@bongos/core 1.19.699 → 1.19.701

package/modules/agents/routes/agents.js

@@ -0,0 +1,177 @@
+// modules/agents/routes/agents.js — the agent registry's READ surface (task
+// 1002488, BONGOS-V1 goal 1000038 Phase 1).
+//
+// WHY. agents-sync reconciles .claude/agents/*.md into agents_definitions at
+// deploy, and the spawn path fires from that table — so the table is the only
+// honest answer to "what agents does this instance actually have, and which of
+// them are armed?". Until now nothing could ask. A builder wondering why an
+// agent did or did not fire had to read the deploy log or the DB directly, and
+// an instance author had no way to see that the definition they committed was
+// flagged for a scope violation and therefore silently disarmed.
+//
+//   GET /agents        — the registry, newest-synced first.
+//   GET /agents/:name  — one definition, by its stable name.
+//
+// SELF-GATED, and that is the whole gate: `requireBuilder` and nothing else.
+// These are reads of the instance's own configuration by the people who build
+// it, the same audience and posture as GET /tasks. There is deliberately NO rank
+// floor — a xenos who can see WHICH agents are armed is better placed to
+// understand the review they just received, and none of the authority-bearing
+// fields is writable here (authoring is a separate task, with its own wall).
+//
+// WHAT IS NOT SERVED, ON PURPOSE:
+//
+//   `persona` is omitted from the LIST and served only on the detail route. It
+//   is capped at 32KB per row by the schema, so a 40-agent registry would be a
+//   1.2MB response to render a table that shows none of it. This is a size
+//   decision, not a secrecy one — the detail route hands it over to anyone who
+//   asks by name.
+//
+//   `author_builder_id` is never served. The FACT that matters downstream is
+//   `author_rank` — the rank the definition was stamped with at sync, which is
+//   what the spawn gate consults — and serving the id would turn a registry read
+//   into a people-directory read, which has its own gate (GET /scouting).
+//
+// Same idioms as modules/copy-desk/routes/copy-desk.js: doorway-only requires,
+// factory export mounted from module.json `contributes.routes`, res.fail codes.
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const validate = require('../lib/validate');
+
+const log = api.logger('agents');
+
+// The columns the serializer needs. Spelled out rather than `SELECT *` so that a
+// column added later (an author's email, a raw credential) cannot reach a
+// response by default — the read surface widens only when someone edits this
+// list and reads the comment above about what is deliberately not served.
+const COLUMNS = `
+  id, name, title, trigger_type, trigger_spec, model_tier,
+  scope_modules, scope_paths, scope_violation,
+  source, provenance, author_rank,
+  source_path, last_synced_at, enabled, created_at, updated_at
+`;
+
+// PURE. Row → wire shape, so the projection is unit-testable without a database.
+//
+// `model_tier` is stored as the TIER ('default' | 'routine'), never a model id:
+// the id a tier resolves to is a deployment fact that changes under the row, and
+// a registry that answered with a stale model name would be worse than one that
+// answers with the tier and lets the caller resolve it. The task asks for the
+// "resolved model tier", and the tier IS the resolved value at this layer.
+//
+// `armed` is derived rather than aliased from `enabled`, because two schema
+// CHECKs make "enabled" narrower than it reads: a row carrying a
+// `scope_violation` is forced to enabled=false, and an enabled row must carry an
+// author_rank. Surfacing the derived boolean beside the reason means a caller
+// asking "why did this not fire?" gets the answer in the same object.
+function serializeDefinition(row, { includePersona = false } = {}) {
+  if (!row) return null;
+  const out = {
+    name: row.name,
+    title: row.title || null,
+    trigger: {
+      type: row.trigger_type,
+      // trigger_spec is jsonb and NOT NULL DEFAULT '{}', but a hand-written row
+      // could still be any object; the event name is lifted out because it is
+      // the only part of the spec every event agent must carry (schema CHECK).
+      spec: row.trigger_spec && typeof row.trigger_spec === 'object' ? row.trigger_spec : {},
+      event: row.trigger_type === 'event' && row.trigger_spec ? (row.trigger_spec.event || null) : null,
+    },
+    model_tier: row.model_tier,
+    provenance: row.provenance,          // 'built-in' | 'instance'
+    source: row.source,                  // 'file' | 'db'
