@bongos/core 1.19.284 → 1.19.285

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.284",
-  "core_contract": "1.19.284",
-  "source_commit": "89eca5541c7cbfd95d598c46ba3a46f3ddc20827",
+  "core_version": "1.19.285",
+  "core_contract": "1.19.285",
+  "source_commit": "81e2e3e6b0bcdad21011218f05f70fd10f3743e4",
   "source_ref": "HEAD",
-  "built_at": "2026-08-21T22:01:22.829Z",
+  "built_at": "2026-08-21T22:12:55.612Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 319,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1723,
-  "tree_sha256": "271e5d408254a1834d4f24731b48a02ae7867dcfa154fbef7e3f1c7a98581bc1",
+  "tree_sha256": "c9778ab2cefac816ecfa4b07061af10f283ac6c42db6bc8b76c7321acc447baa",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/builder-claim/SKILL.md",
       "mode": "0000644",
-      "sha256": "057a5bac75084ea29e5dc3da1cf457089d77c882bfb34936f3c0b37889edc1c3"
+      "sha256": "4e6aeafd02b609df2a7651e11238a1b4c2f45b61f8a8f4122200c530aae81b25"
     },
     {
       "path": ".claude/skills/builder-connect/SKILL.md",
@@ -97,7 +97,7 @@
     {
       "path": ".claude/skills/builder-ship/SKILL.md",
       "mode": "0000644",
-      "sha256": "b21b28bc173431adbaf8c98faec0d32c84808258099a35c346b2cff6612f9f51"
+      "sha256": "d3ef4970dd1d3806dc43cd21a0d66c758cb364b538437ae365542d8ad2be9d96"
     },
     {
       "path": ".claude/skills/builder-stage/SKILL.md",
@@ -3892,7 +3892,7 @@
     {
       "path": "modules/lifecycle/ship-card.js",
       "mode": "0000644",
-      "sha256": "c08ee0e89f67a2db7ea049353a12bdd6e5d97c6a7ec9039d19bdd797f66c112e"
+      "sha256": "2a0485ae7a846e8cb4673873fc1879f7ae354e5375af01f6a30f4bd7e6882f91"
     },
     {
       "path": "modules/lifecycle/ship-preflight.js",
@@ -4507,12 +4507,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d95061f94ca54af0ae3fb5631e87f8df10516b82c5f79c9214adb741ad6b6e02"
+      "sha256": "d9c3039ff1ab07335c611517b4baaf896c77f88b1d5d1ddd72a2c0f62cb6efff"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "958156249f9977ba6e0fa7584290663dc05f01627651b985050c030c42e37b9f"
+      "sha256": "ddea3b764a2952a78e139d4c6d1439a6b1972623ffa166bcc977dcf808e2c606"
     },
     {
       "path": "public-docs/index.html",
@@ -6157,7 +6157,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3408611b1d5426f7cfa78a23db5309455664b4ac644804932e0524b9f29097a5"
+      "sha256": "fa343e5d3af72e2687d2bcf563cb33d1e374f8e36d9a89539831b1cc8cc3f6fa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8332,7 +8332,7 @@
     {
       "path": "tests/ship_card.mjs",
       "mode": "0000644",
-      "sha256": "d326bec65ddabbdfedee525c7adadf6c9e3ed4a46e9f44402c3711705897f97a"
+      "sha256": "9fa0cd147650022ada782721f5a79ca19f9b24810c7ac16b2c11a46b585f0caf"
     },
     {
       "path": "tests/ship_ci_deploy.mjs",

package/.claude/skills/builder-claim/SKILL.md

@@ -50,7 +50,7 @@ The server now **enforces** the one-claim half (task 1642): `POST /api/gds/claim
 
 4. **On success**, relay the claim id, task title, version, priority, credit reward, and the `touches[]` to the user. Treat `touches[]` as an **advisory hint** at the expected blast radius — NOT an editing fence. Code legitimately wanders into files nobody predicted; that is fine and no longer ship-blocking (the grader reads the real committed diff, and `git merge` is the authoritative collision detector). If the claim returned an `overlap_warning`, relay it too — it just means another active claim declares overlapping files; the user self-serializes only if it's genuinely the same code.
 
