@bongos/core 1.19.315 → 1.19.317

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.315",
-  "core_contract": "1.19.315",
-  "source_commit": "fa29b8da2f1429be8b46153157348ad0893bb702",
+  "core_version": "1.19.317",
+  "core_contract": "1.19.317",
+  "source_commit": "47d557d1d8a73aac8e99002c7a282f7bab39a700",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T21:55:22.014Z",
+  "built_at": "2026-08-23T22:06:51.573Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1421,
+    "functional_verbatim": 1436,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1766,
-  "tree_sha256": "194e6d23ae1dc848c9e95e48b8383a33a401686fe98169758b9084884818966b",
+  "file_count": 1781,
+  "tree_sha256": "1a2430cfe83da4de17388e4663512e1eac2d35a6269e0f124f26e7004d09f0a8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -182,7 +182,7 @@
     {
       "path": ".claude/skills/merge-mode/SKILL.md",
       "mode": "0000644",
-      "sha256": "f6c6b5df321c48bf9c8657145b4b1d7d89a73edf9a9b5f6a511c5339cc828282"
+      "sha256": "a1f797a9267428facc357c59b09d8eafd6b6d8ca36e6d6d7ae0c6bf60c11ab58"
     },
     {
       "path": ".claude/skills/new-project/SKILL.md",
@@ -222,7 +222,7 @@
     {
       "path": ".claude/skills/planning-session/SKILL.md",
       "mode": "0000644",
-      "sha256": "e04564f8189ed7ea1d260f0dbe657cfca769ac46593242721223cd3f0b43c363"
+      "sha256": "f51cb3fec1448883300f5f966dc83f6b9636935059503250ed8a1f944526e743"
     },
     {
       "path": ".claude/skills/priority-session/SKILL.md",
@@ -3824,10 +3824,70 @@
       "mode": "0000644",
       "sha256": "4a4a513ed0759e1e999454e6b6972b921789a5c2a88521755812d97fb6194f83"
     },
+    {
+      "path": "modules/lifecycle/db-analytics.js",
+      "mode": "0000644",
+      "sha256": "b0cb5fb6853d39fd99feaa0b8e3b1040b0877a8476273789dad8976be42070cd"
+    },
+    {
+      "path": "modules/lifecycle/db-claim-reads.js",
+      "mode": "0000644",
+      "sha256": "7aafa6f538811bd29d7f8ce3ebbf59fea72a90fea99de1fdfb6c62124eff23d5"
+    },
+    {
+      "path": "modules/lifecycle/db-claims.js",
+      "mode": "0000644",
+      "sha256": "dbce7de39b91cdd1843ba26efc3f3be76690a7112aaa3b1b0406a9b9f98dfb32"
+    },
+    {
+      "path": "modules/lifecycle/db-deps-criteria.js",
+      "mode": "0000644",
+      "sha256": "b3906a4704be5df9cdfdff9f13e2a18878f93ff7285c42edf25856ec1c4531be"
+    },
+    {
+      "path": "modules/lifecycle/db-goals.js",
+      "mode": "0000644",
+      "sha256": "29b950000d31618de168c6128d9b78c03daad7e68b9a9b6d3e83aa40abd3d9fb"
+    },
+    {
+      "path": "modules/lifecycle/db-grade.js",
+      "mode": "0000644",
+      "sha256": "e6c9a996c11a73847317db47620007c8d21f70b19c73ade4499361c1c0c330f9"
+    },
+    {
+      "path": "modules/lifecycle/db-overrides.js",
+      "mode": "0000644",
+      "sha256": "fa3f251ef2bd0d2caaf49ecc2a250ca65ea7814ee25d606e00c23db0572b23fe"
+    },
+    {
+      "path": "modules/lifecycle/db-rank-authz.js",
+      "mode": "0000644",
+      "sha256": "c93780ea71bb2f8f3d2b21f042c21d029f1ed5336a3aaf178fb3e14925dcc19b"
+    },
+    {
+      "path": "modules/lifecycle/db-shared.js",
+      "mode": "0000644",
+      "sha256": "17a6ddfb4a9415c67dfbd06b052a3a7686df7a55287aa78ff2b55c6a2ca3d954"
+    },
+    {
+      "path": "modules/lifecycle/db-ship.js",
+      "mode": "0000644",
+      "sha256": "0a313d9c20cc0da5952e3a5acbca83cd1fd3df7ecccbbd109701d865b4dd2fe6"
+    },
+    {
+      "path": "modules/lifecycle/db-tasks.js",
+      "mode": "0000644",
+      "sha256": "43748950aee899125bc40b8fb6f26a7df5645746e23fcbe6bbe3ea486f0b7248"
