@bongos/core 1.19.573 → 1.19.574

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.573",
-  "core_contract": "1.19.573",
-  "source_commit": "4dac3d1041574ffba78b27c7586c270a75f23d2a",
+  "core_version": "1.19.574",
+  "core_contract": "1.19.574",
+  "source_commit": "cb6c20fba8bc93877d7917986195294b3d7d2d42",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T01:25:15.478Z",
+  "built_at": "2026-09-07T02:14:28.259Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 450,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2042,
+    "functional_verbatim": 2043,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2516,
-  "tree_sha256": "3b3601c11e3adbff7e0520361632f5bebe355f1da99cdbc8f67b773da63a87d0",
+  "file_count": 2517,
+  "tree_sha256": "9160b243d293a7be2f13cb02991462b82a800e4e9948486d898f30a7598a0141",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0b6c38bb0ded3d36a7024229c993f6d3271772f582af4b2b9aa2633805e55329"
+      "sha256": "34f3a97a9b2396e37b6b8739a008aa3c79fffa0f7e02df8b8586b755d6cd0206"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4267,7 +4267,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "08890c50f8c8b2551a495e8a54e0e4fb2925b928ece5dc9aaf2090ea1c37adb3"
+      "sha256": "ce98912ffa428298ad4fe1a2dbf1d6e1121fb9f966cb3c41092ac40fb1428a43"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -4284,6 +4284,11 @@
       "mode": "0000644",
       "sha256": "cc953acd69f844d158c3a79ea4de3b12d652ea0247c878c6a6c33d5abf68eab3"
     },
+    {
+      "path": "modules/economy/reward-policy.js",
+      "mode": "0000644",
+      "sha256": "e1f432cc9871bcb992face1f8ecd9f63fea17b3b67c121d59e8e28a89ba8d7d5"
+    },
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
@@ -7547,12 +7552,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "18bdddc767294c810ce9ee48f2e3dd0f56b4e4ac796762654ec092e1ca6a3d4d"
+      "sha256": "267cb45a286e4a22e781d2c5ff28f5c609683bc79b5d8c327d2b3606aa0795a2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8b5e28c08069f6c10abad7791bac3829918e1fd7a2b8d5a126e6bcbb9348591b"
+      "sha256": "aca40a127da79a5a8217c05ab5c074072dc0840d4b2baf89159d68412cfd6a08"
     },
     {
       "path": "public-docs/index.html",
@@ -7807,7 +7812,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "5aa658b099b2acda06cdb3aecfe905da7de79f2b12c844faca091ff061454017"
+      "sha256": "b08ad47b79417816a9f132e8149f78743eefb47b8824edf3380cdea23447e07f"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
@@ -9252,7 +9257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6f2d2cf5cb0bbe6626a121ee87675ed9596875e644221aa0c4e21b14cdc0bbfc"
+      "sha256": "8b068b3a2cefb919013cdcc7cf35ec4a84859fe16d6e5cf7723d3434370bfcd5"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1595,5 +1595,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.571 with no explicit bump. run 34071078624. (task 1002620)
   1.19.573 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.572 with no explicit bump. run 34072921884. (task 1002620)
+  1.19.574 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.573 with no explicit bump. run 34075598213. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/economy/credits.js

