@bongos/core 1.19.725 → 1.19.726

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.725",
-  "core_contract": "1.19.725",
-  "source_commit": "5a98310e9967d2430aba88122213a7a722ae07ad",
+  "core_version": "1.19.726",
+  "core_contract": "1.19.726",
+  "source_commit": "d8623af04d5a30742d38eb9ba239a3f63f775a36",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T13:36:04.522Z",
+  "built_at": "2026-09-13T14:41:51.726Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 478,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2665,
-  "tree_sha256": "41c25536b149d9641dc2e413a0da01a4e49c306b619ec412c2f2ea7b552944c6",
+  "tree_sha256": "a9b351048d2b02f92d5d3a8a5639a19ab5ed6731a39eb8ac8a937ac19eb22448",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "793f097cac5faadbbf7d9aaec4c2b5b413a535b913b2e3258ef17361982f7ef9"
+      "sha256": "1d9b38322833641b859bcf8e401135219788455e5aa0d5082d7044551beefd08"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7837,12 +7837,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "82be9f1fd6d0b97fdc7b5ac3d36e9e7537c2b42818af2bb643be5ecf6610d22a"
+      "sha256": "7637583d4d85202afbf079b2db2c89fb687377c8478d5baa8c058dc282e6d141"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f1796793605e11cb891209283c562e08772ee65f956bbe5039ee799e1969a013"
+      "sha256": "c9ee4d8541a9fb546d0556b13d3814e132b301e606676d6d23c2416c8c3b23b7"
     },
     {
       "path": "public-docs/index.html",
@@ -8332,7 +8332,7 @@
     {
       "path": "scripts/gds/gate-review.js",
       "mode": "0000644",
-      "sha256": "19d739354ed6f485a842ce77379ed4b63f9b86ba848c3b9d7528809a79ad74f1"
+      "sha256": "183c4592b68f059ef89b4d516ae589526af08901543ded0183b8854cd9b1e5a2"
     },
     {
       "path": "scripts/gds/gating.js",
@@ -9467,7 +9467,7 @@
     {
       "path": "src/bongos/permission-path-check.js",
       "mode": "0000644",
-      "sha256": "5116468286f737a3421dbcdfdc48f78ecc8f25496f7db0382f9af9e1a0110e9c"
+      "sha256": "14ba2ffb603cbea7d8388c196b74f8e7db92b777fb0da7c69c7d3c7c9e27f386"
     },
     {
       "path": "src/bongos/platform-visibility-gate.js",
@@ -9637,7 +9637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5aa7b8b121af462b9feba77bbd2a87b997e6dad22d3c8e6bf467ca122016d3d0"
+      "sha256": "958848fd9515e4e2c7544579ba4023f136ab5d1e5d521964ae12404682fc193c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11127,7 +11127,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "d11562d59861a5f5d294c072b3aa15f03703ddbb2102210ff92f7ccbcff5b5f6"
+      "sha256": "dfde7ca6e223324317a0d56960db7adc9b30bdfc35f718269e9d6978344545ac"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1924,5 +1924,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.723 with no explicit bump. run 34759302425. (task 1002620)
   1.19.725 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.724 with no explicit bump. run 34760272743. (task 1002620)
+  1.19.726 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.725 with no explicit bump. run 34763380132. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.725",
+  "version": "1.19.726",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.725",
+      "version": "1.19.726",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.725",
+  "version": "1.19.726",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gate-review.js

@@ -38,8 +38,11 @@
 
 const { execFileSync } = require('node:child_process');
 const fs = require('node:fs');
-const permPath = require('../../src/bongos/permission-path-check');
-const { PROTECTED_GLOBS, globToRegExp } = permPath;
+// Destructured AT the require, not off a held module object: knip's static pass
+// cannot follow `const x = require(...); const { y } = x;` and reports `y` as an
+// unused export, which reds the CI knip step (this file's own CLAUDE.md records
+// the same trap for src/instance-config.js).
+const { PROTECTED_GLOBS, compileGlobMatcher } = require('../../src/bongos/permission-path-check');
 
