@bongos/core 1.19.605 → 1.19.607

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.605",
-  "core_contract": "1.19.605",
-  "source_commit": "7d75ad596b8a0ebda56d47a18c68f8d7d0372a62",
+  "core_version": "1.19.607",
+  "core_contract": "1.19.607",
+  "source_commit": "a2068c523c1b4845be5d94b006e95f1d213717ed",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T23:30:23.409Z",
+  "built_at": "2026-09-08T23:51:21.550Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 458,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2077,
+    "functional_verbatim": 2078,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2559,
-  "tree_sha256": "54ebf8421271793cdf29f4b7b5cbf777661dfb39ec6bd1eaba4639b0245316c9",
+  "file_count": 2560,
+  "tree_sha256": "1e9d9d267269d69cf9e5cf933d04757d0d20961047ab7f9cd2bfed3cbc721bd7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2732,7 +2732,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "310d1c9b2d8b922f06253f9f93b4f6c4c43f1841c6c1dc8b65e3867371669dad"
+      "sha256": "69fd2cbffee9e8396923dd5984eafe6b647809c1695b87f1d5d0543748187904"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7632,12 +7632,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e852049fb0b2971ebe8c8abb994d0f4239a97e81b56a355eafc055b057beaced"
+      "sha256": "65e25f20c4196fe1064184914552bf3ffbd5fca85db7c6115084d5d5b1e9a210"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d5eed87ff6d40d0f4abd5cd21db941c624240471beacd6dde3ce15b7d800221b"
+      "sha256": "bfbaa26f7eb3571a6c520e890c2c55c8558643fc195d4a3e963896a22f8faef6"
     },
     {
       "path": "public-docs/index.html",
@@ -8399,6 +8399,11 @@
       "mode": "0000644",
       "sha256": "9898b6f8e60b9f5ee4aeb9a023d1b68bb5bfbdf589eed10923a8e492716340ed"
     },
+    {
+      "path": "scripts/gds/prove-strict-versioning.js",
+      "mode": "0000644",
+      "sha256": "dbaec451d7e67cfce811287ebb2289582ec47d73b1fbff92125e7991b734c807"
+    },
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
@@ -9352,7 +9357,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2d74208cc55db7fd00751b651faf4389a8b345ccfb46bea127d678a49f56629a"
+      "sha256": "504ef9943bde8940c3e32850ffb6206a3a2f0869cbd293e3482e7309ea0e3608"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1659,5 +1659,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.603 with no explicit bump. run 34288910914. (task 1002620)
   1.19.605 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.604 with no explicit bump. run 34290892691. (task 1002620)
+  1.19.606 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.605 with no explicit bump. run 34291868670. (task 1002620)
+  1.19.607 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.606 with no explicit bump. run 34292436274. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.605",
+  "version": "1.19.607",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.605",
+      "version": "1.19.607",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.605",
+  "version": "1.19.607",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/prove-strict-versioning.js

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+// scripts/gds/prove-strict-versioning.js — does strict versioning actually hold
+// on THIS instance? (BV1.R30a, task 1003716, goal 1000086; the harness BV1.R30
+// runs. ADR 0250, ADR 0263, ADR 0265.)
+//
+// ADR 0250 built five rules and ADR 0265 added a sixth, all enforced server-side.
+// Nothing could tell you whether they HOLD on a given instance — R30's brief said
+// "run each query against live and capture its output verbatim", which in practice
+// meant hand-assembling a dozen API calls and reading the results by eye. That is
+// how a proof ends up asserting what someone hoped rather than what the instance
+// returned.
+//
+// THE CORE SHIPS TO ANY INSTANCE, so this is not a one-off for the BONGOS-V1
+// cutover. "Is my scope actually closed?" is a question every instance will ask,
+// and its answer should not depend on someone reproducing a call sequence.
+//
+// Two halves, and the split is deliberate:
+//
+//   CHECKS are read-only and always run. They count the live rows and say what
+//   they found, whether or not it is what the rules promise.
+//
+//   PROBES (--probe) attempt writes that MUST be refused. Each one is chosen so a
+//   refusal is the only legal outcome, and it is SKIPPED WITH A STATED REASON when
+//   the preconditions for a guaranteed refusal are absent — a probe that could
+//   succeed is a mutation, not a proof. Each also RE-READS afterwards: a 409 that
+//   nevertheless mutated is the failure mode worth catching, and no amount of
+//   reading the status code finds it.
+//
+// Exit code is non-zero if any check fails, so this can become a gate.
