@bongos/core 1.19.652 → 1.19.653

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.652",
-  "core_contract": "1.19.652",
-  "source_commit": "addabb3fbae5b20acb74b0d7ee3cf369d6a4e8f5",
+  "core_version": "1.19.653",
+  "core_contract": "1.19.653",
+  "source_commit": "eff58cdbf33eb107723b56ef2f119c578d628d5e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T21:00:32.591Z",
+  "built_at": "2026-09-10T23:48:13.514Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 472,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2606,
-  "tree_sha256": "0625f6b55212a6ec7203db50d856c576c15b3eda23ea574a46fb212641dc163c",
+  "tree_sha256": "f2c83acf6434a7c56482adc7efcd782b2577ba4f4d6092d74e2ea143b5c6f90c",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7b9836503b654f29b308db8418484f1f707bfe6edcd32aaae6aa1c1a17216b5b"
+      "sha256": "11da08cbbf3f33e0a95df12baddcfc0bddba2b4bb4cf7c77f2a818c7d1dbfba8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7742,12 +7742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9fcb8bfb10f688b6442649f49bd4cc91454e56a44169414ca8839caab3fc05c7"
+      "sha256": "42dddf576e9fb7f8d33e39dff4244f6105bd4bf78b150cf700d819f763ab6b8d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ed0d91d1a9a16e1f8e97ce2b538de568c297bc281cf15ea99f22f9bb92f1b5f0"
+      "sha256": "12d491b531085f6ed22cbda1b8f7485401c186fd10b1cb4170e8af6bed174d95"
     },
     {
       "path": "public-docs/index.html",
@@ -8187,7 +8187,7 @@
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
-      "sha256": "5ea954ec0bf26e5192a369d0f94dcb3b8bf2e263c9e927c66a01791962a46995"
+      "sha256": "f64905f88718e5617ee97584dada757367497eed350bfb41814d257c9d2ec680"
     },
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
@@ -8207,7 +8207,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "3593c992b397333ee85f11dc2ea6325c3c96a2d1e5b813204da32c34c493b236"
+      "sha256": "b30c5c2b3bf6465a63a7124327ad40f94987088d1d87fcc110fec9281539a0a1"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9502,7 +9502,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d0459d72e42fdd8e712146f10545b27b6f82a310afa7bd0acb1b9290e1ef17b3"
+      "sha256": "03201e0e94d7ba4d755c8d0efae051208913faa2a7f654b231d3cb9ded49bd9b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10957,7 +10957,7 @@
     {
       "path": "tests/government_vocabulary.mjs",
       "mode": "0000644",
-      "sha256": "71bd23242e53b1acd15fddedcb093790a847471c8c55485614d379d29e3065f3"
+      "sha256": "444f0638dccebc42e5a371820ed565c665d4373c198e1581389ab222bf267c5e"
     },
     {
       "path": "tests/grade_aggregates_unavailable.mjs",

package/docs/module-api-changelog.md

@@ -1753,5 +1753,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.650 with no explicit bump. run 34526936330. (task 1002620)
   1.19.652 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.651 with no explicit bump. run 34529655648. (task 1002620)
+  1.19.653 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.652 with no explicit bump. run 34543713846. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.652",
+  "version": "1.19.653",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.652",
+      "version": "1.19.653",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.652",
+  "version": "1.19.653",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -48,11 +48,36 @@ const VOCAB_ALLOW = [
   },
 ];
 
