@bongos/core 1.19.320 → 1.19.321

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.320",
-  "core_contract": "1.19.320",
-  "source_commit": "add665ea5d3565d67ff3ef951b724cae1b7e2ca7",
+  "core_version": "1.19.321",
+  "core_contract": "1.19.321",
+  "source_commit": "242735e2b39608c5500b8c5bd231832a90c5fae7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T00:55:40.560Z",
+  "built_at": "2026-08-24T01:17:55.486Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1800,
-  "tree_sha256": "e31137b82bd472bdedaa8baed29373670556670e80ed40ff0c4b841142b5259f",
+  "tree_sha256": "5d80f6db5c26850188eb0c3f5ace7c42ff85561d277dc525e24f46cdcf52dee8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2827,7 +2827,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "870976966de7c48be4172390dc8e4f7d2eb6ac53e20dfb3fd5d40b08cfcd7850"
+      "sha256": "a51e16aba67547c0692d9422587f83d8ce40f0e45830463b80bfd188401eb6c0"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -4642,12 +4642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cc6846ec9d50fa1d8e41c960ff14171e4033faf435fe54fdfe60b38ec69968a3"
+      "sha256": "6f62185348f89cc7ae1c8998a25d4bdccb2e204ad81581555686f37057db1511"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5b964977f97fcd0749db36916838c51f0ffbea4a6e2eba5af2538472b519758d"
+      "sha256": "3ba87e851af1bf1ad2a08cb62d4c875be12d7ec6d86ffda9e5b26e24fee313ae"
     },
     {
       "path": "public-docs/index.html",
@@ -5292,7 +5292,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "a27a3873f516abdc52f7f482603779010bbc1af4d6e73c0b86dd34292017bc9a"
+      "sha256": "3f32080357abdecb0f0860c5c9313f12283f01774c8367ac22c1c12d0d176411"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -6417,7 +6417,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8cf8e0f172ad38bdf3871c06b99170adf366d2b2b5f1b0e993ecbc0877003fd7"
+      "sha256": "31c5e453080859713ed00c327a6b1fb1a022d2509438523979bad2e0e8feb7bf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6732,7 +6732,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "1e4db680c5925e473fff9ad6247e797bd9089fdf3696c3ffb161903bda41dcda"
+      "sha256": "fcad6c578c2d8698d6ad93fe04f500734d589013590f006910f1bc33fc908642"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -7272,7 +7272,7 @@
     {
       "path": "tests/fitness_ratchets.mjs",
       "mode": "0000644",
-      "sha256": "781bdee0778645704b5179bf99507e839743158714f799e45d6cc64f8fc30477"
+      "sha256": "e33edfa4925694d824c042f1fd06a977f1ac14b5c1cb24b5326014ca9f86ece0"
     },
     {
       "path": "tests/fitness_two_root.mjs",

package/modules/dev-box/box-access.js

@@ -158,6 +158,26 @@ const BASE_SPARSE_PATHS = [
   // and box-source-fetch re-applies this server-computed list every tick
   // (task 1002745). Generated ESM only, no product runtime.
   'clients',
+  // config/ — task 1003227. Without it a box CANNOT RUN ITS OWN QUALITY GATE:
+  // `scripts/gds/fitness.js` compares against config/fitness-baselines.json, and
+  // with the file absent the ratchet used to report PASS (it read the baselines
+  // through a try/catch that returned {}, so every metric had no floor to breach).
+  // A planted 5,000-line + 94-cycle regression sailed straight through. So a boxed
+  // builder shipped believing they were clean and learned otherwise from red CI,
+  // with nothing on the box to reproduce it. The fail-closed half is fixed in
+  // fitness-ratchets.js; this is the half that lets the gate actually run.
+  //
+  // Precedent, and why the "a module glob will pull it" argument does not hold:
+  // ADR 0174 put config/government.json in the `government` key's globs and the
+  // parent-directory emission below exists precisely because `config` was not in
+  // BASE — task 1003018 was RELEASED because its box could never see the file that
+  // was its entire deliverable. BASE is the right home, not a per-module accident.
+  //
+  // Secret posture unchanged: a cone-mode directory of JSON config. The NEUTRAL
+  // packs are already public, and an instance pack (config/branding.json,
+  // config/government.json) is host content the box's own builder authors — no
+  // credentials live here (ADR 0022); those are in /etc and the box env.
+  'config',
 ];
 
