@bongos/core 1.19.757 → 1.19.758

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.757",
-  "core_contract": "1.19.757",
-  "source_commit": "cc213a1bab1fc07008953502c035d32a98ced469",
+  "core_version": "1.19.758",
+  "core_contract": "1.19.758",
+  "source_commit": "aa7bf913cb3802be5885fed7612f2c25cafc981a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T02:31:57.888Z",
+  "built_at": "2026-09-16T02:42:51.087Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2623,
-  "tree_sha256": "6dfa78abe36908cd3c7762f36e1145d5ca9a22362b4825d6eb8c240e05a01815",
+  "tree_sha256": "b18088e92ce27eda1c8bfe22e09c23c33beb4923285dc789628b56a2bfcb6d69",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c415a541beec31293c9fe17473fce5706b0c043818a3da9d2c092d6a36892a12"
+      "sha256": "3b2e92dec077e82fd9d65127264fa203ed0eb8eb94e42c91559fa7eca4e85c90"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7567,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "93d77133102c1137fe1e2772f30fabcd7e4630aece1c1ec238db81580f23f634"
+      "sha256": "68833951b804e0bd61f70df18a54d9bb6b3c2d2115f6e58f19f2a113e0ab706a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb18ccfda9df0b09d536acaff0fdb18df77860d53a35cfa65b41cc1aa70e361c"
+      "sha256": "9e46060372527f559bca75e71439f4c40e326868bc51274a71a258c8c167e693"
     },
     {
       "path": "public-docs/index.html",
@@ -9382,7 +9382,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9798743d1dae3c952b257d48b1ee56341bf0a946504ebb6be66fd88f1a8cddcd"
+      "sha256": "dda37ee6d5df39a520822ad072de3addc0a4cb335e48e82d9fc2f768ee68dfad"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10882,7 +10882,7 @@
     {
       "path": "tests/government_parity.mjs",
       "mode": "0000644",
-      "sha256": "0c619508691d41f41b0fbbb1d6939ba9ac7fde2ef4ec08ae7622bfa70bfbf624"
+      "sha256": "0d2df586d3ee58990b611799334e21f59ad69292285a787e776c16ef11c64625"
     },
     {
       "path": "tests/government_principals.mjs",

package/docs/module-api-changelog.md

@@ -1988,5 +1988,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.755 with no explicit bump. run 35047623582. (task 1002620)
   1.19.757 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.756 with no explicit bump. run 35048307666. (task 1002620)
+  1.19.758 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.757 with no explicit bump. run 35049006030. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.757",
+  "version": "1.19.758",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.757",
+      "version": "1.19.758",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.757",
+  "version": "1.19.758",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.757'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.758'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_parity.mjs

@@ -237,6 +237,166 @@ test('B0: every guards note that names a concrete route names one that EXISTS',
     `guards notes point at routes that do not exist — fix the note (or the route), never ignore it:\n  ${dangling.join('\n  ')}`);
 });
 
