@bongos/core 1.19.339 → 1.19.341

package/docs/file-map.md

@@ -389,7 +389,7 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162)
+└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/recipes/redteam-patrol.md

@@ -16,18 +16,69 @@ node scripts/gds/redteam-patrol.js --canary          # self-test detection only
 node scripts/gds/redteam-patrol.js --canary --file   # prove the full pipe (files + dispute-closes)
 ```
 
-The scheduled form lives at [`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
-(`mode: deterministic`, one step, sink `gds`). Install on a machine per the
-file-map convention: symlink the routine dir under `~/.claude/scheduled-tasks/`.
-Weekly is the cadence — the checks watch drift measured in days (release-age,
-new advisories), not minutes.
+## What actually fires it
+
+**[`.github/workflows/redteam-patrol.yml`](../../.github/workflows/redteam-patrol.yml)
+— Mondays 06:17 UTC** (task 1003209, ADR 0188). Before that lane the patrol was,
+in the follow-up audit's words, a manual script: tracked, documented, wired into
+the control manifest, and run zero times.
+
+The routine itself lives at
+[`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
+(`mode: deterministic`, `cadence: weekly`, one step, sink `gds`) and the workflow
+invokes it through `run-routine.js`, so the SKILL.md's `steps:` stay the single
+source of truth for what a run does. Weekly is the cadence because the checks
+watch drift measured in days (release-age, new advisories), not minutes.
+
+**The cadence and the cron are checked against each other.** `cadence: weekly` in
+the SKILL.md and `cron: '17 6 * * 1'` in the workflow must agree, or
+`scripts/gds/routine-schedule.js` (fitness Check 25) fails the merge gate — as it
+does if the workflow stops firing the routine, or fires one that no longer
+exists. Change one and change the other in the same commit. The odd minute is
+deliberate: GitHub queues scheduled workflows and top-of-hour is its worst
+congestion window.
+
+**Why CI and not the always-on server.** All three checks read things only the
+*repo* has — full git history, `.github/workflows/`, an auditable lockfile. A
+deployed instance runs a vendored core out of `node_modules/@bongos/core`, which
+has none of them, so an in-process timer would have scanned nothing and reported
+clean. ADR 0188 §2.1.
+
+### Filing from CI (optional)
+
+A CI runner has no GDS session, so by default the scheduled run **reports but
+cannot file**: findings go to the Actions job summary and the job exits 2. To let
+it file, set the repo secret **`GDS_PATROL_SESSION`** to a GDS CLI session JSON
+(`{"token":…,"api_base":…}`) for a builder holding `security.report.file`; the
+workflow writes it to the session path `instance-config` resolves and the patrol
+files normally. This is opt-in on purpose — the patrol must not *require* a
+long-lived token to be useful.
+
+**Red means a finding was LOST, not that a finding exists.** Findings are
+advisory (ADR 0162), so a run that files three of them is a success:
+
+| the run… | exit |
+|---|---|
+| found nothing | 0 |
+| was a dry run | 0 |
+| filed its findings | 0 |
+| has findings it cannot file | **2** |
+
+Expect a standing `history-secrets` hit until the staging credential in commit
+`092e473` is scrubbed from history. That is the patrol working, not the lane
+being broken.
 
 ## Prerequisites
 
 - **gitleaks** on PATH (`brew install gitleaks`) or `GITLEAKS_BIN=<path>`. The
   history scan degrades LOUDLY (a printed warning, no silent skip) when absent;
-  the dependency + pin checks still run.
+  the dependency + pin checks still run. The scheduled lane installs it itself —
+  version-pinned and checksum-verified, the same binary and digest the unit gate
+  uses, rather than a mutable action tag (the tj-actions lesson).
 - A GDS session (the normal builder token) for `--file`; dry runs need nothing.
+  `--file` preflights it, so a sessionless run prints its findings and says it
+  could not file them — it never drops into the CLI's interactive re-auth wall,
+  which in a cron log is indistinguishable from a crash.
 - Network access to the npm registry for the dependency checks — registry
   failures print notes and skip that item (advisory layer: fail-open, loud).
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.339",
+  "version": "1.19.341",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.339",
