@bongos/core 1.19.77 → 1.19.78

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.77",
-  "core_contract": "1.19.77",
-  "source_commit": "a20aad3a45d55f5a39b9923d17ec460bfd504630",
+  "core_version": "1.19.78",
+  "core_contract": "1.19.78",
+  "source_commit": "e325ccc071131d7c01dbf333d8f7cd57ae312039",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T22:40:06.341Z",
+  "built_at": "2026-08-12T22:44:08.133Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1541,
-  "tree_sha256": "3125b6aac967f4e3e3e323f3572eee2b53307f8f0acfb7699a40202bc966e354",
+  "tree_sha256": "96bcb5ac17be8a28801e81faab41c95d0b6b2bfee4cd4919231a9b2e0ac6a8a9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "2afd598f687392b313dc872e73d4e6b61af27ce96d140685268ea5697955d636"
+      "sha256": "8d2dc69a139a5a658866a18527efeb5d9ae989e05883fa6cbd0ea63db0ba9476"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -2612,7 +2612,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "a9f51c0ddc4fc8c558d0c6dde77ffcd3e1b1262a6f14f93c88e1bb3e9093538d"
+      "sha256": "ba75c28d8927ebbda1482f394a0062febc6e32a52863814d00d6ad2a6667a591"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -3402,7 +3402,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "bc1526d068698e489fc2a698c04418e60097f18b56fd5c0dcdb6a6f62bbd1c81"
+      "sha256": "5e7dc6c267384eb3b691f49ec82631425151b97d2208eaf342922bf46146965f"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3437,7 +3437,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "5c0d0da5d6a8bcfb920bc432558066840e649cbc624e064dc4e55a926a3d8bb4"
+      "sha256": "8f62f50c5a81d649df6b85ef7c89e57a0bf0e8877482693861a4f9cd5cfafe5a"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ffd10996e222dd7fe49aa05ad7177979e18cb7871ee3666f2cc96c9822e8075e"
+      "sha256": "7829011d4ec272839d524b9e2f9449e16c18ff635378e52490091cb025cefe3f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3cdd1266637cfb67eed301d96a9f6414d32d98f1d4e9033e20aa6687806526c3"
+      "sha256": "b179d0a0a83c292a353548cceac274dba29e8e296c62565244cc4d2fc81e6951"
     },
     {
       "path": "public-docs/index.html",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fee8a499a0208f8f825a317e5ab631684bcb2c718dde601e6eab23eda5f2728c"
+      "sha256": "65dcc9e68f955842239c2c9d4f26e77c920ede6e79608347758ca7d6d71fb5e4"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6032,7 +6032,7 @@
     {
       "path": "tests/box_task_scope.mjs",
       "mode": "0000644",
-      "sha256": "e6cb9f94ae75fc9dd9134c85d8074bfe008eadd64eaddb0df2f1d6d851683c36"
+      "sha256": "22a2dc8bdccb9900b642371b85e8cc1785ecfacaf8f7579b042951425d95d794"
     },
     {
       "path": "tests/box_terminal_ssrf.mjs",

