@bongos/core 1.19.33 → 1.19.34

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.33",
-  "core_contract": "1.19.33",
-  "source_commit": "53e6567ae132484c597ea9f16ed141b3f38c4d98",
+  "core_version": "1.19.34",
+  "core_contract": "1.19.34",
+  "source_commit": "4c7df27cafa52b11076549985f3b270f52a4b83d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T15:10:31.561Z",
+  "built_at": "2026-08-11T15:15:18.155Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 286,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1515,
-  "tree_sha256": "c4eb5d8939b2cfefc3bddc6b97e016418d2fd5a7c99a9090116183a407bfc937",
+  "tree_sha256": "36e160fe7d3ed2db78dea0705bbd6c0da8af094f50ef11a921e88f1ef5e670cb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "b2927d0be39718b274dda102c0d9d9035d323d1c60937ea7cd7a216315d5dc64"
+      "sha256": "77528182c408edf2b8f3e07382bb83f97a7d668b979e97e60e4ff0c2e1bc7109"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4012,12 +4012,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3b7b3283efe27724944d786e894dffd69731c4aca5f10c72c4dd318f2e05e1bf"
+      "sha256": "0a1787d27918736a0349bf2963267b7b164b874fa36cead87070f4ef72216385"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "854d15e8cf4e81bf848db848280b88dfc40a3836858a0ad1ab008f808f96677b"
+      "sha256": "b720c31ba0ccf0ef270d7342c8cc3b0e99a9d93e720145176b4f86fc2dfa266a"
     },
     {
       "path": "public-docs/index.html",
@@ -5637,7 +5637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "229087cbc698ed7d1a71aa3cea5b210528e2d5d1fcc7232ee6a536e9a2ca2010"
+      "sha256": "aec58f6fb1a7383beb03097fc4acea896237d45f75246101f0db10e573fc4725"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6832,7 +6832,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "10b1faf40cef2a3872c44109b63680e79922446b573bb476c79540d44a5622ac"
+      "sha256": "08db201ebec44ea5a711e3c86e36dda63ec22881a400e910dd7c64961c80f6e9"
     },
     {
       "path": "tests/migration_namespace.mjs",

package/modules/lifecycle/db.js

@@ -1474,6 +1474,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
+  'needs_migration', 'module_key',
 ]);
 
 async function updateTaskColumn(id, column, value) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.33",
+  "version": "1.19.34",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.33",
+      "version": "1.19.34",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.33",
+  "version": "1.19.34",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -493,8 +493,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.31 with no explicit bump. run 31504858325. (task 1002620)
 //   1.19.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.32 with no explicit bump. run 31505528205. (task 1002620)
+//   1.19.34 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.33 with no explicit bump. run 31505952506. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.33'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.34'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migration_allocation.mjs

@@ -177,6 +177,41 @@ function shouldReserveMigrationNumber(task) {
     }
   });
 
+  // Runtime wiring, not source text: every column setter must clear the
+  // TASK_SETTER_COLUMNS allowlist inside updateTaskColumn. The needs_migration
+  // setter shipped throwing at runtime because only a source-regex test covered
+  // it — and the same gap had silently broken updateTaskModuleKey (module_key
+  // was never allowlisted). Stub the shared pool and drive the real functions.
+  await test('every task column setter clears the updateTaskColumn allowlist at runtime', async () => {
+    const { pool } = require('../src/bongos/pool.js');
+    const realQuery = pool.query;
+    const seen = [];
+    pool.query = async (sql, params) => { seen.push({ sql, params }); return { rows: [{}] }; };
+    try {
+      const db = require('../modules/lifecycle/db.js');
+      const setters = [
+        [() => db.updateTaskKind(1, 'bug'), 'kind'],
+        [() => db.updateTaskDiscipline(1, 'engineer'), 'discipline'],
+        [() => db.updateTaskNewcomerFriendly(1, true), 'newcomer_friendly'],
+        [() => db.updateTaskParallelSafe(1, true), 'parallel_safe'],
+        [() => db.updateTaskAutomationTag(1, 'live-only'), 'automation_tag'],
+        [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
+        [() => db.updateTaskModuleKey(1, null), 'module_key'],
+      ];
+      for (const [call, column] of setters) {
+        const before = seen.length;
+        await call(); // throws here if the column is missing from the allowlist
+        assert.ok(seen.length > before, `${column} setter must reach pool.query`);
+        assert.ok(
+          seen[seen.length - 1].sql.includes(`SET ${column} =`),
+          `${column} setter must UPDATE its own column`
+        );
+      }
+    } finally {
+      pool.query = realQuery;
+    }
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),