@@ -151,7 +151,24 @@ const IDEA_GOVERNANCE_PASS_FLOOR = 30;  // owner: floor ~30 — see the note on
 // these defaults; the pure helper keeps its code defaults so tests stay
 // deterministic and the call site passes the resolved config. The currency LABEL
 // is `branding.currency.label`.
-const REWARD_MARGIN_PCT = 20; // cost-plus margin, percent — DEFAULT (task 1005)
+// task 1003676: the reward POLICY (these constants + rewardPolicy/rewardConfig)
+// moved to ./reward-policy so a CLIENT can resolve it without importing this file,
+// which pulls { pool, branding } from src/module-api and with it the whole server.
+// Re-exported below, so this module is still the one place reward resolution lives
+// (ADR 0146) and every existing caller is unchanged.
+const {
+  REWARD_MARGIN_PCT, REWARD_MODE_DEFAULT, REWARD_MODE_COST_PLUS_ONLY, rewardPolicy,
+} = require('./reward-policy');
+
+// Per-instance reward policy, resolved over the code defaults. Stays HERE, not in
+// reward-policy.js: the branding read must go through the module port (ADR 0083),
+// and a file the CLI can share may not import the port. Best-effort — a branding
+// hiccup falls back to the defaults so reward accrual never crashes.
+function rewardConfig() {
+  let r = {};
+  try { r = (branding().reward) || {}; } catch { r = {}; }
+  return rewardPolicy(r);
+}
 
 // Reward MODE — which reward streams an instance pays (task 1002270, ADR 0146).
 // The two streams (ADR 0054 "two drachma conventions, one ledger") are:
@@ -170,8 +187,6 @@ const REWARD_MARGIN_PCT = 20; // cost-plus margin, percent — DEFAULT (task 100
 //       else. Cloud Bongos's choice (owner decision, 2026-07-16).
 // Unknown/garbage mode → treated as the default (pay both): a config typo must
 // never silently zero out every builder's per-task reward.
-const REWARD_MODE_DEFAULT = 'cost-plus-and-estimate';
-const REWARD_MODE_COST_PLUS_ONLY = 'cost-plus-only';
 
 // Pure policy resolver — maps a raw branding.reward object to the effective reward
 // policy. Exported so a test can assert the mapping without touching the memoized
@@ -185,24 +200,6 @@ const REWARD_MODE_COST_PLUS_ONLY = 'cost-plus-only';
 // credit writers (IC2/IC4/IC5) gate on `ideatorCredit`, never on `perTaskCredit`.
 // An instance opts the ideator lane out with `reward.ideatorCredit: false`;
 // absent/any-non-false → the default TRUE (a pre-ADR-0172 config keeps paying).
-function rewardPolicy(rawReward) {
-  const r = rawReward || {};
-  const marginPct = Number.isFinite(Number(r.marginPct)) ? Number(r.marginPct) : REWARD_MARGIN_PCT;
-  const usdPeg = Number.isFinite(Number(r.usdPeg)) && Number(r.usdPeg) > 0 ? Number(r.usdPeg) : 1;
-  const mode = r.mode === REWARD_MODE_COST_PLUS_ONLY ? REWARD_MODE_COST_PLUS_ONLY : REWARD_MODE_DEFAULT;
-  const perTaskCredit = mode !== REWARD_MODE_COST_PLUS_ONLY;
-  // Default-on, opt-out-only: only an explicit `false` withholds the ideator lane.
-  const ideatorCredit = r.ideatorCredit !== false;
-  return { marginPct, usdPeg, mode, perTaskCredit, ideatorCredit };
-}
-
-// Per-instance reward policy, resolved over the code defaults. Best-effort: a
-// branding hiccup falls back to the defaults so reward accrual never crashes.
-function rewardConfig() {
-  let r = {};
-  try { r = (branding().reward) || {}; } catch { r = {}; }
-  return rewardPolicy(r);
-}
 
 // Pure helper — exported for tests. Returns { trueCostUsd, marginPct, drachmae,
 // description }. drachmae = round(cost × (1+margin) × usdPeg); at the 1:1 peg a

