@bongos/core 1.19.703 → 1.19.705

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.703",
-  "core_contract": "1.19.703",
-  "source_commit": "f85beb07ce74ab0f248774c68e6d16453aa964c1",
+  "core_version": "1.19.705",
+  "core_contract": "1.19.705",
+  "source_commit": "ee446c148a7c0bc6e13028a538e32f2288b74802",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T03:53:32.093Z",
+  "built_at": "2026-09-13T05:14:27.400Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2132,
+    "functional_verbatim": 2134,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2633,
-  "tree_sha256": "4890a8f49b9e7da75dd0e91d122be5cc3c64802bca863b7eae48b237cab5e9b3",
+  "file_count": 2635,
+  "tree_sha256": "b975cdb11e18889435478808545314cf6b5f9d2a3f17411eb4cd63d3d294e047",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f777f91ad88b47ff271da5bbc1670507ed77fa105df07e3d15dca6912617baef"
+      "sha256": "64a2ef09f0be002b9c3af200c125b35b09775adb665a273b44e235a79b7265b9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3067,7 +3067,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "e5bcc0b4da0755546cb10870052099def2745c890cd8157d36d997e58a0399b3"
+      "sha256": "6760a34d404aa68c61896983c8aa621bd26244e5c98ed056045b3467359c4b53"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -3862,7 +3862,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "5cff70fc4e280c49d33dfb8f60ddb01181decd1645625b0bb5e7c2eb97335b81"
+      "sha256": "cd3659ad5831c767fe6600fabbe883f33b3429107a0b999092158dfa7c95b4e7"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -4642,7 +4642,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "6d9a7520b2565b34bf002df016598543101639ccc384d81a622d313ed688acbc"
+      "sha256": "2a6c392d4499498f0e0fb80c80002ba9d82a3f5e66e48cce9802c21c276af2a0"
     },
     {
       "path": "modules/government/ranks.js",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d63e44b7d4f919455708ad0fd9041ef90552639733c506b1fdc06fe2e2ccd12b"
+      "sha256": "b74ccfc9d9bcd1da47c4bdf0010e1516b48e5213cc435f10069bb30454b6e4fc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ff9eefa1e4c9f66ddd29b8a077ef567602ca79e69ab569b13f72e9221289b2ed"
+      "sha256": "59663e88e9591b8ef999f69c31757eac4275b7aa1376b9497ad6467223a21b3a"
     },
     {
       "path": "public-docs/index.html",
@@ -7862,7 +7862,7 @@
     {
       "path": "scripts/gds/agents-sync.js",
       "mode": "0000644",
-      "sha256": "2e1a55ae7187a8ee970873a108a7989fed121f1ac1f92361d7b9bc61987056a2"
+      "sha256": "7a639c73f8d2f4f523899ab737641174ca7b5ed5409427238d7fc397cdba65ed"
     },
     {
       "path": "scripts/gds/api.js",
@@ -8199,6 +8199,11 @@
       "mode": "0000644",
       "sha256": "2fcc3f97558ed6a653638df96d585dc7a1ef7dd884657a63d3a9545dbdb03e92"
     },
+    {
+      "path": "scripts/gds/exec-path-guard.js",
+      "mode": "0000644",
+      "sha256": "e568575a922de8c4538f11fa0e67ca0a97ab75317ff59b6aea27e6020a87313c"
+    },
     {
       "path": "scripts/gds/feedback-latest.js",
       "mode": "0000644",
@@ -8252,7 +8257,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "d6120a5427f9053529639cf15a59bad0afae9602d5a1e8301017f3321493038b"
+      "sha256": "418376cea128d2b1683e65017d74c453eb170e163bd131c1252ec79c6baf0920"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9557,7 +9562,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6cb88cea4e61987151e1872011b8667189ef59d03f3999be5950ba716ad9b05e"
+      "sha256": "d5b14e265925245fcd8ff4c280c68d0162a3bec6d58ee5358047e43708bdeaed"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9672,12 +9677,12 @@
     {
       "path": "tests/agents_sync.mjs",
       "mode": "0000644",
-      "sha256": "96197b8e25d9a8620cd3e02b7c96137d7118543662555c73d74e22a6b6161953"
+      "sha256": "f7f6d88fd31a2eb1a81678d883706d2716e6a2ae20159599d3dbe7ed4c267f2e"
     },
     {
       "path": "tests/agents_validate.mjs",
       "mode": "0000644",
-      "sha256": "c698b80ab8d64421b5c81e91172e1f219c41924af19721106f1899cd29c2fabc"
+      "sha256": "82c7bcef316f5c0068cb53a43b2ef4a01367ff285939f132f01b0d8633d36353"
     },
     {
       "path": "tests/api_cli_flags.mjs",
@@ -10574,6 +10579,11 @@
       "mode": "0000644",
       "sha256": "d6a78357533fdeea3bc33fe97cfcd27b1d04747c600d0a7800ddfca5199dbb1f"
     },
+    {
+      "path": "tests/exec_path_guard.mjs",
+      "mode": "0000644",
+      "sha256": "478075d19af9592d87ef9419c06496e72c132f4c045e19a1ebf821ab6ff7074b"
+    },
     {
       "path": "tests/executed_closure.mjs",
       "mode": "0000644",
@@ -10992,7 +11002,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "3517e05c1264fbdbeadc533884942926689952c8995548863ca1cfbfc365428e"
+      "sha256": "d11562d59861a5f5d294c072b3aa15f03703ddbb2102210ff92f7ccbcff5b5f6"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1865,5 +1865,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.701 with no explicit bump. run 34735775228. (task 1002620)
   1.19.703 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.702 with no explicit bump. run 34736566183. (task 1002620)
+  1.19.704 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.703 with no explicit bump. run 34738864605. (task 1002620)
+  1.19.705 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.704 with no explicit bump. run 34739785273. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -88,30 +88,57 @@ DB-backed tests with no local Postgres — the count drifts and is not worth rec
 **`node scripts/gds/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
 result means something locally.
 
