@bongos/core 1.19.340 → 1.19.341

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.340",
-  "core_contract": "1.19.340",
-  "source_commit": "729dc8ef4deb583cef9971c4f3a6af6ed260bb33",
+  "core_version": "1.19.341",
+  "core_contract": "1.19.341",
+  "source_commit": "395ad8796967381d04b9f5ad9247da0cbf60d419",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T01:39:02.466Z",
+  "built_at": "2026-08-25T01:41:39.768Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 325,
+    "docs_redacted": 326,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1483,
+    "functional_verbatim": 1485,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1830,
-  "tree_sha256": "5236060970e82dd343f21af8e59eeae712bcc806ea439937aeeb72054b081eef",
+  "file_count": 1833,
+  "tree_sha256": "29b405f9216626b6f363e10be67e90f2bde67fdd472151fc4eaf0a6c18384acd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1419,10 +1419,15 @@
       "mode": "0000644",
       "sha256": "d59906a447f2459efdef6c3eb97cf8629813ec74776ead700017f02ef76aed9e"
     },
+    {
+      "path": "docs/adr/0188-patrol-runs-on-ci-not-the-server.md",
+      "mode": "0000644",
+      "sha256": "4feacf7bc809cdff1a23a1ef5b57d5d28aa448b80bd1ad24fc70860c0fe6739f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "87606f8e07f470f0ff55d7ac733de9d1004d3d15eddf1003a8958566b4147077"
+      "sha256": "4c736c015e635ed0b4e78445f35acbd8b84a14708634e5caf4a957357b1e22b9"
     },
     {
       "path": "docs/api-reference.md",
@@ -1572,7 +1577,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "ffd052f893ea0ef47a65e66a6d260fd43c1ccc653fa277f11f13805099e73d45"
+      "sha256": "bbe32c152ba31a68953f318f9a94e010252e70a6e076d64d7dca820f5c19777b"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1772,7 +1777,7 @@
     {
       "path": "docs/recipes/redteam-patrol.md",
       "mode": "0000644",
-      "sha256": "3dbdc33eb1aa68da5e6569e836845f09fd14953d94794e005af67ce517fb6dad"
+      "sha256": "656f30f568a56111ce6c2db8f3d61b0f9df3b168f41388b953a4552144579c94"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
@@ -4727,12 +4732,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d536e9a3a768714780abe658d3dd1e933deb5b1780f4ebc0e5b89c734ac5d0b9"
+      "sha256": "7c3952267fd38da7241791d8f5c4e7a2d8226d4cf8d30473fd6fe56ca000a4af"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c7f3a1d37b5cf6e9b0da46656d61cd8e9808f2ade90d8402a2f896ccde4f4c01"
+      "sha256": "d2ed11ab8e90eb8293778ce19fe921737158c0ab9d8063a9842383b1cfc59e94"
     },
     {
       "path": "public-docs/index.html",
@@ -5262,7 +5267,7 @@
     {
       "path": "scripts/gds/control-manifest.js",
       "mode": "0000644",
-      "sha256": "189caa1e5c263beb5d2c251d924abfe6ea84b7f8b26409a93633c8466bd5801c"
+      "sha256": "6c9538a110e45a184531e3ddd7725a8307da823411ef71f0d0b575dd3ee9571b"
     },
     {
       "path": "scripts/gds/copy-inventory.js",
@@ -5407,7 +5412,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "0181ba9d5595199777a84b1bc8363d5cda55df68c1eeecb647a18c4fbb6697df"
+      "sha256": "925006ed968209632b20677d05594158ebc27e65229d96a7d69a53baf93f6ed0"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5772,7 +5777,7 @@
     {
       "path": "scripts/gds/redteam-patrol.js",
       "mode": "0000644",
-      "sha256": "4e4ce11a67de653550851d9e0b9931253c8b100dd4285f2a39c74ba2f932b23c"
+      "sha256": "7460ee330a6bc53176a6ab83cb1019d50fe7d872d8a5bf31486e87edc86059af"
     },
     {
       "path": "scripts/gds/regen-instance-docs.js",
@@ -5799,10 +5804,15 @@
       "mode": "0000644",
       "sha256": "084fa5c4da1e755fa0edde5ec770e5151a9f66a247bca222bc7a2366ccf61748"
     },
+    {
+      "path": "scripts/gds/routine-schedule.js",
+      "mode": "0000644",
+      "sha256": "0d75c6b9be5a67738c91e55cda9084e10d7c64aa49c80ce9c0fa4219afcbd14c"
+    },
     {
       "path": "scripts/gds/run-routine.js",
       "mode": "0000644",
-      "sha256": "275098d7069661885fcfc6470d690e4fd18134c475e3d03cb4361a7183f9de08"
+      "sha256": "8b7765f52f4d6e6559a47bbc911bf5edc4acea81a3765b8811be9fd07be8dfb7"
     },
     {
       "path": "scripts/gds/run-unit-tests.js",
@@ -6557,7 +6567,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6a783af54daaa7252a170d835f921a6de968f4f6b7343a459696ddc70888bd58"
+      "sha256": "96c4cf1842a773983825fb0a8639b3e73eb0a3e7646a38781962530f072f6457"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8567,7 +8577,7 @@
     {
       "path": "tests/redteam_patrol.mjs",
       "mode": "0000644",
-      "sha256": "bf32ae5c734fc95873433b7c4e251a6b166c167ccc91c4684d061b97681c3357"
+      "sha256": "2dbaca4570cdac06c9ebdf2447b9955edeb1afdd763f24d98faec2103001a9e9"
     },
     {
       "path": "tests/regrade_eligibility.mjs",
@@ -8619,6 +8629,11 @@
       "mode": "0000644",
       "sha256": "b56a6945713e738542d612f6d43dd9bd00ce1a370b3d7b3e130f4e59a056ee15"
     },
+    {
+      "path": "tests/routine_schedule.mjs",
+      "mode": "0000644",
+      "sha256": "ba7f5690b9a3649a4c4cd2571d316aa837ffc01874d57aaa418dc72683c6a1f1"
+    },
     {
       "path": "tests/routine_timers.mjs",
       "mode": "0000644",
@@ -8632,7 +8647,7 @@
     {
       "path": "tests/run_routine.mjs",
       "mode": "0000644",
-      "sha256": "b27259a2ffa07f800d5e74aa6d35b623ecd7de2118f63fe4274e105bbbe81daf"
+      "sha256": "a33afdf5b7cbe592f77d5162ad8129f449efb0872ed2b484725c6d1bf0ba27c7"
     },
     {
       "path": "tests/run_routine_two_root.mjs",

package/docs/adr/0188-patrol-runs-on-ci-not-the-server.md

@@ -0,0 +1,162 @@
+# 0188 — The weekly patrol runs on CI, and a declared cadence must have something that fires it
+
+- **Status:** Accepted
+- **Date:** 2026-08-24
+- **Tasks:** [#1003209](https://cloudbongos.com/builders#/task/1003209) (goal 1000079 — pay down the frozen debt and make enforcement durable; criterion C4 `reduction-durable`)
+- **Builds on:** [ADR 0078](<redacted>.md) (deterministic-first routines + the `run-routine.js` dispatcher), [ADR 0180](<redacted>.md) §3 (the patrol's dependency checks), [ADR 0022](0022-secrets-policy.md) (the prevent → gate → patrol layering)
+- **Related:** [ADR 0162](<redacted>.md) (patrol findings are advisory — verdicts never self-execute), [ADR 0093](<redacted>.md) §1 (where `routine-timers.js` landed — the in-process poller seam this deliberately does *not* use)
+
+## 1. Context
+
+Goal 1000076 shipped a weekly red-team patrol: `scripts/gds/redteam-patrol.js`
+(full-git-history secret scan, dependency-drift review, workflow action-pin
+check), the `.claude/scheduled-tasks/redteam-weekly` routine that describes how
+to run it, a recipe, and a row in `control-manifest.js` asserting the control
+still exists.
