@bongos/core 1.19.370 → 1.19.372

package/docs/recipes/work-on-a-task-from-your-dev-box.md

@@ -1,12 +1,13 @@
 # Work on a task from your dev box
 
-> Your dev box is **task-scoped**: claim a task and the box pulls **only the code
-> that task needs** — the module(s) its work touches, on top of a small base
-> instance — never the whole repo. Your GitHub token never leaves the server; the
-> box fetches its slice through the control plane. See
-> [ADR 0148](../adr/<redacted>.md) (the scope model) and
-> [ADR 0150](../adr/<redacted>.md) (how the box
-> comes up).
+> Your dev box serves your **rank scope**: Metic+ boxes carry the **whole repo**;
+> newcomer (starter) boxes carry the safe starter surface. Task-scoped slices are
+> **paused** per [ADR 0193](../adr/<redacted>.md) (the
+> machinery from [ADR 0148](../adr/<redacted>.md) remains;
+> `BOX_TASK_SCOPE=on` re-enables it). Your GitHub token never leaves the server —
+> see "How git works on a box" below, and
+> [ADR 0150](../adr/<redacted>.md) for how the
+> box comes up.
 
 ## TL;DR
 
@@ -15,32 +16,48 @@ In your dev box's terminal:
 ```bash
 /builder-start          # see what you can claim
 /builder-claim <N>      # claim task N (locks it to your session)
-/builder-sync           # pull task N's code onto the box now (re-scopes in place)
+/builder-sync           # pull the latest main onto the box right now
 # …work in /workspace…
 /builder-ship           # smoke + review, then land + deploy — awards credits
 ```
 
-That's the whole loop. `/builder-sync` is the new step: it materializes the claimed
-task's code within seconds instead of waiting for the box's ~10-minute refresh.
+That's the whole loop. `/builder-sync` pulls fresh code within seconds instead of
+waiting for the box's ~10-minute refresh.
+
+## How git works on a box — read this BEFORE diagnosing "stuck"
+
+The box holds **no stored git credential, ever** — and that is the design, not a
+fault ([ADR 0055](../adr/<redacted>.md)):
+
+- **Reads are server-mediated, per request.** Every remote git operation goes
+  through `/usr/local/bin/otb-git-credential`, which asks the control plane
+  (`GET /box/source-access`) for a **short-lived, read-only** credential. The
+  server checks your **live** rank + status on every single request — demotion or
+  deactivation cuts off the next fetch instantly.
+- **`git push` always fails with 403 here — by design.** The read credential
+  cannot write. Landing code is the server's job: `/builder-ship` uploads your
+  work, opens the PR, and lands it. Never try to fix the 403 by embedding a
+  token or editing git config.
+- **Source refreshes from `main` every ~10 minutes** (the `box-source-fetch`
+  cron; log at `/tmp/box-source-fetch.log`). `/builder-sync` runs the same fetch
+  on demand.
+- **If a remote git op says `could not read Username`, or the sync log shows
+  401:** the box's GDS session expired. Run `/builder-reauth`, then
+  `/builder-sync`. That is the whole fix.
+
+The box writes these same facts to `/workspace/CLAUDE.local.md` on every sync, so
+a Claude session on the box loads them automatically (the file is gitignored and
+box-written — don't edit it).
 
 ## The model — what's on your box
 
-A task-scoped box carries two layers:
-
-1. **The base instance** — always present, whatever you've claimed: the methodology
-   (`CLAUDE.md`, `.claude/`), the build tooling (`scripts/`, `src/bongos/`),
-   `docs/`, `infra/`, and the **test suite** (`tests/`). Enough for Claude to hold
-   context and run the `/builder-*` CLI, and to run your module's tests.
-2. **Your claimed task's code** — the module directories the task's goal scopes
-   (`goals.scope_modules` → globs, [ADR 0086](../adr/<redacted>.md)). Claim a `dev-box` task → you get
-   `modules/dev-box/`; claim a `game` task → you get the game world too. Nothing
-   else.
-
-What you do **not** get: other builders' modules, the product/game runtime (unless
-your task is game-scoped), and — the point — **no GitHub credential on the box**.
-The box asks the control plane (`GET /box/source-access`) for its slice on each
-fetch; the server holds the token and returns a scoped, cone-mode sparse-checkout
-spec. Lose the claim or a rank, and the next fetch is cut off at the server.
+- **Metic and above:** the full repo in `/workspace` — same tree as a laptop
+  clone, refreshed from `main` by the sync cron.
+- **Below Metic (starter):** the starter surface — methodology (`CLAUDE.md`,
+  `.claude/`), build tooling (`scripts/`, `src/bongos/`), `docs/`, `infra/`,
+  `tests/`, and the sandbox-runnable product code. Rank, checked live by the
+  server, is what bounds a box — not the task you claimed
+  ([ADR 0193](../adr/<redacted>.md)).
 
