@bongos/core 1.19.476 → 1.19.477

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.476",
-  "core_contract": "1.19.476",
-  "source_commit": "631886be90fa74af3353170d0f5e351a5cf100c7",
+  "core_version": "1.19.477",
+  "core_contract": "1.19.477",
+  "source_commit": "17d71953a32ddb4b8006ce2c0ed1d915b815ed1c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T16:34:36.724Z",
+  "built_at": "2026-09-02T17:36:21.154Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 413,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2275,
-  "tree_sha256": "06f67b13e31a022107f61818ab5b0dbc693fcd5c8fd30d8f58e27e16e4b7a113",
+  "tree_sha256": "dc88e652d6b7674e287e406b3397118f0e2af3e0346c2f234602da8ea24ff35b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -252,7 +252,7 @@
     {
       "path": ".claude/skills/session-handoff/SKILL.md",
       "mode": "0000644",
-      "sha256": "ceca875c997081dda2692a1319f78dded07383b9b1645914a68dac09020e2035"
+      "sha256": "ddce51865985491a71bf89f734de3589cf2bb4f1ee76ac828b0c3905844db75f"
     },
     {
       "path": ".claude/skills/status/SKILL.md",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e8957fb9ba93280d840032cdfd55ac8e8aaaf8fc7bc7a80df4e1e78a3cc9bcd1"
+      "sha256": "d04efaed57b08373781ce55244d916cca3302daecd5c6c5c3e7fb93bfcdcf950"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6692,12 +6692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "66d0470b8bbef92b19fb646d6f7d03a07dbccdc43159a4a10cbfa7ef9edf234e"
+      "sha256": "61a5372ee6a0262a905396aa54a6a72f423e509308213dcc24dcc02e78b225c8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eeae6c47ef2d23504ee84eaf0681717f9f78aee6e87ebd02af794e235b9127d7"
+      "sha256": "067fc518cdcae9e18db8cfe039dacef25a81586772c0c8c0105f8325f325ad34"
     },
     {
       "path": "public-docs/index.html",
@@ -8352,7 +8352,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e679812470446860395dcbc799ef21b0459c86f89e954ed9d50b4428f26be6ff"
+      "sha256": "80d23eb49ce424e573ed6bfed618610b58498eba45cc4756ca2739cc05831106"
     },
     {
       "path": "src/module-loader/catalog.js",

package/.claude/skills/session-handoff/SKILL.md

@@ -16,10 +16,10 @@ Use it at the end of a working session, or mid-session when the context is getti
 
 Emit **exactly one fenced code block** (so it's trivially copy-pasteable) containing the prompt below. Write it for a reader — and a future Claude session — that has **none** of this conversation's context: be specific, name files by path, and spell out task ids as hall links, never a bare `#NNN`.
 
-Keep it **short and curated** — a prompt, not a transcript. Include only what the next session needs to act. Use these sections, dropping any that are genuinely empty:
+Keep it **short and curated** — a prompt, not a transcript. Include only what the next session needs to act. Target **under ~60 lines** inside the block: every line is context the fresh session pays for before it does anything. If it runs long, cut history first, then pointers — never the next steps or the first action. Use these sections, dropping any that are genuinely empty:
 
 1. **Goal / where things stand** — one or two lines: the overall objective and the current state.
-2. **Done this session** — a few bullets of what actually landed, each tagged `verified-prod` | `verified-smoke` | `implemented-not-verified` so the next session trusts the right things.
+2. **Done this session** — optional, and capped: **at most three one-line bullets**, each tagged `verified-prod` | `verified-smoke` | `implemented-not-verified`, and only for a fact the next session must TRUST before it builds — a behaviour it will rely on, a state it must not redo. The record of what landed already exists twice (the dated file under `docs/session-logs/` and the ship notes in the ledger), so point at that file by path rather than repeating it here. Drop the section when nothing needs trusting.
 3. **Next steps** — the ordered, concrete actions to take next. Name the exact files, functions, and task ids (as hall links). Lead with the single most important one.
 4. **Manual checks to run first** — anything the next session should verify before building on this work (a test to run, a page to load, a status to confirm).
 5. **Gotchas / watch-outs** — traps you hit or foresee (a stale-tooling merge, a flaky step, a gated path, a decision still open).
@@ -28,7 +28,7 @@ Keep it **short and curated** — a prompt, not a transcript. Include only what
 
 ## How to compose it
 
-- **Ground it in this session.** Pull the "Done" + "Next steps" from what actually happened here — the claims you worked, the files you touched, the decisions you made. If you hold an active claim, name it and its status.
+- **Ground it in this session.** Pull the "Next steps" (and the few "Done" facts worth trusting) from what actually happened here — the claims you worked, the files you touched, the decisions you made. If you hold an active claim, name it and its status. History belongs in the session log, not in the prompt.
 - **Mirror `docs/handoff-template.md`** for the section shape, but condense: a starter prompt is a fraction of a full session log.
 - **Self-contained.** Assume the fresh session starts cold. Every reference (file, task, ADR, URL) must be resolvable without this chat.
 - **Improvable.** If the builder edits the draft, keep their changes — this is their prompt to reuse and refine, not a fixed artifact.

package/docs/module-api-changelog.md

@@ -1389,5 +1389,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.474 with no explicit bump. run 33653632532. (task 1002620)
   1.19.476 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.475 with no explicit bump. run 33655706909. (task 1002620)
+  1.19.477 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.476 with no explicit bump. run 33662059275. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.476",
+  "version": "1.19.477",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.476",
+      "version": "1.19.477",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.476",
+  "version": "1.19.477",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.476'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.477'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');