@bongos/core 1.19.435 → 1.19.436

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.435",
-  "core_contract": "1.19.435",
-  "source_commit": "93f1acd4ec60f7f6d7c3241e716a7a2c25315f02",
+  "core_version": "1.19.436",
+  "core_contract": "1.19.436",
+  "source_commit": "a1241e98d95626ad0f0e4fb92e0bf5570ebd1d19",
   "source_ref": "HEAD",
-  "built_at": "2026-08-30T01:56:28.344Z",
+  "built_at": "2026-08-30T02:36:42.560Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 367,
+    "docs_redacted": 369,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1740,
+    "functional_verbatim": 1743,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2130,
-  "tree_sha256": "f47b962f793eb603e2233c230c31e64d83e1c9d0059a8e68f40c27badabb6f72",
+  "file_count": 2135,
+  "tree_sha256": "fb1407f644a9e1ce28d901f454bb38108b7de3165d3aca0ae74533bf44192727",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -259,6 +259,16 @@
       "mode": "0000644",
       "sha256": "0f5cb8e895c5bcb5e4901d8adce8c1394f6bbba2615a78837f5cc9393c841b09"
     },
+    {
+      "path": ".claude/skills/strand-fix/SKILL.md",
+      "mode": "0000644",
+      "sha256": "9a0b4f5bebdf780c4bfadde487146cb8ab5d08b3a748ee8623f336d7cbec5291"
+    },
+    {
+      "path": ".claude/skills/worktree-clean/SKILL.md",
+      "mode": "0000644",
+      "sha256": "18ac872b38786a748b597351304ccead88a3f8f795b18ac7a258b558997921f6"
+    },
     {
       "path": ".devcontainer/Dockerfile",
       "mode": "0000644",
@@ -1977,7 +1987,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "b0b9355c79b2f1caa965baf8afd645140d341f30a56483a3724697611e20322a"
+      "sha256": "6029a720937dd848e9fb4c39f7adc8b4d096b077a211899a8ec3a78654b1e425"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1987,7 +1997,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a143667876a68f55e726b5342461ebb87ef424c43b73de5d234f13df0ab9e333"
+      "sha256": "8261227744e98ae0628e0f819b9df602e3f7417ccc23b1753f6314a74ac3b9ce"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5597,12 +5607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bbd8414f9a02067c7742dfbfdf0c5ec5a386330994822a47867d2d04b6b2b29e"
+      "sha256": "6a868844044c8ad9bb4914949f7787e746f9e88fc03c2517a10a3aa3c31f0962"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5cbdd7b7313ace6d7481d61088e1c29805ccd2df5ba21368f28bdfe4fcf7fd8e"
+      "sha256": "185654794f0cbca9357dd5804fb45bf89fed4d8c358b2e6b0ffab14f1c2806f7"
     },
     {
       "path": "public-docs/index.html",
@@ -7269,6 +7279,11 @@
       "mode": "0000755",
       "sha256": "dfd5aa72caa26eb2c8cf3063e1b4f51e1f4bcd7fddcdd93d243279c130850628"
     },
+    {
+      "path": "scripts/gds/stale-worktrees.js",
+      "mode": "0000644",
+      "sha256": "40c5ef66ef5efc3754da367e64604af765d2e595986fc7af1af10f793d1a57e0"
+    },
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
@@ -7732,7 +7747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1ff4e0ce398b437fc6cfadfaede99b6b977e108e8cf820ef3b954d49163be38f"
+      "sha256": "61dda9cd35bcb286dd5573c96baded0e1c651945c7249113131f9b50e7f767f0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8689,6 +8704,11 @@
       "mode": "0000644",
       "sha256": "da4904efa11dbce4d4a61e0d0936d58d5566f89337dd855f4cdfab9e649626c2"
     },
+    {
+      "path": "tests/git_guard.mjs",
+      "mode": "0000644",
+      "sha256": "1b0b13310fb1afa544784d18fe0fa3ac2abc0f5ecc01e3ec0cb71c227df296ae"
+    },
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
@@ -10414,6 +10434,11 @@
       "mode": "0000644",
       "sha256": "27bd2a87e001eec2bc58e13cfa58e53f88c73ebe7504b944c718182247d98ca7"
     },
+    {
+      "path": "tests/stale_worktrees.mjs",
+      "mode": "0000644",
+      "sha256": "e003d6391d14212198c0e55494190e702adc0a27c2820362afe3d676c67a4963"
+    },
     {
       "path": "tests/start_env_guard.mjs",
       "mode": "0000644",

package/.claude/skills/strand-fix/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: strand-fix
+description: Walk ONE stranded ship to landed — a task parked at `confirmed` that the server reconciler has already probed and given up on (`needs_rebase_reason` = `strand:no_branch_no_tip` or `strand:land_not_proven`), the shape the SessionStart line calls "will never self-heal". Finds where the work actually is (a main commit, an unpushed local branch, a conflicting PR, or nowhere), does the one sanctioned move for that case, and verifies the flip to `shipped`. Also the fix for a claim refused `409 REBASE_REQUIRED` — that gate is one of YOUR strands. Triggers when the user says "/strand-fix N", "fix strand N", "task N is stranded", "land the strand", "my claim says REBASE_REQUIRED", or after the SessionStart "Stranded ships:" line names a task. For a `completed` (ungraded) task use `/grade-recover`; for a `confirmed` task with no strand reason use `/merge-mode`.