+//
+// Usage:
+//   node scripts/gds/prove-strict-versioning.js [--probe] [--json]
+//   CLOUDBONGOS_API_BASE=https://cloudbongos.com node scripts/gds/prove-strict-versioning.js --probe
+
+// apiCall is the ONE HTTP client for this directory: it resolves the instance
+// base and bearer, returns { status, ok, data } WITHOUT throwing on an HTTP
+// status (exactly what a refusal probe needs), and routes through the
+// no-keep-alive dispatcher — a bare fetch() leaves sockets armed and turns a
+// natural exit into a hang.
+const { apiCall, hasFlag, cliExit, API_BASE } = require('./cli-lib');
+
+// The statuses that mean a task is FINISHED — one vocabulary, declared once
+// (BV1.R01, task 1003588). Everything else holds its goal, and therefore its
+// version, open. Read from the module rather than re-listed here so this file
+// cannot drift from the rule it is checking.
+const { TERMINAL_STATUSES } = require('../../modules/lifecycle/task-status');
+const NON_TERMINAL = ['backlog', 'ready', 'active', 'blocked', 'completed', 'confirmed']
+  .filter((s) => !TERMINAL_STATUSES.includes(s));
+
+// A goal that is no longer open must hold no unfinished work (ADR 0250 D2/D3).
+const CLOSED_GOAL_STATUSES = ['achieved', 'archived'];
+
+// A version's catch-all goal, by the two shapes the codebase has used. The
+// em-dash form is what `generalGoalTitle` matches; "Work with no goal yet" is
+// BONGOS-V1's, and the mismatch between them is exactly why 47 tasks went
+// homeless unnoticed (R31, task 1003711). Match BOTH, or this proof inherits the
+// blind spot it exists to close.
+const CATCH_ALL = (title, versionId) =>
+  title === `${versionId} — general` || /^work with no goal yet$/i.test(String(title || '').trim());
+
+// The API returns a refusal code in two shapes depending on which `res.fail`
+// overload the route used — a bare string, or an object carrying `.code`/`.error`.
+// Rendering the object straight gives `[object Object]`, which tells a reader
+// nothing about WHICH rule fired. Normalise both to the code.
+function errorCode(body) {
+  const e = body && body.error;
+  if (!e) return null;
+  if (typeof e === 'string') return e;
+  return e.code || e.error || e.message || null;
+}
+
+/** GET a Bongos API path, returning the parsed body. Throws on a non-2xx. */
+async function get(path) {
+  const r = await apiCall('GET', `/api/gds${path}`);
+  if (!r.ok) throw new Error(`GET ${path} → ${r.status}`);
+  return r.data;
+}
+
+/** POST a probe. Returns the status WITHOUT throwing — the status IS the proof. */
+async function probePost(path, body) {
+  const r = await apiCall('POST', `/api/gds${path}`, body || {});
+  return { status: r.status, body: r.data, why: errorCode(r.data) };
+}
+
+/** Every non-terminal task on the instance, one status at a time (the list route filters by one). */
+async function allNonTerminalTasks() {
+  const out = [];
+  for (const status of NON_TERMINAL) {
+    const j = await get(`/tasks?status=${encodeURIComponent(status)}&limit=1000`);
+    out.push(...(j.tasks || []));
+  }
+  return out;
+}
+
+const results = [];
+/** Record one check. `ok` false makes the whole run exit non-zero. */
+function record(id, ok, headline, detail) {
+  results.push({ id, ok, headline, detail: detail || null });
+}
+
+async function runChecks() {
+  const [versionsRes, goalsRes, tasks] = await Promise.all([
+    get('/versions'), get('/goals'), allNonTerminalTasks(),
+  ]);
+  const versions = versionsRes.versions || [];
+  const goals = goalsRes.goals || [];
+  const byGoal = new Map(goals.map((g) => [String(g.id), g]));
+  const byVersion = new Map(versions.map((v) => [String(v.id), v]));
+
+  // C1 — a closed goal holding unfinished work (ADR 0250 D2/D3).
+  const c1 = tasks.filter((t) => {
+    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
+    return g && CLOSED_GOAL_STATUSES.includes(g.status);
+  });
+  const c1Goals = [...new Set(c1.map((t) => String(t.goal_id)))];
+  record('C1', c1.length === 0,
+    `${c1Goals.length} closed goal(s) holding ${c1.length} unfinished task(s)`,
+    c1Goals.map((id) => `goal ${id} (${byGoal.get(id).status}) holds ${c1.filter((t) => String(t.goal_id) === id).length}`));
+
+  // C2 — every task has a real goal (ADR 0250 D4). The two populations are
+  // reported apart because they fail for different reasons: a catch-all is a
+  // goal nobody chose, a null is a goal nobody assigned, and only the first is
+  // visible to anything that reasons per goal.
