@bongos/core 1.19.257 → 1.19.259

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.257",
-  "core_contract": "1.19.257",
-  "source_commit": "89cf609c2e7581b6e48f1783d1f641e8c3993b54",
+  "core_version": "1.19.259",
+  "core_contract": "1.19.259",
+  "source_commit": "c8780bb9be3f75bfac1c6c697c5d8e1d081d8dae",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T02:39:24.112Z",
+  "built_at": "2026-08-19T18:22:02.664Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 316,
+    "docs_redacted": 317,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1350,
+    "functional_verbatim": 1360,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1688,
-  "tree_sha256": "78b0f8d12d8e15a2e9b640ce7aec3ea9cbee0ae53c0da8483946f7c261323434",
+  "file_count": 1699,
+  "tree_sha256": "3cbb76304d7e5e19aa97c2b90a211e4b35bf3e08d882a9684184df0720855449",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -527,7 +527,7 @@
     {
       "path": "docs/adr/0022-secrets-policy.md",
       "mode": "0000644",
-      "sha256": "91cd6dc20c4e605bf1a5f36a1fe374778c6f0904f910ca461f197953634a9927"
+      "sha256": "8ea4766c05c27517d19a9ef7343e4083e71604b22b88ed058071dc82399529bb"
     },
     {
       "path": "docs/adr/0023-kind-multipliers-and-idea-bonus.md",
@@ -1402,7 +1402,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "497b1fbf18ec1cf6d7e0f3620669cfba9008bc6a40e1f70e4b5f53d3406bc12e"
+      "sha256": "193c04262908677d4cdee4c9ba20031ed19220c3886cce8f25f54ea3e615079f"
     },
     {
       "path": "docs/branding-contract.md",
@@ -1532,12 +1532,12 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "fcba56f057bbfa22c5586075fab70ae5559137880ab6886e5f9c990f4801edd7"
+      "sha256": "9762b7f69397c28e103cdb39a9987483e23bd800a827f0d83983b62ef962616b"
     },
     {
       "path": "docs/handoff-template.md",
       "mode": "0000644",
-      "sha256": "79186414c46089e83d18f5c6a17bc569f42e8ceff8321154ae55da5237f25768"
+      "sha256": "a60d85b8523b5944d4db8105b60166395ab9c1f931fb92f0f95a825b657fe277"
     },
     {
       "path": "docs/modules-contract.md",
@@ -1617,7 +1617,7 @@
     {
       "path": "docs/recipes/README.md",
       "mode": "0000644",
-      "sha256": "1abab5aabf19301f3a436082aaeb15b957dee72e662de41ea2624d29dfe6cf9a"
+      "sha256": "bf3caea65a8b8a117d40544fdf352c235bb120a69444645d62b91f999a9b7731"
     },
     {
       "path": "docs/recipes/audit-replay.md",
@@ -1729,6 +1729,11 @@
       "mode": "0000644",
       "sha256": "5bfca9628859f1cdd79d741bdd50f3fe415430ee3380a2ac7f46b97ebe082d0e"
     },
+    {
+      "path": "docs/recipes/redteam-patrol.md",
+      "mode": "0000644",
+      "sha256": "3dbdc33eb1aa68da5e6569e836845f09fd14953d94794e005af67ce517fb6dad"
+    },
     {
       "path": "docs/recipes/search-index-ingestion.md",
       "mode": "0000644",
@@ -2409,6 +2414,11 @@
       "mode": "0000644",
       "sha256": "51d7fc76fdc59a5ab145839aa4943fe7753324022f82e4b4a76c2fe3cab9b98d"
     },
+    {
+      "path": "migrations/core_222_idea_inbox_suggested_goal.sql",
+      "mode": "0000644",
+      "sha256": "9939ee2c641caa8ae4f5055c60e3208a6ed4e379b1bfd1aaa67247a8ed4a4fd8"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -3669,6 +3679,11 @@
       "mode": "0000644",
       "sha256": "3c30ba66b8426d6f304c8135764108f25c4c9aeb8a571347dd7c22ff7a68fad2"
     },
+    {
+      "path": "modules/ideas/migrations/ideas_003_lineage_origin_route.sql",