+requires: [gh]
+---
+
+You are landing one stranded task. The reconciler is not coming back for it — a strand produces no signal of its own, so nothing happens until someone walks it.
+
+## Preflight (first, always)
+
+```bash
+node scripts/gds/skill-preflight.js strand-fix   # exits 1 naming what is MISSING (gh)
+```
+
+## Which shape is this? (read first)
+
+`node scripts/gds/strand-watch.js --json` — find the task. Three shapes, three owners:
+
+| shape | status | reason | this skill? |
+|---|---|---|---|
+| `unprovable` | confirmed | `strand:*` | **yes** — below |
+| `unlanded` | confirmed | none | no → `/merge-mode` |
+| `ungraded` | completed | none | no → `/grade-recover` |
+
+## The walk (unprovable only)
+
+1. **Find the work.** In the main checkout:
+   ```
+   git fetch -q origin
+   git branch -a --list "*N*"
+   git log origin/main --oneline --grep="N" | head
+   gh pr list --search "N" --state all --json number,state,mergeable,url
+   ```
+2. **Pick the ONE matching case.**
+   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed (the ship deleted the branch before the reconciler probed — task 1002724). Flip it: `node scripts/gds/api.js POST /api/gds/tasks/N/ship --body '{}'`. Credits land here (ADR 0120).
+   - **B. A local branch exists with commits ahead of `origin/main` and no PR**: the ship never pushed. From that worktree: `git push -u origin <branch>` then `gh pr create --base main --head <branch> --fill`. Green `unit` → server auto-merge → the reconciler flips it within ~5 min. If it merges but does not flip, do **A**.
+   - **C. A PR exists but is `CONFLICTING`**: the branch owner rebases it (`git merge origin/main`, resolve, push) — not this skill, and never `--force`. Report the PR URL and stop.
+   - **D. Nothing anywhere** — no branch, no PR, no commit: a codeless confirm. Ask what the task delivered. Work done outside this repo (on the box's instance checkout, a DB-only change captured in the ship note) is legitimately artifact-free → **A** with the reason in the ship body: `--body '{"note":"codeless: <where the work lives>"}'`. If the work was never done, release it instead so it returns to `ready`: `node scripts/gds/release.js N --reason "stranded codeless confirm; nothing delivered"`.
+3. **Verify**: `node scripts/gds/api.js GET /api/gds/tasks/N` → `"status": "shipped"` (or `ready` after a release). Re-run `strand-watch.js --line` — the task must be gone from it. If the claim gate was the symptom, `claim.js` now succeeds.
+
+## Rules
+
+- One task per invocation; the strand list is short and every case differs.
+- Never `git push origin main`, never force-push, never re-`confirm` around the grader — the fix is always land, flip, or release.
+- Wrong shape → hand off (`/merge-mode`, `/grade-recover`) instead of improvising.
+- No claim is needed to walk someone else's strand — landing confirmed work is the reconciler's job, and this is its manual fallback (Metic+; the ship route is rank-gated server-side).

package/.claude/skills/worktree-clean/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: worktree-clean
+description: Remove the per-claim worktrees whose work already landed — every shipped task leaves a `.claude/worktrees/task-N` behind, and nothing else prunes them. Lists what is stale (branch merged into origin/main, or branch already deleted by the ship), shows the list, then removes each through the junction-safe `worktree.js remove` — never raw `git worktree remove`, which follows the node_modules junction into the shared node_modules (task 1002809). Triggers when the user says "/worktree-clean", "clean up worktrees", "prune stale worktrees", "remove old worktrees", or when the SessionStart line reports "Stale worktrees: N".
