@bongos/core 1.19.698 → 1.19.700

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.698",
-  "core_contract": "1.19.698",
-  "source_commit": "8fb86a2225d9ed2a99fe253ea3886c7b2e7bcfc9",
+  "core_version": "1.19.700",
+  "core_contract": "1.19.700",
+  "source_commit": "7af21bffa8227c67a1c257f64a8fd73f2c1760dc",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T02:48:21.644Z",
+  "built_at": "2026-09-13T03:16:24.200Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2126,
+    "functional_verbatim": 2128,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2627,
-  "tree_sha256": "53de7b22ab854dd4a788f5ce3827fca83328bb1f43e0415eae9528923e68596b",
+  "file_count": 2629,
+  "tree_sha256": "3e7d4889874e8dafb6bc2f7d30722f62c5495396f2760d7a3d06985a79b6adb8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,12 +367,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b15290057c38e4b80db4136d7fdd32549718e31f5975484e77098c66050c4366"
+      "sha256": "cfa105831443d1543f03b217a1673b12ba54e40198d768b57bac1c10459ee35c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bdf715d3196df99d675570748f7ac054522046cbe89d78b84c27eef89a52d18f"
+      "sha256": "a418c0eace4c6335d4bd131ce33032b716bdd33f1b7b080c03b76db4259aa069"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -382,17 +382,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2fbbab84a89021945a707fd21d72acbad7f03b77c5fb6eb39abce44a64d4cc1b"
+      "sha256": "c36be893037b5c271ca116d9a26d66defcde55f1b06a1ea5b6a736b1997be0d4"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "101095af6616b30d3338ec12394343f360d8a583ef3da84f0dce49edc80630cb"
+      "sha256": "4fc17fc7a5a9ecdaa4539d99f6f30dde4a600043b24affd4677018c95fb94b17"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "eeb72bda7a89900279647d6d999d2a920a986bf2f4ed3a63782cd4e36b1b3dfc"
+      "sha256": "83c4a4fc8f4adccb95f15c1943cc40eb6c29d8027c58269271313bb37dbad46c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1922,12 +1922,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "f4f639df647605d86971b62b81921c77c465ded0782eb29d7fc5254ba2f16d0d"
+      "sha256": "2e05ec4efeab7341561a2230e880f6f34d55ada2d542e53b3dcf87f1efa2062c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b09110e4eec5225c0594e4f7a3bd3e18878f751ee4697af87209568d69483c3a"
+      "sha256": "7263a9c74173ef0ca46a444310156f5d901ad4bb191fbd181f690387171d755c"
     },
     {
       "path": "docs/architecture.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5c48de96a5d2d3ed794c4f503a665f0c4defc7d06f384ba4012eeb02cf3036aa"
+      "sha256": "ba12cd298d7b45de5f7764920115a0419101b4ba4f172ef3ff95ef8798c57508"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3862,7 +3862,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "505b62e453d62b820720c00abf661f1ca1ffbfd93d3eba1bdcdf20c7cca95ba7"
+      "sha256": "5cff70fc4e280c49d33dfb8f60ddb01181decd1645625b0bb5e7c2eb97335b81"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -3872,7 +3872,12 @@
     {
       "path": "modules/agents/module.json",
       "mode": "0000644",
-      "sha256": "055d1a806c40d8153b45bac2518b183874d9a8df7924f00355c86ed50682dd24"
+      "sha256": "af487dc7d134b45f2c1616b1a06cb017106529510e5ebc9d15d7dbb9f72d5fe5"
+    },
+    {
+      "path": "modules/agents/routes/agents.js",
+      "mode": "0000644",
+      "sha256": "31fbc1118ac1f315babb9ba3d0ab4ae634bdce3a6e83cb79defdad73288b2e00"
     },
     {
       "path": "modules/agents/spawn.js",
@@ -4257,7 +4262,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "2fbbab84a89021945a707fd21d72acbad7f03b77c5fb6eb39abce44a64d4cc1b"
+      "sha256": "c36be893037b5c271ca116d9a26d66defcde55f1b06a1ea5b6a736b1997be0d4"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -7772,12 +7777,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0faabe7f40491c6ab374488d6ae4a244694e1fbf40c280ad98ef0a249c207b80"
+      "sha256": "4cab339364e2c40b9adb593184fe0c78b8775c11203d6551d019c12de6675e5d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f623a28e95671e15f28bc19bc1b29f26f00312c5f0dc5e8761b872dd42e85923"
+      "sha256": "ed864f4879e51f4bc1adf7222e46b6fb9446fa93d59ea3b17bc26dbde19f18e2"
     },
     {
       "path": "public-docs/index.html",
@@ -9512,7 +9517,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "5c99fec0061221143be5e22bb51ca690aec883d9eaf094bd25007d3e21b5f96c"
+      "sha256": "61b13299ffdd7f036d5bc3d364135bd8ca4d3470223001b8ff6cc45d858d6107"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9542,7 +9547,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f03b116eece1a5517cda1bf812627f7148aaf2827806d53d70f3b67d343026ab"
+      "sha256": "46a02032df3b4b36ac48c77f8f373ee44735d00dca00ec483100ffd0f7b9062e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9644,6 +9649,11 @@
       "mode": "0000644",
       "sha256": "bdc9d3678e12dee3f3252785ca82e06071421762c7146cbc1591d3fc2ec72180"
     },
+    {
+      "path": "tests/agents_routes.mjs",
+      "mode": "0000644",
+      "sha256": "4e07055707e77bffe2b60750273d16e92a6b213dbbc999e8ed7e0cc742915f7c"
+    },
     {
       "path": "tests/agents_spawn.mjs",
       "mode": "0000644",
@@ -10327,7 +10337,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "b88f7ab55948f0bfbf0e6982cc96465ff2c34d76b143f40b86f933c323b8ff1d"
+      "sha256": "20994467d64d35647433c320265e360a520391bff974b1a39a918ef66ad7f172"
     },
     {
       "path": "tests/cutover_codemod.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 363 operations across 55 resource groups
+- 365 operations across 56 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -100,6 +100,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -99,6 +99,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -19,6 +19,8 @@ export interface ErrorEnvelope { error: ApiErrorObject }
 export interface GetAccessRequestsResponse { requests: unknown }