+
+Nothing ever ran it. The follow-up audit
+([`docs/audits/ai-dev-redteam-followup.md`](../audits/ai-dev-redteam-followup.md) §7)
+put the failure in three parts:
+
+1. **No committed scheduler** for `.claude/scheduled-tasks/` at all. ADR 0078
+   built the external dispatcher an operator was meant to wire into cron; the
+   wiring never happened, which `routine-timers.js`'s own header already admits
+   in so many words — *"nothing was ever durably scheduled."*
+2. **No cadence to read.** The SKILL.md declared `mode:` and `steps:` — *how* to
+   run — but never *how often*. There was nothing for a scheduler to honour even
+   if one had looked.
+3. **A manifest that was green anyway.** `control-manifest.js` proved the patrol
+   "wired" by finding the substring `redteam-patrol.js` inside the SKILL.md —
+   i.e. the routine mentioning its own scanner. The control read as connected
+   for months while it ran zero times.
+
+This is the same shape the ADR 0022 audit found in the first place: a control
+that can quietly stop existing (or, here, quietly never start) is not a control.
+It is also the fifth instance in this goal of a more specific pattern — **an
+enforcement surface that names a file goes VACUOUS, not red, when the thing it
+names moves or stops.**
+
+## 2. Decision
+
+### 2.1 The runner is CI, not the always-on server
+
+The obvious symmetry was to add the patrol beside `peer-vote-tally` in
+`modules/autonomy/pollers/routine-timers.js` — the in-process timer built (as an
+ADR 0078 amendment) for exactly the "deterministic routine nobody scheduled"
+problem, whose header even reasons through why an in-process timer beat external
+cron *there*.
+
+**That reasoning does not transfer, and applying it here would have produced a
+patrol that reports clean while scanning nothing.** All three checks read things
+only the *repository* has:
+
+| check | needs |
+|---|---|
+| history-secrets | the full git history |
+| action-pins | `.github/workflows/` |
+| dependency-review | a `package.json` + `package-lock.json` npm can audit |
+
+A deployed instance runs a **vendored** core out of `node_modules/@bongos/core`.
+That directory is not a git repo, carries no workflows, and ships no lockfile.
+The timer would have found no history to scan, no workflows to check, and
+nothing to audit — and every one of those degrades to *"nothing found"*. Worse
+than unscheduled: confidently, weekly, wrong.
+
+So the scheduler is `.github/workflows/redteam-patrol.yml` — a weekly GitHub
+Actions lane with `fetch-depth: 0` and a pinned, checksum-verified gitleaks
+binary (the missing dependency the audit listed as its own gap). It invokes
+`run-routine.js redteam-weekly` rather than the patrol script directly, so the
+SKILL.md's `steps:` remain the single source of truth for what a run does.
+
+### 2.2 `cadence:` is a real frontmatter field
+
+`parseRoutineFrontmatter` now reads `cadence: hourly|daily|weekly|monthly`. It
+is **declarative only** — `run-routine.js` still runs a routine exactly once per
+invocation. The cadence is the contract a committed scheduler must honour.
+
+### 2.3 A cadence nothing fires is a red build
+
+`scripts/gds/routine-schedule.js` (fitness Check 25) is the part that keeps
+§7 from recurring. Its predicate is **relational, not existential**: it reads
+the cadence each routine declares, reads the cron each scheduler carries,
+classifies that cron into the period it actually realizes, and fails when the
+two disagree in either direction —
+
+- a routine declares a cadence and no scheduler fires it → red
+- a scheduler dispatches a routine that no longer exists → red (rename rot)
+- the cron's real period differs from the declared cadence → red
+
+The third is the one that matters most, because **no existence or substring
+predicate can ever see it.** Edit the cron from weekly to monthly and the file
+still exists, the workflow still names the routine, and every "is it wired?"
+check in the repo stays green.
+
+The manifest row was re-pointed to match: "wired" for a scheduled control now
+means the *scheduler* names the routine, not that the routine names itself.
+
+### 2.4 Red means "a finding was lost", not "a finding exists"
+
+A CI runner has no GDS session, so `--file` would have hit `cli-lib`'s
+interactive 401 path — printing *"run /builder-reauth"* and calling
+`process.exit(2)` into a cron log, indistinguishable from a crash, before the
+findings were ever shown. `--file` now preflights the session and follows the
+`main-audit.js --require-roster` doctrine: report loudly rather than
+green-and-vacuous.
+
+The exit code is a small table (`disposition()`), and the choice inside it is
+deliberate. Findings are **advisory** (ADR 0162) — they are filed for
+adjudication, not acted on — so a run that finds three things and files them is
+a **success**:
+
+| state | exit |
+|---|---|
+| ran, nothing to file | 0 |
+| ran, dry run | 0 |
+| ran, findings **filed** | 0 |
+| ran, findings it **cannot** file | **2** |
+
+Red is reserved for the single state where evidence evaporates. The alternative
+— failing whenever findings exist — would have gone red on the very first run
+and stayed red: the staging credential in commit `092e473` is still in history,
+unrotated, so the history scan has a standing hit. A weekly job that is always
+red is a weekly job nobody reads, which is the failure this whole goal is about.
+
+Filing itself is optional and credential-gated: with no `GDS_PATROL_SESSION`
+secret the patrol still runs every week and writes findings to the job summary.
+That default matters because this same goal's C1 is about *removing* long-lived
+tokens — the patrol must not require a new one to be useful.
+
+## 3. Consequences
+
+- The patrol runs unattended for the first time. The first scheduled runs are
+  expected to file a `history-secrets` report until commit `092e473` is scrubbed.
+- Adding a routine to `.claude/scheduled-tasks/` now forces a choice: declare a
+  cadence and schedule it, or declare none and accept a warning that it is
+  manual-only. Silence is no longer an option.
+- The check is tolerant of the two-repo split: `.claude/scheduled-tasks/` is
+  materialized into every instance, `.github/workflows/` is the core repo's and
+  does not travel — so in a checkout with no workflows directory, unscheduled
+  routines are warnings, not violations.
+- `cronCadence()` refuses step values, lists and ranges rather than guessing.
+  An exotic schedule cannot be described by a cadence word and must be reworked
+  or left manual — the safe direction, since a clever cron silently counting as
+  `weekly` would reopen the drift this exists to catch.
+
+## 4. Alternatives rejected
+
+- **An in-process timer in `routine-timers.js`.** §2.1 — the server cannot see
+  the evidence. Rejected on correctness, not cost.
+- **Teaching `routine-timers.js` to discover `.claude/scheduled-tasks/` and
+  honour `cadence:` generically.** The task offered this first and it is the more
+  general mechanism, but its only candidate user cannot run there, so it would
+  have been a scheduler built for nobody. The `cadence:` field is deliberately
+  *scheduler-agnostic*, so an instance that later wants an in-process lane for a
+  server-side routine can read the same declaration.
+- **Failing the job whenever findings exist.** Permanent red, then ignored. §2.4.
+- **Requiring a GDS session secret.** Would have made the whole lane inert until
+  a credential was provisioned, and adds a long-lived token to a goal whose C1 is
+  about eliminating one.
+- **A deeper `control-manifest.js` predicate instead of a new check.** The
+  manifest's shallowness is deliberate and documented (existence + one wiring
+  substring); the cadence↔cron agreement is relational and does not fit that
+  shape. Re-pointing the row *and* adding the check keeps each honest.