+---
+
+**Script skill (authoritative).** Two scripts do the work; this skill only sequences them and shows the list before anything is removed.
+
+## What this skill does
+
+1. `node scripts/gds/stale-worktrees.js` — the list. A worktree is **stale** when its branch is an ancestor of `origin/main` (the land happened) or the branch is gone (the ship deleted it). Detached worktrees and unmerged branches are **live** and never touched. Run `git fetch origin` first so "merged into main" reflects today's main, not the last fetch.
+2. Show the stale list to the builder (names + why). The worktree holding the **current claim** is never stale by construction (its branch is unmerged), but say so if the builder asks.
+3. For each stale name: `node scripts/gds/worktree.js remove <name>`. That helper unlinks any node_modules junction BEFORE `git worktree remove`, which is the whole reason raw git is off-limits here (learning in `scripts/gds/CLAUDE.md` → "Gotchas / invariants"; the `git-guard.js` PreToolUse hook blocks the raw form).
+   - A worktree with untracked leftovers (`.playwright-mcp/`, a stray screenshot) refuses without `--force`. Show the `git -C <path> status --porcelain` output; if it is only untracked junk, re-run with `--force`. If it shows **modified tracked files**, skip it and report — someone's uncommitted work is not this skill's to delete.
+4. `git worktree prune` — clears any registrations whose directory is already gone.
+5. Print the tally: removed / skipped (with why) / still live. Stale branches stay — a merged branch is harmless and `git branch -d` is the ship's business, not a cleanup chore.
+
+## Safety
+
+- Read-only until step 3; the list is shown first.
+- Never `--force` over modified tracked files.
+- Never deletes branches, never touches the primary checkout, never calls `git worktree remove` directly.
+- No claim is needed: worktrees are local machine state, not project state — nothing here is committed.
+
+## Calls
+
+`node scripts/gds/stale-worktrees.js [--json]` · `node scripts/gds/worktree.js remove <name> [--force]` · `git worktree prune`.

package/docs/file-map.md

@@ -183,6 +183,7 @@
 │       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
 │       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills. Task 1002927 / R151 taught it the GRADES: `--full --fields-file f.json` files a Full Idea, `--spark` is capture-then-mark (two requests — the route refuses a pre-marked capture), and after a plain quick capture it OFFERS to develop further. That offer is TTY-gated (`--no-prompt` too): capture.js is run by agents with no terminal and reads its body from stdin, so an unguarded prompt would hang every non-interactive caller
 │       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145 + 1002922 / R146) the whole spark handoff from the terminal: mark one of your OWN quick ideas as a Big Idea Spark (`--undo` withdraws it), `--list` is the SPARK QUEUE, `--template` prints the five Full Idea fields, `--develop <id> --fields-file <json>` is the PICKUP (any builder; author + developer both recorded). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
+│       ├── stale-worktrees.js   ← (task 1003365) the per-claim worktrees whose branch already landed on origin/main or is gone — pure git facts, no API; `--line` is the SessionStart probe, `/worktree-clean` walks the list through worktree.js remove
 │       ├── worktree-claim-guard.js ← (task 1002579) the PURE decision behind worktree-per-claim, enforced at claim time: claiming in the MAIN CHECKOUT is refused (escape hatch `--here` → loud warning), a linked worktree passes, an unclassifiable tree fails open. Stops the ship-time "the main checkout is on <branch>, not main" strand at its cause
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
@@ -413,7 +414,9 @@ tests/
 ├── recall/SKILL.md                ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
 ├── scan-before-install/SKILL.md   ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
 ├── session-handoff/SKILL.md       ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
-└── status/SKILL.md                ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
+├── status/SKILL.md                ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
+├── strand-fix/SKILL.md            ← /strand-fix N — walk ONE stranded confirmed task (strand:no_branch_no_tip / land_not_proven — the shape the reconciler gave up on) to shipped: find the work (main commit / unpushed branch / conflicting PR / nowhere), do the one sanctioned move, verify the flip; also clears a 409 REBASE_REQUIRED claim gate (task 1003365)
+└── worktree-clean/SKILL.md        ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/gds/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)
 ```
 <!-- END GENERATED FILE-MAP .claude/skills/ -->
 
@@ -422,7 +425,25 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-└── redteam-weekly/SKILL.md  ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