+    // A file-sourced row's path is its identity in the repo; a db-authored row
+    // has none, and null says so rather than an empty string that sorts oddly.
+    source_path: row.source_path || null,
+    author_rank: row.author_rank || null,
+    scope: {
+      modules: Array.isArray(row.scope_modules) ? row.scope_modules : [],
+      paths: Array.isArray(row.scope_paths) ? row.scope_paths : [],
+      violation: row.scope_violation || null,
+    },
+    armed: row.enabled === true,
+    // Why an agent is not armed, when the answer is knowable. A scope violation
+    // is the one disarm the registry can explain; anything else is simply off.
+    disarmed_reason: row.enabled === true ? null : (row.scope_violation ? 'scope_violation' : null),
+    last_synced_at: row.last_synced_at || null,
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+  };
+  if (includePersona) out.persona = row.persona;
+  return out;
+}
+
+module.exports = function agentsRoutes() {
+  const router = express.Router();
+
+  // GET /agents — the whole registry. Unpaginated on purpose: agents are
+  // instance CONFIGURATION reconciled from committed files, so the row count is
+  // bounded by what a human wrote, not by traffic. If that ever stops being
+  // true, this is the line that needs a cursor — not a silent LIMIT, which
+  // would make the registry quietly incomplete.
+  router.get('/agents', api.requireBuilder, async (req, res) => {
+    try {
+      const { rows } = await api.pool.query(
+        `SELECT ${COLUMNS} FROM agents_definitions
+          ORDER BY enabled DESC, name ASC`
+      );
+      res.json({
+        ok: true,
+        agents: rows.map((r) => serializeDefinition(r)),
+        // The counts a reader actually wants first, computed here so three
+        // callers do not each reduce the array their own way.
+        counts: {
+          total: rows.length,
+          armed: rows.filter((r) => r.enabled === true).length,
+          flagged: rows.filter((r) => r.scope_violation).length,
+        },
+        // The vocabulary, from the validator that enforces it — so a UI building
+        // a filter cannot spell a trigger type the registry will never contain.
+        // Same rule as the task-kind filter (task 1003453): serve the enum, do
+        // not let the client keep a copy.
+        vocabulary: {
+          trigger_types: [...validate.TRIGGER_TYPES],
+          model_tiers: [...validate.MODEL_TIERS],
+          events: [...validate.EVENT_CATALOG],
+        },
+      });
+    } catch (err) {
+      log.error({ err }, 'GET /agents failed');
+      if (!res.headersSent) res.fail('agents_list_failed', 500);
+    }
+  });
+
+  // GET /agents/:name — one definition, persona included.
+  //
+  // The name is validated against the SAME regex the schema CHECKs, before it
+  // reaches the query. The query is parameterised regardless, so this is not the
+  // injection wall — it is the difference between a 404 and a 400 for a caller
+  // who sent something that could never have been a name.
+  router.get('/agents/:name', api.requireBuilder, async (req, res) => {
+    const name = String(req.params.name || '');
+    if (!validate.NAME_RE.test(name) || name.length > validate.NAME_MAX) {
+      return res.fail('invalid_agent_name', 400);
+    }
+    try {
+      const { rows } = await api.pool.query(
+        `SELECT ${COLUMNS}, persona FROM agents_definitions WHERE name = $1`,
+        [name]
+      );
+      if (!rows.length) return res.fail('agent_not_found', 404);
+      return res.json({ ok: true, agent: serializeDefinition(rows[0], { includePersona: true }) });
+    } catch (err) {
+      log.error({ err, name }, 'GET /agents/:name failed');
+      if (!res.headersSent) return res.fail('agent_read_failed', 500);
+      return undefined;
+    }
+  });
+
+  return router;
+};
+
+// Exported for the unit tests, which drive the projection with fabricated rows
+// rather than standing up Postgres.
+module.exports.serializeDefinition = serializeDefinition;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -99,6 +99,12 @@ function createClient(opts = {}) {
       // GET /achievements — rank: any-builder — GET /achievements
       getAchievements: (args) => request("GET", "/achievements", { hasBody: false }, args),
     },
+    "agents": {
+      // GET /agents — rank: any-builder — GET /agents
+      getAgents: (args) => request("GET", "/agents", { hasBody: false }, args),
+      // GET /agents/{name} — rank: any-builder — GET /agents/:name
+      getAgentsName: (args) => request("GET", "/agents/{name}", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/modules/lifecycle/conflict-resolve.js