 ## Step by step
 
@@ -51,11 +68,10 @@ If you haven't yet, run **`/builder-connect`** (or follow the
 box, then **`/builder-setup`** once on the box to sign the Bongos CLI in. The browser
 terminal drops you into `/workspace` — the one working folder.
 
-> **`bongos shell` / `bongos code` re-scope on connect (BV1.R101).** Connecting with
-> either verb runs the sync for you first, so you land in `/workspace` already scoped
-> to your active claim — no manual `/builder-sync` needed just to arrive. (The browser
-> terminal drops you straight into `/workspace`; run `/builder-sync` there if you
-> claimed or switched since your last sync.)
+> **`bongos shell` / `bongos code` sync on connect (BV1.R101).** Connecting with
+> either verb runs the source fetch for you first, so you land in `/workspace`
+> already fresh. (The browser terminal drops you straight into `/workspace`; run
+> `/builder-sync` there if you want the latest immediately.)
 
 ### 2. See what you can claim — `/builder-start`
 
@@ -64,21 +80,18 @@ claims. Pick one.
 
 ### 3. Claim it — `/builder-claim <N>`
 
-Locks task N to your session. **This is what drives your box's scope:** source
-access is computed from your **active claim** — its task → goal → `scope_modules`.
+Locks task N to your session so no parallel session collides with your work.
 
-### 4. Pull the code now — `/builder-sync`
+### 4. Freshen the code — `/builder-sync`
 
-Re-runs the box's source-fetch immediately, so `/workspace` re-scopes to task N's
-modules within seconds. (A ~10-minute cron does this on its own as a backstop — you
-just don't want to wait for it.) Off a box there's nothing to sync — your source is
-your local checkout — and the command tells you so.
+Re-runs the box's source fetch immediately so `/workspace` is on the current
+`main` before you branch. (The ~10-minute cron does this on its own as a
+backstop.) Off a box there's nothing to sync — your source is your local
+checkout — and the command tells you so.
 
 ### 5. Work — in `/workspace`
 
-`/workspace` now holds the base instance **plus** task N's module code. One folder:
-when you switch tasks it **re-scopes in place**, so there are no per-task folders to
-manage.
+One folder, always. When you switch tasks, keep working in place.
 
 ### 6. Ship — `/builder-ship`
 
@@ -90,19 +103,20 @@ One box, one working folder, one active claim at a time (the server enforces
 one-claim-per-session). To move to a different task:
 
 1. `/builder-ship` (or `/builder-release`) the current claim.
-2. `/builder-claim <M>` the new one.
-3. `/builder-sync` — the box re-scopes to task M in place.
+2. `/builder-claim <M>` the new one — and keep working in `/workspace`.
 
