@bongos/core 1.19.257 → 1.19.258

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.257",
-  "core_contract": "1.19.257",
-  "source_commit": "89cf609c2e7581b6e48f1783d1f641e8c3993b54",
+  "core_version": "1.19.258",
+  "core_contract": "1.19.258",
+  "source_commit": "66f71503310987ea2c91b4e930f3d5c81b3fb018",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T02:39:24.112Z",
+  "built_at": "2026-08-19T18:01:56.705Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 316,
+    "docs_redacted": 317,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1350,
+    "functional_verbatim": 1358,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1688,
-  "tree_sha256": "78b0f8d12d8e15a2e9b640ce7aec3ea9cbee0ae53c0da8483946f7c261323434",
+  "file_count": 1697,
+  "tree_sha256": "66ae54f6968edbafb532b3e566ec10fad20a45ca1c48af7951a8bc3fe1a06cd7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -527,7 +527,7 @@
     {
       "path": "docs/adr/0022-secrets-policy.md",
       "mode": "0000644",
-      "sha256": "91cd6dc20c4e605bf1a5f36a1fe374778c6f0904f910ca461f197953634a9927"
+      "sha256": "8ea4766c05c27517d19a9ef7343e4083e71604b22b88ed058071dc82399529bb"
     },
     {
       "path": "docs/adr/0023-kind-multipliers-and-idea-bonus.md",
@@ -1532,12 +1532,12 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "fcba56f057bbfa22c5586075fab70ae5559137880ab6886e5f9c990f4801edd7"
+      "sha256": "9762b7f69397c28e103cdb39a9987483e23bd800a827f0d83983b62ef962616b"
     },
     {
       "path": "docs/handoff-template.md",
       "mode": "0000644",
-      "sha256": "79186414c46089e83d18f5c6a17bc569f42e8ceff8321154ae55da5237f25768"
+      "sha256": "a60d85b8523b5944d4db8105b60166395ab9c1f931fb92f0f95a825b657fe277"
     },
     {
       "path": "docs/modules-contract.md",
@@ -1617,7 +1617,7 @@
     {
       "path": "docs/recipes/README.md",
       "mode": "0000644",
-      "sha256": "1abab5aabf19301f3a436082aaeb15b957dee72e662de41ea2624d29dfe6cf9a"
+      "sha256": "bf3caea65a8b8a117d40544fdf352c235bb120a69444645d62b91f999a9b7731"
     },
     {
       "path": "docs/recipes/audit-replay.md",
@@ -1729,6 +1729,11 @@
       "mode": "0000644",
       "sha256": "5bfca9628859f1cdd79d741bdd50f3fe415430ee3380a2ac7f46b97ebe082d0e"
     },
+    {
+      "path": "docs/recipes/redteam-patrol.md",
+      "mode": "0000644",
+      "sha256": "3dbdc33eb1aa68da5e6569e836845f09fd14953d94794e005af67ce517fb6dad"
+    },
     {
       "path": "docs/recipes/search-index-ingestion.md",
       "mode": "0000644",
@@ -4442,12 +4447,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8810ea843995b1ca69fb9f14db1a394b00f3cf46b5460a167be62a2b634195b2"
+      "sha256": "815b7d1a58cdf1a0d9c7e30a97f70faa146ee6f826501f0c42f1b38529851575"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "78242b8e21dce2136eded28a2a19b70f2447bf6bdefac4e8cc22ec508569fff8"
+      "sha256": "dcc8774d55d45595b6e3f3229a278b4bf5e263438bb730a8bdd620edf9c47bbd"
     },
     {
       "path": "public-docs/index.html",
@@ -4969,6 +4974,11 @@
       "mode": "0000644",
       "sha256": "8ca6ee391837d7e1a45e69fc62c4a051f5e3d6060db507cdcbc7a343e2b03bd3"
     },
+    {
+      "path": "scripts/gds/control-manifest.js",
+      "mode": "0000644",
+      "sha256": "0d5b0c5e4bc15ff914d34849607ad2f01d1843d4dafeafdaf4191c2f365300bb"
+    },
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
@@ -5079,10 +5089,15 @@
       "mode": "0000644",
       "sha256": "7a7721155c8c7cb169a48e6f279e5d7c0ba0dc4462678a4a2ec41a2686501962"
     },
+    {
+      "path": "scripts/gds/fitness-ratchets.js",
+      "mode": "0000644",
+      "sha256": "a27a3873f516abdc52f7f482603779010bbc1af4d6e73c0b86dd34292017bc9a"
+    },
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "add1ee5439ef3ddff171e7eb9a695c63a41b8323c5e8cc6c415b620b812bdfa8"
+      "sha256": "81b35af96345cfdca3f30a9d4f333715c4dd431657a9aa73b5794c02ef75686f"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5152,7 +5167,7 @@
     {
       "path": "scripts/gds/gen-session-index.js",
       "mode": "0000644",
-      "sha256": "c7bdbd7f7a4d2647be17ad37b540afc35913db80d121000346256d57c065f9fa"
+      "sha256": "9b936143ae25442fefb52b98949bc33d245d4b3894d778c51926e9da75c92357"
     },
     {
       "path": "scripts/gds/git-merge-regen.js",
@@ -5409,6 +5424,11 @@
       "mode": "0000644",
       "sha256": "564996b820fa09ccb95bcef2e5a1b57f22e5b16c4e54b67dfe1a2cd37ff716a4"
     },
+    {
+      "path": "scripts/gds/redteam-patrol.js",
+      "mode": "0000644",
