@bongos/core 1.19.702 → 1.19.704

package/scripts/gds/agents-sync.js

@@ -0,0 +1,482 @@
+#!/usr/bin/env node
+// scripts/gds/agents-sync.js — reconcile .claude/agents/*.md into
+// agents_definitions at deploy (task 1002490, goal 1000038 Phase 1, T6).
+//
+// WHY. The registry is what the spawn path fires from, so it — not the tree — is
+// the operative list. Files-are-source means a committed definition must reach
+// that table on deploy without anyone running anything by hand, and without a
+// deploy ever silently undoing an operator's decision.
+//
+// FOUR RULES, each of which is a way this could go wrong:
+//
+//  1. A `source=db` row is NEVER touched. An instance-authored agent is not in
+//     any file, so a file-driven reconcile that "cleaned up" rows with no
+//     matching file would delete exactly the agents nobody can restore from git.
+//     This script only ever writes rows it owns.
+//
+//  2. `author_rank` is NEVER read from the file, and never taken from git where
+//     it could grant anything. A committed file cannot carry authority (ADR
+//     0016) — writing `author_rank: archon` into frontmatter must buy nothing.
+//     The obvious implementation, "resolve the committer and stamp their live
+//     rank", has the same hole one level down: `git log --format=%ae` reports
+//     the commit AUTHOR, which the committer sets freely with `git config` or
+//     `--author`, so it is attacker-controlled too. Rather than pretend that
+//     value can be trusted, it is denied any power — see stampableAuthorRank:
+//     a definition reaching a PROTECTED module is stamped NULL regardless of
+//     git, which the wall treats as insufficient, so it imports disabled and
+//     arming it becomes an operator act with a real session behind it.
+//
+//  3. The scope wall is RE-RUN here, server-side. The same check runs when a
+//     definition is authored, but that check ran against the author's rank at
+//     authoring time on a machine outside the trust boundary. A definition
+//     scoped onto protected surfaces imports DISABLED and FLAGGED — present in
+//     the registry so it can be seen and fixed, never armed.
+//
+//  4. The sync NEVER ARMS ANYTHING. `enabled` is an operator decision, not a
+//     file one — by exactly the reasoning in rule 2. A new row inserts disabled;
+//     an existing row keeps whatever `enabled` an operator set, unless it is
+//     flagged, in which case it is forced off. So `git push` can add an agent to
+//     the registry and can never switch one on.
+//
+// FAIL-CLOSED IN THE DIRECTION THAT MATTERS. An unresolvable author yields a
+// NULL rank, which the validator treats as insufficient for any protected scope,
+// and which the schema's agents_definitions_armed_needs_author_chk independently
+// refuses to arm. Three layers have to agree before an agent fires; this script
+// is only one of them.
+//
+// Run:  node scripts/gds/agents-sync.js [--dry-run] [--json] [--dir <path>]
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const DEFAULT_DIR = path.join(REPO_ROOT, '.claude', 'agents');
+
+// The module owns the definition grammar; this script is its deploy-time
+// carrier. Requiring the module's own pure validator from the module's own
+// script is the same shape as context-pack.js reading task-classifier.
+const validate = require(path.join(REPO_ROOT, 'modules/agents/lib/validate.js'));
+
+// Validator error codes that mean "the SCOPE is refused", as opposed to "this is
+// not a definition". The distinction is the whole of rule 3: a scope refusal is
+// imported as a flagged row so somebody can SEE it, while a shape error has no
+// row to import — there is no definition there to put in the registry.
+const SCOPE_CODES = Object.freeze([
+  'scope_protected_rank',
+  'scope_out_of_bounds',
+  // task 1002492. The definition is well-formed; what failed is that its paths
+  // could not be checked. That is importable-but-flagged (visible, disabled),
+  // never a silent skip — "nobody checked" must surface as loudly as "refused".
+  'scope_paths_uncheckable',
+]);
+
+// Does this definition reach a PROTECTED surface — by module OR by path? If so,
+// the git-derived author identity is not consulted at all (see below), which is
+// what makes rule 2 hold against a value the author controls.