+├── bfg/SKILL.md                       ← nightly BFG pass (MAS Phase 6, ADR 0026) — doc/memory hygiene + DB counter-vs-ledger drift (Part A), per-builder interaction scoring into transferable-practice suggestions (Part B), and the audited cross-builder memory write (Part C, OFF unless BFG_WRITE_ENABLED) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── bfg-session-eval/SKILL.md          ← nightly session-inefficiency evaluator (MAS Phase 6D, ADR 0027) — mines the session corpus for wasteful sessions and files the fixes as idea_inbox rows plus a docs/audits report (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── box-dormant-reclaim/SKILL.md       ← daily control-plane sweep that fully de-provisions dev boxes parked longer than BOX_DORMANT_DAYS, destroying the leftover snapshot and pinging the builder (ADR 0031 §5(a)); a no-op on an instance with no managed boxes (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── box-idle-suspend/SKILL.md          ← hourly control-plane sweep that DESTROYS idle dev boxes — droplet and snapshot, not a reversible park — once BOX_IDLE_MINUTES elapses with no heartbeat (ADR 0031 §5(a), task 804) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── core-update-subscription/SKILL.md  ← daily patch-only auto-upgrade of subscribed consumer instances (ADR 0136) — deterministic `subscribe.js` step, health-gated with auto-rollback; opt-in and autonomy-gated, so a no-op until an operator arms it (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── dep-audit-nightly/SKILL.md         ← nightly dependency-vulnerability scan (`scripts/security/dep-audit.js`) across npm and the droplet's system packages; findings become idea_inbox rows plus one vulnerability_report per high/critical (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── diagram-drift/SKILL.md             ← daily deterministic backstop that re-derives the onboarding diagrams from migrations plus the live version API and files an idea when the committed ones have drifted (`check.js --file-idea`) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── idea-triage-nightly/SKILL.md       ← nightly autonomous idea_inbox walk — promotes high-confidence ideas to tasks, discards obvious noise, defers anything ambiguous; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── main-audit/SKILL.md                ← post-merge trust-boundary backstop (ADR 0043 / SEC 863) — audits commits landed on main for sub-Metic edits to permission-sensitive surfaces (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── newcomer-floor/SKILL.md            ← daily check that the three evergreen newcomer chores (engineer / artist / ideator) stay stocked; the server restocks them via modules/onboarding/newcomer-restock.js (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── newcomer-generator/SKILL.md        ← daily deterministic generator (`generate.js`) that tops the newcomer_friendly task queue back up to its floor (criterion C1 — newcomer queue always populated) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── overnight-builder/SKILL.md         ← autonomous overnight session-runner — claims the highest-priority safe task, works it end-to-end and ships it; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── overnight-code-review/SKILL.md     ← nightly autonomous code-quality review; each finding lands as its own idea_inbox row so it survives triage; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── peer-vote-tally/SKILL.md           ← deterministic tally (`tally.js`) folding builder-on-builder peer votes at least 7 days old into karma_log rows (criterion C2) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── redteam-weekly/SKILL.md            ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
+├── repo-simplify-sweep/SKILL.md       ← weekly repo-cleanliness janitor — runs repo-metrics, files dead-code findings to idea_inbox, and auto-fixes only the narrow safe class (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── security-review-weekly/SKILL.md    ← weekly security-state review — stale vulnerability_reports, ageing security-tagged tasks, recent high/critical dependency alerts; one Archon broadcast when anything is stale, silent otherwise (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop — aggregates 24h of skill invocations into friction findings filed as `[skill-friction]` idea_inbox rows (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+└── stale-claim-release/SKILL.md       ← hourly sweep releasing claims whose session_pulses heartbeat has been silent for GDS_STALE_CLAIM_HOURS, returning the task to ready and pinging the builder (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 
@@ -432,6 +453,11 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 
 ```
 .claude/hooks/
