@bongos/core 1.19.264 → 1.19.266

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.264",
-  "core_contract": "1.19.264",
-  "source_commit": "bf5cc3668f703f2110626798f6c78e6728d46192",
+  "core_version": "1.19.266",
+  "core_contract": "1.19.266",
+  "source_commit": "d91db4e58ad64674e65d64d611241e88e02188ac",
   "source_ref": "HEAD",
-  "built_at": "2026-08-20T17:10:47.719Z",
+  "built_at": "2026-08-20T17:59:23.193Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1705,
-  "tree_sha256": "355cac3de0571ef24bf2a01412c36cef27c3150840aa9f02b8f672a56e7caceb",
+  "tree_sha256": "22cc9e757ec02b637af6ec28f6d00b5daa91a92f742361641d8921f5ecd27996",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4467,12 +4467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "da4bc7f536408bd310a6793f1a5fe79c8bd34200116f6654a0c44a757a2eb542"
+      "sha256": "6f22594e4af013cef5cb741be874306be308300163055bd00a6c929d48b6de93"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7bd93c3e267ae64b19a7bcbc53f0c34f99e7dc92eb3d09af5692f4ca160d2af"
+      "sha256": "0d77282b3bbfdbff7f582d9a7765a174a8881b18ef150dcbf6d2b640a104069a"
     },
     {
       "path": "public-docs/index.html",
@@ -5062,7 +5062,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "fe57f283f06985234123a46b5ae055f4ecd9df26834cb99e58228a5cb649e0aa"
+      "sha256": "2aba736613cacecbc81b40b813db619eaa83871a8c2aad213ab73869347c7f56"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -5117,7 +5117,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "81b35af96345cfdca3f30a9d4f333715c4dd431657a9aa73b5794c02ef75686f"
+      "sha256": "a5fa6432b70c9b18d39d08837edd17987982a12595c1a55bb44585f9af71628d"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5167,7 +5167,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "569a06e7cb448dab63a3acbcbf9c5366e394252c38edbe477d4d58282a9984c4"
+      "sha256": "d002fe7dd2564dea5965c0801a5d58a61e6d29b3bf6823299177c78612bf492b"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -6117,7 +6117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "87b51e22fba9b2f7b17c0628175b359ad761fb916ee6a1c93887ad473d42f588"
+      "sha256": "c1a2c62a325a9d5516729a15e8bc8939aa05d2c1e25db859a8ec519e04605186"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6937,7 +6937,7 @@
     {
       "path": "tests/fitness.mjs",
       "mode": "0000644",
-      "sha256": "ebb93b7bdd90c0775f71eb949a6e47022570bdb35c901bd4522413fefa750e14"
+      "sha256": "fb9f8fe63f0f9447ab82ba171b718855e4157846ae4a292e907ff895faa892a3"
     },
     {
       "path": "tests/fitness_ratchets.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.264",
+  "version": "1.19.266",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.264",
+      "version": "1.19.266",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.264",
+  "version": "1.19.266",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -153,10 +153,12 @@ async function liveVersions() {
 // 2026-05-30), NOT the seed refs — the V3 renumber (migration 021) made
 // seed-ref R##s diverge from live ids in a couple of places (so a source_ref
 // lookup would be unreliable). On an instance that imported the origin backlog
-// under new ids they resolve through the IMPORT_ID_OFFSETS probe below. In particular the bounty-AWARDING gate is the
-// "auto-confirmation flow that awards drachmae" task (#286 / live ref R67), not
-// the security-ADR-stub task that the old hand-authored .mmd loosely called
-// "R68" (#287). Each entry documents the piece it drives.
+// under new ids they resolve through the IMPORT_ID_OFFSETS probe below.
+//
+// In particular the bounty-AWARDING gate is the "auto-confirmation flow that
+// awards drachmae" task (#286 / live ref R67), not the security-ADR-stub task
+// that the old hand-authored .mmd loosely called "R68" (#287). Each entry
+// documents the piece it drives.
 const CONCEPTUAL_TASK_IDS = {
   // 04-architecture (the MEMORY layer) — ADR 0024 cloneable-memory chain.
   273: 'R54 — builder_memory store schema',
@@ -184,16 +186,23 @@ const CONCEPTUAL_TASK_IDS = {
 //   897  — the per-builder sandbox live game preview on the box
 //   919  — the scoped dev-box session (box token deny-by-default)
 //   1025 — server-mediated branch publish (box uploads bundle, server pushes)
-//   859  — CI self-deploy (Actions deploys main→droplet; no key on any box)
 //   1027 — hardware-verify of the box→prod flow end-to-end (now SHIPPED)
 //   1028 — replaced the standing push PAT with a GitHub App (now SHIPPED)
+//
+// Every id here MUST drive a piece of the diagram. An id no consumer reads is
+// not merely dead weight: conceptualFacts() below degrades the WHOLE bundle to
+// null the moment any single id is unreachable, so an unused id can silently
+// stop 03 + 04 from regenerating at all (the failure shape task 1002667 fixed
+// for the offset case). Do NOT re-add 859 (CI self-deploy): the deploy leg is
+// the standalone AUTO-PULL of ADR 0108/0129, not a task-gated Actions job, so
+// gen-diagrams.js deliberately excludes it — see its comment at `box → prod`.
+// Removed in task 1002674.
 const DEV_BOX_TASK_IDS = {
   904: 'devbox-app — desktop on-off switch',
   774: 'browser-only box terminal (ttyd over tunnel)',
   897: 'per-builder sandbox live preview',
   919: 'scoped dev-box session (box token deny-by-default)',
   1025: 'server-mediated branch publish (box uploads bundle, server pushes)',
-  859: 'CI self-deploy (Actions deploys main to the droplet)',
   1027: 'hardware-verify the box-to-prod flow end-to-end',
   1028: 'GitHub App hardening (replace the standing push PAT)',
 };

