@bongos/core 1.19.712 → 1.19.714

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.712",
-  "core_contract": "1.19.712",
-  "source_commit": "e848d50ff42905384b1e3df672f2dfd3f6cebb23",
+  "core_version": "1.19.714",
+  "core_contract": "1.19.714",
+  "source_commit": "a5a66a5abc084908ffbcb70583aa9effa9bc86d7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T07:31:19.809Z",
+  "built_at": "2026-09-13T07:48:24.895Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 478,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2649,
-  "tree_sha256": "19c186cbca6bdf1dd7a73d69676cf9f52d37a5bd1dc25ed9eae3a46bdec158d2",
+  "tree_sha256": "51e98dc1aa5041914570019a3903f1b1c0cce050fff1b530c41da04241a719a7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "90cfe161bdbb28b563fe34f367c2e5700149f07e2cec5f783f5db8bb9ea4b3db"
+      "sha256": "3484277ad5363b99cffe978b168fcdadd40051cb9fc45c51a2aab58dd43fe601"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4547,7 +4547,7 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "8edccad7dc69a95503d9e0d1de7795fd6082c8122e0695d1f018f49b37051fed"
+      "sha256": "0110e6a9421696632fa749291547045c60ace60255d55f35a88accd61dcf5c80"
     },
     {
       "path": "modules/government/db.js",
@@ -7817,12 +7817,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0cdb4130832c4680860dc1687b17e496d4e3a6ff963898690d8b7301c4040835"
+      "sha256": "732fe7dc9bc6b9c48aabb5fb6dcf35aa9a71f50fcf16d6548e183a1092c40853"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3c89b0fe35a5787a494119123aa0ba2a6e55f2428dfd912a208762e21743b71d"
+      "sha256": "6543f1d328faab7d974585c1ad7f0f1b79ba653563bf5d75b7948f01501ce322"
     },
     {
       "path": "public-docs/index.html",
@@ -9602,7 +9602,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aa71f9f73709ca7b062e9bb5994bfb2fa7d586aa3cca4e89daa74a3204a0db15"
+      "sha256": "e836253fa5b1c1b117c308430b19b2129a19904b21371ad2c033f0613951d0c2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11107,7 +11107,7 @@
     {
       "path": "tests/government_vanilla_boot.mjs",
       "mode": "0000644",
-      "sha256": "da3ebb855209f5de20b7d9ec45a9b09a068e251bc644e3090818e5a3f063b356"
+      "sha256": "5c2676855575784f9fffcf909dd6179e4b588e49cb5c80b5395d6803bf89386d"
     },
     {
       "path": "tests/government_vocabulary.mjs",

package/docs/module-api-changelog.md

@@ -1883,5 +1883,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.710 with no explicit bump. run 34744940181. (task 1002620)
   1.19.712 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.711 with no explicit bump. run 34745412403. (task 1002620)
+  1.19.713 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.712 with no explicit bump. run 34745667268. (task 1002620)
+  1.19.714 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.713 with no explicit bump. run 34746102135. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/config.js

@@ -33,8 +33,13 @@
 //      Their grants are DERIVED from catalog floors and materialised by
 //      governance_002; config may relabel a seeded rank, never re-grant it.
 //
-// Stripping rather than throwing matches resolver.js: a typo in a config file must
-// fail CLOSED, not brick the boot.
+// Stripping rather than throwing matches resolver.js: a template entry that asks for
+// authority it may not have is DROPPED, so a wrong entry fails CLOSED rather than
+// bricking the boot.
+//
+// SCOPE OF THAT RULE — it is about a pack that PARSES and asks for the wrong thing.
+// A pack that does not parse at all is the other case, and the disk loader below
+// throws on it deliberately. See the loadGovernmentConfig header.
 //
 // SLICE BOUNDARY: this file is the config CONTRACT, and deliberately has no production
 // caller yet — R96 is the "what shape is a rank template, and what can config never
@@ -321,11 +326,22 @@ function readJson(p) {
   catch (e) { if (e.code === 'ENOENT') return null; throw e; }
 }
 
-// Disk loader with the documented precedence. BOTH files are optional: the instance
-// pack because a vanilla instance ships only the neutral starter, and the neutral
-// starter because the four ranks still resolve to their canonical names without
+// Disk loader with the documented precedence. BOTH files are optional when ABSENT: the
+// instance pack because a vanilla instance ships only the neutral starter, and the
+// neutral starter because the four ranks still resolve to their canonical names without
 // it. Unlike branding — where a missing identity is fatal — no value here is required,
-// so the loader fails to sane defaults rather than throwing.
+// so an absent pack falls through to sane defaults.
+//
+// ABSENT and MALFORMED are NOT the same case, and this loader treats them differently
+// on purpose. readJson() swallows only ENOENT; a pack that is present but does not
+// parse raises a SyntaxError that propagates out of here and stops boot. A corrupt
+// authority-adjacent file must be fixed by a human, not silently replaced by defaults
+// nobody chose — the loud stop IS the fail-closed behaviour, since a boot that never
+// completes grants nothing. Both halves are pinned as source: the absent half by
+// tests/government_config.mjs ('tolerates a missing instance pack') and
+// tests/government_vanilla_boot.mjs's no-packs-at-all case, the malformed half by
+// that file's 'a malformed config pack fails LOUD'. Changing the throw into a
+// fallback is therefore a deliberate decision plus a test edit, not a tidy-up.
 //
 // CALL THIS AT BOOT, NOT PER REQUEST. The two reads are synchronous, which is correct
 // for a startup read of a committed file and wrong inside a request handler. If a

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.712",
+  "version": "1.19.714",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.712",
+      "version": "1.19.714",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.712",
+  "version": "1.19.714",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.712'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.714'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_vanilla_boot.mjs

@@ -94,13 +94,16 @@ test('a core with NO config packs at all still boots four roles rather than none
 });
 
 test('a malformed config pack fails LOUD — it never degrades into a silent grant', () => {
-  // Documents the loader's real behaviour: readJson() returns null only for ENOENT,
-  // so a syntactically broken pack throws. That is fail-CLOSED (no authority is
-  // produced), which is the property this proof cares about — but it does contradict
-  // the loader's own header note ("the loader fails to sane defaults rather than
-  // throwing"). Reported as a doc/behaviour mismatch in the R102 handoff, not fixed
-  // here: turning a corrupt authority-adjacent file into a silent fallback is a
-  // decision, not a typo.
+  // Pins the loader's real behaviour: readJson() returns null only for ENOENT, so a
+  // syntactically broken pack throws. That is fail-CLOSED (no authority is produced),
+  // which is the property this proof cares about.
+  //
+  // This assertion used to contradict the loader's own header note, which promised
+  // "the loader fails to sane defaults rather than throwing" for the malformed case
+  // too. The PROSE was the bug, not the throw: config.js now states the absent and
+  // malformed cases separately and names this test as the oracle for the second
+  // (task 1002876). Turning a corrupt authority-adjacent file into a silent fallback
+  // remains a decision, not a typo — it would have to change this assertion first.
   withScratchDir((dir) => {
     const broken = path.join(dir, 'broken.json');
     fs.writeFileSync(broken, '{ not json');