 ## Notes + gotchas
 
-- **`tests/` is always in the base** — so a module's tests run on the box (they
-  live in the top-level `tests/`, not inside `modules/<key>/`).
-- **Idle boxes rest.** A box with no activity is reclaimed after ~10–15 min; the
-  next connect re-provisions a fresh one and re-fetches your scope. **Uncommitted
-  work on a reaped box is lost** — ship or commit before you step away.
+- **`tests/` is on every box** — a starter box can run the suite for the code it
+  holds (tests live in the top-level `tests/`, not inside `modules/<key>/`).
+- **Idle boxes park, they don't die.** After ~2 hours of no activity the box is
+  **parked**: a snapshot is kept and the droplet is destroyed, so compute billing
+  stops and a wake restores your filesystem. Only weeks of staying parked lead to
+  reclaim (with a warning first). Still: **ship or commit before you step away** —
+  a snapshot is a safety net, not a workflow.
 - **`/builder-sync` is idempotent** — safe to re-run; it just does, on demand, what
   the cron does on its schedule.
-- **A fresh box comes up with the base already cloned.** If a box ever comes up
+- **A fresh box comes up with the code already cloned.** If a box ever comes up
   *bare* (no code, no terminal), that's the packaging bug
   [ADR 0150](../adr/<redacted>.md) fixed on the
   control plane — flag it rather than working around it.

package/modules/hall-ui/public/dom-utils.js

@@ -269,11 +269,42 @@
     return (data && typeof data === 'object') ? data : {};
   }
 
+  // task 1003276 (goal 1000072, criterion legibility-categories) — a work
+  // CATEGORY as a chip. Lives HERE, not in goals-lib.js, because three surfaces
+  // render it — the Goals page, the Tasks board and the task page — and
+  // dom-utils.js is the only script all three load. One renderer means the
+  // goal's chip and the task's inherited chip cannot drift.
+  //
+  // A LABEL and nothing more: no href, no pointer affordance. A per-category
+  // destination would be a navigation tier, and that is precisely how an
+  // advisory word becomes the second hierarchy in practice even when no code
+  // gates on it (ADR 0192 — a category authorises nothing).
+  //
+  // `inherited` marks a TASK's chip. A task stores no category; it reads its
+  // goal's through goal_id, and saying so out loud stops anyone hunting for a
+  // per-task editor that does not exist.
+  //
+  // Uncategorised renders NOTHING rather than an "Uncategorised" pill: most
+  // goals will carry one, and a board of grey placeholders reads worse than a
+  // board with gaps. The Category filter's "not categorised yet" option is how
+  // you find them.
+  function categoryChip(category, opts) {
+    const label = category && category.label ? String(category.label).trim() : '';
+    if (!label) return '';
+    const inherited = !!(opts && opts.inherited);
+    const title = inherited
+      ? `Category: ${label} — inherited from this task's goal (a task carries no category of its own)`
+      : `Category: ${label}`;
+    return `<span class="gr-cat${inherited ? ' gr-cat--inherited' : ''}" title="${escapeHtml(title)}">`
+      + `${escapeHtml(label)}${inherited ? '<i class="gr-cat__from" aria-hidden="true">via goal</i>' : ''}</span>`;
+  }
+
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn,
     errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,
     contributeHallWidget, hallWidgets, hallWidgetIds,
     splitCriterion,
+    categoryChip, // task 1003276 — shared by the Goals page, the Tasks board and the task page
   };
 })();

