@bongos/core 1.19.264 → 1.19.265

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.264",
-  "core_contract": "1.19.264",
-  "source_commit": "bf5cc3668f703f2110626798f6c78e6728d46192",
+  "core_version": "1.19.265",
+  "core_contract": "1.19.265",
+  "source_commit": "273b4bc62e5af39cd2f8a9b03017b684249b7429",
   "source_ref": "HEAD",
-  "built_at": "2026-08-20T17:10:47.719Z",
+  "built_at": "2026-08-20T17:19:44.827Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1705,
-  "tree_sha256": "355cac3de0571ef24bf2a01412c36cef27c3150840aa9f02b8f672a56e7caceb",
+  "tree_sha256": "a85fe056ad157be858f1419eb6f90b7e6f4ec2c74efbb08eff74e590ad69f691",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4467,12 +4467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "da4bc7f536408bd310a6793f1a5fe79c8bd34200116f6654a0c44a757a2eb542"
+      "sha256": "712a84b80962707ce7da2ee914c67fa5ed7a0032028b71166a31eeda35518733"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7bd93c3e267ae64b19a7bcbc53f0c34f99e7dc92eb3d09af5692f4ca160d2af"
+      "sha256": "512cbdbfc69c237e2620b89d0c424eff4d5175b6ef91bba239c01e3f3714e169"
     },
     {
       "path": "public-docs/index.html",
@@ -5062,7 +5062,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "fe57f283f06985234123a46b5ae055f4ecd9df26834cb99e58228a5cb649e0aa"
+      "sha256": "2aba736613cacecbc81b40b813db619eaa83871a8c2aad213ab73869347c7f56"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -5167,7 +5167,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "569a06e7cb448dab63a3acbcbf9c5366e394252c38edbe477d4d58282a9984c4"
+      "sha256": "d002fe7dd2564dea5965c0801a5d58a61e6d29b3bf6823299177c78612bf492b"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -6117,7 +6117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "87b51e22fba9b2f7b17c0628175b359ad761fb916ee6a1c93887ad473d42f588"
+      "sha256": "f1cba6e04ee2b596f61f0d459bad39496cc7f2ed4276a60fb744174f1328f05b"
     },
     {
       "path": "src/module-loader/catalog.js",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.264",
+  "version": "1.19.265",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.264",
+      "version": "1.19.265",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.264",
+  "version": "1.19.265",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -153,10 +153,12 @@ async function liveVersions() {
 // 2026-05-30), NOT the seed refs — the V3 renumber (migration 021) made
 // seed-ref R##s diverge from live ids in a couple of places (so a source_ref
 // lookup would be unreliable). On an instance that imported the origin backlog
-// under new ids they resolve through the IMPORT_ID_OFFSETS probe below. In particular the bounty-AWARDING gate is the
-// "auto-confirmation flow that awards drachmae" task (#286 / live ref R67), not
-// the security-ADR-stub task that the old hand-authored .mmd loosely called
-// "R68" (#287). Each entry documents the piece it drives.
+// under new ids they resolve through the IMPORT_ID_OFFSETS probe below.
+//
+// In particular the bounty-AWARDING gate is the "auto-confirmation flow that
+// awards drachmae" task (#286 / live ref R67), not the security-ADR-stub task
+// that the old hand-authored .mmd loosely called "R68" (#287). Each entry
+// documents the piece it drives.
 const CONCEPTUAL_TASK_IDS = {
   // 04-architecture (the MEMORY layer) — ADR 0024 cloneable-memory chain.
   273: 'R54 — builder_memory store schema',
@@ -184,16 +186,23 @@ const CONCEPTUAL_TASK_IDS = {
 //   897  — the per-builder sandbox live game preview on the box
 //   919  — the scoped dev-box session (box token deny-by-default)
 //   1025 — server-mediated branch publish (box uploads bundle, server pushes)
-//   859  — CI self-deploy (Actions deploys main→droplet; no key on any box)
 //   1027 — hardware-verify of the box→prod flow end-to-end (now SHIPPED)
 //   1028 — replaced the standing push PAT with a GitHub App (now SHIPPED)
+//
+// Every id here MUST drive a piece of the diagram. An id no consumer reads is
+// not merely dead weight: conceptualFacts() below degrades the WHOLE bundle to
+// null the moment any single id is unreachable, so an unused id can silently
+// stop 03 + 04 from regenerating at all (the failure shape task 1002667 fixed
+// for the offset case). Do NOT re-add 859 (CI self-deploy): the deploy leg is
+// the standalone AUTO-PULL of ADR 0108/0129, not a task-gated Actions job, so
+// gen-diagrams.js deliberately excludes it — see its comment at `box → prod`.
+// Removed in task 1002674.
 const DEV_BOX_TASK_IDS = {
   904: 'devbox-app — desktop on-off switch',
   774: 'browser-only box terminal (ttyd over tunnel)',
   897: 'per-builder sandbox live preview',
   919: 'scoped dev-box session (box token deny-by-default)',
   1025: 'server-mediated branch publish (box uploads bundle, server pushes)',
-  859: 'CI self-deploy (Actions deploys main to the droplet)',
   1027: 'hardware-verify the box-to-prod flow end-to-end',
   1028: 'GitHub App hardening (replace the standing push PAT)',
 };

package/scripts/gds/gen-diagrams.js

@@ -589,7 +589,11 @@ const CONCEPTUAL_TARGETS = [
   }
 
   if (changed.length === 0 && !assertChanged) {
-    console.log('gen-diagrams: mechanical diagrams already current — no changes.');
+    // task 1002674: say WHICH set was checked. The old wording claimed only
+    // "mechanical", which reads as "the conceptual pair was skipped" — the
+    // degraded case — even on a fully successful run. Verifying that 03 + 04
+    // actually regenerated then meant reading the source.
+    console.log(`gen-diagrams: all ${TARGETS.length} diagram(s) already current — no changes${f.conceptual ? '' : ' (conceptual pair SKIPPED — see above)'}.`);
     process.exit(0);
   }
 

package/src/module-api.js

@@ -955,8 +955,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
 //   1.19.264 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.263 with no explicit bump. run 32396082154. (task 1002620)
+//   1.19.265 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.264 with no explicit bump. run 32396925426. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.264'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.265'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');