@bongos/core 1.19.703 → 1.19.704

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.703",
-  "core_contract": "1.19.703",
-  "source_commit": "f85beb07ce74ab0f248774c68e6d16453aa964c1",
+  "core_version": "1.19.704",
+  "core_contract": "1.19.704",
+  "source_commit": "86a7901eed7ffd687d8366c14b70b6dbce1a36f8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T03:53:32.093Z",
+  "built_at": "2026-09-13T04:51:44.117Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2633,
-  "tree_sha256": "4890a8f49b9e7da75dd0e91d122be5cc3c64802bca863b7eae48b237cab5e9b3",
+  "tree_sha256": "6a38a87e7ab24df8fa7020189772ed67bc02d6271601eda7a94aeddf84bfc12d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f777f91ad88b47ff271da5bbc1670507ed77fa105df07e3d15dca6912617baef"
+      "sha256": "339e97fa485b7a1b3090c5964a23d6d30d3863781e549e30af68610fb3eedb91"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3067,7 +3067,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "e5bcc0b4da0755546cb10870052099def2745c890cd8157d36d997e58a0399b3"
+      "sha256": "6760a34d404aa68c61896983c8aa621bd26244e5c98ed056045b3467359c4b53"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -3862,7 +3862,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "5cff70fc4e280c49d33dfb8f60ddb01181decd1645625b0bb5e7c2eb97335b81"
+      "sha256": "cd3659ad5831c767fe6600fabbe883f33b3429107a0b999092158dfa7c95b4e7"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -4642,7 +4642,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "6d9a7520b2565b34bf002df016598543101639ccc384d81a622d313ed688acbc"
+      "sha256": "2a6c392d4499498f0e0fb80c80002ba9d82a3f5e66e48cce9802c21c276af2a0"
     },
     {
       "path": "modules/government/ranks.js",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d63e44b7d4f919455708ad0fd9041ef90552639733c506b1fdc06fe2e2ccd12b"
+      "sha256": "8eb4b18a9a0ee8ec64bab2712698fca515ff92277ebeed12adbb7126fe30e3e2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ff9eefa1e4c9f66ddd29b8a077ef567602ca79e69ab569b13f72e9221289b2ed"
+      "sha256": "6c55beca8912927a2d103ef0efee212341daa09be17e346d4d298377e3958d19"
     },
     {
       "path": "public-docs/index.html",
@@ -7862,7 +7862,7 @@
     {
       "path": "scripts/gds/agents-sync.js",
       "mode": "0000644",
-      "sha256": "2e1a55ae7187a8ee970873a108a7989fed121f1ac1f92361d7b9bc61987056a2"
+      "sha256": "7a639c73f8d2f4f523899ab737641174ca7b5ed5409427238d7fc397cdba65ed"
     },
     {
       "path": "scripts/gds/api.js",
@@ -9557,7 +9557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6cb88cea4e61987151e1872011b8667189ef59d03f3999be5950ba716ad9b05e"
+      "sha256": "0954b91956641ff68caa5c9373be6d33d3ac3fdacda102846de75a339326fc86"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9672,12 +9672,12 @@
     {
       "path": "tests/agents_sync.mjs",
       "mode": "0000644",
-      "sha256": "96197b8e25d9a8620cd3e02b7c96137d7118543662555c73d74e22a6b6161953"
+      "sha256": "f7f6d88fd31a2eb1a81678d883706d2716e6a2ae20159599d3dbe7ed4c267f2e"
     },
     {
       "path": "tests/agents_validate.mjs",
       "mode": "0000644",
-      "sha256": "c698b80ab8d64421b5c81e91172e1f219c41924af19721106f1899cd29c2fabc"
+      "sha256": "82c7bcef316f5c0068cb53a43b2ef4a01367ff285939f132f01b0d8633d36353"
     },
     {
       "path": "tests/api_cli_flags.mjs",
@@ -10992,7 +10992,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "3517e05c1264fbdbeadc533884942926689952c8995548863ca1cfbfc365428e"
+      "sha256": "d11562d59861a5f5d294c072b3aa15f03703ddbb2102210ff92f7ccbcff5b5f6"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1865,5 +1865,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.701 with no explicit bump. run 34735775228. (task 1002620)
   1.19.703 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.702 with no explicit bump. run 34736566183. (task 1002620)
+  1.19.704 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.703 with no explicit bump. run 34738864605. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -88,30 +88,57 @@ DB-backed tests with no local Postgres — the count drifts and is not worth rec
 **`node scripts/gds/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
 result means something locally.
 