package/modules/hall-ui/public/goals-page.js

@@ -228,6 +228,34 @@
     }
   }
 
+  // task 1003276 — the Category dropdown. Unlike Version and Owner (derived from
+  // the loaded goals), the options come from the project's SET — GET
+  // /work-categories — so a category nobody has used yet is still offered, and a
+  // client never hard-codes the labels ("present in every builders hall on any
+  // project" only holds if the vocabulary travels over the wire). The 'none'
+  // option finds the uncategorised, which is the set this feature exists to
+  // shrink. Best-effort: a failed fetch leaves the control with just "— any —".
+  async function populateCategoryFilter() {
+    const sel = $('#f-goal-category');
+    if (!sel) return;
+    let cats = [];
+    try {
+      cats = (await getJSON(`${API}/work-categories`))?.categories || [];
+    } catch (_) { return; }
+    for (const c of cats) {
+      const opt = document.createElement('option');
+      opt.value = c.slug;
+      opt.textContent = c.label;
+      sel.appendChild(opt);
+    }
+    if (cats.length) {
+      const opt = document.createElement('option');
+      opt.value = 'none';
+      opt.textContent = 'not categorised yet';
+      sel.appendChild(opt);
+    }
+  }
+
   // Archon check for the detail view's manage/visibility affordances (the
   // server-side rank gates are the real enforcement). The task-1760 drag-reorder
   // affordance this once also served is retired — see the note where
@@ -797,6 +825,9 @@
       // task 1003135 — fire-and-forget: the Owner options fill when the (cached)
       // directory resolves; boot never waits on a label lookup.
       populateOwnerFilter().catch(() => {});
+      // task 1003276 — same fire-and-forget posture: boot never waits on the
+      // category vocabulary, and the board renders fine before it lands.
+      populateCategoryFilter().catch(() => {});
       // Prefetch details (ring + members on the cards). Sequentially-parallel,
       // failure-tolerant: a card without detail still renders.
       // task 1002439 — also fold in per-goal task-readiness rollups (one request
@@ -859,6 +890,9 @@
       { id: 'f-goal-status', label: 'Status', options: [{ value: '', label: '— any —' }, 'open', 'achieved', 'archived'] },
       { id: 'f-goal-mine', label: 'Membership', options: [{ value: '', label: 'All goals' }, { value: 'mine', label: 'My goals' }] },
       { id: 'f-goal-owner', label: 'Owner', options: [{ value: '', label: '— any —' }] },
+      // task 1003276 — filled from GET /work-categories after boot
+      // (populateCategoryFilter), the populateOwnerFilter pattern.
+      { id: 'f-goal-category', label: 'Category', options: [{ value: '', label: '— any —' }] },
       { id: 'f-goal-order',
         label: 'Sort',
         value: GOAL_SORTS[savedGoalSort] ? savedGoalSort : undefined,

package/modules/hall-ui/public/goals-render.js

@@ -19,7 +19,7 @@
 
   window.OTBGoalsRender = function createGoalsRender(ctx) {
     const { API, curLabel, getJSON, patchJSON, postJSON, sameId, selfId, state } = ctx;
-    const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+    const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel, categoryChip } = window.OTB;
     const {
       priorityRank, touchesConflict, rankTagHtml, deHashRefs,
       creditsPerMinute, buildPromptForTask, friendlyBatchReason,
@@ -81,11 +81,18 @@
     const q = ($('#f-goals-search')?.value || '').trim().toLowerCase();
     const needle = q.replace(/^#/, '');
     const owner = $('#f-goal-owner')?.value || '';
+    // task 1003276 — the Category dropdown. Matches on the SLUG (the stable
+    // machine key) so re-wording a label never breaks a filter, and 'none' is
+    // the uncategorised set — which must be findable, because "what has nobody
+    // placed yet" is exactly the prompt this feature is built around.
+    const cat = $('#f-goal-category')?.value || '';
     const matchesSearch = (g) => !needle
       || String(g.id).includes(needle)
       || (g.title || '').toLowerCase().includes(needle);
     const matchesOwner = (g) => !owner
       || (owner === 'none' ? g.created_by == null : String(g.created_by) === owner);
+    const matchesCategory = (g) => !cat
+      || (cat === 'none' ? !g.category : (g.category?.slug === cat));
     const myId = selfId();
     const iAmMember = (g) => {
       const d = state.details.get(String(g.id));
@@ -96,6 +103,7 @@
       (!status || g.status === status) &&
       matchesSearch(g) &&
       matchesOwner(g) &&
+      matchesCategory(g) &&
       (!mineOnly || iAmMember(g)));
   }
   function goalStampHtml(g) {
@@ -127,10 +135,13 @@
       right = `<span class="gr-quiet">No tasks yet</span>`;
     }
     const metaHtml = `#${escapeHtml(String(g.id))} · ${escapeHtml(g.version_id || '')}${(achieved || g.status === 'open') ? '' : ' · ' + escapeHtml(g.status)}${goalStampHtml(g)}`;
-    return { r, achieved, ringHtml, goalHref, right, metaHtml };
+    // task 1003276 — the category chip. Computed here with the rest of the facts
+    // so the row and the card (task 1003136) cannot drift on it.
+    const catHtml = categoryChip(g.category);
+    return { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml };
   }
   function goalRowHtml(g) {
-    const { r, achieved, ringHtml, goalHref, right, metaHtml } = goalRenderFacts(g, 44);
+    const { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml } = goalRenderFacts(g, 44);
     // NOTE: a rollup row nests real links (title → goal, Claim → task overlay,
     // drill → goal), so the row itself is a <div>, not an <a> — nested anchors
     // are invalid. Only the explicit links navigate.
@@ -138,20 +149,20 @@
       <div class="gr-ringcol">${ringHtml}</div>
       <div class="gr-main">
         <a class="gr-title" href="${goalHref}"${subtitleAttr(g)}>${escapeHtml(g.title || 'Untitled goal')}</a>
-        <div class="gr-meta">${metaHtml}</div>
+        <div class="gr-meta">${metaHtml}${catHtml}</div>
         ${achieved ? '' : goalRollLine(r)}
       </div>
       <div class="gr-right">${right}</div>
     </div>`;
   }
   function goalCardHtml(g) {
-    const { r, achieved, ringHtml, goalHref, right, metaHtml } = goalRenderFacts(g, 36);
+    const { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml } = goalRenderFacts(g, 36);
     return `<div class="goal-card" data-goal-id="${escapeHtml(String(g.id))}">
       <div class="goal-card__head">
         <div class="gr-ringcol">${ringHtml}</div>
         <a class="goal-card__title gr-title" href="${goalHref}"${subtitleAttr(g)}>${escapeHtml(g.title || 'Untitled goal')}</a>
       </div>
-      <div class="goal-card__meta">${metaHtml}</div>
+      <div class="goal-card__meta">${metaHtml}${catHtml}</div>
       ${achieved ? '' : goalRollLine(r)}
       <div class="goal-card__foot">${right}</div>
     </div>`;
@@ -709,7 +720,10 @@
       // still never re-derives the protected roster.
       const gateSpan = g.scope_protected
         ? '<span class="goal-badge goal-badge--locked" title="Protected module scope — join by request; an Archon admits members">🛡 Archon-mediated</span>' : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
+      // task 1003276 — the human category, beside the machine-readable module
+      // scope so the difference is visible: `scope` is the wall that refuses work
+      // (ADR 0086); the chip is a word for a person and gates nothing (ADR 0192).
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${categoryChip(g.category)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
     }
 