+    },
+    {
+      "path": "modules/lifecycle/db-versions.js",
+      "mode": "0000644",
+      "sha256": "aa98bd22cf237579b065a9a85cb64dda30a0b6b9894ebc5d6ca0592bbb7a977f"
+    },
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "f4d3df748f39109c775ae167712926cd44832aba0651251f508adc4a8d4e57fe"
+      "sha256": "70448ebd079d5167bcf0c9c2b4473d46e996a54202f09f5a8ebc30980aba4166"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -4582,12 +4642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "501134bb188ffffca60077b5b43b4e068e5713ff2c35002380cddad4a86076b4"
+      "sha256": "1bdb7a2ab4583036c92b3108244d5c30dc8aa6314ba28eb2339f3712deec806a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4e8358d26d8d6cdd6c5378b0860ebc58671a75d40ad790bb896000e91f9bd0c7"
+      "sha256": "2bbe8915c29c3f2cde9ef26aa885ddeb123f32caea804ed3146090147fa68a4d"
     },
     {
       "path": "public-docs/index.html",
@@ -5122,7 +5182,7 @@
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
       "mode": "0000644",
-      "sha256": "52daeb629c872ad4f596955257f60d43444db4c91ffa96e6e3752145c92f0fec"
+      "sha256": "55ac5440a1c5481766198d6a89cef601fde816024b592b1e77f535c465a2df47"
     },
     {
       "path": "scripts/gds/cost.js",
@@ -5237,7 +5297,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "71f7b70fb6b7b2251c5a335b90faf0b63b51c614829a247679b6f25209549264"
+      "sha256": "fc4af6845de5bf3775629d492bb793f96cf707dfd9837e338cb2344250f733b5"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5339,6 +5399,11 @@
       "mode": "0000644",
       "sha256": "4bf1e6c352e83a63a4747b892c5f9310dc860f8b2f5fc7c607ed432dcb2dd110"
     },
+    {
+      "path": "scripts/gds/identity-strip.js",
+      "mode": "0000644",
+      "sha256": "a5ac6e41f30fd13738e52800616c2e0e3b1f8150dbb5e3f43e1fdbced5f58fe0"
+    },
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
@@ -5527,12 +5592,12 @@
     {
       "path": "scripts/gds/preflight.js",
       "mode": "0000644",
-      "sha256": "bd57bb676f0ed6c426129a912727c4ecd363a1197373588fe24f4d48727a75dc"
+      "sha256": "9898b6f8e60b9f5ee4aeb9a023d1b68bb5bfbdf589eed10923a8e492716340ed"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "1b1e4ca721a9052206265736712ea17e96b2b724c2926faba49839def36a1818"
+      "sha256": "b445702caa082164d8b733a44be2407f3e3889f28838dfd38222a6a0eb5ec672"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -5804,6 +5869,11 @@
       "mode": "0000644",
       "sha256": "f3005175abc0ba20e958381df6aee02402267e9956da466386656dd4e86ad8cf"
     },
+    {
+      "path": "scripts/gds/skill-preflight.js",
+      "mode": "0000644",
+      "sha256": "2c8297314642a459adb31d4253540fac4a8b3b32a4b79dddd9f0e6cdb87b51fc"
+    },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
       "mode": "0000644",
@@ -6257,7 +6327,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ce9693c479994dbf2f113c783048cd9b3dca8c3cdbc14c655ffdc0f893227eb3"
+      "sha256": "7301568d229fc28265cf1ad41b4d568923cc18d1f7098ef5403c971ed531839a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6487,7 +6557,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "1a5524b0e63631a0ebdc5e3e87c04eb862a9be7021b3b1caf5a44afb2dcb455b"
+      "sha256": "135d0af6b1535e50d68ed62baa36b616ba28888e899940cabf2f2940f3cd6f9d"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
@@ -6897,7 +6967,7 @@
     {
       "path": "tests/dependencies_migration.mjs",
       "mode": "0000644",
-      "sha256": "cd5010d2794a23eac2f84a19d6abc8fc5da75400d023373d289f61cbb08ede2c"
