@bongos/core 1.19.731 → 1.19.732

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.731",
-  "core_contract": "1.19.731",
-  "source_commit": "242d39240bacfa3d1d4c88f6a78ae22248c4cbdd",
+  "core_version": "1.19.732",
+  "core_contract": "1.19.732",
+  "source_commit": "05f95d3811b50b7da27f822578bed1bdaa6c678d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:35:28.869Z",
+  "built_at": "2026-09-13T15:41:18.185Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2101,
+    "functional_verbatim": 2102,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2602,
-  "tree_sha256": "1117799d57ae5cfa87178217b7fec728cc0de76ee02b0caba9abc559f2ecd9fa",
+  "file_count": 2603,
+  "tree_sha256": "ff43e4e917e23173177aea01ebf8266b85bab2ff188f67ab26f5577a47c3ffe3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a4d5bc973b439bfbf41bd0b7d59b0cdffde6b0b4c18c6b4d1d73731a92736c84"
+      "sha256": "6a3d0cfd51a5e932d65a8634f52f4a61e62f3501453b104e2ab5d2086860d9e1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/onboarding/diagrams/04-architecture.mmd",
       "mode": "0000644",
-      "sha256": "4af79f61f5b1871e9c2ffaa4cee703f681516f2720782b4db05b797993e0a293"
+      "sha256": "ee949090b1df91be015dabbcaa175bd2f81f3089714cf5f712ad2b0b053f4714"
     },
     {
       "path": "docs/onboarding/diagrams/05-versioning.mmd",
@@ -7512,12 +7512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7027beb6f7d395889a8876a1f54a1c2c69b992f4a78b0d1a53441b748d018669"
+      "sha256": "dc33512a9aebd07ee5a82a6aff3d969080aa4c7f465a2f64b65f534502043f25"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5e1af6b1b0101a246e04b20ce6b36a756a3839dc9f2e436d2e524b6a331165ff"
+      "sha256": "05b4e628ace671cc392fad7a333da1d0eea15d7f33350dd08f6bf4d21b48e972"
     },
     {
       "path": "public-docs/index.html",
@@ -7907,7 +7907,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "2aba736613cacecbc81b40b813db619eaa83871a8c2aad213ab73869347c7f56"
+      "sha256": "3ba594a6d475bb94be7edf5277cd60d5537bf1ab66f92f9d47eeb5138c56341f"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -8057,7 +8057,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "70b673fa4d4216eadefd7a7fad6e6e7fcffa3b2ac408c8f1c0f38c7a3500183c"
+      "sha256": "7cb78cd9796df68b6d7e1e4677cd778690f60583ba3ddc2fc23048f2ff75e4ba"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -9317,7 +9317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "39823a07155b3f5a8b13d2a6362985aab8ac0831d46ac25778e7893708d4fd5b"
+      "sha256": "bd79c2971dd8196fe95345a663188120141c97b5b797147c81a48bad1c9ccc0e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10249,6 +10249,11 @@
       "mode": "0000644",
       "sha256": "36a3bad951c6bfb4ee7b9230a5e6114095bb3b94f1f0019ec5c61c5168dee537"
     },
+    {
+      "path": "tests/diagram_repo_slug.mjs",
+      "mode": "0000644",
+      "sha256": "5132322b103e6ea5a3a04b1509eba987e4988cd749751b17b5d31d813ec508d5"
+    },
     {
       "path": "tests/diff_derived_signals.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1936,5 +1936,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.729 with no explicit bump. run 34765502139. (task 1002620)
   1.19.731 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.730 with no explicit bump. run 34766029928. (task 1002620)
+  1.19.732 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.731 with no explicit bump. run 34766314699. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/diagrams/04-architecture.mmd

@@ -28,7 +28,7 @@ flowchart TB
         DEPLOY["auto-pull deploy (ADR 0129)\na timer pulls THIS instance repo every ~2 min →\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]
     end
 
-    subgraph GH["GITHUB — the instance's own repo (github.com/lars589/cloud-bongos)"]
+    subgraph GH["GITHUB — the instance's own repo"]
         MAIN["branch-protected main\n(no direct push; PR + required checks only)\nholds config + the pinned @bongos/core — NOT the platform source"]
     end
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.731",
+  "version": "1.19.732",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.731",
+      "version": "1.19.732",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.731",
+  "version": "1.19.732",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -20,7 +20,6 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execFileSync } = require('node:child_process');
 