package/docs/adr/README.md

@@ -261,5 +261,6 @@ This keeps the decision history honest and traceable.
 | 0185 | [**The spark-handoff credit split: 70% developer, 30% spark author** ([task 1002923](https://cloudbongos.com/builders#/task/1002923), BV1.R147, goal 1000062 — completing the chain [task 1002920](https://cloudbongos.com/builders#/task/1002920) mark → [task 1002921](https://cloudbongos.com/builders#/task/1002921) queue → [task 1002922](https://cloudbongos.com/builders#/task/1002922) pickup). [ADR 0172](<redacted>.md) built the ideator streams and paid `captured_by`, the only person an idea then had. The spark handoff created a second: R146 develops a spark IN PLACE, preserving the author while recording a `developed_by`. **R146 therefore shipped paying NOTHING on purpose** — not an oversight but a refusal to guess, because `awardIdeaFullPassCredit`'s idempotency predicate is `(builder_id, reason)`, so paying the DEVELOPER would not have blocked a later payment to the AUTHOR and one idea would have paid twice; the cost of that caution was that a developed Full Idea received stream 2 **never** unless its author resubmitted. Owner decision (2026-08-22): **70/30 favouring the developer**, on BOTH existing streams, one ratio so there is one rule to explain. The reasoning is behavioural, not sentimental — developing someone else's spark is the scarce act the queue depends on, and at an even split it pays HALF what authoring your own Full Idea pays for the same writing work, so the rational move is always to write your own and the R145 queue stays a list nobody reads. The author keeps 30% plus their share of stream 1 on every task shipped under the idea, forever. `IDEA_DEVELOPER_SHARE = 0.70` is a **policy constant in `credits.js`** beside the pass bar and quick factor (ADR 0172's own consequence, the ADR 0023 precedent): a share of someone's earnings deserves a review and a commit, not a runtime edit. **The structural half is what retires R146's caution:** the economy module now derives the payees itself (`ideaCreditParties` reads `captured_by` + `developed_by`), so the caller can no longer choose a recipient — the develop route hands over an idea and a score, never a payee, and books the split like any other path (fail-open; the development has already committed). Three arithmetic properties, each a real bug if missed: the total is **conserved** (developer rounded, author gets the REMAINDER — rounding both pays 6 out of a 5-credit payout); a **self-developed** idea collapses to ONE payee, because two rows for one builder would silently UNDER-pay under the per-builder idempotency predicate, not double-pay (the comparison normalises via `String()` since `bigint` arrives as a string, so a type mismatch cannot become a phantom payee); and **zero-value rows are dropped**. Ids otherwise pass through unconverted — `Number()`-ing a `bigint` risks precision. `builder_id` in the idempotency predicate, which entered as an index optimisation (the R143/IC2 grader finding), is now **load-bearing for correctness**: two payees share one `reason`, so a reason-only predicate would refuse the second, and a partially-booked split completes on the next call. **Not decided here:** stream 3's split (ships with the Board Room, task 1002999), and whether `origin='develop'` in `ideas_task_lineage` belongs to whoever promotes a DEVELOPED idea into a task — ADR 0172 §5 says the row is "set at promotion and at develop (R146)", but R146 creates no task, so that origin stays deliberately unwired rather than invented; it changes who stream 1 pays.](<redacted>.md) | economy / ideator lane |
 | 0186 | [**Per-project idea templates: the seam is already built; the economics are the open problem** ([task 1002932](https://cloudbongos.com/builders#/task/1002932), BV1.R156, goal 1000062 — a SPIKE, output is this ADR plus a task list, no implementation). The literal question — how does a founder define their own idea shape without a schema change or forking the scorer — is **already answered by shipped work**: R141 gave every template function an optional `registry` defaulting to the built-in one, so validation and scoring both read the declaration as data; `ideas_grades.template_key` is per-row with a format CHECK whose own comment says a project key "stays addressable"; and `provisioning_instances.settings jsonb` is an existing per-project home. **No schema change, no fork.** Decision A: a **`project-settings` kernel port**, sibling of `builder-settings`, read via `resolveOptional` so a vanilla instance with no provisioning module degrades to the built-in registry; `base-v1` stays the default and the fallback for an unresolvable key. Rejected a new `ideas_templates` table (second home for data that has one) and a config file (per-instance, but one instance hosts many projects). **Decision B is the finding that matters.** Completeness is normalised 0–100 WITHIN its template (mean of per-field ratios), while karma reads it against an absolute bar (`IDEA_FULL_PASS_BAR = 60`, `IDEA_FULL_PASS_CREDIT = 5`) — so template choice becomes a credit-minting lever: `base-v1` needs ~200 characters for 5 credits, a 1-field template with `substanceMin` 10 needs ~10, a ~20× arbitrage handed to exactly the projects this ADR empowers. Shipping A without B would make the feature a way to print credits. The fix separates the two questions one number is answering: **completeness stays relative** (it is the right signal for triage ordering and the hall meter) and **karma stops reading it**, switching to an absolute substance total the scorer already computes per field and currently discards after averaging. An interim guard (≥3 required fields, ≥120 total `substanceMin`) bounds the arbitrage without fixing it. Decision C: an optional per-field `weight` (default 1) turning the unweighted mean into a weighted one — today's behaviour is the all-weights-1 case, so it is a data addition and one arithmetic line. Decision D: the five base fields are **not** mandatory (forcing them would make "define your own" cosmetic), replaced by two constraints — a template must declare ≥1 required field, and a stored template is validated at WRITE time so a malformed one is refused there rather than discovered inside the capture path, which must never throw. **Boundary note:** goal 1000062's wall is `[ideas, hall-ui]`, so the port task (provisioning + kernel) and the karma task (economy) cannot be claimed under it.](<redacted>.md) | ideas / templates |
 | 0187 | [**The OAuth web-handshake cookies live 30 minutes, and move together** ([task 1003234](https://cloudbongos.com/builders#/task/1003234), goal 1000058). The three cookies `/auth/web/start` sets — the CSRF state, the validated return target, the repo-scope opt-in — were 10 minutes each, a hall builder's timescale; a founder's first sign-in can include a GitHub SIGNUP with email verification and came back past ten minutes to "State mismatch" with the return + repo scope gone, and the page's retry door was a bare start. Decision: one `HANDSHAKE_COOKIE_MS = 30 min` for all three (they MUST move together — a state outliving its return cookie lands on the default landing with no scope, a return outliving its state lands on State mismatch), and every OAuth error page plus the access-pending auto-walk-in rebuilds its door from whatever cookies are still valid (`recoveryStartHref`, through the same open-redirect allowlist). What did NOT change: the state is still single-use, still `httpOnly`/`sameSite=lax`/apex-scoped, the code still the bearer — only the window for a legitimate handshake grew. Rejected: lengthening only return + repos (keeps the dead end and breaks the one-lifetime invariant the other way), a server-side state store, sixty minutes. The Discord-link state cookie is a different flow and keeps 10.](<redacted>.md) | auth / security posture |
+| 0188 | [**The weekly patrol runs on CI, and a declared cadence must have something that fires it** ([task 1003209](https://cloudbongos.com/builders#/task/1003209), goal 1000079). Goal 1000076 shipped a weekly red-team patrol, a routine describing how to run it, a recipe, and a manifest row — and nothing ever ran it; the follow-up audit §7 named all three halves (no committed scheduler, no cadence for a scheduler to read, and a manifest green anyway because its wiring predicate was satisfied by the SKILL.md mentioning its own scanner). The symmetric fix — an in-process timer beside `peer-vote-tally` in `routine-timers.js` — is **wrong on correctness, not cost**: all three patrol checks read things only the REPO has (full git history, `.github/workflows/`, an auditable lockfile), and a deployed instance runs a VENDORED core out of `node_modules/@bongos/core` that has none of them, so the timer would have scanned nothing and reported clean — worse than unscheduled. The runner is therefore CI: a weekly Actions lane with `fetch-depth: 0` and a pinned, checksum-verified gitleaks (the missing binary the audit listed separately), invoking `run-routine.js redteam-weekly` so the SKILL.md's steps stay the single source of truth. `cadence:` becomes a real frontmatter field — declarative only, scheduler-agnostic. The load-bearing piece is `routine-schedule.js` (fitness Check 25), whose predicate is **relational, not existential**: it classifies the cron into the period it actually realizes and fails when that disagrees with the declared cadence — the one rot mode no substring or existence check can EVER see, since editing weekly→monthly leaves every "is it wired?" predicate green. The manifest row was re-pointed to match ("wired" now means the SCHEDULER names the routine). Finally the exit code says **a finding was LOST, not that a finding exists**: findings are advisory (ADR 0162), so filing three is a SUCCESS and red is reserved for findings that cannot be recorded — failing on findings would have gone red on run one and stayed there (the unrotated staging credential in `092e473` is a standing history hit), and an always-red weekly job is one nobody reads. Filing is credential-gated but OPTIONAL — with no session secret the patrol still runs and writes its findings to the job summary, which matters because this goal's C1 is about eliminating long-lived tokens, not adding one. Rejected: the in-process timer; teaching `routine-timers.js` generic cadence discovery (a scheduler built for nobody — its only candidate user cannot run there); failing whenever findings exist; requiring the secret; a deeper manifest predicate instead of a new check.](<redacted>.md) | security / enforcement durability |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/file-map.md

@@ -389,7 +389,7 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162)
+└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/recipes/redteam-patrol.md

@@ -16,18 +16,69 @@ node scripts/gds/redteam-patrol.js --canary          # self-test detection only
 node scripts/gds/redteam-patrol.js --canary --file   # prove the full pipe (files + dispute-closes)
 ```
 
-The scheduled form lives at [`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
-(`mode: deterministic`, one step, sink `gds`). Install on a machine per the
-file-map convention: symlink the routine dir under `~/.claude/scheduled-tasks/`.