+  const nullGoal = tasks.filter((t) => t.goal_id == null);
+  const inCatchAll = tasks.filter((t) => {
+    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
+    return g && CATCH_ALL(g.title, g.version_id);
+  });
+  record('C2', nullGoal.length === 0 && inCatchAll.length === 0,
+    `${nullGoal.length} task(s) with no goal, ${inCatchAll.length} in a catch-all goal`,
+    [`null goal_id: ${nullGoal.length}`, `catch-all: ${inCatchAll.length}`,
+     ...[...new Set(inCatchAll.map((t) => String(t.goal_id)))].map((id) => `  catch-all goal ${id} — ${byGoal.get(id).title}`)]);
+
+  // C3 — one version builds, at most one plans (ADR 0250 D5; R04 + R19).
+  const building = versions.filter((v) => v.status === 'building');
+  const planning = versions.filter((v) => v.status === 'planning');
+  record('C3', building.length === 1 && planning.length <= 1,
+    `${building.length} building, ${planning.length} planning`,
+    [`building: ${building.map((v) => v.id).join(', ') || '(none)'}`,
+     `planning: ${planning.map((v) => v.id).join(', ') || '(none)'}`]);
+
+  // C4 — the next version is scoped: every goal on the planning version carries
+  // at least one done-when criterion (R29b). A criterion-less goal can never
+  // achieve, so it entombs its version the way the catch-alls entombed V1.
+  if (planning.length === 0) {
+    record('C4', true, 'no planning version — nothing to scope yet (not a failure)', null);
+  } else {
+    const pv = planning[0];
+    const pvGoals = goals.filter((g) => String(g.version_id) === String(pv.id) && g.status === 'open');
+    const detail = [];
+    let missing = 0;
+    for (const g of pvGoals) {
+      const full = await get(`/goals/${g.id}`);
+      const n = (full.criteria || []).length;
+      if (n === 0) { missing++; detail.push(`goal ${g.id} — NO criteria — ${g.title}`); }
+    }
+    record('C4', missing === 0,
+      `${pv.id}: ${pvGoals.length - missing}/${pvGoals.length} goal(s) carry a done-when criterion`, detail);
+  }
+
+  // C5 — beyond R30's original four. R32 (task 1003713) made a close refuse to
+  // leave work behind; this is the same rule read from the other end, and it
+  // catches what closed BEFORE that rule existed.
+  const onShipped = tasks.filter((t) => {
+    const v = byVersion.get(String(t.version_id));
+    return v && v.status === 'shipped';
+  });
+  record('C5', onShipped.length === 0,
+    `${onShipped.length} unfinished task(s) stranded on a shipped version`,
+    onShipped.slice(0, 20).map((t) => `task ${t.id} (${t.status}) on ${t.version_id}`));
+
+  // C6 — a task and its goal must be on the SAME version. `PATCH /tasks/:id`
+  // refuses a cross-version link with 409 `goal_version_mismatch`, but nothing
+  // has ever checked the rows that predate that rule — and the hierarchy is
+  // version → goal → task, so a split row is counted by one version's rollup
+  // while appearing under the other version's goal. It is also how C5 and a
+  // by-goal count can honestly disagree about the same task, which is exactly
+  // how this check got written.
+  const split = tasks.filter((t) => {
+    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
+    return g && String(g.version_id) !== String(t.version_id);
+  });
+  record('C6', split.length === 0,
+    `${split.length} task(s) whose goal lives on a different version`,
+    split.slice(0, 20).map((t) => `task ${t.id} on ${t.version_id}, but goal ${t.goal_id} is on ${byGoal.get(String(t.goal_id)).version_id}`));
+
+  return { versions, goals, tasks, building, planning, byGoal };
+}
+
+async function runProbes(ctx) {
+  const { goals, tasks, building, byGoal } = ctx;
+  const out = [];
+  /** A probe is only a proof when refusal is the sole legal outcome. */
+  const skip = (id, why) => out.push({ id, skipped: true, why });
+
+  // P1 — R03: a goal cannot join a version that is already building.
+  if (building.length === 0) {
+    skip('P1', 'no building version, so a refusal is not guaranteed');
+  } else {
+    const before = (await get('/goals')).goals.length;
+    const r = await probePost('/goals', { version_id: building[0].id, title: '__probe__ R03 refusal — must never be created' });
+    const after = (await get('/goals')).goals.length;
+    out.push({ absent: r.status === 404, id: 'P1', rule: 'R03 — goal onto a building version', status: r.status,
+      refused: r.status === 409, error: r.why, mutated: after !== before });
+  }
+
+  // P2 — R10: archive refuses without a disposition. Aimed at a goal VERIFIED to
+  // hold open tasks, because a goal holding none archives legitimately — that is
+  // the one shape of this probe that would destroy something.
