@bongos/core 1.19.631 → 1.19.632

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.631",
-  "core_contract": "1.19.631",
-  "source_commit": "8202774d7961f042840d27630f4d0e1a6a5e07e9",
+  "core_version": "1.19.632",
+  "core_contract": "1.19.632",
+  "source_commit": "9fe600f2803473a279fd357fef4dd78cf1f7e03a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T23:08:37.908Z",
+  "built_at": "2026-09-09T23:32:52.198Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 467,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2590,
-  "tree_sha256": "12f67762d32cfaf31bd0af336ddcc207dcacaf27f2be902ae6b5de3aa45e3834",
+  "tree_sha256": "41e7cce2b7459c02fd56072f0784da040022f773accb86bdf4407f43a275f755",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bba1068a4fa47d679635e4b88d714e0246094440aa3df3e1b62e4df16d387aa9"
+      "sha256": "b923feda2cf9f8032a64e80fb2021de98d8f0de3ae7c454d21cc7b9ad9a252a3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7702,12 +7702,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cb7b272da5c1fc4642acf70c63ee1781ee34101fe912cc0e907ebb71fd5f1ae3"
+      "sha256": "cda41f429912a858d853d30b46423b1dafbeb97ec6c1b86725e3160567e05c13"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9dba32fee8407356a478c9d5038b7d95db52c1a9d8a9e242f0be79d3c4d79f65"
+      "sha256": "ffd33922c9171797cb1138b0bcc822258d4959ba8bd0186cba54b962313cdf45"
     },
     {
       "path": "public-docs/index.html",
@@ -9257,7 +9257,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "355a2ceb744e52afa710a23bc50b2df4e27982e5b8bb1cf73ed2db6d530c830e"
+      "sha256": "9a089861e3a9692646381208a71fd3fe4d146c747f1727fabc9d96079d509538"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9447,7 +9447,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f4839dfff1614c47e74577cff4761fb951d17c1702d5bccc77e818348077b9c6"
+      "sha256": "f4936b4b2e9cd4a1ce254e9be6ea19c0015f198f0799f8ef1f96dc06317080d5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11547,7 +11547,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "e705c80ebe2637941415fb96c1add4c0d73b37d956e8f14f0bbf3c8729d33257"
+      "sha256": "470ccf8f8d5f30ce613f01db7dca4ceda00163b5df16a8a0a4ec84a947eba083"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/module-api-changelog.md

@@ -1711,5 +1711,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.629 with no explicit bump. run 34415169250. (task 1002620)
   1.19.631 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.630 with no explicit bump. run 34415537907. (task 1002620)
+  1.19.632 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.631 with no explicit bump. run 34417373737. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.631",
+  "version": "1.19.632",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.631",
+      "version": "1.19.632",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.631",
+  "version": "1.19.632",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -339,6 +339,53 @@ const MODULE_GLOBS = {
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
     'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
   ],
+  // --- the METHODOLOGY surfaces: the instruction core an agent session actually
+  //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
+  //     slash-command skills, and the two scripts/gds files that compose a session's
+  //     opening context (start.js and the discipline→mode table it routes on).
+  //     Added by task 1002989 (goal 1000095, working area 6) as PREP for the
+  //     kernel↔pack split (task 1002990): that work rewrites CLAUDE.md, authors the
+  //     Engineer/Artist/Ideator packs, and deletes .claude/skills/{dev,ideate,paint}/
+  //     — paths NO key resolved, so the goal could not wall its own work (the
+  //     1002690 / 1002736 / 1003124 precedent: a missing key is an empty wall, and
+  //     goal-scope-check then denies every member-authored task).
+  //     `protected` DERIVES true — the root CLAUDE.md, docs/canonical-permissions.md
+  //     and the two trust ADRs sit in the ADR 0043 protected-surfaces registry — so a
+  //     goal scoped here is Archon-only (BV1.R57). Correct: this is the text that
+  //     frames every agent session.
+  //     BOUNDARIES.
+  //     • 'docs/' is deliberately the WHOLE subtree. The ADRs, recipes, session logs,
+  //       audits and design notes are one library; splitting it per module would rot
+  //       on the next doc, and the glob format has no wildcards to carve with. The
+  //       exact docs/ paths other keys enumerate (kernel's module-api-changelog,
+  //       copy-desk's two copy artifacts, ui-design's two loop recipes) stay listed
+  //       there for task affinity — overlap is legal (touchesOverlap is prefix-aware
+  //       both directions) and it keeps those walls standing on their own.
+  //       KNOWN CONSEQUENCE: docs/ was previously owned by nobody, which the ship-time
+  //       module-drift advisory (scripts/gds/ship-flow.js, BV1.R53) read as
+  //       "cross-cutting, allowed". A module_key-labelled task that also writes a
+  //       session log / ADR / regenerated doc now trips that WARNING (advisory only —
+  //       it refuses solely under --enforce-module). Filed as an idea to teach the
+  //       drift check about cross-cutting keys rather than shrink this glob.
+  //     • '.claude/skills/' is the whole dir, on the precedent the map already sets
+  //       for autonomy ('.claude/scheduled-tasks/') and agents ('.claude/agents/'):
+  //       a definition surface travels with the system that composes it. The
+  //       devsecops note — skills stay with whichever module ships the skill — still
+  //       holds for a module that enumerates its own (ui-design lists three); this
+  //       key is the floor under the ~50 that no module claims.
+  //     • '.claude/rules/' is pre-carved territory for task 1003687 (move the
+  //       CLAUDE.md content charter to a paths-scoped rule file) — the carve precedes
+  //       the feature, ADR 0086 §4, on the devsecops '.npmrc' precedent.
+  //     NOT here: scripts/gds/fitness.js. Task 1002989's brief named it as uncovered,
+  //     but that brief predates task 1003124, which gave devsecops the fitness/entropy
+  //     tooling. One owner per enforcement tool — the CLAUDE.md budget check is
+  //     enforcement, not methodology prose. ---
+  methodology: [
+    'CLAUDE.md',
+    'docs/',
+    '.claude/skills/', '.claude/rules/',
+    'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+  ],
 };
 
