (ADR 0174 uses it as the prose word for a rank, recreating the "rank-role" qualifier collision). A boolean `is_lead` was seriously considered and rejected: the text rename keeps the copied CHECK and stays a reversible change on a live authz column, where `ADD boolean; UPDATE; DROP text` is data-destructive. The migration is **expand-then-contract, never `RENAME COLUMN`** — auto-rollback reverts the code pin and NOT the DB, so `core_220` ADDs the column and keeps the pair in lockstep with a BEFORE trigger (direction decided by which side changed), and a later task DROPs the old column with the `-- forward-unsafe` pragma, a backup, and its own window; no `SET NOT NULL` in step 1, because a static NOT NULL on a column the previous release never heard of is what the forward-safety gate rightly flags. The API field renames with it and carries **no `role` alias** (ADR 0174's Lineage lesson: a time-boxed shim outlives its release), pinned by the test of its absence. The reservation gains a **second narrow wall** rather than a widened first one — line-scoped inside the 5k-line `db.js` to the lines that name `goal_members`, so no allowlist is needed. A **fifth** use (`project_memberships.role`) is catalogued and filed, with this as its pattern.](<redacted>.md) | naming / lifecycle |
 | 0178 | [**The copy desk: a flag carries a judgement, and no column here could ever hold copy** ([task 1003113](https://cloudbongos.com/builders#/task/1003113), R02 of goal 1000074). [ADR 0081](<redacted>.md) made the repo the source of truth for design TOKENS; user-facing TEXT had no equivalent. R01 built the inventory (`copy-inventory.js` → `docs/copy-registry.json`), which answers *what does the product say* but cannot answer *what is wrong with it* — a judgement a person must record. This is that record plus the artist's queue. A new default-on module keyed **`copy-desk`, not `copy`**, for a concrete reason: the branding contract already owns a `copy` block, so the bare word reds the `core carries no module code` fitness check on the English word in `src/branding.js` — and the editorial "copy desk" is the more accurate name anyway. **The reason is required in the route AND in a CHECK constraint**: the route gives a person a usable error, the constraint means no future write path can create the reasonless flag the queue exists to not contain (a pointer with no judgement is *worse* than no flag — it still costs the artist a look). Closing requires a note by the same symmetry, since an unexplained close is indistinguishable from clearing a queue to move a number. The load-bearing decision is **NO LIVE CMS enforced by the schema's SHAPE**: `copy_desk_flags` has no column that could hold replacement text and must never gain one, because that non-goal does not erode via an "add a CMS" commit but via one plausible column, then one plausible read of it — `copy_no_cms.mjs` pins the write surface at exactly two verbs so R03's proposal path changes it in a reviewable diff. Rank is asymmetric: **filing is open to every rank** (the engineer who wrote the toast and the newcomer who could not read the button are the likeliest noticers, and neither is the artist — the reason floor is the quality gate, rank is not), closing is Metic+ **or the author** (withdrawing your own flag is a correction, not triage); nothing gates on craft, since an artist is a craft and not a rank. Duplicates are the only automatic signal (the one of stale/duplicated/off-voice needing no judgement layer) and the count **subtracts settled work**, or it never moves and teaches that the queue is decorative. A vanished target is **reported, never auto-closed** — the id is a hash over the text, so an edit routinely orphans a flag, and closing a human judgement because a hash moved is the family of error ADR 0162 rules out. Deliberately reports **no `generated_at`**: R01's contract is determinism, so a clock is the one field it cannot carry.](<redacted>.md) | design / artist loop |
 | 0179 | [**`rank:metic+` means metic and above; a bare `rank:metic` still means exactly metic** ([task 1003094](https://cloudbongos.com/builders#/task/1003094), goal 1000069). [ADR 0175](<redacted>.md) gave the constitution ONE membership form, `rank:<key>`, resolved by an EXACT SQL match — so `rank:metic` seated metics ONLY (excluding Archons), `rank:xenos` seated NEWCOMERS ONLY rather than "everyone", and "Metic and above" was inexpressible. Everywhere else a rank is a LADDER and authority is cumulative (ADR 0034 inheritance, requireRank('metic','archon'), the floor-derived seed); board membership was the one place it meant "exactly", and nothing said so. Rehearsing R25 on a real Postgres, an Archon ratified `rank:metic` under monarchy — the apply worked perfectly — and the next vote came back 403 not_board_member: **the owner flipped the switch and fell off their own board**, with the board deadlocked at one member because an