@bongos/core 1.19.734 → 1.19.735

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.734",
-  "core_contract": "1.19.734",
-  "source_commit": "46c30e30da893738941d1e8d7215a614e2dc4d08",
+  "core_version": "1.19.735",
+  "core_contract": "1.19.735",
+  "source_commit": "6688485db7975049f67d21b58eac72ab6a93875e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:57:45.460Z",
+  "built_at": "2026-09-13T16:18:04.615Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 478,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2107,
+    "functional_verbatim": 2108,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2609,
-  "tree_sha256": "d26fac7aafe1ccc924b1fd6f5b92d1e322ba6f8646329350bb14cfe25af04899",
+  "file_count": 2610,
+  "tree_sha256": "4b125203b2c2f21ff8db51bae409a2e72e3e7099c38bc1e17a85f48573b17831",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2487,7 +2487,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "90a6bceef8a95c93d98b36cf8496fc22ba0a9aa505e96e8c620c57afb1d684f5"
+      "sha256": "3d409c55101525a3f86cf54a60169bc3d82c6926118b9234d98487c44128d7b7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7532,12 +7532,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "028d0931d03fd623ced3e64412ebe17596c7475efc99912bbcf15166f1586e35"
+      "sha256": "210fb895f45fb7015cd76403ab23dabddbbc53d4fe45c6f2fd3ae4c313daeb18"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c4d4049eec4c21014dd7e675c2db8420d5b0ccf0666945b8e2945eda6ef596db"
+      "sha256": "6fe0a516197ae1a54ee1d809bc4faa941ae9ff9e3b681adc4184953dd756d518"
     },
     {
       "path": "public-docs/index.html",
@@ -8327,7 +8327,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "e927900fc296f5cf840425978e77232cd5cdc75de825144255050c8a5ba2f538"
+      "sha256": "225bf45e1e0b297e25b140263a6bd2b616d63a9ab2ee0517edfcf71630cef5aa"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -9337,7 +9337,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2260aaf94b97ca5be01a845df8edfd2af7a10716306e46e7d1507d863b995e00"
+      "sha256": "1bb00c54f48017dd7f83cf8c8d51e8c0acc0f80cb939a5e304a9e70c3fe2a836"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11374,6 +11374,11 @@
       "mode": "0000644",
       "sha256": "f6097301300cdb559d3620a5c602b763b70f1acc14816a7e70e1cdb61bb42d95"
     },
+    {
+      "path": "tests/leak_scan_fail_closed.mjs",
+      "mode": "0000644",
+      "sha256": "e5968a1df544680db05c66eeec803ebdbbbe98932bfec31a5287617c6dc01466"
+    },
     {
       "path": "tests/lib_sh_resolution.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1942,5 +1942,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.732 with no explicit bump. run 34766569496. (task 1002620)
   1.19.734 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.733 with no explicit bump. run 34767120578. (task 1002620)
+  1.19.735 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.734 with no explicit bump. run 34768136326. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.734",
+  "version": "1.19.735",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.734",
+      "version": "1.19.735",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.734",
+  "version": "1.19.735",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/package-core.js

@@ -59,8 +59,11 @@
 //                    (task 1002218 / audit H3) — deterministic + network-free.
 //   --self-verify-boot   ALSO `npm install <tgz>` into a throwaway consumer + boot /healthz
 //                    (reuses tests/consumer_layout_boot.mjs; needs npm/registry access).
-//   --leak-scan-strict   make the post-build leak scan FATAL on any prior-instance literal
-//                    (default: the scan runs + WARNS; --no-leak-scan skips it). task 1002220 / H6.
+//   --no-leak-scan   THE ONLY ESCAPE from the post-build leak scan: skips it entirely.
+//                    The scan is FAIL-CLOSED by default — an un-allowlisted prior-instance
+//                    literal in the built artifact aborts the build (task 1003870 / H6).
+//   --leak-scan-strict   accepted as an explicit no-op; fatal IS the default since task
+//                    1003870. Kept so CI can state the intent it relies on out loud.
 //   Outputs (nothing is committed — dist/ is gitignored):
 //     dist/bongos-core-<version>/           the redacted core tree (inspectable)
 //     dist/bongos-core-<version>.tgz        the installable unit
@@ -629,6 +632,18 @@ function scanKindOf(pathRel) {
   return 'functional';
 }
 