 // --- HARD FLOOR (rank-independent ESCALATE) -------------------------------------------
 // A subset of PROTECTED_GLOBS: the surfaces that, if a compromised/injected senior
@@ -89,12 +92,17 @@ const AUTO_NARROWING = {
   '.husky/secrets-allowlist.txt': certifyAllowlistNarrowing,
 };
 
-const COMPILED_HARD = HARD_FLOOR_GLOBS.map((g) => ({ glob: g, re: globToRegExp(g) }));
-const matchesHardFloor = (f) => COMPILED_HARD.some((c) => c.re.test(f));
+// task 1002874: compile through the authoritative module's FOLDING matcher, not
+// globToRegExp directly. Both of these used to build their own byte-exact regexes
+// from the raw globs and test raw candidates, so after protected-path matching
+// gained NFC + case-folding, an uppercased spelling of a gate surface still walked
+// past THIS classifier — the CI auto-merge gate — which is the bypass the fix
+// exists to close. isCanonicalPath below rejects non-NFC and non-ASCII, but it
+// does not case-fold, so it never covered this.
+const matchesHardFloor = compileGlobMatcher(HARD_FLOOR_GLOBS);
 
 // A path is "protected" per the authoritative module.
-const protectedRe = PROTECTED_GLOBS.map((g) => ({ glob: g, re: globToRegExp(g) }));
-const matchesProtected = (f) => protectedRe.some((c) => c.re.test(f));
+const matchesProtected = compileGlobMatcher(PROTECTED_GLOBS);
 
 // Only [\x20-\x7e] path chars, NFC-stable, no leading/trailing whitespace. Defeats the
 // unicode-homoglyph + whitespace-alias evasions (red-team Holes 6/8).

package/src/bongos/permission-path-check.js

@@ -140,13 +140,80 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-const COMPILED = PROTECTED_SURFACES.map((s) => ({ ...s, re: globToRegExp(s.glob) }));
+// task 1002874: the glob is normalised ONCE here, at build, not per candidate —
+// there are 51 surfaces and `matchProtected` runs over every changed file on the
+// push/claim/grade path. `s.glob` itself is kept VERBATIM on the entry, because it
+// is what gets reported back to a refused builder and in the registry's own docs;
+// only the compiled matcher is folded.
+const COMPILED = PROTECTED_SURFACES.map((s) => ({ ...s, re: globToRegExp(foldForMatch(s.glob)) }));
 
 // Normalize a path the way git reports it (forward slashes, no leading ./).
+// normalize — put a path in the ONE spelling matching happens in.
+//
+// task 1002874 (ADR 0151 §4, the last piece of R101's scope): this used to do
+// only backslash→slash and strip a leading './', so matching was exact-BYTES. On
+// a case-insensitive filesystem — macOS by default, and Windows, i.e. the two
+// platforms most builders use — `Src/Bongos/Auth.js` and `src/bongos/auth.js` name
+// the SAME file, and only one of them matched the protected-surface glob. Unicode
+// composition does the same thing invisibly: NFD (`e` + U+0301) and NFC (`é`) are
+// different byte strings for one filename, and a checkout can hand you either.
+// A protected-path wall you can step over by spelling is not a wall.
+//
+// BOTH SIDES go through this — the candidate here, and every registry glob ONCE at
+// COMPILED build — so the transform is applied symmetrically and matching cannot
+// become narrower. It is a strict widening: any pair that matched byte-for-byte
+// still matches after both are folded the same way. The only regression shape is
+// OVER-protection, surfacing as an unexpected claim/push refusal, never a silent
+// un-protection.
+//
+// CASE FOLD: `toLowerCase()`, and that IS the invariant fold here. The Turkish-I
+// hazard the ADR warns about belongs to `toLocaleLowerCase('tr')`, which maps
+// 'I' → 'ı' (dotless) — measured. Plain `toLowerCase()` is Unicode Default Case
+// Conversion and is locale-independent by specification, so it is the correct
+// primitive and `toLocaleLowerCase` is the one that must never appear on this
+// path. A test asserts it does not.
+//
+// ORDER: NFC first, then fold. Measured equivalent to folding first for the
+// composed-accent cases, and NFC-first keeps the input in one canonical form
+// before any other transform reasons about it.
 function normalize(p) {
   return String(p || '').replace(/\\/g, '/').replace(/^\.\//, '').trim();
 }
 
