@bongos/core 1.19.759 → 1.19.760

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.759",
-  "core_contract": "1.19.759",
-  "source_commit": "707e9f0b5bf49699402632ba77c655817675f27c",
+  "core_version": "1.19.760",
+  "core_contract": "1.19.760",
+  "source_commit": "d95227cc76780c216d4662c4b5d1979114a2841f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T03:03:00.033Z",
+  "built_at": "2026-09-16T03:30:46.130Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2623,
-  "tree_sha256": "72ddc6e8bfc5b6eb4aa5ab50108bbe35d4639bb91cad6318c0d6359b3c86ceec",
+  "tree_sha256": "0aa4534bb30ad7aebdab2abc87c30d522f473d9d154e17820e73fedaa79748f5",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1c38ce9a7932e516d69df1e3deaf499f2a8e10ef545e8d4621919eef11a14b8a"
+      "sha256": "dac2227121e64e9f6516a5dfb80e9362b4b3c05da7abef17cd199b89bf861104"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7567,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d3aebc78f2bcf902f69e9f27bb7375410de5851af241dbaebf7aefe729465f69"
+      "sha256": "578710b1ef47bdf6cdf4510cbe531c5ed92a8ae3758f820eeb75efe4c6bafa61"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "83cc5d9eb22a0201d8a6bca2a74392b23eb9713aa78a651200552a3e2710b273"
+      "sha256": "34ee3354f9e18c01ed9b9f0b5cac46a1d4e64da68978e38519e37a540b2c8787"
     },
     {
       "path": "public-docs/index.html",
@@ -9352,7 +9352,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "f4bba033b2052b61d026682b0a06dd3044d77138e1978ad601060fbebbfdc34d"
+      "sha256": "405b8069c27ea596981cd4a2fd6a57b7e3637022cf63962d46a19b452fa675fc"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9382,7 +9382,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8ec75227e0ef1df2b932e943d085151cbb47133212aae42c86b425fb664a3c4c"
+      "sha256": "9080c03abc81fa68447459fcec10d19afb4c9f8a5816515a2af48adf4cce76dd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11067,7 +11067,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "c4da76a78326495bad7393797d47ca076f8ad1f49fc3224fa2be337a3b6f109d"
+      "sha256": "10d8376f94e415d20b112a61e8d1f7f8f0f539eba5f685bdac4509624a69c13e"
     },
     {
       "path": "tests/hall_palette.mjs",

package/docs/module-api-changelog.md

@@ -1992,5 +1992,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.757 with no explicit bump. run 35049006030. (task 1002620)
   1.19.759 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.758 with no explicit bump. run 35050268139. (task 1002620)
+  1.19.760 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.759 with no explicit bump. run 35052040282. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.759",
+  "version": "1.19.760",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.759",
+      "version": "1.19.760",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.759",
+  "version": "1.19.760",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -1164,8 +1164,16 @@ function mountInternalSurfaces(app) {
   // task 1003172 (C02): `collab` joins the same tier — every read behind it is
   // any-builder and scoped to the caller by the SERVER (GET /help-requests/for-me
   // derives crafts from the viewer's own profile), so signed-in is the right floor.
+  // task 1003629 (idea 1000907): the BARE `task` and `idea` slugs join the tier
+  // their own /:id forms already sit on. /builders/task/:id and /builders/idea/:id
+  // are gated by TASK_DETAIL_PAGE_RE / IDEA_DETAIL_PAGE_RE below, but those
+  // regexes require a numeric id, so the id-less slugs fell through to
+  // BUILDERS_PAGE_RE — which resolves them to the SAME task.html / idea.html
+  // shells — and matched no gate at all. The shell carries no data and every
+  // read behind it is gated server-side, so this closed an inconsistency rather
+  // than an exposure; the point is that one URL cannot be two tiers at once.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.759'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.760'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_page_gate_map.mjs

@@ -122,15 +122,15 @@ const ORACLE = {
   '/builders/drachmae': null,
   '/builders/profile': null,
 
-  // NOT deliberate — recorded because it is true, and filed as idea 1000907
-  // (task 1003448). The detail pages are addressed by a second segment, and
-  // /builders/task/:id and /builders/idea/:id are both gated at signed-in; the
-  // id-less slugs still resolve to the same shells through BUILDERS_PAGE_RE and
-  // match no gate. No data rides the shell and every read behind it is gated
-  // server-side, so this is an inconsistency rather than an exposure — but it is
-  // a row that should turn into a real gate (or a redirect) when that is decided.
-  '/builders/task': null,
-  '/builders/idea': null,
+  // The bare detail slugs, gated by task 1003629 — the decision idea 1000907
+  // (task 1003448) asked for. They resolve to the same task.html / idea.html
+  // shells their /:id forms do, so they now sit on the same tier: the id-less
+  // form was never a different page, only a different spelling that the
+  // id-requiring TASK_DETAIL_PAGE_RE / IDEA_DETAIL_PAGE_RE could not see. A
+  // gate, not a redirect, because the shell is a real page at signed-in tier
+  // and redirecting would have to invent an id it does not have.
+  '/builders/task': 'requireBuilderPage',
+  '/builders/idea': 'requireBuilderPage',
 
   // Gone, not public — the hall ships no my-projects page at all since task
   // 1003308 (owner's decision: "my projects" is a user-level page the hub owns,