@bongos/core 1.19.656 → 1.19.658

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.656",
-  "core_contract": "1.19.656",
-  "source_commit": "c0c5d7b3e5b4f9be24da806b898180fc4bf0df47",
+  "core_version": "1.19.658",
+  "core_contract": "1.19.658",
+  "source_commit": "116ba7cf659c5768b1e7ce2196e38becb98d2654",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T00:27:13.017Z",
+  "built_at": "2026-09-11T00:39:52.368Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 472,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2111,
+    "functional_verbatim": 2112,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2607,
-  "tree_sha256": "90e88ec865416bea870aef7c0ea90db47124defc012e894bc04037bea59f12a6",
+  "file_count": 2608,
+  "tree_sha256": "c480f8fa183ff4de3cbfefdfe804fe219ab875a0c873e4d9dc8ed1322652e3ae",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "273133f1ce79a6e67b3beaa6d993c7aa3dda23daba0beeb2e9aedf9250152e6f"
+      "sha256": "5c81ca2fe6d92058039999c0d5e38b67cfdaa795ba227e341b2339bbf20815d5"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -1932,12 +1932,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "bcf48ded2e73de1f9892dd8b3a088c1a36750df38b37296c77dfb30fc1741682"
+      "sha256": "9c7ebc5ac06b51b14168be63504572c223ade3b023f552181ae05e08c2f1891d"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "57d7553e4da5ee9fc563c79d712dde9aea8f89c21f03ddf1dd18a317d513ee71"
+      "sha256": "b0d5ba4f48eb6deeeafdd20b8dc6bb56cfb9340b85707b2da6a7a24c0637d5c6"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "448e81f5dfb15330d406be135e4ada5c3cfcf0751fca4457a7c91ab58d836d10"
+      "sha256": "08320e0ddfd04ab34b258eb3c6e2c4700c5cc209d76efb8becf7c9f65149678b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4789,20 +4789,25 @@
       "mode": "0000644",
       "sha256": "cad620c960fb6bb8533d40a1e1e9b841b998b30ff073dabaca8623ee183d142c"
     },
+    {
+      "path": "modules/hall-ui/public/board-lib.js",
+      "mode": "0000644",
+      "sha256": "4320cea37413fd9d4eb327c7c11cf4f49fd8ae33b21fe00e9b4d0ca2c3bf912b"
+    },
     {
       "path": "modules/hall-ui/public/board-room.css",
       "mode": "0000644",
-      "sha256": "df055656f8640c1fd2958f1d2a16f0e9aa0dbdccc33bf0e5eb24a8fb8e50e733"
+      "sha256": "863c8af438be96097a63555d4573baec2b3a0bbdc73c1d23366cf5484189fb8a"
     },
     {
       "path": "modules/hall-ui/public/board-room.html",
       "mode": "0000644",
-      "sha256": "8602cf3b22645128fcc99435c8aa5720a4d9b4cacc12a08345ae963c0bbf7ab7"
+      "sha256": "362381c40f1011455cab89d473108eb3f41747fe46cde62d932744fc2d2512f0"
     },
     {
       "path": "modules/hall-ui/public/board-room.js",
       "mode": "0000644",
-      "sha256": "c68b0361baf9d00233d6ca89cf7f85801ffeb07f32f9f084e387bf6160ffa211"
+      "sha256": "8ffede7efdf1c99e42fc58ecfe56ae6736c1ef3cd1446ca6a544c30f781947a2"
     },
     {
       "path": "modules/hall-ui/public/board-room.states.json",
@@ -5012,17 +5017,17 @@
     {
       "path": "modules/hall-ui/public/government.css",
       "mode": "0000644",
-      "sha256": "8965bda9e213aa638f9a0122b8d0a666cad3e4d825fe0dc691fc3f68d2cda45a"
+      "sha256": "df3a7f79fbcac083f8a616eead84b49d40ed867e08896a7f7279d1a56178799d"
     },
     {
       "path": "modules/hall-ui/public/government.html",
       "mode": "0000644",
-      "sha256": "7e8a2c198bd934bbc64e9317b144dddef85e10db919f1fa6294aa522756ae5f1"
+      "sha256": "83338cc027af8f146960f58c3398dd28c0218c9671aad2327eef6d81588f85b8"
     },
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "6e89cd78c0bc443e93bc9aef52db9838a3fa6c4701bcc633b3e988f8d8e35862"
+      "sha256": "4e527b94cf239b219b309d1fe7d8a7d907f42f1f610b0ef3d7edb6d4b23ab6c6"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -5152,7 +5157,7 @@
     {
       "path": "modules/hall-ui/public/oversight.css",
       "mode": "0000644",
-      "sha256": "a199baf1c11bdbe6d30931253956e0c9a9709ae3f880af77b2a6737212fe0984"
+      "sha256": "456432b7b0a0863a35d3fe25f3e24949dacf9112583ec01e7e71ced79ffeb08c"
     },
     {
       "path": "modules/hall-ui/public/pair.css",
@@ -7742,12 +7747,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "667fc77f1bfd67239fa405a73b70b64ec77419d97da57bc8350c96ba3c68197b"