Archon can still PROPOSE but no longer VOTE. Owner decision: EXPLICIT GRAMMAR. `rank:metic+` (that rank and above), `rank:metic,archon` (union), and **a bare key still means EXACTLY that key** — rejecting the smaller diff (silently redefining the bare form) precisely because it would have changed the meaning of every already-ratified constitution, the monarchy default included, on upgrade: nothing in a government should change meaning without a vote. `+` is defined only on the STANDARD ladder — "and above" about a custom rank with no ladder position is a parse REFUSAL, not a guess, and a refusal seats nobody. The grammar had been written TWICE (a shape regex in the config sanitizer, a parse regex in the resolver, pinned by a property test) — sound for one literal form, unsound the moment a rule needs a LOOKUP, which is the same class of drift that produced the bug; both now call one pure `membership-predicate.js`. Adds the DISENFRANCHISEMENT GUARD: a proposal that would unseat its own proposer is refused before any write, naming the one-character fix, overridable with an explicit `acknowledge_self_removal` (a separate parameter, never a proposal field) because stepping back is a legitimate act. The two DB reads take a set via `= ANY($1)` + DISTINCT (a double-counted member silently raises the consent bar), the structural filters are re-proven against real Postgres (a deactivated builder and a machine principal still never govern), and the hall panel now describes every form in plain language — rendering `rank:metic+` as "the metic+ rank" would be the same bug one layer up. Unblocks task 1003095, which can now write each charter's TRUE predicate rather than wording around a limitation.](<redacted>.md) | government / the board |
+| 0180 | [**Dependency intake & drift policy: baseline-ratchet audit gate, install scripts off, cooldown via patrol, OIDC publish** ([task 1003127](https://cloudbongos.com/builders#/task/1003127), goal 1000076). The red-team baseline audit found 18 advisories (2 high) sitting unwatched in 9 production deps, the `undici ^6.27.0` override pinned INSIDE a vulnerable range while also breaking Node 26 CLIs, and nothing gated what an agent may install — against a 2025 npm threat wave (chalk/debug, Shai-Hulud, Nx) that ran on postinstall scripts and long-lived publish tokens. Four decisions. (1) `scripts/gds/audit-gate.js` runs in the required `unit` check: a high/critical advisory NOT in the committed `config/audit-baseline.json` fails the merge gate; the baseline is **shrink-only pre-gate debt** (10 findings at adoption) — adding an entry to silence a NEW advisory is out of policy. Fail-OPEN on registry/infra errors, fail-CLOSED on findings: the gate catches new advisories, it does not prove registry uptime. Notably a blanket `npm audit fix` cannot even run here (`workspace:` protocol, EUNSUPPORTEDPROTOCOL) — fixes are explicit tasks. (2) `.npmrc ignore-scripts=true`: the tree needs no install-lifecycle scripts — sharp installs prebuilds via optionalDependencies, proven by a script-less `npm ci` + full 430-test suite; a future dep needing one is an ADR-level exception. (3) Update cooldown is PATROL-enforced (task 1003128 flags versions younger than 7 days + stale overrides + action-pin drift) rather than `.npmrc`-enforced, because CI's npm 10 warns on the npm-11 `minimum-release-age` key for every builder; move it into `.npmrc` when the toolchain floor reaches npm ≥ 11.10. (4) Publish auth moves to npm **trusted publishing (OIDC)** — needs a one-time owner registration on npmjs.com (blocker filed); until then the granular 90-day `NPM_TOKEN` is a documented exception.](<redacted>.md) | devsecops / supply chain |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.256",
+  "version": "1.19.257",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.256",
+      "version": "1.19.257",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.256",
+  "version": "1.19.257",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-gate.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+// scripts/gds/audit-gate.js — the dependency vulnerability gate (task 1003127,
+// goal 1000076; ADR 0180, docs/audits/ai-dev-redteam-baseline.md §3).
+//
+// Ratchet semantics, matching the goal's other budgets: a committed BASELINE
+// (config/audit-baseline.json) records the advisories that predate the gate.
+// A HIGH or CRITICAL advisory NOT in the baseline fails CI; anything below
+// high warns; a baseline entry that no longer reproduces prints a shrink nudge
+// (removing it is an ordinary PR). Fixes are explicit tasks — a blanket
+// `npm audit fix` does not even run against this tree (workspace: protocol).
+//
+// Fail contract: CLOSED on findings, OPEN on infrastructure — a registry
+// outage or unparseable audit output warns and exits 0 rather than bricking
+// every PR (the gate's job is catching new advisories, not proving uptime).
