@bongos/core 1.19.324 → 1.19.325

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.324",
-  "core_contract": "1.19.324",
-  "source_commit": "7448abdd2e984ab3e1d9acb627bb21e631f198c8",
+  "core_version": "1.19.325",
+  "core_contract": "1.19.325",
+  "source_commit": "9a1a1c67f80e8d01c562568c4565b9c2b4fb9420",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T14:18:41.725Z",
+  "built_at": "2026-08-24T14:28:39.280Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1806,
-  "tree_sha256": "170e8d01edc7c386adfef5d3c45b916a749225cd999f6e7aef6c65e8c1307c24",
+  "tree_sha256": "d455b7b84d748804468edea9e50ab188ef60da26a3538ede625b0766ca673f9b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4652,12 +4652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2bee07291c5d8ef2f9a3c4e0c7e10714c8e078d7a0e9bdc2321aecf4af7d9afe"
+      "sha256": "1a460f0c695ba6d590ee9bab9b281626de4747e164ca416098658ae054843ad6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7c47e473b34391b7357c799f632cfb8101bb723099baa3d41b2074deba44e37"
+      "sha256": "7cc398a8e7f341aee2272da252afc4abd5213349ece88962764c6bde65f27f25"
     },
     {
       "path": "public-docs/index.html",
@@ -5182,7 +5182,7 @@
     {
       "path": "scripts/gds/control-manifest.js",
       "mode": "0000644",
-      "sha256": "0d5b0c5e4bc15ff914d34849607ad2f01d1843d4dafeafdaf4191c2f365300bb"
+      "sha256": "189caa1e5c263beb5d2c251d924abfe6ea84b7f8b26409a93633c8466bd5801c"
     },
     {
       "path": "scripts/gds/copy-inventory.js",
@@ -5267,7 +5267,7 @@
     {
       "path": "scripts/gds/doc-cli-guard.js",
       "mode": "0000644",
-      "sha256": "6f157f0b3a5618bcc2372b6d3a2805ff212013b421720470b443da35aa72cf26"
+      "sha256": "9cf6c8ead8129799d17a18eadedf0423828cb457fa07fd317dcf2853254861e9"
     },
     {
       "path": "scripts/gds/docs-entropy.js",
@@ -6437,7 +6437,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cbeef525ef673bbd61cd645ea63a3cbc5bc7946d9a8f9e7b15457aaae0869220"
+      "sha256": "cc999c875729b68c2b78cf1f16a34184412b4d2b87b82be7b182627d313e9628"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6987,7 +6987,7 @@
     {
       "path": "tests/control_manifest.mjs",
       "mode": "0000644",
-      "sha256": "2465159282594723a49d03ed2ca9dbb10e95ddb7af96d145c45f7d7c2a8b8cee"
+      "sha256": "46ec55dbdb06b33cbe4b3dff44580cbb90d2daa0b225b810352a887e941e4798"
     },
     {
       "path": "tests/copy_desk_flags_db.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.324",
+  "version": "1.19.325",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.324",
+      "version": "1.19.325",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.324",
+  "version": "1.19.325",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/control-manifest.js

@@ -74,6 +74,47 @@ const CONTROLS = [
     wiredIn: { file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md', needle: 'redteam-patrol.js' },
     alsoExists: ['scripts/gds/redteam-patrol.js'],
   },
+
+  // ── goal 1000077's four guards (task 1003169 / G05) ──────────────────────
+  //
+  // Same reasoning as the goal-1000076 controls above, applied to the goal that
+  // exists BECAUSE prose documented four failure modes and nothing refused them.
+  // A guard that can silently stop existing is not a guard — and these four are
+  // exactly the kind that can: three are one line in fitness.js's CHECKS array
+  // (delete the line and the check simply never runs, with nothing red), and the
+  // fourth is a module the ship pipeline requires.
+  //
+  // `alsoExists` names each guard's TEST on purpose. A check whose test is gone
+  // still runs, but nothing then proves it can still fail — and this session
+  // produced three tests that were green for the wrong reason, so an untested
+  // guard is a guard on trust.
+  {
+    label: 'guard: a doc that names a CLI matches the real CLI (G01)',
+    file: 'scripts/gds/doc-cli-guard.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'doc-cli-guard' },
+    alsoExists: ['tests/doc_cli_guard.mjs'],
+  },
+  {
+    label: 'guard: no ops script hardcodes a version id (G02)',
+    file: 'scripts/gds/version-literal-guard.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'version-literal-guard' },
+    alsoExists: ['tests/version_literals.mjs', 'scripts/gds/version-select.js'],
+  },
+  {
+    label: 'guard: an ops skill declares the machine it needs (G03)',
+    file: 'scripts/gds/skill-preflight.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'skill-preflight' },
+    alsoExists: ['tests/skill_preflight.mjs'],
+  },
+  {
+    // Not a fitness check: a module the ship pipeline requires. Wired in
+    // ship-flow.js, which is where the carve left the resume path — and where a
+    // missing import silently broke every regrade until task 1003166 hit it.
+    label: 'guard: a ship cannot lie about how far it got (G04)',
+    file: 'scripts/gds/ship-honesty.js',
+    wiredIn: { file: 'scripts/gds/ship-flow.js', needle: 'ship-honesty' },
+    alsoExists: ['tests/ship_cannot_lie.mjs'],
+  },
 ];
 
