@bongos/core 1.19.641 → 1.19.642

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.641",
-  "core_contract": "1.19.641",
-  "source_commit": "7af21a0086bc6cbc069a459b0a30b90f1646f82e",
+  "core_version": "1.19.642",
+  "core_contract": "1.19.642",
+  "source_commit": "c6bea45e42c4f596aab75c09f8a0b5c1659a51bb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T17:12:24.520Z",
+  "built_at": "2026-09-10T17:19:26.832Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2600,
-  "tree_sha256": "1fd37a4de38d4265a2f0956b03da63ce66a9e84de7ce8a24e1c66ae4465ea028",
+  "tree_sha256": "220035e0bd7f1d6881e5ff218c34a135e0b0822527a21e30e4c2aa5a67ee4625",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "967b335b7e06715fb8c07cea7af1141fa2dd3acb0da7873017048bb63aad15d0"
+      "sha256": "12455239558665503941d95dda844f8de0d1db80ad9df889684ca896d251b663"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7722,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9a655dfca70f3edf6083c6533004860a8a6da53455d732526dea6c0c37f3fcf1"
+      "sha256": "1a1e2e7386cf99e8554916563b80a12da0ead3338a232208a4adab57cedb23bd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "80d6ffe532ebbd4d2165171ec5e2887487599e42c53e5411bb4048074d2eb0fb"
+      "sha256": "e831988b7dfec47e49c0e0c763fd9cb467cf51c296c08ea6a51d1f2747a19398"
     },
     {
       "path": "public-docs/index.html",
@@ -9232,7 +9232,7 @@
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "075c29580b58aa648b203b37c5d558900daaaa8cbfeaceb871ae9b1733361928"
+      "sha256": "b205304524629b0e867200e43a083bdf23b9121a6dbc2463c1e80e0e3fca8b8f"
     },
     {
       "path": "src/bongos/github-repos.js",
@@ -9482,7 +9482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cc274e241228f0ad4bb534674500d4daf228abcf6434241fed7152e49590f43f"
+      "sha256": "0ab1529d0da82c501530a79cfc3b7f47b00421677059a7afa7bf8382a9098fe6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10897,7 +10897,7 @@
     {
       "path": "tests/government_rank_sync.mjs",
       "mode": "0000644",
-      "sha256": "8750d0bbfc33403ff451b780935496a037dbab4a8e30bdc089abde8da8b7400a"
+      "sha256": "d4bd68c98f6e4bbec59890dde225f27f1daf380397f39d329b447fb77fd51c14"
     },
     {
       "path": "tests/government_require_permission.mjs",

package/docs/module-api-changelog.md

@@ -1731,5 +1731,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.639 with no explicit bump. run 34506041899. (task 1002620)
   1.19.641 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.640 with no explicit bump. run 34506718627. (task 1002620)
+  1.19.642 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.641 with no explicit bump. run 34507442448. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.641",
+  "version": "1.19.642",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.641",
+      "version": "1.19.642",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.641",
+  "version": "1.19.642",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/db.js

@@ -517,11 +517,12 @@ async function getLatestRankChangeForBuilder(builderId) {
 // Graceful builder exit (V3.R88 #307). Deactivating a builder is reversible
 // and lossless: drachmae (credits) + credit_log, shipped tasks, and historical
 // session_logs all stay. What changes: status → inactive (blocks new claims via
-// claimTask's guard), rank → 'xenos' (sandboxed tier), active claims released
-// cleanly with a final 'abandoned' session_log sealing each, and the tasks
-// returned to 'ready' for someone else. Reactivation flips status back; rank
-// is NOT auto-restored (an Archon re-promotes deliberately via PATCH
-// /builders/:id/rank). Memory archival is local-first and handled by the
+// claimTask's guard), rank → 'xenos' (sandboxed tier) WITH its seeded rank-role
+// rotated to match (task 1003193 — the direct SQL used to skip that), active claims
+// released cleanly with a final 'abandoned' session_log sealing each, and the tasks
+// returned to 'ready' for someone else. Reactivation flips status back and re-syncs
+// the rank-role; rank itself is NOT auto-restored (an Archon re-promotes deliberately
+// via PATCH /builders/:id/rank). Memory archival is local-first and handled by the
 // /builder-exit skill — the server never holds another builder's local memory
 // (the server-side memory store is criterion #54's job, not this task's).
 