+//
+// The path half arrived with task 1002492. Before it, this asked about modules
+// only, which left the withholding rule with the same asymmetry the scope wall
+// itself had: naming `modules/government/` as a PATH reached neither check, so a
+// spoofed identity could still have stamped a rank onto a definition pointed at
+// the authority surface. Both halves, or neither is a wall.
+function declaresProtectedScope(candidate, protectedModules = [], isProtectedPath = null) {
+  const modules = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
+  if (modules.some((m) => protectedModules.includes(m))) return true;
+  const paths = Array.isArray(candidate?.scope_paths) ? candidate.scope_paths : [];
+  if (paths.length === 0) return false;
+  // No matcher and declared paths: unanswerable, so treated as protected — the
+  // same fail-closed reading the validator applies (scope_paths_uncheckable).
+  if (typeof isProtectedPath !== 'function') return true;
+  return paths.some((p) => {
+    try { return isProtectedPath(p) !== false; } catch { return true; }
+  });
+}
+
+// THE RANK THAT ACTUALLY GETS STAMPED, and the answer to the spoofable-identity
+// problem in lastCommitterLogin above.
+//
+// The naive design — resolve the committer, read their live rank, stamp it — is
+// an escalation path: the committer email is attacker-controlled, so anyone who
+// can land a commit can claim to be an Archon and arm an agent scoped onto the
+// authority surface. Verifying the identity properly would mean a trustworthy
+// server-side record of who authored each file, which this script does not have.
+//
+// So instead of trying to make the input trustworthy, the input is denied any
+// power: WHERE THE RANK COULD GRANT SOMETHING, IT IS NOT TAKEN FROM GIT.
+//
+//   - definition reaches a protected module → rank is NULL, full stop. The wall
+//     then flags it (an unresolved rank is insufficient, never exempt) and it
+//     imports disabled. Arming it is an operator act with a real session behind
+//     it, which is where the authority decision belongs.
+//   - definition reaches nothing protected → the rank gates nothing, so the
+//     hint is recorded as the provenance it is.
+//
+// The result is that spoofing the git identity buys exactly nothing: on the only
+// path where rank matters, no git-derived value is read.
+function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [], isProtectedPath = null } = {}) {
+  if (declaresProtectedScope(candidate, protectedModules, isProtectedPath)) return null;
+  return gitRank;
+}
+
+// ---- pure core -------------------------------------------------------------
+
+// Split `---\n<yaml>\n---\n<body>` into frontmatter text and body.
+// Deliberately NOT a YAML parser: the definition grammar is a flat map of
+// scalars and simple lists, and pulling a YAML dependency into a deploy script
+// to read four keys would be a supply-chain decision, not a convenience. The
+// validator is the thing that decides whether the result is a definition — this
+// only has to hand it a plain object faithfully.
+function splitFrontmatter(text) {
+  const s = String(text || '');
+  // Tolerates a BOM and CRLF, both of which a Windows-authored file will carry.
+  //
+  // The BOM is stripped BY CODE POINT rather than matched inside the regex. Two
+  // earlier spellings both failed review for the same reason: a literal U+FEFF
+  // in the pattern is invisible, so `/^<BOM>?---/` reads as `/^?---/` — an
+  // apparent no-op quantifier on a zero-width assertion — and an escape can be
+  // re-interpreted back into that literal by tooling on the way to disk. This
+  // form is unambiguous ASCII, and the file now contains no invisible
+  // characters at all. Behaviour that is correct but unreadable is still a
+  // defect; it cost two review rounds here.
+  const withoutBom = s.charCodeAt(0) === 0xFEFF ? s.slice(1) : s;
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(withoutBom);
+  if (!m) return { frontmatter: null, body: s };
+  return { frontmatter: m[1], body: m[2] };
+}
+
+// `key: value` / `key: [a, b]` / `key:\n  - a\n  - b`. Unknown keys are kept —
+// the validator refuses what it does not recognise, and silently dropping a key
+// here would turn a typo into a default instead of an error.