-Weekly is the cadence — the checks watch drift measured in days (release-age,
-new advisories), not minutes.
+## What actually fires it
+
+**[`.github/workflows/redteam-patrol.yml`](../../.github/workflows/redteam-patrol.yml)
+— Mondays 06:17 UTC** (task 1003209, ADR 0188). Before that lane the patrol was,
+in the follow-up audit's words, a manual script: tracked, documented, wired into
+the control manifest, and run zero times.
+
+The routine itself lives at
+[`.claude/scheduled-tasks/redteam-weekly/`](../../.claude/scheduled-tasks/redteam-weekly/SKILL.md)
+(`mode: deterministic`, `cadence: weekly`, one step, sink `gds`) and the workflow
+invokes it through `run-routine.js`, so the SKILL.md's `steps:` stay the single
+source of truth for what a run does. Weekly is the cadence because the checks
+watch drift measured in days (release-age, new advisories), not minutes.
+
+**The cadence and the cron are checked against each other.** `cadence: weekly` in
+the SKILL.md and `cron: '17 6 * * 1'` in the workflow must agree, or
+`scripts/gds/routine-schedule.js` (fitness Check 25) fails the merge gate — as it
+does if the workflow stops firing the routine, or fires one that no longer
+exists. Change one and change the other in the same commit. The odd minute is
+deliberate: GitHub queues scheduled workflows and top-of-hour is its worst
+congestion window.
+
+**Why CI and not the always-on server.** All three checks read things only the
+*repo* has — full git history, `.github/workflows/`, an auditable lockfile. A
+deployed instance runs a vendored core out of `node_modules/@bongos/core`, which
+has none of them, so an in-process timer would have scanned nothing and reported
+clean. ADR 0188 §2.1.
+
+### Filing from CI (optional)
+
+A CI runner has no GDS session, so by default the scheduled run **reports but
+cannot file**: findings go to the Actions job summary and the job exits 2. To let
+it file, set the repo secret **`GDS_PATROL_SESSION`** to a GDS CLI session JSON
+(`{"token":…,"api_base":…}`) for a builder holding `security.report.file`; the
+workflow writes it to the session path `instance-config` resolves and the patrol
+files normally. This is opt-in on purpose — the patrol must not *require* a
+long-lived token to be useful.
+
+**Red means a finding was LOST, not that a finding exists.** Findings are
+advisory (ADR 0162), so a run that files three of them is a success:
+
+| the run… | exit |
+|---|---|
+| found nothing | 0 |
+| was a dry run | 0 |
+| filed its findings | 0 |
+| has findings it cannot file | **2** |
+
+Expect a standing `history-secrets` hit until the staging credential in commit
+`092e473` is scrubbed from history. That is the patrol working, not the lane
+being broken.
 
 ## Prerequisites
 
 - **gitleaks** on PATH (`brew install gitleaks`) or `GITLEAKS_BIN=<path>`. The
   history scan degrades LOUDLY (a printed warning, no silent skip) when absent;
-  the dependency + pin checks still run.
+  the dependency + pin checks still run. The scheduled lane installs it itself —
+  version-pinned and checksum-verified, the same binary and digest the unit gate
+  uses, rather than a mutable action tag (the tj-actions lesson).
 - A GDS session (the normal builder token) for `--file`; dry runs need nothing.
+  `--file` preflights it, so a sessionless run prints its findings and says it
+  could not file them — it never drops into the CLI's interactive re-auth wall,
+  which in a cron log is indistinguishable from a crash.
 - Network access to the npm registry for the dependency checks — registry
   failures print notes and skip that item (advisory layer: fail-open, loud).
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.340",
+  "version": "1.19.341",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.340",
+      "version": "1.19.341",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.340",
+  "version": "1.19.341",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/control-manifest.js

@@ -69,10 +69,17 @@ const CONTROLS = [
     wiredIn: { file: '.github/workflows/unit.yml', needle: '--knip' },
   },
   {
-    label: 'patrol: weekly red-team routine wired to its scanner',
+    // Task 1003209 re-pointed this row. It used to prove the routine mentioned
+    // its own scanner — a wiring substring satisfied by the SKILL.md talking
+    // about itself, which is why the manifest read GREEN for months while the
+    // patrol never ran once (follow-up audit §7). "Wired" for a scheduled
+    // control has to mean SOMETHING FIRES IT, so the needle now lives in the
+    // scheduler. The period itself is checked relationally, where a substring
+    // can't reach: scripts/gds/routine-schedule.js (fitness Check 25).
+    label: 'patrol: weekly red-team routine is actually scheduled',
     file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md',
-    wiredIn: { file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md', needle: 'redteam-patrol.js' },
-    alsoExists: ['scripts/gds/redteam-patrol.js'],
+    wiredIn: { file: '.github/workflows/redteam-patrol.yml', needle: 'run-routine.js redteam-weekly' },
+    alsoExists: ['scripts/gds/redteam-patrol.js', 'scripts/gds/routine-schedule.js', 'tests/routine_schedule.mjs'],
   },
 
   // ── goal 1000077's four guards (task 1003169 / G05) ──────────────────────

package/scripts/gds/fitness.js

@@ -1305,6 +1305,7 @@ const CHECKS = [
   // and the check gets its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
+  require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
 ];
 
 function runAll() {

package/scripts/gds/redteam-patrol.js

@@ -24,6 +24,24 @@
 // to /api/gds/security/reports. --canary proves the end-to-end pipe: plants a
 // constructed token, asserts the scanner catches it, files a low "[canary]"
 // report, and dispute-closes it so the queue stays clean.