package/modules/dev-box/box-access.js

@@ -203,18 +203,33 @@ function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
 // + passed by the route in R94) selects the surface, three ways:
 //   - scopeKeys is a NON-EMPTY array → TASK scope: BASE ∪ the claims' module dirs
 //     (via sparsePathsForScopeKeys + the passed-in `moduleScopeMap`).
-//   - scopeKeys is an EMPTY array     → BASE-only (a live box with no active claim /
-//     no scoped goal — the pre-existing Bongos instance, nothing extra).
+//   - scopeKeys is an EMPTY array     → depends on whether the builder is actually
+//     working (see `hasActiveClaims` below).
 //   - scopeKeys is ABSENT (undefined) → the pre-ADR-0148 RANK fallback (full for
 //     Metic+, else the starter sparse surface). This is the path a vanilla instance
 //     with no lifecycle port takes, and it preserves the old behavior EXACTLY — so
 //     shipping R93 before R94 wires the route changes nothing in production.
 //
+// TASK 1002729 — the empty-array case is NOT one case, it is two, and collapsing
+// them was a live defect. moduleScopeForActiveClaims returns [] both when the
+// builder holds no claim AND when they hold claims whose goals declare no
+// scope_modules (the goal wall is optional; only 13 of 46 goals on the live
+// instance declared one). Treating the second as "no scope" handed a working
+// builder a box with NO modules/ directory at all — less code than the rank
+// fallback would have given a newcomer. On the live fleet that was 247 of 248
+// source grants, including an Archon holding 7 active claims.
+//   - [] + hasActiveClaims true  → RANK fallback. The builder is working; an
+//     undeclared goal wall is a planning gap, and it must not cripple their box.
+//   - [] + hasActiveClaims false → BASE-only, as before (a genuinely unscoped box
+//     — the pre-existing Bongos instance, nothing extra). Least privilege holds.
+// `hasActiveClaims` is optional: omitted (undefined) preserves the old BASE-only
+// reading, so a caller that hasn't been taught the signal is unchanged.
+//
 // Returns one of:
 //   { allowed:false, reason:'BUILDER_INACTIVE' }
 //   { allowed:false, reason:'INSUFFICIENT_RANK', required, actual }
 //   { allowed:true,  scope, spec }
-function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, moduleScopeMap } = {}) {
+function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, hasActiveClaims, moduleScopeMap } = {}) {
   if (status && status !== 'active') {
     return { allowed: false, reason: 'BUILDER_INACTIVE' };
   }
@@ -228,11 +243,19 @@ function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, sco
   }
   // Claim-driven task scope (present → the box asks for exactly its work's code).
   if (Array.isArray(scopeKeys)) {
-    const sparsePaths = sparsePathsForScopeKeys(scopeKeys, moduleScopeMap);
-    const scope = scopeKeys.length > 0 ? 'task' : 'base';
-    return { allowed: true, scope, spec: { scope, mode: 'sparse', sparsePaths } };
+    if (scopeKeys.length > 0) {
+      const sparsePaths = sparsePathsForScopeKeys(scopeKeys, moduleScopeMap);
+      return { allowed: true, scope: 'task', spec: { scope: 'task', mode: 'sparse', sparsePaths } };
+    }
+    // Empty. A builder mid-claim whose goals declare no wall gets the rank scope,
+    // NOT a stripped box — the planning gap is not theirs to pay for.
+    if (!hasActiveClaims) {
+      const sparsePaths = sparsePathsForScopeKeys([], moduleScopeMap);
+      return { allowed: true, scope: 'base', spec: { scope: 'base', mode: 'sparse', sparsePaths } };
+    }
   }
-  // No claim signal (no lifecycle port on this instance): the pre-ADR-0148 rank fallback.
+  // No claim signal (no lifecycle port on this instance), or claims with an
+  // undeclared goal wall: the pre-ADR-0148 rank fallback.
   const scope = boxScopeForRank(rank);
   return { allowed: true, scope, spec: cloneSpecForScope(scope) };
 }

package/modules/dev-box/routes/box.js

@@ -444,6 +444,7 @@ module.exports = function buildBoxRouter() {
       // NEVER fail the source fetch on a scope-read hiccup — degrade to rank scope.
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
+      let hasActiveClaims;
       if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
@@ -452,7 +453,19 @@ module.exports = function buildBoxRouter() {
           scopeKeys = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, moduleScopeMap: api.moduleScopeMap });
+      // task 1002729 — only needed to disambiguate an EMPTY scope: no claim (BASE)
+      // vs claims whose goals declare no wall (rank scope). Skipped otherwise so
+      // the common path keeps its single query.
+      if (Array.isArray(scopeKeys) && scopeKeys.length === 0
+          && lifecycle && typeof lifecycle.activeClaimCountForBuilder === 'function') {
+        try {
+          hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
+        } catch (claimErr) {
+          console.error('[gds] source-access claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          hasActiveClaims = undefined;
+        }
+      }
+      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
       const box = await boxes.getBoxByBuilderId(pool, req.builder.id);
       const auditDeny = (reason, extra) =>
         box && boxAccess.recordSourceEvent(pool, {
@@ -548,6 +561,7 @@ module.exports = function buildBoxRouter() {
       // (optional lifecycle port; degrade to rank scope on any hiccup).
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
+      let hasActiveClaims;
       if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
@@ -556,7 +570,18 @@ module.exports = function buildBoxRouter() {
           scopeKeys = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, moduleScopeMap: api.moduleScopeMap });
+      // task 1002729 — same disambiguation as source-access, so this read-only
+      // companion can never report a scope the real fetch wouldn't grant.
+      if (Array.isArray(scopeKeys) && scopeKeys.length === 0
+          && lifecycle && typeof lifecycle.activeClaimCountForBuilder === 'function') {
+        try {
+          hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
+        } catch (claimErr) {
+          console.error('[gds] /box/scope claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          hasActiveClaims = undefined;
+        }
+      }
+      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
       if (!decision.allowed) {
         return res.fail('SOURCE_ACCESS_REVOKED', 403, {
           reason: decision.reason,