+      "mode": "0000644",
+      "sha256": "8edeeb0bbf5bac57111008357fc287f8dc14e6907d7bc218264c40633778b9c3"
+    },
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
@@ -4442,12 +4457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8810ea843995b1ca69fb9f14db1a394b00f3cf46b5460a167be62a2b634195b2"
+      "sha256": "df6bf392719f8ba6a0aa64db49a0c29fc65dbc623f6efe0cf0b33e984469803b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "78242b8e21dce2136eded28a2a19b70f2447bf6bdefac4e8cc22ec508569fff8"
+      "sha256": "8afa3a02911351bbae1709a66e204a73ff07c65132c50fad0536246708143aac"
     },
     {
       "path": "public-docs/index.html",
@@ -4969,6 +4984,11 @@
       "mode": "0000644",
       "sha256": "8ca6ee391837d7e1a45e69fc62c4a051f5e3d6060db507cdcbc7a343e2b03bd3"
     },
+    {
+      "path": "scripts/gds/control-manifest.js",
+      "mode": "0000644",
+      "sha256": "0d5b0c5e4bc15ff914d34849607ad2f01d1843d4dafeafdaf4191c2f365300bb"
+    },
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
@@ -5079,10 +5099,15 @@
       "mode": "0000644",
       "sha256": "7a7721155c8c7cb169a48e6f279e5d7c0ba0dc4462678a4a2ec41a2686501962"
     },
+    {
+      "path": "scripts/gds/fitness-ratchets.js",
+      "mode": "0000644",
+      "sha256": "a27a3873f516abdc52f7f482603779010bbc1af4d6e73c0b86dd34292017bc9a"
+    },
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "add1ee5439ef3ddff171e7eb9a695c63a41b8323c5e8cc6c415b620b812bdfa8"
+      "sha256": "81b35af96345cfdca3f30a9d4f333715c4dd431657a9aa73b5794c02ef75686f"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5152,7 +5177,7 @@
     {
       "path": "scripts/gds/gen-session-index.js",
       "mode": "0000644",
-      "sha256": "c7bdbd7f7a4d2647be17ad37b540afc35913db80d121000346256d57c065f9fa"
+      "sha256": "9b936143ae25442fefb52b98949bc33d245d4b3894d778c51926e9da75c92357"
     },
     {
       "path": "scripts/gds/git-merge-regen.js",
@@ -5409,6 +5434,11 @@
       "mode": "0000644",
       "sha256": "564996b820fa09ccb95bcef2e5a1b57f22e5b16c4e54b67dfe1a2cd37ff716a4"
     },
+    {
+      "path": "scripts/gds/redteam-patrol.js",
+      "mode": "0000644",
+      "sha256": "4e4ce11a67de653550851d9e0b9931253c8b100dd4285f2a39c74ba2f932b23c"
+    },
     {
       "path": "scripts/gds/regen-instance-docs.js",
       "mode": "0000644",
@@ -5879,6 +5909,11 @@
       "mode": "0000644",
       "sha256": "a932e617ee66dabc49b4087baf6606eeb2074f70ebb3efa0723b1d9c92add290"
     },
+    {
+      "path": "src/bongos/logger.js",
+      "mode": "0000644",
+      "sha256": "08a48a47445606c22c1fb5f1e709de5106693eb8b774466186fb5e30352841e8"
+    },
     {
       "path": "src/bongos/metrics.js",
       "mode": "0000644",
@@ -5887,12 +5922,12 @@
     {
       "path": "src/bongos/middleware/audit.js",
       "mode": "0000644",
-      "sha256": "1b260403bdf9f660027a30f316be3246cd833439938216c189033c8e9b3573fa"
+      "sha256": "ad2d224b01bba5ce747f8e3ab8704cbbbd67b1bfb6f4d1237bc910e91f7e4287"
     },
     {
       "path": "src/bongos/middleware/error-envelope.js",
       "mode": "0000644",
-      "sha256": "9a0b9c5212607285b09b5139baa665dcac534e915e9e51aa5644f42efbc8ef9b"
+      "sha256": "920897ba69d929ab5b77bac1605c67d78805ebbbf962d59fec5bdc8b293bd67a"
     },
     {
       "path": "src/bongos/middleware/rate-limit.js",