+//
+// UNATTENDED RUNS (task 1003209). The scheduler is .github/workflows/redteam-patrol.yml
+// — CI, not the always-on server, because all three checks read things only the
+// REPO has: full git history, .github/workflows/, and a package-lock npm can audit
+// (ADR 0188). A CI runner has no GDS session, so --file would otherwise hit
+// cli-lib's interactive re-auth wall and print "run /builder-reauth" into a cron
+// log. Instead --file preflights the session and, when there is none, follows the
+// main-audit.js --require-roster doctrine: report LOUDLY rather than green-and-
+// vacuous. The exit code says whether a finding was LOST, not whether findings
+// exist — findings are advisory (ADR 0162) and a patrol that goes red merely for
+// doing its job trains everyone to ignore it:
+//
+//   ran + filed                     → 0
+//   ran, nothing to file            → 0 (with or without a session)
+//   ran, has findings, cannot file  → 2 — the one state where evidence evaporates
+//
+// Findings are ALSO appended to $GITHUB_STEP_SUMMARY when set, so a scheduled run
+// is readable in the Actions UI without opening the log.
 
 'use strict';
 
@@ -211,6 +229,45 @@ function buildClassReport(className, findings, notes = []) {
   };
 }
 
+// Append markdown to the Actions job summary when running under GitHub Actions.
+// Best-effort and inert everywhere else — a patrol run must never fail because a
+// log surface was unavailable.
+function stepSummary(md) {
+  const dest = process.env.GITHUB_STEP_SUMMARY;
+  if (!dest) return;
+  try { fs.appendFileSync(dest, `${md}\n`); } catch { /* never fatal */ }
+}
+
+// Pure: what a completed sweep should DO with its findings, and the exit code
+// that disposition deserves. Extracted so the honest-exit contract is a table a
+// test can enumerate rather than branching buried in main().
+//
+// The load-bearing row is the last one. Findings are ADVISORY (ADR 0162), so a
+// run that finds three things and files them is a SUCCESS — going red merely for
+// doing its job is how a weekly lane becomes noise everyone filters. Red is
+// reserved for the single state where evidence EVAPORATES: findings exist,
+// filing was asked for, and it cannot happen.
+function disposition({ findingClasses = 0, doFile = false, blocker = null } = {}) {
+  if (!findingClasses) return { action: 'clean', exitCode: 0 };
+  if (!doFile) return { action: 'dry-run', exitCode: 0 };
+  if (blocker) return { action: 'not-filed', exitCode: 2 };
+  return { action: 'file', exitCode: 0 };
+}
+
+// Is there a GDS session this run could file with? Returns the reason it cannot,
+// or null when filing is possible. Read directly (readSessionToken) rather than
+// probing with apiCall, because apiCall's 401 path exits the process with
+// interactive re-auth guidance — useless in a cron log and indistinguishable from
+// a crash.
+function filingBlocker() {
+  try {
+    const { readSessionToken } = require('./cli-lib.js');
+    return readSessionToken() ? null : 'no GDS session on this runner';
+  } catch (e) {
+    return `session unreadable: ${e && e.message}`;
+  }
+}
+
 async function fileReport(report) {
   const { apiCall } = require('./cli-lib.js');
   const r = await apiCall('POST', '/api/gds/security/reports', report);
@@ -283,10 +340,30 @@ async function main() {
   const pins = actionPinCheck();
   if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
 
+  if (secrets.degraded) stepSummary(`> **DEGRADED** — ${secrets.degraded}`);
+
   if (!classes.length) {
     console.log('patrol: clean sweep — nothing to file.');
+    stepSummary('## red-team patrol\n\nClean sweep — no findings to file.');
     return;
   }
+
+  stepSummary(['## red-team patrol', ...classes.map((c) =>
+    `### ${c.title}\n\nseverity: **${c.severity}**\n\n${c.repro_steps_md}`)].join('\n\n'));
+
+  // Preflight the session ONCE, before the first POST: a half-filed sweep (class
+  // one lands, class two hits the auth wall and exits) is worse than not starting.
+  const blocker = doFile ? filingBlocker() : null;
+  const { action, exitCode } = disposition({ findingClasses: classes.length, doFile, blocker });
+  if (action === 'not-filed') {
+    console.error(`patrol: DID NOT FILE — ${blocker}. ${classes.length} finding class(es) above are NOT in the adjudication queue.`);
+    console.error('patrol: sign in on this runner (or set the scheduler\'s session secret) and re-run — see docs/recipes/redteam-patrol.md.');
+    for (const report of classes) console.error(`  [${report.severity}] ${report.title}\n${report.repro_steps_md}`);
+    stepSummary(`\n> **NOT FILED** — ${blocker}. These findings exist only in this run's log.`);
+    process.exitCode = exitCode;
+    return;
+  }
+
   for (const report of classes) {
     if (doFile) {
       const id = await fileReport(report);
@@ -305,4 +382,5 @@ if (require.main === module) {
 module.exports = {
   parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
   buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
+  stepSummary, filingBlocker, disposition,
 };

package/scripts/gds/routine-schedule.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+// scripts/gds/routine-schedule.js — a declared cadence must have something that
+// fires it (task 1003209, goal 1000079; docs/audits/ai-dev-redteam-followup.md §7).
+//
+// THE GAP THIS CLOSES. Goal 1000076 shipped the redteam-weekly patrol, wired it
+// into the control manifest, and documented it — and then nothing ever ran it.
+// The follow-up audit's §7 named all three halves of the failure:
+//
+//   1. no committed scheduler for .claude/scheduled-tasks/ at all;
+//   2. the SKILL.md declared `mode` and `steps` but no cadence — "nothing for a
+//      scheduler to read even if one looked";
+//   3. control-manifest.js called the patrol "wired" on a substring (the SKILL.md
+//      mentions its own scanner), so the manifest was GREEN while the patrol was
+//      dormant.
+//
+// (2) is now a real frontmatter field (run-routine.js parseRoutineFrontmatter),
+// (1) is .github/workflows/redteam-patrol.yml, and THIS file is (3): the check
+// that refuses the combination of a declared cadence and nothing firing it.
+//
+// WHY A DEDICATED CHECK RATHER THAN ANOTHER MANIFEST ROW. The manifest's
+// predicates are deliberately shallow — file exists, one wiring substring. That
+// shape is exactly what let the patrol read as wired while dormant, and this goal
+// has now hit the same failure five times: an enforcement surface that NAMES a
+// file goes VACUOUS, not red, when the thing it names moves or stops. So the
+// predicate here is relational, not existential: it reads the cadence each
+// routine declares, reads the cron each scheduler actually carries, and fails
+// when the two disagree in EITHER direction —
+//
+//   • a routine declares `cadence:` and no scheduler fires it   → red
+//   • a scheduler fires a routine that no longer exists         → red (rename rot)
+//   • the cron's real period differs from the declared cadence  → red
+//
+// The third is the one a substring check can never catch: edit the cron from
+// weekly to yearly and every "is it wired?" predicate stays green.
+//
+// TWO-REPO TOLERANCE. Scheduled routines are TOPOLOGY — `bongos init/upgrade`
+// materializes .claude/scheduled-tasks/ into each instance (claude-materialize.js),
+// but .github/workflows/ is the CORE repo's and does not travel. So an instance
+// checkout legitimately has routines and no workflows directory. There, the
+// unscheduled routines are reported as WARNINGS (the instance's operator owns its
+// own scheduler); in a repo that HAS workflows, they are violations. That keeps
+// the check honest in the core without red-building every instance.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const TASKS_DIR = path.join(ROOT, '.claude', 'scheduled-tasks');
+const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
+
+const { parseRoutineFrontmatter } = require('./run-routine.js');
+
+// The cadences a routine may declare. The value is the period a cron expression
+// must resolve to for the two to agree. Add a name here and cronCadence() below
+// must be able to produce it, or the pair can never match.
+const CADENCES = new Set(['hourly', 'daily', 'weekly', 'monthly']);
+
+// Pure: classify a 5-field cron expression into the cadence it actually realizes.
+// Returns null for anything this vocabulary cannot describe (step values, lists,
+// ranges) — a cadence can then never "match" it, which is the safe direction: an
+// exotic cron must be described some other way rather than silently accepted.