 // sparsePathsForScopeKeys — PURE. Given the module KEYS a builder's active claims

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.320",
+  "version": "1.19.321",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.320",
+      "version": "1.19.321",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.320",
+  "version": "1.19.321",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-ratchets.js

@@ -215,12 +215,52 @@ function knipIssueCount() {
 
 // ---------- baseline + ratchet ----------
 
+// readBaselines — task 1003227. Returns { metrics, error }: `error` is a reason
+// string when the file cannot be trusted, null when it read cleanly.
+//
+// This used to `catch { return {}; }`, which made the gate FAIL OPEN. An empty
+// baseline map leaves every `floor === undefined`, and compareToBaselines classifies
+// an absent floor as a WARNING — so a checkout with no config/ reported the ratchet
+// as PASSED. Measured: with the baselines gone, a planted 5,000-line and 94-cycle
+// regression produced 0 violations. That is not a hypothetical checkout — `config/`
+// is absent from every dev box's sparse slice, so the builders who most needed the
+// gate were the ones silently exempt from it, learning from red CI instead.
+//
+// Distinguish the two absences, because they are not the same fact:
+//   - the FILE is missing/malformed  -> cannot verify anything -> hard fail (here);
+//   - a KEY is missing for one metric -> a genuinely new metric -> stays a warning
+//     in compareToBaselines, so adding a metric does not break the build.
+//
+// The file's own header says raising a baseline to pass CI is out of policy;
+// deleting the file must not be the loophole that raising it is not.
 function readBaselines() {
+  let raw;
   try {
-    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).metrics || {};
-  } catch {
-    return {};
+    raw = fs.readFileSync(BASELINE_PATH, 'utf8');
+  } catch (e) {
+    const missing = e && e.code === 'ENOENT';
+    return {
+      metrics: {},
+      error: missing
+        ? `config/fitness-baselines.json is MISSING — the quality ratchet cannot verify anything, so it fails CLOSED rather than reporting a pass it did not check. `
+          + `If this is a dev box, config/ was historically outside the sparse checkout (task 1003227); re-sync the box (\`node scripts/gds/box-sync.js\`). `
+          + `To bootstrap a fresh baseline deliberately: node scripts/gds/fitness-ratchets.js --update-baselines`
+        : `config/fitness-baselines.json is unreadable (${e && e.message}) — failing CLOSED.`,
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { metrics: {}, error: `config/fitness-baselines.json is not valid JSON (${e && e.message}) — failing CLOSED.` };
+  }
+  const metrics = parsed && typeof parsed.metrics === 'object' && parsed.metrics !== null
+    ? parsed.metrics
+    : null;
+  if (!metrics) {
+    return { metrics: {}, error: 'config/fitness-baselines.json has no "metrics" object — failing CLOSED.' };
   }
+  return { metrics, error: null };
 }
 