package/scripts/gds/fitness.js

@@ -579,6 +579,23 @@ function discoveredModuleKeys(modulesDir) {
   for (const root of MODULE_ROOTS) for (const k of _moduleKeysIn(path.join(root, 'modules'))) keys.add(k);
   return [...keys];
 }
+// task 1002790: two questions, previously conflated and asserted EQUAL. BROAD
+// (every dir) stays broad — the migration checks need it, since a .sql in a
+// manifest-less dir must still be namespace/stem-checked (schema_migrations is
+// stem-keyed; a collision is silently SKIPPED). NARROW = carries module.json,
+// which is what makes a module a module (ADR 0083) and what kernel-naming means.
+function manifestModuleKeys(modulesDir) {
+  const manifested = (dir) => _moduleKeysIn(dir).filter((k) => fs.existsSync(path.join(dir, k, 'module.json')));
+  if (modulesDir) return manifested(modulesDir);
+  return [...new Set(MODULE_ROOTS.flatMap((r) => manifested(path.join(r, 'modules'))))];
+}
+// The DIFFERENCE as an instruction, not a bare diff — and a WARNING, because a
+// dir without a manifest is the normal transient shape of scaffolding a module.
+function manifestlessModuleDirs(modulesDir) {
+  const narrow = new Set(manifestModuleKeys(modulesDir));
+  return discoveredModuleKeys(modulesDir).filter((k) => !narrow.has(k)).sort().map((k) =>
+    `modules/${k}/ has no module.json — it is a directory, not a module. Add the manifest (ADR 0083) or remove the dir. Warning, not a failure: scaffolding a module dir before its manifest is normal and must not red CI.`);
+}
 // Absolute path to a discovered module's dir, resolving WHICH root holds it (core package or
 // instance repo). Today both roots coincide → the single checkout.
 function moduleDir(key) {
@@ -618,7 +635,7 @@ function scanKernelForModuleKeys(text, keys) {
 }
 
 function checkCoreCarriesNoModuleCode() {
-  const keys = discoveredModuleKeys();
+  const keys = manifestModuleKeys(); // task 1002790 — NARROW: a manifest-less dir is not a module
   const violations = [];
   for (const relFile of KERNEL_FILES) {
     if (KERNEL_NAMES_MODULES_OK.has(relFile)) continue; // the registry legitimately names every module
@@ -631,8 +648,8 @@ function checkCoreCarriesNoModuleCode() {
     ok: violations.length === 0,
     hardFail: violations.length > 0,
     violations,
-    warnings: [],
-    note: `kernel machinery (${KERNEL_FILES.length} files) names no discovered module key${keys.length ? ` (keys: ${keys.join(', ')})` : ' (none yet)'} (ADR 0083 §Decision #4).`,
+    warnings: manifestlessModuleDirs(), // task 1002790 — named, and never a hard fail
+    note: `kernel machinery (${KERNEL_FILES.length} files) names no module key${keys.length ? ` (keys: ${keys.join(', ')})` : ' (none yet)'} (ADR 0083 §Decision #4). A key is a modules/ dir carrying module.json; the migration checks deliberately scan every dir (task 1002790).`,
   };
 }
 