+  const held = new Map();
+  for (const t of tasks) if (t.goal_id != null) held.set(String(t.goal_id), (held.get(String(t.goal_id)) || 0) + 1);
+  const target = goals.find((g) => g.status === 'open' && (held.get(String(g.id)) || 0) > 0);
+  if (!target) {
+    skip('P2', 'no open goal holds unfinished tasks, so a bare archive could succeed');
+  } else {
+    const r = await probePost(`/goals/${target.id}/archive`, {});
+    const after = (await get(`/goals/${target.id}`)).goal;
+    out.push({ absent: r.status === 404, id: 'P2', rule: `R10 — bare archive of goal ${target.id} (holds ${held.get(String(target.id))})`,
+      status: r.status, refused: r.status === 409, error: r.why, mutated: after.status !== 'open' });
+  }
+
+  // P3 — R12: a version holding open goals refuses a close with no dispositions.
+  if (building.length === 0) {
+    skip('P3', 'no building version to close');
+  } else {
+    const v = building[0];
+    const openGoals = goals.filter((g) => String(g.version_id) === String(v.id) && g.status === 'open');
+    if (openGoals.length === 0) {
+      skip('P3', `${v.id} holds no open goals, so a bare close could succeed`);
+    } else {
+      const r = await probePost(`/versions/${v.id}/close`, {});
+      const after = (await get('/versions')).versions.find((x) => String(x.id) === String(v.id));
+      out.push({ absent: r.status === 404, id: 'P3', rule: `R12 — bare close of ${v.id} (holds ${openGoals.length} open goals)`,
+        status: r.status, refused: r.status === 409, error: r.why, mutated: after.status !== 'building' });
+    }
+  }
+  return out;
+}
+
+(async () => {
+  const base = API_BASE;
+  const wantProbe = hasFlag('--probe');
+  const asJson = hasFlag('--json');
+
+  const ctx = await runChecks();
+  const probes = wantProbe ? await runProbes(ctx) : [];
+
+  if (asJson) {
+    console.log(JSON.stringify({ instance: base, at: new Date().toISOString(), checks: results, probes }, null, 2));
+  } else {
+    console.log(`\nStrict-versioning proof — ${base}`);
+    console.log(`  ${new Date().toISOString()}\n`);
+    for (const r of results) {
+      console.log(`  ${r.ok ? 'HOLDS ' : 'FAILS '} ${r.id}  ${r.headline}`);
+      if (r.detail) for (const d of r.detail) console.log(`           ${d}`);
+    }
+    if (wantProbe) {
+      console.log('\n  Refusal probes (each write below MUST be refused):');
+      for (const p of probes) {
+        if (p.skipped) { console.log(`  SKIP   ${p.id}  ${p.why}`); continue; }
+        const verdict = p.absent ? 'ABSENT ' : (p.refused && !p.mutated ? 'REFUSED' : 'LEAKED ');
+        console.log(`  ${verdict} ${p.id}  ${p.rule} → ${p.status}${p.error ? ` ${p.error}` : ''}`);
+        if (p.absent) console.log('           the route does not exist on this instance — the rule is built but NOT DEPLOYED here.');
+        if (p.mutated) console.log('           ⚠ THE STATE CHANGED ANYWAY — the refusal is cosmetic.');
+      }
+    } else {
+      console.log('\n  (read-only; pass --probe to also attempt the three refusals)');
+    }
+    console.log('');
+  }
+
+  const failedChecks = results.filter((r) => !r.ok).length;
+  // A 404 is NOT a leak — the rule simply is not on this instance yet. Counting it
+  // as a failure would make the harness cry wolf on every instance running an
+  // older core, and the honest signal ("built, not deployed") is already printed.
+  const leakedProbes = probes.filter((p) => !p.skipped && !p.absent && (!p.refused || p.mutated)).length;
+  // cliExit, never process.exit — a hard exit while the request machinery is still
+  // tearing down aborts natively on Windows/Node 24 AFTER stdout has flushed, so
+  // the run looks fine and then exits 127 (this directory's CLAUDE.md; task 1002734).
+  cliExit(failedChecks + leakedProbes > 0 ? 1 : 0);
+})().catch((err) => {
+  console.error('prove-strict-versioning failed:', err.message);
+  cliExit(2);
+});

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.605'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.607'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');