 export interface GetAccessRequestsStatusResponse { github_login: unknown; status: unknown; admitted: unknown }
 export interface GetAchievementsResponse { achievements: unknown }
+export interface GetAgentsNameResponse { ok: boolean; agent: unknown }
+export interface GetAgentsResponse { ok: boolean; agents: unknown; counts: unknown; vocabulary: unknown }
 export interface GetAuditLogResponse { rows: unknown; page: unknown }
 export interface GetAuthAppPairInfoResponse { pair_code: unknown; device_name: unknown; platform: unknown; status: unknown }
 export interface GetAuthWebAdmissionStatusResponse { admitted: boolean }
@@ -434,6 +436,12 @@ export interface BongosClient {
     /** GET /achievements — rank: any-builder */
     getAchievements(args?: RequestArgs): Promise<GetAchievementsResponse>;
   };
+  "agents": {
+    /** GET /agents — rank: any-builder */
+    getAgents(args?: RequestArgs): Promise<GetAgentsResponse>;
+    /** GET /agents/{name} — rank: any-builder */
+    getAgentsName(args?: RequestArgs): Promise<GetAgentsNameResponse>;
+  };
   "analytics": {
     /** GET /analytics/builder/{id} — rank: any-builder */
     getAnalyticsBuilderId(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -96,6 +96,12 @@ export function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -29,6 +29,10 @@
       "name": "achievements",
       "description": "Endpoints under `/api/bongos/achievements`."
     },
+    {
+      "name": "agents",
+      "description": "Endpoints under `/api/bongos/agents`."
+    },
     {
       "name": "analytics",
       "description": "Endpoints under `/api/bongos/analytics`."
@@ -505,6 +509,96 @@
         ]
       }
     },
+    "/agents": {
+      "get": {
+        "operationId": "get_agents",
+        "tags": [
+          "agents"
+        ],
+        "summary": "GET /agents",
+        "description": "GET /agents — the whole registry. Unpaginated on purpose: agents are instance CONFIGURATION reconciled from committed files, so the row count is bounded by what a human wrote, not by traffic. If that ever stops being true, this is the line that needs a cursor — not a silent LIMIT, which would make the registry quietly incomplete.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/agents/routes/agents.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAgentsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/agents/{name}": {
+      "get": {
+        "operationId": "get_agents_name",
+        "tags": [
+          "agents"
+        ],
+        "summary": "GET /agents/:name",
+        "description": "GET /agents/:name — one definition, persona included. The name is validated against the SAME regex the schema CHECKs, before it reaches the query. The query is parameterised regardless, so this is not the injection wall — it is the difference between a 404 and a 400 for a caller who sent something that could never have been a name.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/agents/routes/agents.js",
+        "parameters": [
+          {
+            "name": "name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `name`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAgentsNameResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/analytics/builder/{id}": {
       "get": {
         "operationId": "get_analytics_builder_id",
@@ -16776,6 +16870,36 @@
           "achievements"
         ]
       },
+      "GetAgentsNameResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "agent": {}
+        },
+        "required": [
+          "ok",
+          "agent"
+        ]
+      },
+      "GetAgentsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "agents": {},
+          "counts": {},
+          "vocabulary": {}
+        },
+        "required": [
+          "ok",
+          "agents",
+          "counts",
+          "vocabulary"
+        ]
+      },
       "GetAuditLogResponse": {
         "type": "object",
         "properties": {
@@ -22992,9 +23116,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 363,
-  "x-schema-count": 401,
+  "x-endpoint-count": 365,
+  "x-schema-count": 403,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 270,
+  "x-response-schemas": 272,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 363 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 365 endpoints across 59 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -23,6 +23,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/achievements` | `any-builder` | — | All seeded achievements — lets /builders render locked + unlocked side by side. |
 
+## `agents` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/agents` | `any-builder` | — | GET /agents — the whole registry. |
+| GET | `/api/bongos/agents/:name` | `any-builder` | — | GET /agents/:name — one definition, persona included. |
+
 ## `analytics` (1)
 
 | Method | Path | Rank | Body | Description |

package/docs/module-api-changelog.md

@@ -1855,5 +1855,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.696 with no explicit bump. run 34733301156. (task 1002620)
   1.19.698 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.697 with no explicit bump. run 34733917938. (task 1002620)
+  1.19.699 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.698 with no explicit bump. run 34734848584. (task 1002620)
+  1.19.700 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.699 with no explicit bump. run 34735048203. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -303,4 +303,10 @@ module.exports = {
   MODEL_TIERS,
   RANK_ORDER,
   SCOPE_RANK_FLOOR,
+  // Exported for the read routes (task 1002488), which reject an impossible
+  // :name with a 400 before it reaches the query. Shared rather than re-spelled:
+  // this pair already mirrors the agents_definitions_name_fmt_chk CHECK, and a
+  // second copy in the route layer is one more place for the three to drift.