@@ -5902,7 +5937,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "e8a6050abfd191b0afd79c1b4990d4d0ad0a1836f8f83bf31823ec46a4ab14c8"
+      "sha256": "c3b5499005ae5150d1e3288437dbfd422e28068a28e3c5783a8c4b3fa2edd09c"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -6037,7 +6072,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "785c83fa3bb4a12ea33b528d70e030cffd44fb3ffaecbdb90f7c558621118f3e"
+      "sha256": "2ce782b00c80482ef9b9d3e4a54a634e73c6d956e13e32cc7e3d2ff63e8282cd"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -6072,7 +6107,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c56a890ac70423925ba2b32d431db24ee9d88ff2f0dc484ff6057d5e18862849"
+      "sha256": "c00527049537e4f63e7c3d70446ebb20ba7e760fa77bb200aa26f3e2de6b22f2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6112,7 +6147,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "9567d70acc5150dbdd0f6ea1df996977f2566c8c577bd6c9d0ca05516163dc1b"
+      "sha256": "704f68cdafb697138b9e012defedeb827dee3ff97191c78bf0e86be0ae5d61cf"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -6282,7 +6317,7 @@
     {
       "path": "tests/auth_resolve_failure.mjs",
       "mode": "0000644",
-      "sha256": "25271ff1abef5600fab6b9d768c0f94965ffdea4d926b6a60344676f5392f9f1"
+      "sha256": "d14529c53ddf42f69c40fd49dc6eb230df4a519e9bc2bfdfab04df277e3dbb9c"
     },
     {
       "path": "tests/auth_session_ttl.mjs",
@@ -6537,7 +6572,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "6d31d8597e3b1e9e7efde56f9a3839715cfa87378e7555f0fa3b26b09346a569"
+      "sha256": "ad3daf4c6cc3a0f56d8d205077c835397b1d112a0219dabb05a7e8b3a8da9492"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -6604,6 +6639,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/control_manifest.mjs",
+      "mode": "0000644",
+      "sha256": "2465159282594723a49d03ed2ca9dbb10e95ddb7af96d145c45f7d7c2a8b8cee"
+    },
     {
       "path": "tests/copy_desk_flags_db.mjs",
       "mode": "0000644",
@@ -6889,6 +6929,11 @@
       "mode": "0000644",
       "sha256": "ebb93b7bdd90c0775f71eb949a6e47022570bdb35c901bd4522413fefa750e14"
     },
+    {
+      "path": "tests/fitness_ratchets.mjs",
+      "mode": "0000644",
+      "sha256": "781bdee0778645704b5179bf99507e839743158714f799e45d6cc64f8fc30477"
+    },
     {
       "path": "tests/fitness_two_root.mjs",
       "mode": "0000644",
@@ -7474,6 +7519,11 @@
       "mode": "0000644",
       "sha256": "a01036699653e810c8eb2e4f8bdabe081095e5634ef6ea4f1e4f85b2b5f56523"
     },
+    {
+      "path": "tests/logger.mjs",
+      "mode": "0000644",
+      "sha256": "88508517d49ad11a01d2dbc97767c4baa6789753ea42afe76699bc2bab5017d4"
+    },
     {
       "path": "tests/main_audit.mjs",
       "mode": "0000644",
@@ -7877,7 +7927,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "1dfca44ba378b69041894371c1a3765eba40edbdec18570d7b67cc849bcb9e8a"
+      "sha256": "c61741aebfad2e85e55f0e734b3195d9474f8dd0c7812c3ee1434b05d088c1de"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -7914,6 +7964,11 @@
       "mode": "0000644",
       "sha256": "6d82e99c69d23a4dd7a844ffdd7f239ea70c94d9c509e2fc8e1a672cd9f05a28"
     },
+    {
+      "path": "tests/redteam_patrol.mjs",
+      "mode": "0000644",
+      "sha256": "bf32ae5c734fc95873433b7c4e251a6b166c167ccc91c4684d061b97681c3357"
+    },
     {
       "path": "tests/regrade_eligibility.mjs",
       "mode": "0000644",

