@bongos/core 1.19.552 → 1.19.553

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.552",
-  "core_contract": "1.19.552",
-  "source_commit": "c33c4fe6dd1cf9319051a7bee1e9c940472549a5",
+  "core_version": "1.19.553",
+  "core_contract": "1.19.553",
+  "source_commit": "0037c66da0cfa4bf64edadc01329b5b053aa50ad",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T15:55:11.203Z",
+  "built_at": "2026-09-06T16:03:40.475Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 442,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2485,
-  "tree_sha256": "c628eebd2a60fa4e7346604f1f5507a913cfac851f45fc632f3eff4aedf36487",
+  "tree_sha256": "5394d408102a1217b87c8481579b5f9ee59eec97a9adac6f841254af6495e52a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2652,7 +2652,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2fb63f0c4427c7f7bff711fcf41f5637cca7b31a8009a21305530748b130e310"
+      "sha256": "ccbe2f9174064241f3e14dc6d1e816d6ebaae4f982497ff4efe3493e6800846c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4607,7 +4607,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "b9cf0c5dc9e0df09eb16a8c14b3d50d9d8ebcf899da5c7b10318f81fe5615d45"
+      "sha256": "876c4f21b3aaa77fad298915afe7cc481a39b5235e846f61bcc7657a270dd227"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4822,7 +4822,7 @@
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "f8025b961adedc8a02d09626a96e0db3d41a13656fcb862ab9e23f654c1b217e"
+      "sha256": "df47881aa19503356bc54c04ffca1167effb68f43b5c442e909074744f9af63c"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -4862,7 +4862,7 @@
     {
       "path": "modules/hall-ui/public/idea.js",
       "mode": "0000644",
-      "sha256": "73f2d9a4f826f8680cbcf7ba8b5443ef0716a743c4cca0a2b0213057d161c2d9"
+      "sha256": "e2b0491898652f569a569617c6f3ce969c9011072e04e376355b95d969a09119"
     },
     {
       "path": "modules/hall-ui/public/idea.states.json",
@@ -5217,12 +5217,12 @@
     {
       "path": "modules/hall-ui/public/task-lib.js",
       "mode": "0000644",
-      "sha256": "3efb1199b1fc3c979b1c3aaa23d817241b48104dd1dfd40cbc20ed80b1a971cc"
+      "sha256": "64cfbc3a3815fd12249a4f8694668b4503272ec7c795ed3eaafbc81ed77183f3"
     },
     {
       "path": "modules/hall-ui/public/task.css",
       "mode": "0000644",
-      "sha256": "c811a3aafeb8e792315b5ac77c637f31d00169e9ba9e4007f897c276f418f935"
+      "sha256": "1f2d0ed8f8c8497468e1102dd2d90b0e63f15bd89158e5935f50de1016c355e4"
     },
     {
       "path": "modules/hall-ui/public/task.html",
@@ -5232,7 +5232,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "c11bacc90cfc86e0cf809a70e42ead7c31a5925c22f037170817db8783e3e10b"
+      "sha256": "4e4ae2a620f30bc5d8863e0acf75003f97f9071405fceb51fda60de4deb7e3ad"
     },
     {
       "path": "modules/hall-ui/public/task.states.json",
@@ -5277,7 +5277,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "7283ebe918bb1ab2eedf4f88e7ccfc8fa7ab79b790460c1886c89cabc2632f9c"
+      "sha256": "1fed935dc521c45972e49435308cb791f2c509ea544ff55663221c9723590632"
     },
     {
       "path": "modules/hall-ui/public/work.states.json",
@@ -6697,7 +6697,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "9d1e904bdb89b929f29871c6c50cbdf9a33d73943b689d167ad26cb1201a01e2"
+      "sha256": "c6ad936d8f4340a16f7faea30ec0b97b7a1c526a9a991d1e1c6ff1833ddb57ce"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -7472,17 +7472,17 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cc08dead6d4714851b7db549d9b6ad9829bbd0e22722fab29cef54f9b28f7693"
+      "sha256": "cfbffbcea38df68b7a0bffb2c6f99c76be20b0efcbb1d86489e029272e7d410b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "36e67dc71f4fced7aa31d42102c8ff9c424ded06dea1a6f2f67d45888e95e406"
+      "sha256": "445928943329f12df7a6aa27a544b0f1a7c40bd4634c9c8460518777eb69981f"
     },
     {
       "path": "public-docs/index.html",
       "mode": "0000644",
-      "sha256": "09891860e91b4c25e4314de24e3189c3dbb36c29e1fbc01eb5d3125fb2ac6985"
+      "sha256": "5ca4ae4f141fb9af378b8bdc0f3a013a6cb3f5289e0b9ba2f5ae5069c4c34844"
     },
     {
       "path": "public-docs/redoc.standalone.js",
@@ -9172,7 +9172,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bd96dabd37302c58d3519dde872d4a77f20302b5da263dc829db0fda37654edb"
+      "sha256": "87189caf049da61dd52f02a1a8f884caac9bde741d3dd29543a7815e6994bca0"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1553,5 +1553,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.550 with no explicit bump. run 33917261720. (task 1002620)
   1.19.552 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.551 with no explicit bump. run 34043771286. (task 1002620)
+  1.19.553 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.552 with no explicit bump. run 34044208907. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -335,7 +335,7 @@
 