-**That gate's Windows baseline as of task 1003529 (2026-09-12): 4 suites** — `sound_player`
-(task 1003628), `session_caps` (1003827), `skill_preflight` (1003754), `task_recommendations`
-(1003759) — **plus the 6 carried by task 1003848**: `cli_surface`, `module_api_lazy`,
-`search_index_poller`, `search_isolation`, `tool_scan_engine`, `security/mirror`. Everything else
-is green, and a red suite outside those ten is yours.
-
-`logger` is **not** on that list and needs no work: it was the whole of the old "missing deps in
-the worktree" family and task 1003616 fixed it on 2026-09-07 — see the walk-up section below.
-
-**Two of the ten are INTERMITTENT, so a green run does not mean fixed.** `session_caps` and
-`search_isolation` exit `3221226505` (`0xC0000409`, STATUS_STACK_BUFFER_OVERRUN) — the process
-dies during teardown *after* its assertions have all passed, so whether the suite counts them as
-failures depends on timing. Measured in task 1003529: `session_caps` passed inside a full
-`run-unit-tests.js` sweep and failed twice in a row when run on its own, minutes apart, with task
-1003827 still open and nothing on main having touched it. This is the `cliExit` class documented in
+**That gate's Windows baseline, re-measured for task 1003860 on 2026-09-12 in a deps-installed
+`origin/main` worktree (core 1.19.703): 9 suites** — `session_caps` (task 1003827),
+`skill_preflight` (1003754), `task_recommendations` (1003759) — **plus the 6 carried by task
+1003848**: `cli_surface`, `module_api_lazy`, `search_index_poller`, `search_isolation`,
+`tool_scan_engine`, `security/mirror`. Everything else is green, and a red suite outside those
+nine is yours.
+
+**`sound_player` LEFT this list on 2026-09-12** — task 1003628 fixed the real bug behind it (the
+sound-prefs case read the builder's own settings instead of a fixture), and it is now green in two
+full sweeps and two standalone runs. It is called out rather than quietly deleted because it was
+listed as expected-red for a matter of hours: the list was written the same day the fix shipped.
+`logger` is likewise **not** on the list and needs no work — it was the whole of the old "missing
+deps in the worktree" family and task 1003616 fixed it on 2026-09-07 (see the walk-up section
+below).
+
+**THREE suites are INTERMITTENT on a Windows box, so neither a green run nor a red one settles
+anything on its own.** Two of the three are on the baseline above; the third is NOT, and keeping
+that distinction straight is the whole point of this paragraph — "intermittent" is a property of a
+suite, not a licence to add it to the expected-red list.
+
+*Intermittent AND on the list:* `session_caps` and `search_isolation` exit `3221226505`
+(`0xC0000409`, STATUS_STACK_BUFFER_OVERRUN) — the process dies during teardown *after* its
+assertions have all passed, so whether the suite counts them as failures depends on timing. Both
+directions are now on record. Task 1003529: `session_caps` passed inside a full
+`run-unit-tests.js` sweep and failed twice in a row when run on its own, minutes apart. Task
+1003860, two sweeps minutes apart on one unchanged tree: `session_caps` was RED in the first and
+GREEN in the second, plus green twice standalone — so the same tree answers 9 failures or 8
+depending on nothing you did, and `search_isolation` was red in both. Task 1003827 is still open
+and nothing on main has touched either. This is the `cliExit` class documented in
 [scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md) — a hard exit while handles are still closing.
 Do not mark either fixed on the strength of one green sweep, and do not let their noise cover a
 real regression: diff by name AND re-run the individual suite.
 
+*Intermittent but NOT on the list:* `<redacted>` (task 1003860). It failed inside one
+full sweep on 2026-09-12 and has not reproduced since — green standalone 7-of-7 then, and green in
+both full sweeps and three more standalone runs when the baseline was re-measured. It binds an
+ephemeral socket (`app.listen(0)`) and calls `server.close()` without awaiting it, so it is the
+same teardown-timing class as the two above. Know the name, so a red here does not send you
+hunting your own diff — but it stays OFF the expected-red list, because it is green on
+`origin/main`. **A suite that reds once and then will not reproduce is not a baseline entry.**
+Promoting a one-off red to a known name buys nothing and gives a genuine regression somewhere to
+hide; `git_merge_regen` below is the case that cost a whole session. Re-run this one alone before
+you touch anything.
+
 Two warnings about that list, both paid for:
 
 - **It drifts in BOTH directions.** The measurement before it (2026-08-27, 25 suites) had 7
   entries already fixed and was missing 6 that had since broken — so more than half of it was
-  wrong within a fortnight. Re-measure; never inherit a list.
+  wrong within a fortnight. And the one after THAT went stale in hours rather than weeks:
+  `sound_player` was fixed by task 1003628 the same day it was written down as expected-red
+  (task 1003860). Re-measure; never inherit a list.
 - **Compare NAMES, never counts**, and never bank a local red as "environmental" without a
   by-name baseline run in a deps-installed `origin/main` worktree. A count that matches can hide
   one suite fixed and another broken.

package/modules/agents/lib/validate.js

@@ -143,6 +143,11 @@ function validateAgentDefinition(obj, opts = {}) {
   const rawProtected = safeGet(options, 'protectedModules');
   const allowedModules = Array.isArray(rawAllowed) ? rawAllowed : [];
   const protectedModules = Array.isArray(rawProtected) ? rawProtected : [];
+  // (path) => boolean — "does this repo-relative path reach a protected
+  // surface?". Supplied by the caller from the protected-surface registry
+  // (task 1002492); see the scope_paths wall below for why it is passed in and
+  // why its absence refuses rather than admits.
+  const isProtectedPath = safeGet(options, 'isProtectedPath');
 