+      "sha256": "4e4ce11a67de653550851d9e0b9931253c8b100dd4285f2a39c74ba2f932b23c"
+    },
     {
       "path": "scripts/gds/regen-instance-docs.js",
       "mode": "0000644",
@@ -5879,6 +5899,11 @@
       "mode": "0000644",
       "sha256": "a932e617ee66dabc49b4087baf6606eeb2074f70ebb3efa0723b1d9c92add290"
     },
+    {
+      "path": "src/bongos/logger.js",
+      "mode": "0000644",
+      "sha256": "08a48a47445606c22c1fb5f1e709de5106693eb8b774466186fb5e30352841e8"
+    },
     {
       "path": "src/bongos/metrics.js",
       "mode": "0000644",
@@ -5887,12 +5912,12 @@
     {
       "path": "src/bongos/middleware/audit.js",
       "mode": "0000644",
-      "sha256": "1b260403bdf9f660027a30f316be3246cd833439938216c189033c8e9b3573fa"
+      "sha256": "ad2d224b01bba5ce747f8e3ab8704cbbbd67b1bfb6f4d1237bc910e91f7e4287"
     },
     {
       "path": "src/bongos/middleware/error-envelope.js",
       "mode": "0000644",
-      "sha256": "9a0b9c5212607285b09b5139baa665dcac534e915e9e51aa5644f42efbc8ef9b"
+      "sha256": "920897ba69d929ab5b77bac1605c67d78805ebbbf962d59fec5bdc8b293bd67a"
     },
     {
       "path": "src/bongos/middleware/rate-limit.js",
@@ -5902,7 +5927,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "e8a6050abfd191b0afd79c1b4990d4d0ad0a1836f8f83bf31823ec46a4ab14c8"
+      "sha256": "c3b5499005ae5150d1e3288437dbfd422e28068a28e3c5783a8c4b3fa2edd09c"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -6037,7 +6062,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "785c83fa3bb4a12ea33b528d70e030cffd44fb3ffaecbdb90f7c558621118f3e"
+      "sha256": "2ce782b00c80482ef9b9d3e4a54a634e73c6d956e13e32cc7e3d2ff63e8282cd"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -6072,7 +6097,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c56a890ac70423925ba2b32d431db24ee9d88ff2f0dc484ff6057d5e18862849"
+      "sha256": "a34bf521314a258ef3c444962bac548fa9aa2e0853dc45531f79586ef52bdeec"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6112,7 +6137,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "9567d70acc5150dbdd0f6ea1df996977f2566c8c577bd6c9d0ca05516163dc1b"
+      "sha256": "704f68cdafb697138b9e012defedeb827dee3ff97191c78bf0e86be0ae5d61cf"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -6282,7 +6307,7 @@
     {
       "path": "tests/auth_resolve_failure.mjs",
       "mode": "0000644",
-      "sha256": "25271ff1abef5600fab6b9d768c0f94965ffdea4d926b6a60344676f5392f9f1"
+      "sha256": "d14529c53ddf42f69c40fd49dc6eb230df4a519e9bc2bfdfab04df277e3dbb9c"
     },
     {
       "path": "tests/auth_session_ttl.mjs",
@@ -6537,7 +6562,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "6d31d8597e3b1e9e7efde56f9a3839715cfa87378e7555f0fa3b26b09346a569"
+      "sha256": "ad3daf4c6cc3a0f56d8d205077c835397b1d112a0219dabb05a7e8b3a8da9492"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -6604,6 +6629,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/control_manifest.mjs",
+      "mode": "0000644",
+      "sha256": "2465159282594723a49d03ed2ca9dbb10e95ddb7af96d145c45f7d7c2a8b8cee"
+    },
     {
       "path": "tests/copy_desk_flags_db.mjs",
       "mode": "0000644",
@@ -6889,6 +6919,11 @@
       "mode": "0000644",
       "sha256": "ebb93b7bdd90c0775f71eb949a6e47022570bdb35c901bd4522413fefa750e14"
     },
+    {
+      "path": "tests/fitness_ratchets.mjs",
+      "mode": "0000644",
+      "sha256": "781bdee0778645704b5179bf99507e839743158714f799e45d6cc64f8fc30477"
+    },
     {
       "path": "tests/fitness_two_root.mjs",
       "mode": "0000644",
@@ -7474,6 +7509,11 @@
       "mode": "0000644",
       "sha256": "a01036699653e810c8eb2e4f8bdabe081095e5634ef6ea4f1e4f85b2b5f56523"
     },
+    {
+      "path": "tests/logger.mjs",
+      "mode": "0000644",
+      "sha256": "88508517d49ad11a01d2dbc97767c4baa6789753ea42afe76699bc2bab5017d4"
+    },
     {
       "path": "tests/main_audit.mjs",
       "mode": "0000644",
@@ -7877,7 +7917,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "1dfca44ba378b69041894371c1a3765eba40edbdec18570d7b67cc849bcb9e8a"
+      "sha256": "c61741aebfad2e85e55f0e734b3195d9474f8dd0c7812c3ee1434b05d088c1de"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -7914,6 +7954,11 @@
       "mode": "0000644",
       "sha256": "6d82e99c69d23a4dd7a844ffdd7f239ea70c94d9c509e2fc8e1a672cd9f05a28"
     },
+    {
+      "path": "tests/redteam_patrol.mjs",
+      "mode": "0000644",
+      "sha256": "bf32ae5c734fc95873433b7c4e251a6b166c167ccc91c4684d061b97681c3357"
+    },
     {
       "path": "tests/regrade_eligibility.mjs",
       "mode": "0000644",

