@bongos/core 1.19.480 → 1.19.481

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.480",
-  "core_contract": "1.19.480",
-  "source_commit": "11b59244f97682c2c4b23cf585934bd274e6c7c5",
+  "core_version": "1.19.481",
+  "core_contract": "1.19.481",
+  "source_commit": "1e15c64fea66158d77a525295d8f0de6762a2d09",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T18:36:15.613Z",
+  "built_at": "2026-09-02T18:54:38.572Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 421,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2288,
-  "tree_sha256": "417f6f6e7324c2f6e2b2212d479ce821b64ff11bc66dbb697451fa6865aca967",
+  "tree_sha256": "ee9b67479c48cf815519f65d3dfe69cf1f1b4054aa15100612e6ed03897c27f4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2157,7 +2157,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7c08b1fa71a88d99f9b37988c3f9091aa194552e74a65bfab897ddae316e8fd6"
+      "sha256": "e6020c99be6acc88d36c8cc3c4cff695a50e2c94d80141dc9b4f7e61468d6739"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6647,7 +6647,7 @@
     {
       "path": "modules/ui-design/styles/README.md",
       "mode": "0000644",
-      "sha256": "27f468f3375109d82077fb3136be845cb40bdd4651c58343f34b3a46d8f33a40"
+      "sha256": "fdc2cde0abfa6eb513785888daa0f3e1defb33bd02975775090ecc18c588c57a"
     },
     {
       "path": "modules/ui-design/styles/blueprint/DESIGN.md",
@@ -6752,12 +6752,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "18ddb1e7bcf982fa0d669e269e7d18ca6f247a9122c26830b0e7964ad416df0f"
+      "sha256": "caf8322fc29303944e76c6d9d5ee51d9a953efdd9880160f3ea60f8a44746a9d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "175ae82a06ebcfd4aa5c2590a2babd80a32177a68febb4750047665bddd121ea"
+      "sha256": "46e539eb3e734d2748b85c00b7f81e845d9fe184ef608130e2ff5beba8d14026"
     },
     {
       "path": "public-docs/index.html",
@@ -8412,7 +8412,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b52bf0118bb22bbed64a78043214284f953611def3e46193305fba740f868fca"
+      "sha256": "0e13f37b5e4b46d75c5ee21c9f445aaa35dc86d699b7fae8aec1ba83b8199a7d"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1397,5 +1397,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.478 with no explicit bump. run 33665076054. (task 1002620)
   1.19.480 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.479 with no explicit bump. run 33668172411. (task 1002620)
+  1.19.481 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.480 with no explicit bump. run 33670051626. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ui-design/styles/README.md

@@ -43,6 +43,8 @@ node modules/ui-design/kit/check-mock.js --file modules/ui-design/styles/grove/m
 SURFACE=modules/ui-design/styles/expedition STYLE=expedition node modules/ui-design/kit/serve.js   # the specimen at /mock
 ```
 
+**`--pack <name>` is not optional when you check a look's specimen** (verified on a scaffolded instance, [task 1003331](https://cloudbongos.com/builders#/task/1003331)). Without it `check-mock.js` reads the taste bans from the **checkout's own** root `DESIGN.md`, not the look's, so a specimen that is clean under its own rules fails under the chrome world's (its `eyebrow` ban promotes the kicker-above-the-h1 tell to a FAIL). `--pack` points both the colours and the bans at the look. The same run confirmed the reverse direction works as designed: pointing `GDS_BRANDING_FILE` at an instance's `config/branding.json` makes every kit command measure **that instance's** world, so a look adopted there is what `contrast.js`, `render.js` and `check-mock.js` see with no flag at all.
+
 **On an instance** (the switch is the contract, not a page): copy the look's `pack.json` `theme` into `config/branding.json`, the file `cloudbongos init` writes ([`docs/branding-contract.md`](../../../docs/branding-contract.md) §Branding a new instance). Every served page re-themes at once, because the server splices `theme.ui` into `:root` at the end of `<head>` and every sheet reads only that. To leave a look, remove the block: the neutral pack (the chrome world) resolves.
 
 **What stays the platform's, whichever look is on:** the dark ground (black), the hall's fixed green / amber / red **verification** vocabulary and the status ledger's pillars (a look must not repaint a status chip, ADR 0196 Context §2), the derived recipes each sheet carries (a corner radius, a shadow, a glass are a sheet's tier, not a pack's), and the platform floors.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.480",
+  "version": "1.19.481",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.480",
+      "version": "1.19.481",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.480",
+  "version": "1.19.481",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.480'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.481'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');