   // --- name ----------------------------------------------------------------
   const name = safeGet(obj, 'name');
@@ -276,6 +281,57 @@ function validateAgentDefinition(obj, opts = {}) {
     }
   }
 
+  // --- scope: THE OTHER HALF OF THE SAME WALL (task 1002492) -----------------
+  //
+  // Until now the rank wall ran over `scope_modules` only, and `scope_paths` was
+  // checked for tree-escape and nothing else. So one wall had two halves that
+  // disagreed: `scope_modules: ['government']` was refused below Metic, while
+  // `scope_paths: ['modules/government/']` reached the same code and passed at
+  // any rank. A definition could scope itself onto the authority surface by
+  // spelling it as a path — which is the one thing this check exists to stop.
+  //
+  // The matcher is PASSED IN rather than required, for the same reason
+  // `protectedModules` is: this module may not require core (ADR 0083), and the
+  // protected-surface registry must stay readable with no DB and no server so
+  // the out-of-band enforcers keep working (ADR 0043). The caller owns both.
+  if (scopePaths && scopePaths.length > 0) {
+    if (typeof isProtectedPath !== 'function') {
+      // FAIL-CLOSED, and deliberately not a default of "nothing is protected":
+      // scope_paths has no allowlist counterpart the way scope_modules has
+      // `allowedModules`, so an absent matcher would be a silent hole rather
+      // than a narrow scope. Declaring paths REQUIRES the caller to supply the
+      // means to check them.
+      E('scope_paths_uncheckable', 'scope_paths',
+        'scope_paths: declared, but no protected-path matcher was supplied, so they cannot be checked against the protected-surface registry. Refused rather than admitted — a path scope that nothing verified is indistinguishable from one nobody walled.');
+    } else {
+      const hits = [];
+      for (const p of scopePaths) {
+        let protectedPath;
+        try {
+          // ONLY an explicit `false` clears a path. Not `=== true`: that reads
+          // every ambiguous answer — undefined from a matcher that forgot a
+          // return, a truthy string, null — as "not protected", which is
+          // fail-OPEN on the exact question the wall exists to ask. Reading
+          // ambiguity as protected is loud and gets fixed; reading it as clean
+          // is silent and does not.
+          protectedPath = isProtectedPath(p) !== false;
+        } catch {
+          // A throwing matcher is treated as a HIT for the same reason: the
+          // question going unanswered must not read as no.
+          protectedPath = true;
+        }
+        if (protectedPath) hits.push(p);
+      }
+      if (hits.length > 0) {
+        const rankIdx = typeof authorRank === 'string' ? RANK_ORDER.indexOf(authorRank) : -1;
+        if (rankIdx < RANK_ORDER.indexOf(SCOPE_RANK_FLOOR)) {
+          E('scope_protected_rank', 'scope_paths',
+            `scope_paths: ${hits.map((p) => JSON.stringify(p)).join(', ')} ${hits.length === 1 ? 'reaches a protected surface' : 'reach protected surfaces'} and require a ${SCOPE_RANK_FLOOR}+ author; the author's resolved rank is ${JSON.stringify(authorRank ?? null)} (ADR 0016 / ADR 0043). A path scope is walled exactly as a module scope is — spelling the surface as a path is not a way around it.`);
+        }
+      }
+    }
+  }
+
   if (errors.length > 0) return { ok: false, errors, value: null };
 
   // The normalized row, built fresh — the caller's object is never mutated, and

package/modules/government/protected-surfaces.json

@@ -55,6 +55,14 @@
     { "glob": "scripts/gds/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },
     { "glob": "scripts/gds/hooks/", "group": "pipeline", "why": "the git hooks themselves (self-protect)" },
     { "glob": "scripts/gds/cli-lib.js", "group": "pipeline", "why": "session/token + apiCall the gate relies on" },
+    { "glob": "scripts/gds/git-merge-regen.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: registerMergeDriver writes 'node scripts/gds/git-merge-regen.js' as a RELATIVE command with cwd at the clone root, so git merge runs the BRANCH's copy, with the live server's DATABASE_URL and BUILDER_SECRET_KEY, before any post-merge step. This and the six generators below are the ENTRYPOINTS in modules/lifecycle/executed-closure.js; tests/government_protected_surfaces.mjs fails the build if that list ever grows past this registry." },
+    { "glob": "scripts/gds/gen-repo-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: run by the merge resolver as execFile(node, [<clone>/...]) after the merge — the branch's copy, the server's environment." },
+    { "glob": "scripts/gds/gen-file-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/gds/gen-session-index.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/gds/copy-inventory.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone. NOT named by the 2026-08-29 audit, which said 'the gen-* trio' — that trio was already stale against GENERATOR_SCRIPTS, which is why this registry is pinned to the closure's ENTRYPOINTS rather than to the audit's prose." },
+    { "glob": "scripts/gds/gen-api-docs.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone, and the widest one — it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers." },
+    { "glob": "scripts/gds/gen-api-client.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone." },
+    { "glob": ".gitattributes", "group": "pipeline", "why": "task 1003366, audit ref MIT1. Not code and never require()d, but it NAMES which paths git hands the otb-regen driver — so editing it changes how much of the tree that driver rewrites during a merge. modules/lifecycle/executed-closure.js carries it as TRUSTED_NON_CODE for exactly this reason (ADR 0043)." },
     { "glob": "scripts/migrate.sh", "group": "pipeline", "why": "applies migrations on deploy" },
     { "glob": "scripts/deploy/", "group": "pipeline", "why": "the deploy scripts run on the droplet at deploy (ADR 0058)" },
     { "glob": "modules/lifecycle/merge-lock.js", "group": "pipeline", "why": "BV1.R86: serializes a ship" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.703",
+  "version": "1.19.704",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.703",
+      "version": "1.19.704",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.703",
+  "version": "1.19.704",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agents-sync.js