+// ═══ B0b — a guards note naming a PAGE GATE names a live one, for its own atom ══
+//
+// task 1002878, from idea 1000625 (and independently from the BV1.R107 ship grade's
+// hacker worker). B0 above pins a note that names a ROUTE. A note that names a page
+// GATE was checked by nothing at all, and the `guards` field is the route-to-atom map
+// every migration is instructed to read as authoritative.
+//
+// WHAT WENT WRONG ONCE. page.view.builder's note read 'authenticated hall pages
+// (requireNonXenosPage / requireBuilderPage)'. Those two gates never admitted the same
+// people: requireBuilderPage enforces page.view.public (floor xenos), requireNonXenosPage
+// enforced page.view.builder (floor thetes). Migrating requireBuilderPage onto
+// page.view.builder on the strength of that note would have locked every Xenos out of
+// Work, Settings, pair, atlas, goals, roadmap and task-detail. R107 caught it by hand and
+// used the right atom, so no lockout ever shipped — but the note stayed wrong, and the
+// next reader had no reason to distrust it.
+//
+// This check would have failed on that note the day it was written: requireBuilderPage
+// enforces page.view.public, not page.view.builder, so the pair disagrees mechanically.
+//
+// IT ALSO CATCHES THE STALE HALF. Task 1003450 has since deleted requireNonXenosPage
+// along with /not-ready. A note still naming a gate that no longer exists reads as
+// authoritative and resolves to nothing; an unknown gate name is therefore a failure
+// here, not a skip — failing open is how the first version of this problem survived.
+//
+// PARSED FROM SOURCE, NOT IMPORTED. PAGE_GATES is internal to auth.js's page-gate
+// dispatcher and deliberately unexported. Exporting it so a test could read it would
+// widen the surface of a PROTECTED file (src/bongos/auth.js, group authz) for a test's
+// convenience — the same trade tests/government_protected_surfaces.mjs declines for
+// HARD_FLOOR_GLOBS, and for the same reason.
+// PURE, and split out from the live assertion deliberately. Today's catalog is CORRECT
+// (task 1003450 fixed the one bad note), so a check that only asserts "no problems
+// against the real tree" passes without ever executing the branches that find one — a
+// capture-group swap could make it vacuous forever and nothing would say so. The module's
+// own precedent for a load-bearing invariant is government_ownership_scope.mjs F5–F8,
+// which loads a MUTATED copy to prove each assert actually fires; these two functions are
+// what let this do the same, in the negative tests below.
+function parsePageGates(src) {
+  const block = src.match(/const PAGE_GATES = Object\.freeze\(\{([\s\S]*?)\n\}\);/);
+  if (!block) return null; // caller decides whether an absent table is fatal
+  const out = new Map();
+  // Each entry's own object literal is bounded by [^}]* so the scan cannot run past a
+  // gate that lacks a `permission` key and silently adopt the NEXT gate's. `permission`
+  // is then found ANYWHERE inside that literal rather than assumed to come first —
+  // requireProjectCuratePage already carries a second key, and key order in an object
+  // literal is not a contract anyone maintains.
+  for (const m of block[1].matchAll(/(require[A-Za-z]*Page):\s*Object\.freeze\(\{([^}]*)\}\)/g)) {
+    const perm = m[2].match(/permission:\s*'([^']+)'/);
+    if (perm) out.set(m[1], perm[1]);
+  }
+  return out;
+}
+
+// Any require*Page identifier mentioned anywhere in a guards note, prose included —
+// which is the whole point, since B0's route regex only ever looked at the leading
+// `METHOD /path` and prose went entirely unchecked.
+const PAGE_GATE_RE = /\b(require[A-Za-z]*Page)\b/g;
+
+// The comparison itself. Returns every disagreement plus how many notes participated,
+// so the caller can tell "nothing is wrong" from "nothing was looked at".
+function guardGateProblems(gates, permissions) {
+  const problems = [];
+  let named = 0;
+  for (const p of permissions) {
+    for (const [, gate] of String(p.guards || '').matchAll(PAGE_GATE_RE)) {
+      named += 1;
+      if (!gates.has(gate)) {
+        problems.push(`${p.key}: names '${gate}', which is not a gate in PAGE_GATES — `
+          + 'either the gate was deleted and the note was left behind, or the name is a typo.');
+        continue;
+      }
+      if (gates.get(gate) !== p.key) {
+        problems.push(`${p.key}: names '${gate}', but that gate enforces '${gates.get(gate)}'. `
+          + 'A guards note is the route-to-atom map a migration reads as authoritative, so a '
+          + 'gate listed against the wrong atom is an instruction to gate the wrong audience.');
+      }
+    }
+  }
+  return { problems, named };
+}
+
+test('B0b: a guards note naming a page gate names a live one, for its own atom', () => {