@@ -1951,6 +1968,7 @@ module.exports = {
   kernelDomainImport,
   KERNEL_FILES,
   discoveredModuleKeys,
+  manifestModuleKeys, manifestlessModuleDirs, // task 1002790 — narrow defn + the difference
   moduleMigrationViolations,
   moduleNamespace,
   resolvesToModule,

package/scripts/gds/gen-diagrams.js

@@ -589,7 +589,11 @@ const CONCEPTUAL_TARGETS = [
   }
 
   if (changed.length === 0 && !assertChanged) {
-    console.log('gen-diagrams: mechanical diagrams already current — no changes.');
+    // task 1002674: say WHICH set was checked. The old wording claimed only
+    // "mechanical", which reads as "the conceptual pair was skipped" — the
+    // degraded case — even on a fully successful run. Verifying that 03 + 04
+    // actually regenerated then meant reading the source.
+    console.log(`gen-diagrams: all ${TARGETS.length} diagram(s) already current — no changes${f.conceptual ? '' : ' (conceptual pair SKIPPED — see above)'}.`);
     process.exit(0);
   }
 

package/src/module-api.js

@@ -955,8 +955,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
 //   1.19.264 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.263 with no explicit bump. run 32396082154. (task 1002620)
+//   1.19.265 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.264 with no explicit bump. run 32396925426. (task 1002620)
+//   1.19.266 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.265 with no explicit bump. run 32400609982. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.264'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.266'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness.mjs

@@ -2,6 +2,8 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { onDiskModuleKeys } from './helpers.mjs';
@@ -166,7 +168,59 @@ test('core-carries-no-module-code: the live kernel machinery is clean', () => {
   // platform-identity), so it asserted a topology that no longer existed — task 1002470.
   // Derived from an INDEPENDENT readdir of modules/, so a discovery regression in
   // fitness.js still diverges from disk and fails here.
-  assert.deepEqual(fitness.discoveredModuleKeys().sort(), onDiskModuleKeys());
+  //
+  // task 1002790: compare the definition this check ACTUALLY uses. It used to
+  // deepEqual discoveredModuleKeys() (every directory) against onDiskModuleKeys()
+  // (only directories carrying module.json) — two different questions asserted
+  // equal, so any transient dir-without-manifest was a hard CI failure. That is
+  // the normal shape of scaffolding a module, and goal 1000038's own task graph
+  // produced it (1002486 created modules/agents/migrations/ while 1002485 created
+  // the manifest, with no dependency edge): building in graph order red the gate.
+  assert.deepEqual(fitness.manifestModuleKeys().sort(), onDiskModuleKeys());
+});
+
+test('a modules/ dir without a manifest is a NAMED warning, never a hard failure', () => {
+  // The regression this task exists to prevent: mid-scaffold state must not red
+  // CI, and when it is reported the message must say what to do rather than
+  // showing a bare "+ agents" diff.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fitness-modules-'));
+  const modules = path.join(tmp, 'modules');
+  fs.mkdirSync(path.join(modules, 'realmod'), { recursive: true });
+  fs.writeFileSync(path.join(modules, 'realmod', 'module.json'), '{"key":"realmod"}');
+  fs.mkdirSync(path.join(modules, 'scaffolded'), { recursive: true });
+
+  // Broad vs narrow now answer differently, which is the whole point.
+  assert.deepEqual(fitness.discoveredModuleKeys(modules).sort(), ['realmod', 'scaffolded']);
+  assert.deepEqual(fitness.manifestModuleKeys(modules).sort(), ['realmod']);
+
+  const warnings = fitness.manifestlessModuleDirs(modules);
+  assert.equal(warnings.length, 1, 'exactly the manifest-less dir is reported');
+  assert.match(warnings[0], /modules\/scaffolded\//, 'the warning NAMES the offender');
+  assert.match(warnings[0], /no module\.json/, 'and says what is missing');
+  assert.doesNotMatch(warnings[0], /realmod/, 'a real module is not reported');
+
+  // A fully-scaffolded tree reports nothing.
+  fs.writeFileSync(path.join(modules, 'scaffolded', 'module.json'), '{"key":"scaffolded"}');
+  assert.deepEqual(fitness.manifestlessModuleDirs(modules), []);
+});
+
+test('the migration checks keep the BROAD definition — narrowing would lose coverage', () => {
+  // The caution the task called out: a .sql dropped in a manifest-less dir must
+  // still be namespace/stem-checked, because schema_migrations is stem-keyed and
+  // a collision is SILENTLY skipped. So discoveredModuleKeys stays broad, and the
+  // migration checks must still be calling it.
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/fitness.js'), 'utf8');
+  const additive = src.slice(src.indexOf('function checkModuleMigrationsAdditive'));
+  assert.match(
+    additive.slice(0, 600),
+    /discoveredModuleKeys\(\)/,
+    'checkModuleMigrationsAdditive must scan every modules/ dir, not just manifested ones',
+  );
+  // And the kernel-naming check must use the NARROW one (a stray dir with a
+  // common-word name must not be able to red an unrelated check).
+  const kernel = src.slice(src.indexOf('function checkCoreCarriesNoModuleCode'));
+  assert.match(kernel.slice(0, 400), /manifestModuleKeys\(\)/,
+    'checkCoreCarriesNoModuleCode must use the manifest-scoped definition');
 });
 
 test('the discovered-module roster is derived from a NON-EMPTY disk read (mutation check)', () => {