@bongos/core 1.19.634 → 1.19.635

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.634",
-  "core_contract": "1.19.634",
-  "source_commit": "c6cf6b2097a356d4fbeba38d35f63d7916f47161",
+  "core_version": "1.19.635",
+  "core_contract": "1.19.635",
+  "source_commit": "c97f3015861c4ca09d2c5a07f78ab33284d7c26c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T02:29:42.182Z",
+  "built_at": "2026-09-10T02:33:59.187Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 468,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2591,
-  "tree_sha256": "130728eaa47c8b34377490cb73c892c09b434f7921757c9152e0bc60022b1193",
+  "tree_sha256": "c5c9267a793145efe19a63442cfbe05ee6cf03d5c6ff363084857bf151aec4cc",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c14f5fdbf90cbd56a4bc7895d0bca43707ec4b983a841b4341a872cf4b769ef2"
+      "sha256": "baa05168e88c98e3fc35c1bf652bd85ef90dcfb463408c68e5132910316f8c34"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7707,12 +7707,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "89f594b6acc49fac8207c8a81f6bb1e35d0612256242a55313569ca4b71adebd"
+      "sha256": "f40ca54ae7693ccd7a41bb2429fa61f71b147f0aabc821535e4ca6e9055d9f49"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2a7c8b281d90d8f0bb544426dd5d7eb370a41e0004f7b2e7f429ff666c008df9"
+      "sha256": "1d7c9b3ad4172d3702cd4baa6fd5f30d1c26bedcfdcea6e8c2532d0decb9814e"
     },
     {
       "path": "public-docs/index.html",
@@ -9312,7 +9312,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "ad2d07652864d577736f6c0f83e27ff197fe2201796eb06c5577743c16119a5b"
+      "sha256": "514f9bb73cc74a2574272b733e0314dfe3b372497874bd7c88b763f22ddab64e"
     },
     {
       "path": "src/bongos/routes.js",
@@ -9452,7 +9452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9fe227bb682a168430e0f111e37ece6d952038cf9bb03b34abf5f11c39d2db8e"
+      "sha256": "79ef2ff7f2ac145450cc27389e4da2edd8079f2887ba7240c057e0e8cb8bb198"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12202,7 +12202,7 @@
     {
       "path": "tests/route_rank_check.mjs",
       "mode": "0000644",
-      "sha256": "bdc58224050392ece492ae8e8f12f62a8934d86e3993e0df5b8cb0aac80602e8"
+      "sha256": "9fd3762c6b171ee39b0cee336de2d41547795b2cd4898b178325cfdd321cf28a"
     },
     {
       "path": "tests/route_shadow_guard.mjs",

package/docs/module-api-changelog.md

@@ -1717,5 +1717,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.632 with no explicit bump. run 34417769106. (task 1002620)
   1.19.634 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.633 with no explicit bump. run 34429621784. (task 1002620)
+  1.19.635 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.634 with no explicit bump. run 34429906252. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.634",
+  "version": "1.19.635",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.634",
+      "version": "1.19.635",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.634",
+  "version": "1.19.635",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -517,6 +517,61 @@ function rankFromRankGate(tail) {
   return null;
 }
 
+// The source text of ONE route declaration — `router.X(` through its matching `)`.
+//
+// Why this exists (task 1003190, from the task-1002671 adversarial verification):
+// a route's middleware list IS its parenthesised argument list, so the honest bound
+// on "what gates this route" is the declaration's own paren balance. Every earlier
+// bound was a heuristic tail that cut at the next thing RESEMBLING a sibling, which
+// meant anything between the route and that marker still read as this route's gate.
+// Three shapes got through, each certifying an UNGATED route as gated with real
+// `via:'middleware'` provenance — passing the ungated-write blocker and satisfying
+// the EXPECTED_RANKS pins (the task-1002553 fix only stops `via:'annotation'`):
+//   1. a non-route gate below it   — `const guard = auth.requirePermission('…')`
+//   2. an inline classic handler   — `function (req, res) {` never matches `=> {`
+//   3. a middleware array below it — `const chain = [auth.requireRank('archon')]`
+// Shape 1 is the general case: task 1003062's next-`router.` clamp closed only the
+// sibling-ROUTE spelling of it, so the originally-filed repro no longer reproduces
+// while the hole itself stayed open.
+//
+// Scans quote-, template- and comment-aware so a `)` inside a route path, a string
+// default, or a comment cannot end the span early. Returns the whole text unchanged
+// when the opening `(` is absent or never closes inside the window — an unbalanced
+// declaration is not evidence of a narrower gate, so the caller keeps its prior
+// (wider, fail-loud) view rather than silently trusting a truncation.
+function declarationSpan(text) {
+  const open = text.search(/router\.(get|post|patch|put|delete|use)\s*\(/);
+  if (open === -1) return text;
+  const start = text.indexOf('(', open);
+  if (start === -1) return text;
+
+  let depth = 0;
+  let quote = null;      // "'" | '"' | '`' when inside a string/template
+  let comment = null;    // 'line' | 'block'
+  for (let k = start; k < text.length; k++) {
+    const c = text[k];
+    const next = text[k + 1];
+
+    if (comment === 'line') { if (c === '\n') comment = null; continue; }
+    if (comment === 'block') { if (c === '*' && next === '/') { comment = null; k++; } continue; }
+    if (quote) {
+      if (c === '\\') { k++; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '/' && next === '/') { comment = 'line'; k++; continue; }
+    if (c === '/' && next === '*') { comment = 'block'; k++; continue; }
+    if (c === "'" || c === '"' || c === '`') { quote = c; continue; }
+
+    if (c === '(') depth++;
+    else if (c === ')') {
+      depth--;
+      if (depth === 0) return text.slice(0, k + 1);
+    }
+  }
+  return text;
+}
+
 // Classify one route's gate from the source lines and the declaration index.
 // Returns { rank, perms, via } — `perms` is the permission atoms the route names, or
 // null when it carries no permission gate; `via` is the PROVENANCE of the label:
@@ -555,8 +610,14 @@ function classifyGate(lines, i, { floors } = {}) {
   // common because the fitness oversize ratchet pushes handler bodies out of large
   // route files, so this is not an exotic shape. A window must never cross into a
   // sibling declaration.
-  const nextRouteAt = window.search(/\n\s*router\.(get|post|patch|put|delete|use)\s*\(/);
-  const own = nextRouteAt === -1 ? window : window.slice(0, nextRouteAt);
+  // task 1003190: the two clamps above are both HEURISTIC TAILS — they cut at the
+  // next thing that looks like a sibling, so anything between the route and that
+  // sibling is still read as this route's middleware. `declarationSpan` replaces
+  // the guesswork with the real bound: the declaration's own parenthesis balance.
+  // A route's middleware list is, by definition, the arguments inside `router.X(
+  // … )`; nothing after the matching `)` can be a gate on THIS route. See that
+  // function's header for the three shapes the heuristics let through.
+  const own = declarationSpan(window);
   const handlerAt = own.search(/=>\s*\{/);
   const tail = handlerAt === -1 ? own : own.slice(0, handlerAt);
 