@@ -64,14 +64,35 @@ const validate = require(path.join(REPO_ROOT, 'modules/agents/lib/validate.js'))
 // not a definition". The distinction is the whole of rule 3: a scope refusal is
 // imported as a flagged row so somebody can SEE it, while a shape error has no
 // row to import — there is no definition there to put in the registry.
-const SCOPE_CODES = Object.freeze(['scope_protected_rank', 'scope_out_of_bounds']);
-
-// Does this definition reach a PROTECTED module? If so, the git-derived author
-// identity is not consulted at all (see below) — which is what makes rule 2 hold
-// against a value the author controls.
-function declaresProtectedScope(candidate, protectedModules = []) {
-  const declared = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
-  return declared.some((m) => protectedModules.includes(m));
+const SCOPE_CODES = Object.freeze([
+  'scope_protected_rank',
+  'scope_out_of_bounds',
+  // task 1002492. The definition is well-formed; what failed is that its paths
+  // could not be checked. That is importable-but-flagged (visible, disabled),
+  // never a silent skip — "nobody checked" must surface as loudly as "refused".
+  'scope_paths_uncheckable',
+]);
+
+// Does this definition reach a PROTECTED surface — by module OR by path? If so,
+// the git-derived author identity is not consulted at all (see below), which is
+// what makes rule 2 hold against a value the author controls.
+//
+// The path half arrived with task 1002492. Before it, this asked about modules
+// only, which left the withholding rule with the same asymmetry the scope wall
+// itself had: naming `modules/government/` as a PATH reached neither check, so a
+// spoofed identity could still have stamped a rank onto a definition pointed at
+// the authority surface. Both halves, or neither is a wall.
+function declaresProtectedScope(candidate, protectedModules = [], isProtectedPath = null) {
+  const modules = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
+  if (modules.some((m) => protectedModules.includes(m))) return true;
+  const paths = Array.isArray(candidate?.scope_paths) ? candidate.scope_paths : [];
+  if (paths.length === 0) return false;
+  // No matcher and declared paths: unanswerable, so treated as protected — the
+  // same fail-closed reading the validator applies (scope_paths_uncheckable).
+  if (typeof isProtectedPath !== 'function') return true;
+  return paths.some((p) => {
+    try { return isProtectedPath(p) !== false; } catch { return true; }
+  });
 }
 
 // THE RANK THAT ACTUALLY GETS STAMPED, and the answer to the spoofable-identity
@@ -95,8 +116,8 @@ function declaresProtectedScope(candidate, protectedModules = []) {
 //
 // The result is that spoofing the git identity buys exactly nothing: on the only
 // path where rank matters, no git-derived value is read.
-function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [] } = {}) {
-  if (declaresProtectedScope(candidate, protectedModules)) return null;
+function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [], isProtectedPath = null } = {}) {
+  if (declaresProtectedScope(candidate, protectedModules, isProtectedPath)) return null;
   return gitRank;
 }
 
@@ -203,6 +224,7 @@ function planOne(candidate, {
   authorRank: gitRank = null,
   allowedModules = [],
   protectedModules = [],
+  isProtectedPath = null,
   existing = null,
 } = {}) {
   const name = typeof candidate?.name === 'string' ? candidate.name : null;
@@ -210,7 +232,7 @@ function planOne(candidate, {
   // survives stampableAuthorRank, which withholds it entirely on any definition
   // that reaches a protected module. Everything below uses `authorRank`, so the
   // spoofable value cannot reach the wall by a path that forgets to launder it.
-  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules });
+  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules, isProtectedPath });
 