 // Pure evaluation — exported for the test. deps.exists/deps.read override fs.
@@ -107,7 +148,7 @@ function checkControlsExist() {
     warnings: [],
     note: violations.length
       ? 'a shipped security/quality control disappeared or came unwired — restore it or update control-manifest.js in the same change'
-      : `all ${CONTROLS.length} goal-1000076 controls present and wired (the assurance-of-assurance the ADR 0022 audit found missing)`,
+      : `all ${CONTROLS.length} controls present and wired — goal 1000076's plus goal 1000077's four guards (task 1003169). The assurance-of-assurance the ADR 0022 audit found missing.`,
   };
 }
 

package/scripts/gds/doc-cli-guard.js

@@ -33,34 +33,9 @@ const { execFileSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
-// ---------------------------------------------------------------------------
-// Check 22 — a doc that NAMES a CLI invocation must match the real CLI
-// (task 1003165 / G01, goal 1000077).
-//
-// WHY. Task 1002931 shipped a skill instructing `capture.js --full --fields-file`
-// while those flags lived on an unlanded branch. Its test passed, because the test
-// pinned the skill's PROSE — it asserted the file said the words, never that the
-// words worked. So the skill confidently told agents to run a command that
-// silently ignored both flags and filed the wrong thing. That is the whole class:
-// AN UNRECOGNISED FLAG IS NOT AN ERROR. `arg('--x')`/`hasFlag('--x')` just return
-// null and the command proceeds, so a doc can name a flag that does nothing and
-// every test stays green (learning 1000198).
-//
-// It happened TWICE in one session: the second time, /workspace ran an older
-// capture.js and the same documented flags were dropped on the floor again.
-//
-// WHAT IT CHECKS, deliberately narrow: for every `node scripts/gds/<x>.js` in a
-// tracked .md, (a) the script exists, and (b) each `--flag` written next to it is
-// parsed by that script. Nothing else — this is not a linter for prose.
-//
-// STATIC ONLY, NEVER EXECUTED. The task says so and the reason matters: running
-// every documented CLI from a fitness check would be slow, would need a session,
-// and a command that blocks on a prompt would hang CI forever — the exact failure
-// R151's TTY gate exists to prevent.
-// Key is `<doc path>::<token>`, where token is either the script path (the whole
-// invocation is tolerated) or `--flag` (just that flag). Every entry carries its
-// reason on the same line: an unexplained entry is a silent hole, and the point of
-// this check is that a doc's claims are checkable.
+// Check 22 in fitness.js's CHECKS. The why, the narrowness and the static-only
+// rule are all in the file header above — not restated here.
+
 const DOC_CLI_ALLOW = new Map([
   ['.claude/skills/paint/SKILL.md::scripts/gds/art-stage.js',
     'art-stage.js ships with the art-pipeline HOST module, which publish-manifest.js excludes from core — absent from a core-only checkout by design; the skill says so inline.'],
@@ -120,6 +95,14 @@ function scanDocs(docs, { readDoc, readScript, allow = DOC_CLI_ALLOW } = {}) {
     if (!srcCache.has(rel)) srcCache.set(rel, readScript(rel));
     return srcCache.get(rel);
   };
+  // Memoized alongside srcCache: stripLineComments is two regex passes over a
+  // whole script, and it was being recomputed for EVERY flag on every invocation
+  // of that script. Invariant per file, so compute it once (grader, task 1003165).
+  const codeCache = new Map();
+  const codeOnly = (rel, src) => {
+    if (!codeCache.has(rel)) codeCache.set(rel, stripLineComments(src));
+    return codeCache.get(rel);
+  };
 