     // task 1762: the goal's own owner/manager (or an Archon) can invite/manage

package/modules/hall-ui/public/style.css

@@ -2172,3 +2172,12 @@ html.palette-open { overflow: hidden; }
   .palette__panel { margin-top: 6vh; }
   .palette__group { min-width: 56px; }
 }
+/* task 1003276 — the human CATEGORY chip. Quiet by design: it sits beside the
+   meta line, not above the title, because it is a label a person scans, never a
+   status or a permission (ADR 0192). No hover/pointer affordance and no href —
+   a per-category destination would be a navigation tier, which is exactly the
+   second hierarchy this feature must not become. On a TASK the chip is the one
+   inherited from its goal, and says so, so nobody hunts for a per-task editor. */
+.gr-cat { display: inline-flex; align-items: baseline; gap: 5px; margin-left: 8px; padding: 1px 8px; border: 1px solid var(--rule-soft); border-radius: 999px; font-size: 11px; font-weight: 600; letter-spacing: .01em; color: var(--ink-soft); background: var(--surface-2); vertical-align: baseline; white-space: nowrap; }
+.gr-cat--inherited { font-weight: 550; color: var(--ink-faint); }
+.gr-cat__from { font-style: normal; font-weight: 500; font-size: 10px; color: var(--ink-faint); opacity: .85; }

package/modules/hall-ui/public/task.js

@@ -193,7 +193,7 @@
       `Task description:\n${desc}`;
   }
 
-  function renderTask(t, lastClaim, viewer) {
+  function renderTask(t, lastClaim, viewer, goal) {
     document.title = `#${t.id} — ${t.title || 'Task'} — ${document.title.split(' — ').pop()}`;
     const sub = $('#task-sub');
     if (sub) sub.textContent = `Task #${t.id}`;
@@ -222,7 +222,14 @@
     }
 
     if (t.goal_id) {
-      parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a></p>`);
+      // task 1003276 — the goal line names the goal and carries the category this
+      // task INHERITS from it. Two legibility fixes in one line: the link used to
+      // read "Goal #1000072", which tells a person nothing they didn't already
+      // know, and the chip answers "what kind of work is this" without opening
+      // the goal. Marked inherited because a task carries no category of its own.
+      const goalName = goal && goal.title ? ` — ${escapeHtml(goal.title)}` : '';
+      const catChip = window.OTB.categoryChip(goal && goal.category, { inherited: true });
+      parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a>${goalName}${catChip}</p>`);
     }
 