+function parseFrontmatter(fmText) {
+  const out = {};
+  if (typeof fmText !== 'string') return out;
+  const lines = fmText.split(/\r?\n/);
+  let listKey = null;
+  for (const raw of lines) {
+    if (!raw.trim() || /^\s*#/.test(raw)) continue;
+    const item = /^\s*-\s+(.*)$/.exec(raw);
+    if (item && listKey) { out[listKey].push(scalar(item[1])); continue; }
+    const kv = /^([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.*)$/.exec(raw);
+    if (!kv) { listKey = null; continue; }
+    const [, key, rest] = kv;
+    if (rest === '') { listKey = key; out[key] = []; continue; }
+    listKey = null;
+    const inline = /^\[(.*)\]$/.exec(rest.trim());
+    out[key] = inline
+      ? inline[1].split(',').map((p) => scalar(p)).filter((p) => p !== '')
+      : scalar(rest);
+  }
+  return out;
+}
+
+function scalar(raw) {
+  let v = String(raw).trim();
+  // Strip a trailing comment only when the value is not quoted — a persona-ish
+  // string legitimately contains '#'.
+  const quoted = /^(['"])([\s\S]*)\1$/.exec(v);
+  if (quoted) return quoted[2];
+  v = v.replace(/\s+#.*$/, '').trim();
+  if (v === 'true') return true;
+  if (v === 'false') return false;
+  return v;
+}
+
+// One file → the candidate object the validator takes. The BODY is the persona:
+// a persona is prose, and prose does not belong in frontmatter.
+function parseAgentFile(text, { name } = {}) {
+  const { frontmatter, body } = splitFrontmatter(text);
+  const fm = parseFrontmatter(frontmatter);
+  const candidate = { ...fm };
+  // The filename is the identity when frontmatter does not override it, so
+  // historian.md is the `historian` agent without having to say so twice.
+  if (!candidate.name && name) candidate.name = name;
+  const persona = String(body || '').trim();
+  if (persona) candidate.persona = persona;
+  // `trigger: event` + `event: task.shipped` is the readable file spelling of
+  // the column pair the schema stores. Mapped here rather than in the validator
+  // so the validator keeps taking exactly the row shape the DB holds.
+  if (candidate.trigger && !candidate.trigger_type) {
+    candidate.trigger_type = candidate.trigger;
+    delete candidate.trigger;
+  }
+  if (candidate.event && !candidate.trigger_spec) {
+    candidate.trigger_spec = { event: candidate.event };
+    delete candidate.event;
+  }
+  return candidate;
+}
+
+/**
+ * Decide what to do with ONE parsed candidate. Pure: no disk, no database, no
+ * git. Returns a plan the caller applies (or prints, under --dry-run).
+ *
+ * Outcomes:
+ *   skip    — not a definition. No row; the reason is reported.
+ *   flagged — a real definition whose SCOPE is refused. Imported disabled, with
+ *             scope_violation set, so it is visible and fixable.
+ *   upsert  — clean. Imported; `enabled` is left to the operator (rule 4).
+ *   protected — a `source=db` row owns this name. Never touched (rule 1).
+ */
+function planOne(candidate, {
+  authorRank: gitRank = null,
+  allowedModules = [],
+  protectedModules = [],
+  isProtectedPath = null,
+  existing = null,
+} = {}) {
+  const name = typeof candidate?.name === 'string' ? candidate.name : null;
+  // The caller passes the GIT-DERIVED rank; what gets stamped is whatever
+  // survives stampableAuthorRank, which withholds it entirely on any definition
+  // that reaches a protected module. Everything below uses `authorRank`, so the
+  // spoofable value cannot reach the wall by a path that forgets to launder it.
+  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules, isProtectedPath });
+
+  // Rule 1, checked before anything else: an instance-authored row owns its
+  // name. A file that happens to share it does not get to overwrite it, and
+  // this is reported rather than silent so the collision is visible.
+  if (existing && existing.source === 'db') {
+    return { action: 'protected', name, reason: 'an instance-authored (source=db) row owns this name — the file is ignored' };
+  }
+
+  const verdict = validate.validateAgentDefinition(candidate, {
+    authorRank, allowedModules, protectedModules, isProtectedPath,
+  });
+
+  if (verdict.ok) {
+    return {
+      action: 'upsert',
+      name,
+      value: verdict.value,
+      authorRank,
+      scopeViolation: null,
+      // Rule 4: never arm. Absent an existing row this is a fresh insert, which
+      // the schema defaults to disabled; on update we carry the operator's own
+      // setting forward untouched.