@@ -51,6 +51,16 @@ const githubPush = require('./github-push');
 const { repoInfo, branding } = require('../../src/module-api');
 const { loadRepoInfo } = repoInfo;
 const { registerMergeDriver } = require('../../scripts/gds/install-git-hooks');
+const { computeExecutedClosure, branchTouchesExecutedCode } = require('./executed-closure');
+
+// The closure is a property of the SERVER's trusted tree, not of the branch being
+// resolved, so it is computed once per root and cached. Asking the clone what our code
+// executes would let the branch answer the question the check exists to ask.
+const closureCache = new Map();
+function executedClosure(root) {
+  if (!closureCache.has(root)) closureCache.set(root, computeExecutedClosure({ root }));
+  return closureCache.get(root);
+}
 
 const execFileP = promisify(execFile);
 
@@ -141,7 +151,8 @@ async function hasConflictMarkers(gitIn) {
 //   { resolved: true,  head_sha, branch, regenerated }            — merged + pushed
 //   { resolved: false, skipped: '<why>' [, conflicted: [...] ] }  — left as-is
 // skipped reasons: disabled | unconfigured | already_up_to_date | clone_failed |
-//   fetch_failed | checkout_failed | markers_remain | push_failed |
+//   fetch_failed | checkout_failed | diff_failed | branch_modifies_executed_code
+//   (with executes[]) | markers_remain | push_failed |
 //   unresolvable_conflict (with conflicted[]) | generator_failed | commit_failed.
 // `regenerated` says whether step 7b had to commit post-merge generator drift on top
 // of the merge (task 1003546) — head_sha is that commit when it did.
@@ -211,6 +222,28 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     if (r.code !== 0) return { resolved: false, skipped: 'checkout_failed' };
     const before = (await git(['rev-parse', 'HEAD'])).stdout.trim();
 
+    // 5b. REFUSE A BRANCH THAT EDITS THE CODE THIS FUNCTION IS ABOUT TO RUN
+    //     (task 1003367, audit B1). Everything below executes out of the clone with the
+    //     live server's environment — the merge driver at step 6 and the generators at
+    //     7b — so a branch that rewrote any of it would be running its own code as the
+    //     server. This check must sit BEFORE the merge, not after it: `git merge` invokes
+    //     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone
+    //     root, so the driver is the clone's copy and it runs at step 6.
+    //
+    //     Fail CLOSED and hand the merge to a human. The alternative — scrubbing the
+    //     clone and running anyway — has to be right about every file it restores, and
+    //     the closure is 80-odd files deep through src/instance-config and src/bongos/*,
+    //     not the scripts/ directory alone.
+    const touched = await git(['diff', '--name-only', 'refs/remotes/origin/main...HEAD']);
+    if (touched.code !== 0) return { resolved: false, skipped: 'diff_failed' };
+    const executes = branchTouchesExecutedCode(
+      touched.stdout.split('\n'),
+      deps.executedClosure || executedClosure(repoRoot),
+    );
+    if (executes.length) {
+      return { resolved: false, skipped: 'branch_modifies_executed_code', executes };
+    }
+
     // 6. Merge origin/main into the branch. The otb-regen driver resolves the
     //    generated files; union resolves docs/adr/README.md; any genuine conflict
     //    leaves the merge non-zero.
@@ -392,7 +425,8 @@ async function defaultRunGenerators({ work, execFile = execFileP } = {}) {
 //     is a no-op for the strand.
 // Returns { refreshed: true, head_sha, branch } | { refreshed: false, skipped }.
 // skipped reasons: disabled | unconfigured | clone_failed | fetch_failed |
-//   checkout_failed | merge_conflict | generator_failed | no_regen_diff |
+//   checkout_failed | diff_failed | branch_modifies_executed_code (with executes[]) |
+//   merge_conflict | generator_failed | no_regen_diff |
 //   markers_remain | commit_failed | push_failed.
 async function refreshStaleGenerated({ branch } = {}, deps = {}) {
   const disabled = deps.disabled !== undefined ? deps.disabled : process.env.CONFLICT_RESOLVE_DISABLED === '1';
@@ -441,6 +475,22 @@ async function refreshStaleGenerated({ branch } = {}, deps = {}) {
     r = await git(['checkout', '-B', branch, `refs/remotes/origin/${branch}`]);
     if (r.code !== 0) return { refreshed: false, skipped: 'checkout_failed' };
 