-**That gate's Windows baseline as of task 1003529 (2026-09-12): 4 suites** — `sound_player`
-(task 1003628), `session_caps` (1003827), `skill_preflight` (1003754), `task_recommendations`
-(1003759) — **plus the 6 carried by task 1003848**: `cli_surface`, `module_api_lazy`,
-`search_index_poller`, `search_isolation`, `tool_scan_engine`, `security/mirror`. Everything else
-is green, and a red suite outside those ten is yours.
-
-`logger` is **not** on that list and needs no work: it was the whole of the old "missing deps in
-the worktree" family and task 1003616 fixed it on 2026-09-07 — see the walk-up section below.
-
-**Two of the ten are INTERMITTENT, so a green run does not mean fixed.** `session_caps` and
-`search_isolation` exit `3221226505` (`0xC0000409`, STATUS_STACK_BUFFER_OVERRUN) — the process
-dies during teardown *after* its assertions have all passed, so whether the suite counts them as
-failures depends on timing. Measured in task 1003529: `session_caps` passed inside a full
-`run-unit-tests.js` sweep and failed twice in a row when run on its own, minutes apart, with task
-1003827 still open and nothing on main having touched it. This is the `cliExit` class documented in
+**That gate's Windows baseline, re-measured for task 1003860 on 2026-09-12 in a deps-installed
+`origin/main` worktree (core 1.19.703): 9 suites** — `session_caps` (task 1003827),
+`skill_preflight` (1003754), `task_recommendations` (1003759) — **plus the 6 carried by task
+1003848**: `cli_surface`, `module_api_lazy`, `search_index_poller`, `search_isolation`,
+`tool_scan_engine`, `security/mirror`. Everything else is green, and a red suite outside those
+nine is yours.
+
+**`sound_player` LEFT this list on 2026-09-12** — task 1003628 fixed the real bug behind it (the
+sound-prefs case read the builder's own settings instead of a fixture), and it is now green in two
+full sweeps and two standalone runs. It is called out rather than quietly deleted because it was
+listed as expected-red for a matter of hours: the list was written the same day the fix shipped.
+`logger` is likewise **not** on the list and needs no work — it was the whole of the old "missing
+deps in the worktree" family and task 1003616 fixed it on 2026-09-07 (see the walk-up section
+below).
+
+**THREE suites are INTERMITTENT on a Windows box, so neither a green run nor a red one settles
+anything on its own.** Two of the three are on the baseline above; the third is NOT, and keeping
+that distinction straight is the whole point of this paragraph — "intermittent" is a property of a
+suite, not a licence to add it to the expected-red list.
+
+*Intermittent AND on the list:* `session_caps` and `search_isolation` exit `3221226505`
+(`0xC0000409`, STATUS_STACK_BUFFER_OVERRUN) — the process dies during teardown *after* its
+assertions have all passed, so whether the suite counts them as failures depends on timing. Both
+directions are now on record. Task 1003529: `session_caps` passed inside a full
+`run-unit-tests.js` sweep and failed twice in a row when run on its own, minutes apart. Task
+1003860, two sweeps minutes apart on one unchanged tree: `session_caps` was RED in the first and
+GREEN in the second, plus green twice standalone — so the same tree answers 9 failures or 8
+depending on nothing you did, and `search_isolation` was red in both. Task 1003827 is still open
+and nothing on main has touched either. This is the `cliExit` class documented in
 [scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md) — a hard exit while handles are still closing.
 Do not mark either fixed on the strength of one green sweep, and do not let their noise cover a
 real regression: diff by name AND re-run the individual suite.
 