   // Rule 1, checked before anything else: an instance-authored row owns its
   // name. A file that happens to share it does not get to overwrite it, and
@@ -220,7 +242,7 @@ function planOne(candidate, {
   }
 
   const verdict = validate.validateAgentDefinition(candidate, {
-    authorRank, allowedModules, protectedModules,
+    authorRank, allowedModules, protectedModules, isProtectedPath,
   });
 
   if (verdict.ok) {
@@ -256,6 +278,11 @@ function planOne(candidate, {
     authorRank: validate.RANK_ORDER[validate.RANK_ORDER.length - 1],
     allowedModules: [...new Set([...allowedModules, ...declaredModules])],
     protectedModules: [],
+    // The re-run clears the MODULE wall to recover the normalized shape. The
+    // path matcher is deliberately left in place: a matcher that says a path is
+    // protected is a fact about the path, not about the author, so laundering
+    // it here would store a row whose scope no longer matches its flag.
+    isProtectedPath: () => false,
   });
   if (!shapeOnly.ok) {
     // Defensive: the two runs disagreeing means an error that is scope-coded but
@@ -275,13 +302,14 @@ function planOne(candidate, {
 // The whole plan, for a list of { name, candidate } and a lookup of existing
 // rows by name. Pure, so the reconcile's DECISIONS are unit-testable with no
 // database standing up.
-function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [] } = {}) {
+function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [], isProtectedPath = null } = {}) {
   return files.map((f) => ({
     file: f.file || null,
     ...planOne(f.candidate, {
       authorRank: authorRankFor(f.file),
       allowedModules,
       protectedModules,
+      isProtectedPath,
       existing: existingByName.get(f.candidate?.name) || null,
     }),
   }));
@@ -370,6 +398,12 @@ async function main() {
   const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
   const allowedModules = scopeMap.moduleKeys();
   const protectedModules = scopeMap.protectedModules();
+  // The protected-surface registry, read the way every other enforcer reads it:
+  // synchronously from the checkout, no DB and no server (ADR 0043). surfaceFor
+  // returns the governing registry entry or null, so this is the boolean the
+  // validator's scope_paths wall asks for.
+  const permissionPaths = require(path.join(REPO_ROOT, 'src/bongos/permission-path-check.js'));
+  const isProtectedPath = (p) => permissionPaths.surfaceFor(p) !== null;
 
   const { rows: existingRows } = await pool.query(
     'SELECT name, source, enabled FROM agents_definitions'
@@ -397,7 +431,7 @@ async function main() {
     return login ? (rankByLogin.get(login.toLowerCase()) || null) : null;
   };
 
-  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules });
+  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules, isProtectedPath });
 
   if (dryRun) {
     if (asJson) console.log(JSON.stringify({ ok: true, scanned: files.length, plan }, null, 2));

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.703'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.704'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_sync.mjs

@@ -316,6 +316,69 @@ t('a GitHub noreply address yields the login; a local name is only a fallback',
     'an unreadable history resolves to null, which rule 2 treats as insufficient');
 });
 
+console.log('\nthe path wall is wired to the REAL registry (task 1002492):');
+
+const permissionPaths = require('../src/bongos/permission-path-check.js');
+const realMatcher = (p) => permissionPaths.surfaceFor(p) !== null;
+
+t('the wall is wired to the REAL protected-surface registry', () => {
+  // Not a stub: the same synchronously-loaded registry the pre-push hook, the
+  // grader pre-pass and main-audit.js read (ADR 0043). If a governance re-map
+  // narrows it, this fails rather than silently widening what an agent may reach.
+  assert.equal(realMatcher('modules/government/catalog.js'), true, 'the authority surface');
+  assert.equal(realMatcher('migrations/001_init.sql'), true, 'schema');
+  assert.equal(realMatcher('.claude/hooks/pre-push.js'), true, 'local automation');
+  assert.equal(realMatcher('modules/agents/lib/validate.js'), false, "a module's own code is not protected");
+  // `.claude/agents/` itself is deliberately NOT in the registry — see the note
+  // on ADDED_SINCE_R101 in tests/government_protected_surfaces.mjs. Protecting
+  // it would rank-wall the whole agents module by derivation, which is a
+  // separate decision from the one this wall makes.
+  assert.equal(realMatcher('.claude/agents/historian.md'), false,
+    'not protected — and that is recorded, not accidental');
+});
+
+t('a path scope onto the authority surface is withheld a rank AND flagged', () => {
+  // Both halves of task 1002492 meeting the rule from 1002490: the definition
+  // reaches a protected surface BY PATH, so (a) no git-derived rank is stamped
+  // and (b) the scope wall refuses it — imported, disabled, visible.
+  const d = sync.parseAgentFile(
+    '---\nname: snoop\ntrigger: on-demand\nscope_paths: [modules/government/catalog.js]\n---\nbody', {});
+  assert.equal(sync.declaresProtectedScope(d, [], realMatcher), true);
+  assert.equal(sync.stampableAuthorRank(d, { gitRank: 'archon', isProtectedPath: realMatcher }), null,
+    'a claimed archon rank must not survive a PATH-spelled protected scope either');
+  const p = sync.planOne(d, {
+    authorRank: 'archon', allowedModules: ['agents'], isProtectedPath: realMatcher,
+  });
+  assert.equal(p.action, 'flagged');
+  assert.equal(p.authorRank, null);
+  assert.equal(p.enabled, false);
+  assert.match(p.scopeViolation, /scope_paths|protected surface/i);
+});
+
+t('an unprotected path scope still reconciles normally', () => {
+  // The wall is a floor, not a ban — a tightening that refused every path scope
+  // would pass the test above and break the feature.
+  const d = sync.parseAgentFile(
+    '---\nname: reader\ntrigger: on-demand\nscope_paths: [modules/agents/lib/]\n---\nbody', {});
+  assert.equal(sync.declaresProtectedScope(d, [], realMatcher), false);
+  const p = sync.planOne(d, {
+    authorRank: 'metic', allowedModules: ['agents'], isProtectedPath: realMatcher,
+  });
+  assert.equal(p.action, 'upsert');
+  assert.equal(p.authorRank, 'metic', 'rank gates nothing here, so the provenance hint is kept');
+});
+
+t('declaring paths with NO matcher flags rather than importing clean', () => {
+  // The uncheckable case end to end: the plan must not treat "nobody checked"
+  // as "nothing was protected".
+  const d = sync.parseAgentFile(
+    '---\nname: x\ntrigger: on-demand\nscope_paths: [anything]\n---\nbody', {});
+  assert.equal(sync.declaresProtectedScope(d, [], null), true, 'unanswerable reads as protected');
+  const p = sync.planOne(d, { authorRank: 'archon', allowedModules: ['agents'] });
+  assert.equal(p.action, 'flagged', 'imported and visible, never silently clean');
+  assert.equal(p.enabled, false);
+});
+
 console.log('\nthe reconcile actually RUNS at deploy:');
 