+      "sha256": "b64a9a59bb6257652b417c5a8c52b901d02915ae5d565b728e29b01f73ee5b01"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9bee6edf68d9dc8177a24349a4c444c1829ff77619a511be70c8a49329726ac8"
+      "sha256": "0c28879af088fa3615bb534b1d545e909d712b2c5676e5f4a6140410c43b21e2"
     },
     {
       "path": "public-docs/index.html",
@@ -8187,7 +8192,7 @@
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
-      "sha256": "f64905f88718e5617ee97584dada757367497eed350bfb41814d257c9d2ec680"
+      "sha256": "ff21b52ecfe355ce19d7bf576880dfe1b561ffe33664a9a6ec06ccc704425f1d"
     },
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
@@ -8207,7 +8212,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "b30c5c2b3bf6465a63a7124327ad40f94987088d1d87fcc110fec9281539a0a1"
+      "sha256": "d6120a5427f9053529639cf15a59bad0afae9602d5a1e8301017f3321493038b"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9337,13 +9342,18 @@
     {
       "path": "src/bongos/platform-visibility-gate.js",
       "mode": "0000644",
-      "sha256": "46a0c76cb57b8d1b65efbcd53b46302e8d4e7ad070f67bc3f4d43c71c8d8d56b"
+      "sha256": "eea15ebe44e9450f2d62040c239828008e8953ea5ee465085d5f0e8e63fe6233"
     },
     {
       "path": "src/bongos/pool.js",
       "mode": "0000644",
       "sha256": "c9edcf9cb1f027ca122388beabae488d2b771b9e7aee2cd12fbdb48ea6f0ded8"
     },
+    {
+      "path": "src/bongos/prelaunch-gate.js",
+      "mode": "0000644",
+      "sha256": "16da458f537d9eaf55675fab8aab71f537882c1630baa02d2795f32f6a52454e"
+    },
     {
       "path": "src/bongos/project-door.js",
       "mode": "0000644",
@@ -9467,12 +9477,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "969494ec8a6730aa5d40c5c1bf046e8dbbdcae15f81b835658f710cdf8dc87af"
-    },
-    {
-      "path": "src/bongos/stealth-gate.js",
-      "mode": "0000644",
-      "sha256": "3f105bd9c578d320a5b88cf4cebb69c63c16f7b7f81dbeb554a78d00461ca97c"
+      "sha256": "b388de4de8993892d26a1a456eda30deb87a95cf4f64e262cb6541e04495c43d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9502,7 +9507,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3077ef167f846985e33e1d8316b78cefa5e7ff4825b9a0a7e1b71187a49e4636"
+      "sha256": "25384d0eebd630303512971574f4bbdfa1aebc9680705bff64a34c6dc6e1b4d5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10807,7 +10812,7 @@
     {
       "path": "tests/government_board_room_copy.mjs",
       "mode": "0000644",
-      "sha256": "9d3322d7a00eb00dc8419caad0f99bf17e4f3ece9a34d82a40430bd804c19f53"
+      "sha256": "8a13c4aefa85968aa716b8a06fa40166f5e612a597da87973bad313b8140d370"
     },
     {
       "path": "tests/government_board_summons.mjs",
@@ -10867,7 +10872,7 @@
     {
       "path": "tests/government_constitution_view.mjs",
       "mode": "0000644",
-      "sha256": "1fb474588046f937319bde1121f66428300cc0f63e36766ab4543c684a5a09bc"
+      "sha256": "ad805a6015e844e5afa32913d8731bf76b9a474f316c741ee41c28d0d12e57e0"
     },
     {
       "path": "tests/government_fold.mjs",
@@ -11869,6 +11874,11 @@
       "mode": "0000644",
       "sha256": "9f16091a8feeaef9e4350104dbc9671fab6f2b53f99fd82f798c77800e780b61"
     },
+    {
+      "path": "tests/prelaunch_gate.mjs",
+      "mode": "0000644",
+      "sha256": "53bdf7b9e0f09b4abab2c83ed77d48bd4ecd29f2b82afecc78dd694d5b36bc9f"
+    },
     {
       "path": "tests/preview_server.mjs",
       "mode": "0000644",
@@ -12162,7 +12172,7 @@
     {
       "path": "tests/rank_tier_single_source.mjs",
       "mode": "0000644",
-      "sha256": "61cb1a74f65939f0a5c596dd4c10ce9008ec42238baa21cdc5bcdc29621ffd1c"
+      "sha256": "1601fee7aef64836d1496954f0f74c5947c03dc167a49c6a5a4845e5ec07b91d"
     },
     {
       "path": "tests/rate_limit_public.mjs",
@@ -12729,11 +12739,6 @@
       "mode": "0000644",
       "sha256": "aa1d79bb3f900097a911c8c6b3055debe4bb20bfe2c3d6c8c64cfd8d7688824e"
     },
-    {
-      "path": "tests/stealth_gate.mjs",
-      "mode": "0000644",
-      "sha256": "bb264253e2a9c233734cf9273928db203f8f441c4e7a53f5f9ae5ea0477e20e3"
-    },
     {
       "path": "tests/stop_refcheck.mjs",
       "mode": "0000644",

