@bongos/core 1.19.636 → 1.19.637

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.636",
-  "core_contract": "1.19.636",
-  "source_commit": "7e7d5caa1a0c5ff310bdab82a7679fd56e2f71d7",
+  "core_version": "1.19.637",
+  "core_contract": "1.19.637",
+  "source_commit": "1c08a67a41a3bf7de85545460f6803cf6c68982d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T03:45:41.270Z",
+  "built_at": "2026-09-10T04:22:04.368Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 468,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2592,
-  "tree_sha256": "abf5929f41b5c8b538294d87d01632069ad0371e2e2eed440b97a9727a33d426",
+  "tree_sha256": "09c8365d205c14a4ae13cab5ab9eb561213f4e38cc9126033a3942e5dda81e3f",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "74c46d5efae11f3adc3f0cb79bec6757e0f7bb820e7f77c1f66cd6fc083a503c"
+      "sha256": "3e80809a3e33883a21335d5380c6bf9358d98f09ac1ccf6322c864bbbaa06892"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7707,12 +7707,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7e8bd5c903c8f50fa7bcc80c7e317a4ea202bf079e0e63a8beafc988718953e1"
+      "sha256": "262eabcdc5a5a052871db03a5a334721de892e4d927f4c069787ad763d675686"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0e2c886ce78f829a2b694c3c49af7fafff6297695da0ddb346d7c0936fe95ff8"
+      "sha256": "e62905214d126629233cda9c9bbb2d57e3b45771899b66139237607269e190fb"
     },
     {
       "path": "public-docs/index.html",
@@ -8372,7 +8372,7 @@
     {
       "path": "scripts/gds/main-audit.js",
       "mode": "0000644",
-      "sha256": "18e14d00fead3293eb5b1c9d7a756a0a3780147938a40253ff35540740a73f4b"
+      "sha256": "35047f05c6059aee0cb64b13ef1495e4db1f3885b5b9c8cac5c60283069a059d"
     },
     {
       "path": "scripts/gds/me.js",
@@ -9457,7 +9457,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4c4fcf6a9833c72d6c371208d00afc60eba49cd07e5a0c9b4cd384133089340d"
+      "sha256": "b15a7de69ca6e8cd7c57b50dab455d6ec44a40336895c78738ad0f8ec8a25a10"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10857,7 +10857,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "fd05f72404be0d007222793a6ed3a49904239f8bb354cddab6b052d74288b3b1"
+      "sha256": "cd56facc3522f17cd83b067ee1ae9dcb3e4e03dac13157013c44d7ba23508af2"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -11442,7 +11442,7 @@
     {
       "path": "tests/main_audit.mjs",
       "mode": "0000644",
-      "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
+      "sha256": "eff2ce96889306f4898686c3648d302f54fff5f137ee41ddf543866fdf2f807d"
     },
     {
       "path": "tests/maintenance_goal.mjs",

package/docs/module-api-changelog.md

@@ -1721,5 +1721,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.634 with no explicit bump. run 34429906252. (task 1002620)
   1.19.636 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.635 with no explicit bump. run 34434517065. (task 1002620)
+  1.19.637 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.636 with no explicit bump. run 34436870653. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.636",
+  "version": "1.19.637",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.636",
+      "version": "1.19.637",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.636",
+  "version": "1.19.637",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/main-audit.js

@@ -55,7 +55,14 @@ const { cliClient, API_BASE } = require('./cli-lib');
 // not a GDS github_login, and every builder shares one commit email — so the
 // author NAME is the only distinguishing signal, and an unresolved name is
 // 'needs a human glance', not 'definitely a violation'.
-function analyzeCommits(commits, rankByIdentity, { strict = false } = {}) {
+//
+// `registry` is the protected-surface matcher, defaulting to the real one. It
+// is a parameter for the same reason `rankByIdentity` is: this analyzer is pure
+// and its callers supply its inputs. Tests inject a MIXED-FLOOR fixture through
+// it — the real registry floors every surface at 'metic' today, so without the
+// seam the per-hit floor comparison below is untestable and would silently rot
+// back into a global-minimum test. The CLI never passes it.
+function analyzeCommits(commits, rankByIdentity, { strict = false, registry = ppc } = {}) {
   const findings = [];
   for (const c of commits || []) {
     // #863-followup (finding #5): we no longer blanket-skip merges. For a
@@ -67,28 +74,46 @@ function analyzeCommits(commits, rankByIdentity, { strict = false } = {}) {
     // changes are still attributed to their feature commits (no double-count);
     // but a merge that smuggles a protected change is now caught and attributed
     // to the MERGE author.
-    const hits = ppc.matchProtected(c.files || []);
+    const hits = registry.matchProtected(c.files || []);
     if (hits.length === 0) continue;
 