-// A line CITING a historical artifact by its real name: an ADR filename, the
-// docs/governance/ evidence folder, or one of the already-applied
-// governance_NNN migrations. These names are permanent (see the header), so a
-// reference to one is a citation, not drift.
-const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
+// A line CITING a durable artifact by its real name: an ADR filename, the
+// docs/governance/ evidence folder, one of the already-applied migrations, or
+// the cross-goal pass-event contract. These names are permanent (see the
+// header), so a reference to one is a citation, not drift.
+//
+// The migration family is `govern(ance|ment)_NNN` on purpose. government_001
+// RENAMED the governance_NNN family to government_NNN, so half the applied
+// migrations on disk carry each spelling and BOTH are permanent — and the
+// rename migration's own filename (`government_001_rename_from_governance.sql`)
+// says the banned word while matching neither half of the old regex. That is
+// not drift; it is the one filename that has to name what it renamed.
+//
+// docs/specs/board-room-pass-event-contract.md is here for the same reason a
+// migration filename is: it is the agreed cross-goal name of the economy-side
+// award (awardIdeaGovernancePassCredit) and the credit_log reason family
+// idea.credit.governance_pass:<id>. Those are durable ledger rows and another
+// goal's method signature — a line pointing at the contract is citing a name
+// this surface does not own and cannot rename.
+const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|govern(?:ance|ment)_0\d\d|board-room-pass-event-contract/;
+
+// Naming the RULE stays legal — a line that cites ADR 0174 or the task that
+// built the wall is meta-commentary about the ban, and meta-commentary has to
+// be able to say the banned word. Same principle as check 19b's
+// GOAL_VOCAB_CITATION, and deliberately preferred over a per-file VOCAB_ALLOW
+// entry: the exemption belongs to the CITATION, not to whichever file happens
+// to hold it today. (Adding '.md' to VOCAB_EXTS brought the module's own
+// nested CLAUDE.md into scope — the file that TEACHES this rule, which states
+// it in the same breath. Three allowlist entries would have taken the cap of 5
+// to its limit for lines whose only sin is quoting the rule correctly.)
+const VOCAB_CITATION = /ADR 0174|task 1003008/;
 
 const VOCAB_SURFACE = [
   'modules/government',
@@ -67,7 +92,13 @@ const VOCAB_SURFACE = [
   'modules/hall-ui/public/board-room.html',
   'modules/hall-ui/public/board-room.css',
 ];
-const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
+// '.md' is load-bearing, not tidiness (task 1003120). A nested CLAUDE.md is
+// INSTRUCTION: it loads on demand for every agent working in the module, and
+// the agent that reads the wrong vocabulary there goes on to write it into the
+// code. Leaving markdown unscanned is how modules/government/CLAUDE.md came to
+// assert the INVERSE of ADR 0174 and survive a criterion review (task 1003118).
+// The doc surface is the higher-leverage one to guard, and it was the unguarded one.
+const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css', '.md']);
 const VOCAB_BANNED = [
   { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
   { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
@@ -202,6 +233,9 @@ function checkVocabularyWall() {
         // too, or the code could not point at the migration that created its own
         // tables. Same principle, applied to the line rather than the file.
         if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
+        // A line that CITES the rule is meta-commentary about the ban, not an
+        // instance of it. Costs no allowlist entry and travels with the sentence.
+        if (VOCAB_CITATION.test(scanLine)) continue;
         const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
         if (excused) continue;
         violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
@@ -214,8 +248,52 @@ function checkVocabularyWall() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
-        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
+    note: `${scanned} government-surface file(s) scanned for "role"/"governance" (${[...VOCAB_EXTS].sort().join(' ')}); `
+        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies), plus the citation rule. `
+        + 'Historical migrations + docs/adr are excluded by construction, not suppressed.',
+  };
+}
+
+// ── Check 19c — a rename sweep that ate its own arrow (task 1003120) ─────────
+//
+// THE HOLE CHECK 19 CANNOT SEE. Checks 19 and 19b grep for a BANNED WORD, so
+// they are structurally blind to the damage that actually happened in task
+// 1003118: a find-and-replace ran over a doc that was DESCRIBING the rename, and
+// swept BOTH sides of every rename pair. `governance` → `government` became
+// `government` → `government`. Not one banned word survives that edit, so the
+// wall passed — while the nested CLAUDE.md now taught the next agent that the
+// old name and the new name were the same word, and asserted the inverse of
+// ADR 0174 through a criterion review.
+//
+// An arrow between two identical names states nothing. It is only ever the
+// fossil of a sweep, so flagging the SHAPE catches the defect on the day it
+// lands, with no vocabulary to enumerate. Measured on the whole tree: the one
+// hit outside this surface is ADR 0194's `open` → `open`, a real mapping
+// sentence — which is why the check is scoped to the government surface (the
+// files the rename actually swept) rather than run repo-wide.
+const RENAME_IDENTITY_RE = /`([\w./-]+)` *(?:→|->) *`\1`/;
+
+function checkGovernmentRenameIdentity() {
+  const violations = [];
+  let scanned = 0;
+  for (const { abs, rel } of vocabFilesToScan()) {
+    scanned += 1;
+    fs.readFileSync(abs, 'utf8').split('\n').forEach((line, i) => {
+      const m = RENAME_IDENTITY_RE.exec(line);
+      if (!m) return;
+      violations.push(`${rel}:${i + 1}: \`${m[1]}\` → \`${m[1]}\` — a rename arrow between two IDENTICAL names states nothing. `
+        + 'A sweep ate one side of the pair (task 1003118); restore the name it renamed FROM.'
+        + `  →  ${line.trim().slice(0, 90)}`);
+    });
+  }
+  return {
+    name: 'a rename arrow names two different things (task 1003120)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} government-surface file(s) scanned for \`X\` → \`X\` pairs; no allowlist — `
+        + 'an arrow between identical names has no legitimate form to excuse.',
   };
 }
 