+  NAME_RE,
+  NAME_MAX,
 };

package/modules/agents/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": false,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "migrations": true },
+  "contributes": { "routes": ["agents"], "migrations": true },
   "provides": [],
   "consumes": ["grade"]
 }

package/modules/agents/routes/agents.js

@@ -0,0 +1,177 @@
+// modules/agents/routes/agents.js — the agent registry's READ surface (task
+// 1002488, BONGOS-V1 goal 1000038 Phase 1).
+//
+// WHY. agents-sync reconciles .claude/agents/*.md into agents_definitions at
+// deploy, and the spawn path fires from that table — so the table is the only
+// honest answer to "what agents does this instance actually have, and which of
+// them are armed?". Until now nothing could ask. A builder wondering why an
+// agent did or did not fire had to read the deploy log or the DB directly, and
+// an instance author had no way to see that the definition they committed was
+// flagged for a scope violation and therefore silently disarmed.
+//
+//   GET /agents        — the registry, newest-synced first.
+//   GET /agents/:name  — one definition, by its stable name.
+//
+// SELF-GATED, and that is the whole gate: `requireBuilder` and nothing else.
+// These are reads of the instance's own configuration by the people who build
+// it, the same audience and posture as GET /tasks. There is deliberately NO rank
+// floor — a xenos who can see WHICH agents are armed is better placed to
+// understand the review they just received, and none of the authority-bearing
+// fields is writable here (authoring is a separate task, with its own wall).
+//
+// WHAT IS NOT SERVED, ON PURPOSE:
+//
+//   `persona` is omitted from the LIST and served only on the detail route. It
+//   is capped at 32KB per row by the schema, so a 40-agent registry would be a
+//   1.2MB response to render a table that shows none of it. This is a size
+//   decision, not a secrecy one — the detail route hands it over to anyone who
+//   asks by name.
+//
+//   `author_builder_id` is never served. The FACT that matters downstream is
+//   `author_rank` — the rank the definition was stamped with at sync, which is
+//   what the spawn gate consults — and serving the id would turn a registry read
+//   into a people-directory read, which has its own gate (GET /scouting).
+//
+// Same idioms as modules/copy-desk/routes/copy-desk.js: doorway-only requires,
+// factory export mounted from module.json `contributes.routes`, res.fail codes.
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const validate = require('../lib/validate');
+
+const log = api.logger('agents');
+
+// The columns the serializer needs. Spelled out rather than `SELECT *` so that a
+// column added later (an author's email, a raw credential) cannot reach a
+// response by default — the read surface widens only when someone edits this
+// list and reads the comment above about what is deliberately not served.
+const COLUMNS = `
+  id, name, title, trigger_type, trigger_spec, model_tier,
+  scope_modules, scope_paths, scope_violation,
+  source, provenance, author_rank,
+  source_path, last_synced_at, enabled, created_at, updated_at
+`;
+
+// PURE. Row → wire shape, so the projection is unit-testable without a database.
+//
+// `model_tier` is stored as the TIER ('default' | 'routine'), never a model id:
+// the id a tier resolves to is a deployment fact that changes under the row, and
+// a registry that answered with a stale model name would be worse than one that
+// answers with the tier and lets the caller resolve it. The task asks for the
+// "resolved model tier", and the tier IS the resolved value at this layer.
+//
+// `armed` is derived rather than aliased from `enabled`, because two schema
+// CHECKs make "enabled" narrower than it reads: a row carrying a
+// `scope_violation` is forced to enabled=false, and an enabled row must carry an
+// author_rank. Surfacing the derived boolean beside the reason means a caller
+// asking "why did this not fire?" gets the answer in the same object.
