@bongos/core 1.19.699 → 1.19.701

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.699",
-  "core_contract": "1.19.699",
-  "source_commit": "c2fc577575ff838fa4b7c6ef9b487a61834508da",
+  "core_version": "1.19.701",
+  "core_contract": "1.19.701",
+  "source_commit": "6c01baa69654043099e16c9bf0353eff61d2012d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T03:11:31.535Z",
+  "built_at": "2026-09-13T03:22:47.893Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2126,
+    "functional_verbatim": 2130,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2627,
-  "tree_sha256": "6784a09f48fd3badc907d3157a51dfd66a765084f015b78924eb7229bcb7c757",
+  "file_count": 2631,
+  "tree_sha256": "640bb539971ad78a750aa80116d26c7f1f81fc1b2afb21ef0fd33855189fe10a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,12 +367,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b15290057c38e4b80db4136d7fdd32549718e31f5975484e77098c66050c4366"
+      "sha256": "cfa105831443d1543f03b217a1673b12ba54e40198d768b57bac1c10459ee35c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bdf715d3196df99d675570748f7ac054522046cbe89d78b84c27eef89a52d18f"
+      "sha256": "a418c0eace4c6335d4bd131ce33032b716bdd33f1b7b080c03b76db4259aa069"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -382,17 +382,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2fbbab84a89021945a707fd21d72acbad7f03b77c5fb6eb39abce44a64d4cc1b"
+      "sha256": "c36be893037b5c271ca116d9a26d66defcde55f1b06a1ea5b6a736b1997be0d4"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "101095af6616b30d3338ec12394343f360d8a583ef3da84f0dce49edc80630cb"
+      "sha256": "4fc17fc7a5a9ecdaa4539d99f6f30dde4a600043b24affd4677018c95fb94b17"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "eeb72bda7a89900279647d6d999d2a920a986bf2f4ed3a63782cd4e36b1b3dfc"
+      "sha256": "83c4a4fc8f4adccb95f15c1943cc40eb6c29d8027c58269271313bb37dbad46c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1922,12 +1922,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "f4f639df647605d86971b62b81921c77c465ded0782eb29d7fc5254ba2f16d0d"
+      "sha256": "2e05ec4efeab7341561a2230e880f6f34d55ada2d542e53b3dcf87f1efa2062c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b09110e4eec5225c0594e4f7a3bd3e18878f751ee4697af87209568d69483c3a"
+      "sha256": "7263a9c74173ef0ca46a444310156f5d901ad4bb191fbd181f690387171d755c"
     },
     {
       "path": "docs/architecture.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "83f3755afa52e27b8dc1c9cacc65fd57eb20ca11463f1408bb7298279bbf3994"
+      "sha256": "4fc39aaaae76afb8153485474fc9f3459a2ee380b96f59d1d693a4a7680db464"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3862,7 +3862,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "505b62e453d62b820720c00abf661f1ca1ffbfd93d3eba1bdcdf20c7cca95ba7"
+      "sha256": "5cff70fc4e280c49d33dfb8f60ddb01181decd1645625b0bb5e7c2eb97335b81"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -3872,7 +3872,12 @@
     {
       "path": "modules/agents/module.json",
       "mode": "0000644",
-      "sha256": "055d1a806c40d8153b45bac2518b183874d9a8df7924f00355c86ed50682dd24"
+      "sha256": "af487dc7d134b45f2c1616b1a06cb017106529510e5ebc9d15d7dbb9f72d5fe5"
+    },
+    {
+      "path": "modules/agents/routes/agents.js",
+      "mode": "0000644",
+      "sha256": "31fbc1118ac1f315babb9ba3d0ab4ae634bdce3a6e83cb79defdad73288b2e00"
     },
     {
       "path": "modules/agents/spawn.js",
@@ -4257,7 +4262,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "2fbbab84a89021945a707fd21d72acbad7f03b77c5fb6eb39abce44a64d4cc1b"
+      "sha256": "c36be893037b5c271ca116d9a26d66defcde55f1b06a1ea5b6a736b1997be0d4"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -5637,7 +5642,7 @@
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
-      "sha256": "3e20f4965d1d83d17f8e777201bd7e4fd7857843295180542914de16ae51e936"
+      "sha256": "4114eb2632a95a9b830956d0e476ad92ed6eaaa526d9bd46e7ddba8a6fb566e3"
     },
     {
       "path": "modules/lifecycle/criterion-suggest.js",
@@ -5724,6 +5729,11 @@
       "mode": "0000644",
       "sha256": "23ee20e57c67adb5d2ec29c654d2bc469434cafa010b375a8a4452ced1df49e3"
     },
+    {
+      "path": "modules/lifecycle/executed-closure.js",
+      "mode": "0000644",
+      "sha256": "70be81206f577910d250e70ed0841466bbe329691324156b5b15bb75abcd93d3"
+    },
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
@@ -5847,7 +5857,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "28c61d55fe2b492f0fce4c99b60e88f0cbeb542c47c04482558818d65628e0d7"
+      "sha256": "9f3e3ae52f9fa49a1f5638d92a4b985d0c23fe0433d917d017aa78876c41ca43"
     },
     {
       "path": "modules/lifecycle/rot.js",
@@ -7772,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7235324939dc1acfb616300365334ebf96e054f83b8083b15cd2f99eeb5a6d71"
+      "sha256": "f7fb304e4955f8024186863281f2540c2e92299e49b16f7f6ea0f78c6d46d22a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c650680172226a9259dbb3da9cfc459a3c94f3fa5578be520c27d2b71d0a71d9"
+      "sha256": "be0e756de883b5e3291f721efe8515540771994df5d83f0eb96bd07f87ecf1e8"
     },
     {
       "path": "public-docs/index.html",
@@ -9542,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f6283921aa6c4af4de772e638a58ad28111bb8e6664a4bb67e15bc86ad1083f3"
+      "sha256": "2fdd8c72769bba600991d5c886878c7390ef2086f67ad8c1036555e45631a971"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9644,6 +9654,11 @@
       "mode": "0000644",
       "sha256": "bdc9d3678e12dee3f3252785ca82e06071421762c7146cbc1591d3fc2ec72180"
     },
+    {
+      "path": "tests/agents_routes.mjs",
+      "mode": "0000644",
+      "sha256": "4e07055707e77bffe2b60750273d16e92a6b213dbbc999e8ed7e0cc742915f7c"
+    },
     {