@@ -225,12 +303,15 @@ module.exports = {
   GOAL_VOCAB_LINE_SCOPED,
   GOAL_VOCAB_SURFACE,
   LIFECYCLE_DB_FILES,
+  RENAME_IDENTITY_RE,
   VOCAB_ALLOW,
   VOCAB_BANNED,
+  VOCAB_CITATION,
   VOCAB_EXTS,
   VOCAB_HISTORICAL_REF,
   VOCAB_SURFACE,
   checkGoalMembershipVocabulary,
+  checkGovernmentRenameIdentity,
   checkVocabularyWall,
   vocabFilesToScan,
 };

package/scripts/gds/fitness.js

@@ -36,7 +36,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
-const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
 // ============================================================================
 // Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
 // ============================================================================
@@ -1374,6 +1374,7 @@ const CHECKS = [
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
+  checkGovernmentRenameIdentity, // Check 19c — task 1003120: `X` → `X`, the rename arrow a sweep ate both sides of (the shape checks 19/19b are blind to)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
@@ -1434,8 +1435,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  checkVocabularyWall, VOCAB_ALLOW,
-  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE,
+  checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, // 19c — task 1003120
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.652'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.653'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_vocabulary.mjs

@@ -46,18 +46,113 @@ test('a planted "governance" on the government surface REDS the build', () => {
 // Plant a line into a real government-surface file, run the check, restore.
 // Uses the real file rather than a fixture so the test exercises the same path
 // resolution the CI gate does.
-function withPlantedLine(line) {
+function withPlantedLine(line, relParts = ['modules', 'government', 'resolver.js'], check = 'checkVocabularyWall') {
   const fs = require('node:fs');
-  const target = path.join(ROOT, 'modules', 'government', 'resolver.js');
+  const target = path.join(ROOT, ...relParts);
   const original = fs.readFileSync(target, 'utf8');
   try {
     fs.writeFileSync(target, `${original}\n${line}\n`);
-    return fitness.checkVocabularyWall().violations;
+    return fitness[check]().violations;
   } finally {
     fs.writeFileSync(target, original);
   }
 }
 
