@bongos/core 1.19.367 → 1.19.368

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.367",
-  "core_contract": "1.19.367",
-  "source_commit": "ff41cbee283990f68a2c9bf200a4c325dcfaafb8",
+  "core_version": "1.19.368",
+  "core_contract": "1.19.368",
+  "source_commit": "17b78f620a5cdc6f01af878404e8b11ebd9b2f77",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T21:38:46.917Z",
+  "built_at": "2026-08-25T21:47:56.330Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 332,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1895,
-  "tree_sha256": "a59dcfb6a265f28e9abf4bcd3428af1117f21091d32a5e4ea19e882d689eb0e4",
+  "tree_sha256": "f3b82bb092f3f91eea0a51d84cc52e1b31042d4e9ae32a5a54972a00e9816c39",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4892,12 +4892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "390ce17a741752f8e4ee90ad06761bf3618a389e4d5e4f2fbaa8292355686b1e"
+      "sha256": "a58b49638d9cbd5aa528a08b7435d6be48d636cb2574e7ed9b84b11850b296dd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3a8cef238a15b3d12a6f49fc9825ccf6723581e0c2764acd58f19a772cb10814"
+      "sha256": "225e8f6b5b696a25599e723f18cfb3d8da8382a8be2a85be2429b090445ce178"
     },
     {
       "path": "public-docs/index.html",
@@ -5972,7 +5972,7 @@
     {
       "path": "scripts/gds/redteam-patrol.js",
       "mode": "0000644",
-      "sha256": "b47919e09dae54b94a9f90c81bf535c00918dbd916f0d51c4bc29517dec9f7e9"
+      "sha256": "34e2a56646ad7b8f72c63ee3f8c6319ce523c3ee390d89740bf44d27190d2005"
     },
     {
       "path": "scripts/gds/regen-instance-docs.js",
@@ -6777,7 +6777,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4a12d31fe4599fab8030fbebb69bb6618756e7c6239b081fbd489b821e04e9c6"
+      "sha256": "c66c224c5bf1755a79ce4bcb6da90bfb72079ae5195b0b8758be067602329ab7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8862,7 +8862,7 @@
     {
       "path": "tests/redteam_patrol.mjs",
       "mode": "0000644",
-      "sha256": "2dbaca4570cdac06c9ebdf2447b9955edeb1afdd763f24d98faec2103001a9e9"
+      "sha256": "6dac9970bfdc8e5fd3940dc956b94963bc8ecdc345820de831078af614cf875f"
     },
     {
       "path": "tests/regrade_eligibility.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.367",
+  "version": "1.19.368",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.367",
+      "version": "1.19.368",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.367",
+  "version": "1.19.368",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/redteam-patrol.js

@@ -134,6 +134,43 @@ function lockedVersion(lock, name) {
   return entry && entry.version;
 }
 
+// Pure: what to say about ONE `overrides` entry. Extracted so the rule is a table
+// a test can enumerate — the networked half (npm view) stays outside.
+//
+// THE BUG THIS REPLACES (task 1003283, report 1000025). The old rule compared the
+// pinned MAJOR against `dist-tags.latest` and filed a medium whenever latest was
+// higher. That flags every override which deliberately holds a major line — which
+// is the normal reason an override exists at all. It fired on `undici ^6.28.0`
+// "while latest is 8.10.0", when 6.28.0 is the newest 6.x, `discord.js` (the only
+// consumer) requires the 6.x line, and `npm audit` finds nothing. Acting on it
+// would have BROKEN the dependent; ignoring it weekly is the alert-fatigue failure
+// ADR 0188 §2.4 exists to prevent — here inside the patrol itself.
+//
+// The real signal is narrower: a pin whose LOCKED version has fallen behind what
+// its own range already allows. That is rot nobody chose. Trailing the latest
+// major is reported as a NOTE instead, because only a human can say whether a
+// dependent still constrains the line.
+//
+// `satisfying` is every published version matching `range`, ASCENDING (npm's own
+// order), so the newest in-range version is simply the last element — no semver
+// comparator needed, and no dependency added to do it.
+function overrideVerdict({ name, range, locked, satisfying = [], latest = null } = {}) {
+  const newestInRange = satisfying.length ? satisfying[satisfying.length - 1] : null;
+  if (newestInRange && locked && newestInRange !== locked && satisfying.includes(locked)) {
+    return {
+      finding: { severity: 'medium', item: `stale override: ${name} is locked at ${locked} but its own pin "${range}" already allows ${newestInRange} — refresh the lockfile` },
+    };
+  }
+  const pinnedMajor = parseInt(String(range).replace(/^[^0-9]*/, ''), 10);
+  const latestMajor = parseInt(String(latest), 10);
+  if (Number.isFinite(pinnedMajor) && Number.isFinite(latestMajor) && latestMajor > pinnedMajor) {
+    return {
+      note: `override ${name} "${range}" trails the latest major (${latest}) — expected when a dependent requires that line; verify before lifting, do NOT bump blind`,
+    };
+  }
+  return {};
+}
+
 function dependencyReview() {
   const findings = [];
   const notes = [];
@@ -175,16 +212,19 @@ function dependencyReview() {
     }
   }
 