package/docs/adr/0022-secrets-policy.md

@@ -1,20 +1,24 @@
 # ADR 0022 — Secrets policy
 
 **Date:** 2026-05-28
-**Context:** Task [#279](https://example.com/builders#/task/279) (V3.R60), GDS-V3 criterion C8. Builds on the pre-commit hook + CI scan shipped by [#257](https://example.com/builders#/task/257) (V3.R36) and pairs with [ADR 0020](<redacted>.md) (security model — public stub) and [ADR 0016](<redacted>.md) (trust boundary). Companion to [`docs/security-baseline.md`](../security-baseline.md) item 6.
+**Context:** Task [#279](https://example.com/builders#/task/279) (V3.R60), GDS-V3 criterion C8. Originally built on a pre-commit hook + CI scan (task [#257](https://example.com/builders#/task/257), V3.R36); those surfaces were lost in the core extraction and rebuilt as the prevent/gate/patrol layers under goal 1000076 (task 1003131). Pairs with [ADR 0020](<redacted>.md) (security model — public stub) and [ADR 0016](<redacted>.md) (trust boundary).
+**Enforcement rebuilt:** 2026-08-19 (task 1003131, goal 1000076) — see the Problem section's box.
 **Status:** Accepted.
 
 ## Problem
 
 A secret committed to a public repo is a credential someone else can use within minutes — even after a force-push to remove it, the value survives in forks, GitHub's commit cache, and any clone made between the commit and the removal. The right model is **defense in depth**: each layer assumes the next one will fail.
 
-We already have parts of this:
+We have defense in depth (rebuilt under goal 1000076 — see the box below):
 
-- Pre-commit hook in `.husky/pre-commit` blocks the obvious shapes locally.
-- `.github/workflows/secrets-scan.yml` re-scans full history in CI on every PR.
-- `.gitignore` lists `.env.local`.
+- **Prevent (agent-side):** `.claude/hooks/secret-gate.js`, a PreToolUse hook, blocks a secret-shaped Write/Edit/Bash payload before it reaches the tree; `.claude/settings.json` denies reading the env/key/session lanes.
+- **Gate (CI):** `.gitleaks.toml` drives a gitleaks scan of the working tree in the required `unit` workflow on every PR.
+- **Patrol (weekly):** `.claude/scheduled-tasks/redteam-weekly` runs a full-git-**history** gitleaks scan and files any hit as a security report.
+- `.gitignore` lists `.env.local` and the key/PEM shapes.
 - Live credentials resolve from `/etc/example/` on the droplet or `~/.config/otb/env` on builder laptops — neither path is tracked.
 
+> **Why this list is now trustworthy — the assurance-of-assurance.** The controls above are not just described here; each has a row in `scripts/gds/control-manifest.js`, a fitness check that reds the merge gate if any control file is deleted or comes unwired (task 1003131). This ADR **used to** name a `.husky/pre-commit` hook, a `.github/workflows/secrets-scan.yml`, and a `docs/security-baseline.md` — **none of which existed in this repo**; they were lost in the core extraction and nothing noticed for releases (the red-team baseline audit's headline finding, [`docs/audits/ai-dev-redteam-baseline.md`](../audits/ai-dev-redteam-baseline.md) §0). A doc describing a control cannot be the assurance; the manifest is.
+
 What's missing — and what this ADR adds — is a written **policy** that defines:
 
 1. What counts as a secret (so the scan can be tuned).
@@ -26,7 +30,7 @@ Without this document, every new builder reinvents the answers. Some answers wil
 
 ## Decision
 
-This ADR is **the policy**. The pre-commit hook + the CI workflow are the **enforcement**. The `docs/security-baseline.md` check is the **assertion that both still exist**. Each layer is independently maintained but consistent with this document.
+This ADR is **the policy**. The prevent hook + the CI gitleaks gate + the weekly patrol are the **enforcement** (goal 1000076). `scripts/gds/control-manifest.js` — a fitness check in the `unit` gate — is the **assertion that they still exist and stay wired**. Each layer is independently maintained but consistent with this document; a change that removes an enforcement surface must update the manifest in the same commit, or CI goes red.
 
 ## What counts as a secret
 
@@ -86,11 +90,11 @@ GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use,
 
 ## What to do when the scan finds a hit
 
-If `.husky/pre-commit` blocks a commit, OR `.github/workflows/secrets-scan.yml` fails on a PR, OR a one-off TruffleHog run finds a hit in history, OR `scripts/gds/security-baseline-check.sh` item 6 flips to FAIL:
+If `.claude/hooks/secret-gate.js` blocks a write, OR the gitleaks step in the `unit` workflow fails on a PR, OR the weekly `redteam-weekly` patrol files a history-secrets report, OR `scripts/gds/control-manifest.js` flags a missing control:
 
 1. **Stop**. Do not push, do not merge, do not delete the offending file from the working tree (yet).
 2. **Identify the credential** — what service, what scope, was it ever active in production.
-3. **Rotate the credential first** (steps 1-4 above). Treat the leaked value as compromised even if the scan was a pre-commit catch — the same value may have been pasted into a chat or a sibling file.
+3. **Rotate the credential first** (steps 1-4 above). Treat the leaked value as compromised even if the scan was a prevent-hook catch — the same value may have been pasted into a chat or a sibling file.
 4. **Then** rewrite the offending file (remove the credential) and commit. If the credential was already in pushed history, run `git filter-repo --replace-text <pattern>` to scrub it from every commit. This rewrites SHAs; force-push is required; CI scan re-validates afterward.
 5. **Document** — add an entry to [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) with the date, what happened, and what changed in the response so the next time it goes faster.
 6. **Forks + clones** — the rewrite doesn't reach existing clones. Anyone with an outdated clone gets a `git fetch` warning about non-fast-forward; they re-clone. Forks that mirror via GitHub's mirror feature need a manual `git push --force` from the upstream-aware operator.
@@ -109,16 +113,16 @@ The enforcement above keeps secrets out of the **repo**. A second egress exists:
 
