@bongos/core 1.19.308 → 1.19.310

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.308",
-  "core_contract": "1.19.308",
-  "source_commit": "73400ffdb3672b797a1dda57f589d9cc43da2ed1",
+  "core_version": "1.19.310",
+  "core_contract": "1.19.310",
+  "source_commit": "5b818fdd0299678fb8ba3d222dd9f916281057ea",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T20:30:08.216Z",
+  "built_at": "2026-08-23T20:40:41.952Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 322,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1764,
-  "tree_sha256": "bfea309c25b9ba974096b8f0572e268ea80238aaf00e23d700adeb9e58458d49",
+  "tree_sha256": "a15e680234e3ff733027b28fadc46849add8160eec5afcf7b7c3d5dc2509a9fb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1417,12 +1417,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d545aada2bc0127be904c5df12c393c3ab8756f84ef86cc7bcee1348074769f9"
+      "sha256": "a654d9def4780d3210c66031193198f58fd0d7d84f5088c4ce7e6d0a58682193"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "828558b3bd6cc8d7c9c720eef962e098e4f886ab33360833b2c6d3946acbd1d1"
+      "sha256": "e0b531f19187a3c00a54917bff4e2827a75b250f1aaa761229660a974a4f6217"
     },
     {
       "path": "docs/architecture.md",
@@ -3777,7 +3777,7 @@
     {
       "path": "modules/ideas/routes/blockers.js",
       "mode": "0000644",
-      "sha256": "7c61821b9ddf9a9255f6a9916659140881a6436dbd50f3d53b4cf818640a39a4"
+      "sha256": "2247bb4499e6296fca8ccde3614b6726a50435786fc3cf634eaacd35982ef3f4"
     },
     {
       "path": "modules/ideas/routes/inbox.js",
@@ -3927,7 +3927,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "7fb4a74237c1f84a5c20591663e634a7b190861e6a3f1c5804e22145ef58f6be"
+      "sha256": "73dee3ef1546bf873a27bac8a160c8de64a6dbb5d0da6f3b68648d3a90e07d21"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -4577,12 +4577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4293f77940579b7c64fa5bc09f5a132c27efb5e4d21ee37a29ee3cf08d60ad88"
+      "sha256": "0d120722614fdddf98aa543303d1c1fada639e93da07d75b87fdf257e59ae098"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "254eba7acbbc7ba707abfe41dd50f8e83880cf8f93cbe5daff2c88cf02dd46f1"
+      "sha256": "8c05cbebb968c9d858ee8ca77cb58282f6a64c876096a11cc772aa08f330d2a6"
     },
     {
       "path": "public-docs/index.html",
@@ -5067,7 +5067,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "e2d6f177e1ee5eda21b5d8711145b7de79b41a9f8dc1a1b9e2836dde2f1c0143"
+      "sha256": "a044b7ea705a87e569f903eb4fb19c941a1fbfd11b069563a2bc767be339d184"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -6162,7 +6162,7 @@
     {
       "path": "src/bongos/routes/healthz.js",
       "mode": "0000644",
-      "sha256": "da50a75349d36f7fee03c00b5f89697cf97fba91d4778fe304257d29470fedb5"
+      "sha256": "26f4992c484d2fc5882131c695c4173db950e4c815424fad68385bfa64fa7ab8"
     },
     {
       "path": "src/bongos/routes/instance.js",
@@ -6197,7 +6197,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "fbfc3422f111e6d3f1429cefec78741d4a919c89985bc9d69f0a7a8e070c52b5"
+      "sha256": "295b4bafc8a7bf832ed33fb0d35f4487a788caaff994383cda451cc24de2c6c7"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -6252,7 +6252,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "87cec9eba20525297a298914c20d89882db138f0cdbc5c1ae4a5ce3d285147db"
+      "sha256": "6d3b31b887cd58a7f28d9050d4f31da50bc0b82146921a175665397a6f36cc7f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6727,7 +6727,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "ad3daf4c6cc3a0f56d8d205077c835397b1d112a0219dabb05a7e8b3a8da9492"
+      "sha256": "5ca8997f238d8395663992c9ce9ccef08ea2b09fbee6735c44f119050ef9455b"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",