 // Pure ratchet verdict — exported for the hermetic test.
@@ -256,7 +296,11 @@ function computeMetrics({ withDocs = true } = {}) {
 // The fitness.js check (in-suite, hermetic — everything except knip).
 function checkQualityRatchets() {
   const metrics = computeMetrics();
-  const { violations, warnings } = compareToBaselines(metrics, readBaselines());
+  const { metrics: baselines, error: baselineError } = readBaselines();
+  const { violations, warnings } = compareToBaselines(metrics, baselines);
+  // task 1003227: an unreadable baseline file is a hard failure, not silence. Put it
+  // FIRST so it is the headline rather than buried under per-metric noise.
+  if (baselineError) violations.unshift(baselineError);
   return {
     name: 'quality ratchets — size, duplication, cycles, console, doc entropy only tighten (task 1003129)',
     hardFail: violations.length > 0,
@@ -274,7 +318,9 @@ function main() {
     const metrics = computeMetrics();
     const knip = knipIssueCount();
     if (knip !== null) metrics.knip_issue_count = knip;
-    const existing = readBaselines();
+    // The bootstrap path deliberately tolerates an absent file — writing it is the
+    // whole point — so it reads the metrics and ignores any error (task 1003227).
+    const { metrics: existing } = readBaselines();
     if (knip === null && existing.knip_issue_count !== undefined) metrics.knip_issue_count = existing.knip_issue_count;
     fs.writeFileSync(
       BASELINE_PATH,
@@ -290,7 +336,9 @@ function main() {
       console.warn('fitness-ratchets: WARN — knip not runnable here (no node_modules / npx failure); failing OPEN.');
       process.exit(0);
     }
-    const { violations, warnings } = compareToBaselines({ knip_issue_count: value }, readBaselines());
+    const { metrics: knipBaselines, error: knipBaselineError } = readBaselines();
+    const { violations, warnings } = compareToBaselines({ knip_issue_count: value }, knipBaselines);
+    if (knipBaselineError) violations.unshift(knipBaselineError);
     for (const w of warnings) console.warn(`fitness-ratchets: ${w}`);
     if (violations.length) {
       for (const v of violations) console.error(`fitness-ratchets: FAIL — ${v}`);

package/src/module-api.js

@@ -1067,8 +1067,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.318 with no explicit bump. run 32670195088. (task 1002620)
 //   1.19.320 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.319 with no explicit bump. run 32678147546. (task 1002620)
+//   1.19.321 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.320 with no explicit bump. run 32679324013. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.320'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.321'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -368,5 +368,51 @@ t('a DENIED decision projects to null (the route returns 403, never a scope body
   assert.equal(access.scopeMetadata(), null, 'no args → null');
 });
 
+// ---------- task 1003227: config/ must be in the box's BASE slice ----------
+//
+// Without it a box cannot run its own quality gate: fitness.js compares against
+// config/fitness-baselines.json, and with the file absent the ratchet used to report
+// PASS (a planted 5,000-line + 94-cycle regression sailed through). So a boxed builder
+// shipped believing they were clean and learned otherwise from red CI, with nothing on
+// the box to reproduce it. Precedent for the same class: ADR 0174 put
+// config/government.json in the `government` globs, config/ was not in BASE, and task
+// 1003018 was RELEASED because its box could never see its own deliverable.
+
+t('1003227 BASE includes config/ so a box can read its own fitness baselines', () => {
+  const spec = access.decideSourceAccess({
+    rank: 'archon', status: 'active', scopeKeys: [], hasActiveClaims: false, moduleScopeMap: {},
+  });
+  assert.equal(spec.scope, 'base');
+  assert.ok(spec.spec.sparsePaths.includes('config'),
+    `base scope must carry config/; got ${spec.spec.sparsePaths.join(',')}`);
+});
+
+t('1003227 a TASK-scoped box carries config/ too (the common case — a claim is held)', () => {
+  // The REAL scope map, not a hand-rolled object — the shape matters here.
+  const scopeMap = require('../src/bongos/module-scope-map.js');
+  const spec = access.decideSourceAccess({
+    rank: 'xenos', status: 'active', scopeKeys: ['economy'], hasActiveClaims: true,
+    moduleScopeMap: scopeMap,
+  });
+  assert.equal(spec.scope, 'task');
+  assert.ok(spec.spec.sparsePaths.includes('config'), 'task scope must carry config/ as well');
+  assert.ok(spec.spec.sparsePaths.includes('modules/economy'),
+    `and still layer the claimed module on top; got ${spec.spec.sparsePaths.join(',')}`);
+});
+
+t('1003227 config/ is a cone-mode DIRECTORY entry (a file path aborts the whole set)', () => {
+  // ADR 0148: `git sparse-checkout set` rejects a file path, which kills the entire
+  // checkout — so every BASE entry must be a bare directory, no trailing slash.
+  for (const p of access.BASE_SPARSE_PATHS) {
+    assert.ok(!p.endsWith('/'), `${p} must not carry a trailing slash`);
+    // A dotted DIRECTORY (.claude, .devcontainer) is fine; what cone mode rejects is
+    // a file, so only test for an extension on the FINAL segment of a non-dotfile.
+    const last = p.split('/').pop();
+    if (!last.startsWith('.')) {
+      assert.ok(!/\.[a-z0-9]+$/i.test(last), `${p} looks like a FILE — cone mode would abort the set`);
+    }
+  }
+});
+
 console.log(`\nbox_access.mjs: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/fitness_ratchets.mjs