-   **Render the claimed card (task 1275).** _As of task 1288 the lifecycle-card `PostToolUse` hook (`.claude/hooks/lifecycle-card.js`) reads this card and injects a one-step render directive right after `claim.js` runs — normally just follow that injected directive and render **once**; the detail below is the fallback if no directive appears._ `claim.js` prints the deterministic lifecycle card for the `claimed` stage — a monospace card plus, when the builder has widgets on (the default), an `[otb-card-html] <path>` marker. If that marker is present **and** an in-feed visualization tool is available (e.g. `show_widget`), **Read that file and pass its exact contents** to the tool as `widget_code` (title like `task_<id>_claimed`); it shows the scope (priority / estimate / touches), the brief in its dropdown, and an "Open the work" action routed to the task's discipline session. **Author nothing yourself and don't restate the claim in prose** — the card is the summary. If instead you see an `[otb-card] widgets are off …` line (the builder disabled widgets via Settings → Rendering, task 1279) — or no visualization tool is available — the monospace card already printed IS the summary; relay it as-is and do not call show_widget.
+   **Render the claimed card (task 1275).** _As of task 1288 the lifecycle-card `PostToolUse` hook (`.claude/hooks/lifecycle-card.js`) reads this card and injects a one-step render directive right after `claim.js` runs — normally just follow that injected directive and render **once**; the detail below is the fallback if no directive appears._ `claim.js` prints the deterministic lifecycle card for the `claimed` stage — a monospace card plus, when the builder has widgets on (the default), an `[otb-card-html] <path>` marker. If that marker is present **and** an in-feed visualization tool is available (e.g. `show_widget`), **Read that file and pass its exact contents** to the tool as `widget_code` (title like `task_<id>_claimed`); it shows the scope (priority / estimate / touches), the brief in its dropdown, and an "Open the work" action routed to the task's discipline session. **Author nothing yourself and don't restate the claim in prose** — the card is the summary. If instead you see an `[otb-card] widgets are off …` line (the builder disabled widgets via Settings → Rendering, task 1279) — or no visualization tool is available — the monospace card already printed IS the summary; relay it as-is and do not call show_widget. **One exception, always: relay the `[otb-confirm]` line as text** (task 1001730). `show_widget` reports success whether or not the client actually painted, and CLI stdout is not reliably shown to the user either — so that single line is the only confirmation channel that cannot silently vanish. Verbatim, one line, in addition to the card.
 
 5. **On `ALREADY_CLAIMED`**: another session beat us to it. Run `/builder-start` again to get a fresh list and let the user pick something else.
 

package/.claude/skills/builder-ship/SKILL.md

@@ -65,16 +65,18 @@ The CLI drives a **three-state lifecycle** with a subagent grader between states
    **Never merge a task branch to main before running `ship.js`.** `ship.js` diffs the claim branch against `main`; an already-merged branch yields an empty diff, and the only exits are `--allow-empty` (dead-ends the task at `completed`, requiring an Archon-only confirm) or reverting the merge. Ship from the branch, then let `ship.js` land it. (This trap was hit on tasks 1002417 and 1002419, producing blockers 1000081/1000082 and an ~8.5-hour stall.)
 