 t('migrate.sh invokes agents-sync, module-gated and fail-open', () => {

package/tests/agents_validate.mjs

@@ -41,7 +41,15 @@ const OK_DEF = Object.freeze({
   model_tier: 'default',
   scope_modules: ['agents'],
 });
-const OPTS = Object.freeze({ authorRank: 'archon', allowedModules: ['agents'] });
+// task 1002492 added the scope_paths half of the rank wall, and with it the rule
+// that DECLARING paths requires the caller to supply the means to check them —
+// there is no `allowedPaths` counterpart to fail closed on, so an absent matcher
+// would be a silent hole. The baseline options therefore carry a matcher; the
+// uncheckable and protected cases each get their own test below.
+const NOTHING_PROTECTED = () => false;
+const OPTS = Object.freeze({
+  authorRank: 'archon', allowedModules: ['agents'], isProtectedPath: NOTHING_PROTECTED,
+});
 
 const codes = (r) => r.errors.map((e) => e.code);
 const hasCode = (r, code) => codes(r).includes(code);
@@ -241,6 +249,115 @@ await test('a scope_path that escapes the tree is refused', () => {
   assert.equal(validateAgentDefinition({ ...OK_DEF, scope_paths: ['modules/agents/'] }, OPTS).ok, true);
 });
 