@@ -571,6 +572,18 @@ async function deactivateBuilder({ builderId, reason, actorBuilderId }) {
                   deactivated_at, reactivated_at, deactivated_reason`,
       [builderId, reason ?? null]
     );
+    // BV1.R95b — rotate the seeded rank-role IN THIS TRANSACTION, exactly as
+    // _applyRankChangeTx does (task 1003193). The UPDATE above forces rank to
+    // 'xenos' by direct SQL rather than through setBuilderRank, so without this the
+    // builder's OLD seeded rank-role (archon, say) survives in
+    // government_builder_ranks — getRankKeysForBuilder has no builders.status filter.
+    // It is not a live grant while they are inactive (every session is revoked below
+    // and requireBuilder denies 'inactive' per request), but reactivateBuilder flips
+    // status back without touching rank, so the stale-high role would return live.
+    // The rank is read back from the row just written rather than re-spelled here.
+    // Deliberately uncaught, for the same reason as the twin: a committed
+    // deactivation whose rotation failed IS the privilege-retention bug.
+    await syncGovernanceRankRole(client, builderId, updated[0].rank);
     // Interim audit (→ audit_log when R36 lands). delta=0 = no-op for credits.
     await client.query(
       `INSERT INTO credit_log (builder_id, task_id, delta, reason)
@@ -629,6 +642,15 @@ async function reactivateBuilder({ builderId, actorBuilderId }) {
     );
     // Rank is intentionally left at whatever it is (xenos after a deactivation):
     // an Archon re-promotes deliberately via PATCH /builders/:id/rank.
+    //
+    // REACTIVATION IS THE EXPOSURE (task 1003193). Rank does not move here, but
+    // status flipping back to 'active' makes whatever seeded rank-role the builder
+    // still holds live again — getActiveBuildersWithRank, builderHoldsRankActive,
+    // the board roll and the R10 tally denominator all read it. So sync to the row's
+    // CURRENT rank: a stale-high role left by a deactivation predating this fix (or
+    // drifted in from anywhere else) is removed as PART of the reactivation rather
+    // than after it. Idempotent — a consistent builder costs two SELECTs, no write.
+    await syncGovernanceRankRole(client, builderId, updated[0].rank);
     await client.query(
       `INSERT INTO credit_log (builder_id, task_id, delta, reason)
        VALUES ($1, NULL, 0, $2)`,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.641'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.642'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_rank_sync.mjs