 5. **Render the completion card — it IS the summary; do NOT write a prose recap (task 1270).**
-   _As of task 1288 the lifecycle-card `PostToolUse` hook (`.claude/hooks/lifecycle-card.js`) reads this card and injects a one-step render directive right after `ship.js` runs — normally just follow that and render **once**; the detail below is the fallback if no directive appears._
+   _(Task 1288's lifecycle-card `PostToolUse` hook is no longer part of the core — `.claude/hooks/` ships only `secret-gate.js`, verified task 1001730. If an instance installs such a hook and it injects a render directive, follow it and render **once**; otherwise the steps below ARE the procedure, not a fallback.)_
    On every ship, `ship.js` prints ONE deterministic completion card — the same shape every time, only the data changes. It always prints a monospace card to stdout, and for a shipped / confirmed / grade-failed outcome it ALSO writes a branded HTML card to a temp file and prints two marker lines:
    ```
+   [otb-confirm] shipped: task <id> · commit <sha> · credits +N — <title>
    [otb-card-html] /tmp/otb-ship-card-<id>.html
-   [otb-card] builder-ship: render the HTML ... via the visualization tool ...
+   [otb-card] builder-ship: render the HTML ... AND relay this one line as text ...
    ```
-   - If the `[otb-card-html] <path>` line is present **and** an in-feed visualization tool is available (e.g. `show_widget`): **Read that file and pass its exact contents** to the tool as `widget_code` (title like `task_<id>_shipped`). The card renders in the chat feed. **Author nothing yourself** — the HTML is generated, so the card is byte-identical every ship; that determinism is the whole point.
+   - **ALWAYS relay the `[otb-confirm]` line as text in your message** (task 1001730). This is the *guaranteed* confirmation and it is not optional. `show_widget` returns "Content rendered and shown to the user" whether or not the client actually painted the frame — so a widget can silently fail to appear and neither you nor the tool can tell. The owner then gets **no** ship confirmation at all and has to ask "did it land?" (owner, 2026-07-02: *"why didn't it show the shipped card then?"*). One line of text cannot be silently dropped, so it is the floor beneath the card. Relay it verbatim; do not reword or expand it.
+   - If the `[otb-card-html] <path>` line is present **and** an in-feed visualization tool is available (e.g. `show_widget`): **Read that file and pass its exact contents** to the tool as `widget_code` (title like `task_<id>_shipped`), *in addition to* the `[otb-confirm]` line. The card renders in the chat feed. **Author nothing yourself** — the HTML is generated, so the card is byte-identical every ship; that determinism is the whole point.
    - If instead you see an **`[otb-card] widgets are off …`** line (the builder disabled widgets via Settings → Rendering — task 1279), there is no HTML file by design: **relay the monospace card as plain text and do NOT call show_widget.** Don't try to "restore" the widget — the absence is the saving.
-   - If no visualization tool is available at all (headless / cron / a session without it), the **monospace card already printed IS the summary** — stop there.
-   - **Either way: do NOT add a free-form recap** of what shipped, credits, files, cost, or next steps. The card already carries all of it, and its built-in action ("Start next task" / "Land it" / "Fix & re-grade") is the next-step prompt — you don't need to restate it. This replaces the old per-ship prose summary the owner asked us to retire.
+   - If no visualization tool is available at all (headless / cron / a session without it), the **monospace card already printed IS the summary** — relay the `[otb-confirm]` line and stop there.
+   - **Beyond that one line: do NOT add a free-form recap** of what shipped, credits, files, cost, or next steps. The card already carries all of it, and its built-in action ("Start next task" / "Land it" / "Fix & re-grade") is the next-step prompt — you don't need to restate it. This replaces the old per-ship prose summary the owner asked us to retire. (The `[otb-confirm]` line is the deliberate exception, and it is *one line* — that is what keeps the redundancy trivial when the card does paint.)
    - The ONLY thing you may add is a single **required** action the card can't express — e.g. a sandbox `🔍 REVIEW REQUIRED` URL from a review pause (see step 1), or a blocker that needs the owner. One line, then stop.
    - A Hero sound + Discord broadcast may still fire on a milestone (CLAUDE.md §2); that's automatic — no need to narrate it.
 

