@bongos/core 1.19.705 → 1.19.706

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.705",
-  "core_contract": "1.19.705",
-  "source_commit": "ee446c148a7c0bc6e13028a538e32f2288b74802",
+  "core_version": "1.19.706",
+  "core_contract": "1.19.706",
+  "source_commit": "64c9df530070e324d8e24759cabe9f99b5f72e84",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T05:14:27.400Z",
+  "built_at": "2026-09-13T05:25:47.946Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2134,
+    "functional_verbatim": 2135,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2635,
-  "tree_sha256": "b975cdb11e18889435478808545314cf6b5f9d2a3f17411eb4cd63d3d294e047",
+  "file_count": 2636,
+  "tree_sha256": "153b7b8ec9f73145d3a44c31dd75daa089b2c94be32c2b91ad61e59270e89c69",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "64a2ef09f0be002b9c3af200c125b35b09775adb665a273b44e235a79b7265b9"
+      "sha256": "68adee401731b2252b8f8e5c32d1164da7abb13261d0bc9aa1e8b83ead4a2a99"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b74ccfc9d9bcd1da47c4bdf0010e1516b48e5213cc435f10069bb30454b6e4fc"
+      "sha256": "c22b832366994675cd2cb205017f9d775c35f89cafd4ecbf2ff4a13f5e8e218c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "59663e88e9591b8ef999f69c31757eac4275b7aa1376b9497ad6467223a21b3a"
+      "sha256": "e85ec6c7db1b0f2ba643ff4178049b28c57c43ba417feff7c54a4184a6da111f"
     },
     {
       "path": "public-docs/index.html",
@@ -9057,7 +9057,7 @@
     {
       "path": "scripts/gds/smoke-write.sh",
       "mode": "0000644",
-      "sha256": "cfa2f05cd72aad3975a683e334e32341c4cc10e34802091e693fe26f2e49781f"
+      "sha256": "beb3dd4f828a8fe6e3a800ce6481b373af00b10dad5b11f7cc9dbaaf6aa2dc1a"
     },
     {
       "path": "scripts/gds/spark.js",
@@ -9562,7 +9562,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d5b14e265925245fcd8ff4c280c68d0162a3bec6d58ee5358047e43708bdeaed"
+      "sha256": "ea041db8186de51e61bdb52281d9d8a57627b10514f94a39e4120d9888c05aa5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12789,6 +12789,11 @@
       "mode": "0000644",
       "sha256": "f9b1a7021c96c02a5eb667b2d10003b4c7e256fcaafbbc228b2585c710f1d162"
     },
+    {
+      "path": "tests/smoke_write_contract.mjs",
+      "mode": "0000644",
+      "sha256": "d4938674f77288a6efd6cb0d03dc0d4faf76716be4c6e71fc16712022ca08dec"
+    },
     {
       "path": "tests/social_mode.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1869,5 +1869,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.703 with no explicit bump. run 34738864605. (task 1002620)
   1.19.705 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.704 with no explicit bump. run 34739785273. (task 1002620)
+  1.19.706 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.705 with no explicit bump. run 34740247460. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.705",
+  "version": "1.19.706",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.705",
+      "version": "1.19.706",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.705",
+  "version": "1.19.706",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/smoke-write.sh

@@ -11,6 +11,9 @@
 #                session_logs row exists for this claim
 #                public/recent-shipped does NOT contain the smoke title
 #                public/progress weighting unchanged (smoke tasks filtered)
+#   6. On PASS, abandon the throwaway task so the ledger does not refill with
+#      test noise (task 1002018). A FAILED run deliberately KEEPS its task and
+#      claim so the failure can be read from the ledger afterwards.