+//
+//   min hour dom mon dow
+//   17   6    *   *   1   → weekly   (a specific day-of-week)
+//   17   6    *   *   *   → daily    (a specific hour, every day)
+//   17   6    3   *   *   → monthly  (a specific day-of-month)
+//   17   *    *   *   *   → hourly   (a specific minute, every hour)
+function cronCadence(expr) {
+  const f = String(expr == null ? '' : expr).trim().split(/\s+/);
+  if (f.length !== 5) return null;
+  const [min, hour, dom, mon, dow] = f;
+  const fixed = (v) => /^\d+$/.test(v);
+  const any = (v) => v === '*';
+  if (!fixed(min)) return null;          // every cadence below pins the minute
+  if (!any(mon)) return null;            // a specific month is a yearly shape
+  if (any(hour)) return any(dom) && any(dow) ? 'hourly' : null;
+  if (!fixed(hour)) return null;
+  if (fixed(dow) && any(dom)) return 'weekly';
+  if (fixed(dom) && any(dow)) return 'monthly';
+  if (any(dom) && any(dow)) return 'daily';
+  return null;
+}
+
+// Pure: every cron expression a workflow file declares under `on: schedule:`.
+// A focused subset of YAML (the repo has no js-yaml dep and the parser in
+// run-routine.js is the same shape): the `cron:` keys are unambiguous enough to
+// read directly, and a workflow that hides one behind an anchor would simply
+// read as unscheduled — the safe direction.
+function workflowCrons(yamlText) {
+  const out = [];
+  for (const line of String(yamlText == null ? '' : yamlText).split('\n')) {
+    const m = /^\s*-?\s*cron:\s*['"]?([^'"#\n]+?)['"]?\s*(?:#.*)?$/.exec(line);
+    if (m) out.push(m[1].trim());
+  }
+  return out;
+}
+
+// Pure: does `yamlText` actually invoke routine `name`? Either the canonical
+// dispatcher form (`run-routine.js <name>`) or one of the routine's own step
+// commands verbatim. Both are real invocations; a mere mention in prose is not,
+// which is the whole point — the substring predicate this replaces was satisfied
+// by a comment.
+function invokesRoutine(yamlText, name, steps = []) {
+  const hay = String(yamlText == null ? '' : yamlText);
+  const dispatched = new RegExp(`run-routine\\.js\\s+(?:--\\S+\\s+)*${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w-])`);
+  if (dispatched.test(hay)) return true;
+  return steps.some((s) => s.command && hay.includes(s.command));
+}
+
+// Read every routine that declares a cadence, plus the ones that don't.
+function readRoutines(dir = TASKS_DIR) {
+  const withCadence = [];
+  const withoutCadence = [];
+  let names = [];
+  try {
+    names = fs.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch (_) { return { withCadence, withoutCadence }; }
+  for (const name of names.sort()) {
+    let md;
+    try { md = fs.readFileSync(path.join(dir, name, 'SKILL.md'), 'utf8'); } catch (_) { continue; }
+    const { cadence, steps } = parseRoutineFrontmatter(md);
+    if (cadence) withCadence.push({ name, cadence, steps });
+    else withoutCadence.push({ name });
+  }
+  return { withCadence, withoutCadence };
+}
+
+function readWorkflows(dir = WORKFLOWS_DIR) {
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml')); }
+  catch (_) { return null; } // null = no workflows directory at all (instance repo)
+  return files.sort().map((f) => ({ file: f, text: fs.readFileSync(path.join(dir, f), 'utf8') }));
+}
+
+// Pure evaluation — exported for the test, which drives it with fixtures.
+// `workflows === null` means "this checkout has no CI to schedule with", which
+// downgrades unscheduled routines from violations to warnings (see the two-repo
+// note in the header).
+function evaluate({ withCadence, withoutCadence }, workflows) {
+  const violations = [];
+  const warnings = [];
+  const hasCI = workflows !== null;
+  const wf = workflows || [];
+
+  for (const r of withCadence) {
+    if (!CADENCES.has(r.cadence)) {
+      violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')})`);
+      continue;
+    }
+    const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
+    if (!firing.length) {
+      const msg = `routine '${r.name}' declares cadence: ${r.cadence} but NOTHING fires it — no scheduled workflow invokes it`;
+      (hasCI ? violations : warnings).push(msg);
+      continue;
+    }
+    // It is invoked somewhere. At least one of those invocations must be on a
+    // schedule whose real period is the declared cadence. A workflow_dispatch-only
+    // lane is a human running it — exactly the state §7 called "decorative".
+    const seen = [];
+    let matched = false;
+    for (const w of firing) {
+      for (const expr of workflowCrons(w.text)) {
+        const actual = cronCadence(expr);
+        seen.push(`${w.file}: "${expr}" → ${actual || 'unclassifiable'}`);
+        if (actual === r.cadence) matched = true;
+      }
+    }
+    if (!matched) {
+      violations.push(
+        seen.length
+          ? `routine '${r.name}' declares cadence: ${r.cadence} but no scheduler fires it at that period — ${seen.join('; ')}`
+          : `routine '${r.name}' declares cadence: ${r.cadence} but ${firing.map((w) => w.file).join(', ')} carries no 'on: schedule:' cron (manual dispatch only)`
+      );
+    }
+  }
+
+  // Rename rot, the other direction: a scheduler that dispatches a routine name
+  // no longer on disk. run-routine.js exits 2 on a missing SKILL.md, so this
+  // would be a weekly red job nobody watches; catch it at merge time instead.
+  // Deduped: a workflow legitimately names its own invocation more than once (the
+  // step itself plus the header comment explaining why it dispatches rather than
+  // calling the script), and one rename should read as one problem.
+  const known = new Set([...withCadence, ...withoutCadence].map((r) => r.name));
+  const dangling = new Set();
+  for (const w of wf) {
+    for (const m of w.text.matchAll(/run-routine\.js\s+(?:--\S+\s+)*([A-Za-z0-9_-]+)/g)) {
+      if (!known.has(m[1])) dangling.add(`${w.file} dispatches routine '${m[1]}', which has no .claude/scheduled-tasks/${m[1]}/SKILL.md`);
+    }
+  }
+  violations.push(...dangling);
+
+  for (const r of withoutCadence) {
+    warnings.push(`routine '${r.name}' declares no cadence: — it can only ever be run by hand`);
+  }
+  return { violations, warnings };
+}
+
+// The fitness.js check.
+function checkRoutineCadencesScheduled() {
+  const routines = readRoutines();
+  const workflows = readWorkflows();
+  const { violations, warnings } = evaluate(routines, workflows);
+  const scheduled = routines.withCadence.length - violations.filter((v) => v.startsWith("routine '")).length;
+  return {
+    name: 'a declared cron cadence has something that fires it (task 1003209)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: violations.length
+      ? 'a scheduled routine is declared but dormant — add/repair the scheduler, or drop the cadence: field and stop claiming it runs'
+      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler at the declared period; ${routines.withoutCadence.length} manual-only.`,
+  };
+}
+
+function main() {
+  const r = checkRoutineCadencesScheduled();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  for (const w of r.warnings) console.warn(`⚠ ${w}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  checkRoutineCadencesScheduled, evaluate, cronCadence, workflowCrons,
+  invokesRoutine, readRoutines, readWorkflows, CADENCES,
+};

package/scripts/gds/run-routine.js

@@ -47,12 +47,19 @@ function unquote(s) {
   return t;
 }
 
-// Pure: parse mode + steps[] from SKILL.md frontmatter. A focused YAML subset
-// (no js-yaml dep): scalar `mode:`/`description:` and a `steps:` list of
-// `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+// Pure: parse mode + cadence + steps[] from SKILL.md frontmatter. A focused YAML
+// subset (no js-yaml dep): scalar `mode:`/`cadence:`/`description:` and a `steps:`
+// list of `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+//
+// `cadence:` (task 1003209) is the field the follow-up audit found missing — the
+// routines declared HOW to run but never HOW OFTEN, so "there was nothing for a
+// scheduler to read even if one looked." It is declarative only: run-routine.js
+// still runs a routine exactly once per invocation. The cadence is the contract a
+// committed scheduler must honour, and scripts/gds/routine-schedule.js is the check
+// that refuses a cadence nothing fires.