package/modules/lifecycle/ship-card.js

@@ -577,11 +577,57 @@ function renderCardHtml(model) {
 // and NOT call show_widget.
 //
 // Strictly best-effort — a summary card must never fail or undo a CLI action.
+// task 1001730 — THE GUARANTEED CONFIRMATION. One line, plain text, always
+// emitted, carrying the facts the owner actually asked for ("did it land?"):
+// stage, task id, and the stage's own key facts (commit / credits / grade).
+//
+// WHY a line and not the card: show_widget is best-effort in a direction the
+// agent cannot see. The tool answers "Content rendered and shown to the user"
+// whether or not the client actually painted the frame, so no amount of care on
+// this side can make the WIDGET deterministic. Determinism has to come from a
+// channel that cannot silently drop — the conversation text itself. The card
+// stays the rich confirmation; this line is the floor beneath it.
+//
+// Deliberately ONE line: it is redundant with the card on every successful
+// paint, so it has to be cheap enough that the redundancy costs nothing.
+// Pure + exported so every stage's wording is pinned by a test.
+function confirmLine(model) {
+  const m = model || {};
+  const id = m.taskId != null ? `task ${m.taskId}` : 'task';
+  const word = (m.cfg && m.cfg.statusWord) ? String(m.cfg.statusWord).toLowerCase() : String(m.stage || 'done');
+  // The stage's own rows already hold exactly the facts that stage cares about
+  // (buildCardModel picks them per stage); reuse them rather than re-deriving,
+  // so a new stage fact shows up here for free instead of drifting. The live row
+  // keys are Changed · Grade · Credits · Usage · Deploy — `Deploy` is where the
+  // commit rides ("live · ea509d5"), which is why there is no Commit key to keep.
+  // Usage (token spend) is deliberately dropped: it is not part of "did it land".
+  const keep = ['Changed', 'Grade', 'Credits', 'Deploy', 'Status'];
+  const byKey = new Map((Array.isArray(m.rows) ? m.rows : []).filter((r) => r && r.k).map((r) => [r.k, r.v]));
+  const bits = [];
+  for (const k of keep) {
+    if (!byKey.has(k)) continue;
+    const v = String(byKey.get(k));
+    // Skip the key prefix when the value already says the word ("+38 credits"),
+    // so the line never reads "credits +38 credits".
+    bits.push(v.toLowerCase().includes(k.toLowerCase()) ? v : `${k.toLowerCase()} ${v}`);
+  }
+  const title = m.title ? ` — ${String(m.title).slice(0, 60)}` : '';
+  return `${word}: ${id}${bits.length ? ' · ' + bits.join(' · ') : ''}${title}`;
+}
+
 function emitCard(model, taskId, { log = console.log, widgetsEnabled = true } = {}) {
   try {
     log('');
     log(renderMonospaceCard(model));
   } catch (_) { return null; }
+  // task 1001730: emitted BEFORE the widget branch and on EVERY path, so the
+  // owner has a confirmation even if everything downstream of here fails.
+  let confirm = null;
+  try {
+    confirm = confirmLine(model);
+    log('');
+    log(`[otb-confirm] ${confirm}`);
+  } catch (_) { /* best-effort; never break a CLI action over a summary */ }
   if (!widgetsEnabled) {
     try {
       log('');
@@ -594,7 +640,13 @@ function emitCard(model, taskId, { log = console.log, widgetsEnabled = true } =
     fs.writeFileSync(file, renderCardHtml(model), 'utf8');
     log('');
     log(`[otb-card-html] ${file}`);
-    log('[otb-card] render the HTML at the path above in the chat feed via the visualization tool (show_widget), then stop — no prose recap. If that tool is unavailable, the card above IS the summary.');
+    // task 1001730: the old directive ended "then stop — no prose recap", which
+    // is precisely what made a silent non-paint fatal — the agent was told to
+    // say nothing, so a dropped widget frame left the owner with NO confirmation
+    // at all (owner, 2026-07-02: "why didn't it show the shipped card then?").
+    // Now the [otb-confirm] line above is ALWAYS relayed in text as well. Still
+    // no long recap — one line, so the redundancy is trivial when the card paints.
+    log(`[otb-card] render the HTML at the path above in the chat feed via the visualization tool (show_widget) AND relay this one line as text so the confirmation cannot be lost if the widget does not paint: "${confirm || ''}". No other prose recap. If the tool is unavailable, the card above IS the summary.`);
     return file;
   } catch (_) {
     return null;
@@ -603,6 +655,8 @@ function emitCard(model, taskId, { log = console.log, widgetsEnabled = true } =
 
 module.exports = {
   STAGES, TONE, stageFor, buildCardModel, renderMonospaceCard, renderCardHtml, emitCard,
+  // task 1001730 — the guaranteed one-line confirmation (pure; every stage pinned).
+  confirmLine,
   // exported for unit tests:
   fmtTokens, fmtUsd, fmtInt, fmtMins, nextActionFor, esc, wrap, changedText,
   // task 1003150 — the session-boundary nudge, pure so every branch is pinned.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.284",
+  "version": "1.19.285",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.284",
+      "version": "1.19.285",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.284",
+  "version": "1.19.285",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -995,8 +995,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.282 with no explicit bump. run 32527313879. (task 1002620)
 //   1.19.284 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.283 with no explicit bump. run 32531111199. (task 1002620)
+//   1.19.285 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.284 with no explicit bump. run 32531963073. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.284'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.285'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_card.mjs

@@ -342,5 +342,84 @@ test('html ribbon: confirmed shows shipping bold-current + confirmed checked-don
   assert.match(html, /ti-check[^<]*<\/i> completed<\/span>/);     // a done step, checked
 });
 