package/modules/lifecycle/db.js

@@ -4756,6 +4756,29 @@ async function moduleScopeForActiveClaims(builderId, deps = {}) {
   return rows.map((r) => r.module_key);
 }
 
+// Task 1002729 — the companion signal moduleScopeForActiveClaims cannot carry.
+// That query INNER JOINs goals and unnests scope_modules, so it returns [] for
+// BOTH "this builder holds no claim" and "this builder holds claims whose goals
+// declare no scope_modules". Those must not be treated alike: the first is a
+// genuinely unscoped box (BASE-only is right), the second is a builder actively
+// working who would be handed a box with no modules/ at all. Live evidence for
+// why this matters: 247 of 248 source grants on the cloudbongos fleet resolved to
+// BASE, including an Archon holding 7 active claims — every one of those claims
+// sat on a goal with scope_modules = {}. Counts CLAIMS, deliberately not joining
+// goals, so it stays true regardless of how the goal wall is (or isn't) declared.
+async function activeClaimCountForBuilder(builderId, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const id = Number(builderId);
+  if (!Number.isInteger(id)) {
+    throw new Error('activeClaimCountForBuilder: builderId must be numeric');
+  }
+  const { rows } = await activePool.query(
+    `SELECT count(*)::int AS n FROM claims WHERE builder_id = $1 AND released_at IS NULL`,
+    [id]
+  );
+  return rows.length ? Number(rows[0].n) : 0;
+}
+
 // task 1642 — every active claim bound to a given CLI session. "Active" is the
 // claims-table convention (released_at IS NULL); there is NO `status` column on
 // claims (a common misread — the task's status lives on `tasks`). Keyed on
@@ -5625,6 +5648,7 @@ module.exports = {
   getClaimPublishedSha, // task 1547 — read the published tip for the reconcile gate
   getActiveClaimsForBuilder,
   moduleScopeForActiveClaims, // goal 1000051 / R92 — dev-box task-scoped source access (ADR 0148 §2)
+  activeClaimCountForBuilder, // task 1002729 — distinguishes "no claim" from "claim with an empty goal wall"
   getActiveClaimsForSession,
   getLastClaimHolder, // --regrade ownership guard (#678)
   getTaskGrade,       // V4.R08 — diff-hash reuse check before grading

package/modules/lifecycle/lifecycle.js

@@ -65,4 +65,7 @@ module.exports = {
   // resolver (goal 1000051 / R92, ADR 0148 §2). Keys only; box-access maps them to
   // git sparse-checkout globs through the doorway `moduleScopeMap`.
   moduleScopeForActiveClaims: (...a) => db.moduleScopeForActiveClaims(...a),
+  // task 1002729 — the "is this builder actually working right now" signal that
+  // lets box-access tell an unscoped box from a crippled one (see db.js).
+  activeClaimCountForBuilder: (...a) => db.activeClaimCountForBuilder(...a),
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.77",
+  "version": "1.19.78",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.77",
+      "version": "1.19.78",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.77",
+  "version": "1.19.78",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -581,8 +581,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.75 with no explicit bump. run 31637719876. (task 1002620)
 //   1.19.77 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.76 with no explicit bump. run 31647860631. (task 1002620)
+//   1.19.78 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.77 with no explicit bump. run 31648127800. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.77'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.78'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_task_scope.mjs