+// foldForMatch — the spelling MATCHING happens in. Separate from normalize() on
+// purpose: normalize() still produces the path we REPORT, and that must keep its
+// original case. A finding, a refusal message and a grader issue all carry
+// `file`, and on a case-sensitive filesystem (Linux, i.e. CI) a lowercased path
+// names nothing — a consumer that tried to read it would get ENOENT for a file
+// that exists.
+function foldForMatch(p) {
+  return normalize(p).normalize('NFC').toLowerCase();
+}
+
+// compileGlobMatcher(globs) → (file) => boolean, with the fold applied to BOTH
+// sides: each glob once here, the candidate on every call.
+//
+// task 1002874: this exists because `globToRegExp` + the raw `PROTECTED_GLOBS`
+// are BOTH exported, and a consumer that compiles them itself gets a byte-exact
+// matcher — which is precisely the wall this task removed, rebuilt by accident.
+// gate-review.js had done exactly that (its ESCALATE / HARD_FLOOR classifier),
+// so an uppercased spelling still slipped past CI's auto-merge gate after the
+// matcher here was fixed. Anything matching a PROTECTED-surface list should
+// compile through this, not through globToRegExp directly.
+//
+// NOT a blanket replacement for globToRegExp, deliberately. Folding widens what
+// matches, and that is only safe when matching more means protecting more. On an
+// ALLOW-list — publish-manifest's PUBLISH_ALLOWLIST, which decides what reaches
+// the public OSS mirror — widening would publish MORE files. Those lists keep
+// the exact matcher on purpose.
+function compileGlobMatcher(globs) {
+  const compiled = (globs || []).map((g) => globToRegExp(foldForMatch(g)));
+  return (file) => {
+    const folded = foldForMatch(file);
+    return folded ? compiled.some((re) => re.test(folded)) : false;
+  };
+}
+
 // Which of `files` are permission-sensitive? Returns
 // [{ file, glob, floor, permission }] — floor + permission come straight from the
 // registry entry that matched, so a governance re-map flows through every caller.
@@ -155,7 +222,11 @@ function matchProtected(files) {
   for (const raw of files || []) {
     const f = normalize(raw);
     if (!f) continue;
-    const hit = COMPILED.find((c) => c.re.test(f));
+    // Match on the FOLDED spelling, report the original one — see foldForMatch.
+    // Hoisted OUT of the predicate on purpose: inside it, the fold re-runs once
+    // per registry surface (51 today) for every candidate file.
+    const folded = foldForMatch(raw);
+    const hit = COMPILED.find((c) => c.re.test(folded));
     if (hit) out.push({ file: f, glob: hit.glob, floor: hit.floor, permission: hit.permission });
   }
   return out;
@@ -164,7 +235,8 @@ function matchProtected(files) {
 // The registry entry governing `file`, or null when the path is unprotected.
 function surfaceFor(file) {
   const f = normalize(file);
-  const hit = f ? COMPILED.find((c) => c.re.test(f)) : null;
+  const folded = f ? foldForMatch(file) : '';
+  const hit = f ? COMPILED.find((c) => c.re.test(folded)) : null;
   return hit ? { glob: hit.glob, floor: hit.floor, permission: hit.permission, group: hit.group, why: hit.why } : null;
 }
 