 #
 # The synthetic task has credits_reward=0 so no credit_log row is written
 # and the leaderboard is unaffected. The credit-award path is implicitly
@@ -68,6 +71,51 @@ VERSION_ID=$(node "$(dirname "$0")/version-select.js") || {
 }
 echo "Version: ${VERSION_ID}"
 
+# Caused by task 1003598 (BV1.R11, ADR 0250 D4), found and fixed under task
+# 1002018: goal_id became REQUIRED on POST /tasks and this script still sent none, so step 1 died on a 400 goal_id_required
+# and the whole smoke could not run. Resolved at RUNTIME, not hardcoded, for the
+# same reason version-select.js exists (task 1003166): an id literal goes stale
+# the moment the version rolls, and the failure then looks like a broken API
+# rather than a stale constant. Every version auto-creates exactly ONE
+# is_maintenance goal (BV1.R18), and a synthetic row is maintenance-goal work.
+#
+# node, not python3, on purpose: this script already shells out to node for
+# version-select.js, and node is the interpreter a Windows builder box actually
+# has — the python3 the rest of this file depends on is frequently absent there
+# (it is the Microsoft Store stub), so a python3 step cannot be verified locally.
+GOAL_ID=$(call GET "/api/gds/goals?version=${VERSION_ID}" | node -e '
+let s = "";
+process.stdin.on("data", (d) => { s += d; });
+process.stdin.on("end", () => {
+  const goals = JSON.parse(s).goals || [];
+  const m = goals.filter((g) => g.is_maintenance && g.status === "open");
+  if (m.length !== 1) {
+    process.stderr.write("expected exactly 1 open maintenance goal, found " + m.length + "\n");
+    process.exit(1);
+  }
+  // The caller splices this straight into a python3 -c SOURCE string, unquoted,
+  // so a non-numeric id would be executed as Python rather than read as data.
+  // Validating the COUNT is not validating the ID: check its shape too.
+  const id = String(m[0].id);
+  if (!/^[0-9]+$/.test(id)) {
+    process.stderr.write("goal id is not numeric: " + JSON.stringify(id) + "\n");
+    process.exit(1);
+  }
+  process.stdout.write(id);
+});
+') || {
+  echo "FAIL: could not resolve the maintenance goal for ${VERSION_ID}" >&2
+  exit 1
+}
+# Belt-and-braces at the point of use: the resolver above already refuses a
+# non-numeric id, but this value is interpolated into python3 source below as
+# CODE, not as a quoted literal, so it is re-checked where the risk actually is.
+[[ "${GOAL_ID}" =~ ^[0-9]+$ ]] || {
+  echo "FAIL: resolved goal id is not numeric: ${GOAL_ID}" >&2
+  exit 1
+}
+echo "Goal: ${GOAL_ID}"
+
 echo "--- 0. snapshot progress before ---"
 PROGRESS_BEFORE=$(snapshot_progress)
 echo "${PROGRESS_BEFORE}"
@@ -78,6 +126,7 @@ CREATE_BODY=$(python3 -c "
 import json
 print(json.dumps({
   'version_id': '${VERSION_ID}',
+  'goal_id': ${GOAL_ID},
   'title': '${SMOKE_TITLE}',
   'description': 'Synthetic smoke task. Auto-shipped by smoke-write.sh.',
   'status': 'ready',
@@ -177,6 +226,45 @@ else
   echo "SKIP session_logs DB check (set GDS_SMOKE_DB_SSH + GDS_SMOKE_DB_NAME to enable)"
 fi
 
+echo
+echo "--- 5. clean up the throwaway task ---"
+# task 1002018 — this smoke CREATES a real task to exercise the create API, and
+# used to leave it in the ledger forever: 94 rows accumulated under PMS-V1 before
+# the task-2016 sweep cleared them by hand. Abandon is the right terminal state —
+# a smoke row is not shipped work, and the route refuses to abandon a shipped one
+# anyway (cannot_abandon_shipped). The row sits at 'completed' after step 3, and
+# only 'shipped' and an unreleased claim are refused, so this is always legal here.
+#
+# ONLY on success, deliberately: a FAILED run leaves its task and claim in place
+# so the failure can be inspected in the ledger, which is why the FAIL branch of
+# the summary below still prints both ids.