+function serializeDefinition(row, { includePersona = false } = {}) {
+  if (!row) return null;
+  const out = {
+    name: row.name,
+    title: row.title || null,
+    trigger: {
+      type: row.trigger_type,
+      // trigger_spec is jsonb and NOT NULL DEFAULT '{}', but a hand-written row
+      // could still be any object; the event name is lifted out because it is
+      // the only part of the spec every event agent must carry (schema CHECK).
+      spec: row.trigger_spec && typeof row.trigger_spec === 'object' ? row.trigger_spec : {},
+      event: row.trigger_type === 'event' && row.trigger_spec ? (row.trigger_spec.event || null) : null,
+    },
+    model_tier: row.model_tier,
+    provenance: row.provenance,          // 'built-in' | 'instance'
+    source: row.source,                  // 'file' | 'db'
+    // A file-sourced row's path is its identity in the repo; a db-authored row
+    // has none, and null says so rather than an empty string that sorts oddly.
+    source_path: row.source_path || null,
+    author_rank: row.author_rank || null,
+    scope: {
+      modules: Array.isArray(row.scope_modules) ? row.scope_modules : [],
+      paths: Array.isArray(row.scope_paths) ? row.scope_paths : [],
+      violation: row.scope_violation || null,
+    },
+    armed: row.enabled === true,
+    // Why an agent is not armed, when the answer is knowable. A scope violation
+    // is the one disarm the registry can explain; anything else is simply off.
+    disarmed_reason: row.enabled === true ? null : (row.scope_violation ? 'scope_violation' : null),
+    last_synced_at: row.last_synced_at || null,
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+  };
+  if (includePersona) out.persona = row.persona;
+  return out;
+}
+
+module.exports = function agentsRoutes() {
+  const router = express.Router();
+
+  // GET /agents — the whole registry. Unpaginated on purpose: agents are
+  // instance CONFIGURATION reconciled from committed files, so the row count is
+  // bounded by what a human wrote, not by traffic. If that ever stops being
+  // true, this is the line that needs a cursor — not a silent LIMIT, which
+  // would make the registry quietly incomplete.
+  router.get('/agents', api.requireBuilder, async (req, res) => {
+    try {
+      const { rows } = await api.pool.query(
+        `SELECT ${COLUMNS} FROM agents_definitions
+          ORDER BY enabled DESC, name ASC`
+      );
+      res.json({
+        ok: true,
+        agents: rows.map((r) => serializeDefinition(r)),
+        // The counts a reader actually wants first, computed here so three
+        // callers do not each reduce the array their own way.
+        counts: {
+          total: rows.length,
+          armed: rows.filter((r) => r.enabled === true).length,
+          flagged: rows.filter((r) => r.scope_violation).length,
+        },
+        // The vocabulary, from the validator that enforces it — so a UI building
+        // a filter cannot spell a trigger type the registry will never contain.
+        // Same rule as the task-kind filter (task 1003453): serve the enum, do
+        // not let the client keep a copy.
+        vocabulary: {
+          trigger_types: [...validate.TRIGGER_TYPES],
+          model_tiers: [...validate.MODEL_TIERS],
+          events: [...validate.EVENT_CATALOG],
+        },
+      });
+    } catch (err) {
+      log.error({ err }, 'GET /agents failed');
+      if (!res.headersSent) res.fail('agents_list_failed', 500);
+    }
+  });
+
+  // GET /agents/:name — one definition, persona included.
+  //
+  // The name is validated against the SAME regex the schema CHECKs, before it
+  // reaches the query. The query is parameterised regardless, so this is not the
+  // injection wall — it is the difference between a 404 and a 400 for a caller
+  // who sent something that could never have been a name.
+  router.get('/agents/:name', api.requireBuilder, async (req, res) => {
+    const name = String(req.params.name || '');
+    if (!validate.NAME_RE.test(name) || name.length > validate.NAME_MAX) {
+      return res.fail('invalid_agent_name', 400);
+    }
+    try {
+      const { rows } = await api.pool.query(
+        `SELECT ${COLUMNS}, persona FROM agents_definitions WHERE name = $1`,
+        [name]
+      );
+      if (!rows.length) return res.fail('agent_not_found', 404);
+      return res.json({ ok: true, agent: serializeDefinition(rows[0], { includePersona: true }) });
+    } catch (err) {
+      log.error({ err, name }, 'GET /agents/:name failed');
+      if (!res.headersSent) return res.fail('agent_read_failed', 500);
+      return undefined;
+    }
+  });
+
+  return router;
+};
+
+// Exported for the unit tests, which drive the projection with fabricated rows
+// rather than standing up Postgres.