 // --- comment stripping (so rank/status literals in prose don't read as wiring) ---
 // Line-based on purpose: a regex block-comment strip over concatenated files can
@@ -232,25 +231,36 @@ function seededAchievementCount(migs) {
   return ids.size;
 }
 
-// Repo slug ("host/owner/repo") for 04's REPO node — derived from the git
-// `origin` remote so no builder identity is hardcoded in implementation code
-// (CLAUDE.md V3.R12 rule + scripts/gds/audit-authorship.sh). Falls back to a
-// neutral placeholder if origin can't be read.
-function repoSlug(repo) {
-  try {
-    const url = execFileSync('git', ['-C', repo, 'remote', 'get-url', 'origin'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-    // git@github.com:owner/repo.git  OR  https://github.com/owner/repo(.git)
-    const m =
-      url.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/) ||
-      url.match(/github\.com[:/](.+?)(?:\.git)?$/);
-    if (m) return `github.com/${m[1].replace(/^github\.com\//, '')}`;
-  } catch (_) {
-    /* no remote / not a repo — fall through */
-  }
-  return 'the project repo';
+// Repo slug ("github.com/owner/repo") for 04's REPO node.
+//
+// Sourced from the BRANDING CONTRACT (`repo: { owner, name }`), never from the
+// git `origin` remote. Reading git was the original design (task #357) and it
+// did satisfy the rule it was written for — keep builder identity out of
+// implementation code (audit-authorship.sh) — but it only moved the identity
+// from the source into the GENERATED file, which is committed AND published.
+// The portable core carries no branding.json, so `origin` there is always some
+// real person's fork and every regeneration wrote that login into
+// docs/onboarding/diagrams/04-architecture.mmd and shipped it in the core
+// package. That is task 1003911: the one leak the task 1003869 sweep could not
+// hold, because a generator puts it back the moment anyone regenerates.
+//
+// Branding fails to neutral by construction, which is the whole point: an unset
+// `repo` yields the placeholder, so the portable core renders a placeholder and
+// a host instance that declares its own repo renders its own. Every other
+// identity string in these diagrams already follows exactly this rule — see
+// `brand()` in gen-diagrams.js, whose header states it for the currency, the
+// world/product name and the public host.
+function repoSlug() {
+  let b = {};
+  try { b = require('../../src/branding').branding() || {}; } catch (_) { /* fail-to-neutral */ }
+  const r = (b && b.repo) || {};
+  const owner = typeof r.owner === 'string' ? r.owner.trim() : '';
+  const name = typeof r.name === 'string' ? r.name.trim() : '';
+  // Both halves or neither — a half-filled pack must not render "owner/".
+  // null, not a placeholder string: the CALLER owns the prose, so a neutral
+  // instance can drop the clause entirely instead of rendering a parenthetical
+  // that restates the label it sits inside.
+  return owner && name ? `github.com/${owner}/${name}` : null;
 }
 
 // An instance that IMPORTED the origin backlog renumbers the origin tasks by a
@@ -315,7 +325,7 @@ async function conceptualFacts({ repo, migs, api }) {
     taskStatus: status,
     taskLabels: { ...ALL_TASK_IDS },
     achievementsSeeded: seededAchievementCount(migs),
-    repoSlug: repoSlug(repo),
+    repoSlug: repoSlug(),
   };
 }
 

package/scripts/gds/gen-diagrams.js

@@ -444,7 +444,7 @@ function architectureMmd(f) {
     '        DEPLOY["auto-pull deploy (ADR 0129)\\na timer pulls THIS instance repo every ~2 min →\\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]',
     '    end',
     '',
-    `    subgraph GH["GITHUB — the instance's own repo (${c.repoSlug})"]`,
+    `    subgraph GH["GITHUB — the instance's own repo${c.repoSlug ? ` (${c.repoSlug})` : ''}"]`,
     '        MAIN["branch-protected main\\n(no direct push; PR + required checks only)\\nholds config + the pinned @bongos/core — NOT the platform source"]',
     '    end',
     '',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.731'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.732'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/diagram_repo_slug.mjs