 This scrubber is **transcript-grade** and **recall-first** (task 1003, which also completed the open token-redaction of task 723): a missed secret is a credential compromise, while over-redacting a non-secret in a BFG digest is merely cosmetic, so when in doubt it redacts. Five layers: (1) literal dynamic values — this run's GDS session token + every secret-shaped **env value** (`collectEnvSecrets()`, e.g. the `MAC_*`/`APPLE_*` signing creds, a baked GDS/DO token); (2) multi-line PEM private-key blocks; (3) the in-scope known shapes from this ADR (provider key prefixes, Stripe `sk_`/`rk_`/`whsec_`, our `gds_`/`pms_` tokens, `Authorization`/`Bearer` headers, JWTs, credentialed DSNs, Apple app-specific passwords); (4) recognised-key `key=value` / JSON-field assignments; (5) a **high-entropy catch-all** (`looksHighEntropySecret()`) over base64url/hex runs ≥20 chars — the net for an *unknown* secret shape. The accepted cost of layer 5 is that high-entropy non-secrets (git SHAs, UUIDs, a 40-hex value shape-identical to a GitHub OAuth client secret) are redacted too; the structured BFG metrics that matter (token/turn counts, tool names, error flags) are separate fields and untouched. The planted-secret corpus in `tests/scrubber_corpus.mjs` is the regression gate — every planted secret must be fully redacted, every benign line must survive — and **gates the full-transcript capture task**: capture must not ship until this passes.
 
-This scrubber is now a load-bearing enforcement surface alongside the pre-commit hook + CI scan; a change to the in-scope secret shapes above should update it (and its corpus) too, or the policy and the enforcement will drift.
+This scrubber is now a load-bearing enforcement surface alongside the prevent hook + CI gitleaks gate; a change to the in-scope secret shapes above should update it (and its corpus) too, or the policy and the enforcement will drift.
 
 ## Alternatives considered
 
 - **Use a cloud secrets manager.** Rejected: cost (~$0.40/secret-month at AWS), latency (an extra network hop on cold start), single point of failure (the manager being down blocks deploys). At ~10 secrets and one operator, the filesystem-permissions model is cheaper and not meaningfully less secure.
 - **Encrypt secrets in the repo (SOPS, git-crypt).** Rejected: shifts the problem from "don't commit the secret" to "don't lose the decryption key." The decryption key has to live somewhere; if it lives in the same repo, we've solved nothing; if it lives outside, we've reinvented the current `/etc/example/` model with extra steps.
-- **Skip the pre-commit hook; rely on CI alone.** Rejected: CI catches the leak after the secret has already been pushed to GitHub (where it's now in their cache, even if the PR closes). The pre-commit hook is the fast feedback that prevents the leak from leaving the laptop.
+- **Skip the agent-side prevent hook; rely on CI alone.** Rejected: CI catches the leak after the secret has already been pushed to GitHub (where it's now in their cache, even if the PR closes). The PreToolUse prevent hook is the fast feedback that stops the leak before it ever reaches a commit.
 
 ## Consequences
 
-- New builders go through a one-line orientation: "creds live in /etc/example on the droplet, in ~/.config/otb/env or .env.local on your laptop, nowhere else." If they ask "but what if I want to commit one?" — the hook blocks them; if they push past the hook, CI blocks the merge.
-- The pre-commit hook + CI workflow + security-baseline-check item 6 are now load-bearing. A change to any of them needs to update this ADR too, or the policy and the enforcement will drift.
+- New builders go through a one-line orientation: "creds live in /etc/example on the droplet, in ~/.config/otb/env or .env.local on your laptop, nowhere else." If they ask "but what if I want to commit one?" — the prevent hook blocks the write; if they push past it, the CI gitleaks gate blocks the merge; and anything already in history is caught by the weekly patrol.
+- The prevent hook + CI gitleaks gate + weekly patrol are now load-bearing, and `scripts/gds/control-manifest.js` fails CI if any of them is removed or unwired. A change to any of them needs to update this ADR (and the manifest row) too, or the policy and the enforcement will drift — the exact drift this ADR's own rewrite corrected.
 - Rotation is the operator's responsibility (Lars). The team is informed via the chat broadcast; there is no automatic distribution of new secrets to builder laptops. This is a deliberate accept-the-friction choice — automatic distribution requires a secrets manager.