       "path": "tests/agents_spawn.mjs",
       "mode": "0000644",
@@ -10549,6 +10564,11 @@
       "mode": "0000644",
       "sha256": "d6a78357533fdeea3bc33fe97cfcd27b1d04747c600d0a7800ddfca5199dbb1f"
     },
+    {
+      "path": "tests/executed_closure.mjs",
+      "mode": "0000644",
+      "sha256": "9f4b768e74b542e080f2f2d92db3e5d7a05a66e0fe8822528a40e1b9399f178c"
+    },
     {
       "path": "tests/explore_visible_states.mjs",
       "mode": "0000644",
@@ -12212,7 +12232,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "4c7c58a1fd28427fbcace0d20a9446f88c2a90cc19eb5fd4826236207732be26"
+      "sha256": "92806699b18a064233330d844d4a5bd85ae5ebc628231be81bcdc4548063f074"
     },
     {
       "path": "tests/push_path_brief.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 363 operations across 55 resource groups
+- 365 operations across 56 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -100,6 +100,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -99,6 +99,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -19,6 +19,8 @@ export interface ErrorEnvelope { error: ApiErrorObject }
 export interface GetAccessRequestsResponse { requests: unknown }
 export interface GetAccessRequestsStatusResponse { github_login: unknown; status: unknown; admitted: unknown }
 export interface GetAchievementsResponse { achievements: unknown }
+export interface GetAgentsNameResponse { ok: boolean; agent: unknown }
+export interface GetAgentsResponse { ok: boolean; agents: unknown; counts: unknown; vocabulary: unknown }
 export interface GetAuditLogResponse { rows: unknown; page: unknown }
 export interface GetAuthAppPairInfoResponse { pair_code: unknown; device_name: unknown; platform: unknown; status: unknown }
 export interface GetAuthWebAdmissionStatusResponse { admitted: boolean }
@@ -434,6 +436,12 @@ export interface BongosClient {
     /** GET /achievements — rank: any-builder */
     getAchievements(args?: RequestArgs): Promise<GetAchievementsResponse>;
   };
+  "agents": {
+    /** GET /agents — rank: any-builder */
+    getAgents(args?: RequestArgs): Promise<GetAgentsResponse>;
+    /** GET /agents/{name} — rank: any-builder */
+    getAgentsName(args?: RequestArgs): Promise<GetAgentsNameResponse>;
+  };
   "analytics": {
     /** GET /analytics/builder/{id} — rank: any-builder */
     getAnalyticsBuilderId(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -96,6 +96,12 @@ export function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -29,6 +29,10 @@
       "name": "achievements",
       "description": "Endpoints under `/api/bongos/achievements`."
     },
+    {
+      "name": "agents",
+      "description": "Endpoints under `/api/bongos/agents`."
+    },
     {
       "name": "analytics",
       "description": "Endpoints under `/api/bongos/analytics`."
@@ -505,6 +509,96 @@
         ]
       }
     },
+    "/agents": {
+      "get": {
+        "operationId": "get_agents",
+        "tags": [
+          "agents"
+        ],
+        "summary": "GET /agents",
+        "description": "GET /agents — the whole registry. Unpaginated on purpose: agents are instance CONFIGURATION reconciled from committed files, so the row count is bounded by what a human wrote, not by traffic. If that ever stops being true, this is the line that needs a cursor — not a silent LIMIT, which would make the registry quietly incomplete.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/agents/routes/agents.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAgentsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/agents/{name}": {
+      "get": {
+        "operationId": "get_agents_name",
+        "tags": [
+          "agents"
+        ],
+        "summary": "GET /agents/:name",
+        "description": "GET /agents/:name — one definition, persona included. The name is validated against the SAME regex the schema CHECKs, before it reaches the query. The query is parameterised regardless, so this is not the injection wall — it is the difference between a 404 and a 400 for a caller who sent something that could never have been a name.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/agents/routes/agents.js",
+        "parameters": [
+          {
+            "name": "name",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `name`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAgentsNameResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/analytics/builder/{id}": {
       "get": {
         "operationId": "get_analytics_builder_id",
@@ -16776,6 +16870,36 @@
           "achievements"
         ]
       },
+      "GetAgentsNameResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "agent": {}
+        },
+        "required": [
+          "ok",
+          "agent"
+        ]
+      },
+      "GetAgentsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "agents": {},
+          "counts": {},
+          "vocabulary": {}
+        },
+        "required": [
+          "ok",
+          "agents",
+          "counts",
+          "vocabulary"
+        ]
+      },
       "GetAuditLogResponse": {
         "type": "object",
         "properties": {
@@ -22992,9 +23116,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 363,
-  "x-schema-count": 401,
+  "x-endpoint-count": 365,
+  "x-schema-count": 403,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 270,
+  "x-response-schemas": 272,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 363 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 365 endpoints across 59 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -23,6 +23,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/achievements` | `any-builder` | — | All seeded achievements — lets /builders render locked + unlocked side by side. |
 