+      enabled: existing ? existing.enabled === true : false,
+    };
+  }
+
+  const codes = verdict.errors.map((e) => e.code);
+  const scopeOnly = codes.length > 0 && codes.every((c) => SCOPE_CODES.includes(c));
+  if (!scopeOnly) {
+    return { action: 'skip', name, reason: verdict.errors.map((e) => e.message).join(' · ') };
+  }
+
+  // Rule 3. The definition is well-formed; only its scope is refused. To import
+  // it we need the NORMALIZED row, which the validator only returns on success —
+  // so it is re-run with the scope checks satisfied purely to obtain that shape.
+  //
+  // This cannot widen anything: the re-run's verdict is discarded except for
+  // `value`, the row is forced enabled:false with scope_violation set, and the
+  // schema's agents_definitions_flagged_not_armed_chk refuses to store a flagged
+  // row as armed even if this code were wrong.
+  const declaredModules = Array.isArray(candidate.scope_modules) ? candidate.scope_modules : [];
+  const shapeOnly = validate.validateAgentDefinition(candidate, {
+    authorRank: validate.RANK_ORDER[validate.RANK_ORDER.length - 1],
+    allowedModules: [...new Set([...allowedModules, ...declaredModules])],
+    protectedModules: [],
+    // The re-run clears the MODULE wall to recover the normalized shape. The
+    // path matcher is deliberately left in place: a matcher that says a path is
+    // protected is a fact about the path, not about the author, so laundering
+    // it here would store a row whose scope no longer matches its flag.
+    isProtectedPath: () => false,
+  });
+  if (!shapeOnly.ok) {
+    // Defensive: the two runs disagreeing means an error that is scope-coded but
+    // not scope-caused. Skipping is the fail-closed answer.
+    return { action: 'skip', name, reason: verdict.errors.map((e) => e.message).join(' · ') };
+  }
+  return {
+    action: 'flagged',
+    name,
+    value: shapeOnly.value,
+    authorRank,
+    scopeViolation: verdict.errors.map((e) => e.message).join(' · '),
+    enabled: false,
+  };
+}
+
+// The whole plan, for a list of { name, candidate } and a lookup of existing
+// rows by name. Pure, so the reconcile's DECISIONS are unit-testable with no
+// database standing up.
+function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [], isProtectedPath = null } = {}) {
+  return files.map((f) => ({
+    file: f.file || null,
+    ...planOne(f.candidate, {
+      authorRank: authorRankFor(f.file),
+      allowedModules,
+      protectedModules,
+      isProtectedPath,
+      existing: existingByName.get(f.candidate?.name) || null,
+    }),
+  }));
+}
+
+// ---- disk + git ------------------------------------------------------------
+
+// An ABSENT directory is a legitimate state, not an error: `.claude/agents/`
+// does not exist in the core tree at all today, and an instance that ships no
+// agents must deploy cleanly. Zero files, exit 0, nothing written.
+function readAgentFiles(dir = DEFAULT_DIR) {
+  let names;
+  try {
+    names = fs.readdirSync(dir).filter((f) => f.endsWith('.md'));
+  } catch (err) {
+    if (err.code === 'ENOENT') return [];
+    throw err;
+  }
+  return names.sort().map((f) => {
+    const full = path.join(dir, f);
+    return {
+      file: path.relative(REPO_ROOT, full).split(path.sep).join('/'),
+      candidate: parseAgentFile(fs.readFileSync(full, 'utf8'), { name: f.replace(/\.md$/, '') }),
+    };
+  });
+}
+
+// The login that last committed a file — a PROVENANCE HINT, and explicitly NOT
+// an authority input. Read `declaresProtectedScope` below before using it.
+//
+// An earlier version of this comment claimed the GitHub noreply address "cannot
+// be spoofed by setting a local git name". THAT WAS WRONG, and it was the more
+// dangerous half of the mistake: `git log --format=%ae` reports the commit
+// AUTHOR, which any committer sets freely with `git config user.email` or
+// `--author`, noreply-shaped values included. Nothing here verifies the address
+// against GitHub. So this value is attacker-controlled, and a comment asserting
+// otherwise invites the next reviewer to skip the one check that matters.
