@bongos/core 1.19.372 → 1.19.373

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.372",
-  "core_contract": "1.19.372",
-  "source_commit": "55e9c32ab7bdeda662fa00ca1ac329f7c9350f35",
+  "core_version": "1.19.373",
+  "core_contract": "1.19.373",
+  "source_commit": "fbe2ff6cdfb5154f956f0a473085ad2f55a9e7e2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T22:14:48.327Z",
+  "built_at": "2026-08-25T22:26:30.155Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 334,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1901,
-  "tree_sha256": "d935d4f065823168da32ef35c6b17f66ecb8937ea59a28be97e7aafc26cfa39d",
+  "tree_sha256": "028f3591a335092742ce9ca6791ae17cc69d690bbe3895e09e10742a648eb04e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -147,7 +147,7 @@
     {
       "path": ".claude/skills/goal-create/SKILL.md",
       "mode": "0000644",
-      "sha256": "e52032cb787f813a84e16a16c0ac75751ca111ad16f5502cf5f6bd8fb7a91068"
+      "sha256": "88494b0c9604992c43fb0efbb5d2cc34de51fd3645e7d65b22a65f0538e8f26f"
     },
     {
       "path": ".claude/skills/goal-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f918564f73e753583651a8d963824c981cd82dc02d1e0d809d245e541219513e"
+      "sha256": "bebe9282f7f60c62dc554c24bbec1fb7c9a8453e98015d5207c3b70260bcbb56"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1277,7 +1277,7 @@
     {
       "path": "docs/adr/0161-publish-on-merge.md",
       "mode": "0000644",
-      "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
+      "sha256": "b625ad07227ce25f8fe082fa9ccd93d3d704fd726aceb967d1f43677e164239a"
     },
     {
       "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
@@ -1382,7 +1382,7 @@
     {
       "path": "docs/adr/0180-dependency-intake-and-drift-policy.md",
       "mode": "0000644",
-      "sha256": "62de8180208c3945c7a040b2b2799dceafd59b1c5a117aab7db56a57eb538e44"
+      "sha256": "9d50f2f71de5c4eba8d5af40aca201c6e054b1eec937a9e1342d1bb3b4ce45c1"
     },
     {
       "path": "docs/adr/0181-teardown-state-gate-and-address-retention.md",
@@ -1477,7 +1477,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ada26795f34a9ce26711b788abc87bf277c475aa14ee7bb1f92e9376f1e50cc8"
+      "sha256": "dbc90270a1754caf816ce9fde9cde35af21e977da08309f56c4d96dbf7cad9bf"
     },
     {
       "path": "docs/architecture.md",
@@ -4102,7 +4102,7 @@
     {
       "path": "modules/lifecycle/goal-category.js",
       "mode": "0000644",
-      "sha256": "6bc1bc0152900b49d79a6c09560020dc96ff5fae6c78d7dbb84d72dfed1953d2"
+      "sha256": "5b64317b3c687a08c80d0ebe78619b6b4bb8a9cdf4cf37673a0f29785fd5a7ca"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -4212,7 +4212,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "5e01d0da935758aa24c8f13d2f4e97d9f561c2b1044b326fb4184c5dbc4bf6fb"
+      "sha256": "db587e3a79c76671cdba1900bfdce156d62d0ef270319adb82a3b0805f3d091c"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -4902,12 +4902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2f3c61f9360a509a95f00a50e5b297f727fa3ad9a0eb4dc60d237c7367c82962"
+      "sha256": "01e0ec5418014e61e5a0bdf1781ea84ee46c4c8bfc1b63b0e55bb6397ec06498"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f3dca0d69c0457b6ff3a4fcc16f01eedb758732e5e2fec7f5cfe65c82782b2df"
+      "sha256": "f38add7db0b96f5b469c5127f7e06336ef5626edc93d61f797d3439e0ca51760"
     },
     {
       "path": "public-docs/index.html",
@@ -5367,7 +5367,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "9709fcffab1d386c174666788687b1dfd974f141ab552ffd5641abd690259619"
+      "sha256": "7289ba7894edd4ae6154615f2464c55ee8c8835f3c61988dbad2354aaafeac2e"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -6792,7 +6792,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d5baf1741759cab821c57eb5c9b701e4e256838612b81835102c6286447f884e"
+      "sha256": "88ea06ed6759765c78ff0fc67ddd0a65041e7b8fda60e0f18b5809c44107ad7d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7217,7 +7217,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "98ec16d513074b30de8cd897143e4a3df1b3e54132a09d015b99e13e870de384"
+      "sha256": "b7c9d529eba81e1e7ea11aaed734e3a30355483cf69972453c3bb03fdd3aab97"
     },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
@@ -7767,7 +7767,7 @@
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
-      "sha256": "19e6987712231ac54e58c4b6658d12bb7df3d6681344bf358c38c1655243f058"
+      "sha256": "05d46d4dcfd3a3b21ef0fc258263081cf4e624bdef4348daf84a90da589387c3"
     },
     {
       "path": "tests/goal_category_ui.mjs",

package/.claude/skills/goal-create/SKILL.md

@@ -63,6 +63,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 - **Title** — the outcome the goal owns, not a task list. One line.