+*Intermittent but NOT on the list:* `<redacted>` (task 1003860). It failed inside one
+full sweep on 2026-09-12 and has not reproduced since — green standalone 7-of-7 then, and green in
+both full sweeps and three more standalone runs when the baseline was re-measured. It binds an
+ephemeral socket (`app.listen(0)`) and calls `server.close()` without awaiting it, so it is the
+same teardown-timing class as the two above. Know the name, so a red here does not send you
+hunting your own diff — but it stays OFF the expected-red list, because it is green on
+`origin/main`. **A suite that reds once and then will not reproduce is not a baseline entry.**
+Promoting a one-off red to a known name buys nothing and gives a genuine regression somewhere to
+hide; `git_merge_regen` below is the case that cost a whole session. Re-run this one alone before
+you touch anything.
+
 Two warnings about that list, both paid for:
 
 - **It drifts in BOTH directions.** The measurement before it (2026-08-27, 25 suites) had 7
   entries already fixed and was missing 6 that had since broken — so more than half of it was
-  wrong within a fortnight. Re-measure; never inherit a list.
+  wrong within a fortnight. And the one after THAT went stale in hours rather than weeks:
+  `sound_player` was fixed by task 1003628 the same day it was written down as expected-red
+  (task 1003860). Re-measure; never inherit a list.
 - **Compare NAMES, never counts**, and never bank a local red as "environmental" without a
   by-name baseline run in a deps-installed `origin/main` worktree. A count that matches can hide
   one suite fixed and another broken.

package/modules/agents/lib/validate.js

@@ -143,6 +143,11 @@ function validateAgentDefinition(obj, opts = {}) {
   const rawProtected = safeGet(options, 'protectedModules');
   const allowedModules = Array.isArray(rawAllowed) ? rawAllowed : [];
   const protectedModules = Array.isArray(rawProtected) ? rawProtected : [];
+  // (path) => boolean — "does this repo-relative path reach a protected
+  // surface?". Supplied by the caller from the protected-surface registry
+  // (task 1002492); see the scope_paths wall below for why it is passed in and
+  // why its absence refuses rather than admits.
+  const isProtectedPath = safeGet(options, 'isProtectedPath');
 
   // --- name ----------------------------------------------------------------
   const name = safeGet(obj, 'name');
@@ -276,6 +281,57 @@ function validateAgentDefinition(obj, opts = {}) {
     }
   }
 