+├── secret-gate.js            ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit|Bash): cooperative, fail-OPEN block of secret-shaped content before it reaches the tree or a shell (task 1003125, ADR 0022)
+├── git-guard.js              ← PreToolUse (Bash): same contract as secret-gate — blocks `git stash` (repo-global stack, learning 1000215), raw `git worktree remove` (follows the node_modules junction, task 1002809), `git push origin main` (PR-only) and `git branch -D`, each with its remedy; kill-switch BONGOS_GIT_GUARD_OFF=1 (task 1003365)
+├── _core-resolve.js          ← shared helper, not a hook: locates a core module/script across the monolith vs `node_modules/@cloudbongos/core` layouts; required by most hooks here and by four routine scripts under `.claude/scheduled-tasks/`
+├── cascade-route.js          ← PreToolUse (Task|Agent): cheapest-sufficient start-model advisory for a subagent spawn (ADR 0024); inert unless OTB_AUTONOMY_ENABLED=1
+├── land-watch-card.js        ← UserPromptSubmit: delivers the SHIPPED banner once an async CI land completes (reads `scripts/gds/land-watch.js`)
 ├── worktree-guard.js         ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit): DENY a write that lands in the wrong git checkout (main/sibling worktree) when the session is in a worktree — hands back the corrected worktree path. Fail-open; opt-out OTB_ALLOW_CROSS_TREE=1 (V4.R13, [#951](https://example.com/builders#/task/951))
 ├── session-start.js          ← SessionStart: <redacted> .env.local into a fresh worktree, then chains onboarding-ship + rank-change greeting + memory pull
 ├── rank-change-greeting.js   ← promotion/demotion greeting (V3.R28 #249); spawned by session-start.js, also runnable standalone
@@ -442,11 +468,10 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 ├── lifecycle-card.js         ← PostToolUse: deterministic delivery of MUTATING lifecycle cards (claim/ship/release) — the write-side mirror of session-cards.js (task 1288)
 ├── pre-compact.js            ← PreCompact: thin reader around eviction-policy.js — emits an eviction directive (blocks to drop + one-line recovery stubs) at the compaction seam (task 1349)
 ├── eviction-policy.js        ← pure deterministic in-session compaction classifier (transcript turns → eviction set + replacement stubs); no I/O, unit-tested in tests/eviction_policy.mjs; consumed by pre-compact.js (task 1348)
-├── stop-sound.js             ← ⚠ ABSENT from this repo (see the note below). Superseded anyway: the turn-end sound is now `scripts/gds/turn-end-sound.js`, wired as the Stop hook in `.claude/settings.json` and cross-platform rather than macOS-only (task 1003272)
 └── stop-refcheck.js          ← Stop: deterministic backstop that catches a bare `#NNN` Bongos ref in live session text (autolinks to a 404 GitHub issue) and asks for the clickable form (follow-on to task 929)
 ```
 
-> **⚠ THIS TREE IS STALE: 12 of the 13 files listed above are NOT in this repo** — only `secret-gate.js` exists on disk, and `.claude/settings.json` wires just `SessionStart` (three `scripts/gds/*` probes + the sound-prefs mirror), `PreToolUse` (secret-gate) and `Stop` (`scripts/gds/turn-end-sound.js`). The hook tree went the same way as `.claude/sounds/` — absent from every commit, lost when core was re-seeded to 1.18.0 (task 1003272 found and fixed the sound half of that). Do not assume a hook named here runs; check `.claude/settings.json`. Auditing and either restoring or deleting the other twelve is its own task, not a doc edit.
+> Restored in task 1003365 from the box's pre-re-seed checkout: the tree was lost when core was re-seeded to 1.18.0 (task 1003272 found the sound half; this brought back the rest). `stop-sound.js` was NOT restored — `scripts/gds/turn-end-sound.js` superseded it. Every hook above is wired in `.claude/settings.json`, which is the authority on what actually runs.
 
 (Before [#671](https://example.com/builders#/task/671) these ran via `bash` shims — `sync-env-local.sh`, `conductor.sh`, `onboarding-ship-logs.sh`, `rank-change-greeting.sh`, `pull-memory.sh` — which failed on Windows without Git Bash. The Node entries above replaced them.)
 

package/docs/module-api-changelog.md

@@ -1307,5 +1307,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.433 with no explicit bump. run 33281881764. (task 1002620)
   1.19.435 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.434 with no explicit bump. run 33286790214. (task 1002620)
+  1.19.436 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.435 with no explicit bump. run 33288364716. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.435",
+  "version": "1.19.436",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.435",
+      "version": "1.19.436",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.435",
+  "version": "1.19.436",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/stale-worktrees.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// scripts/gds/stale-worktrees.js — the worktrees whose work already landed.