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.634'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.635'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/route_rank_check.mjs

@@ -80,6 +80,78 @@ test('a route declared with NO middleware does not borrow the NEXT route\'s rank
   assert.equal(rows.find((x) => x.method === 'POST').rank, 'archon');
 });
 
+// ---------- task 1003190: the bound is the DECLARATION, not a heuristic tail ----------
+//
+// From the task-1002671 adversarial verification (finding 1). The bleed above is only
+// the sibling-ROUTE spelling; task 1003062 closed that one by clamping at the next
+// `router.` declaration. But the clamp is still a heuristic TAIL — it cuts at the next
+// thing RESEMBLING a sibling, so any gate-shaped text BEFORE that marker was still read
+// as this route's middleware. Each case below is an UNGATED write that classified as
+// gated with real `via:'middleware'` provenance — which passes the ungated-write blocker
+// AND satisfies the EXPECTED_RANKS pins (the task-1002553 fix only stops
+// `via:'annotation'`). `declarationSpan` bounds the tail by paren balance instead, so
+// nothing after the declaration's matching `)` can be mistaken for its gate.
+//
+// The assertion that matters in each is `via`: 'unknown'/null is the auditor admitting
+// it cannot verify a gate (a blocker on a write route — loud, correct), whereas the bug
+// produced a confident, wrong 'middleware'.
+
+test('a named-function handler does not absorb a NON-ROUTE gate below it [task 1003190]', () => {
+  // The general case task 1003062's next-`router.` clamp does not reach: the gate-shaped
+  // text is a plain const, so there is no sibling declaration to clamp at.
+  const src = `router.post('/ungated-write', handleUngatedWrite);\n` +
+              `\n` +
+              `const guard = auth.requirePermission('government.manage');\n`;
+  const row = rrc.classifyText(src)[0];
+  assert.equal(row.rank, 'unknown');
+  assert.equal(row.via, null);
+  assert.equal(row.perms, null); // must NOT inherit government.manage
+});
+
+test('an inline CLASSIC function handler does not absorb a trailing gate [task 1003190]', () => {
+  // `function (req, res) {` never matches the `=> {` truncation, so before this fix the
+  // classifier fell through to the full 20-line window.
+  const src = `router.post('/ungated-write', function (req, res) {\n` +
+              `  res.end();\n` +
+              `});\n` +
+              `const guard = auth.requireRank('archon');\n`;
+  const row = rrc.classifyText(src)[0];
+  assert.equal(row.rank, 'unknown');
+  assert.equal(row.via, null);
+});
+
+test('a named-function handler does not absorb a middleware ARRAY below it [task 1003190]', () => {
+  const src = `router.post('/ungated-write', handleUngatedWrite);\n` +
+              `const chain = [auth.requireRank('archon')];\n`;
+  const row = rrc.classifyText(src)[0];
+  assert.equal(row.rank, 'unknown');
+  assert.equal(row.via, null);
+});
+
+test('a REAL multi-line middleware list is still read in full [task 1003190]', () => {
+  // The counter-test: bounding by paren balance must not truncate a legitimate gate that
+  // spans several lines. Without this, the fix above could "pass" by blinding the auditor.
+  const src = `router.post(\n` +
+              `  '/gated',\n` +
+              `  auth.requireBuilder,\n` +
+              `  auth.requirePermission('government.manage'),\n` +
+              `  async (req, res) => {\n` +
+              `    res.end();\n  },\n);`;
+  const row = rrc.classifyText(src)[0];
+  assert.equal(row.via, 'middleware');
+  assert.deepEqual(row.perms, ['government.manage']);
+});
+
+test('a gate inside a route PATH or string cannot be ended early by its parens [task 1003190]', () => {
+  // declarationSpan is quote-aware: a `)` inside the path string must not close the span
+  // before the real middleware is seen.
+  const src = `router.get('/re/(x)/y', auth.requireRank('archon'), async (req, res) => {\n` +
+              `  res.end();\n});`;
+  const row = rrc.classifyText(src)[0];
+  assert.equal(row.rank, 'archon');
+  assert.equal(row.via, 'middleware');
+});
+
 // ---------- BV1.R109b: multi-line route DECLARATIONS are visible at all ----------
 //
 // Distinct from the "multi-line middleware" test above: there the METHOD AND PATH were