@bongos/core 1.19.290 → 1.19.291

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.290",
-  "core_contract": "1.19.290",
-  "source_commit": "a983fae1fa7615fda22b12d59ff393255fd81a19",
+  "core_version": "1.19.291",
+  "core_contract": "1.19.291",
+  "source_commit": "c05eeaf6f713e548b9a30460ce153d4388041ebc",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T04:46:05.299Z",
+  "built_at": "2026-08-22T15:00:29.764Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 320,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1731,
-  "tree_sha256": "f3100f6df33ff1d5f9e4da0d536a0cc792b0c7ad9e3c945c87324554b34105db",
+  "tree_sha256": "d46fa302ab0b4aba74a3c947cfc01de0cf9bc482d5fec65df8ea2c518b29153b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2797,7 +2797,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "3b7b24b5ced8eead07e1d758e4c1b59321b0fb0f2108aefefd0e4b73bb7cc78b"
+      "sha256": "7faac7fc48e714c76c2b19feaaf9c730b2c9b10ab71ddc5697c21497d02f10ef"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4522,12 +4522,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e96dcf6ef882c61be154cfcb5d902942a1cad182173d11b63c824fdfb87f9879"
+      "sha256": "7dc929fd01010d29e076564007cdb27b3cfecbf5b2f318f1b045a742d405ab04"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1b86eeccda0d20d4c9b739016bd727f4867fa59de6a9dc5526b24ba5a6c92dd"
+      "sha256": "ccb290e054afd40d91c5058a10cbaae6c3d7c7d18a4afdad65f593825ee1ec4c"
     },
     {
       "path": "public-docs/index.html",
@@ -5437,7 +5437,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "e33e72278f4bb7b96c2e3f9d911ec55838ea96154327b8f98af3b45439d01590"
+      "sha256": "2fe4490f873e02e2ade253ff8e63ec70c555ea08b01ab27856deee8af2eb93dc"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -6172,7 +6172,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6d275b0dea8e96343483360f9429816f5b6b3a754d71e9ae0a3700481a22e0aa"
+      "sha256": "4699911082270a5de6b6692df442c0901c6153e2eef39139fdd2118bd5cb4869"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6792,7 +6792,7 @@
     {
       "path": "tests/cutover_codemod.mjs",
       "mode": "0000644",
-      "sha256": "4555a337ce7d795fbda7e463f4a33774583dd17c8c81af83b928cf0057823427"
+      "sha256": "827dbb19b8be01a5658b3079620ab977af211a7aaf5b7f82a488bb9715d720fb"
     },
     {
       "path": "tests/dead_deps.mjs",
@@ -7872,7 +7872,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "269ebccbc3697af01219f282b91bff138f880054e82eb31fa29ad07800043db0"
+      "sha256": "9bdebe777e63bb2269e528a7ee19194a73610ab9226f59a18fec6fbe18c7a98e"
     },
     {
       "path": "tests/parallel-load.mjs",
@@ -8027,7 +8027,7 @@
     {
       "path": "tests/pruned_lockfile_integrity.mjs",
       "mode": "0000644",
-      "sha256": "a2e29941b5275751d37004bbe01a7123f0d11edcd1d34f5a2ee4079f91cd711a"
+      "sha256": "7c24744feee780786c82ac2ed76779e22ccde35e0c4c7ab5894ca4c4bce4bd90"
     },
     {
       "path": "tests/public_landing_projects.mjs",

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -278,6 +278,8 @@ function createClient(opts = {}) {
       postDiscordChannelsReconcile: (args) => request("POST", "/discord/channels/reconcile", { hasBody: true }, args),
     },
     "doneWhen": {
+      // PATCH /done-when/{criterionId} — rank: metic+archon — PATCH /done-when/:criterionId
+      patchDoneWhenCriterionId: (args) => request("PATCH", "/done-when/{criterionId}", { hasBody: true }, args),
       // POST /done-when/{criterionId}/satisfy — rank: metic+archon — POST /done-when/:criterionId/satisfy
       postDoneWhenCriterionIdSatisfy: (args) => request("POST", "/done-when/{criterionId}/satisfy", { hasBody: true }, args),
       // POST /done-when/{criterionId}/unsatisfy — rank: metic+archon — POST /done-when/:criterionId/unsatisfy
@@ -308,6 +310,8 @@ function createClient(opts = {}) {
       postGoals: (args) => request("POST", "/goals", { hasBody: true }, args),
       // GET /goals/{id} — rank: any-builder — GET /goals/:id
       getGoalsId: (args) => request("GET", "/goals/{id}", { hasBody: false }, args),
+      // PATCH /goals/{id} — rank: any-builder — PATCH /goals/:id
+      patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
       // GET /goals/{id}/conflicts — rank: any-builder — GET /goals/:id/conflicts
@@ -350,6 +354,8 @@ function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
+      getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },
     "government": {
       // GET /government/assignments — rank: archon — GET /government/assignments
@@ -396,6 +402,8 @@ function createClient(opts = {}) {
       getInboxId: (args) => request("GET", "/inbox/{id}", { hasBody: false }, args),
       // PATCH /inbox/{id} — rank: metic+archon — PATCH /inbox/:id
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
+      // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
+      patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/package-lock.json

