@bongos/core 1.19.730 → 1.19.731

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.730",
-  "core_contract": "1.19.730",
-  "source_commit": "3f93cfa0217ede14fe7949d98ed1e298cfc0bf17",
+  "core_version": "1.19.731",
+  "core_contract": "1.19.731",
+  "source_commit": "242d39240bacfa3d1d4c88f6a78ae22248c4cbdd",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:24:59.913Z",
+  "built_at": "2026-09-13T15:35:28.869Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2602,
-  "tree_sha256": "262b2dd98348643b71dddab54d3637811bfcc13b336b0e48a2e2e516c16152c3",
+  "tree_sha256": "1117799d57ae5cfa87178217b7fec728cc0de76ee02b0caba9abc559f2ecd9fa",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "73560b927b992fc1fdebf584b70d7ead444303708c64d76f38acb34f9cd01212"
+      "sha256": "a4d5bc973b439bfbf41bd0b7d59b0cdffde6b0b4c18c6b4d1d73731a92736c84"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7512,12 +7512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9ae46f748e2463accb302101f1ee604ba32234081a73959da3d0d2e144e86390"
+      "sha256": "7027beb6f7d395889a8876a1f54a1c2c69b992f4a78b0d1a53441b748d018669"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7210ef7cb81f359b560b4b1a0bacb86fd42ee0d48d51150e53af53e7b7fb4d7b"
+      "sha256": "5e1af6b1b0101a246e04b20ce6b36a756a3839dc9f2e436d2e524b6a331165ff"
     },
     {
       "path": "public-docs/index.html",
@@ -9317,7 +9317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e16770f57d46b5ef94d4b98477943b7bff414b7a499081a338fd49709ccf6241"
+      "sha256": "39823a07155b3f5a8b13d2a6362985aab8ac0831d46ac25778e7893708d4fd5b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10807,7 +10807,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "25d8b1851872230a189dcaf04a82a769c1bc8b285540bce3eaed6159790edf4c"
+      "sha256": "4478853e79266130c2ad3ab7a523f0f20fb98a97e88f1dd2476ef09db6b96dcc"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1934,5 +1934,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.728 with no explicit bump. run 34765179905. (task 1002620)
   1.19.730 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.729 with no explicit bump. run 34765502139. (task 1002620)
+  1.19.731 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.730 with no explicit bump. run 34766029928. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.730",
+  "version": "1.19.731",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.730",
+      "version": "1.19.731",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.730",
+  "version": "1.19.731",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.730'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.731'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -489,6 +489,60 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
   }
 });
 
+// ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
+//
+// task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
+// scripts/gds/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// escalate-to-owner set — and the comment above it declares the array to be "A subset of
+// PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
+//
+// TWO LISTS IS THE DESIGN, NOT THE BUG, which is why this is a subset test and not a
+// de-duplication. The registry answers "who may EDIT this path" (a rank floor, re-mappable
+// by government). The hard floor answers "may CI auto-merge an edit to this path at all"
+// — no, escalate to the owner, whatever the author's rank. The second is deliberately
+// narrower: every hard-floor surface must be protected, but most protected surfaces are
+// ordinary Metic work that should not ping the owner.
+//
+// Checked at BOTH altitudes on purpose. The source literal is what a reviewer reads and
+// what the decision asked be parsed; the exported array is what compileGlobMatcher actually
+// compiles at gate-review.js:102. Asserting they agree means a future refactor that
+// computes or filters the list cannot leave the visible source saying one thing while the
+// gate enforces another.
+function hardFloorGlobsFromSource() {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
+  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
+    + 'if it was renamed or restructured, this test must be taught the new shape rather '
+    + 'than deleted: it is the only thing holding the declared subset honest.');
+  return [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
+}
+
+test('every hard-floor glob is a protected surface (1002875 subset tripwire)', () => {
+  const fromSource = hardFloorGlobsFromSource();
+  assert.ok(fromSource.length >= 20,
+    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of gate-review.js, `
+    + 'and the array has held about two dozen since it was written. A parse that returns '
+    + 'few or none passes the subset check vacuously.');
+
+  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
+    'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
+    + 'exports and compiles into its matcher. The source and the enforced list must be the '
+    + 'same thing, or a reviewer reading the file is reading a list the gate does not use.');
+
+  const registry = new Set(ppc.PROTECTED_GLOBS);
+  for (const glob of gr.HARD_FLOOR_GLOBS) {
+    assert.ok(registry.has(glob),
+      `'${glob}' is a HARD FLOOR surface in scripts/gds/gate-review.js — CI escalates any `
+      + 'edit to it to the owner regardless of rank — but it is not in '
+      + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
+      + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
+      + 'narrower (most protected paths are ordinary Metic work and should not ping the '
+      + 'owner), never wider. Either add the glob to the registry, or remove it from '
+      + 'HARD_FLOOR_GLOBS — do not delete this assertion.');
+  }
+});
+
 test('registering the credential readers widened no module wall', () => {
   // The second-order effect task 1002891 was explicitly warned about, asserted rather
   // than reasoned about. src/bongos/module-scope-map.js DERIVES a module's `protected`