package/docs/adr/0182-project-visibility-two-axes.md

@@ -150,7 +150,15 @@ Stealth's distinction from private is **at the door, not in the queue**: a refus
 
 **Decision:** the *product* meaning (the owner-facing state, whose orb metaphor is locked by the criterion) keeps the word. The infra gate is the one that should be renamed — to `prelaunch` — but that touches a protected path, an env var, and a live instance's configuration, so it is **not** decided here by an ADR about visibility. It is filed as its own task with the owner's call attached.
 
-Until then: `stealth` unqualified in product code and copy means the project state. The infra gate is referred to as the **pre-launch gate** in prose even while its identifier still says stealth.
+**RESOLVED — the rename was taken** (owner, 2026-09-09 backlog review of goal [#1000111](https://cloudbongos.com/builders#/goal/1000111); executed by task [#1003152](https://cloudbongos.com/builders#/task/1003152)). This paragraph is kept rather than rewritten, because the open question is part of the record: what follows is what the rename actually did, not what it promised.
+
+- `src/bongos/stealth-gate.js` → **`src/bongos/prelaunch-gate.js`**; `stealthGate()` → `prelaunchGate()`. The ~16 files carrying the PRODUCT sense are untouched, exactly as this decision says they must be.
+- **`PRELAUNCH_PASSWORD` is primary; `STEALTH_PASSWORD` is honoured as a deprecated alias**, with a one-time startup warning when only the old name is set. The env is read in exactly one place, so honouring both is a single expression — and it had to be: `STEALTH_PASSWORD` is set on live today, and a rename that did not read it would be an instant, total outage of the instance. Dropping the alias is a separate, later task, and must not run until the live instance has `PRELAUNCH_PASSWORD` set.
+- The submit path is **`/__prelaunch`**, with `/__stealth` still accepted and still exempt, so a form already open when the rename deployed still works.
+- **Three identifiers deliberately did NOT move** — the cookie `cb_stealth`, the HMAC label `stealth-v1`, and the legacy path above. The first two are keyed into live cookies: <redacted> either forces every holder to re-enter the password and buys nothing, because neither string is ever read by a human. One is wire format, the other an HMAC message; neither is vocabulary.
+- A fitness check in the ADR 0174 family (**check 19d**, `checkPrelaunchVocabulary`) now keeps the word from drifting back into the infra surface, scoped so the product surface's legitimate `stealth` never trips it. Per ADR 0174's own lesson it carries mutation tests: plant a violation, prove the build reds.
+
+The last sentence of this decision is therefore now spent — `stealth` unqualified means the project state, and the infra gate says `prelaunch` in its identifiers as well as in prose.
 
 ## Consequences