     const rank = resolveRank(c, rankByIdentity);
     const fileList = hits.map((h) => h.file).join(', ');
     if (rank == null) {
+      const need = strictestFloorLabel(hits, registry);
       findings.push({
         severity: strict ? 'blocker' : 'review',
         sha: c.sha,
         author: c.authorName,
         rank: null,
         files: hits.map((h) => h.file),
-        summary: `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] but the author could not be resolved to a GDS rank. Verify it is Metic+ work.`,
+        summary: `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] but the author could not be resolved to a GDS rank. Verify it is ${need}+ work.`,
       });
-    } else if (ppc.isBelowFloor(rank)) {
+      continue;
+    }
+
+    // Each hit is judged against ITS OWN registry floor — not against the
+    // registry's global minimum. `isBelowFloor` tests the lowest floor any
+    // surface declares, which is identical only while every surface floors at
+    // the same rank (true today). The moment governance RAISES one surface's
+    // floor, a global-minimum test silently downgrades that raise back to the
+    // minimum here — in the one layer that catches a raw `git push origin main`
+    // (task 1003191; the cooperative layers already compare per-hit via
+    // checkPermissionPaths). Unknown ranks stay non-blocking, as before: an
+    // unresolvable rank is the `rank == null` case above.
+    const tier = registry.tierOf(rank);
+    const below = tier === null ? [] : hits.filter((h) => tier < registry.RANK_TIER[h.floor]);
+    if (below.length > 0) {
+      const need = strictestFloorLabel(below, registry);
+      const belowList = below.map((h) => `${h.file} (floor ${h.floor})`).join(', ');
       findings.push({
         severity: 'blocker',
         sha: c.sha,
         author: c.authorName,
         rank,
-        files: hits.map((h) => h.file),
-        summary: `commit ${short(c.sha)} by '${c.authorName}' (rank '${rank}', below Metic) modified permission-sensitive path(s) [${fileList}] — this is the SEC #863 violation class. It must be reverted and re-landed by a Metic+ builder if genuinely needed.`,
+        files: below.map((h) => h.file),
+        floors: below.map((h) => h.floor),
+        summary: `commit ${short(c.sha)} by '${c.authorName}' (rank '${rank}') modified permission-sensitive path(s) [${belowList}] whose registry floor it does not clear — this is the SEC #863 violation class. It must be reverted and re-landed by a ${need}+ builder if genuinely needed.`,
       });
     }
   }
@@ -115,6 +140,16 @@ function short(sha) {
   return String(sha || '').slice(0, 9);
 }
 
+// The highest rank floor demanded by a set of protected hits, title-cased for
+// prose ('Metic', 'Archon'). What a reader has to clear to own the whole commit
+// — so a finding names the floor that actually governs it rather than a
+// hardcoded 'Metic+' that a governance floor raise would make a lie.
+function strictestFloorLabel(hits, registry) {
+  const floors = hits.map((h) => h.floor);
+  const top = floors.reduce((a, b) => (registry.RANK_TIER[b] > registry.RANK_TIER[a] ? b : a), floors[0]);
+  return top ? top.charAt(0).toUpperCase() + top.slice(1) : 'Metic';
+}
+
 // ---------- git + API glue (CLI) ----------
 
 function git(args) {

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.636'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.637'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -172,14 +172,36 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
-test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
+// Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
+// exactly 'metic' made the registry's own contract untestable and, worse,
+// illegal: governance owns this data and raising one surface to 'archon' is a
+// policy edit the enforcers are supposed to honour. What must never happen is a
+// surface dropping BELOW Metic — that is ADR 0043 being weakened by a data edit.
+// So: no surface under Metic, and the derived minimum stays exactly Metic.
+test('no surface floors below Metic — the ADR 0043 floor (a raise above it is legal policy)', () => {
   for (const s of registry.SURFACES) {
-    assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
+    assert.ok(ppc.RANK_TIER[s.floor] >= ppc.RANK_TIER.metic,
+      `${s.glob} floors at '${s.floor}', below the Metic floor ADR 0043 sets. Governance may RAISE a floor; it may never lower one under Metic.`);
   }
-  assert.equal(registry.FLOOR, 'metic');
+  assert.equal(registry.FLOOR, 'metic', 'the lowest declared floor is the Metic floor itself');
   assert.equal(ppc.MIN_TIER, ppc.RANK_TIER.metic, 'the kernel floor must DERIVE to metic');
 });
 