@@ -1,18 +1,24 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.290",
+  "version": "1.19.291",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.290",
+      "version": "1.19.291",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
         "pg": "^8.20.0"
       }
     },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -32,6 +38,15 @@
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/body-parser": {
       "version": "1.20.5",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
@@ -539,6 +554,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -655,6 +679,43 @@
         "split2": "^4.1.0"
       }
     },
+    "node_modules/pino": {
+      "version": "9.14.0",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",
+      "integrity": "sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==",
+      "license": "MIT",
+      "dependencies": {
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^2.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^3.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-2.0.0.tgz",
+      "integrity": "sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -694,6 +755,22 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/process-warning": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.0.tgz",
+      "integrity": "sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
@@ -722,6 +799,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -746,6 +829,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.13.0"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -766,6 +858,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -895,6 +996,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+      "license": "MIT",
+      "dependencies": {
+        "atomic-sleep": "^1.0.0"
+      }
+    },
     "node_modules/split2": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
@@ -913,6 +1023,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/thread-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-3.2.0.tgz",
+      "integrity": "sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==",
+      "license": "MIT",
+      "dependencies": {
+        "real-require": "^0.2.0"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.290",
+  "version": "1.19.291",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -25,7 +25,8 @@
   },
   "dependencies": {
     "express": "^4.21.2",
-    "pg": "^8.20.0"
+    "pg": "^8.20.0",
+    "pino": "^9.14.0"
   },
   "overrides": {
     "undici": "^6.27.0"

package/scripts/gds/package-core.js

@@ -252,10 +252,13 @@ function isNpmStripped(pathRel) {
 // git) and staged in their place. Everything else still ships through the
 // normal isPublishable()/processCoreFile path.
 //
-// Core deps are express + pg (+ an undici pin) — ADR 0108 §Context. discord.js
-// (+ its undici requirement) is an OPTIONAL MODULE dependency, not core; a
-// consumer that enables the discord module installs it itself.
-const CORE_DEP_NAMES = ['express', 'pg'];
+// Core deps are express + pg + pino (+ an undici pin) — ADR 0108 §Context.
+// pino joined the core boot path with the structured logger (task 1003130:
+// platform-server → serve-internal → routes → middleware/audit → logger); a
+// published core without it crashes MODULE_NOT_FOUND at startup (task 1003160).
+// discord.js (+ its undici requirement) is an OPTIONAL MODULE dependency, not
+// core; a consumer that enables the discord module installs it itself.
+const CORE_DEP_NAMES = ['express', 'pg', 'pino'];
 
 // Pure — takes the source package.json's `dependencies`/`overrides` as plain
 // objects so this is unit-testable with no disk I/O. Throws if a required core

package/src/module-api.js

@@ -1007,8 +1007,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.288 with no explicit bump. run 32549912116. (task 1002620)
 //   1.19.290 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.289 with no explicit bump. run 32552538814. (task 1002620)
+//   1.19.291 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.290 with no explicit bump. run 32580353000. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.290'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.291'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cutover_codemod.mjs

@@ -174,7 +174,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
   const { buildPackageJson } = require('../scripts/gds/package-core.js');
-  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
   }

package/tests/package_core.mjs

@@ -360,15 +360,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -400,7 +400,7 @@ t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / A
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -408,8 +408,8 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg']);
+t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and

package/tests/pruned_lockfile_integrity.mjs

@@ -71,8 +71,8 @@ t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rew
   assert.equal(mismatched.length, 0, `integrity rewritten for: ${mismatched.slice(0, 10).join(', ')}`);
 });
 
-t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg)', () => {
-  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg'));
+t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg + pino)', () => {
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino'));
 });
 
 console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);