 
   // Wires the public landing's access-request form. Submits to the one public
-  // GDS write (POST /access-requests). On success the form collapses into a
+  // Bongos write (POST /access-requests). On success the form collapses into a
   // confirmation so the stranger knows the Archon has been pinged.
 
   // Reads the module-level lastKarmaState / lastCostState directly — every caller
@@ -427,7 +427,7 @@
   //   * pick_disciplines — the craft picker (PATCH /me/disciplines).
   //   * join_discord      — a Connect-Discord button (the existing OAuth flow,
   //                         auto-joins + assigns rank role); clears when linked.
-  // cli_setup clears once the GDS CLI is authenticated (db.hasCliSession) and
+  // cli_setup clears once the Bongos CLI is authenticated (db.hasCliSession) and
   // ship_three on the 3rd ship — both passive. The terminal ship_three step
   // shows the live "N of 3" counter (its `detail`). `discord` is the /me discord
   // block ({ linked, configured }) — when Discord isn't configured server-side
@@ -972,7 +972,7 @@
   // local action or page reload while the hall sits open:
   //   * box_connect — stamped by the box's heartbeat the first time a `claude`
   //                   process runs on the dev box (builder_boxes.first_connected_at);
-  //   * cli_setup   — stamped when the GDS CLI is first authenticated on the box;
+  //   * cli_setup   — stamped when the Bongos CLI is first authenticated on the box;
   //   * join_discord — flips on the OAuth link (usually a full redirect, but can
   //                    also land from another tab).
   // Without a poll, a newcomer who connects their box AFTER opening the hall sees
@@ -1268,7 +1268,7 @@
   // The hall used to fetch every panel once at load and then freeze until a
   // manual refresh — so an onboarding step that ticked server-side (e.g. after
   // /builder-ship) never showed. We now open a Server-Sent Events stream
-  // (GET /api/bongos/live) that emits a tiny `nudge` whenever GDS state changes via
+  // (GET /api/bongos/live) that emits a tiny `nudge` whenever Bongos state changes via
   // ANY write path — API routes, background routines, even direct psql writes
   // (the trigger lives in the DB; see migration 066 + src/bongos/routes/live.js).
   // On a nudge we re-run loadAll(), debounced so a burst coalesces into one

package/modules/hall-ui/public/hall-render.js

@@ -916,7 +916,7 @@
       // time. (The Discord step already did this; the craft picker and the
       // See-the-works link used to render on locked/cleared steps too.) Every
       // step auto-detects its own completion server-side (#777): join_discord
-      // clears on the Discord link, cli_setup once the GDS CLI is authenticated,
+      // clears on the Discord link, cli_setup once the Bongos CLI is authenticated,
       // ship_three at the third ship — no manual ticking.
       let action = '';
       if (s.is_current && !s.cleared) {

package/modules/hall-ui/public/idea.js

@@ -114,7 +114,7 @@
   }
 
   // The body is markdown and renders through the hall's one parser, the way the
-  // task record's description does (task 1003465); a bare #NNN is a GDS id and
+  // task record's description does (task 1003465); a bare #NNN is a Bongos id and
   // drops its hash so it cannot read as a GitHub issue. Without the reader the
   // text still shows, escaped.
   function prose(text) {

package/modules/hall-ui/public/task-lib.js

@@ -65,7 +65,7 @@
     return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${esc(label)}</span>`;
   }
 
-  // Strip bare "#NNN" GDS refs from prose we are about to paste elsewhere: on
+  // Strip bare "#NNN" Bongos refs from prose we are about to paste elsewhere: on
   // GitHub a bare #NNN autolinks to an ISSUE, and our ids are not GitHub's, so
   // the link 404s. (Same rule the repo enforces in committed markdown.)
   // VERBATIM from the two originals — do not "tidy" either detail:
@@ -95,7 +95,7 @@
     const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
     const hallUrl = `${hallBase}#/task/${t.id}`;
     return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
+      `I am working on Bongos task ${t.id} (${t.title}) — ${hallUrl}`,
       `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
       ``,
       `Task description:`,

package/modules/hall-ui/public/task.css

@@ -15,7 +15,7 @@
    beats with exactly ONE lit, which is the same lit-step grammar as the open tab
    and the current nav item. It is a READOUT, not a control — nothing here is
    pressable, so the accent lights only the beat the task is actually on.
-   The six GDS statuses fold into five beats because backlog / blocked / ready
+   The six Bongos statuses fold into five beats because backlog / blocked / ready
    are all "no builder has it yet"; task.js writes the caption that says which. */
 .tk-rail {
   display: grid;

package/modules/hall-ui/public/task.js

@@ -244,7 +244,7 @@
     return `<section><p class="rec-sec__h">${escapeHtml(kindWord)}</p><ul class="rec-deplist">${rows}</ul></section>`;
   }
 