+      "version": "1.19.341",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.339",
+  "version": "1.19.341",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -201,6 +201,10 @@
 
 *{box-sizing:border-box;margin:0;padding:0;}
 [hidden]{display:none !important;}
+/* visually-hidden: said by a screen reader, never painted. The done panel's
+   progress strip needs it (its dots carry each stage's state for the eye only),
+   and the hub's map heading and skip link ride on it. */
+.vh{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap;}
 html{scroll-behavior:smooth;}
 body{font-family:var(--font-body);color:var(--ink);background:var(--page-bg);min-height:100vh;-webkit-font-smoothing:antialiased;overflow-x:hidden;}
 
@@ -283,14 +287,18 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    verification — warm when verified live, amber-dim when stale, ashen when
    it failed its check, ghosted when torn down. Born for the dark sky; on
    light cards the inset ring keeps it grounded. ── */
-.orb{flex:0 0 54px;width:54px;height:54px;border-radius:50%;position:relative;overflow:visible;cursor:pointer;border:none;padding:0;
+.orb{flex:0 0 54px;width:54px;height:54px;border-radius:50%;position:relative;overflow:visible;border:none;padding:0;
   background:radial-gradient(120% 120% at 50% 50%, var(--acc,#fb923c), color-mix(in srgb, var(--acc,#fb923c) 55%, #1b2b52) 100%);
   box-shadow:0 0 0 1.5px rgba(255,255,255,.35) inset, 0 6px 18px rgba(20,16,40,.28), 0 0 26px var(--glow, rgba(251,146,60,.5));}
 .orb::after{content:'';position:absolute;inset:0;border-radius:50%;pointer-events:none;
   background:radial-gradient(38% 34% at 34% 28%, rgba(255,255,255,.9), rgba(255,255,255,0) 60%);}
 .orb.dim{filter:saturate(.55) brightness(.92);--glow:rgba(217,119,6,.35);}
 .orb.ashen{filter:saturate(.3) brightness(.78);--glow:rgba(220,38,38,.22);}
-.orb.ghost{opacity:.4;box-shadow:0 0 0 1.5px rgba(255,255,255,.25) inset;filter:saturate(.2);cursor:default;}
+.orb.ghost{opacity:.4;box-shadow:0 0 0 1.5px rgba(255,255,255,.25) inset;filter:saturate(.2);}
+/* only the LINKED orb is clickable: orbFor() emits a <span class="orb"> for
+   every non-navigable state, and index.html's .conItem .orb takes cursor:inherit
+   from the <a> it sits inside — so .orb.ghost's cursor reset is redundant. */
+a.orb{cursor:pointer;}
 
 /* ── project cards ── */
 .projects{list-style:none;display:flex;flex-direction:column;gap:18px;}
@@ -622,6 +630,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl th{text-align:left;font-family:var(--font-display);font-size:11.5px;font-weight:700;
   letter-spacing:.9px;text-transform:uppercase;color:var(--ink-faint);padding:15px 18px;
   border-bottom:2px solid var(--line);white-space:nowrap;}
+/* the sort control is a real button so the keyboard can reach it; it must look
+   like the header it replaced, so it inherits everything the th declares. */
+.tbl th button{all:unset;cursor:pointer;}
+.tbl th button:focus-visible{outline:2px solid var(--accent);outline-offset:2px;}
 .tbl td{padding:15px 18px;border-bottom:1px solid var(--line);font-size:14px;font-weight:600;
   color:var(--ink-soft);vertical-align:middle;}
 .tbl tr:last-child td{border-bottom:none;}
@@ -631,7 +643,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .pname{display:flex;align-items:center;gap:11px;}
 .tbl .pdot{width:11px;height:11px;border-radius:50%;background:var(--acc);flex:0 0 auto;
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
-.tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);}
+.tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);text-decoration:none;}
+.tbl a.ptitle:hover{text-decoration:underline;}
 .tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
 .tbl .num{font-family:var(--font-mono);font-weight:500;}
 .tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
@@ -753,6 +766,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .steps li.now .snum{border-color:var(--accent);color:var(--accent-deep);}
 .steps .slbl{font-size:12.5px;font-weight:700;color:var(--ink-faint);}
 .steps li.now .slbl,.steps li.done .slbl{color:var(--ink-soft);}
+.steps li[role=button]{cursor:pointer;}
+.steps li[role=button]:focus-visible{outline:2px solid var(--accent);outline-offset:3px;border-radius:8px;}
 .createSplit{display:grid;grid-template-columns:1fr 300px;gap:var(--pad-md);align-items:center;}
 @media (max-width:840px){.createSplit{grid-template-columns:1fr;}.createSplit .bongoCell{display:none;}}