+## `agents` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/agents` | `any-builder` | — | GET /agents — the whole registry. |
+| GET | `/api/bongos/agents/:name` | `any-builder` | — | GET /agents/:name — one definition, persona included. |
+
 ## `analytics` (1)
 
 | Method | Path | Rank | Body | Description |

package/docs/module-api-changelog.md

@@ -1857,5 +1857,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.697 with no explicit bump. run 34733917938. (task 1002620)
   1.19.699 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.698 with no explicit bump. run 34734848584. (task 1002620)
+  1.19.700 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.699 with no explicit bump. run 34735048203. (task 1002620)
+  1.19.701 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.700 with no explicit bump. run 34735311256. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -303,4 +303,10 @@ module.exports = {
   MODEL_TIERS,
   RANK_ORDER,
   SCOPE_RANK_FLOOR,
+  // Exported for the read routes (task 1002488), which reject an impossible
+  // :name with a 400 before it reaches the query. Shared rather than re-spelled:
+  // this pair already mirrors the agents_definitions_name_fmt_chk CHECK, and a
+  // second copy in the route layer is one more place for the three to drift.
+  NAME_RE,
+  NAME_MAX,
 };

package/modules/agents/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": false,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "migrations": true },
+  "contributes": { "routes": ["agents"], "migrations": true },
   "provides": [],
   "consumes": ["grade"]
 }