package/docs/adr/0022-secrets-policy.md

@@ -1,20 +1,24 @@
 # ADR 0022 — Secrets policy
 
 **Date:** 2026-05-28
-**Context:** Task [#279](https://example.com/builders#/task/279) (V3.R60), GDS-V3 criterion C8. Builds on the pre-commit hook + CI scan shipped by [#257](https://example.com/builders#/task/257) (V3.R36) and pairs with [ADR 0020](<redacted>.md) (security model — public stub) and [ADR 0016](<redacted>.md) (trust boundary). Companion to [`docs/security-baseline.md`](../security-baseline.md) item 6.
+**Context:** Task [#279](https://example.com/builders#/task/279) (V3.R60), GDS-V3 criterion C8. Originally built on a pre-commit hook + CI scan (task [#257](https://example.com/builders#/task/257), V3.R36); those surfaces were lost in the core extraction and rebuilt as the prevent/gate/patrol layers under goal 1000076 (task 1003131). Pairs with [ADR 0020](<redacted>.md) (security model — public stub) and [ADR 0016](<redacted>.md) (trust boundary).
+**Enforcement rebuilt:** 2026-08-19 (task 1003131, goal 1000076) — see the Problem section's box.
 **Status:** Accepted.
 
 ## Problem
 
 A secret committed to a public repo is a credential someone else can use within minutes — even after a force-push to remove it, the value survives in forks, GitHub's commit cache, and any clone made between the commit and the removal. The right model is **defense in depth**: each layer assumes the next one will fail.
 