+    // 4b. Same refusal as resolveBranchConflicts step 5b (task 1003367, audit B1). This
+    //     path registers no merge driver, so its only execution vector is runGenerators
+    //     at step 6 — but the check still belongs BEFORE the merge, because after it the
+    //     tree is a mix of both sides and `origin/main...HEAD` no longer answers "what
+    //     did this BRANCH change". Same closure, same fail-closed posture, so the two
+    //     heals cannot drift into different security postures.
+    const touched = await git(['diff', '--name-only', 'refs/remotes/origin/main...HEAD']);
+    if (touched.code !== 0) return { refreshed: false, skipped: 'diff_failed' };
+    const executes = branchTouchesExecutedCode(
+      touched.stdout.split('\n'),
+      deps.executedClosure || executedClosure(repoRoot),
+    );
+    if (executes.length) {
+      return { refreshed: false, skipped: 'branch_modifies_executed_code', executes };
+    }
+
     // 5. Merge origin/main. Expected CLEAN for this strand (the PR was mergeable and
     //    the failing signal was a stale-generated CHECK, not a conflict). A genuine
     //    conflict → abort + report merge_conflict so the resolveBranchConflicts path

package/modules/lifecycle/executed-closure.js

@@ -0,0 +1,183 @@
+// modules/lifecycle/executed-closure.js — which files does the merge resolver EXECUTE
+// out of a builder's branch? (task 1003367, audit ref B1, 2026-08-29 security audit.)
+//
+// WHY. resolveBranchConflicts and refreshStaleGenerated clone a builder's branch into a
+// temp tree and run code out of it with the LIVE SERVER's environment — DATABASE_URL,
+// BUILDER_SECRET_KEY, GITHUB_PUSH_TOKEN, DISCORD_BOT_TOKEN all inherited. That happens
+// on two separate paths, and the second one is easy to miss:
+//
+//   1. the `otb-regen` MERGE DRIVER. registerMergeDriver writes the driver command
+//      `node scripts/gds/git-merge-regen.js %O %A %B %P` with cwd at the clone root, so
+//      git runs the CLONE's copy during `git merge` — before any post-merge step.
+//   2. the GENERATORS, run after the merge as execFile(node, [<clone>/scripts/gds/…]).
+//
+// Both resolve their repo root from __dirname, which is why the trusted-code problem
+// cannot be solved by pointing them at the server's own copy: a server-rooted
+// git-merge-regen.js would regenerate the SERVER's checkout instead of the clone.
+//
+// WHAT THIS MODULE IS FOR. The audit prescribed restoring scripts/gds/ from origin/main.
+// That is not sufficient on its own: every generator requires ../../src/instance-config,
+// and gen-api-docs additionally requires src/bongos/route-rank-check, api-prefix and
+// routes/_helpers. A restore scoped to scripts/gds/ leaves those builder-controlled and
+// the hole open. So rather than curate a list by hand, we COMPUTE the transitive
+// require-closure of the real entrypoints and let the callers refuse to auto-resolve a
+// branch that touches any of it.
+//
+// The closure is computed against the SERVER's trusted tree on purpose. The question is
+// "what does OUR code execute", and asking the clone would let the branch answer it.
+//
+// THE RESIDUAL ASSUMPTION, stated so it can be re-checked rather than rediscovered.
+// This is a STATIC walk of string-literal require()s, so it is sound exactly as far as
+// that style holds. A computed require of real code — string concatenation, a template
+// literal, a variable — inside a closure member would be invisible here and the closure
+// would under-report what a branch can make the server run. That is not hypothetical:
+// src/module-loader/loader.js is in the closure and computed-requires every module's
+// route file, but only from loadModules(), which nothing on the generator path calls.
+// tests/executed_closure.mjs pins the known computed requires per file and fails the
+// build on a new one — which catches a change to OUR tree, and is therefore a tripwire,
+// not a widening. If a generator ever starts loading modules, or a closure member
+// switches to dynamic require, this walk must grow to match before it is trusted again.
+//
+// COST. computeExecutedClosure does synchronous readFileSync/statSync over ~80 files.
+// It runs in the live server process, so that is worth knowing — but it is called from a
+// ~5-minute background sweep, never a request path, and conflict-resolve.js caches it per
+// repo root for the process lifetime. Revisit if the entrypoint set grows a lot, or if
+// the cache key ever stops being a constant.
+//
+// Route files are deliberately NOT in here: src/bongos/route-rank-check.js reads them as
+// DATA, never require()s them (ADR 0083's one-way rule, and its own comment says so), and
+// gen-api-docs scans route sources textually. That distinction is what makes a narrow
+// closure correct — the resolver still REGENERATES from the builder's merged tree, it