+// --- THE scope_paths HALF OF THE WALL (task 1002492) ------------------------
+//
+// The defect this closes: the rank wall ran over scope_modules only, so
+// `scope_modules: ['government']` was refused below Metic while
+// `scope_paths: ['modules/government/']` reached the same code and passed at any
+// rank. One wall, two halves, disagreeing — and the path half was the one an
+// author would reach for to name a specific surface.
+
+const REACHES_GOVERNMENT = (p) => String(p).startsWith('modules/government');
+
+await test('a scope_path onto a protected surface is refused below the floor', () => {
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/catalog.js'] },
+    { authorRank: 'thetes', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, false, 'a thetes author may not scope onto the authority surface by path');
+  assert.ok(hasCode(r, 'scope_protected_rank'), JSON.stringify(codes(r)));
+  assert.match(r.errors.find((e) => e.code === 'scope_protected_rank').message, /scope_paths/);
+});
+
+await test('the two halves of the wall now agree', () => {
+  // The asymmetry itself, asserted: the same surface named as a module and as a
+  // path must reach the same verdict for the same author.
+  const asModule = validateAgentDefinition(
+    { ...OK_DEF, scope_modules: ['government'] },
+    { authorRank: 'thetes', allowedModules: ['agents', 'government'], protectedModules: ['government'], isProtectedPath: NOTHING_PROTECTED }
+  );
+  const asPath = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/'] },
+    { authorRank: 'thetes', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(asModule.ok, false, 'the module spelling was always refused');
+  assert.equal(asPath.ok, false, 'and the path spelling must be too — this is the whole task');
+  assert.ok(hasCode(asModule, 'scope_protected_rank'));
+  assert.ok(hasCode(asPath, 'scope_protected_rank'));
+});
+
+await test('a Metic+ author may scope onto a protected path', () => {
+  // The wall is a FLOOR, not a ban — a tightening that refused everyone would
+  // pass the test above while breaking the feature.
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/catalog.js'] },
+    { authorRank: 'metic', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, true, JSON.stringify(codes(r)));
+  assert.deepEqual(r.value.scope_paths, ['modules/government/catalog.js']);
+});
+
+await test('an UNPROTECTED path is unaffected at any rank', () => {
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/agents/lib/'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, true, 'the wall must not become a blanket refusal of path scopes');
+});
+
+await test('declaring scope_paths with NO matcher is refused, not admitted', () => {
+  // scope_modules fails closed through `allowedModules` defaulting to empty.
+  // scope_paths has no such counterpart, so an absent matcher would be a silent
+  // hole — "nobody checked" must not read the same as "nothing was protected".
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['anything/at/all'] },
+    { authorRank: 'archon', allowedModules: ['agents'] }
+  );
+  assert.equal(r.ok, false);
+  assert.ok(hasCode(r, 'scope_paths_uncheckable'), JSON.stringify(codes(r)));
+  // …and an ARCHON is refused too: this is not a rank question, it is a
+  // "we could not answer the question" question.
+  assert.equal(r.value, null);
+});
+
+await test('a THROWING matcher counts as a hit, never as a clean path', () => {
+  const boom = () => { throw new Error('registry unreadable'); };
+  const low = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['whatever'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: boom }
+  );
+  assert.equal(low.ok, false, 'an unanswered question must not resolve to "not protected"');
+  assert.ok(hasCode(low, 'scope_protected_rank'));
+  // The floor still applies: a Metic+ author is admitted, because the
+  // fail-closed reading is "treat as protected", not "refuse everyone".
+  const high = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['whatever'] },
+    { authorRank: 'archon', allowedModules: ['agents'], isProtectedPath: boom }
+  );
+  assert.equal(high.ok, true);
+});
+
+await test('ONLY an explicit false clears a path — ambiguity reads as protected', () => {
+  // The fail-open trap: `answer === true` would read undefined (a matcher that
+  // forgot a return), a truthy string, or null as "not protected" — silently
+  // opening the wall on the exact question it exists to ask. Reading ambiguity
+  // as protected is loud and gets fixed; reading it as clean is not.
+  for (const answer of [undefined, null, 'yes', 0, '']) {
+    const r = validateAgentDefinition(
+      { ...OK_DEF, scope_paths: ['x'] },
+      { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: () => answer }
+    );
+    assert.equal(r.ok, false, `a matcher answering ${JSON.stringify(answer)} must not clear the path`);
+    assert.ok(hasCode(r, 'scope_protected_rank'));
+  }
+  // …and a real `false` does clear it, or the wall would refuse everything.
+  const clean = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['x'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: () => false }
+  );
+  assert.equal(clean.ok, true);
+});
+
 // --- THE RANK WALL (ADR 0016 — authority is the author's LIVE rank) ---------
 
 await test('RANK_ORDER is the ladder low→high, and the scope floor is Metic', () => {