+  const gates = parsePageGates(fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8'));
+  assert.ok(gates, 'could not find the PAGE_GATES table in src/bongos/auth.js — if it '
+    + 'moved or changed shape, teach this test the new one rather than deleting it: it is '
+    + 'the only thing checking that a guards note names a gate that agrees with it.');
+  assert.ok(gates.size >= 4,
+    `fixture sanity: parsed ${gates.size} page gate(s) out of auth.js's PAGE_GATES, and the `
+    + 'table has held at least four since task 1003450 removed the two dead ones. A parse '
+    + 'returning few or none makes every assertion below vacuous.');
+
+  const { problems, named } = guardGateProblems(gates, FLOORED);
+  assert.ok(named >= 1,
+    'fixture sanity: no guards note named a page gate at all. One does today '
+    + '(page.view.government → requireGovernmentPage), so either the note was removed — in '
+    + 'which case delete this floor deliberately — or PAGE_GATE_RE has stopped matching and '
+    + 'this test is now checking nothing.');
+  assert.deepEqual(problems, [],
+    `guards notes disagree with the page gates they name:\n  ${problems.join('\n  ')}`);
+});
+
+// ── B0b negative fixtures — proof the check above can actually FAIL ───────────────
+// The real catalog is correct, so B0b passing proves only that it found no problem, not
+// that it can find one. These replay the HISTORICAL defect verbatim against a synthetic
+// pair, which is the repeatable form of the throwaway probe that was run by hand.
+
+const GATES_FIXTURE = new Map([
+  ['requireBuilderPage', 'page.view.public'],
+  ['requireGovernmentPage', 'page.view.government'],
+]);
+
+test('B0b catches the original defect: a gate listed against the WRONG atom', () => {
+  // page.view.builder's note as it actually stood — requireBuilderPage enforces
+  // page.view.public, so migrating on the strength of it would have locked every Xenos
+  // out of Work, Settings, pair, atlas, goals, roadmap and task-detail.
+  const { problems, named } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.builder', guards: 'authenticated hall pages (requireBuilderPage)' },
+  ]);
+  assert.equal(named, 1);
+  assert.equal(problems.length, 1);
+  assert.match(problems[0], /names 'requireBuilderPage', but that gate enforces 'page\.view\.public'/);
+});
+
+test('B0b catches a note left pointing at a DELETED gate', () => {
+  // requireNonXenosPage went with /not-ready in task 1003450. A note outliving its gate
+  // reads as authoritative and resolves to nothing, so an unknown name must FAIL here
+  // rather than skip — failing open is how the original problem survived unnoticed.
+  const { problems } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.builder', guards: 'authenticated hall pages (requireNonXenosPage)' },
+  ]);
+  assert.equal(problems.length, 1);
+  assert.match(problems[0], /names 'requireNonXenosPage', which is not a gate in PAGE_GATES/);
+});
+
+test('B0b stays silent on a note whose gate agrees with it, and on notes naming none', () => {
+  // The permissive half, asserted as deliberately as the strict ones: a correct note and
+  // a prose-only note must BOTH pass, or the check would just be noise someone disables.
+  const { problems, named } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.government', guards: 'the government pages — /watch (requireGovernmentPage)' },
+    { key: 'page.view.builder', guards: 'nothing in the core today — seeded and attachable' },
+  ]);
+  assert.deepEqual(problems, []);
+  assert.equal(named, 1, 'only the note naming a gate participates');
+});
+
+test('parsePageGates reads permission wherever it sits, and never borrows a sibling gate\'s', () => {
+  // The nit the grade raised: the old inner regex assumed `permission` came first in a
+  // gate's literal. It does today; key order is not a contract. A gate with no permission
+  // key at all must be DROPPED, never silently given the next gate's.
+  const gates = parsePageGates([
+    'const PAGE_GATES = Object.freeze({',
+    "  requireSecondKeyPage: Object.freeze({ deniedTo: '/builders', permission: 'a.b' }),",
+    "  requireNoPermissionPage: Object.freeze({ deniedTo: '/builders' }),",
+    "  requireNormalPage: Object.freeze({ permission: 'c.d', deniedTo: '/builders' }),",
+    '});',
+  ].join('\n'));
+  assert.equal(gates.get('requireSecondKeyPage'), 'a.b', 'permission declared second still reads');
+  assert.equal(gates.has('requireNoPermissionPage'), false, 'a gate with no permission is dropped');
+  assert.equal(gates.get('requireNormalPage'), 'c.d', 'and it did not inherit a sibling\'s');
+});
+
 // ONE-DIRECTIONAL, and deliberately so. A floor STRICTER than the route middleware
 // is legitimate and common: the wall lives in the handler (task.confirm.grade_bypass
 // on an any-builder POST /tasks/:id/confirm; goal.manage.own's owner|manager check;