@bongos/core 1.19.575 → 1.19.576

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.575",
-  "core_contract": "1.19.575",
-  "source_commit": "06f2bc7360c871c7ae9051caae7372bd32e4e220",
+  "core_version": "1.19.576",
+  "core_contract": "1.19.576",
+  "source_commit": "a97463936d818b3a6be556837447748b3a2abaa1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T02:30:21.362Z",
+  "built_at": "2026-09-07T14:24:36.180Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 450,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2518,
-  "tree_sha256": "ff29aa75a762fd923fca632d24204ec76f53ab2c2ad0ea8d00862050083a1bca",
+  "tree_sha256": "9b56f557f5e1d8d63c314cb2990df89c75d7230c3f16bdd41416396d95e2b6bd",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "975da7ed26da38c356d4e7b1882360b9bffa442cc30f94ab8d97beec256dd4a9"
+      "sha256": "8f122cc3f3ca35dcc6569b98bad34967f2a4bbf9ebcbc0e645ca2b1016245fbc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7552,12 +7552,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "863449e24534ec382f2f4fd20a9e51e6bfd60d54cfe28dc90bf9676c005216d0"
+      "sha256": "8a58247d11bee28e30582d0860bd54cac15c8f3cb30753111063711a9369c390"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ea9f793f71d0eec2ce2dffe4c04798b6fe619e9af70e71f3a56282f5a60eb8b8"
+      "sha256": "e2f634e2e1deae3517a6b545c91a2b4818c51b04cb56daa4f1528b822cc1d14e"
     },
     {
       "path": "public-docs/index.html",
@@ -9257,7 +9257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "260a36b45692ff9d97f9ad058bb7040b9a3d35eff75c9f85a217fa5aac08f651"
+      "sha256": "fb020c72dfb07b789b7e281ba766fe8f0f9c4fe67c359c8b5c9928c8e86b85da"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11157,7 +11157,7 @@
     {
       "path": "tests/logger.mjs",
       "mode": "0000644",
-      "sha256": "edf87a88bd7130e85844db291d5f1d7b6de561434501bdb064dfadf0e23befe1"
+      "sha256": "7450580274562f784122e5e9eefe458669fb9083adddb7268364de7139f94cb5"
     },
     {
       "path": "tests/main_audit.mjs",

package/docs/module-api-changelog.md

@@ -1599,5 +1599,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.573 with no explicit bump. run 34075598213. (task 1002620)
   1.19.575 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.574 with no explicit bump. run 34076465465. (task 1002620)
+  1.19.576 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.575 with no explicit bump. run 34132732488. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.575",
+  "version": "1.19.576",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.575",
+      "version": "1.19.576",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.575",
+  "version": "1.19.576",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.575'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.576'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/logger.mjs

@@ -11,8 +11,20 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// pino resolves as a BARE specifier, never as ROOT/node_modules/pino (task 1003616).
+// An absolute path demands the directory exist at exactly that spot, so a fresh
+// per-claim worktree with no install of its own reported a phantom FAIL; the bare
+// form walks parent directories and finds the checkout the worktree lives under.
+// Where nothing is installed at all — a package-only consumer — say so and skip,
+// the same contract tests/hooks_drain.mjs uses for its own `pg` gate.
+try { require.resolve('pino'); } catch {
+  console.log('logger: SKIP — pino is not installed in or above this checkout (run npm install).');
+  process.exit(0);
+}
+
 const log = require(path.join(ROOT, 'src', 'bongos', 'logger.js'));
-const pino = require(path.join(ROOT, 'node_modules', 'pino'));
+const pino = require('pino');
 const { Writable } = require('node:stream');
 
 // pino writes through sonic-boom directly to the fd, so we can't intercept the