@@ -89,3 +89,85 @@ test('the committed baseline file parses and covers every hermetic metric', () =
     assert.ok(Number.isInteger(b.metrics[key]), `baseline missing ${key}`);
   }
 });
+
+// ---------- task 1003227: the gate must FAIL CLOSED on an unusable baseline ----------
+//
+// readBaselines used to `catch { return {} }`. An empty baseline map leaves every
+// `floor === undefined`, which compareToBaselines classifies as a WARNING — so a
+// checkout with no config/ reported the ratchet PASSED. Measured before the fix: a
+// planted 5,000-line + 94-cycle regression produced ZERO violations. That was not a
+// hypothetical checkout — config/ is absent from every dev box's sparse slice, so the
+// builders who most needed the gate were the ones silently exempt from it.
+//
+// checkQualityRatchets() reads the real repo, so these tests drive compareToBaselines
+// (pure) for the metric-level rules and exercise the file-level rule by pointing at a
+// baseline that does not exist.
+
+test('1003227 an ABSENT baseline file makes the gate hard-fail, not pass', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup`;
+  const had = fs.existsSync(real);
+  if (had) fs.renameSync(real, backup);
+  try {
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true, 'a gate that cannot read its floors must not report a pass');
+    assert.ok(r.violations.length > 0, 'and it must say so as a VIOLATION, not a warning');
+    assert.match(r.violations[0], /MISSING/, 'the first violation names the real cause');
+    assert.match(r.violations[0], /fails CLOSED/i, 'and states the posture explicitly');
+  } finally {
+    if (had) fs.renameSync(backup, real);
+  }
+});
+
+test('1003227 a MALFORMED baseline file also hard-fails', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup2`;
+  const had = fs.existsSync(real);
+  if (had) fs.copyFileSync(real, backup);
+  try {
+    fs.writeFileSync(real, '{ this is not json');
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true, 'unparseable is no more verifiable than absent');
+    assert.match(r.violations[0], /not valid JSON/);
+  } finally {
+    if (had) { fs.copyFileSync(backup, real); fs.unlinkSync(backup); }
+  }
+});
+
+test('1003227 a baseline file with no "metrics" object hard-fails', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup3`;
+  const had = fs.existsSync(real);
+  if (had) fs.copyFileSync(real, backup);
+  try {
+    fs.writeFileSync(real, JSON.stringify({ _comment: 'no metrics key' }));
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true);
+    assert.match(r.violations[0], /no "metrics" object/);
+  } finally {
+    if (had) { fs.copyFileSync(backup, real); fs.unlinkSync(backup); }
+  }
+});
+
+test('1003227 a missing KEY for a NEW metric stays a warning (adding a metric must not brick CI)', () => {
+  // The two absences are different facts and must not collapse: no FILE = cannot
+  // verify = fail; no KEY = a genuinely new metric = warn.
+  const { violations, warnings } = rat.compareToBaselines(
+    { brand_new_metric: 7 },
+    { excess_lines_total: 100 },
+  );
+  assert.deepEqual(violations, [], 'a new metric with no floor yet must not fail the build');
+  assert.match(warnings.join(' '), /no baseline for "brand_new_metric"/);
+});
+
+test('1003227 a real regression is still caught when the baselines ARE readable', () => {
+  const { violations } = rat.compareToBaselines(
+    { excess_lines_total: 5100, require_cycle_count: 99 },
+    { excess_lines_total: 100, require_cycle_count: 5 },
+  );
+  assert.equal(violations.length, 2, 'both regressions reported');
+  assert.match(violations.join(' '), /never raise the baseline to pass/);
+});