+#
+# Strictly best-effort. A cleanup that cannot run must never turn a passing smoke
+# into a failing one, so this never touches ${fail} and never trips set -e:
+# task.abandon is floor-metic (ADR 0152), so a Xenos/Thetes token gets a 403 here
+# while every assertion above genuinely passed.
+cleanup_throwaway_task() {
+  local out code
+  local reason='{"reason":"smoke cleanup (task 1002018) - write-path smoke passed; the throwaway row has served its purpose"}'
+  out=$(curl -sS -X POST \
+    -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" \
+    -d "${reason}" -w "\n%{http_code}" \
+    "${API}/api/gds/tasks/${TASK_ID}/abandon") || true
+  code="${out##*$'\n'}"
+  case "${code}" in
+    2*)  echo "PASS cleaned up throwaway task #${TASK_ID} (abandoned)" ;;
+    403) echo "SKIP cleanup — task.abandon needs Metic+ (ADR 0152); task #${TASK_ID} left in the ledger" ;;
+    000) echo "SKIP cleanup — POST /tasks/${TASK_ID}/abandon got no response; task #${TASK_ID} left in the ledger" ;;
+    *)   echo "SKIP cleanup — POST /tasks/${TASK_ID}/abandon returned HTTP ${code:-none}; task #${TASK_ID} left in the ledger" ;;
+  esac
+}
+
+if [[ "${fail}" -eq 0 ]]; then
+  cleanup_throwaway_task
+else
+  echo "SKIP cleanup — run FAILED; task #${TASK_ID} and claim #${CLAIM_ID} kept for post-mortem"
+fi
+
 echo
 echo "--- summary ---"
 if [[ "${fail}" -eq 0 ]]; then

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.705'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.706'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/smoke_write_contract.mjs

@@ -0,0 +1,110 @@
+// tests/smoke_write_contract.mjs — the write-path smoke's own contract
+// (task 1002018).
+//
+// TWO DEFECTS, ONE FILE. Both were found by trying to RUN scripts/gds/smoke-write.sh
+// rather than by reading it, and neither was visible to any existing test:
+//
+// 1. IT COULD NOT RUN AT ALL. goal_id became required on POST /tasks (task 1003598,
+//    ADR 0250 D4) and this script still sent none, so step 1 died on a 400
+//    goal_id_required. The production write-path smoke had been dead since that
+//    landed, and nothing said so — the same silent-rot shape as the PMS-V1 version
+//    literal that tests/version_literals.mjs exists to prevent, one field over.
+//
+// 2. IT LEAKED ITS THROWAWAY TASK. The smoke creates a REAL task to exercise the
+//    create API and never disposed of it: 94 rows accumulated under PMS-V1 before
+//    the task-2016 sweep cleared them by hand.
+//
+// WHY ASSERT ON SOURCE TEXT. This script talks to a live API, needs a session
+// token and (for the rest of the file) python3, so it cannot be executed in the
+// DB-free unit gate. Source assertions are what CAN run here. They are written
+// narrowly — each one names a specific defect that actually happened, and the
+// resolution assertions deliberately REJECT a hardcoded id rather than merely
+// requiring the field to be present, because "send goal_id" is satisfied just as
+// well by a literal that goes stale the moment the version rolls. That is the
+// over-broad-source-assertion trap this repo keeps relearning (learning 1000196):
+// the cure is specificity, not a bigger regex.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SH = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'smoke-write.sh'), 'utf8');
+
+// ---- defect 1: the create must carry a goal_id, resolved not hardcoded -----
+
+test('the create body sends goal_id at all (the 400 that killed the smoke)', () => {
+  assert.match(SH, /'goal_id':/, 'POST /tasks has required goal_id since task 1003598');
+});
+
+test('goal_id is the RESOLVED id, never a literal', () => {
+  assert.match(SH, /'goal_id': \$\{GOAL_ID\}/, 'the create interpolates the resolved id');
+  assert.ok(
+    !/'goal_id': *[0-9]/.test(SH),
+    'a numeric goal id in the body would go stale the moment the version rolls'
+  );
+});
+
+test('GOAL_ID is resolved at runtime, from the is_maintenance flag', () => {
+  assert.match(SH, /GOAL_ID=\$\(call GET "\/api\/gds\/goals\?version=\$\{VERSION_ID\}"/,
+    'it asks the API for this version-s goals');
+  assert.match(SH, /is_maintenance/, 'and picks the maintenance goal by its flag');
+  // Exactly one open maintenance goal exists per version (BV1.R18). Ambiguity here
+  // means the instance is misconfigured, and guessing would file the smoke row into
+  // a real working area — so the resolution must refuse rather than pick.