+//
+// Run:            node scripts/gds/audit-gate.js
+// Refresh floor:  node scripts/gds/audit-gate.js --update-baseline
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const BASELINE_PATH = path.join(ROOT, 'config', 'audit-baseline.json');
+const GATE_SEVERITIES = new Set(['high', 'critical']);
+
+// npm audit JSON → flat advisory findings, one per (advisory, vulnerable pkg).
+// Identity is the advisory's numeric `source` id + the package it hits — stable
+// across runs, unlike the parent-package rollups npm prints.
+function extractFindings(auditJson) {
+  const out = new Map();
+  const vulns = (auditJson && auditJson.vulnerabilities) || {};
+  for (const entry of Object.values(vulns)) {
+    for (const via of entry.via || []) {
+      if (typeof via !== 'object' || via === null || via.source == null) continue;
+      const key = `${via.source}:${via.name}`;
+      if (!out.has(key)) {
+        out.set(key, {
+          id: String(via.source),
+          name: via.name,
+          severity: String(via.severity || entry.severity || 'unknown').toLowerCase(),
+          title: via.title || '',
+        });
+      }
+    }
+  }
+  return [...out.values()].sort((a, b) => (a.name + a.id).localeCompare(b.name + b.id));
+}
+
+// Pure gate decision — exported for the hermetic test.
+function compare(currentFindings, baselineFindings) {
+  const baseKeys = new Set((baselineFindings || []).map((f) => `${f.id}:${f.name}`));
+  const curKeys = new Set(currentFindings.map((f) => `${f.id}:${f.name}`));
+  const fresh = currentFindings.filter((f) => !baseKeys.has(`${f.id}:${f.name}`));
+  return {
+    newGating: fresh.filter((f) => GATE_SEVERITIES.has(f.severity)),
+    newAdvisory: fresh.filter((f) => !GATE_SEVERITIES.has(f.severity)),
+    resolved: (baselineFindings || []).filter((f) => !curKeys.has(`${f.id}:${f.name}`)),
+  };
+}
+
+function readBaseline() {
+  try {
+    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).findings || [];
+  } catch {
+    return [];
+  }
+}
+
+function runAudit() {
+  try {
+    return execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024 }).toString();
+  } catch (e) {
+    // npm audit exits 1 when advisories exist — that IS the payload.
+    if (e && e.stdout) return e.stdout.toString();
+    throw e;
+  }
+}
+
+function main() {
+  const update = process.argv.includes('--update-baseline');
+  let findings;
+  try {
+    findings = extractFindings(JSON.parse(runAudit()));
+  } catch (e) {
+    console.warn(`audit-gate: WARN — npm audit did not produce parseable JSON (${e.message}); failing OPEN (infra, not findings).`);
+    process.exit(0);
+  }
+
+  if (update) {
+    fs.writeFileSync(
+      BASELINE_PATH,
+      JSON.stringify({ _comment: 'audit-gate baseline (ADR 0180): pre-existing advisories the gate tolerates. Shrink-only — remove entries as fix tasks land; never add by hand to silence a NEW advisory.', updated: null, findings }, null, 2) + '\n',
+    );
+    console.log(`audit-gate: baseline updated — ${findings.length} finding(s) recorded at ${path.relative(ROOT, BASELINE_PATH)}.`);
+    return;
+  }
+
+  const verdict = compare(findings, readBaseline());
+  for (const f of verdict.resolved) {
+    console.log(`audit-gate: ratchet-down available — baseline entry no longer reproduces: [${f.severity}] ${f.name} (${f.id}) ${f.title}`);
+  }
+  for (const f of verdict.newAdvisory) {
+    console.warn(`audit-gate: WARN new ${f.severity} advisory (below the gate): ${f.name} (${f.id}) ${f.title}`);
+  }
+  if (verdict.newGating.length) {
+    console.error('audit-gate: FAIL — new high/critical advisories not in the baseline:');
+    for (const f of verdict.newGating) {
+      console.error(`  [${f.severity}] ${f.name} (advisory ${f.id}) ${f.title}`);
+    }
+    console.error('Fix or pin the dependency. The baseline only records PRE-GATE debt; do not add new entries to silence this.');
+    process.exit(1);
+  }
+  console.log(`audit-gate: PASS — ${findings.length} known finding(s), 0 new at high/critical.`);
+}
+
+if (require.main === module) main();
+
+module.exports = { extractFindings, compare, GATE_SEVERITIES, BASELINE_PATH };

package/src/bongos/module-scope-map.js

@@ -310,7 +310,7 @@ const MODULE_GLOBS = {
     '.npmrc', '.gitleaks.toml',
     'package.json', 'package-lock.json',
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