package/docs/architecture.md

@@ -154,7 +154,13 @@ learnings(id, title, body_md, tags text[], related_files text[], captured_by, so
           source_ref, task_id?, created_at)
   indexes: GIN(tags), GIN(related_files), UNIQUE(source, source_ref) WHERE non-null
 idea_inbox(id, title, body_md, kind, suggested_version, suggested_priority, captured_at,
-           captured_by, status 'open'|'promoted'|'discarded'|'merged', promoted_to_task_id, reviewed_at)
+           captured_by, status 'open'|'promoted'|'discarded'|'merged', promoted_to_task_id, reviewed_at,
+           merged_into_idea_id? FK idea_inbox, triage_note?,   -- mig core_195 (task 1002447): what a
+           -- triage VERDICT decided -- which idea a merge folded into, and why a discard happened.
+           -- CHECK (merged_into_idea_id IS NULL OR status = 'merged') -- no merge chains.
+           suggested_goal_id? FK goals ON DELETE SET NULL)  -- mig core_222 (task 1003060, goal 1000071):
+           -- an ADVISORY routing hint for rows that did NOT convert (homeless/soft-landed/Discord).
+           -- The binding home for routed work is tasks.goal_id; nothing may gate on this column.
 done_when_criteria(id, version_id, criterion_id, criterion_md, satisfied bool, satisfied_by_task_id,
                    checked_at, sort_order, UNIQUE(version_id, criterion_id))  -- 13 seeded (V1 + PMS-V2)
 task_criteria(task_id FK tasks, criterion_id FK done_when_criteria, source 'backfill'|'manual'|'planning',

package/docs/file-map.md

@@ -388,6 +388,7 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
+└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162)
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/handoff-template.md

@@ -89,4 +89,4 @@ This template forces:
 
 ## Old entries
 
-There is **no per-session compaction chore** anymore. CLAUDE.md §13 shows only a generated, bounded recent-sessions snippet (older entries roll off it automatically) and the full history is the generated [`docs/session-log-index.md`](session-log-index.md) — neither is hand-maintained. Trimming very old prose from `docs/session-logs/` into `docs/session-log-archive.md` is optional on-disk housekeeping; it no longer affects the loaded-every-session context cost.
+There is **no per-session compaction chore** anymore. CLAUDE.md §13 shows only a generated, bounded recent-sessions snippet (older entries roll off it automatically) and the full history is the generated `docs/session-log-index.md` — neither is hand-maintained. Trimming very old prose from `docs/session-logs/` into `docs/session-log-archive.md` is optional on-disk housekeeping; it no longer affects the loaded-every-session context cost.

package/docs/recipes/README.md

@@ -17,7 +17,7 @@ A "recipe" is not a limitation (something the project cannot do). It is a multi-
 
 - Architectural decisions → [`docs/adr/`](../../docs/adr/)
 - Things the project cannot do → [`limitations/`](../../limitations/)
-- Things stuck on the prompter's input → [`blockers/`](../../blockers/)
+- Things stuck on the prompter's input → the blockers queue (`POST /api/gds/blockers`, reviewed via `/blocker-review`)
 