+  // --- scope: THE OTHER HALF OF THE SAME WALL (task 1002492) -----------------
+  //
+  // Until now the rank wall ran over `scope_modules` only, and `scope_paths` was
+  // checked for tree-escape and nothing else. So one wall had two halves that
+  // disagreed: `scope_modules: ['government']` was refused below Metic, while
+  // `scope_paths: ['modules/government/']` reached the same code and passed at
+  // any rank. A definition could scope itself onto the authority surface by
+  // spelling it as a path — which is the one thing this check exists to stop.
+  //
+  // The matcher is PASSED IN rather than required, for the same reason
+  // `protectedModules` is: this module may not require core (ADR 0083), and the
+  // protected-surface registry must stay readable with no DB and no server so
+  // the out-of-band enforcers keep working (ADR 0043). The caller owns both.
+  if (scopePaths && scopePaths.length > 0) {
+    if (typeof isProtectedPath !== 'function') {
+      // FAIL-CLOSED, and deliberately not a default of "nothing is protected":
+      // scope_paths has no allowlist counterpart the way scope_modules has
+      // `allowedModules`, so an absent matcher would be a silent hole rather
+      // than a narrow scope. Declaring paths REQUIRES the caller to supply the
+      // means to check them.
+      E('scope_paths_uncheckable', 'scope_paths',
+        'scope_paths: declared, but no protected-path matcher was supplied, so they cannot be checked against the protected-surface registry. Refused rather than admitted — a path scope that nothing verified is indistinguishable from one nobody walled.');
+    } else {
+      const hits = [];
+      for (const p of scopePaths) {
+        let protectedPath;
+        try {
+          // ONLY an explicit `false` clears a path. Not `=== true`: that reads
+          // every ambiguous answer — undefined from a matcher that forgot a
+          // return, a truthy string, null — as "not protected", which is
+          // fail-OPEN on the exact question the wall exists to ask. Reading
+          // ambiguity as protected is loud and gets fixed; reading it as clean
+          // is silent and does not.
+          protectedPath = isProtectedPath(p) !== false;
+        } catch {
+          // A throwing matcher is treated as a HIT for the same reason: the
+          // question going unanswered must not read as no.
+          protectedPath = true;
+        }
+        if (protectedPath) hits.push(p);
+      }
+      if (hits.length > 0) {
+        const rankIdx = typeof authorRank === 'string' ? RANK_ORDER.indexOf(authorRank) : -1;
+        if (rankIdx < RANK_ORDER.indexOf(SCOPE_RANK_FLOOR)) {
+          E('scope_protected_rank', 'scope_paths',
+            `scope_paths: ${hits.map((p) => JSON.stringify(p)).join(', ')} ${hits.length === 1 ? 'reaches a protected surface' : 'reach protected surfaces'} and require a ${SCOPE_RANK_FLOOR}+ author; the author's resolved rank is ${JSON.stringify(authorRank ?? null)} (ADR 0016 / ADR 0043). A path scope is walled exactly as a module scope is — spelling the surface as a path is not a way around it.`);
+        }
+      }
+    }
+  }
+
   if (errors.length > 0) return { ok: false, errors, value: null };
 