   for (const doc of docs) {
     const text = readDoc(doc);
@@ -156,7 +139,7 @@ function scanDocs(docs, { readDoc, readScript, allow = DOC_CLI_ALLOW } = {}) {
           // rather than failing is the deliberate choice: a usage banner is the
           // ONLY place some scripts name a flag they genuinely handle via a helper,
           // so failing here would resurrect the false positives that sank draft 1.
-          if (!scriptMentionsFlag(stripLineComments(src), flag)) {
+          if (!scriptMentionsFlag(codeOnly(scriptRel, src), flag)) {
             warnings.push(
               `${doc} → \`node ${scriptRel} --${flag}\`: ${scriptRel} names \`--${flag}\` only in comments/usage text, `
               + 'never in code — it may be a flag whose implementation was deleted. Verify it is still handled.'

package/src/module-api.js

@@ -1075,8 +1075,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.322 with no explicit bump. run 32680138776. (task 1002620)
 //   1.19.324 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.323 with no explicit bump. run 32737868129. (task 1002620)
+//   1.19.325 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.324 with no explicit bump. run 32738897943. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.324'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.325'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/control_manifest.mjs

@@ -58,3 +58,63 @@ test('all-present + all-wired yields zero violations', () => {
   const v = cm.evaluate(controls, { exists: () => true, read: () => 'has NEEDLE inside' });
   assert.deepEqual(v, []);
 });
+
+// ── goal 1000077's four guards (task 1003169 / G05) ────────────────────────
+// The goal exists because prose documented four failure modes and nothing
+// refused them. These assert the guards themselves cannot quietly vanish —
+// three are ONE LINE in fitness.js's CHECKS array, so deleting that line makes
+// the check never run with nothing going red.
+
+const GUARD_LABELS = ['G01', 'G02', 'G03', 'G04'];
+
+test('all four goal-1000077 guards are in the manifest', () => {
+  for (const g of GUARD_LABELS) {
+    const row = cm.CONTROLS.find((c) => c.label.includes(`(${g})`));
+    assert.ok(row, `${g} has a manifest entry`);
+    assert.ok(row.file, `${g} names its file`);
+    assert.ok(row.wiredIn && row.wiredIn.file && row.wiredIn.needle, `${g} names where it is wired`);
+    assert.ok(Array.isArray(row.alsoExists) && row.alsoExists.some((f) => f.startsWith('tests/')),
+      `${g} names its TEST — a check whose test is gone still runs, but nothing proves it can fail`);
+  }
+});
+
+test('each guard file really exists and is really wired', () => {
+  // Not a source-text assertion: run the manifest's own evaluator over the
+  // real tree for just these rows.
+  const rows = cm.CONTROLS.filter((c) => GUARD_LABELS.some((g) => c.label.includes(`(${g})`)));
+  assert.equal(rows.length, 4);
+  assert.deepEqual(cm.evaluate(rows), [], 'no violations on the live tree');
+});
+
+test('a DELETED guard file is caught', () => {
+  const row = cm.CONTROLS.find((c) => c.label.includes('(G01)'));
+  const out = cm.evaluate([row], { exists: () => false, read: () => '' });
+  assert.equal(out.length, 1);
+  assert.match(out[0], /missing/i);
+});
+
+test('a guard UNWIRED from fitness.js is caught — the one-line deletion', () => {
+  // The realistic rot: someone removes the CHECKS entry and the guard sits on
+  // disk, never running, with a green build.
+  for (const g of ['G01', 'G02', 'G03']) {
+    const row = cm.CONTROLS.find((c) => c.label.includes(`(${g})`));
+    const out = cm.evaluate([row], { exists: () => true, read: () => 'const CHECKS = [];' });
+    assert.equal(out.length, 1, `${g} must be caught when unwired`);
+  }
+});
+
+test("G04 is wired via ship-flow, not fitness — it is a module, not a check", () => {
+  const row = cm.CONTROLS.find((c) => c.label.includes('(G04)'));
+  assert.equal(row.wiredIn.file, 'scripts/gds/ship-flow.js');
+  const out = cm.evaluate([row], { exists: () => true, read: () => 'nothing requires it' });
+  assert.equal(out.length, 1, 'an unrequired ship-honesty is caught');
+});
+
+test('a guard whose TEST vanished is caught', () => {
+  const row = cm.CONTROLS.find((c) => c.label.includes('(G02)'));
+  const out = cm.evaluate([row], {
+    exists: (f) => !String(f).startsWith('tests/'),
+    read: () => "require('./version-literal-guard.js')",
+  });
+  assert.ok(out.length >= 1, 'a missing test is a violation, not a shrug');
+});