-We already have parts of this:
+We have defense in depth (rebuilt under goal 1000076 — see the box below):
 
-- Pre-commit hook in `.husky/pre-commit` blocks the obvious shapes locally.
-- `.github/workflows/secrets-scan.yml` re-scans full history in CI on every PR.
-- `.gitignore` lists `.env.local`.
+- **Prevent (agent-side):** `.claude/hooks/secret-gate.js`, a PreToolUse hook, blocks a secret-shaped Write/Edit/Bash payload before it reaches the tree; `.claude/settings.json` denies reading the env/key/session lanes.
+- **Gate (CI):** `.gitleaks.toml` drives a gitleaks scan of the working tree in the required `unit` workflow on every PR.
+- **Patrol (weekly):** `.claude/scheduled-tasks/redteam-weekly` runs a full-git-**history** gitleaks scan and files any hit as a security report.
+- `.gitignore` lists `.env.local` and the key/PEM shapes.
 - Live credentials resolve from `/etc/example/` on the droplet or `~/.config/otb/env` on builder laptops — neither path is tracked.
 
+> **Why this list is now trustworthy — the assurance-of-assurance.** The controls above are not just described here; each has a row in `scripts/gds/control-manifest.js`, a fitness check that reds the merge gate if any control file is deleted or comes unwired (task 1003131). This ADR **used to** name a `.husky/pre-commit` hook, a `.github/workflows/secrets-scan.yml`, and a `docs/security-baseline.md` — **none of which existed in this repo**; they were lost in the core extraction and nothing noticed for releases (the red-team baseline audit's headline finding, [`docs/audits/ai-dev-redteam-baseline.md`](../audits/ai-dev-redteam-baseline.md) §0). A doc describing a control cannot be the assurance; the manifest is.
+
 What's missing — and what this ADR adds — is a written **policy** that defines:
 
 1. What counts as a secret (so the scan can be tuned).
@@ -26,7 +30,7 @@ Without this document, every new builder reinvents the answers. Some answers wil
 
 ## Decision
 
-This ADR is **the policy**. The pre-commit hook + the CI workflow are the **enforcement**. The `docs/security-baseline.md` check is the **assertion that both still exist**. Each layer is independently maintained but consistent with this document.
+This ADR is **the policy**. The prevent hook + the CI gitleaks gate + the weekly patrol are the **enforcement** (goal 1000076). `scripts/gds/control-manifest.js` — a fitness check in the `unit` gate — is the **assertion that they still exist and stay wired**. Each layer is independently maintained but consistent with this document; a change that removes an enforcement surface must update the manifest in the same commit, or CI goes red.
 
 ## What counts as a secret
 
@@ -86,11 +90,11 @@ GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use,
 
 ## What to do when the scan finds a hit
 
-If `.husky/pre-commit` blocks a commit, OR `.github/workflows/secrets-scan.yml` fails on a PR, OR a one-off TruffleHog run finds a hit in history, OR `scripts/gds/security-baseline-check.sh` item 6 flips to FAIL:
+If `.claude/hooks/secret-gate.js` blocks a write, OR the gitleaks step in the `unit` workflow fails on a PR, OR the weekly `redteam-weekly` patrol files a history-secrets report, OR `scripts/gds/control-manifest.js` flags a missing control:
 
 1. **Stop**. Do not push, do not merge, do not delete the offending file from the working tree (yet).
 2. **Identify the credential** — what service, what scope, was it ever active in production.
-3. **Rotate the credential first** (steps 1-4 above). Treat the leaked value as compromised even if the scan was a pre-commit catch — the same value may have been pasted into a chat or a sibling file.
+3. **Rotate the credential first** (steps 1-4 above). Treat the leaked value as compromised even if the scan was a prevent-hook catch — the same value may have been pasted into a chat or a sibling file.
 4. **Then** rewrite the offending file (remove the credential) and commit. If the credential was already in pushed history, run `git filter-repo --replace-text <pattern>` to scrub it from every commit. This rewrites SHAs; force-push is required; CI scan re-validates afterward.
 5. **Document** — add an entry to [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) with the date, what happened, and what changed in the response so the next time it goes faster.
 6. **Forks + clones** — the rewrite doesn't reach existing clones. Anyone with an outdated clone gets a `git fetch` warning about non-fast-forward; they re-clone. Forks that mirror via GitHub's mirror feature need a manual `git push --force` from the upstream-aware operator.
@@ -109,16 +113,16 @@ The enforcement above keeps secrets out of the **repo**. A second egress exists:
 