+// The post-build leak scan's POLICY, split out of main() so a test can plant a literal and prove
+// the build refuses without running a full 2-minute package (task 1003870). Pure: argv in, verdict
+// out. Fail-closed — any un-allowlisted prior-instance literal is fatal unless the operator has
+// explicitly said --no-leak-scan, which skips the scan altogether rather than downgrading it.
+// `--leak-scan-strict` is honoured as a no-op: it named this behaviour before it became default.
+function leakScanVerdict(remainingLiteralHits, argv = process.argv) {
+  if (argv.includes('--no-leak-scan')) return { run: false, fatal: false, reason: 'skipped' };
+  const n = (remainingLiteralHits || []).length;
+  if (n === 0) return { run: true, fatal: false, reason: 'clean' };
+  return { run: true, fatal: true, reason: 'prior-instance-literals' };
+}
+
 // Independent post-build leak scan over the built core file set (task 1002220 / audit H6). Two layers:
 //   • INSTANCE LITERALS — findLeaks() over PRIOR_INSTANCE_LITERALS (+ the public-IP floor) across
 //     EVERY shipped file: brand/owner/history that must not ship in a portable core. This is the
@@ -942,14 +957,14 @@ function main() {
 
   // Post-build leak scan (task 1002220 / audit H6): independent verification that the BUILT
   // artifact carries no prior-instance identity, + a warn-level secret-shape scan over functional
-  // files. Runs on every build (skip with --no-leak-scan). Prior-instance literals are a WARNING
-  // by default and a hard FAILURE under --leak-scan-strict (the trunk still carries residual
-  // history until task 1002219 sweeps it + task 1002217 adds the fail-closed floor gate). A
-  // secret-shape hit is ALWAYS a non-fatal warning — the R88 functional-verbatim fix is preserved.
+  // files. Runs on every build and is FAIL-CLOSED: an un-allowlisted prior-instance literal aborts
+  // the build. The trunk sweep (task 1003869) cleared the residue those literals used to represent,
+  // so warning instead of failing would only let it creep back (task 1003870). --no-leak-scan is
+  // the sole escape. A secret-shape hit stays a non-fatal warning — those 14 files were each
+  // confirmed a test fixture (task 1003871) and the R88 functional-verbatim fix is preserved.
   if (!process.argv.includes('--no-leak-scan')) {
     const scanFiles = staged.map((s) => ({ path: s.name.startsWith(TAR_ROOT) ? s.name.slice(TAR_ROOT.length) : s.name, content: s.buf }));
     const scan = scanArtifactForLeaks(scanFiles);
-    const strict = process.argv.includes('--leak-scan-strict');
     // Named, reasoned exceptions (task 1003869). A detector must carry the pattern it
     // detects and a "public IPs are flagged" test must be handed a public IP, so those
     // hits are real but not leaks. Each is listed per (file, literal) with its reason in
@@ -966,17 +981,21 @@ function main() {
       for (const e of stale) console.error(`   ${e.path}  [${e.literal}]`);
     }
     scan.literalHits = remaining;
+    const verdict = leakScanVerdict(scan.literalHits);
     if (scan.literalHits.length) {
       const byLit = {};
       for (const h of scan.literalHits) byLit[h.sample] = (byLit[h.sample] || 0) + 1;
       const summary = Object.entries(byLit).sort((a, b) => b[1] - a[1]).map(([k, n]) => `${k}×${n}`).join(', ');
       const files = [...new Set(scan.literalHits.map((h) => h.path))];
       console.error('');
-      console.error(`[leak-scan] ${strict ? 'FAILED' : 'WARNING'} — ${scan.literalHits.length} prior-instance literal hit(s) across ${files.length} shipped file(s): ${summary}`);
+      console.error(`[leak-scan] FAILED — ${scan.literalHits.length} prior-instance literal hit(s) across ${files.length} shipped file(s): ${summary}`);
       for (const p of files.slice(0, 30)) console.error(`   ${p}`);
       if (files.length > 30) console.error(`   … +${files.length - 30} more file(s)`);
-      if (strict) { console.error('[leak-scan] --leak-scan-strict: refusing to certify a leaky artifact.'); process.exit(1); }
-      console.error('[leak-scan] non-fatal for now — the trunk sweep (task 1003869) is clearing the residue; it becomes a hard gate when task 1003870 arms publish.yml. Run --leak-scan-strict to enforce today.');
+      console.error('[leak-scan] refusing to certify a leaky artifact. Either remove the literal at SOURCE (check what');
+      console.error('[leak-scan] REGENERATES the file — a generator re-leaks on every run, task 1003911), or, if the hit is');
+      console.error('[leak-scan] a detector carrying its own pattern, add a named (path, class) reason to');
+      console.error('[leak-scan] scripts/gds/leak-scan-allowlist.js. --no-leak-scan skips this gate entirely.');
+      if (verdict.fatal) process.exit(1);
     } else {
       console.error('[leak-scan] ✓ no prior-instance literals in the built artifact.');
     }
@@ -1021,6 +1040,8 @@ module.exports = {
   selfVerify, reproducePinFromTree,
   // task 1002220 (audit H6) — post-build leak scan (prior-instance literals + functional secret shapes)
   scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
+  // task 1003870 — the fail-closed verdict the build acts on (pure, so a test can plant a literal)
+  leakScanVerdict,
   // task 1002217 (audit H4) — the fixed neutral floor injected into the doc-redaction + fail-closed gate
   PRIOR_INSTANCE_FLOOR,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.734'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.735'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/leak_scan_fail_closed.mjs