 ## Read order while working
 

package/docs/recipes/redteam-patrol.md

@@ -0,0 +1,48 @@
+# The weekly red-team patrol
+
+**What it is.** The patrol layer of goal 1000076 (task 1003128): deterministic
+scanners that run weekly and file findings into the security-reports
+adjudication queue. It complements the two always-on layers — the agent-side
+prevent hooks (task 1003125) and the CI merge gates (tasks 1003126/1003127/1003129)
+— by covering what those can't: **git history**, **the network** (registry
+metadata), and **slow sweeps**.
+
+## Running it
+
+```bash
+node scripts/gds/redteam-patrol.js            # dry run — print, file nothing
+node scripts/gds/redteam-patrol.js --file     # the weekly cron form — files reports
+node scripts/gds/redteam-patrol.js --canary          # self-test detection only
+node scripts/gds/redteam-patrol.js --canary --file   # prove the full pipe (files + dispute-closes)
+```
+
+The scheduled form lives at [`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
+(`mode: deterministic`, one step, sink `gds`). Install on a machine per the
+file-map convention: symlink the routine dir under `~/.claude/scheduled-tasks/`.
+Weekly is the cadence — the checks watch drift measured in days (release-age,
+new advisories), not minutes.
+
+## Prerequisites
+
+- **gitleaks** on PATH (`brew install gitleaks`) or `GITLEAKS_BIN=<path>`. The
+  history scan degrades LOUDLY (a printed warning, no silent skip) when absent;
+  the dependency + pin checks still run.
+- A GDS session (the normal builder token) for `--file`; dry runs need nothing.
+- Network access to the npm registry for the dependency checks — registry
+  failures print notes and skip that item (advisory layer: fail-open, loud).
+
+## What a finding means
+
+Reports land at `target: redteam-patrol/<class>` for Archon adjudication in the
+red-team dashboard — confirm / dispute / link-fix, exactly like a
+`/builder-redteam` filing (they share the pipeline and the bounty table; patrol
+reports are machine-filed, so confirming one pays nobody). The fix is always an
+ordinary task; the patrol never gates and never self-executes (ADR 0162).
+
+## Design boundaries
+
+Deterministic only — AI review was deliberately deferred (owner decision
+2026-08-18, recorded on the goal). One report per finding class per run keeps
+the queue at 0–3 rows weekly. Severity mapping: npm's `moderate` files as
+`medium` (the bounty table's vocabulary). Caps: 10 itemized findings per report
+body, the rest counted.

package/migrations/core_222_idea_inbox_suggested_goal.sql

@@ -0,0 +1,57 @@
+-- core_222_idea_inbox_suggested_goal.sql — a routing HINT on an inbox row
+-- (task 1003060, BV1.R02, goal 1000071 "Idea routing").
+--
+-- WHAT THIS IS NOT. This is not where a routed idea's goal lives. When routing
+-- fires, the idea is converted in the same transaction (R01): the idea row goes
+-- status='promoted' with promoted_to_task_id set, and the TASK carries the real
+-- goal_id. The binding home for "which goal does this work belong to" is
+-- tasks.goal_id — always. This column is strictly the ADVISORY leftover for rows
+-- that did NOT convert:
+--   * soft-landed / homeless ideas that stayed in the inbox (no goal at filing),
+--   * Discord #ideas inbound carrying a classifier's guess (R12),
+--   * Full Ideas and criterion-proposals, which never auto-route by design,
+-- so /idea-triage can show "this probably belongs to goal N" instead of making
+-- every triage pass re-derive it. A hint is nullable, overwritable, and load-
+-- bearing for NOTHING — no rank check, no scope wall, and no payout may read it.
+--
+-- WHY CORE, NOT modules/ideas/migrations/. `idea_inbox` is a CORE table. A module
+-- migration may only touch its own <key>_-prefixed objects — fitness.js
+-- checkModuleMigrationsAdditive hard-fails an `ALTER TABLE idea_inbox` from a
+-- module (ADR 0083 §Decision #5). Same reasoning core_195 recorded when it added
+-- merged_into_idea_id: the ideas module owns every QUERY against this table and
+-- none of its schema. The lineage half of R02 — which touches an ideas-OWNED
+-- table — is correctly a module migration (ideas_003).
+--
+-- WHY ON DELETE SET NULL. A hint must never keep a goal alive nor block its
+-- deletion, and a dangling hint is worse than no hint: an archived-then-deleted
+-- goal would otherwise leave triage pointing at a tombstone. RESTRICT would let
+-- an advisory column veto a goal deletion, which inverts the whole point.
+--
+-- Additive, nullable, idempotent (safe to re-run). Forward-safe by construction:
+-- every existing reader SELECTs an explicit column list, so old code on the new
+-- schema neither sees nor needs this (tests/migrations_forward_safe.mjs).
+
+BEGIN;
+
+ALTER TABLE idea_inbox
+  ADD COLUMN IF NOT EXISTS suggested_goal_id bigint REFERENCES goals(id) ON DELETE SET NULL;
+
+-- Triage's homeless-only walk (R13) filters "open ideas that have a hint" and
+-- the reverse "what is pointed at this goal". Partial: the overwhelming majority
+-- of rows are NULL (no hint), so a partial index stays small and still serves
+-- both directions.
+--
+-- NOT CONCURRENTLY, and it cannot be: CREATE INDEX CONCURRENTLY is forbidden
+-- inside a transaction block, and this migration is wrapped BEGIN/COMMIT so the
+-- column and its index land atomically (a half-applied migration is the worse
+-- failure). The plain form takes a brief ACCESS EXCLUSIVE lock on idea_inbox for
+-- the duration of the build. That is acceptable HERE specifically because
+-- idea_inbox is a low-volume human-filing queue — ideas arrive at human pace, not
+-- per-request — so the build is milliseconds against a small table and no write
+-- path of consequence blocks. This reasoning does NOT generalise: a future index
+-- on a write-hot table wants CONCURRENTLY in its OWN transaction-less migration.
+CREATE INDEX IF NOT EXISTS idx_idea_inbox_suggested_goal
+  ON idea_inbox (suggested_goal_id)
+  WHERE suggested_goal_id IS NOT NULL;
+
+COMMIT;