 This scrubber is **transcript-grade** and **recall-first** (task 1003, which also completed the open token-redaction of task 723): a missed secret is a credential compromise, while over-redacting a non-secret in a BFG digest is merely cosmetic, so when in doubt it redacts. Five layers: (1) literal dynamic values — this run's GDS session token + every secret-shaped **env value** (`collectEnvSecrets()`, e.g. the `MAC_*`/`APPLE_*` signing creds, a baked GDS/DO token); (2) multi-line PEM private-key blocks; (3) the in-scope known shapes from this ADR (provider key prefixes, Stripe `sk_`/`rk_`/`whsec_`, our `gds_`/`pms_` tokens, `Authorization`/`Bearer` headers, JWTs, credentialed DSNs, Apple app-specific passwords); (4) recognised-key `key=value` / JSON-field assignments; (5) a **high-entropy catch-all** (`looksHighEntropySecret()`) over base64url/hex runs ≥20 chars — the net for an *unknown* secret shape. The accepted cost of layer 5 is that high-entropy non-secrets (git SHAs, UUIDs, a 40-hex value shape-identical to a GitHub OAuth client secret) are redacted too; the structured BFG metrics that matter (token/turn counts, tool names, error flags) are separate fields and untouched. The planted-secret corpus in `tests/scrubber_corpus.mjs` is the regression gate — every planted secret must be fully redacted, every benign line must survive — and **gates the full-transcript capture task**: capture must not ship until this passes.
 
-This scrubber is now a load-bearing enforcement surface alongside the pre-commit hook + CI scan; a change to the in-scope secret shapes above should update it (and its corpus) too, or the policy and the enforcement will drift.
+This scrubber is now a load-bearing enforcement surface alongside the prevent hook + CI gitleaks gate; a change to the in-scope secret shapes above should update it (and its corpus) too, or the policy and the enforcement will drift.
 
 ## Alternatives considered
 
 - **Use a cloud secrets manager.** Rejected: cost (~$0.40/secret-month at AWS), latency (an extra network hop on cold start), single point of failure (the manager being down blocks deploys). At ~10 secrets and one operator, the filesystem-permissions model is cheaper and not meaningfully less secure.
 - **Encrypt secrets in the repo (SOPS, git-crypt).** Rejected: shifts the problem from "don't commit the secret" to "don't lose the decryption key." The decryption key has to live somewhere; if it lives in the same repo, we've solved nothing; if it lives outside, we've reinvented the current `/etc/example/` model with extra steps.
-- **Skip the pre-commit hook; rely on CI alone.** Rejected: CI catches the leak after the secret has already been pushed to GitHub (where it's now in their cache, even if the PR closes). The pre-commit hook is the fast feedback that prevents the leak from leaving the laptop.
+- **Skip the agent-side prevent hook; rely on CI alone.** Rejected: CI catches the leak after the secret has already been pushed to GitHub (where it's now in their cache, even if the PR closes). The PreToolUse prevent hook is the fast feedback that stops the leak before it ever reaches a commit.
 
 ## Consequences
 
-- New builders go through a one-line orientation: "creds live in /etc/example on the droplet, in ~/.config/otb/env or .env.local on your laptop, nowhere else." If they ask "but what if I want to commit one?" — the hook blocks them; if they push past the hook, CI blocks the merge.
-- The pre-commit hook + CI workflow + security-baseline-check item 6 are now load-bearing. A change to any of them needs to update this ADR too, or the policy and the enforcement will drift.
+- New builders go through a one-line orientation: "creds live in /etc/example on the droplet, in ~/.config/otb/env or .env.local on your laptop, nowhere else." If they ask "but what if I want to commit one?" — the prevent hook blocks the write; if they push past it, the CI gitleaks gate blocks the merge; and anything already in history is caught by the weekly patrol.
+- The prevent hook + CI gitleaks gate + weekly patrol are now load-bearing, and `scripts/gds/control-manifest.js` fails CI if any of them is removed or unwired. A change to any of them needs to update this ADR (and the manifest row) too, or the policy and the enforcement will drift — the exact drift this ADR's own rewrite corrected.
 - Rotation is the operator's responsibility (Lars). The team is informed via the chat broadcast; there is no automatic distribution of new secrets to builder laptops. This is a deliberate accept-the-friction choice — automatic distribution requires a secrets manager.

package/docs/file-map.md

@@ -388,6 +388,7 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
+└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162)
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/handoff-template.md