package/docs/api/openapi.json

@@ -1269,7 +1269,7 @@
           "blockers"
         ],
         "summary": "GET /blockers",
-        "description": "List currently-open blockers + the tasks each is blocking. Public: anyone landing on /builders or status.amazonprimea.com can see what's stuck on Lars. rank: public — open blocker list; documented \"Public: anyone landing on /builders or status.amazonprimea.com can see what's stuck on Lars\" in the handler comment above.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "List currently-open blockers + the tasks each is blocking. Public: anyone landing on /builders or the status dashboard (status.<apex>) can see what's stuck on the owner. rank: public — open blocker list; documented \"Public: anyone landing on /builders or the status dashboard can see what's stuck on the owner\" in the handler comment above.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/ideas/routes/blockers.js",
         "responses": {
@@ -6167,7 +6167,7 @@
           "healthz"
         ],
         "summary": "GET /healthz",
-        "description": "liveness probe; status.amazonprimea.com hits this anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "liveness probe; the status dashboard (status.<apex>) hits this anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/healthz.js",
         "responses": {
@@ -10623,7 +10623,7 @@
           "public"
         ],
         "summary": "GET /public/tasks/:id",
-        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.<apex>/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "parameters": [
@@ -10693,7 +10693,7 @@
           "public"
         ],
         "summary": "GET /public/versions",
-        "description": "read-only surface for status.amazonprimea.com.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "read-only surface for the status dashboard (status.<apex>).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -13471,7 +13471,7 @@
           "versions"
         ],
         "summary": "GET /versions/:id/done-when",
-        "description": "Public: status.amazonprimea.com fetches this every 60s alongside other public/* surfaces. No auth, same Cache-Control posture as the other status feeds. rank: public — status.amazonprimea.com fetches every 60s anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Public: the status dashboard (status.<apex>) fetches this every 60s alongside other public/* surfaces. No auth, same Cache-Control posture as the other status feeds. rank: public — the status dashboard (status.<apex>) fetches every 60s anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "parameters": [

package/docs/api-reference.md

@@ -256,7 +256,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
+| GET | `/api/bongos/healthz` | `public` | — | liveness probe; the status dashboard (status.<apex>) hits this anonymously. |
 
 ## `inbox` (14)
 
@@ -439,7 +439,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/public/repo-info` | `public` | — | GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). |
 | GET | `/api/bongos/public/tasks/:id` | `public` | — | Single-task resolver for "#NNN" deep links. |
 | GET | `/api/bongos/public/uptime` | `public` | — | Uptime: current status + 90-day history bucketed by hour. |
-| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for status.example.com. |
+| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for the status dashboard (status.<apex>). |
 
 ## `scouting` (1)
 
@@ -536,7 +536,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/versions` | `public` | — | read-only version list; mirrors /public/versions. |
 | POST | `/api/bongos/versions` | `metic+archon` | `id`, `name`, `status`, `track`, `done_when`, `scope_doc_path`, `criteria` | POST /versions — create a version + its done-when criteria in one call. |
-| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: status.example.com fetches this every 60s alongside other public/* surfaces. |
+| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: the status dashboard (status.<apex>) fetches this every 60s alongside other public/* surfaces. |
 | POST | `/api/bongos/versions/:id/done-when` | `metic+archon` | `criterion_id`, `criterion_md`, `goal_id`, `sort_order` | Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. |
 | GET | `/api/bongos/versions/:id/progress` | `public` | — | Per-criterion progress rollup: each done-when criterion → the tasks that gate it (task_criteria, migration 055) → live statuses → what re… |
 | GET | `/api/bongos/versions/close-suggestions` | `public` | — | Close-flow gate suggestions for every version still 'building'. |

package/modules/ideas/routes/blockers.js

@@ -10,10 +10,10 @@ module.exports = function buildBlockersRouter() {
   const router = express.Router();
 