-  // 2c — override staleness (the undici lesson: a pin nobody watches rots).
+  // 2c — override staleness (the undici lesson: a pin nobody watches rots) —
+  // measured INSIDE the pinned range, see overrideVerdict above.
   for (const [name, range] of Object.entries(pkg.overrides || {})) {
     if (typeof range !== 'string') continue;
     const latest = npmViewJson(`${name} dist-tags.latest`);
-    if (!latest) continue;
-    const pinnedMajor = parseInt(String(range).replace(/^[^0-9]*/, ''), 10);
-    const latestMajor = parseInt(String(latest), 10);
-    if (Number.isFinite(pinnedMajor) && Number.isFinite(latestMajor) && latestMajor > pinnedMajor) {
-      findings.push({ severity: 'medium', item: `stale override: ${name} pinned "${range}" while latest is ${latest} — re-justify or lift the pin` });
-    }
+    // Every published version matching the range, ascending. npm returns a bare
+    // string when exactly one matches, so normalise to an array.
+    const matched = npmViewJson(`"${name}@${range}" version`);
+    const satisfying = matched == null ? [] : (Array.isArray(matched) ? matched : [matched]);
+    if (!latest && !satisfying.length) { notes.push(`npm view failed for override ${name} — staleness check skipped`); continue; }
+    const v = overrideVerdict({ name, range, locked: lockedVersion(lock, name), satisfying, latest });
+    if (v.finding) findings.push(v.finding);
+    if (v.note) notes.push(v.note);
   }
   return { findings, notes };
 }
@@ -393,5 +433,5 @@ if (require.main === module) {
 module.exports = {
   parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
   buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
-  stepSummary, filingBlocker, disposition,
+  stepSummary, filingBlocker, disposition, overrideVerdict,
 };

package/src/module-api.js

@@ -1164,8 +1164,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.365 with no explicit bump. run 32895705036. (task 1002620)
 //   1.19.367 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.366 with no explicit bump. run 32902059088. (task 1002620)
+//   1.19.368 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.367 with no explicit bump. run 32902864988. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.367'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.368'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/redteam_patrol.mjs

@@ -128,3 +128,73 @@ test('filingBlocker reports a sessionless runner instead of exiting with re-auth
   assert.doesNotMatch(r.stdout + r.stderr, /builder-reauth/,
     'the sessionless path must not print interactive re-auth guidance into a cron log');
 });
+
+// ---------------------------------------------------------------------------
+// overrideVerdict (task 1003283, report 1000025). The first scheduled patrol run
+// filed a medium saying `undici` was "pinned ^6.28.0 while latest is 8.10.0".
+// It was wrong: 6.28.0 IS the newest 6.x, discord.js (the only consumer) requires
+// the 6.x line, and npm audit finds nothing — acting on it would have broken the
+// dependent, and ignoring it weekly is the alert-fatigue failure the patrol is
+// supposed to avoid. These pin the narrower rule that replaced it.
+// ---------------------------------------------------------------------------
+
+test('a pin holding a major line on purpose is a NOTE, never a finding', () => {
+  // THE regression. An override exists precisely to hold a line; "latest is a
+  // higher major" is the expected steady state, not a defect.
+  const v = p.overrideVerdict({
+    name: 'undici', range: '^6.28.0', locked: '6.28.0',
+    satisfying: ['6.24.1', '6.27.0', '6.28.0'], latest: '8.10.0',
+  });
+  assert.equal(v.finding, undefined, 'a deliberate major pin must not file weekly forever');
+  assert.match(v.note, /trails the latest major/);
+  assert.match(v.note, /do NOT bump blind/);
+});
+
+test('a lock that trails what the pin already allows IS a finding — rot nobody chose', () => {
+  const v = p.overrideVerdict({
+    name: 'undici', range: '^6.28.0', locked: '6.27.0',
+    satisfying: ['6.27.0', '6.28.0'], latest: '8.10.0',
+  });
+  assert.equal(v.finding.severity, 'medium');
+  assert.match(v.finding.item, /locked at 6\.27\.0 but its own pin .* already allows 6\.28\.0/);
+  assert.equal(v.note, undefined, 'the actionable finding replaces the note, not doubles it');
+});
+
+test('a current pin with no newer major says nothing at all', () => {
+  const v = p.overrideVerdict({
+    name: 'x', range: '^3.1.0', locked: '3.4.0', satisfying: ['3.1.0', '3.4.0'], latest: '3.4.0',
+  });
+  assert.deepEqual(v, {});
+});
+
+test('no npm data produces silence, not a guess', () => {
+  // A registry failure must not read as "the pin is fine" OR invent a finding —
+  // the caller adds an explicit skipped-check note instead.
+  assert.deepEqual(p.overrideVerdict({ name: 'x', range: '^3.0.0', locked: '3.0.0', satisfying: [], latest: null }), {});
+  assert.deepEqual(p.overrideVerdict(), {});
+});
+
+test('a locked version OUTSIDE the declared range is not reported as a stale lock', () => {
+  // If the lock does not satisfy the range at all, the mismatch is a different
+  // (worse) problem than "refresh the lockfile", and this rule must not mislabel
+  // it — the `satisfying.includes(locked)` guard is what keeps that honest.
+  const v = p.overrideVerdict({
+    name: 'x', range: '^6.0.0', locked: '5.9.9', satisfying: ['6.0.0', '6.1.0'], latest: '6.1.0',
+  });
+  assert.equal(v.finding, undefined);
+});
+
+test('LIVE: the repo\'s own overrides produce no medium finding today', () => {
+  // The end state report 1000025 should have had. Uses the committed package.json
+  // + lockfile, with the registry answers stubbed to what they really are, so the
+  // assertion is hermetic but not fictional.
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
+  const ranges = Object.entries(pkg.overrides || {}).filter(([, r]) => typeof r === 'string');
+  assert.ok(ranges.length > 0, 'this test is pointless if the repo declares no overrides');
+  for (const [name, range] of ranges) {
+    const locked = p.lockedVersion(lock, name);
+    const v = p.overrideVerdict({ name, range, locked, satisfying: [locked], latest: '99.0.0' });
+    assert.equal(v.finding, undefined, `${name} should not file a medium: ${JSON.stringify(v)}`);
+  }
+});