@@ -89,4 +89,4 @@ This template forces:
 
 ## Old entries
 
-There is **no per-session compaction chore** anymore. CLAUDE.md §13 shows only a generated, bounded recent-sessions snippet (older entries roll off it automatically) and the full history is the generated [`docs/session-log-index.md`](session-log-index.md) — neither is hand-maintained. Trimming very old prose from `docs/session-logs/` into `docs/session-log-archive.md` is optional on-disk housekeeping; it no longer affects the loaded-every-session context cost.
+There is **no per-session compaction chore** anymore. CLAUDE.md §13 shows only a generated, bounded recent-sessions snippet (older entries roll off it automatically) and the full history is the generated `docs/session-log-index.md` — neither is hand-maintained. Trimming very old prose from `docs/session-logs/` into `docs/session-log-archive.md` is optional on-disk housekeeping; it no longer affects the loaded-every-session context cost.

package/docs/recipes/README.md

@@ -17,7 +17,7 @@ A "recipe" is not a limitation (something the project cannot do). It is a multi-
 
 - Architectural decisions → [`docs/adr/`](../../docs/adr/)
 - Things the project cannot do → [`limitations/`](../../limitations/)
-- Things stuck on the prompter's input → [`blockers/`](../../blockers/)
+- Things stuck on the prompter's input → the blockers queue (`POST /api/gds/blockers`, reviewed via `/blocker-review`)
 