@@ -271,6 +343,11 @@ module.exports = {
   REGISTRY_PATH,
   SPECIALTY,
   globToRegExp,
+  compileGlobMatcher,
+  // foldForMatch is deliberately NOT exported: it is the internal spelling rule,
+  // and every caller should go through compileGlobMatcher so the fold is applied
+  // to BOTH sides. Handing it out invites a consumer to fold one side only, which
+  // is the asymmetry that breaks matching outright.
   matchProtected,
   surfaceFor,
   floorFor,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.725'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.726'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -518,3 +518,140 @@ test('the floor decision reads the hit\'s registry floor, so a re-map takes effe
   const atFloor = ppc.checkPermissionPaths({ changedFiles: ['migrations/001.sql'], builderRank: 'metic' });
   assert.equal(atFloor.hardFail, false);
 });
+
+
+// ---------------------------------------------------------------------------
+// task 1002874 — NFC + case-folding, the last piece of R101's ADR 0151 §4 scope.
+//
+// R101 shipped the registry with matching left exact-BYTES, deliberately and
+// declared: its hard constraint was byte-identical behaviour, and normalisation
+// changes what matches. This IS that change, so these come in two halves — the
+// wall must now hold against a re-spelling, and nothing protected before may have
+// stopped being protected.
+// ---------------------------------------------------------------------------
+
+// A real literal surface from the registry, not a fixture: this cannot pass
+// against a glob that no longer exists.
+const LITERAL = ppc.PROTECTED_SURFACES.find((s) => !s.glob.includes('*') && !s.glob.endsWith('/'));
+
+test('a CASE variant of a protected path is still protected', () => {
+  assert.ok(LITERAL, 'no literal surface in the registry — this test is reading the wrong shape');
+  assert.ok(ppc.surfaceFor(LITERAL.glob), 'the exact spelling must match (sanity)');
+  // macOS by default and Windows are case-INsensitive: this names the SAME file.
+  assert.ok(ppc.surfaceFor(LITERAL.glob.toUpperCase()),
+    'an uppercased spelling of a protected file must not step over the wall');
+  const mixed = LITERAL.glob.replace(/(^|\/)([a-z])/g, (m, s, c) => s + c.toUpperCase());
+  assert.ok(ppc.surfaceFor(mixed), `a mixed-case spelling must not step over the wall: ${mixed}`);
+});
+
+test('the REPORTED path keeps its original case — only matching is folded', () => {
+  const shouty = LITERAL.glob.toUpperCase();
+  const [hit] = ppc.matchProtected([shouty]);
+  assert.ok(hit, 'the case variant must be caught');
+  assert.equal(hit.file, shouty,
+    'findings, refusals and grader issues all carry this path; a lowercased one names '
+    + 'nothing on a case-SENSITIVE filesystem (Linux, i.e. CI) and would ENOENT for a file that exists');
+  assert.equal(hit.glob, LITERAL.glob, 'and the registry glob is reported verbatim, not folded');
+});
+
+test('an NFD-composed path matches its NFC glob', () => {
+  // The registry is pure ASCII today, so this exercises the mechanism directly:
+  // one filename, two different byte strings, either of which a checkout can hand you.
+  const nfc = 'modules/caf\u00e9/secret.js';
+  const nfd = 'modules/cafe\u0301/secret.js';
+  assert.notEqual(nfc, nfd, 'the two spellings must really differ in bytes, or this proves nothing');
+  const fold = (s) => s.normalize('NFC').toLowerCase();
+  const re = ppc.globToRegExp(fold(nfc));
+  assert.ok(re.test(fold(nfd)), 'NFD and NFC spellings of one filename must match the same glob');
+  assert.ok(re.test(fold(nfc.toUpperCase())), 'and case must not separate them either');
+});
+
+test('STRICTLY WIDENING: every glob still matches a path it matched before', () => {
+  // The regression that would matter is a path silently becoming UNprotected, so
+  // walk the whole registry and synthesise a concrete path from each glob.
+  let checked = 0;
+  for (const s of ppc.PROTECTED_SURFACES) {
+    const sample = s.glob.endsWith('/')
+      ? `${s.glob}probe.js`
+      : s.glob.replace(/\*\*/g, 'x/y').replace(/\*/g, 'z');
+    assert.ok(ppc.surfaceFor(sample), `${s.glob} no longer protects ${sample} — this change must never narrow`);
+    checked += 1;
+  }