+// just never EXECUTES it.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// The two execution roots, as repo-relative POSIX paths.
+//
+// BOTH script-tree spellings are listed while the compat shim exists. Task 1003705 moves
+// these to scripts/bongos/ and leaves scripts/gds/ holding WORKING forwarders, which git
+// still executes by the driver's relative path — so a guard that knew only the new name
+// would stop seeing edits to code that still runs. Missing entries are skipped, so this
+// is correct before the rename, during the shim window, and after C3d retires it.
+const ENTRYPOINTS = Object.freeze([
+  // 1. the merge driver (runs DURING `git merge`)
+  'scripts/gds/git-merge-regen.js',
+  'scripts/bongos/git-merge-regen.js',
+  // 2. the generators (run after the merge) — mirrors GENERATOR_SCRIPTS in
+  //    conflict-resolve.js; asserted identical by tests/executed_closure.mjs so the two
+  //    lists cannot drift apart.
+  'scripts/gds/gen-repo-map.js',
+  'scripts/bongos/gen-repo-map.js',
+  'scripts/gds/gen-file-map.js',
+  'scripts/bongos/gen-file-map.js',
+  'scripts/gds/gen-session-index.js',
+  'scripts/bongos/gen-session-index.js',
+  'scripts/gds/copy-inventory.js',
+  'scripts/bongos/copy-inventory.js',
+  'scripts/gds/gen-api-docs.js',
+  'scripts/bongos/gen-api-docs.js',
+  'scripts/gds/gen-api-client.js',
+  'scripts/bongos/gen-api-client.js',
+]);
+
+// Files that are not require()d but still decide what runs. .gitattributes names which
+// paths the otb-regen driver is applied to, so editing it changes what git hands the
+// driver and how much of the tree that driver rewrites during a merge.
+const TRUSTED_NON_CODE = Object.freeze(['.gitattributes']);
+
+const REQUIRE_RE = /\brequire\(\s*(['"])([^'"]+)\1\s*\)/g;
+
+function toPosix(p) {
+  return p.split(path.sep).join('/');
+}
+
+// Resolve a relative require specifier to a repo-relative file, trying the extensions
+// node would. Returns null for bare/`node:` specifiers and for anything that escapes the
+// repo — a require that leaves the tree is not a file a branch can edit.
+function resolveRelative(fromFileAbs, spec, { root }) {
+  if (!spec.startsWith('.')) return null;
+  const base = path.resolve(path.dirname(fromFileAbs), spec);
+  const candidates = [base, base + '.js', base + '.json', path.join(base, 'index.js')];
+  for (const c of candidates) {
+    let st;
+    try {
+      st = fs.statSync(c);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    const rel = toPosix(path.relative(root, c));
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return null;
+    return rel;
+  }
+  return null;
+}
+
+// computeExecutedClosure — every file the resolver can execute out of a cloned branch.
+//
+// A STATIC walk of require() literals. It deliberately does not try to follow a computed
+// require: the one that exists (gen-api-docs' require(path.join(CORE_ROOT,
+// 'package.json'))) resolves to package.json, which is parsed as JSON rather than run.
+// If a computed require of real CODE is ever added, the closure would under-report — so
+// tests/executed_closure.mjs fails the build on any computed require inside the closure,
+// which is the honest way to hold a static analysis to its assumption.
+function computeExecutedClosure({ root = REPO_ROOT, entrypoints = ENTRYPOINTS } = {}) {
+  const seen = new Set();
+  const queue = [];
+
+  for (const rel of entrypoints) {
+    const abs = path.join(root, rel);
+    if (fs.existsSync(abs)) queue.push(rel);
+  }
+
+  while (queue.length) {
+    const rel = queue.shift();
+    if (seen.has(rel)) continue;
+    seen.add(rel);
+
+    const abs = path.join(root, rel);
+    let src;
+    try {
+      src = fs.readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    REQUIRE_RE.lastIndex = 0;
+    let m;
+    while ((m = REQUIRE_RE.exec(src))) {
+      const next = resolveRelative(abs, m[2], { root });
+      if (next && !seen.has(next)) queue.push(next);
+    }
+  }
+
+  for (const rel of TRUSTED_NON_CODE) seen.add(rel);
+  return Object.freeze([...seen].sort());
+}
+
+// branchTouchesExecutedCode — pure predicate over `git diff --name-only` output.
+//
+// Returns the SORTED INTERSECTION rather than a boolean so the caller can name the
+// offending files in its skip reason. A resolver that refuses without saying which file
+// tripped it is one nobody can act on.
+function branchTouchesExecutedCode(touchedPaths, closure) {
+  const inClosure = new Set(closure);
+  const hits = [];
+  for (const raw of touchedPaths || []) {
+    const rel = toPosix(String(raw).trim());
+    if (rel && inClosure.has(rel)) hits.push(rel);
+  }
+  return [...new Set(hits)].sort();
+}
+
+module.exports = {
+  ENTRYPOINTS,
+  TRUSTED_NON_CODE,
+  REPO_ROOT,
+  computeExecutedClosure,
+  branchTouchesExecutedCode,
+};