 function parseRoutineFrontmatter(skillMd) {
   const norm = String(skillMd == null ? '' : skillMd).replace(/\r\n/g, '\n');
-  const empty = { mode: null, steps: [], description: null };
+  const empty = { mode: null, cadence: null, steps: [], description: null };
   if (!norm.startsWith('---\n')) return empty;
   const lines = norm.split('\n');
   let close = -1;
@@ -62,6 +69,7 @@ function parseRoutineFrontmatter(skillMd) {
   if (close === -1) return empty;
 
   let mode = null;
+  let cadence = null;
   let description = null;
   const steps = [];
   let inSteps = false;
@@ -96,12 +104,13 @@ function parseRoutineFrontmatter(skillMd) {
 
     if (!inSteps && isTopLevel && topKv) {
       if (topKv[1] === 'mode') mode = unquote(topKv[2]) || null;
+      else if (topKv[1] === 'cadence') cadence = unquote(topKv[2]) || null;
       else if (topKv[1] === 'description') description = topKv[2].trim();
       else if (topKv[1] === 'steps' && topKv[2].trim() === '') inSteps = true;
     }
   }
   pushCur();
-  return { mode, steps, description };
+  return { mode, cadence, steps, description };
 }
 
 // Pure: split a repo-authored command string into argv, honoring simple quotes.

package/src/module-api.js

@@ -1110,8 +1110,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.338 with no explicit bump. run 32797325535. (task 1002620)
 //   1.19.340 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.339 with no explicit bump. run 32798342738. (task 1002620)
+//   1.19.341 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.340 with no explicit bump. run 32798507686. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.340'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.341'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/redteam_patrol.mjs

@@ -65,3 +65,66 @@ test('buildClassReport caps the item list, counts the remainder, and takes max s
   assert.match(r.repro_steps_md, /…and 3 more/);
   assert.match(r.repro_steps_md, /Notes:/);
 });
+
+// ---------------------------------------------------------------------------
+// Unattended-run behaviour (task 1003209): the patrol now runs on CI, which has
+// no GDS session. These pin the two things that turns on — an exit code that
+// means "a finding was LOST" rather than "a finding exists", and a job-summary
+// surface so a scheduled run is readable without opening the log.
+// ---------------------------------------------------------------------------
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+test('disposition: red is reserved for findings that could not be recorded', () => {
+  // A clean sweep is green even if filing was impossible — nothing was lost.
+  assert.deepEqual(p.disposition({ findingClasses: 0, doFile: true, blocker: 'no session' }),
+    { action: 'clean', exitCode: 0 });
+  // A dry run prints; it never claims to have filed, so it never fails.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: false, blocker: null }),
+    { action: 'dry-run', exitCode: 0 });
+  // Findings filed for adjudication = the patrol working as designed (ADR 0162).
+  // If this ever became a failure, a weekly red would train everyone to ignore it.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: null }),
+    { action: 'file', exitCode: 0 });
+  // The ONE red state: findings exist, filing was asked for, and it cannot happen.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: 'no GDS session on this runner' }),
+    { action: 'not-filed', exitCode: 2 });
+  assert.deepEqual(p.disposition(), { action: 'clean', exitCode: 0 });
+});
+
+test('stepSummary appends markdown for the Actions UI, and is inert off-CI', () => {
+  const f = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-')), 'summary.md');
+  const prev = process.env.GITHUB_STEP_SUMMARY;
+  try {
+    process.env.GITHUB_STEP_SUMMARY = f;
+    p.stepSummary('## one');
+    p.stepSummary('## two');
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+    delete process.env.GITHUB_STEP_SUMMARY;
+    p.stepSummary('## three'); // must not throw, must not write anywhere
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+  } finally {
+    if (prev === undefined) delete process.env.GITHUB_STEP_SUMMARY;
+    else process.env.GITHUB_STEP_SUMMARY = prev;
+  }
+});
+
+test('filingBlocker reports a sessionless runner instead of exiting with re-auth guidance', () => {
+  // The regression guarded here: cli-lib's apiCall answers 401 by PRINTING
+  // "run /builder-reauth" and calling process.exit(2). In a cron log that is
+  // indistinguishable from a crash, and it kills the run before the findings are
+  // ever printed. A subprocess with an empty HOME is the only honest way to
+  // simulate a runner with no session file — the suite's own machine has one.
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-home-'));
+  const r = spawnSync(process.execPath, ['-e',
+    `const p = require(${JSON.stringify(path.join(ROOT, 'scripts', 'gds', 'redteam-patrol.js'))});
+     console.log(JSON.stringify({ blocker: p.filingBlocker() }));`,
+  ], { env: { ...process.env, HOME: home, USERPROFILE: home }, encoding: 'utf8' });
+  assert.equal(r.status, 0, `expected a clean return, not an exit: ${r.stderr}`);
+  const out = JSON.parse(r.stdout.trim().split('\n').pop());
+  assert.equal(typeof out.blocker, 'string');
+  assert.match(out.blocker, /no GDS session|session unreadable/);
+  assert.doesNotMatch(r.stdout + r.stderr, /builder-reauth/,
+    'the sessionless path must not print interactive re-auth guidance into a cron log');
+});

package/tests/routine_schedule.mjs

@@ -0,0 +1,176 @@
+// tests/routine_schedule.mjs — a declared cadence must have something that fires
+// it (task 1003209, goal 1000079; ADR 0188, follow-up audit §7).
+//
+// The check exists because goal 1000076's patrol was "wired" by every predicate
+// the repo had and still ran zero times. So these tests are written against the
+// ways that state can come BACK, not merely against the happy path: the strongest
+// one is the cron silently drifting off the declared cadence, which no
+// existence/substring predicate can ever catch.
+//
+// Hermetic — the evaluator is pure and driven with fixtures; the two live-tree
+// tests at the bottom assert the real repo is in the state this task shipped.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rs = require(path.join(ROOT, 'scripts', 'gds', 'routine-schedule.js'));
+const { parseRoutineFrontmatter } = require(path.join(ROOT, 'scripts', 'gds', 'run-routine.js'));
+
+const WEEKLY_WF = {
+  file: 'redteam-patrol.yml',
+  text: [
+    'on:',
+    '  schedule:',
+    "    - cron: '17 6 * * 1'",
+    '  workflow_dispatch:',
+    'jobs:',
+    '  patrol:',
+    '    steps:',
+    '      - run: node scripts/gds/run-routine.js redteam-weekly',
+  ].join('\n'),
+};
+const routines = (withCadence, withoutCadence = []) => ({ withCadence, withoutCadence });
+const WEEKLY = [{ name: 'redteam-weekly', cadence: 'weekly', steps: [] }];
+
+// ---------------------------------------------------------------- cron parsing
+
+test('cronCadence classifies the four periods a routine may declare', () => {
+  assert.equal(rs.cronCadence('17 6 * * 1'), 'weekly');
+  assert.equal(rs.cronCadence('17 6 * * *'), 'daily');
+  assert.equal(rs.cronCadence('17 6 3 * *'), 'monthly');
+  assert.equal(rs.cronCadence('17 * * * *'), 'hourly');
+});
+
+test('cronCadence refuses what its vocabulary cannot describe, rather than guessing', () => {
+  // Unclassifiable must mean "never matches a declared cadence" — the safe
+  // direction. A clever cron that silently counted as `weekly` would reopen
+  // exactly the drift this check exists to catch.