+  assert.ok(checked >= 40, `only ${checked} surfaces walked — the registry read is not working`);
+});
+
+test('an UNprotected path is still unprotected — folding must not over-reach', () => {
+  for (const p of ['README.md', 'docs/notes.md', 'tests/example.mjs']) {
+    assert.equal(ppc.surfaceFor(p), null, `${p} must not become protected by normalisation`);
+  }
+});
+
+test('the matcher never uses a LOCALE-sensitive case fold (the Turkish-I hazard)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'), 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\/\/[^\n]*/g, '');
+  assert.ok(src.length > 1000, `comment-stripping left only ${src.length} chars — the scan is reading nothing`);
+  assert.ok(!/toLocaleLowerCase|toLocaleUpperCase/.test(src),
+    'toLocaleLowerCase("tr") maps I to dotless i — measured — so a Turkish locale would fold '
+    + 'two different paths together. Plain toLowerCase is locale-independent by specification '
+    + 'and is the correct primitive here; the ADR note warning against it does not apply to JS.');
+  assert.match(src, /toLowerCase\(\)/, 'and the fold must actually be applied');
+  assert.match(src, /normalize\('NFC'\)/, 'as must NFC composition');
+});
+
+
+// ---------------------------------------------------------------------------
+// task 1002874, round 2 — the fold has to reach every PROTECTED matcher, not just
+// the one in permission-path-check.
+//
+// Round 1 fixed matchProtected/surfaceFor and trusted the task description's claim
+// that all eleven substrate consumers route through them. They do not.
+// gate-review.js — the CI ESCALATE / HARD_FLOOR classifier — imported the RAW
+// PROTECTED_GLOBS plus globToRegExp and compiled its own byte-exact regexes, so an
+// uppercased spelling of a gate surface still walked past the auto-merge gate after
+// the wall itself was fixed. Its isCanonicalPath() rejects non-NFC and non-ASCII
+// but does not case-fold, so it never covered this.
+// ---------------------------------------------------------------------------
+
+test('compileGlobMatcher folds BOTH sides', () => {
+  const m = ppc.compileGlobMatcher(['src/bongos/auth.js', 'migrations/']);
+  assert.ok(m('src/bongos/auth.js'), 'exact still matches');
+  assert.ok(m('SRC/BONGOS/AUTH.JS'), 'case variant matches');
+  assert.ok(m('Migrations/001.sql'), 'a folded subtree prefix still matches');
+  assert.ok(!m('docs/readme.md'), 'and an unrelated path does not');
+  assert.ok(!m(''), 'empty is never a match');
+  assert.ok(!m(null), 'nor is a missing path');
+});
+
+test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
+  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
+  assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
+  assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');
+  assert.ok(gr.matchesHardFloor(literal.toUpperCase()),
+    'an uppercased gate surface must still escalate — otherwise CI auto-merge is bypassable '
+    + 'by re-spelling, which is the hole this task exists to close');
+});
+
+test('no consumer compiles a PROTECTED glob list byte-exact', () => {
+  // The drift guard. Both globToRegExp and the raw glob lists are exported, so a
+  // consumer can rebuild the byte-exact matcher by accident — which is exactly what
+  // gate-review had done. globToRegExp stays exported because ALLOW-lists
+  // legitimately need it: folding publish-manifest's PUBLISH_ALLOWLIST would widen
+  // what reaches the public OSS mirror, i.e. publish MORE. So the ban is narrow —
+  // pairing a PROTECTED list with the raw compiler in one file.
+  const dir = path.join(ROOT, 'scripts', 'gds');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js'));
+  assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
+  const offenders = [];
+  for (const f of files) {
+    const src = fs.readFileSync(path.join(dir, f), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    const usesRawCompiler = /globToRegExp\s*\(/.test(src);
+    const usesProtectedList = /(PROTECTED_GLOBS|HARD_FLOOR_GLOBS)\s*\.\s*map/.test(src);
+    if (usesRawCompiler && usesProtectedList) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these compile a protected-surface list with the raw byte-exact compiler; use `
+    + `compileGlobMatcher so the fold reaches them too: ${offenders.join(', ')}`);
+});