package/modules/ideas/migrations/ideas_003_lineage_origin_route.sql

@@ -0,0 +1,62 @@
+-- ideas_003_lineage_origin_route.sql — 'route' becomes a legal lineage origin
+-- (task 1003060, BV1.R02, goal 1000071 "Idea routing").
+--
+-- WHY. ideas_002 created ideas_task_lineage with origin IN ('promote','develop')
+-- — the two ways a task could descend from an idea when it was written. Routing
+-- adds a THIRD: capture-time promotion, where the idea row and its task are
+-- written in one transaction at filing time (R01) rather than by a later triage
+-- promote. That is genuinely a different provenance and must be distinguishable
+-- in the ledger: 'promote' means a human triaged it, 'route' means the filer
+-- named a goal and the system converted it on the spot. Collapsing the two would
+-- destroy the only signal that tells us how much triage routing actually saved
+-- (C6 triage-shrinks-to-judgment) — and IC4 may want to weigh them differently.
+--
+-- WHY THE WHOLE POINT IS ATTRIBUTION. Discord #bugs is the cautionary tale this
+-- goal exists to fix: it creates tasks DIRECTLY, skipping idea_inbox, so there is
+-- no captured_by and no lineage row — the ideator-credit lane (goal 1000067) has
+-- nothing to ever pay against. Routing must never become a second such bypass, so
+-- every routed task gets a lineage row like any other. This CHECK is what lets it.
+--
+-- WHY THIS IS ADDITIVE DESPITE THE `DROP CONSTRAINT`. Postgres has no "extend a
+-- CHECK" verb; widening an enum-style CHECK is necessarily drop-then-re-add of
+-- the SAME-named constraint. That is additive in EFFECT — the new predicate
+-- permits a strict superset of the old one, so no existing row can be
+-- invalidated and no data is touched. fitness.js recognises exactly this shape
+-- (isConstraintWidening, task 1978): a DROP whose constraint name is re-ADDed in
+-- the same file is exempt from the destructive-DDL rule. The name must therefore
+-- match Postgres's auto-generated name from the ideas_002 inline column CHECK —
+-- ideas_task_lineage_origin_check — or the exemption does not apply and the
+-- constraint silently does not come back. provisioning_003 is the precedent.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: every object here is
+-- ideas_-prefixed, no down-migration, idempotent (safe to re-run).
+
+BEGIN;
+
+ALTER TABLE ideas_task_lineage DROP CONSTRAINT IF EXISTS ideas_task_lineage_origin_check;
+ALTER TABLE ideas_task_lineage ADD CONSTRAINT ideas_task_lineage_origin_check
+  CHECK (origin IN ('promote', 'develop', 'route'));
+
+-- SAFETY NET — did the widening actually take? If ideas_002's inline CHECK ever
+-- carried a name other than Postgres's auto-generated ideas_task_lineage_origin_check,
+-- the DROP above silently no-ops and the ADD installs a SECOND constraint while the
+-- original keeps rejecting 'route' — routing would then fail at runtime, in the one
+-- transaction whose whole job is preserving attribution, with nothing pointing here.
+-- A migration that cannot prove its own effect must not report success. Read-only,
+-- no DDL: it asserts that no surviving CHECK on this table still excludes 'route'.
+DO $$
+DECLARE stale text;
+BEGIN
+  SELECT string_agg(conname, ', ') INTO stale
+    FROM pg_constraint
+   WHERE conrelid = 'ideas_task_lineage'::regclass
+     AND contype  = 'c'
+     AND pg_get_constraintdef(oid) ILIKE '%origin%'
+     AND pg_get_constraintdef(oid) NOT ILIKE '%route%';
+  IF stale IS NOT NULL THEN
+    RAISE EXCEPTION
+      'ideas_003: CHECK constraint(s) % still reject origin=''route'' — the widening did not take (name mismatch with ideas_002). Rename the DROP target to match and re-run.', stale;
+  END IF;
+END $$;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.257",
+  "version": "1.19.259",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.257",
+      "version": "1.19.259",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.257",
+  "version": "1.19.259",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",