 ## Read order while working
 

package/docs/recipes/redteam-patrol.md

@@ -0,0 +1,48 @@
+# The weekly red-team patrol
+
+**What it is.** The patrol layer of goal 1000076 (task 1003128): deterministic
+scanners that run weekly and file findings into the security-reports
+adjudication queue. It complements the two always-on layers — the agent-side
+prevent hooks (task 1003125) and the CI merge gates (tasks 1003126/1003127/1003129)
+— by covering what those can't: **git history**, **the network** (registry
+metadata), and **slow sweeps**.
+
+## Running it
+
+```bash
+node scripts/gds/redteam-patrol.js            # dry run — print, file nothing
+node scripts/gds/redteam-patrol.js --file     # the weekly cron form — files reports
+node scripts/gds/redteam-patrol.js --canary          # self-test detection only
+node scripts/gds/redteam-patrol.js --canary --file   # prove the full pipe (files + dispute-closes)
+```
+
+The scheduled form lives at [`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
+(`mode: deterministic`, one step, sink `gds`). Install on a machine per the
+file-map convention: symlink the routine dir under `~/.claude/scheduled-tasks/`.
+Weekly is the cadence — the checks watch drift measured in days (release-age,
+new advisories), not minutes.
+
+## Prerequisites
+
+- **gitleaks** on PATH (`brew install gitleaks`) or `GITLEAKS_BIN=<path>`. The
+  history scan degrades LOUDLY (a printed warning, no silent skip) when absent;
+  the dependency + pin checks still run.
+- A GDS session (the normal builder token) for `--file`; dry runs need nothing.
+- Network access to the npm registry for the dependency checks — registry
+  failures print notes and skip that item (advisory layer: fail-open, loud).
+
+## What a finding means
+
+Reports land at `target: redteam-patrol/<class>` for Archon adjudication in the
+red-team dashboard — confirm / dispute / link-fix, exactly like a
+`/builder-redteam` filing (they share the pipeline and the bounty table; patrol
+reports are machine-filed, so confirming one pays nobody). The fix is always an
+ordinary task; the patrol never gates and never self-executes (ADR 0162).
+
+## Design boundaries
+
+Deterministic only — AI review was deliberately deferred (owner decision
+2026-08-18, recorded on the goal). One report per finding class per run keeps
+the queue at 0–3 rows weekly. Severity mapping: npm's `moderate` files as
+`medium` (the bounty table's vocabulary). Caps: 10 itemized findings per report
+body, the rest counted.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.257",
+  "version": "1.19.258",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.257",
+      "version": "1.19.258",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.257",
+  "version": "1.19.258",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/control-manifest.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+// scripts/gds/control-manifest.js — the assurance-of-assurance check (task
+// 1003131, goal 1000076; docs/audits/ai-dev-redteam-baseline.md §0).
+//
+// The audit's HEADLINE finding: ADR 0022 named three enforcement controls
+// (a pre-commit secret hook, a secrets-scan CI workflow, a security-baseline
+// doc) that DID NOT EXIST in this repo — they never survived the core
+// extraction, and nothing noticed for releases. A control that can silently
+// stop existing is not a control.
+//
+// This module is the manifest of controls goal 1000076 shipped, plus the
+// predicate each must satisfy. It runs as a fitness check (fitness.js): delete
+// or unwire any control and the merge gate goes red. The manifest is the ONE
+// list — a control added later without a manifest row, or a manifest row whose
+// file is gone, both fail.
+//
+// Predicates are deliberately shallow (existence + one wiring substring), not
+// deep behavior tests — the control's own unit test proves behavior; THIS proves
+// the control is still present and connected. Cheap, hermetic (fs only), and
+// exactly the check whose absence the audit flagged.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const exists = (rel) => fs.existsSync(path.join(ROOT, rel));
+
+// Each control: a file that must exist, and optionally a `wiredIn` (file, needle)
+// proving it is CONNECTED, not just present on disk. `label` names it in failures.
+const CONTROLS = [
+  {
+    label: 'prevent: secret-gate PreToolUse hook',
+    file: '.claude/hooks/secret-gate.js',
+    wiredIn: { file: '.claude/settings.json', needle: 'secret-gate.js' },
+  },
+  {
+    label: 'prevent: settings deny-rules for env/key lanes',
+    file: '.claude/settings.json',
+    wiredIn: { file: '.claude/settings.json', needle: '"deny"' },
+  },
+  {
+    label: 'gate: gitleaks secret scan in the unit workflow',
+    file: '.gitleaks.toml',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: 'gitleaks' },
+  },
+  {
+    label: 'gate: dependency audit gate + baseline',
+    file: 'scripts/gds/audit-gate.js',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: 'audit-gate.js' },
+    alsoExists: ['config/audit-baseline.json'],
+  },
+  {
+    label: 'gate: install-lifecycle scripts disabled',
+    file: '.npmrc',
+    wiredIn: { file: '.npmrc', needle: 'ignore-scripts=true' },
+  },
+  {
+    label: 'gate: quality ratchets registered in fitness',
+    file: 'scripts/gds/fitness-ratchets.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'fitness-ratchets' },
+    alsoExists: ['config/fitness-baselines.json'],
+  },
+  {
+    label: 'gate: knip dead-code ratchet step in the unit workflow',
+    file: 'scripts/gds/fitness-ratchets.js',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: '--knip' },
+  },
+  {
+    label: 'patrol: weekly red-team routine wired to its scanner',
+    file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md',
+    wiredIn: { file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md', needle: 'redteam-patrol.js' },
+    alsoExists: ['scripts/gds/redteam-patrol.js'],
+  },
+];
+
+// Pure evaluation — exported for the test. deps.exists/deps.read override fs.
+function evaluate(controls = CONTROLS, deps = {}) {
+  const ex = deps.exists || exists;
+  const rd = deps.read || read;
+  const missing = [];
+  for (const c of controls) {
+    if (!ex(c.file)) { missing.push(`${c.label}: control file missing (${c.file})`); continue; }
+    for (const extra of c.alsoExists || []) {
+      if (!ex(extra)) missing.push(`${c.label}: companion file missing (${extra})`);
+    }
+    if (c.wiredIn) {
+      let hay = '';
+      try { hay = ex(c.wiredIn.file) ? rd(c.wiredIn.file) : ''; } catch { hay = ''; }
+      if (!hay.includes(c.wiredIn.needle)) {
+        missing.push(`${c.label}: not wired in — "${c.wiredIn.needle}" absent from ${c.wiredIn.file}`);
+      }
+    }
+  }
+  return missing;
+}
+
+// The fitness.js check.
+function checkControlsExist() {
+  const violations = evaluate();
+  return {
+    name: 'controls assert their own existence — goal 1000076 enforcement manifest (task 1003131)',
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: violations.length
+      ? 'a shipped security/quality control disappeared or came unwired — restore it or update control-manifest.js in the same change'
+      : `all ${CONTROLS.length} goal-1000076 controls present and wired (the assurance-of-assurance the ADR 0022 audit found missing)`,
+  };
+}
+
+function main() {
+  const r = checkControlsExist();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkControlsExist, evaluate, CONTROLS };