+//
+// It is kept because provenance is genuinely useful where nothing is riding on
+// it. The wall is that it is never consulted where it could grant anything.
+function lastCommitterLogin(file, { runGit = defaultRunGit } = {}) {
+  let out;
+  try { out = runGit(['log', '-1', '--format=%ae%n%an', '--', file]); }
+  catch { return null; }
+  const [email = '', authorName = ''] = String(out || '').split(/\r?\n/);
+  const noreply = /^(?:\d+\+)?([A-Za-z0-9-]+)@users\.noreply\.github\.com$/.exec(email.trim());
+  if (noreply) return noreply[1];
+  return authorName.trim() || null;
+}
+
+function defaultRunGit(args) {
+  return execFileSync('git', args, { cwd: REPO_ROOT, encoding: 'utf8' });
+}
+
+module.exports = {
+  splitFrontmatter,
+  parseFrontmatter,
+  parseAgentFile,
+  declaresProtectedScope,
+  stampableAuthorRank,
+  planOne,
+  planSync,
+  readAgentFiles,
+  lastCommitterLogin,
+  SCOPE_CODES,
+  DEFAULT_DIR,
+};
+
+// ---- facade ----------------------------------------------------------------
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const dryRun = argv.includes('--dry-run');
+  const asJson = argv.includes('--json');
+  const dirIdx = argv.indexOf('--dir');
+  const dir = dirIdx >= 0 ? argv[dirIdx + 1] : DEFAULT_DIR;
+
+  const files = readAgentFiles(dir);
+  if (files.length === 0) {
+    if (asJson) console.log(JSON.stringify({ ok: true, scanned: 0, plan: [] }));
+    else console.log(`agents-sync: no definitions under ${path.relative(REPO_ROOT, dir) || dir} — nothing to reconcile.`);
+    return 0;
+  }
+
+  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
+  const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
+  const allowedModules = scopeMap.moduleKeys();
+  const protectedModules = scopeMap.protectedModules();
+  // The protected-surface registry, read the way every other enforcer reads it:
+  // synchronously from the checkout, no DB and no server (ADR 0043). surfaceFor
+  // returns the governing registry entry or null, so this is the boolean the
+  // validator's scope_paths wall asks for.
+  const permissionPaths = require(path.join(REPO_ROOT, 'src/bongos/permission-path-check.js'));
+  const isProtectedPath = (p) => permissionPaths.surfaceFor(p) !== null;
+
+  const { rows: existingRows } = await pool.query(
+    'SELECT name, source, enabled FROM agents_definitions'
+  );
+  const existingByName = new Map(existingRows.map((r) => [r.name, r]));
+
+  // ONE git subprocess per file, memoised — `authorRankFor` is called again from
+  // planSync, and re-shelling out there doubled the blocking spawns for an answer
+  // that cannot have changed mid-run.
+  const loginByFile = new Map(files.map((f) => [f.file, lastCommitterLogin(f.file)]));
+  // One query for every distinct committer, not one per file.
+  const logins = [...new Set([...loginByFile.values()].filter(Boolean))];
+  const rankByLogin = new Map();
+  if (logins.length) {
+    const { rows } = await pool.query(
+      'SELECT github_login, rank FROM builders WHERE lower(github_login) = ANY($1)',
+      [logins.map((l) => l.toLowerCase())]
+    );
+    for (const r of rows) rankByLogin.set(String(r.github_login).toLowerCase(), r.rank);
+  }
+  // The git-derived rank. planOne withholds it on any protected-scope definition
+  // (stampableAuthorRank) — this function never decides whether it may be used.