+const MD = ['modules', 'government', 'CLAUDE.md'];
+
+// ---------- markdown is inside the wall (task 1003120) ----------
+//
+// The gap this closes: a nested CLAUDE.md is INSTRUCTION — it loads on demand
+// for every agent working in the module, and the agent that reads the wrong
+// vocabulary there writes it into the code next. It sat outside the very rule
+// it describes, which is how it came to teach the INVERSE of ADR 0174 and
+// survive a criterion review (task 1003118).
+
+test('the wall scans markdown — the doc that TEACHES the rule is inside it', () => {
+  assert.ok(fitness.VOCAB_EXTS.has('.md'),
+    'markdown must be scanned: the highest-leverage vocabulary surface is the nested '
+    + 'CLAUDE.md an agent reads before writing code, not the code itself');
+  const scanned = fitness.vocabFilesToScan().map((f) => f.rel);
+  assert.ok(scanned.includes('modules/government/CLAUDE.md'),
+    `the module's own nested doc must be in scope; scanned: ${scanned.join(', ')}`);
+});
+
+test('a planted "role" in a government MARKDOWN file REDS the build', () => {
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md.*"role"/.test(v)),
+    'a doc that teaches the banned vocabulary must be caught — otherwise adding '
+    + '.md to VOCAB_EXTS bought nothing');
+});
+
+// ---------- the citation rule is an exemption, not a hole ----------
+//
+// Preferred over three more VOCAB_ALLOW entries (which would have taken the cap
+// of 5 to its limit) because the exemption belongs to the CITATION, not to
+// whichever file happens to hold it. So it has to be narrow, and both halves of
+// that are load-bearing: it lets the rule be NAMED, and nothing else.
+
+test('a line that CITES the rule may say the banned word', () => {
+  const planted = withPlantedLine('On this surface "role" is banned — see ADR 0174.', MD);
+  assert.ok(!planted.some((v) => /CLAUDE\.md/.test(v)),
+    'meta-commentary about the ban has to be able to name it, or the doc could '
+    + 'not state the rule it enforces');
+});
+
+test('the citation rule does NOT excuse the rest of the line', () => {
+  // Same file, same banned word, no citation: still caught. Without this the
+  // exemption could be silently widened to "this file is fine" and stay green.
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md/.test(v)),
+    'a line with no citation must still red — an exemption that covers the file '
+    + 'rather than the sentence is an allowlist wearing a regex');
+});
+
+test('the allowlist did not grow to absorb the markdown surface', () => {
+  // The whole point of the citation rule: bringing .md into scope surfaced three
+  // legitimate lines, and NONE of them cost an allowlist slot.
+  assert.ok(fitness.VOCAB_ALLOW.length <= 4,
+    `the allowlist grew to ${fitness.VOCAB_ALLOW.length} when .md came into scope. `
+    + 'The citation rule exists so it would not have to.');
+});
+
+// ---------- check 19c: the rename arrow a sweep ate both sides of ----------
+//
+// The defect checks 19 and 19b are structurally blind to. Task 1003118 ran a
+// find-and-replace over a doc DESCRIBING the rename and swept both sides of
+// every pair: `governance` → `government` became `government` → `government`.
+// No banned word survives that edit, so the wall passed while the doc taught
+// the next agent that the old and new names were the same word.
+
+test('the government surface carries no identity rename arrows today', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.equal(r.ok, true,
+    `an \`X\` → \`X\` arrow is on the surface:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+test('a planted `X` → `X` pair REDS the build', () => {
+  const planted = withPlantedLine('The sweep renamed `ranks.js` → `ranks.js` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.ok(planted.some((v) => /ranks\.js/.test(v)),
+    'an arrow between two identical names states nothing and is only ever the '
+    + 'fossil of a sweep — it must be caught');
+});
+
+test('a REAL rename arrow is left alone', () => {
+  // The check must not punish the sentence it exists to protect: a doc
+  // describing the rename correctly names two different things.
+  const planted = withPlantedLine('The sweep renamed `governance_001` → `government_001` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.equal(planted.length, 0,
+    `a legitimate A → B rename must pass, or the rule teaches docs not to describe `
+    + `renames at all:\n${planted.join('\n')}`);
+});
+
+test('the rename-identity check has no allowlist to erode', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.ok(/no allowlist/.test(r.note),
+    'an arrow between identical names has no legitimate form, so there is nothing '
+    + 'to excuse — and no slot for a future exemption to grow into');
+});
+
 // ---------- the allowlist is small, reasoned, and real ----------
 
 test('every allowlist entry carries a written reason', () => {