   // The normalized row, built fresh — the caller's object is never mutated, and

package/modules/government/protected-surfaces.json

@@ -55,6 +55,14 @@
     { "glob": "scripts/gds/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },
     { "glob": "scripts/gds/hooks/", "group": "pipeline", "why": "the git hooks themselves (self-protect)" },
     { "glob": "scripts/gds/cli-lib.js", "group": "pipeline", "why": "session/token + apiCall the gate relies on" },
+    { "glob": "scripts/gds/git-merge-regen.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: registerMergeDriver writes 'node scripts/gds/git-merge-regen.js' as a RELATIVE command with cwd at the clone root, so git merge runs the BRANCH's copy, with the live server's DATABASE_URL and BUILDER_SECRET_KEY, before any post-merge step. This and the six generators below are the ENTRYPOINTS in modules/lifecycle/executed-closure.js; tests/government_protected_surfaces.mjs fails the build if that list ever grows past this registry." },
+    { "glob": "scripts/gds/gen-repo-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: run by the merge resolver as execFile(node, [<clone>/...]) after the merge — the branch's copy, the server's environment." },
+    { "glob": "scripts/gds/gen-file-map.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/gds/gen-session-index.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: the same post-merge generator path as gen-repo-map.js." },
+    { "glob": "scripts/gds/copy-inventory.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone. NOT named by the 2026-08-29 audit, which said 'the gen-* trio' — that trio was already stale against GENERATOR_SCRIPTS, which is why this registry is pinned to the closure's ENTRYPOINTS rather than to the audit's prose." },
+    { "glob": "scripts/gds/gen-api-docs.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone, and the widest one — it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers." },
+    { "glob": "scripts/gds/gen-api-client.js", "group": "pipeline", "why": "task 1003366, audit ref MIT1. EXECUTION ROOT: a generator the resolver runs out of the clone." },
+    { "glob": ".gitattributes", "group": "pipeline", "why": "task 1003366, audit ref MIT1. Not code and never require()d, but it NAMES which paths git hands the otb-regen driver — so editing it changes how much of the tree that driver rewrites during a merge. modules/lifecycle/executed-closure.js carries it as TRUSTED_NON_CODE for exactly this reason (ADR 0043)." },
     { "glob": "scripts/migrate.sh", "group": "pipeline", "why": "applies migrations on deploy" },
     { "glob": "scripts/deploy/", "group": "pipeline", "why": "the deploy scripts run on the droplet at deploy (ADR 0058)" },
     { "glob": "modules/lifecycle/merge-lock.js", "group": "pipeline", "why": "BV1.R86: serializes a ship" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.703",
+  "version": "1.19.705",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.703",
+      "version": "1.19.705",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.703",
+  "version": "1.19.705",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agents-sync.js

@@ -64,14 +64,35 @@ const validate = require(path.join(REPO_ROOT, 'modules/agents/lib/validate.js'))
 // not a definition". The distinction is the whole of rule 3: a scope refusal is
 // imported as a flagged row so somebody can SEE it, while a shape error has no
 // row to import — there is no definition there to put in the registry.
-const SCOPE_CODES = Object.freeze(['scope_protected_rank', 'scope_out_of_bounds']);
-
-// Does this definition reach a PROTECTED module? If so, the git-derived author
-// identity is not consulted at all (see below) — which is what makes rule 2 hold
-// against a value the author controls.
-function declaresProtectedScope(candidate, protectedModules = []) {
-  const declared = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
-  return declared.some((m) => protectedModules.includes(m));
+const SCOPE_CODES = Object.freeze([
+  'scope_protected_rank',
+  'scope_out_of_bounds',
+  // task 1002492. The definition is well-formed; what failed is that its paths
+  // could not be checked. That is importable-but-flagged (visible, disabled),
+  // never a silent skip — "nobody checked" must surface as loudly as "refused".
+  'scope_paths_uncheckable',
+]);
+
+// Does this definition reach a PROTECTED surface — by module OR by path? If so,
+// the git-derived author identity is not consulted at all (see below), which is
+// what makes rule 2 hold against a value the author controls.
+//
+// The path half arrived with task 1002492. Before it, this asked about modules
+// only, which left the withholding rule with the same asymmetry the scope wall
+// itself had: naming `modules/government/` as a PATH reached neither check, so a
+// spoofed identity could still have stamped a rank onto a definition pointed at
+// the authority surface. Both halves, or neither is a wall.
+function declaresProtectedScope(candidate, protectedModules = [], isProtectedPath = null) {
+  const modules = Array.isArray(candidate?.scope_modules) ? candidate.scope_modules : [];
+  if (modules.some((m) => protectedModules.includes(m))) return true;
+  const paths = Array.isArray(candidate?.scope_paths) ? candidate.scope_paths : [];
+  if (paths.length === 0) return false;
+  // No matcher and declared paths: unanswerable, so treated as protected — the
+  // same fail-closed reading the validator applies (scope_paths_uncheckable).
+  if (typeof isProtectedPath !== 'function') return true;
+  return paths.some((p) => {
+    try { return isProtectedPath(p) !== false; } catch { return true; }
+  });
 }
 