+module.exports.serializeDefinition = serializeDefinition;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -99,6 +99,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.698",
+  "version": "1.19.700",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.698",
+      "version": "1.19.700",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.698",
+  "version": "1.19.700",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -107,25 +107,66 @@ function themeMarkup(theme) {
   if (!theme) return '';
   const decls = [];
   for (const [key, cssVar] of Object.entries(COLOR_VARS)) {
-    const v = theme.colors?.[key];
+    const v = cssSafe(theme.colors?.[key]);
     if (v) decls.push(`${cssVar}:${v};`);
   }
-  if (theme.fonts?.display) decls.push(`--font-display:${theme.fonts.display};`);
-  if (theme.fonts?.body) decls.push(`--font-body:${theme.fonts.body};`);
+  const display = cssSafe(theme.fonts?.display);
+  if (display) decls.push(`--font-display:${display};`);
+  const body = cssSafe(theme.fonts?.body);
+  if (body) decls.push(`--font-body:${body};`);
   let out = '';
   for (const href of theme.fonts?.links || []) {
-    out += `<link rel="stylesheet" href="${href}">`;
+    out += `<link rel="stylesheet" href="${esc(href)}">`;
   }
   // `backdrop` paints the page background (e.g. the Cloud Bongos sunrise gradient,
   // ADR 0064 / R74) over the flat var(--bg); omitted packs (OTB) keep --bg.
   const css = [];
   if (decls.length) css.push(`:root{${decls.join('')}}`);
-  if (theme.backdrop) css.push(`body{background:${theme.backdrop};}`);
+  const backdrop = cssSafe(theme.backdrop);
+  if (backdrop) css.push(`body{background:${backdrop};}`);
   if (css.length) out += `<style>${css.join('')}</style>`;
-  if (theme.favicon) out += `<link rel="icon" href="${theme.favicon}">`;
+  // esc() is lossless in an attribute: the HTML parser decodes the entities back
+  // before anything reads the URL, so the neutral pack's inline `data:image/svg+xml,
+  // <svg …>` favicon resolves to exactly the same bytes it does today.
+  if (theme.favicon) out += `<link rel="icon" href="${esc(theme.favicon)}">`;
   return out;
 }
 
+// A pack-supplied value on its way into <style> TEXT. esc() is the wrong tool
+// here and would corrupt the output: CSS is not entity-decoded, so a font stack
+// like `"Cinzel", serif` would reach the browser as `&quot;Cinzel&quot;, serif`
+// and simply not parse. There is no encoding that both survives CSS and
+// neutralizes markup, so this fails closed instead. The only way out of a <style>
+// element is a literal `</style`, every route to it begins with `<`, and no
+// colour, font stack, or backdrop has a legitimate use for one — so a value
+// carrying `<` is dropped whole rather than emitted half-escaped. Dropping one
+// declaration loses that pack's colour and falls back to style.css's default;
+// emitting it loses the page.
+function cssSafe(v) {
+  const s = String(v == null ? '' : v);
+  return s.includes('<') ? '' : s;
+}
+
+// Serialize a pack value for injection INSIDE a <script> element. JSON.stringify
+// alone is not enough: its output is valid JSON, but the browser reads a script
+// body as raw text FIRST, so a `</script>` anywhere in the pack ends the element
+// early and everything after it lands in the document as markup (the latent
+// self-XSS from an operator-authored pack — idea 348, Hacker dispatch on task
+// 1374). Escaping `<` alone closes it: `</script`, `<script`, and `<!--` all need
+// one. `>` and `&` need no escaping here precisely because a classic script body
+// is NOT entity-decoded — there is nothing for them to start. U+2028/U+2029 are
+// escaped as well: legal in string literals since ES2019, so not a break-out on
+// any browser we serve, but free to escape and still fatal to an older parser.
+// `\u003c` is the same character to the JS parser and never one to the HTML
+// parser, so the value the page actually reads is unchanged. Same fix, same
+// reasoning as modules/provisioning/routes/callback-page.js.
+function jsonForScript(value) {
+  return JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
 // Inject the client-safe branding pack into a served HTML document (R56 task 1195
 // + R57 task 1196, ADR 0062 §3):
 //   * `window.__BRANDING__` — a synchronous global so every hall/status script
@@ -145,7 +186,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
   // UI sections for off modules synchronously (no fetch, no race). R60 wires the
   // actual section-hiding; this exposes the data.
   const stamped = applyBrandTokens(html, brand);
-  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${JSON.stringify(brand)};window.__MODULES__=${JSON.stringify(mods)};</script>${themeMarkup(brand.theme)}`;
+  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${jsonForScript(brand)};window.__MODULES__=${jsonForScript(mods)};</script>${themeMarkup(brand.theme)}`;
   return stamped.includes('</head>') ? stamped.replace('</head>', `${tag}</head>`) : tag + stamped;
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.698'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.700'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_routes.mjs

@@ -0,0 +1,194 @@
+// tests/agents_routes.mjs — the agent registry's read surface (task 1002488,
+// goal 1000038 Phase 1).