package/tests/government_protected_surfaces.mjs

@@ -92,7 +92,89 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // Each entry is { after, glob, why }: `after` is the glob it is inserted
 // directly below, so the expected list is reconstructed in order rather than
 // re-pasted (a re-paste is how the two lists drift apart).
-const ADDED_SINCE_R101 = [];
+// CONSIDERED AND DELIBERATELY NOT ADDED: `.claude/agents/` (task 1002492).
+//
+// It looks like it belongs — an agent definition is local automation that fires
+// on its own and declares its own scope, which is the stated reason
+// `.claude/hooks/` and `.claude/settings.json` sit in the automation group. It
+// was added, and backed out, because protectedness is DERIVED PER MODULE:
+// module-scope-map marks a module protected when ANY of its globs is, and
+// `.claude/agents/` is one of the `agents` module's globs. So the entry silently
+// rank-walls the WHOLE agents module — `modules/agents/` source included — and
+// with it goals 1000038/39/40, changing who may work them. Two guards caught it:
+// module-scope-map's "derived, not hand-set" assertion and publish_manifest's
+// rule that every protected glob be explicitly excluded or publishable.
+//
+// That is a policy decision about a rank floor on three goals. It is NOT the
+// decision task 1002492 was for — "an agent may not scope itself onto the
+// authority surface" — which the scope_paths wall in
+// modules/agents/lib/validate.js now enforces on its own. Protecting the
+// directory would gate who may EDIT a definition; it does nothing about where a
+// definition POINTS.
+//
+// If the owner does want the agents module rank-walled, it needs the entry here,
+// a publish-manifest carve-out, and the module-scope-map roster test updated —
+// three deliberate edits, not a side effect of a scope fix.
+const ADDED_SINCE_R101 = [
+  // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
+  // execution roots the merge resolver runs out of a cloned branch. The audit named four
+  // of them ("the three gen-* scripts and .gitattributes"); modules/lifecycle/executed-
+  // closure.js names eight, so the audit's prose was already stale against shipped code.
+  // The drift tripwire below is what keeps this list honest from here.
+  {
+    after: 'scripts/gds/cli-lib.js',
+    glob: 'scripts/gds/git-merge-regen.js',
+    why: 'the otb-regen MERGE DRIVER. Registered as a relative command with cwd at the '
+       + 'clone root, so git merge runs the BRANCH copy with the live server environment '
+       + 'BEFORE any post-merge step — the earliest execution vector, and the one the '
+       + "audit's \"after the merge\" framing missed.",
+  },
+  {
+    after: 'scripts/gds/git-merge-regen.js',
+    glob: 'scripts/gds/gen-repo-map.js',
+    why: 'a post-merge generator the resolver runs as execFile(node, [<clone>/...]) — the '
+       + "branch's own copy, inheriting DATABASE_URL and BUILDER_SECRET_KEY.",
+  },
+  {
+    after: 'scripts/gds/gen-repo-map.js',
+    glob: 'scripts/gds/gen-file-map.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-file-map.js',
+    glob: 'scripts/gds/gen-session-index.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-session-index.js',
+    glob: 'scripts/gds/copy-inventory.js',
+    why: 'a post-merge generator the resolver executes out of the clone. NOT one of the '
+       + "audit's \"gen-* trio\" — it is the first of the four roots that prose omitted, "
+       + 'which is why this registry is pinned to the closure rather than to the audit.',
+  },
+  {
+    after: 'scripts/gds/copy-inventory.js',
+    glob: 'scripts/gds/gen-api-docs.js',
+    why: 'a post-merge generator the resolver executes out of the clone, and the widest '
+       + 'one: it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers, '
+       + 'which is why a restore scoped to scripts/gds/ was never sufficient.',
+  },
+  {
+    after: 'scripts/gds/gen-api-docs.js',
+    glob: 'scripts/gds/gen-api-client.js',
+    why: 'a post-merge generator the resolver executes out of the clone, inheriting the '
+       + 'live server environment like its siblings.',
+  },
+  {
+    after: 'scripts/gds/gen-api-client.js',
+    glob: '.gitattributes',
+    why: 'never require()d, so it is not code — but it NAMES which paths git hands the '
+       + 'otb-regen driver, so editing it changes how much of the tree that driver '
+       + 'rewrites during a merge. executed-closure.js carries it as TRUSTED_NON_CODE.',
+  },
+];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
 // a removal on purpose: a rename keeps the protection and moves it, a removal
@@ -172,6 +254,55 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
+// ---------- the drift tripwire: every EXECUTION ROOT is a protected surface ----------
+//
+// task 1003366, audit ref MIT1. The audit prescribed "the three gen-* scripts and
+// .gitattributes" — four surfaces. modules/lifecycle/executed-closure.js (task 1003367,
+// ref B1) names SEVEN execution roots plus .gitattributes, because GENERATOR_SCRIPTS grew
+// after the audit was written. Pasting the audit's four names in would therefore have
+// shipped a hand-curated list that was ALREADY stale on the day it landed, leaving
+// git-merge-regen.js — the earliest vector of the three — writable by any rank.
+//
+// So the registry is pinned to the closure's own ENTRYPOINTS, and this test is what makes
+// the pin real: add a generator to GENERATOR_SCRIPTS (executed_closure.mjs already asserts
+// those two lists are identical) and the build reds HERE until the registry grows to match.
+//
+// WHY THE ENTRYPOINTS AND NOT THE WHOLE 81-FILE CLOSURE — two controls, different jobs:
+//   - the closure's TRANSITIVE TAIL is enforced by conflict-resolve.js steps 5b/4b, which
+//     REFUSE to auto-resolve a branch touching any of the 81. That refusal is substrate:
+//     it does not depend on the builder cooperating, and it cannot drift, because it is
+//     computed rather than listed.
+//   - this registry is COOPERATIVE (pre-push hook, grader pre-pass, main-audit). Its job
+//     is the rank floor and the audit trail. The task says so: MIT1 is the interim
+//     mitigation, B1 is the close.
+// Listing all 81 here would add no enforcement the refusal does not already provide, while
+// floor-gating ordinary source at Metic — src/bongos/logger.js, src/branding.js and
+// src/build-info.js are all in the closure — and locking newcomers out of routine work.
+// The entrypoints are different in kind: they exist ONLY to be executed by the pipeline,
+// which is exactly what group 'pipeline' already means for ship.js and gate-review.js.
+test('every execution root in the closure is a protected surface (MIT1 drift tripwire)', () => {
+  const ec = require(path.join(ROOT, 'modules', 'lifecycle', 'executed-closure.js'));
+  // ENTRYPOINTS lists both script-tree spellings across the C-series rename window; only
+  // the ones that exist can be executed, so only those must be protected.
+  const roots = [
+    ...ec.ENTRYPOINTS.filter((rel) => fs.existsSync(path.join(ROOT, rel))),
+    ...ec.TRUSTED_NON_CODE,
+  ];
+  assert.ok(roots.length >= 8,
+    'fixture sanity: the closure must declare the execution roots this test checks');
+  for (const rel of roots) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} is an EXECUTION ROOT — the merge resolver runs it out of a cloned branch `
+      + 'with the live server environment — but no protected surface covers it. Add it to '
+      + 'modules/government/protected-surfaces.json (group "pipeline") and declare it in '
+      + 'ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} is an execution root floored at '${surface.floor}' — below Metic it stays `
+      + 'writable by the ranks ADR 0043 keeps out of the pipeline.');
+  }
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a