   // List currently-open blockers + the tasks each is blocking.
-  // Public: anyone landing on /builders or status.amazonprimea.com can see
-  // what's stuck on Lars.
+  // Public: anyone landing on /builders or the status dashboard (status.<apex>)
+  // can see what's stuck on the owner.
   // rank: public — open blocker list; documented "Public: anyone landing on /builders
-  // or status.amazonprimea.com can see what's stuck on Lars" in the handler comment above.
+  // or the status dashboard can see what's stuck on the owner" in the handler comment above.
   router.get('/blockers', async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): the open-blocker list is public + grows with the

package/modules/lifecycle/routes/done-when.js

@@ -80,10 +80,10 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
 module.exports = function buildDoneWhenRouter() {
   const router = express.Router();
 
-  // Public: status.amazonprimea.com fetches this every 60s alongside other
-  // public/* surfaces. No auth, same Cache-Control posture as the other
+  // Public: the status dashboard (status.<apex>) fetches this every 60s alongside
+  // other public/* surfaces. No auth, same Cache-Control posture as the other
   // status feeds.
-  // rank: public — status.amazonprimea.com fetches every 60s anonymously.
+  // rank: public — the status dashboard (status.<apex>) fetches every 60s anonymously.
   router.get('/versions/:id/done-when', asyncHandler('GET /versions/:id/done-when', async (req, res) => {
     const versionId = String(req.params.id || '').trim();
     if (!versionId) return res.fail('version_id_required', 400);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.308",
+  "version": "1.19.310",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.308",
+      "version": "1.19.310",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.308",
+  "version": "1.19.310",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -82,6 +82,13 @@ function hostOf(origin) { try { return new URL(String(origin)).host || null; } c
 // instance-config uses, so nothing here is ever a founder literal (R76-safe).
 function effConfigDir(b) { return (b && b.configDir) || ic.FALLBACK_DIR; }
 function effEnvPrefix(b) { return (b && b.envPrefix) || ic.FALLBACK_ENV_PREFIX; }
+// The brand token outbound User-Agents are built from, mirroring src/branding.js
+// userAgent(): repo name, else env prefix, lowercased. Kept in sync by the
+// tests/claude_materialize.mjs UA-rule case + tests/hook_user_agents.mjs.
+function effUaBase(b) {
+  const base = (b && b.repo && b.repo.name) || (b && b.envPrefix) || '';
+  return String(base).toLowerCase();
+}
 
 // Ordered source→target rebrand rules from two branding objects. PURE + exported.
 function buildRebrandRules(from = {}, to = {}) {
@@ -109,6 +116,15 @@ function buildRebrandRules(from = {}, to = {}) {
   add(`[${fc}]`, `[${tc}]`);
   // The instance env-var prefix (e.g. OTB_ → CLOUDBONGOS_), bounded by its underscore.
   add(`${effEnvPrefix(from)}_`, `${effEnvPrefix(to)}_`);
+  // task 1002672: the bare User-Agent brand token (e.g. `amazonprimea-gds-cli/1.0`
+  // in a hook's outbound fetch). It carries no TLD, so none of the HOST rules above
+  // ever matched it and a founder-branded UA leaked into every materialized
+  // instance verbatim. Bounded by the `-gds` suffix (the userAgent() convention)
+  // so a bare founder word in prose is NOT rewritten — only the UA token shape.
+  // Both bases must resolve: an empty side would degenerate into a bare `-gds`
+  // rule that rewrites every occurrence of the suffix itself.
+  const fromUa = effUaBase(from), toUa = effUaBase(to);
+  if (fromUa && toUa) add(`${fromUa}-gds`, `${toUa}-gds`);
   // Longest literal first so a full host is replaced before any bare token inside it.
   rules.sort((x, y) => y.pattern.source.length - x.pattern.source.length);
   return rules;

package/src/bongos/routes/healthz.js

@@ -4,7 +4,7 @@ const auth = require('../auth');
 module.exports = function buildHealthzRouter() {
   const router = express.Router();
 