+  assert.match(SH, /m\.length !== 1/, 'it refuses on anything but exactly one match');
+});
+
+// ---- defect 2: the throwaway task is disposed of ---------------------------
+
+test('a passing run abandons its throwaway task', () => {
+  assert.match(SH, /cleanup_throwaway_task\(\) \{/, 'the cleanup exists');
+  assert.match(SH, /tasks\/\$\{TASK_ID\}\/abandon/, 'and it abandons the row it created');
+});
+
+test('cleanup runs ONLY on success — a failed run keeps its evidence', () => {
+  const guard = SH.slice(SH.indexOf('--- 5. clean up'));
+  assert.match(guard, /if \[\[ "\$\{fail\}" -eq 0 \]\]; then\s*\n\s*cleanup_throwaway_task/,
+    'the call is gated on fail==0');
+  assert.match(guard, /kept for post-mortem/,
+    'and a failing run says why the row is still there');
+});
+
+test('cleanup is best-effort: it can never fail a passing smoke', () => {
+  const fn = SH.slice(SH.indexOf('cleanup_throwaway_task() {'), SH.indexOf('--- summary ---'));
+  // The three ways this could turn a PASS into a FAIL, each closed:
+  assert.match(fn, /\|\| true/, 'the curl cannot trip set -e');
+  assert.ok(!/fail=1/.test(fn), 'and it never touches the fail counter');
+  // task.abandon is floor-metic (ADR 0152), so a Xenos/Thetes token gets a 403
+  // here while every assertion above genuinely passed. That must read as SKIP.
+  assert.match(fn, /403\)/, 'a rank refusal is reported as SKIP, not as a failure');
+  assert.match(fn, /000\)/, 'so is no response at all');
+});
+
+// ---- the id is spliced as CODE, so its SHAPE is a security property ---------
+//
+// Raised by the grader's hacker worker on the first round of this task, and it
+// was right: `'goal_id': ${GOAL_ID},` lands inside a `python3 -c "..."` SOURCE
+// string, unquoted. The resolver validated the goal COUNT and never the id's own
+// shape, so a non-numeric id from /goals — schema drift, a misbehaving API, any
+// future path where an id-like field is influenced — would have been executed as
+// Python rather than read as data. Validating the count is not validating the id.
+
+test('the resolver refuses a non-numeric goal id', () => {
+  const ext = SH.slice(SH.indexOf('GOAL_ID=$(call GET'), SH.indexOf("') || {"));
+  assert.match(ext, /\/\^\[0-9\]\+\$\//, 'the extracted id is shape-checked');
+  assert.match(ext, /is not numeric/, 'and says so when it refuses');
+  // The check must come BEFORE the value is emitted, or it guards nothing.
+  assert.ok(
+    ext.indexOf('is not numeric') < ext.lastIndexOf('process.stdout.write'),
+    'the refusal precedes the write'
+  );
+});
+
+test('and the interpolation site re-checks it', () => {
+  // Belt-and-braces where the risk actually is: between resolution and the
+  // python3 heredoc the value passes through shell, so it is re-validated there.
+  assert.match(SH, /\[\[ "\$\{GOAL_ID\}" =~ \^\[0-9\]\+\$ \]\]/,
+    'bash re-checks the id before the create body interpolates it');
+});