@@ -0,0 +1,108 @@
+// tests/leak_scan_fail_closed.mjs
+//
+// Task 1003870 — the post-build leak scan must FAIL CLOSED. The detector (task 1002220) and
+// the neutral floor (task 1002217) both landed, but strictness was opt-in and the publish lane
+// never opted in, so a leaky artifact could have gone to npm while the workflow's own header
+// comment claimed a fail-closed gate. This locks both halves:
+//   1. the POLICY — planting a prior-instance literal makes the build refuse, with no flag,
+//   2. the WIRING — the publish lane still arms the gate and never disarms it.
+// (2) is the half that was actually broken, and a policy test alone would not have caught it.
+//
+// Run:  node tests/leak_scan_fail_closed.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { scanArtifactForLeaks, leakScanVerdict, PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// This file is itself published, so it DERIVES the literal it plants instead of spelling it
+// out — the self-leak invariant the allowlist and mirror-redact both hold about themselves.
+// It also means a future rename of the prior instance cannot quietly gut this test: the plant
+// follows the floor, rather than pinning a string that would stop matching.
+const TOKEN = PRIOR_INSTANCE_FLOOR.tokens[0];
+const OWNER = PRIOR_INSTANCE_FLOOR.owners[0];
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('\nthe planted literal makes the build refuse (no flag required):');
+
+t('a planted prior-instance token in a functional file is FATAL by default', () => {
+  const files = [{ path: 'src/some-module.js', content: `const host = "${TOKEN}";\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted token');
+  const v = leakScanVerdict(scan.literalHits, ['node', 'package-core.js']);
+  assert.equal(v.run, true, 'the scan runs when no escape flag is passed');
+  assert.equal(v.fatal, true, 'THE LOAD-BEARING ASSERTION: a leak aborts the build with no flag');
+  assert.equal(v.reason, 'prior-instance-literals');
+});
+
+t('a planted prior-instance OWNER is fatal too, not just the token', () => {
+  const files = [{ path: 'scripts/thing.js', content: `// maintained by ${OWNER}\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted owner');
+  assert.equal(leakScanVerdict(scan.literalHits, ['node', 'x']).fatal, true);
+});
+
+t('a clean artifact is NOT fatal (the gate does not fire on everything)', () => {
+  const files = [{ path: 'src/clean.js', content: 'const x = 1;\n' }];
+  const scan = scanArtifactForLeaks(files);
+  assert.equal(scan.literalHits.length, 0);
+  const v = leakScanVerdict(scan.literalHits, ['node', 'x']);
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'clean');
+});
+
+t('--leak-scan-strict is a no-op: it cannot be the thing that makes it fatal', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const withFlag = leakScanVerdict(hits, ['node', 'x', '--leak-scan-strict']);
+  const without = leakScanVerdict(hits, ['node', 'x']);
+  assert.deepEqual(withFlag, without, 'strict must add nothing — fatal is the default now');
+});
+
+t('--no-leak-scan is the only escape, and it skips rather than downgrades', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const v = leakScanVerdict(hits, ['node', 'x', '--no-leak-scan']);
+  assert.equal(v.run, false, 'the scan does not run at all');
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'skipped');
+});
+
+console.log('\nthe publish lane arms the gate (the half that was actually broken):');
+
+const publishYml = readFileSync(join(ROOT, '.github/workflows/publish.yml'), 'utf8');
+const packLine = publishYml.split('\n').find((l) => l.includes('package-core.js') && l.includes('--ref HEAD'));
+
+t('publish.yml still invokes package-core to build the release artifact', () => {
+  assert.ok(packLine, 'no package-core invocation found — the lane was rewired, re-check this test');
+});
+
+t('the publish invocation arms the leak gate explicitly', () => {
+  assert.ok(packLine.includes('--leak-scan-strict'),
+    'the publish lane must state the gate it depends on, even though fatal is the default');
+});
+
+t('nothing the publish lane RUNS disarms the leak scan', () => {
+  // Executable lines only: a YAML/shell comment may legitimately name the escape flag while
+  // explaining why the lane never uses it, and matching prose would fail on its own docs.
+  const executable = publishYml
+    .split('\n')
+    .filter((l) => !/^\s*#/.test(l))
+    .join('\n');
+  assert.ok(!executable.includes('--no-leak-scan'),
+    'the one lane that makes an artifact permanent and public must never skip the scan');
+});
+
+console.log(`\n${passed} passed, ${failed} failed\n`);
+if (failed) process.exit(1);