+  for (const expr of ['*/5 * * * *', '0 6 * * 1-5', '0 6 * * 1,4', '0 0 1 1 *', '17 6 * *', '', 'nonsense']) {
+    assert.equal(rs.cronCadence(expr), null, `${expr} should not classify`);
+  }
+  // A day-of-month AND day-of-week together is an OR in cron — neither period.
+  assert.equal(rs.cronCadence('17 6 3 * 1'), null);
+});
+
+test('workflowCrons reads every cron a workflow declares, quoted or bare, ignoring trailing comments', () => {
+  const y = ["  schedule:", "    - cron: '17 6 * * 1'", '    - cron: "0 3 * * *"', '    - cron: 5 * * * *  # bare + comment'].join('\n');
+  assert.deepEqual(rs.workflowCrons(y), ['17 6 * * 1', '0 3 * * *', '5 * * * *']);
+  assert.deepEqual(rs.workflowCrons(''), []);
+});
+
+// ------------------------------------------------------------- what counts as
+//                                                                an invocation
+
+test('invokesRoutine accepts the dispatcher form and a verbatim step command', () => {
+  assert.equal(rs.invokesRoutine('run: node scripts/gds/run-routine.js redteam-weekly', 'redteam-weekly'), true);
+  assert.equal(rs.invokesRoutine('run: node scripts/gds/run-routine.js --dry-run redteam-weekly', 'redteam-weekly'), true);
+  assert.equal(
+    rs.invokesRoutine('run: node scripts/gds/redteam-patrol.js --file', 'redteam-weekly',
+      [{ command: 'node scripts/gds/redteam-patrol.js --file' }]),
+    true);
+});
+
+test('invokesRoutine does not accept a prefix match for a different routine', () => {
+  // `redteam-weekly-v2` must not satisfy `redteam-weekly` — that would let a
+  // renamed routine keep the old one's green.
+  assert.equal(rs.invokesRoutine('node scripts/gds/run-routine.js redteam-weekly-v2', 'redteam-weekly'), false);
+});
+
+// ------------------------------------------------------------------ the check
+
+test('a routine fired weekly by a weekly cron passes', () => {
+  const { violations } = rs.evaluate(routines(WEEKLY), [WEEKLY_WF]);
+  assert.deepEqual(violations, []);
+});
+
+test('THE regression this check exists for: the cron drifts off the declared cadence', () => {
+  // Every existence/substring predicate in the repo stays green here — the file
+  // exists, the workflow still names the routine, the manifest needle still hits.
+  // Only a relational check sees it.
+  const drifted = { ...WEEKLY_WF, text: WEEKLY_WF.text.replace('17 6 * * 1', '17 6 3 * *') };
+  const { violations } = rs.evaluate(routines(WEEKLY), [drifted]);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /declares cadence: weekly but no scheduler fires it at that period/);
+  assert.match(violations[0], /→ monthly/);
+});
+
+test('dispatch-only is not scheduled — the exact state the audit called "decorative"', () => {
+  const manual = { ...WEEKLY_WF, text: WEEKLY_WF.text.replace(/  schedule:\n.*\n/, '') };
+  const { violations } = rs.evaluate(routines(WEEKLY), [manual]);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /carries no 'on: schedule:' cron \(manual dispatch only\)/);
+});
+
+test('a cadence with no scheduler at all is a violation where CI exists', () => {
+  const { violations } = rs.evaluate(routines(WEEKLY), []);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /NOTHING fires it/);
+});
+
+test('rename rot is caught from the other side: a scheduler dispatching a routine that is gone', () => {
+  const { violations } = rs.evaluate(routines([], [{ name: 'something-else' }]), [WEEKLY_WF]);
+  assert.equal(violations.length, 1, violations.join(' | '));
+  assert.match(violations[0], /dispatches routine 'redteam-weekly', which has no/);
+});
+
+test('a workflow naming its own invocation twice reports one problem, not two', () => {
+  const twice = { ...WEEKLY_WF, text: `# see run-routine.js redteam-weekly below\n${WEEKLY_WF.text}` };
+  const { violations } = rs.evaluate(routines([], []), [twice]);
+  assert.equal(violations.length, 1);
+});
+
+test('an unknown cadence word is refused rather than silently unenforceable', () => {
+  const { violations } = rs.evaluate(routines([{ name: 'r', cadence: 'fortnightly', steps: [] }]), []);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /unknown cadence "fortnightly"/);
+});
+
+test('an instance checkout (no .github/workflows) warns instead of red-building', () => {
+  // Routines are materialized into every instance; .github/workflows is the core
+  // repo's and does not travel. Hard-failing there would red every instance for
+  // owning a scheduler the core cannot see.
+  const { violations, warnings } = rs.evaluate(routines(WEEKLY), null);
+  assert.deepEqual(violations, []);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /NOTHING fires it/);
+});
+
+test('a routine with no cadence is a warning — it can only ever be run by hand', () => {
+  const { violations, warnings } = rs.evaluate(routines([], [{ name: 'manual-thing' }]), []);
+  assert.deepEqual(violations, []);
+  assert.match(warnings.join(' '), /declares no cadence/);
+});
+
+// --------------------------------------------------------------- the live tree
+
+test('the frontmatter parser reads cadence: alongside mode: and steps:', () => {
+  const md = ['---', 'mode: deterministic', 'cadence: weekly', 'description: d', 'steps:',
+    '  - command: node x.js', '    sink: gds', '---', '# body'].join('\n');
+  const fm = parseRoutineFrontmatter(md);
+  assert.equal(fm.cadence, 'weekly');
+  assert.equal(fm.mode, 'deterministic');
+  assert.equal(fm.steps.length, 1);
+  // Absent cadence must be null, not undefined — evaluate() branches on truthiness.
+  assert.equal(parseRoutineFrontmatter('---\nmode: deterministic\n---\n').cadence, null);
+});
+
+test('LIVE: redteam-weekly declares a cadence and this repo actually fires it', () => {
+  const r = rs.checkRoutineCadencesScheduled();
+  assert.equal(r.hardFail, false, r.violations.join(' | '));
+  assert.ok(rs.readRoutines().withCadence.some((x) => x.name === 'redteam-weekly'),
+    'redteam-weekly must declare a cadence — without it nothing can schedule it');
+});
+
+test('LIVE: the patrol workflow installs gitleaks, which the history scan cannot run without', () => {
+  // The follow-up audit listed the missing binary as its own gap; a scheduled
+  // patrol without it degrades to "history scan SKIPPED" every week forever.
+  const wf = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'redteam-patrol.yml'), 'utf8');
+  assert.match(wf, /GITLEAKS_BIN=/, 'the patrol must be handed a gitleaks binary');
+  assert.match(wf, /sha256sum -c -/, 'the binary must be checksum-verified (the tj-actions lesson)');
+  assert.match(wf, /fetch-depth: 0/, 'a shallow clone makes the history scan a confident no-op');
+});

package/tests/run_routine.mjs

@@ -49,8 +49,11 @@ test('a top-level key after steps ends the list', () => {
 });
 
 test('no frontmatter → empty contract', () => {
-  assert.deepEqual(parseRoutineFrontmatter('just a body'), { mode: null, steps: [], description: null });
-  assert.deepEqual(parseRoutineFrontmatter(''), { mode: null, steps: [], description: null });
+  // `cadence: null` joined the contract at task 1003209 — routine-schedule.js
+  // branches on its truthiness, so "absent" must be null, never undefined.
+  const empty = { mode: null, cadence: null, steps: [], description: null };
+  assert.deepEqual(parseRoutineFrontmatter('just a body'), empty);
+  assert.deepEqual(parseRoutineFrontmatter(''), empty);
 });
 
 test('mode-only frontmatter (judgment) → no steps', () => {