 // THE RANK THAT ACTUALLY GETS STAMPED, and the answer to the spoofable-identity
@@ -95,8 +116,8 @@ function declaresProtectedScope(candidate, protectedModules = []) {
 //
 // The result is that spoofing the git identity buys exactly nothing: on the only
 // path where rank matters, no git-derived value is read.
-function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [] } = {}) {
-  if (declaresProtectedScope(candidate, protectedModules)) return null;
+function stampableAuthorRank(candidate, { gitRank = null, protectedModules = [], isProtectedPath = null } = {}) {
+  if (declaresProtectedScope(candidate, protectedModules, isProtectedPath)) return null;
   return gitRank;
 }
 
@@ -203,6 +224,7 @@ function planOne(candidate, {
   authorRank: gitRank = null,
   allowedModules = [],
   protectedModules = [],
+  isProtectedPath = null,
   existing = null,
 } = {}) {
   const name = typeof candidate?.name === 'string' ? candidate.name : null;
@@ -210,7 +232,7 @@ function planOne(candidate, {
   // survives stampableAuthorRank, which withholds it entirely on any definition
   // that reaches a protected module. Everything below uses `authorRank`, so the
   // spoofable value cannot reach the wall by a path that forgets to launder it.
-  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules });
+  const authorRank = stampableAuthorRank(candidate, { gitRank, protectedModules, isProtectedPath });
 
   // Rule 1, checked before anything else: an instance-authored row owns its
   // name. A file that happens to share it does not get to overwrite it, and
@@ -220,7 +242,7 @@ function planOne(candidate, {
   }
 
   const verdict = validate.validateAgentDefinition(candidate, {
-    authorRank, allowedModules, protectedModules,
+    authorRank, allowedModules, protectedModules, isProtectedPath,
   });
 
   if (verdict.ok) {
@@ -256,6 +278,11 @@ function planOne(candidate, {
     authorRank: validate.RANK_ORDER[validate.RANK_ORDER.length - 1],
     allowedModules: [...new Set([...allowedModules, ...declaredModules])],
     protectedModules: [],
+    // The re-run clears the MODULE wall to recover the normalized shape. The
+    // path matcher is deliberately left in place: a matcher that says a path is
+    // protected is a fact about the path, not about the author, so laundering
+    // it here would store a row whose scope no longer matches its flag.
+    isProtectedPath: () => false,
   });
   if (!shapeOnly.ok) {
     // Defensive: the two runs disagreeing means an error that is scope-coded but
@@ -275,13 +302,14 @@ function planOne(candidate, {
 // The whole plan, for a list of { name, candidate } and a lookup of existing
 // rows by name. Pure, so the reconcile's DECISIONS are unit-testable with no
 // database standing up.
-function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [] } = {}) {
+function planSync(files, { existingByName = new Map(), authorRankFor = () => null, allowedModules = [], protectedModules = [], isProtectedPath = null } = {}) {
   return files.map((f) => ({
     file: f.file || null,
     ...planOne(f.candidate, {
       authorRank: authorRankFor(f.file),
       allowedModules,
       protectedModules,
+      isProtectedPath,
       existing: existingByName.get(f.candidate?.name) || null,
     }),
   }));
@@ -370,6 +398,12 @@ async function main() {
   const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
   const allowedModules = scopeMap.moduleKeys();
   const protectedModules = scopeMap.protectedModules();
+  // The protected-surface registry, read the way every other enforcer reads it:
+  // synchronously from the checkout, no DB and no server (ADR 0043). surfaceFor
+  // returns the governing registry entry or null, so this is the boolean the
+  // validator's scope_paths wall asks for.
+  const permissionPaths = require(path.join(REPO_ROOT, 'src/bongos/permission-path-check.js'));
+  const isProtectedPath = (p) => permissionPaths.surfaceFor(p) !== null;
 
   const { rows: existingRows } = await pool.query(
     'SELECT name, source, enabled FROM agents_definitions'
@@ -397,7 +431,7 @@ async function main() {
     return login ? (rankByLogin.get(login.toLowerCase()) || null) : null;
   };
 
-  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules });
+  const plan = planSync(files, { existingByName, authorRankFor, allowedModules, protectedModules, isProtectedPath });
 
   if (dryRun) {
     if (asJson) console.log(JSON.stringify({ ok: true, scanned: files.length, plan }, null, 2));