+//
+// Worktree-per-claim (task 1642, enforced at claim time by worktree-claim-guard.js)
+// means every shipped task leaves a `.claude/worktrees/task-N` behind unless someone
+// removes it. Nothing did: the 2026-08-29 audit (task 1003365) found 74 dirs for 70
+// shipped tasks. A stale worktree costs disk, slows `git worktree list`, and — the
+// real hazard — tempts a builder into `git worktree remove`, which follows the
+// node_modules junction into the SHARED node_modules (task 1002809).
+//
+// "Stale" needs no API call: a worktree is stale when its branch is already an
+// ancestor of origin/main (the land happened) or its branch is gone (the ship
+// deleted it). Both are pure git facts, so this runs in well under a second at
+// SessionStart. The primary checkout is never listed.
+//
+// Usage:
+//   node scripts/gds/stale-worktrees.js --line   # ONE line, or nothing; always exit 0
+//   node scripts/gds/stale-worktrees.js --json   # { stale: [{name, path, branch, why}], live: [...] }
+//   node scripts/gds/stale-worktrees.js          # human report; exit 0 clean, 1 stale found
+//
+// Removal is deliberately NOT here — `/worktree-clean` walks this list through
+// `node scripts/gds/worktree.js remove <name>`, the junction-safe path.
+
+'use strict';
+
+const { execFileSync } = require('child_process');
+const path = require('path');
+
+const MAIN_REF = 'origin/main';
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+}
+
+// Parse `git worktree list --porcelain` into [{path, branch|null, isMain}].
+function parseWorktreeList(porcelain) {
+  const out = [];
+  let cur = null;
+  for (const raw of String(porcelain).split('\n')) {
+    const line = raw.trim();
+    if (line.startsWith('worktree ')) {
+      cur = { path: line.slice('worktree '.length), branch: null, isMain: out.length === 0 };
+      out.push(cur);
+    } else if (cur && line.startsWith('branch ')) {
+      cur.branch = line.slice('branch '.length).replace(/^refs\/heads\//, '');
+    }
+  }
+  return out;
+}
+
+// Pure classifier so the decision is unit-testable without a repo: `isMerged(branch)`
+// and `branchExists(branch)` are the two git facts it needs.
+function classifyWorktrees(worktrees, { isMerged, branchExists }) {
+  const stale = [];
+  const live = [];
+  for (const wt of worktrees) {
+    if (wt.isMain) continue;
+    const name = path.basename(wt.path);
+    if (!wt.branch) { live.push({ name, path: wt.path, branch: null }); continue; } // detached: not ours to judge
+    if (!branchExists(wt.branch)) stale.push({ name, path: wt.path, branch: wt.branch, why: 'branch gone' });
+    else if (isMerged(wt.branch)) stale.push({ name, path: wt.path, branch: wt.branch, why: 'merged into main' });
+    else live.push({ name, path: wt.path, branch: wt.branch });
+  }
+  return { stale, live };
+}
+
+// Three git calls total, whatever the worktree count: the list, every local branch,
+// every branch already merged into origin/main. Per-worktree subprocesses would be
+// N+1 over exactly the number this probe exists to shrink.
+function refNames(out) {
+  return new Set(String(out).split('\n').map((s) => s.trim()).filter(Boolean));
+}
+
+function scan(cwd) {
+  const worktrees = parseWorktreeList(git(['worktree', 'list', '--porcelain'], cwd));
+  const existing = refNames(git(['for-each-ref', '--format=%(refname:short)', 'refs/heads/'], cwd));
+  let merged;
+  try { merged = refNames(git(['branch', '--merged', MAIN_REF, '--format=%(refname:short)'], cwd)); }
+  catch { merged = new Set(); } // no origin/main yet (fresh clone, no fetch) → nothing is provably stale
+  return classifyWorktrees(worktrees, {
+    branchExists: (b) => existing.has(b),
+    isMerged: (b) => merged.has(b),
+  });
+}
+
+function lineFor(r) {
+  if (!r.stale.length) return '';
+  const names = r.stale.slice(0, 6).map((s) => s.name).join(', ');
+  const more = r.stale.length > 6 ? ` +${r.stale.length - 6} more` : '';
+  return `Stale worktrees: ${r.stale.length} whose work already landed (${names}${more}). `
+    + 'Run /worktree-clean — never `git worktree remove` (it follows the node_modules junction).';
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  const cwd = process.cwd();
+  let r;
+  try { r = scan(cwd); } catch (e) {
+    if (argv.includes('--line')) process.exit(0); // fail-open: a probe never blocks a session
+    console.error(`stale-worktrees: undetermined — ${e.message || e}`);
+    process.exit(2);
+  }
+  if (argv.includes('--json')) { console.log(JSON.stringify(r, null, 2)); return; }
+  if (argv.includes('--line')) { const l = lineFor(r); if (l) console.log(l); return; }
+  console.log(`  Worktrees: ${r.live.length} live, ${r.stale.length} stale`);
+  for (const s of r.stale) console.log(`    stale  ${s.name}  (${s.why})`);
+  for (const l of r.live) console.log(`    live   ${l.name}  [${l.branch || 'detached'}]`);
+  if (r.stale.length) { console.log('  Remove with: node scripts/gds/worktree.js remove <name>   (or /worktree-clean)'); process.exit(1); }
+}
+
+if (require.main === module) main();
+
+module.exports = { parseWorktreeList, classifyWorktrees, lineFor };

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.435'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.436'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/git_guard.mjs

@@ -0,0 +1,119 @@
+// tests/git_guard.mjs — the PreToolUse gate that refuses four raw git shapes.