-  // The lifecycle rail: five beats, exactly one lit. Six GDS statuses fold into
+  // The lifecycle rail: five beats, exactly one lit. Six Bongos statuses fold into
   // five because backlog / blocked / ready all mean "no builder holds it yet";
   // the first beat's caption is what says WHICH of the three it is, so the rail
   // never implies a claim that has not happened.
@@ -321,7 +321,7 @@
     }
   }
 
-  // A bare #NNN in a description is a GDS id, and anywhere it is pasted or
+  // A bare #NNN in a description is a Bongos id, and anywhere it is pasted or
   // rendered it would autolink to a GitHub issue that does not exist (CLAUDE.md's
   // no-bare-#NNN rule) — so both the copy and the rendered paths drop the hash.
   const delinkRefs = (s) => String(s || '').replace(/(^|\s)#(\d+)\b/g, '$1$2');
@@ -343,7 +343,7 @@
   function buildPrompt(t) {
     const url = `${location.origin}${hallBase()}/task/${t.id}`;
     const desc = delinkRefs(t.description);
-    return `I am working on GDS task ${t.id} (${t.title || ''}) — ${url}\n\n` +
+    return `I am working on Bongos task ${t.id} (${t.title || ''}) — ${url}\n\n` +
       `Claim it with \`/builder-claim ${t.id}\`, build it, then \`/builder-ship ${t.id}\`.\n\n` +
       `Task description:\n${desc}`;
   }

package/modules/hall-ui/public/work.js

@@ -817,7 +817,7 @@
   function buildBulkParallelPrompt(tasks) {
     const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
     const lines = [
-      `I want to work on ${tasks.length} GDS tasks IN PARALLEL — open ${tasks.length} separate Claude Code sessions, each in its own worktree, one per task below, so they can run at the same time without touching each other's files.`,
+      `I want to work on ${tasks.length} Bongos tasks IN PARALLEL — open ${tasks.length} separate Claude Code sessions, each in its own worktree, one per task below, so they can run at the same time without touching each other's files.`,
       '',
     ];
     tasks.forEach((t, i) => {
@@ -831,7 +831,7 @@
   function buildBulkSequentialPrompt(tasks) {
     const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
     const lines = [
-      `I want to work on ${tasks.length} GDS tasks IN ORDER, one after another in this same session — claim, build, and ship each before moving to the next.`,
+      `I want to work on ${tasks.length} Bongos tasks IN ORDER, one after another in this same session — claim, build, and ship each before moving to the next.`,
       '',
     ];
     tasks.forEach((t, i) => {

package/modules/public-landing/public/index.html

@@ -910,7 +910,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 <script>
 (function () {
   var API = '/api/bongos';
-  var GDS = '/api/gds';
+  var API_ROOT = '/api/gds';
 
   /* ── the tagline. It is ONE server-stamped string, but the composition wants it
      on two lines, so the two halves are baked as separate spans. A host whose
@@ -1109,7 +1109,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
     return d.getDate() + ' ' + MONTHS[d.getMonth()];
   }
 
-  json(GDS + '/public/progress').then(function (data) {
+  json(API_ROOT + '/public/progress').then(function (data) {
     var rows = (data && data.progress) || [];
     if (!rows.length) return;
     var live = null;
@@ -1129,7 +1129,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
     }
   });
 
-  json(GDS + '/public/recent-shipped?limit=6').then(function (data) {
+  json(API_ROOT + '/public/recent-shipped?limit=6').then(function (data) {
     var tasks = ((data && data.tasks) || []).slice(0, 6);
     var list = document.querySelector('[data-rows]');
     if (!tasks.length || !list) return;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.552",
+  "version": "1.19.553",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.552",
+      "version": "1.19.553",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.552",
+  "version": "1.19.553",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-docs/index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>{{productName}} — API docs</title>
-  <meta name="description" content="{{productName}} GDS API reference (OpenAPI 3.1)." />
+  <meta name="description" content="{{productName}} API reference (OpenAPI 3.1)." />
   <style>
     /* Self-contained: no external fonts/CSS. Redoc paints the rest. */
     html, body { margin: 0; padding: 0; }

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.552'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.553'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');