+      "sha256": "daf81be50910d712cdfe10ac2c50578f70dc1d8cf261d435db23a120ec310968"
     },
     {
       "path": "tests/dependencies_polymorphic.mjs",
@@ -7107,7 +7177,7 @@
     {
       "path": "tests/fitness.mjs",
       "mode": "0000644",
-      "sha256": "de84ceb6c73818975d5da77949c8ff4823f6e9d4613d9c95ea21c96a92b66760"
+      "sha256": "465c7ef58342b6e03947858fe34649f5a13a5bcf3658478601baed1e8b2420ef"
     },
     {
       "path": "tests/fitness_ratchets.mjs",
@@ -7187,7 +7257,7 @@
     {
       "path": "tests/goal_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "daf3a5942ce3f154d29618e4242557758db50d8c70046562995fc2c10d5ee954"
+      "sha256": "b9fea609f0dc0aa1c0d05c1794290a65e48996c817a4a435098e91220ade89c1"
     },
     {
       "path": "tests/goal_achievement.mjs",
@@ -7197,7 +7267,7 @@
     {
       "path": "tests/goal_advisory.mjs",
       "mode": "0000644",
-      "sha256": "f5a6985502bc85589d688bf96b3e9242d84efec39d52f5a451e92c23cbb9175c"
+      "sha256": "b9fe4a36c7b60512c71e1d4837e8639381d441c19261007e186cb8c369d5b2c6"
     },
     {
       "path": "tests/goal_cli.mjs",
@@ -7327,7 +7397,7 @@
     {
       "path": "tests/government_claim_eligibility.mjs",
       "mode": "0000644",
-      "sha256": "2750f75bc0ef7f5286a2abe1d59e49ff2ea6ea300d3c1760dda31ae8ad74dc61"
+      "sha256": "7eb103c6a201345728af5002aae1be09c1f3b1459b74bef7ea14e990a28dd05b"
     },
     {
       "path": "tests/government_config.mjs",
@@ -7387,7 +7457,7 @@
     {
       "path": "tests/government_rank_sync.mjs",
       "mode": "0000644",
-      "sha256": "8e430f7286ec798eceaba7db962bb3725c1de2e9cbaeee70739aae6287695d7e"
+      "sha256": "8750d0bbfc33403ff451b780935496a037dbab4a8e30bdc089abde8da8b7400a"
     },
     {
       "path": "tests/government_require_permission.mjs",
@@ -7527,7 +7597,7 @@
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "56321847cf62d27db361b7b4f2511f3573967e3d1b95630f7efd48bad74a7a8f"
+      "sha256": "7a306648d5fd083313126ce98d364e19d130313edf7d37dd23e3767c7e527c8f"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -7842,7 +7912,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "6755c9568cd6cdb7b8600ae2c6651856d63c053684dcb8b765f7329590a9fc08"
+      "sha256": "017770d7639ca5dfb204b613b9ed287fb01c1f768c4f6e0550cc0ac7cad5fb5e"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -8217,12 +8287,12 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "c61741aebfad2e85e55f0e734b3195d9474f8dd0c7812c3ee1434b05d088c1de"
+      "sha256": "09c5e96eadbfd99f26579fbf67b2ccdf39c6c04415a2596e9dbd4644be8d3ebe"
     },
     {
       "path": "tests/rank_gate.mjs",
       "mode": "0000644",
-      "sha256": "2745778ec6ff188a9e65b0a5964f07d5a399aaafdd8854aa962e3cb6728244e6"
+      "sha256": "d8fff57f5fee95bf11a5c1df3e2c0e342d39ef5b22c5e87f47a61dd9a3d2a8cb"
     },
     {
       "path": "tests/rank_tier_single_source.mjs",
@@ -8287,7 +8357,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "a21d9f4d3ff937d59b9361b330a2e5e93ded9c9a12d73434eb843cae9d1a3c74"
+      "sha256": "52f9997d60ce03c60137376dc2bba1940c669617f0ca69fdafd3d90091411df3"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",
@@ -8624,6 +8694,11 @@
       "mode": "0000644",
       "sha256": "4557c934704a009612ed8858c0f59c5b53facb5d92fa2c0740b1aecb079aa5c9"
     },
+    {
+      "path": "tests/skill_preflight.mjs",
+      "mode": "0000644",
+      "sha256": "df2c86d02d560b242a341c905b9ee5fbb25c6479c506736807947749e0a033fa"
+    },
     {
       "path": "tests/skill_prefs.mjs",
       "mode": "0000644",