+//
+// WHY THIS LIVES IN tests/ AND NOT modules/agents/tests/. The `agents` module is
+// `default: false`, and run-unit-tests.js discovers a module's own tests only
+// when that module is ENABLED ("it isn't mounted, so its tests don't run
+// either"). On this instance agents is disabled, so a module-local file here
+// would be silently skipped forever — coverage in name only. tests/ always runs.
+// Same call task 1002487 made for tests/agents_validate.mjs; this follows it.
+//
+// No database, no fixtures, no HTTP. The projection is a pure function and the
+// gate is a property of the mounted router, so both are checked directly.
+//
+// Run:  node tests/agents_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const routes = require('../modules/agents/routes/agents.js');
+const validate = require('../modules/agents/lib/validate.js');
+const api = require('../src/module-api.js');
+
+const { serializeDefinition } = routes;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); console.log(`  PASS  ${name}`); passed += 1; }
+  catch (err) { console.log(`  FAIL  ${name}\n        ${err.message}`); failed += 1; }
+}
+
+// A full row as agents-sync would have written it — every column the serializer
+// reads, including the two it must never emit.
+function row(over = {}) {
+  return {
+    id: 7,
+    name: 'historian',
+    title: 'The Historian',
+    persona: 'PERSONA BODY',
+    trigger_type: 'event',
+    trigger_spec: { event: 'task.shipped' },
+    model_tier: 'routine',
+    scope_modules: ['lifecycle'],
+    scope_paths: [],
+    scope_violation: null,
+    source: 'file',
+    provenance: 'built-in',
+    author_rank: 'archon',
+    author_builder_id: 4242,
+    source_path: '.claude/agents/historian.md',
+    last_synced_at: '2026-09-01T00:00:00.000Z',
+    enabled: true,
+    created_at: '2026-08-01T00:00:00.000Z',
+    updated_at: '2026-09-01T00:00:00.000Z',
+    ...over,
+  };
+}
+
+console.log('\nthe projection — what a registry read may and may not carry:');
+
+t('the LIST omits persona; the DETAIL route serves it', () => {
+  assert.ok(!('persona' in serializeDefinition(row())), 'a 32KB body per row must not ride the list');
+  assert.equal(serializeDefinition(row(), { includePersona: true }).persona, 'PERSONA BODY');
+});
+
+t('author_builder_id is NEVER served, on either route', () => {
+  // The rank is the fact the spawn gate consults; the id would turn a registry
+  // read into a people-directory read, which has its own gate (GET /scouting).
+  for (const opts of [{}, { includePersona: true }]) {
+    const json = JSON.stringify(serializeDefinition(row(), opts));
+    assert.doesNotMatch(json, /4242/, 'the author id leaked into the response');
+    assert.doesNotMatch(json, /author_builder_id/, 'the author id key leaked into the response');
+  }
+  assert.equal(serializeDefinition(row()).author_rank, 'archon', 'the rank IS served — it is the gate-relevant fact');
+});
+
+t('model_tier is served as the TIER, never a resolved model id', () => {
+  // The id a tier resolves to is a deployment fact that changes under the row.
+  // A registry answering with a stale model name is worse than one answering
+  // with the tier, so this asserts the absence of any model-shaped string.
+  const o = serializeDefinition(row());
+  assert.equal(o.model_tier, 'routine');
+  assert.ok(validate.MODEL_TIERS.includes(o.model_tier));
+  assert.doesNotMatch(JSON.stringify(o), /claude-|sonnet|opus|haiku/i, 'a concrete model id must not appear');
+});
+
+console.log('\n`armed` is DERIVED, because two CHECKs make `enabled` narrower than it reads:');
+
+t('a scope-violating row reads as disarmed AND says why', () => {
+  // agents_definitions_flagged_not_armed_chk forces enabled=false when a
+  // violation is recorded. A caller asking "why did this not fire?" gets the
+  // answer in the same object rather than having to know that CHECK exists.
+  const o = serializeDefinition(row({ enabled: false, scope_violation: 'scope_paths exceeds module' }));
+  assert.equal(o.armed, false);
+  assert.equal(o.disarmed_reason, 'scope_violation');
+  assert.equal(o.scope.violation, 'scope_paths exceeds module');
+});
+
+t('an ordinary disabled row is disarmed with no invented reason', () => {
+  const o = serializeDefinition(row({ enabled: false }));
+  assert.equal(o.armed, false);
+  assert.equal(o.disarmed_reason, null, 'absence of a reason must not be reported as a violation');
+});
+
+t('armed is a strict boolean, not a truthy passthrough', () => {
+  assert.equal(serializeDefinition(row({ enabled: true })).armed, true);
+  // A driver returning 't'/1 for a boolean column must not read as armed by
+  // accident — the fail-safe direction for "is this thing allowed to fire" is
+  // false, so the check is `=== true`.