+  const authorRankFor = (file) => {
+    const login = loginByFile.get(file);
+    return login ? (rankByLogin.get(login.toLowerCase()) || null) : null;
+  };
+
+  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules, isProtectedPath });
+
+  if (dryRun) {
+    if (asJson) console.log(JSON.stringify({ ok: true, scanned: files.length, plan }, null, 2));
+    else for (const p of plan) console.log(`  ${p.action.padEnd(9)} ${p.name || p.file}${p.reason ? ` — ${p.reason}` : ''}`);
+    return 0;
+  }
+
+  let upserted = 0;
+  let flagged = 0;
+  for (const p of plan) {
+    if (p.action === 'skip' || p.action === 'protected') {
+      console.error(`agents-sync: ${p.action} ${p.name || p.file} — ${p.reason}`);
+      continue;
+    }
+    const v = p.value;
+    // ON CONFLICT targets the name unique constraint, and the WHERE clause is
+    // rule 1 made structural: a row that turned source=db between the read above
+    // and this write is not overwritten by the race either.
+    await pool.query(
+      `INSERT INTO agents_definitions
+         (name, title, persona, trigger_type, trigger_spec, model_tier,
+          scope_modules, scope_paths, scope_violation, source, provenance,
+          author_rank, source_path, last_synced_at, enabled)
+       VALUES ($1,$2,$3,$4,$5::jsonb,$6,$7,$8,$9,'file','built-in',$10,$11,now(),$12)
+       ON CONFLICT (name) DO UPDATE SET
+         title = EXCLUDED.title, persona = EXCLUDED.persona,
+         trigger_type = EXCLUDED.trigger_type, trigger_spec = EXCLUDED.trigger_spec,
+         model_tier = EXCLUDED.model_tier, scope_modules = EXCLUDED.scope_modules,
+         scope_paths = EXCLUDED.scope_paths, scope_violation = EXCLUDED.scope_violation,
+         author_rank = EXCLUDED.author_rank, source_path = EXCLUDED.source_path,
+         last_synced_at = now(), enabled = EXCLUDED.enabled, updated_at = now()
+       WHERE agents_definitions.source = 'file'`,
+      [v.name, v.title, v.persona, v.trigger_type, JSON.stringify(v.trigger_spec), v.model_tier,
+        v.scope_modules, v.scope_paths, p.scopeViolation, p.authorRank, p.file || null, p.enabled]
+    );
+    if (p.action === 'flagged') flagged += 1; else upserted += 1;
+  }
+  console.log(`agents-sync: ${files.length} file(s) — ${upserted} reconciled, ${flagged} flagged (disabled), `
+    + `${plan.filter((p) => p.action === 'skip').length} skipped, ${plan.filter((p) => p.action === 'protected').length} db-owned.`);
+  return 0;
+}
+
+if (require.main === module) {
+  main().then((code) => { process.exitCode = code; }).catch((err) => {
+    console.error(`agents-sync: ${err && err.message ? err.message : err}`);
+    process.exitCode = 1;
+  });
+}

package/scripts/migrate.sh

@@ -358,3 +358,26 @@ if [ "${OTB_POST_DEPLOY_CHECK:-0}" = "1" ]; then
     echo "post-deploy: python3 not found — skipping whole-world check" >&2
   fi
 fi
+
+# ---------- post-deploy: reconcile the agent registry (task 1002490) ----------
+#
+# .claude/agents/*.md -> agents_definitions. This runs HERE because migrate.sh is
+# the one deploy-time hook the portable core owns: the droplet's own deploy.sh
+# calls it, and the schema the reconcile writes into is applied a few lines
+# above, so the table is guaranteed to exist by the time this runs.
+#
+# FAIL-OPEN, deliberately. A reconcile that cannot run is a registry that is
+# stale by one deploy; a reconcile that aborts the deploy is an outage. The
+# script itself is already fail-closed in the direction that matters (an
+# unresolvable author, or any protected scope, imports disabled+flagged), so the
+# worst case here is an agent that does not appear until the next deploy.
+#
+# Silent when the module is off: `agents` is default:false, so on most instances
+# there is no table to reconcile into and nothing to say about it.
+if node -e "process.exit(require('./src/modules').isModuleEnabled('agents') ? 0 : 1)" 2>/dev/null; then
+  echo
+  echo "post-deploy: reconciling .claude/agents/ into the agent registry"
+  if ! node scripts/gds/agents-sync.js; then
+    echo "post-deploy: agents-sync failed — the registry is stale by one deploy, not broken" >&2
+  fi
+fi

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.702'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.704'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');