+// The gate's contract: exit 2 (blocked, reason on stderr) on `git stash`,
+// `git worktree remove`, `git push origin main`, and `git branch -D`; exit 0 on
+// everything else — including the read-only `git stash list`, the supported
+// worktree remover, and any payload it does not understand. It is the cooperative
+// layer (ADR 0043 shape), so every unknown input fails OPEN.
+//
+// Spawned rather than called in-process (unlike tests/secret_gate.mjs, which
+// exercises decide() directly) because the EXIT CODE is the whole contract with
+// Claude Code: 2 blocks the tool call, anything else lets it through.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOOK = path.join(ROOT, '.claude', 'hooks', 'git-guard.js');
+
+// Run the hook exactly as Claude Code does: the PreToolUse payload on stdin.
+function runHook(stdin, env = {}) {
+  const r = spawnSync(process.execPath, [HOOK], {
+    input: stdin,
+    encoding: 'utf8',
+    env: { ...process.env, BONGOS_GIT_GUARD_OFF: '', ...env },
+  });
+  return { status: r.status, stderr: r.stderr || '' };
+}
+
+function bash(command, env) {
+  return runHook(JSON.stringify({ tool_name: 'Bash', tool_input: { command } }), env);
+}
+
+test('blocks every git stash form except the read-only list', () => {
+  for (const cmd of [
+    'git stash',
+    'git stash push -m "wip"',
+    'git stash pop',
+    'git stash show -p',
+    'git -C ../wt-1003346 stash',
+    'cd ../wt-1003346 && git stash save "before the merge"',
+  ]) {
+    const r = bash(cmd);
+    assert.equal(r.status, 2, `expected block for: ${cmd}`);
+    assert.match(r.stderr, /git-guard: blocked/);
+    assert.match(r.stderr, /commit on your own branch/);
+  }
+});
+
+test('blocks git worktree remove and points at the supported remover', () => {
+  for (const cmd of [
+    'git worktree remove ../wt-1003346',
+    'git worktree remove --force ../wt-1003346',
+    'git -C /repo worktree remove wt-1',
+  ]) {
+    const r = bash(cmd);
+    assert.equal(r.status, 2, `expected block for: ${cmd}`);
+    assert.match(r.stderr, /scripts\/gds\/worktree\.js remove/);
+  }
+});
+
+test('blocks a direct push to main in both refspec forms', () => {
+  for (const cmd of [
+    'git push origin main',
+    'git push origin HEAD:main',
+    'git push origin feature/x:main',
+    'git push --force origin main',
+    'git push -u origin main',
+    'cd "$CLAUDE_PROJECT_DIR" && git push origin HEAD:main',
+  ]) {
+    const r = bash(cmd);
+    assert.equal(r.status, 2, `expected block for: ${cmd}`);
+    assert.match(r.stderr, /builder-ship/);
+  }
+});
+
+test('blocks git branch -D and points at -d', () => {
+  for (const cmd of ['git branch -D task-1003346', 'git branch -D old', 'git -C . branch -r -D stale']) {
+    const r = bash(cmd);
+    assert.equal(r.status, 2, `expected block for: ${cmd}`);
+    assert.match(r.stderr, /use `-d`/);
+  }
+});
+
+test('allows the read-only, the supported, and the ordinary', () => {
+  for (const cmd of [
+    'git stash list',
+    'git status',
+    'git push origin task-1003346',
+    'git branch -d merged-branch',
+    'git worktree list --porcelain',
+    'node scripts/gds/worktree.js remove wt-1003346',
+    'npm test',
+  ]) {
+    assert.equal(bash(cmd).status, 0, `false positive on: ${cmd}`);
+  }
+});
+