@@ -0,0 +1,142 @@
+// tests/diagram_repo_slug.mjs
+//
+// Task 1003911 — the onboarding architecture diagram must not carry the live
+// instance's GitHub owner into published output.
+//
+// The bug: diagram-facts.repoSlug() derived the slug from the git `origin`
+// remote. That satisfied the rule it was written for (no builder identity
+// hardcoded in implementation code — audit-authorship.sh) but only moved the
+// identity from the SOURCE into the GENERATED file, which is committed and
+// shipped in the core package. Because it is a generator, hand-sweeping the
+// .mmd achieved nothing: the next regeneration put the owner login straight
+// back, which is how it survived the task 1003869 sweep and failed the leak
+// scan on landed main.
+//
+// The fix routes the slug through the branding contract (`repo: {owner,name}`),
+// which fails to neutral by construction — the same rule the currency, the
+// world/product name and the public host already follow.
+//
+// NOTE ON METHOD: this file never writes a real owner login down. It reads the
+// live `origin` at run time and asserts the output does not contain it. That is
+// the self-leak invariant mirror-redact.js holds about itself, and the trap this
+// sweep fell into twice — a test that pins "X must not leak" by spelling X out
+// puts X back into the very tree it is guarding.
+//
+// Run:  node tests/diagram_repo_slug.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const REPO = process.cwd();
+
+// branding() memoizes on first call, so each pack needs its own process.
+function slugWith(pack) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-slug-'));
+  const file = path.join(tmp, 'branding.json');
+  fs.writeFileSync(file, JSON.stringify(pack));
+  try {
+    const out = execFileSync(
+      process.execPath,
+      ['-e', 'process.stdout.write(JSON.stringify(require("./scripts/gds/diagram-facts.js").repoSlug()))'],
+      { cwd: REPO, encoding: 'utf8', env: { ...process.env, BONGOS_BRANDING_FILE: file } },
+    );
+    return JSON.parse(out);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+// The live owner, read at run time and never written down. If there is no
+// origin remote (a CI checkout without one), the guards that need it skip.
+function liveOwner() {
+  try {
+    const url = execFileSync('git', ['-C', REPO, 'remote', 'get-url', 'origin'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const m = url.match(/[:/]([^/:]+)\/[^/]+?(?:\.git)?$/);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+// ---- the branding contract drives it, and fails to neutral ----
+
+test('an unset repo yields null, so the caller can drop the clause entirely', () => {
+  assert.equal(slugWith({ repo: { owner: '', name: '' } }), null);
+});
+
+test('a pack with no repo key at all is still neutral, not a crash', () => {
+  assert.equal(slugWith({}), null);
+});
+
+test('a declared repo renders that instance own slug', () => {
+  assert.equal(slugWith({ repo: { owner: 'octocat', name: 'hello-world' } }), 'github.com/octocat/hello-world');
+});
+
+test('a half-filled pack renders nothing, never a dangling owner/', () => {
+  assert.equal(slugWith({ repo: { owner: 'octocat', name: '' } }), null);
+  assert.equal(slugWith({ repo: { owner: '', name: 'hello-world' } }), null);
+});
+
+test('whitespace is not a declaration', () => {
+  assert.equal(slugWith({ repo: { owner: '   ', name: '  ' } }), null);
+});
+
+// ---- the regression guard: reverting to git-derivation must FAIL here ----
+//
+// Every assertion above passes if repoSlug() goes back to reading `origin`,
+// because those packs are neutral and a git fallback would only fire when the
+// pack is empty. This is the one that catches it.
+
+test('a neutral pack does NOT fall back to the git origin owner', () => {
+  const owner = liveOwner();
+  if (!owner) return; // no remote in this checkout; nothing to leak
+  const got = slugWith({ repo: { owner: '', name: '' } });
+  assert.equal(got, null, 'neutral branding must render no slug at all');
+  assert.doesNotMatch(String(got), new RegExp(owner, 'i'), 'the git origin owner reached the diagram facts');
+});
+
+test('a declared repo wins over the git origin, it is not merely a fallback', () => {
+  const owner = liveOwner();
+  if (!owner) return;
+  const got = slugWith({ repo: { owner: 'octocat', name: 'hello-world' } });
+  assert.equal(got, 'github.com/octocat/hello-world');
+  assert.doesNotMatch(got, new RegExp(owner, 'i'));
+});
+
+// ---- the committed artifact, which is what actually ships ----
+
+test('the committed 04-architecture.mmd carries no owner login', () => {
+  const owner = liveOwner();
+  if (!owner) return;
+  const mmd = path.join(REPO, 'docs/onboarding/diagrams/04-architecture.mmd');
+  if (!fs.existsSync(mmd)) return;
+  const text = fs.readFileSync(mmd, 'utf8');
+  assert.doesNotMatch(
+    text,
+    new RegExp(owner, 'i'),
+    'the published diagram names the live owner — regenerate it after fixing the generator',
+  );
+});
+
+console.log(`\ndiagram_repo_slug: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);