@@ -326,3 +326,130 @@ test('the writer EXECUTES its plan: a custom rank survives a rank change', async
   const del = c.find(/DELETE FROM government_builder_ranks/);
   assert.deepEqual(del.params, [11, ['archon']]);
 });
+
+// ---------------------------------------------------------------------------
+// offboard + reactivation (task 1003193)
+// ---------------------------------------------------------------------------
+//
+// deactivateBuilder forces rank='xenos' by direct SQL — not through
+// setBuilderRank/_applyRankChangeTx, the only paths that rotated the role — so the
+// offboarded builder's OLD seeded rank-role survived in government_builder_ranks,
+// and getRankKeysForBuilder has no builders.status filter. The stale row is not a
+// live grant while they are inactive; REACTIVATION is the exposure, because
+// reactivateBuilder restores status='active' without touching rank, and a
+// reactivated ex-Archon sitting at builders.rank='xenos' then matches
+// getActiveBuildersWithRank / builderHoldsRankActive on the stale archon row.
+//
+// Asserted by EXECUTION, like the writer tests above: withTx is stubbed on
+// db-kernel BEFORE src/bongos/db.js is required (it destructures at load), the
+// government port is wired to the REAL syncRank, and both functions run against one
+// recording client — so the rotation being on the same transaction, and after the
+// rank write, is a fact about the code rather than a regex over it.
+
+const kernel = require(path.join(ROOT, 'src/bongos/db-kernel.js'));
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+if (!seams.hasProvider('government.rankSync')) {
+  seams.registerProvider('government.rankSync', { syncRank: govDb.syncRank });
+}
+
+// One client for the whole transaction: the builders/claims/sessions statements the
+// exit path issues AND the two government reads syncRank makes. Order the matchers
+// specific-first — the assignments read also names government_ranks (it joins it).
+function exitTxClient({ builderId, rank, status, held = [], newRank, newStatus }) {
+  const calls = [];
+  return {
+    calls,
+    find: (re) => calls.find((c) => re.test(c.sql)),
+    indexOf: (re) => calls.findIndex((c) => re.test(c.sql)),
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/INSERT INTO|DELETE FROM/.test(sql)) return { rows: [] };
+      if (/FROM government_builder_ranks br/.test(sql)) return { rows: held };
+      if (/FROM government_ranks/.test(sql)) return { rows: SEEDED };
+      if (/FROM builders WHERE id = \$1 FOR UPDATE/.test(sql)) {
+        return { rows: [{ id: builderId, rank, status }] };
+      }
+      if (/FROM claims/.test(sql)) return { rows: [] };
+      if (/UPDATE builders/.test(sql)) {
+        return { rows: [{ id: builderId, rank: newRank, status: newStatus }] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+let txClient = null;
+kernel.withTx = async (fn) => fn(txClient);
+const coreDb = require(path.join(ROOT, 'src/bongos/db.js'));
+
+test('offboarding an Archon removes the archon rank-role in the deactivation transaction', async () => {
+  txClient = exitTxClient({
+    builderId: 25, rank: 'archon', status: 'active',
+    held: [seededRank_('archon')], newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 25, reason: 'left the team', actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM government_builder_ranks/);
+  assert.ok(del, 'deactivateBuilder must rotate the seeded rank-role, not only write rank=xenos');
+  assert.deepEqual(del.params, [25, ['archon']], 'the stale archon assignment must be the row deleted');
+  const ins = txClient.find(/INSERT INTO government_builder_ranks/);
+  assert.deepEqual(ins.params, [25, ['xenos']], 'and the sandboxed rank-role takes its place');
+
+  assert.ok(txClient.indexOf(/DELETE FROM government_builder_ranks/) > txClient.indexOf(/UPDATE builders/),
+    'the rotation must follow the rank write inside the same transaction');
+});
+
+test('reactivation re-syncs the rank-role, so a stale-high role cannot come back live', async () => {
+  // The pre-fix residue: rank was forced to xenos but the archon assignment stayed.
+  // Flipping status back to 'active' is the moment it becomes a live grant again.
+  txClient = exitTxClient({
+    builderId: 25, rank: 'xenos', status: 'inactive',
+    held: [seededRank_('archon')], newRank: 'xenos', newStatus: 'active',
+  });
+  await coreDb.reactivateBuilder({ builderId: 25, actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM government_builder_ranks/);
+  assert.ok(del, 'reactivateBuilder must sync the rank-role to the row\'s current rank');
+  assert.deepEqual(del.params, [25, ['archon']],
+    'a reactivated ex-Archon must not resolve Archon permissions on the stale row');
+  assert.deepEqual(txClient.find(/INSERT INTO government_builder_ranks/).params, [25, ['xenos']]);
+});
+
+test('a consistent builder is reactivated with no government write at all', async () => {
+  // The sync is a repair, not a rewrite: it must not churn rows on every offboard
+  // round-trip once the assignment already agrees with builders.rank.
+  txClient = exitTxClient({
+    builderId: 26, rank: 'xenos', status: 'inactive',
+    held: [seededRank_('xenos'), customRank('release-manager')], newRank: 'xenos', newStatus: 'active',
+  });
+  await coreDb.reactivateBuilder({ builderId: 26, actorBuilderId: 3 });
+
+  assert.ok(!txClient.find(/(INSERT INTO|DELETE FROM) government_builder_ranks/),
+    'no rotation is due — and the custom rank must survive untouched');
+});
+
+test('a custom rank survives an offboard (only the seeded rank-role rotates)', async () => {
+  txClient = exitTxClient({
+    builderId: 27, rank: 'metic', status: 'active',
+    held: [seededRank_('metic'), customRank('release-manager')], newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 27, reason: null, actorBuilderId: 3 });
+
+  assert.deepEqual(txClient.find(/DELETE FROM government_builder_ranks/).params, [27, ['metic']],
+    'offboarding must never revoke an Archon-assigned custom rank');
+});
+
+test('both exit paths rotate the role on the transaction client, uncaught', async () => {
+  // The posture half, which execution cannot show: no try/catch around the call, so
+  // a rotation that cannot be written rolls the status change back with it.
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/db.js'), 'utf8');
+  for (const fn of ['deactivateBuilder', 'reactivateBuilder']) {
+    const body = src.slice(src.indexOf(`async function ${fn}(`));
+    const end = body.indexOf('\n}\n');
+    const scope = body.slice(0, end === -1 ? body.length : end);
+    const sync = scope.indexOf('await syncGovernanceRankRole(client');
+    assert.ok(sync !== -1, `${fn}: must rotate the seeded rank-role inside its transaction`);
+    assert.ok(!/try\s*{[\s\S]*syncGovernanceRankRole/.test(scope),
+      `${fn}: the rotation must not be swallowed — a failed rotation has to roll the write back`);
+  }
+});