package/modules/economy/reward-policy.js

@@ -0,0 +1,50 @@
+// modules/economy/reward-policy.js — the reward POLICY shape, and nothing else
+// (task 1003676).
+//
+// What it is: the reward defaults and the PURE function that resolves a branding
+// pack's `reward` block over them — margin, USD peg, mode, whether the per-task
+// credit and the ideator lane are on.
+//
+// Why it is its own file, and why it imports NOTHING: this is the one piece of
+// economy a CLIENT needs. `bongos start` prints a task's credit reward and the
+// wording depends on the mode, so the CLI must resolve the policy. It used to get
+// that by requiring credits.js, which imports { pool, branding } from
+// src/module-api at module scope — so one lazy require of one config reader pulled
+// Postgres, auth and db-kernel into the closure of every CLI subcommand, and that
+// is what made the CLI impossible to publish as a client-only package (goal
+// 1000054) and left a new builder with no private-registry credential unable to
+// claim anything.
+//
+// It takes the raw `reward` block as an ARGUMENT rather than reading branding
+// itself: a module may import only src/module-api (ADR 0083, enforced by
+// fitness.js), so a file that both a module and a client can share has to be free
+// of host reads. Each caller supplies its own — credits.js through the module port,
+// the CLI straight from src/branding. One resolver, two readers; ADR 0146's rule
+// that reward resolution is always economy's still holds, because this file is
+// economy's.
+
+// Cost-plus margin, percent — the DEFAULT (task 1005).
+const REWARD_MARGIN_PCT = 20;
+const REWARD_MODE_DEFAULT = 'cost-plus-and-estimate';
+const REWARD_MODE_COST_PLUS_ONLY = 'cost-plus-only';
+
+// PURE. Resolves a raw branding `reward` block over the code defaults. Every field
+// is validated rather than trusted: a malformed pack degrades to the defaults
+// instead of poisoning an award.
+function rewardPolicy(rawReward) {
+  const r = rawReward || {};
+  const marginPct = Number.isFinite(Number(r.marginPct)) ? Number(r.marginPct) : REWARD_MARGIN_PCT;
+  const usdPeg = Number.isFinite(Number(r.usdPeg)) && Number(r.usdPeg) > 0 ? Number(r.usdPeg) : 1;
+  const mode = r.mode === REWARD_MODE_COST_PLUS_ONLY ? REWARD_MODE_COST_PLUS_ONLY : REWARD_MODE_DEFAULT;
+  const perTaskCredit = mode !== REWARD_MODE_COST_PLUS_ONLY;
+  // Default-on, opt-out-only: only an explicit `false` withholds the ideator lane.
+  const ideatorCredit = r.ideatorCredit !== false;
+  return { marginPct, usdPeg, mode, perTaskCredit, ideatorCredit };
+}
+
+module.exports = {
+  REWARD_MARGIN_PCT,
+  REWARD_MODE_DEFAULT,
+  REWARD_MODE_COST_PLUS_ONLY,
+  rewardPolicy,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.573",
+  "version": "1.19.574",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.573",
+      "version": "1.19.574",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.573",
+  "version": "1.19.574",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/cli-lib.js

@@ -82,7 +82,17 @@ function rewardPolicy(fromServer) {
     return { mode: fromServer.mode, perTaskCredit: fromServer.perTaskCredit !== false };
   }
   try {
-    const p = require('../../modules/economy/credits').rewardConfig();
+    // economy's PURE resolver + our own branding read, NOT ./credits (task
+    // 1003676): credits.js imports { pool, branding } from src/module-api at
+    // module scope, so this one fallback require used to drag Postgres + auth +
+    // db-kernel into EVERY CLI subcommand's closure — which is what stopped the
+    // CLI shipping as a public, client-only package. Same resolver, same answer,
+    // no server. The CLI is not a module, so reading src/branding directly here
+    // is allowed where it would not be inside modules/ (ADR 0083).
+    const { rewardPolicy: resolve } = require('../../modules/economy/reward-policy');
+    let raw = {};
+    try { raw = (require('../../src/branding').branding().reward) || {}; } catch (_) { raw = {}; }
+    const p = resolve(raw);
     if (p && typeof p.mode === 'string') return p;
   } catch (_) { /* fall through */ }
   return { mode: 'cost-plus-and-estimate', perTaskCredit: true };

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.573'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.574'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');