@@ -96,4 +96,74 @@ await test('an inactive builder is denied even with claims in scope', async () =
   assert.equal(inactive.decision.reason, 'BUILDER_INACTIVE');
 });
 
+// =========================================================================
+// Task 1002729 — an EMPTY scope is two different situations, not one
+// =========================================================================
+// The live defect: moduleScopeForActiveClaims returns [] both for "holds no
+// claim" and for "holds claims whose goals declare no scope_modules". Reading
+// both as BASE handed working builders a box with no modules/ at all — 247 of
+// 248 grants on the live fleet, including an Archon with 7 active claims.
+
+// A pool that answers BOTH queries the resolver pair now issues: the
+// claims→goals→scope_modules unnest, and the plain active-claim count.
+function poolReturningWithClaims(moduleKeyRows, claimCount) {
+  const c = makeSqlAwareClient((s) => {
+    if (/FROM claims c/.test(s) && /unnest\(g\.scope_modules\)/.test(s)) return { rows: moduleKeyRows };
+    if (/count\(\*\)/.test(s) && /FROM claims/.test(s)) return { rows: [{ n: claimCount }] };
+    return null;
+  });
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+
+async function specForClaimsWithCount({ builderId = 3, rank = 'metic', status = 'active', moduleKeyRows, claimCount }) {
+  const pool = poolReturningWithClaims(moduleKeyRows, claimCount);
+  const scopeKeys = await db.moduleScopeForActiveClaims(builderId, { pool });
+  const hasActiveClaims = (await db.activeClaimCountForBuilder(builderId, { pool })) > 0;
+  return { scopeKeys, hasActiveClaims, decision: access.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: scopeMap }) };
+}
+
+await test('claims held but every goal wall empty → RANK scope, never a stripped box', async () => {
+  // Exactly Lars's live shape: 7 active claims, all on goals with scope_modules={}.
+  const { scopeKeys, hasActiveClaims, decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [], claimCount: 7,
+  });
+  assert.deepEqual(scopeKeys, [], 'the union query still yields nothing — the goals declare no wall');
+  assert.equal(hasActiveClaims, true, 'but the builder IS working');
+  assert.equal(decision.scope, 'full', 'an Archon mid-claim gets the full surface, not base');
+  assert.equal(decision.spec.mode, 'full');
+  assert.notEqual(decision.scope, 'base', 'the regression this test exists to prevent');
+});
+
+await test('no claims at all → BASE-only is preserved (least privilege holds)', async () => {
+  const { hasActiveClaims, decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [], claimCount: 0,
+  });
+  assert.equal(hasActiveClaims, false);
+  assert.equal(decision.scope, 'base', 'an idle box is still not handed the repo');
+  assert.deepEqual(decision.spec.sparsePaths, [...BASE]);
+});
+
+await test('a declared goal wall still wins over the rank fallback', async () => {
+  // Claims AND a wall → task scope, exactly as before; the fix must not widen this.
+  const { decision } = await specForClaimsWithCount({
+    rank: 'archon', moduleKeyRows: [{ module_key: 'status-ui' }], claimCount: 2,
+  });
+  assert.equal(decision.scope, 'task', 'a real wall is still honoured, not overridden by rank');
+  assert.deepEqual(decision.spec.sparsePaths, [...BASE, 'modules/status-ui']);
+});
+
+await test('a Thetes mid-claim with no wall gets STARTER, not full — rank still bounds it', async () => {
+  const { decision } = await specForClaimsWithCount({
+    rank: 'thetes', moduleKeyRows: [], claimCount: 1,
+  });
+  assert.equal(decision.scope, 'starter', 'the fallback is rank-bounded; it is not a blanket widen');
+});
+
+await test('activeClaimCountForBuilder rejects a non-numeric builder id', async () => {
+  await assert.rejects(
+    () => db.activeClaimCountForBuilder('not-a-number', { pool: poolReturningWithClaims([], 0) }),
+    /must be numeric/,
+  );
+});
+
 summary();