+test('a floor raise flows through to the enforcers, not just the registry', () => {
+  // The registry promises a re-mapped floor reaches the substrate. Each layer
+  // must read the hit's OWN floor: the cooperative ones through
+  // checkPermissionPaths, the authoritative post-push audit through its per-hit
+  // comparison (task 1003191 — it used to test the global minimum and silently
+  // downgraded every raise).
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'main-audit.js'), 'utf8');
+  assert.ok(!/\bppc\.isBelowFloor\s*\(/.test(src),
+    'main-audit.js must not decide floors with isBelowFloor — that tests the registry '
+    + 'GLOBAL MINIMUM, so a governance floor raise is silently downgraded in the one '
+    + 'layer that catches a raw `git push origin main` (task 1003191).');
+  assert.ok(/RANK_TIER\[h\.floor\]/.test(src),
+    'main-audit.js must compare each hit against its own registry floor');
+});
+
 // ---------- the system-permission mapping flows from the registry ----------
 
 test('every entry maps to a permission the catalog defines as system:true', () => {

package/tests/main_audit.mjs

@@ -134,6 +134,101 @@ t('#863-followup (finding #6): a sub-Metic author NAME still resolves and BLOCKS
   assert.equal(r.findings[0].rank, 'thetes');
 });
 
+// -- per-hit registry floors (task 1003191) --------------------------------
+//
+// The authoritative layer used to decide floors with ppc.isBelowFloor(rank),
+// which tests the registry's GLOBAL MINIMUM floor. Every live surface floors at
+// 'metic', so that was indistinguishable from a per-hit comparison — until
+// governance RAISES one surface, at which point layer 3 silently downgraded the
+// raise back to the minimum while the pre-push hook and the grader (both on
+// checkPermissionPaths, which compares per-hit) still blocked it. Layer 3 is the
+// only one that catches a raw `git push origin main`, so the authoritative net
+// was the loosest of the three.
+//
+// A uniform-floor fixture cannot tell the two implementations apart. This is the
+// shape that can: one surface raised above the minimum, one left at it.
+const ppc = require('../src/bongos/permission-path-check.js');
+
+function mixedFloorRegistry() {
+  const SURFACES = [
+    { glob: 'infra/', floor: 'archon' },     // RAISED above the global minimum
+    { glob: 'src/bongos/db.js', floor: 'metic' }, // still at the minimum
+  ];
+  return {
+    RANK_TIER: ppc.RANK_TIER,
+    tierOf: (rank) => ppc.RANK_TIER[rank] ?? null,
+    matchProtected: (files) => (files || [])
+      .map((f) => {
+        const s = SURFACES.find((x) => (x.glob.endsWith('/') ? f.startsWith(x.glob) : f === x.glob));
+        return s ? { file: f, glob: s.glob, floor: s.floor, permission: 'path.protected.modify' } : null;
+      })
+      .filter(Boolean),
+  };
+}
+
+t('a RAISED surface floor is enforced: Metic touching an archon-floored path → BLOCKER', () => {
+  const r = analyzeCommits([{
+    sha: 'r01', subject: 'touch the substrate', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true, 'a governance floor raise must reach the authoritative layer');
+  assert.equal(r.findings.length, 1);
+  assert.deepEqual(r.findings[0].floors, ['archon']);
+  assert.match(r.findings[0].summary, /Archon\+ builder/);
+});
+
+t('the finding reports only the paths the author actually fails to clear', () => {
+  // db.js floors at the minimum this Metic DOES clear; infra/ does not. A
+  // per-hit comparison names the second and stays silent about the first.
+  const r = analyzeCommits([{
+    sha: 'r02', subject: 'mixed', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js', 'infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true);
+  assert.deepEqual(r.findings[0].files, ['infra/deploy.sh']);
+  assert.equal(r.findings[0].summary.includes('src/bongos/db.js'), false,
+    'a path the author clears must not be reported as a violation');
+});
+
+t('a raised floor does not over-block: Archon touching the same path → no finding', () => {
+  const r = analyzeCommits([{
+    sha: 'r03', subject: 'x', authorName: 'somearchon', authorEmail: 'l@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('a Metic still clears a surface left at the minimum floor', () => {
+  const r = analyzeCommits([{
+    sha: 'r04', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('an unresolved author is told the floor that actually governs, not a hardcoded Metic', () => {
+  const r = analyzeCommits([{
+    sha: 'r05', subject: 'x', authorName: 'Nobody Known', authorEmail: 'n@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].severity, 'review');
+  assert.match(r.findings[0].summary, /Archon\+ work/);
+});
+
+t('the default registry is the real one — no injection needed in production', () => {
+  // The seam must not change what the CLI does: infra/ floors at metic today,
+  // so a Metic touching it is legal on the live registry.
+  const r = analyzeCommits([{
+    sha: 'r06', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS);
+  assert.equal(r.hardFail, false);
+  assert.equal(ppc.floorFor('infra/deploy.sh'), 'metic');
+});
+
 // -- the default range window (task 1002566) -------------------------------
 //
 // Everything above tests the pure ANALYZER. Nothing tested what FEEDS it, which