+// ---- task 1001730: the GUARANTEED one-line confirmation ----------------------
+// show_widget answers "Content rendered and shown to the user" whether or not the
+// client actually painted, and CLI stdout is not reliably shown to the user
+// either — so neither the widget nor the monospace card is a deterministic
+// confirmation. The [otb-confirm] line, relayed as message text, is the floor.
+// Owner-reported 2026-07-02: a ship whose card silently failed to paint left them
+// asking "did it land?" on work that was already shipped + merged.
+
+test('confirmLine: every stage yields one line naming the stage and the task', () => {
+  for (const stage of ['claimed', 'review', 'confirmed', 'shipped', 'failed']) {
+    const line = card.confirmLine(card.buildCardModel({ ...shippedInput, stage, postGradeStatus: undefined }));
+    assert.ok(!line.includes('\n'), `${stage} must be exactly one line`);
+    assert.match(line, /task 1266/, `${stage} names the task id`);
+    assert.ok(line.length > 10 && line.length < 260, `${stage} stays a glanceable line (got ${line.length})`);
+  }
+});
+
+test('confirmLine: a shipped line carries the facts the owner asks for ("did it land?")', () => {
+  const line = card.confirmLine(card.buildCardModel(shippedInput));
+  assert.match(line, /^shipped: task 1266/, 'leads with the outcome, not chrome');
+  assert.match(line, /deploy live/, 'says it actually deployed — the commit rides in this row');
+  assert.match(line, /credits/, 'carries the credit outcome');
+});
+
+test('confirmLine: never repeats a word already inside the value ("credits +38 credits")', () => {
+  const line = card.confirmLine(card.buildCardModel(shippedInput));
+  assert.ok(!/credits\s+\+?\d[^·]*credits/.test(line), `duplicated key word: ${line}`);
+});
+
+test('confirmLine: token usage is deliberately excluded — it is not part of did-it-land', () => {
+  const line = card.confirmLine(card.buildCardModel(shippedInput));
+  assert.ok(!/usage|\$/i.test(line), `spend must not ride the confirmation line: ${line}`);
+});
+
+test('confirmLine: a failed grade is stated as such, never dressed up as success', () => {
+  const line = card.confirmLine(card.buildCardModel({ ...shippedInput, postGradeStatus: 'completed' }));
+  assert.match(line, /needs fixes/);
+  assert.ok(!/^shipped/.test(line));
+});
+
+test('confirmLine: degenerate input never throws (a summary must not break a CLI action)', () => {
+  assert.equal(typeof card.confirmLine(null), 'string');
+  assert.equal(typeof card.confirmLine({}), 'string');
+  assert.equal(typeof card.confirmLine({ rows: null, taskId: 5 }), 'string');
+});
+
+test('emitCard: ALWAYS emits [otb-confirm] — widgets on, widgets off, and before the widget', () => {
+  const model = card.buildCardModel(shippedInput);
+  for (const widgetsEnabled of [true, false]) {
+    const lines = [];
+    card.emitCard(model, 1266, { log: (s) => lines.push(String(s)), widgetsEnabled });
+    const out = lines.join('\n');
+    assert.match(out, /\[otb-confirm\] shipped: task 1266/, `widgetsEnabled=${widgetsEnabled} must still confirm`);
+    if (widgetsEnabled) {
+      const ci = out.indexOf('[otb-confirm]');
+      const hi = out.indexOf('[otb-card-html]');
+      assert.ok(ci >= 0 && hi >= 0 && ci < hi, 'the confirmation is emitted BEFORE the widget marker, so a later failure cannot lose it');
+    }
+  }
+});
+
+test('emitCard: the widget directive no longer tells the agent to go silent', () => {
+  const lines = [];
+  card.emitCard(card.buildCardModel(shippedInput), 1266, { log: (s) => lines.push(String(s)) });
+  const directive = lines.find((l) => l.startsWith('[otb-card] render'));
+  assert.ok(directive, 'the render directive is still emitted');
+  assert.ok(!/then stop — no prose recap/.test(directive),
+    'THE REGRESSION: "then stop — no prose recap" is what made a silent non-paint leave the owner with nothing');
+  assert.match(directive, /AND relay this one line as text/, 'it now requires the text confirmation too');
+  assert.match(directive, /No other prose recap/, 'while still forbidding a full recap');
+});
+
+test('the ship + claim skills both instruct relaying [otb-confirm]', () => {
+  for (const p of ['../.claude/skills/builder-ship/SKILL.md', '../.claude/skills/builder-claim/SKILL.md']) {
+    const md = fs.readFileSync(new URL(p, import.meta.url), 'utf8');
+    assert.match(md, /otb-confirm/, `${p} must teach the guaranteed line`);
+  }
+});
+
 console.log(`\nship_card: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);