+  assert.equal(serializeDefinition(row({ enabled: 1 })).armed, false);
+});
+
+console.log('\nshape tolerance — a hand-written db row is still a row:');
+
+t('a null/odd trigger_spec degrades to {} instead of throwing', () => {
+  assert.deepEqual(serializeDefinition(row({ trigger_spec: null })).trigger.spec, {});
+  assert.deepEqual(serializeDefinition(row({ trigger_spec: 'nope' })).trigger.spec, {});
+  assert.equal(serializeDefinition(row({ trigger_type: 'on-demand' })).trigger.event, null,
+    'an on-demand agent has no event, even when a spec carries one');
+});
+
+t('null arrays degrade to [], and a missing row serializes to null', () => {
+  const o = serializeDefinition(row({ scope_modules: null, scope_paths: null }));
+  assert.deepEqual(o.scope.modules, []);
+  assert.deepEqual(o.scope.paths, []);
+  assert.equal(serializeDefinition(null), null);
+  assert.equal(serializeDefinition(undefined), null);
+});
+
+console.log('\nthe gate — self-gated means requireBuilder, on EVERY route:');
+
+t('both routes mount requireBuilder, and neither is left ungated', () => {
+  const router = routes();
+  const mounted = router.stack.filter((l) => l.route);
+  assert.equal(mounted.length, 2, 'exactly two routes — a third needs its own gate and its own row here');
+  const paths = mounted.map((l) => l.route.path).sort();
+  assert.deepEqual(paths, ['/agents', '/agents/:name']);
+  for (const layer of mounted) {
+    const handlers = layer.route.stack.map((s) => s.handle);
+    assert.ok(handlers.includes(api.requireBuilder),
+      `${layer.route.path} does not mount requireBuilder — a registry read must not be anonymous`);
+    assert.ok(handlers.length >= 2, `${layer.route.path} has no handler behind its gate`);
+  }
+});
+
+t('every mounted route is a GET — this surface writes nothing', () => {
+  // The read half is a separate task from authoring on purpose. A write verb
+  // appearing here would carry no author-rank clamp and no scope wall.
+  for (const layer of routes().stack.filter((l) => l.route)) {
+    assert.deepEqual(Object.keys(layer.route.methods), ['get'],
+      `${layer.route.path} exposes a non-GET verb on the read surface`);
+  }
+});
+
+console.log('\nthe vocabulary is SERVED, not copied into the client:');
+
+t('the route file spells no enum of its own', () => {
+  // Task 1003453's lesson, applied before the bug rather than after: a filter
+  // built from a client-side copy goes stale against the validator and the DB
+  // CHECK. The list response carries the enums, and they come from validate.js.
+  const src = require('node:fs').readFileSync(new URL('../modules/agents/routes/agents.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /\[\s*'event'\s*,\s*'on-demand'\s*\]/, 'trigger types re-spelled in the route');
+  assert.doesNotMatch(src, /\[\s*'default'\s*,\s*'routine'\s*\]/, 'model tiers re-spelled in the route');
+  assert.match(src, /validate\.TRIGGER_TYPES/);
+  assert.match(src, /validate\.MODEL_TIERS/);
+  assert.match(src, /validate\.EVENT_CATALOG/);
+});
+
+t('the name guard reuses the validator regex, not a third copy of it', () => {
+  // The pattern already exists twice — in validate.js and in the schema's
+  // agents_definitions_name_fmt_chk. The route makes a third place to drift.
+  assert.ok(validate.NAME_RE instanceof RegExp, 'NAME_RE is exported for the route to share');
+  assert.equal(typeof validate.NAME_MAX, 'number');
+  assert.ok(validate.NAME_RE.test('historian'));
+  assert.equal(validate.NAME_RE.test('Historian'), false, 'the CHECK is lowercase-anchored');
+  assert.equal(validate.NAME_RE.test('9lives'), false, 'must start with a letter');
+  const src = require('node:fs').readFileSync(new URL('../modules/agents/routes/agents.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /\/\^\[a-z\]\[a-z0-9-\]\*\$\//, 'the name regex was re-spelled in the route');
+});
+
+console.log('\nthe module declares the routes it now ships:');
+
+t('module.json contributes the agents route file', () => {
+  const manifest = require('../modules/agents/module.json');
+  assert.ok(Array.isArray(manifest.contributes.routes), 'contributes.routes is declared');
+  assert.ok(manifest.contributes.routes.includes('agents'),
+    'the loader mounts modules/agents/routes/<name>.js from this list — without it the file is dead');
+  assert.equal(manifest.contributes.migrations, true, 'the existing migrations contribution survives');
+  assert.equal(manifest.default, false, 'shipped is not enabled — an instance opts in (ADR 0083)');
+});
+
+console.log(`\nagents_routes: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/currency_label.mjs

@@ -121,6 +121,89 @@ test('injectBrandingGlobal degrades safely when there is no </head>', () => {
   assert.ok(out.includes('<div>no head</div>'));
 });
 
+// --- task 1001434 (idea 348): everything the pack contributes is escaped for the
+// context it lands in. The pack is operator-authored, so this is not a defence
+// against a hostile visitor — it is a defence against one stray character in a
+// config file silently turning every served page's <head> into markup.