package/modules/lifecycle/publish-reconciler.js

@@ -386,6 +386,21 @@ async function runSweep(deps = {}) {
                   `strand:unresolvable_conflict${files ? `:${files}` : ''}`,
                   `PR #${m.number} (${branch}) has a hand-written conflict (${files || 'unknown files'}) only its builder can resolve`
                 );
+              } else if (rr && rr.skipped === 'branch_modifies_executed_code') {
+                // task 1003367 (audit B1): DEFINITIVE in exactly the sense P-3 means it —
+                // the resolver refused because the branch edits code the resolver would
+                // have executed, and no number of later sweeps changes that. Without this
+                // branch the skip fell through both chains with no log and no flag, so the
+                // PR retried silently every ~5 min forever. Announcing it is not polish:
+                // a refusal nobody is told about is indistinguishable from a resolver that
+                // quietly stopped working, and this file's own header says a strand must
+                // reach its builder when it is DETECTED.
+                const files = (rr.executes || []).slice(0, 5).join(',');
+                await announceStrand(
+                  r,
+                  `strand:branch_modifies_executed_code${files ? `:${files}` : ''}`,
+                  `PR #${m.number} (${branch}) changes code the merge resolver executes (${files || 'unknown files'}) — it will not be auto-resolved; a human must land it`
+                );
               }
             } catch (e) {
               errFn(`[publish-reconciler] conflict-resolve for task ${r.task_id} (non-blocking): ${e && e.message}`);
@@ -470,6 +485,19 @@ async function runSweep(deps = {}) {
                   logFn(
                     `[publish-reconciler] task ${r.task_id} (${branch}) PR #${m.number} red (${m.reason}) but regeneration produced no diff — a real check failure, left for a human`
                   );
+                } else if (rr && rr.skipped === 'branch_modifies_executed_code') {
+                  // task 1003367 (audit B1). A tree-level determination, so it burns a cap
+                  // slot like the two above rather than retrying as if it were flaky infra:
+                  // the answer is the same on every future sweep. Announced for the same
+                  // reason as the conflict path — silence here is a PR that never lands and
+                  // never says why.
+                  attempts.set(branch, n + 1);
+                  const files = (rr.executes || []).slice(0, 5).join(',');
+                  await announceStrand(
+                    r,
+                    `strand:branch_modifies_executed_code${files ? `:${files}` : ''}`,
+                    `PR #${m.number} (${branch}) changes code the regen heal executes (${files || 'unknown files'}) — it will not be auto-healed; a human must land it`
+                  );
                 }
               } catch (e) {
                 errFn(`[publish-reconciler] regen-heal for task ${r.task_id} (non-blocking): ${e && e.message}`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.699",
+  "version": "1.19.701",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.699",
+      "version": "1.19.701",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.699",
+  "version": "1.19.701",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.699'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.701'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');