-  // rank: public — liveness probe; status.amazonprimea.com hits this anonymously.
+  // rank: public — liveness probe; the status dashboard (status.<apex>) hits this anonymously.
   router.get('/healthz', async (_req, res) => {
     res.json({
       ok: true,

package/src/bongos/routes/public.js

@@ -140,7 +140,7 @@ module.exports = function buildPublicRouter() {
     res.json(clientModules());
   });
 
-  // rank: public — read-only surface for status.amazonprimea.com.
+  // rank: public — read-only surface for the status dashboard (status.<apex>).
   router.get('/public/versions', async (req, res) => {
     // R14 (#2001 / ADR 0119): adopt the shared pagination contract (was unbounded).
     // Small list → fetch + slice; `page` is additive (readers of .versions unchanged).
@@ -378,7 +378,7 @@ module.exports = function buildPublicRouter() {
   // Single-task resolver for "#NNN" deep links. Our docs reference GDS task IDs
   // as bare "#NNN"; read on github.com those collide with GitHub's own PR/issue
   // autolinker (a separate number space) and mis-link, so they are rewritten to
-  // status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve
+  // status-dashboard permalinks (status.<apex>/#/task/N) that resolve
   // here. Privacy gate: a full title/summary is exposed ONLY for
   // already-public work (status shipped|confirmed — same surface as
   // /public/recent-shipped). In-flight tasks return status + version with the

package/src/module-api.js

@@ -1043,8 +1043,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.306 with no explicit bump. run 32663876767. (task 1002620)
 //   1.19.308 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.307 with no explicit bump. run 32664559221. (task 1002620)
+//   1.19.309 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.308 with no explicit bump. run 32664868080. (task 1002620)
+//   1.19.310 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.309 with no explicit bump. run 32665109518. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.308'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.310'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -200,6 +200,25 @@ t('buildRebrandRules: partial target (only publicOrigin) → subdomains fall bac
   assert.equal(out, 'acme.example.org', 'no builders.acme.example.org mangling');
 });
 
+// task 1002672: the bare UA brand token (no TLD — none of the host rules match it).
+// A founder-branded hook UA like `amazonprimea-gds-cli/1.0` must neutralize on
+// materialize; a bare founder word in prose (no `-gds` suffix) must NOT be touched.
+t('buildRebrandRules: User-Agent brand token rewritten; bare brand word in prose untouched', () => {
+  const from = { ...OTB, repo: { name: 'amazonprimea' } };
+  const to = { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME', repo: { name: 'acme-city' } };
+  const rules = m.buildRebrandRules(from, to);
+  assert.equal(m.rebrandText(`'User-Agent': 'amazonprimea-gds-cli/1.0'`, rules), `'User-Agent': 'acme-city-gds-cli/1.0'`);
+  assert.equal(m.rebrandText('amazonprimea-gds/1.0', rules), 'acme-city-gds/1.0');
+  assert.equal(m.rebrandText('the amazonprimea style guide', rules), 'the amazonprimea style guide', 'prose token without -gds suffix stays');
+  // envPrefix fallback when repo.name is absent on either side.
+  const rules2 = m.buildRebrandRules(OTB, { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME' });
+  assert.equal(m.rebrandText('otb-gds-cli/1.0', rules2), 'acme-gds-cli/1.0');
+  // No degenerate bare `-gds` rule when a side resolves to nothing.
+  const rules3 = m.buildRebrandRules({ domains: {} }, { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME' });
+  assert.ok(!rules3.some((r) => r.pattern.source === '-gds'), 'no bare -gds rule');
+  assert.equal(m.rebrandText('plain-gds/1.0 text', m.buildRebrandRules({}, {})), 'plain-gds/1.0 text');
+});
+
 t('buildRebrandRules: source === target is an empty ruleset → rebrandText is a no-op', () => {
   assert.equal(m.buildRebrandRules(OTB, OTB).length, 0);
   const s = 'https://amazonprimea.com ~/.config/otb';