+
+// A pack string carrying `</script>` is the whole bug: the browser finds the end
+// of the script element by scanning raw text, before any JS parsing happens.
+const HOSTILE = {
+  identity: { productName: '</script><img src=x onerror=alert(1)>', worldName: 'w' },
+  copy: { tagline: 'a < b && c > d' },
+};
+
+function brandingJson(out) {
+  const m = /window\.__BRANDING__=(.*?);window\.__MODULES__=/s.exec(out);
+  assert.ok(m, 'the injected branding assignment must be findable');
+  return m[1];
+}
+
+test('1001434: a `</script>` in the pack cannot close the injected script element', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  assert.ok(/<script>window\.__BRANDING__=(.*?)<\/script>/s.exec(out), 'the injected block is well-formed');
+  // Two closers are correct and expected: the client-bundle <script src=…></script>
+  // that leads the tag, and our own terminator. A third would BE the bug — the
+  // pack's `</script>` ending the element early. Unfixed, this counts 3.
+  assert.equal(out.split('</script>').length - 1, 2, 'no early close');
+  assert.ok(!out.includes('<img src=x'), 'the payload never reaches the document as a tag');
+});
+
+test('1001434: every `<` in the injected JSON is \\u003c, and the VALUE is unchanged', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  const json = brandingJson(out);
+  assert.ok(!json.includes('<'), 'no raw < survives into the script body');
+  assert.ok(json.includes('\\u003c'), 'it is escaped, not stripped');
+  // Escaping must be lossless: < is the same character to the JSON parser,
+  // so the page reads exactly what the operator configured.
+  const parsed = JSON.parse(json);
+  assert.equal(parsed.identity.productName, '</script><img src=x onerror=alert(1)>');
+  assert.equal(parsed.copy.tagline, 'a < b && c > d', '> and & are left alone — a script body is not entity-decoded');
+});
+
+test('1001434: __MODULES__ is escaped too — it rides the same script tag', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding({}), { enabled: { '</script>': true } });
+  assert.equal(out.split('</script>').length - 1, 2, 'the bundle tag and our terminator, and nothing else');
+  const m = /window\.__MODULES__=(.*?);<\/script>/s.exec(out);
+  assert.ok(m && !m[1].includes('<'));
+  assert.deepEqual(JSON.parse(m[1]), { enabled: { '</script>': true } });
+});
+
+test('1001434: a theme value carrying `<` is DROPPED rather than breaking out of <style>', () => {
+  const m = themeMarkup({
+    colors: { bg: '#fff', ink: '</style><script>alert(1)</script>' },
+    backdrop: '</style>x',
+    fonts: { display: '"Cinzel", serif' },
+  });
+  assert.ok(!m.includes('<script>'), 'no escape from the style element');
+  assert.equal(m.split('</style>').length - 1, 1, 'exactly one style terminator — our own');
+  assert.ok(m.includes('--bg:#fff;'), 'the clean declarations still ship');
+  assert.ok(!m.includes('--ink:'), 'the poisoned one is dropped whole, not half-escaped');
+  assert.ok(!m.includes('body{background:'), 'a poisoned backdrop is dropped too');
+  // CSS is not entity-decoded, so esc() here would be a bug of its own: the font
+  // stack has to keep its real quotes.
+  assert.ok(m.includes('--font-display:"Cinzel", serif;'), 'quotes in a font stack survive intact');
+});
+
+test('1001434: a pack cannot break out of the favicon or font-link href attribute', () => {
+  const m = themeMarkup({ favicon: 'x"><script>alert(1)</script>', fonts: { links: ['y"><script>alert(2)</script>'] } });
+  assert.ok(!m.includes('<script>'), 'neither href can escape its attribute');
+  assert.ok(m.includes('&quot;'), 'the quote is entity-escaped, which the parser undoes on read');
+});
+
+test('1001434: escaping the favicon is lossless — the neutral inline-SVG data URI still resolves', () => {
+  const favicon = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'><circle r='8'/></svg>";
+  const m = themeMarkup({ favicon });
+  const href = /<link rel="icon" href="([^"]*)">/.exec(m);
+  assert.ok(href, 'the attribute is still well-formed');
+  // Decode the way an HTML parser does; the operator's bytes must come back.
+  const decoded = href[1]
+    .replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
+  assert.equal(decoded, favicon, 'the browser reads exactly the URI the pack configured');
+});
+
 // --- BV1.R75: module hall-widget script injection (ADR 0062 §4) ---
 
 const HALL = '<body><script src="/builders/builders.js?v=2026-06-27-r75" defer></script></body>';