-    'scripts/gds/redteam-patrol.js',
+    'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
   ],
 };
 

package/src/module-api.js

@@ -939,8 +939,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.254 with no explicit bump. run 32207967928. (task 1002620)
 //   1.19.256 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.255 with no explicit bump. run 32208475455. (task 1002620)
+//   1.19.257 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.256 with no explicit bump. run 32209295358. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.256'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.257'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/audit_gate.mjs

@@ -0,0 +1,89 @@
+// tests/audit_gate.mjs — the dependency audit gate's pure core (task 1003127,
+// goal 1000076; ADR 0180). Hermetic: exercises extractFindings + compare on
+// fixture JSON — the npm/network half is CI-only by design (fail-open there).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gate = require(path.join(ROOT, 'scripts', 'gds', 'audit-gate.js'));
+
+const AUDIT_FIXTURE = {
+  vulnerabilities: {
+    // parent rollup whose via is a STRING (another package) — contributes nothing
+    'discord.js': { severity: 'moderate', via: ['undici'] },
+    // real advisory objects — these are the findings
+    undici: {
+      severity: 'moderate',
+      via: [
+        { source: 101, name: 'undici', severity: 'moderate', title: 'CRLF injection' },
+        { source: 102, name: 'undici', severity: 'moderate', title: 'response desync' },
+      ],
+    },
+    sharp: {
+      severity: 'high',
+      via: [{ source: 200, name: 'sharp', severity: 'high', title: 'libvips CVEs' }],
+    },
+    nanoid: {
+      severity: 'high',
+      // duplicate of the same advisory via two chains — must dedupe
+      via: [
+        { source: 300, name: 'nanoid', severity: 'high', title: 'predictable ids' },
+        { source: 300, name: 'nanoid', severity: 'high', title: 'predictable ids' },
+      ],
+    },
+  },
+};
+
+test('extractFindings flattens advisory objects, skips string vias, dedupes by advisory×package', () => {
+  const f = gate.extractFindings(AUDIT_FIXTURE);
+  assert.equal(f.length, 4, `expected 4 unique findings, got ${JSON.stringify(f)}`);
+  assert.ok(f.every((x) => typeof x.id === 'string' && x.name && x.severity));
+  assert.equal(f.filter((x) => x.name === 'nanoid').length, 1, 'duplicate advisory chains collapse');
+});
+
+test('a baseline-covered tree passes: no newGating, no newAdvisory', () => {
+  const f = gate.extractFindings(AUDIT_FIXTURE);
+  const v = gate.compare(f, f);
+  assert.equal(v.newGating.length, 0);
+  assert.equal(v.newAdvisory.length, 0);
+  assert.equal(v.resolved.length, 0);
+});
+
+test('a NEW high advisory gates; a new moderate only advises', () => {
+  const baseline = gate.extractFindings(AUDIT_FIXTURE);
+  const current = [
+    ...baseline,
+    { id: '999', name: 'express', severity: 'high', title: 'fresh high' },
+    { id: '998', name: 'pg', severity: 'moderate', title: 'fresh moderate' },
+  ];
+  const v = gate.compare(current, baseline);
+  assert.deepEqual(v.newGating.map((f) => f.id), ['999']);
+  assert.deepEqual(v.newAdvisory.map((f) => f.id), ['998']);
+});
+
+test('a fixed advisory surfaces as a ratchet-down nudge, never a failure', () => {
+  const baseline = gate.extractFindings(AUDIT_FIXTURE);
+  const current = baseline.filter((f) => f.name !== 'sharp');
+  const v = gate.compare(current, baseline);
+  assert.equal(v.newGating.length, 0);
+  assert.deepEqual(v.resolved.map((f) => f.name), ['sharp']);
+});
+
+test('empty/missing baseline means every high gates (the fresh-repo case)', () => {
+  const v = gate.compare(gate.extractFindings(AUDIT_FIXTURE), []);
+  assert.equal(v.newGating.length, 2, 'sharp + nanoid gate');
+  assert.equal(v.newAdvisory.length, 2, 'the two undici moderates advise');
+});
+
+test('the committed baseline file parses and only carries known severities', () => {
+  const b = require(path.join(ROOT, 'config', 'audit-baseline.json'));
+  assert.ok(Array.isArray(b.findings) && b.findings.length > 0);
+  for (const f of b.findings) {
+    assert.ok(['low', 'moderate', 'high', 'critical', 'info', 'unknown'].includes(f.severity), `odd severity ${f.severity}`);
+    assert.ok(f.id && f.name, 'baseline entries carry advisory id + package');
+  }
+});