     // Claim history (task 751 — best-effort: the API surfaces the most recent
@@ -356,7 +363,17 @@
         const me = await getJSON(`${API}/me`, { softAuth: true });
         viewer = (me && me.builder) ? me.builder : null;
       } catch (_) { /* cosmetic — the server enforces regardless */ }
-      renderTask(d.task, d.last_claim || null, viewer);
+      // task 1003276 — the task's goal, for its name and the category the task
+      // inherits. Best-effort and non-blocking on failure: the page has always
+      // rendered without it, and a category is a nicety, never a prerequisite.
+      let goal = null;
+      if (d.task.goal_id != null) {
+        try {
+          const g = await getJSON(`${API}/goals/${encodeURIComponent(d.task.goal_id)}`, { softAuth: true });
+          goal = (g && g.goal) ? g.goal : null;
+        } catch (_) { /* cosmetic — the goal link still resolves without it */ }
+      }
+      renderTask(d.task, d.last_claim || null, viewer, goal);
     } catch (err) {
       if (err && err.code === AUTH_NEEDED) { toAuth(); return; }
       if (err && err.status === 404) { renderNotFound(id); return; }

package/modules/hall-ui/public/work.js

@@ -337,6 +337,12 @@
       // task 1002955: how old is this task? A ready queue reads as equally fresh
       // without it; the exact date rides the tooltip.
       const ageChip = window.OTBKit.ageChipHtml(t.created_at);
+      // task 1003276 — the category this task inherits from its goal, marked as
+      // inherited so nobody looks for a per-task editor that does not exist. It
+      // is a label only: it never filters or orders this board, because nothing
+      // a person may not act on should decide what the queue offers (ADR 0192).
+      const catChip = window.OTB.categoryChip(
+        (taskState.goalCategories || {})[String(t.goal_id)], { inherited: true });
       const selected = selection.claim.has(String(t.id));
       return `
         <div class="task${selected ? ' task--selected' : ''}" data-task-id="${t.id}">
@@ -358,6 +364,7 @@
               <span>${cpmText}</span>
               ${touchesChip}
               ${ageChip}
+              ${catChip}
             </div>
           </div>
           <div class="task__credits">
@@ -1071,9 +1078,17 @@
 
     // task 1755: goal id → title map for the Goal filter (best-effort).
     taskState.goalTitles = {};
+    // task 1003276 — a task INHERITS its goal's category (it stores none of its
+    // own), so the board resolves the label the same way the schema does: through
+    // goal_id. The goals fetch below is already made for the titles, so the chip
+    // costs no extra request and no server change.
+    taskState.goalCategories = {};
     try {
       const gr = await getJSON(`${API}/goals`);
-      (gr.goals || []).forEach((g) => { taskState.goalTitles[g.id] = g.title; });
+      (gr.goals || []).forEach((g) => {
+        taskState.goalTitles[g.id] = g.title;
+        taskState.goalCategories[g.id] = g.category || null;
+      });
     } catch (_) { /* filter labels fall back to 'Goal #id' */ }
 
     // Claimable + active claims in one call. A 403 means the primer gate — show

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.370",
+  "version": "1.19.372",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.370",
+      "version": "1.19.372",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.370",
+  "version": "1.19.372",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1170,8 +1170,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.368 with no explicit bump. run 32903289072. (task 1002620)
 //   1.19.370 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.369 with no explicit bump. run 32904231221. (task 1002620)
+//   1.19.371 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.370 with no explicit bump. run 32904582252. (task 1002620)
+//   1.19.372 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.371 with no explicit bump. run 32905166786. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.370'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.372'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');