+test('non-Bash tools and unknown payload shapes fail open', () => {
+  assert.equal(
+    runHook(JSON.stringify({ tool_name: 'Write', tool_input: { file_path: 'x.js', content: 'git stash' } })).status,
+    0,
+  );
+  assert.equal(runHook(JSON.stringify({ tool_name: 'Bash' })).status, 0);
+  assert.equal(runHook(JSON.stringify({})).status, 0);
+  assert.equal(runHook('null').status, 0);
+});
+
+test('malformed stdin fails open rather than breaking the turn', () => {
+  for (const raw of ['', 'not json at all', '{"tool_name":"Bash",']) {
+    assert.equal(runHook(raw).status, 0, `expected fail-open for: ${JSON.stringify(raw)}`);
+  }
+});
+
+test('kill-switch disables the gate entirely', () => {
+  for (const cmd of ['git stash', 'git push origin main', 'git worktree remove x', 'git branch -D y']) {
+    assert.equal(bash(cmd, { BONGOS_GIT_GUARD_OFF: '1' }).status, 0, `kill-switch missed: ${cmd}`);
+  }
+});

package/tests/stale_worktrees.mjs

@@ -0,0 +1,66 @@
+// tests/stale_worktrees.mjs — the stale-worktree classifier is a pure function of git
+// facts (task 1003365): no repo, no API, just the porcelain text + two predicates.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseWorktreeList, classifyWorktrees, lineFor } from '../scripts/gds/stale-worktrees.js';
+
+const PORCELAIN = [
+  'worktree C:/repo',
+  'HEAD aaaa',
+  'branch refs/heads/main',
+  '',
+  'worktree C:/repo/.claude/worktrees/task-1',
+  'HEAD bbbb',
+  'branch refs/heads/task-1',
+  '',
+  'worktree C:/repo/.claude/worktrees/task-2',
+  'HEAD cccc',
+  'branch refs/heads/task-2',
+  '',
+  'worktree C:/repo/.claude/worktrees/task-3',
+  'HEAD dddd',
+  'branch refs/heads/task-3',
+  '',
+  'worktree C:/repo/.claude/worktrees/spike',
+  'HEAD eeee',
+  'detached',
+  '',
+].join('\n');
+
+test('parses porcelain into worktrees, first entry is the primary checkout', () => {
+  const wts = parseWorktreeList(PORCELAIN);
+  assert.equal(wts.length, 5);
+  assert.equal(wts[0].isMain, true);
+  assert.equal(wts[0].branch, 'main');
+  assert.equal(wts[1].branch, 'task-1');
+  assert.equal(wts[4].branch, null);
+});
+
+test('merged or branch-gone worktrees are stale; unmerged and detached are live; main is skipped', () => {
+  const wts = parseWorktreeList(PORCELAIN);
+  const r = classifyWorktrees(wts, {
+    isMerged: (b) => b === 'task-1',
+    branchExists: (b) => b !== 'task-2',
+  });
+  assert.deepEqual(r.stale.map((s) => [s.name, s.why]), [
+    ['task-1', 'merged into main'],
+    ['task-2', 'branch gone'],
+  ]);
+  assert.deepEqual(r.live.map((l) => l.name), ['task-3', 'spike']);
+});
+
+test('--line is empty when nothing is stale and names the junction-safe path when something is', () => {
+  assert.equal(lineFor({ stale: [], live: [] }), '');
+  const line = lineFor({ stale: [{ name: 'task-9', why: 'merged into main' }], live: [] });
+  assert.match(line, /Stale worktrees: 1 /);
+  assert.match(line, /task-9/);
+  assert.match(line, /\/worktree-clean/);
+});
+
+test('--line caps the named list at six', () => {
+  const stale = Array.from({ length: 8 }, (_, i) => ({ name: `task-${i}`, why: 'merged into main' }));
+  const line = lineFor({ stale, live: [] });
+  assert.match(line, /Stale worktrees: 8 /);
+  assert.match(line, /\+2 more/);
+  assert.doesNotMatch(line, /task-7/);
+});