 // A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.631'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.632'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -206,3 +206,48 @@ test('devsecops joined the roster (task 1003124) — the enforcement territory g
   assert.equal(covers('.claude/skills/builder-ship/SKILL.md'), false, 'skills stay with the module that ships them');
   assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle, not devsecops');
 });
+
+test('methodology joined the roster (task 1002989) — the instruction surfaces working area 6 walls', () => {
+  // Before this, the root CLAUDE.md, docs/, .claude/skills/ and the two session-
+  // composing scripts were covered by NO key, so goal 1000095 could not wall the
+  // kernel↔pack split (task 1002990) — the work that rewrites CLAUDE.md, authors the
+  // Engineer/Artist/Ideator packs, and deletes the three discipline skills.
+  assert.ok(scope.isModuleKey('methodology'), 'roster missing module "methodology"');
+  const globs = scope.globsForModules(['methodology']);
+  assert.ok(globs.includes('CLAUDE.md'), 'methodology owns the always-loaded instruction root');
+  assert.ok(globs.includes('docs/'), 'methodology owns the docs library');
+  assert.ok(globs.includes('.claude/skills/'), 'the slash-command skills are the methodology definition surface');
+  assert.ok(globs.includes('scripts/gds/start.js'), 'the session-opening composer travels with the domain');
+  // Derived, not hand-set: CLAUDE.md, docs/canonical-permissions.md and the two trust
+  // ADRs sit in the ADR 0043 protected-surfaces registry, so this key MUST derive
+  // protected — creating or widening a goal into it is Archon-only (BV1.R57).
+  assert.equal(scope.isProtectedModule('methodology'), true, 'methodology must derive protected (CLAUDE.md is a protected surface)');
+  assert.equal(
+    scope.scopeForModule('methodology').protected,
+    scope.isProtected(globs),
+    'protected must be the faithful derivation, never a literal',
+  );
+  // Asserted through the REAL consumer (directional containment), not re-implemented.
+  const covers = (touch) => gsc.scopeSubset(['methodology'], [touch]).ok;
+  for (const touch of [
+    'CLAUDE.md',                              // the kernel half of the split (1002990)
+    '.claude/skills/dev/SKILL.md',            // one of the three discipline skills it deletes
+    '.claude/skills/ideate/SKILL.md',
+    '.claude/skills/paint/SKILL.md',
+    '.claude/rules/content-charter.md',       // pre-carved for task 1003687
+    'docs/adr/0264-the-ten-working-areas.md', // the ADR library
+    'docs/handoff-template.md',
+    'scripts/gds/start.js',                   // composes a session's opening context
+    'scripts/gds/discipline-modes.json',      // the discipline→mode table it routes on
+  ]) {
+    assert.equal(covers(touch), true, `wall does not cover ${touch}`);
+  }
+  // …and still BOUNDS: the trust kernel, the sibling .claude definition dirs, and the
+  // enforcement tooling devsecops owns all stay outside this wall.
+  assert.equal(covers('src/bongos/auth.js'), false, 'the wall must not cover the kernel auth core');
+  assert.equal(covers('.claude/settings.json'), false, 'the agent settings belong to devsecops');
+  assert.equal(covers('.claude/scheduled-tasks/bfg/SKILL.md'), false, 'scheduled-tasks belongs to autonomy, not methodology');
+  assert.equal(covers('.claude/agents/reviewer.md'), false, 'agent definitions belong to agents, not methodology');
+  assert.equal(covers('scripts/gds/fitness.js'), false, 'the fitness tool stayed with devsecops (task 1003124)');
+  assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle');
+});