 - **`description`** — 2–4 sentences: what is true when this goal is achieved, and what it explicitly does not cover.
 - **`scope_modules`** — infer from the planned work's file paths, then **verify every key against `moduleKeys()`**. An unknown key is a hard `400 unknown_module` (the response helpfully returns the full valid roster). Keep it tight: the wall is set here and only here. **No covering key?** Do not invent one — file a `kind='refactor'` prep task scoped to `kernel` to extend `MODULE_GLOBS`, and make this goal's tasks depend on it.
+- **`category_id`** — the goal's HUMAN category (task 1003277; ADR 0192 — advisory, it gates nothing). Read the live set with `GET /api/gds/work-categories` (never hard-code the labels), infer the best fit from the goal's outcome and its `scope_modules`, and state your pick in the Phase-4 approval round like every other drafted field. **When nothing in the set fits, that is a designed prompt, not an error**: do NOT silently pick the nearest, and do NOT leave it null and move on — surface the gap in the gray-area round and offer to create a new category (`POST /api/gds/work-categories` with `{"label":"..."}`; a duplicate slug converges on the existing row), then use it. Creating uncategorised stays legal — if the user declines to name one, POST the goal without `category_id` and note that the 201 body will carry a `category_advisory` reminding whoever looks next.
 - **`succeeds_goal_id`** — set it when carrying an achieved goal forward. `POST /goals` validates the predecessor exists *before* creating, so a bad ref can't orphan a goal; it then stamps the predecessor's `succeeded_by_goal_id`. Archiving the predecessor is a **separate** call.
 - **Criteria — 2 to 4.** A goal's criteria are narrower than a version's: each should plausibly anchor 2–5 tasks. Draft `criterion_id` as a stable kebab slug (position-independent, and what `criterion_ids` on `POST /tasks` should reference); `criterion_md` is the outcome prose.
 - **Seed tasks — 3 to 8.** Per criterion, with `kind`, a one-line done-when, `criterion_ids: ["<slug>"]`, and dependency edges. Omit `touches[]` (advisory, ADR 0049 — backfilled from the real diff at ship). Never hand-set `requires_rank` (auto-derives, ADR 0084). Proof tasks use `kind='verify'`; exploration uses `kind='spike'` (and spikes are deliberately left in backlog).
@@ -72,7 +73,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 Two rounds at most, both via **AskUserQuestion**.
 
 1. **Gray-area round — at most one round, at most 4 questions, often zero.** A question earns its place only if the work is genuinely underspecified on it, reasonable people would disagree, **and** the answer changes the goal's shape. Put your recommendation first and leave room for "Other". Legitimate gray areas: where this goal's boundary falls against an adjacent one; whether a module belongs inside the wall or is a dependency; whether this succeeds a prior goal or replaces it; whether a criterion belongs to this goal or the version. **Do not ask** anything the goal board, the criteria list, or `moduleKeys()` already answers, and never ask a yes/no rubber-stamp.
-2. **The approval round — always exactly one, always last.** Present the goal (title · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
+2. **The approval round — always exactly one, always last.** Present the goal (title · category · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
 
 ## Phase 5 — Land it (write order: goal → criteria → tasks)
 
@@ -81,10 +82,12 @@ The order is forced: a criterion needs `goal_id`, a task needs both `goal_id` an
 > **Always `--body-file`, never inline `--body`, for anything carrying a title, description or criterion prose.** Those strings are authored in this session and routinely contain an apostrophe ("the builder's hall"), which terminates a single-quoted shell argument and corrupts the JSON — or, with a hostile string, runs whatever follows on the builder's machine. Write the body to a temp `.json` file and pass its path. On Windows also heed `scripts/gds/CLAUDE.md`: do **not** create that file with `Out-File`/`>` (the UTF-8 BOM breaks `JSON.parse`), and never pipe `api.js` through `2>&1` (its banner goes to stderr by design).
 
 ```
-# 5a — the goal. STRICT validation: exactly these five fields are accepted
-#      (version_id*, title*, description, scope_modules[], succeeds_goal_id).
+# 5a — the goal. STRICT validation: exactly these seven fields are accepted
+#      (version_id*, title*, subtitle, description, scope_modules[], succeeds_goal_id, category_id).
 #      ANY other key is a 400 unknown_field — do NOT pass criteria, tasks, lead or visibility.
-#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"]}
+#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"],"category_id":<id>}
+#   category_id comes from GET /api/gds/work-categories (task 1003277); omitting it is
+#   legal — the 201 body then carries a category_advisory, never a refusal.
 #   carry-forward: add "succeeds_goal_id":<prior_goal_id>
 node scripts/gds/api.js POST /api/gds/goals --body-file <path-to-goal.json>
 # → 201 {ok, goal, succeeds_goal_id}. CAPTURE goal.id.

package/clients/bongos-client/index.d.ts

@@ -252,7 +252,7 @@ export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; chang
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
 export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number }
-export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
+export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }

package/docs/adr/0161-publish-on-merge.md

@@ -22,7 +22,7 @@ The consumption side (ADR 0136's subscription) was never the problem; supply was
 
 1. **Every merge to `main` publishes.** A `publish` workflow fires on the `unit` check succeeding on a main push (never on a red suite), builds via `package-core` — the fail-closed no-leak gate and `--self-verify` pin check run inside the build — publishes (restricted), and tags `core-v<version>`.
 2. **CI bumps PATCH only.** When a merge lands without a human bump, `scripts/gds/bump-version.js` bumps the patch and writes the changelog line (shape-preserving; pinned by `tests/bump_version.mjs`). A **minor or major stays a deliberate in-task human edit** — it is a statement about the doorway surface, and it decides what patch-channel subscribers receive unattended (ADR 0136). CI is not allowed to make that call.
-3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
+3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. **Superseded for the npm half at task 1003202 (2026-08-25):** the write token is gone — the lane publishes via OIDC trusted publishing (ADR 0180), so no long-lived npm credential exists to steal. `RELEASE_PUSH_TOKEN` remains, as the bump commit still needs contents:write. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
 4. **Idempotent by version-compare.** The bump commit re-triggers `unit` → `publish`, which then finds HEAD's version already on npm and no-ops. npm's duplicate-version rejection is the backstop; concurrent merges queue behind a no-cancel concurrency group.
 
 ## Consequences

package/docs/adr/0180-dependency-intake-and-drift-policy.md

@@ -31,6 +31,12 @@ The consensus post-Shai-Hulud control is a **release-age cooldown** (don't insta
 
 The publish-on-merge lane (ADR 0161) authenticates with a long-lived `NPM_TOKEN` repository secret — exactly the credential class the Sept-2025 attacks monetized, and why GitHub revoked classic tokens and capped granular ones at 90 days. Decision: **adopt npm trusted publishing (OIDC)** — no long-lived secret, provenance for free. It needs a one-time owner action on npmjs.com (register the repo+workflow as a trusted publisher for `@bongos/core`), filed as a blocker. **Until then** the granular `NPM_TOKEN` remains a *documented exception*: 90-day expiry, publish-only scope, rotated on expiry.
 
+> **Landed 2026-08-25 — task 1003202, blocker 1000115 resolved.** The owner registered the trusted publisher; `publish.yml` now carries `id-token: write` and publishes with no secret. Three things this needed that the decision above did not anticipate, each of which fails SILENTLY if missed:
+>
+> - **npm ≥ 11.5.1.** Node 22 ships npm 10.x, which ignores the OIDC token and publishes unauthenticated. The lane now installs a pinned npm and refuses to continue below that version.
+> - **Provenance had to be turned OFF.** Trusted publishing enables it by default and npm *refuses* to generate provenance from a **private source repository** — so the "provenance for free" clause above does not apply to this repo, and leaving the default would have failed every publish.
+> - **The registry could no longer answer "is this version taken?".** `@bongos/core` is private, so an unauthenticated `npm view` is a flat `E404` rather than a "no", and OIDC authenticates `npm publish` and nothing else. Keeping that check would have skipped the auto-bump on every run and collided on the published version — **breaking after exactly one release**. The lane now reads its own `release: core X.Y.Z` commits (`laneReleasedVersions`), which need no auth and are the source the cascade terminator already trusts.
+
 ## What this deliberately does not cover
 
 New-dependency *intake vetting* (registry existence/age/download checks — the slopsquatting defense) lives in the weekly patrol (task 1003128), and one-off vulnerability *fixes* (sharp ≥ 0.35 for the libvips CVEs, the colyseus chain for nanoid) are ordinary tasks that shrink the baseline — filed in the idea inbox at adoption time.

package/docs/api/openapi.json

@@ -18019,12 +18019,14 @@
             "type": "boolean"
           },
           "goal": {},
-          "succeeds_goal_id": {}
+          "succeeds_goal_id": {},
+          "category_advisory": {}
         },
         "required": [
           "ok",
           "goal",
-          "succeeds_goal_id"
+          "succeeds_goal_id",
+          "category_advisory"
         ]
       },
       "PostGovernmentAssignmentsRequest": {

package/modules/lifecycle/goal-category.js

@@ -134,6 +134,33 @@ async function setGoalCategory({ goalId, categoryId }, deps = {}) {
   return rows[0] ?? null;
 }
 
+// -------------------------------------------------------------------------
+// The advisory (task 1003277)
+// -------------------------------------------------------------------------
+
+// adviseCategory — PURE, FAIL-OPEN (the goal-advisory.js posture: this is advice
+// appended to a request that ALREADY SUCCEEDED, so a wrong guess must nag nobody).
+// Returns null when the goal is categorised, or the advisory body when it is not.
+//
+// The criterion is explicit about what an uncategorised goal IS: "Claude assigns
+// where it can; where it cannot, the human is prompted to create a new category —
+// that failure is a designed prompt, not an error." So the advisory carries the
+// live SET (so the client can offer real choices, never hard-coded labels) and
+// names the create endpoint (so the prompt has somewhere to write into). It never
+// escalates past advice — the moment a missing category can refuse a write, the
+// label has become a gate (ADR 0192).
+function adviseCategory({ categoryId, categories = [] } = {}) {
+  if (categoryId != null) return null;
+  return {
+    reason: 'uncategorised',
+    message: 'This goal has no human category yet. A category orients a person scanning the board '
+      + '(it gates nothing — ADR 0192). Pick one from the set below via PATCH /goals/:id/category, '
+      + 'or — if none fits — ask the human to name a new one and create it with POST /work-categories: '
+      + 'that failure is a designed prompt, not an error.',
+    categories: categories.map((c) => ({ id: String(c.id), slug: c.slug, label: c.label })),
+  };
+}
+
 // -------------------------------------------------------------------------
 // Decoration
 // -------------------------------------------------------------------------
@@ -263,6 +290,7 @@ module.exports = {
   isValidSlug,
   listCategories,
   getCategory,
+  adviseCategory,
   createCategory,
   setGoalCategory,
   decorateGoalCategory,

package/modules/lifecycle/routes/goals.js

@@ -129,7 +129,16 @@ module.exports = function buildGoalsRouter() {
       if (succeedsId != null) {
         await db.setGoalSuccessor({ goalId: succeedsId, successorId: goal.id });
       }
-      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId });
+      // task 1003277 — the category advisory, the goal_advisory precedent: advice
+      // on a request that already succeeded, null when the goal has a category.
+      // Best-effort: a failed set read must not turn advice into a 500.
+      let category_advisory = null;
+      if (categoryId === null) {
+        try {
+          category_advisory = goalCategory.adviseCategory({ categoryId, categories: await goalCategory.listCategories() });
+        } catch (_) { /* fail-open — advice only */ }
+      }
+      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory });
     } catch (err) {
       log.error('[gds] POST /goals', err);
       return res.fail('goal_create_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.372",
+  "version": "1.19.373",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.372",
+      "version": "1.19.373",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.372",
+  "version": "1.19.373",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -86,5 +86,45 @@ function isReleaseCommit(subject) {
   return RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
 }
 
-module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit };
+// laneReleasedVersions — every version THIS lane has announced it published, read
+// from its own release commits (task 1003202).
+//
+// WHY THIS EXISTS. publish.yml used to answer "is HEAD's version already on the
+// registry?" with `npm view @bongos/core@<v>`. That needs a credential:
+// @bongos/core is PRIVATE, so an unauthenticated read is a flat E404, not a
+// "no". Moving the lane to OIDC trusted publishing removes the token — and OIDC
+// only authenticates `npm publish`, nothing else — so the old check would have
+// silently reported "not taken" on EVERY run, skipped the auto-bump, and then
+// collided on the already-published version. It would have looked fine for
+// exactly one release.
+//
+// The answer is already in the repo. Every version this lane ships is announced
+// by a `release: core X.Y.Z — CI auto-patch carrier` commit it writes itself, and
+// RELEASE_COMMIT_RE above is that contract. So the registry is not the only place
+// that knows; git knows too, needs no auth, and is the same source the cascade
+// terminator already trusts.
+//
+// Deliberately shares RELEASE_COMMIT_RE with isReleaseCommit, so a HUMAN release
+// commit ("release: core 1.19.2 — carrier for the init-blocker fixes") is NOT
+// counted here either — that version is new and still needs publishing, which is
+// exactly the distinction the constant was written to make.
+//
+// BOTH failure directions are safe, which is what makes this acceptable on a
+// release-critical lane:
+//   • commit written, publish then failed  → version looks taken, next run bumps
+//     past it. A gap in the version sequence; harmless.
+//   • published, commit push then failed   → version looks free, the publish
+//     retries and npm refuses with EPUBLISHCONFLICT. Loud, and nothing wrong ships.
+function laneReleasedVersions(subjects = []) {
+  const out = new Set();
+  for (const subject of subjects) {
+    const line = String(subject == null ? '' : subject);
+    if (!RELEASE_COMMIT_RE.test(line)) continue;
+    const m = /^release: core (\d+\.\d+\.\d+) /.exec(line);
+    if (m) out.add(m[1]);
+  }
+  return out;
+}
+
+module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit, laneReleasedVersions };
 if (require.main === module) main();

package/src/module-api.js

@@ -1174,8 +1174,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.370 with no explicit bump. run 32904582252. (task 1002620)
 //   1.19.372 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.371 with no explicit bump. run 32905166786. (task 1002620)
+//   1.19.373 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.372 with no explicit bump. run 32906118616. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.372'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.373'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bump_version.mjs

@@ -16,7 +16,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { bumpPatch, CONST_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const bump = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const { bumpPatch, CONST_RE } = bump;
+// The LIVE test below reads this repo's real release history (task 1003202).
+const { execFileSync } = require('node:child_process');
 
 const SAMPLE = [
   '// prologue',
@@ -111,3 +114,76 @@ test('publish.yml wires the terminator: guard step present, every armed step gat
   const gates = (PUBLISH_YML.match(/steps\.relhead\.outputs\.release_head == 'false'/g) || []).length;
   assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, tag) — found ${gates}`);
 });
+
+// ---------------------------------------------------------------------------
+// laneReleasedVersions — the token-free "is this version already published?"
+// (task 1003202 / blocker 1000115, the OIDC trusted-publishing migration).
+//
+// publish.yml used to ask the REGISTRY, which needs a credential: @bongos/core is
+// private, so an unauthenticated `npm view` is a flat E404 rather than a "no".
+// OIDC authenticates `npm publish` and nothing else, so keeping that check would
+// have reported "not taken" every run, skipped the auto-bump, and collided on the
+// published version — working for exactly one release before breaking. git holds
+// the same answer, needs no auth, and is the source the cascade terminator above
+// already trusts.
+// ---------------------------------------------------------------------------
+
+test('laneReleasedVersions reads the versions this lane announced', () => {
+  const subjects = [
+    'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'Merge pull request #385 from lars589/some-branch',
+    'release: core 1.19.367 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'feat(security): something unrelated',
+  ];
+  const v = bump.laneReleasedVersions(subjects);
+  assert.deepEqual([...v].sort(), ['1.19.367', '1.19.368']);
+  assert.equal(v.has('1.19.369'), false, 'a version never announced must read as free');
+});
+
+test('a HUMAN release commit is NOT counted — that version still needs publishing', () => {
+  // The same distinction RELEASE_COMMIT_RE was written to make for the cascade
+  // terminator. Counting it here would skip the publish of a hand-cut release.
+  const v = bump.laneReleasedVersions([
+    'release: core 1.19.2 — carrier for the init-blocker fixes',
+    'release: core 1.20.0 — hand-cut minor',
+  ]);
+  assert.equal(v.size, 0);
+});
+
+test('malformed and empty input yields an empty set, never a throw', () => {
+  // This runs inside the publish lane. A crash here would take down releases;
+  // an empty set degrades to "nothing is taken", which the publish itself
+  // catches with EPUBLISHCONFLICT — loud, and nothing wrong ships.
+  assert.equal(bump.laneReleasedVersions([]).size, 0);
+  assert.equal(bump.laneReleasedVersions().size, 0);
+  assert.equal(bump.laneReleasedVersions([null, undefined, '', 42]).size, 0);
+});
+
+test('laneReleasedVersions and isReleaseCommit agree on what a lane release looks like', () => {
+  // They share RELEASE_COMMIT_RE on purpose: if one ever recognises a subject the
+  // other does not, the cascade terminator and the version check disagree about
+  // the same commit, and the lane either double-publishes or silently no-ops.
+  const subjects = [
+    'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'release: core 1.19.2 — carrier for the init-blocker fixes',
+    'chore: not a release at all',
+  ];
+  for (const s of subjects) {
+    const counted = bump.laneReleasedVersions([s]).size === 1;
+    assert.equal(counted, bump.isReleaseCommit(s), `disagreement on: ${s}`);
+  }
+});
+
+test('LIVE: the version HEAD declares is one this lane already released', () => {
+  // The steady state the lane depends on: HEAD carries the version set by the
+  // previous release commit, so `taken` is true and the auto-bump fires. If this
+  // ever reads false on a normal main checkout, the lane would try to republish
+  // an existing version.
+  const headVersion = /^const CORE_VERSION = '([0-9.]+)';/m
+    .exec(fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8'))[1];
+  const subjects = execFileSync('git', ['log', '--format=%s', 'HEAD'], { encoding: 'utf8', cwd: ROOT }).split('\n');
+  const released = bump.laneReleasedVersions(subjects);
+  assert.ok(released.size > 100, `expected a long release history, saw ${released.size}`);
+  assert.equal(released.has(headVersion), true,
+    `HEAD declares ${headVersion}, which this lane has no release commit for — the auto-bump would not fire`);
+});

package/tests/goal_category.mjs

@@ -145,6 +145,34 @@ test('an unknown category is a 404, not a silently-created one', async () => {
   assert.equal(res.statusCode, 404);
 });
 
+// ---- the advisory (task 1003277) --------------------------------------------
+
+test('an uncategorised goal earns an advisory that carries the live set and the create path', () => {
+  const adv = gc.adviseCategory({ categoryId: null, categories: [
+    { id: 3, slug: 'security', label: 'Security' },
+    { id: 6, slug: 'economics', label: 'Economics' },
+  ] });
+  assert.equal(adv.reason, 'uncategorised');
+  assert.deepEqual(adv.categories.map((c) => c.slug), ['security', 'economics'],
+    'the live set rides along so a client offers real choices, never hard-coded labels');
+  assert.match(adv.message, /POST \/work-categories/, 'the prompt has somewhere to write into');
+  assert.match(adv.message, /designed prompt, not an error/, 'the criterion\'s own framing travels with the advice');
+  assert.match(adv.message, /gates nothing/, 'and so does the rule that outranks the feature');
+});
+
+test('a categorised goal gets NO advisory — silence, the fail-open posture', () => {
+  assert.equal(gc.adviseCategory({ categoryId: 3, categories: [] }), null);
+});
+
+test('the advisory is advice on a 201, never a refusal', () => {
+  // Pinned in source: POST /goals attaches category_advisory to its SUCCESS body
+  // and never fails the create over it (best-effort, wrapped in try).
+  const routes = read('modules', 'lifecycle', 'routes', 'goals.js');
+  assert.match(routes, /category_advisory = goalCategory\.adviseCategory/);
+  assert.match(routes, /res\.status\(201\)\.json\(\{ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory \}\)/,
+    'it rides the 201 — advice appended to a request that already succeeded');
+});
+
 // ---- decoration ------------------------------------------------------------
 
 test('a goal carries a readable category, and an uncategorised one carries null', () => {