package/.claude/skills/merge-mode/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: merge-mode
 description: Manual fallback for the auto-merge in /builder-ship. Walks every task at status='confirmed' (= verified but not yet on main) and runs the merge + smoke + deploy chain. Triggers when the user says "/merge-mode", "merge the queue", "land confirmed tasks", "land the queue", "do a merge run", or after a /builder-ship reported the auto-merge bailed.
+requires: [main-checkout, push-credential, gh, droplet-ssh]
 ---
 
 You are running the manual merge-mode session for Example. **`/merge-mode` is a rare last resort, not a routine sweep — and not something to push on other builders.** The server lands merges on its own: `/builder-ship` chains into auto-merge, green PRs auto-merge, a 5-min reconciler flips `confirmed → shipped`, and the [ADR 0082](../../../docs/adr/<redacted>.md) resolver self-heals generated-file conflicts. **Before running this skill, confirm the task is genuinely stuck** — still at `confirmed` more than ~5 minutes after its ship because of a conflict or regression the server couldn't auto-resolve. If you haven't waited for the sweep yet, stop and wait. This skill is for the strand that survives all of that — usually a cross-branch / non-generated-file conflict, a smoke regression, or a `--no-merge` ship.
@@ -17,6 +18,21 @@ The queue this skill works against is **tasks at status='confirmed'**. Those are
 
 ## How to use
 
+**Step 0 — preflight this machine, before anything else.**
+
+```bash
+node scripts/gds/skill-preflight.js merge-mode   # exits 1 naming what is MISSING
+```
+
+If it exits non-zero, **stop**: this machine cannot finish the procedure, and the
+partial run is the dangerous outcome (it mutates the main worktree). The skill's
+`requires:` frontmatter is what it checks — `main-checkout`, `push-credential`,
+`gh`, `droplet-ssh`. This gate exists because the note below was prose only, and
+prose cannot refuse: merge-mode was run on a dev box that had none of them, while
+`ship.js` separately already knew (`strandNextStep` tells a box "/merge-mode is
+NOT available here"). The knowledge existed twice and neither copy stopped the run
+(task 1003167).
+
 > **Environment note:** merge-mode is an **ops procedure** — it mutates the single
 > main worktree and deploys to the Linux droplet (owner-gated SSH). The git /
 > `ssh` / `deploy.sh` / branch-inventory steps below assume a bash environment

package/.claude/skills/planning-session/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: planning-session
 description: Run a structured planning session for an upcoming Bongos version — set scope criteria, draft a written spec, interview the owner in depth to resolve every non-obvious decision, then seed the ranked task list from that spec. Triggers when the user says "/planning-session", "open a planning session", "let's plan V[N]", "plan the next version", or "scope a new version". Metic+ rank only (Metic and Archon; not Xenos).
+requires: [droplet-ssh]
 ---
 
 You are running a planning session for Bongos. The goal is to leave the session with: (a) a clear set of done-when criteria for a version, (b) a **written spec** (`docs/specs/<ver>-<goal-slug>.md`) that an in-depth interview refines until every non-obvious decision is resolved, (c) a ranked task list **seeded from that spec** that lives in the Bongos database, and (d) a durable record of the session for the audit trail.
@@ -193,9 +194,18 @@ a builder-local one (so the bash/`ssh`/`psql` here is server-side by design, not
 a Windows concern):
 
 ```bash
+node scripts/gds/skill-preflight.js planning-session   # stops here if this box has no ssh
 ssh lars@REDACTED_IP "psql -d example -c '\\d tasks' | grep -i check"
 ```
 
+The preflight sits at THIS step rather than at the top of the skill on purpose:
+the `droplet-ssh` this skill declares is needed for one optional lookup, not for
+the whole session, so gating the entire planning session on it would refuse work
+that does not need it. Compare `/merge-mode`, where the capabilities are
+preconditions for the whole procedure and the gate is Step 0. Both placements are
+legitimate; what is not legitimate is declaring a capability and never checking it
+(task 1003167).
+
 Confirm what the `priority` column actually allows.
 
 **Encoding (V3 convention):** priority is `1-5` (CHECK constraint). Use priority by tier: