@bongos/core 1.19.784 → 1.19.786

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.784",
-  "core_contract": "1.19.784",
-  "source_commit": "f02324ac698997d8c553a1d4f1287effd81c09e7",
+  "core_version": "1.19.786",
+  "core_contract": "1.19.786",
+  "source_commit": "785c921afb48af049814782f27929cc27885667c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T21:59:58.914Z",
+  "built_at": "2026-09-16T22:20:27.767Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2668,
-  "tree_sha256": "1352898105cb24c3ed7bc555a9f5b3c7ec497b80ee9e62999118b530e63d23aa",
+  "tree_sha256": "3d454ef4a876f5368603708cbe4f13b53dc57a854dc03e217285b327b6dd0bf9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -207,7 +207,7 @@
     {
       "path": ".claude/skills/planning-session/SKILL.md",
       "mode": "0000644",
-      "sha256": "cae7be7bf857da01fea4ce74122a7c586b182ff7ec2de38a8f79c85793bba8fa"
+      "sha256": "8ed3e62213268015e49ad180d9f9c0c3c875867b392e93430a9850962a70455b"
     },
     {
       "path": ".claude/skills/priority-session/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "de0c1251e540e53625585facc59f8034a58db77bbc8e17c8156b0cb9a6f10e46"
+      "sha256": "580f9ae0d3677bc11fe335f73027c314edd8633f2397cd71400e07725a8f4a03"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/packs/ideator.md",
       "mode": "0000644",
-      "sha256": "3437355c1c891f5dd62b0d826e73c82c6e8dc691864e7f470734bd855ef74492"
+      "sha256": "93cef9d530a668d750d6cba4789fda25b15d176c35366240cb72187e272fa141"
     },
     {
       "path": "docs/project-context.template.md",
@@ -7062,7 +7062,7 @@
     {
       "path": "modules/security/secret-scrub.js",
       "mode": "0000644",
-      "sha256": "26e920133f0ad40de27a0b20e97492d8d42e656561e2e331e8b6ecce3de2ccf3"
+      "sha256": "c28b9a47e3d01d206cb2a13e71844865a95cc2a9dc5e0237e1153ccf8f292286"
     },
     {
       "path": "modules/security/security.js",
@@ -7622,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a8ffb2e66575892ab8a245db29ba6c58b0e8ab04a9771ecb206ef5d653f1d669"
+      "sha256": "a08e66b825d352b3b0c128f3b5b71d4665183bf734d69d0e837adf8946a28f19"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a9c4baca9ba7278c89fa2988bb4a79482da95eff23940e14a55c102e590df6ce"
+      "sha256": "9f9dfe9f5f8cc3d3ebc1cd46909eb73ac9ef03046933478f391cb6c23680cfa6"
     },
     {
       "path": "public-docs/index.html",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "adec7c6bb4200142251c5e927030fa8cd3673d12e63efdfcbc78ffdfeaaa71c8"
+      "sha256": "0eb65d596ccf4f9af9cb2ec8769e373c18f3148b93e785157895d4dbb94299c7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12557,7 +12557,7 @@
     {
       "path": "tests/scrubber_corpus.mjs",
       "mode": "0000644",
-      "sha256": "cb05f1824487124163f7b8dac0a8c589a1a02cbb1130f06ac716701fea6bf59c"
+      "sha256": "d1f80894bd96f866359d3d1997e36e8843fe3dba141ac621874cdc1d530b9282"
     },
     {
       "path": "tests/seam_wiring_guard.mjs",

package/.claude/skills/planning-session/SKILL.md

@@ -15,6 +15,10 @@ The first planning session — V3 Planning Session #1, 2026-05-12 — is the tem
 - A version is in `status='planning'` and needs scope locked before tasks start landing in earnest
 - A previous planning session left proposals in `idea_inbox` tagged `kind='criterion-proposal'` that need ratification
 
+**Run an ideation pass first when the goal's SHAPE is not yet settled.** An ideator session (the [Ideator pack](../../../docs/packs/ideator.md)) inverts this skill's stance: there the human drives and you are the sounding board, so *their* framing sets the shape of the thing. Carry its output into Phase 1 and the Phase-4 interview is left with genuine residue instead of first-pass design.
+
+Not a gate — a session for work whose shape is already settled should open directly. But **Phase 4 is a poor instrument for a first pass**: an `AskUserQuestion` round must author its options before the owner has said anything, so every option encodes *your* framing, and a proposal you believe is correct never becomes a question at all. The 2026-08-16 Board Room session is the evidence — three agent proposals (a role-based voting chamber, a tiered standard-of-review override ledger, Discord reaction-voting) died in the ideation half that would otherwise have been baked into the spec as defaults, none of which would have surfaced as an interview question.
+
 ## When NOT to invoke
 
 - Mid-version: planning sessions set scope, they don't refine it. For mid-version adjustments, use `/idea-triage`.

package/docs/module-api-changelog.md

@@ -2042,5 +2042,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.782 with no explicit bump. run 35152631705. (task 1002620)
   1.19.784 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.783 with no explicit bump. run 35155326585. (task 1002620)
+  1.19.785 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.784 with no explicit bump. run 35156349018. (task 1002620)
+  1.19.786 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.785 with no explicit bump. run 35157132070. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/packs/ideator.md

@@ -101,6 +101,12 @@ That is the **same route** the hall form uses, so the record is identical — sa
 
 The command reports what the server **stored**. If it says the idea landed as *quick*, say so plainly — capture is fail-open on grading, and telling someone they filed a Full Idea when they did not is the one outcome worse than the failure itself.
 
+### When the thread is bigger than one idea
+
+Some developed threads are not an idea — they are the shape of a whole goal or version: several interlocking pieces, a scope someone would have to *plan* rather than just build. When that is what you are looking at, **say so and offer the handoff to `/planning-session`**, which turns a settled shape into criteria, a written spec and a seeded task list. Arriving there with the shape already agreed is the point: its interview is then about residue, not about inventing the thing.
+
+File the idea first either way, and treat the handoff as an offer rather than a gate — a thread they would rather leave as an idea stays one. Planning is a trusted-builder step, so if they cannot open one themselves, the filed idea *is* the handoff: it queues for whoever runs the next session.
+
 ### Developing someone else's spark
 
 The same conversation works on a **Big Idea Spark** — a quick idea whose author marked it as needing development. `node scripts/gds/spark.js --list` shows what is waiting; develop one with `spark.js --develop <id> --fields-file <path>`. The author keeps the credit for having had the thought and the payout splits with them (ADR 0185), so the never-invent rule applies with *more* force, not less: those five answers go out under two people's names.

package/modules/security/secret-scrub.js

@@ -190,12 +190,34 @@ const ENV_SECRET_PREFIX_RE = /^(?:gds_|pms_|mac_|apple|anthropic|stripe|cf_|clou
 // last `cd` (task 2130). Exact-match only, so real password vars (MYSQL_PWD, DB_PWD, …)
 // still match below.
 const ENV_BENIGN_KEY_RE = /^(?:PWD|OLDPWD)$/;
+// CONFIG-IDENTIFIER NAMES under a provider prefix (task 1003512). ENV_SECRET_PREFIX_RE
+// matches ^anthropic, so the Claude Code harness's own ANTHROPIC_DEFAULT_OPUS_MODEL —
+// whose value is a MODEL ID like claude-opus-5, not a credential — was collected as a
+// live secret. package-core's fail-closed leak gate then flagged every functional file
+// containing that string verbatim and refused to build, on ANY machine where Claude
+// Code had set its model vars, i.e. every builder machine. Hit live packaging
+// 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+//
+// AN ALLOWLIST ON THE NAME, NOT A SHAPE TEST ON THE VALUE. The entropy/prefix check on
+// the VALUE is the other obvious fix and this file already records why that direction
+// loses: see the doc-path exemption above, where three shape rules were tried and each
+// one leaked, because a predicate built on what a secret LOOKS like also admits a
+// secret dressed the other way. These literals feed the PUBLIC mirror and session
+// uploads, so a shape hole here is a smuggling channel. That a _MODEL or _BASE_URL var
+// holds a configuration identifier is a fact about the NAME, which cannot be dressed.
+//
+// NARROW BY CONSTRUCTION: this exempts only names matched by the provider PREFIX. A
+// name carrying an actual secret word (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN) matches
+// ENV_SECRET_KEY_RE first and is still collected, whatever it ends with.
+const ENV_CONFIG_NAME_RE = /(?:_MODEL|_BASE_URL)$/i;
 function collectEnvSecrets(env = process.env) {
   const out = [];
   for (const [k, v] of Object.entries(env || {})) {
     if (typeof v !== 'string' || v.length < 8) continue;
     if (ENV_BENIGN_KEY_RE.test(k)) continue;
-    if (ENV_SECRET_KEY_RE.test(k) || ENV_SECRET_PREFIX_RE.test(k)) out.push(v);
+    // A secret WORD in the name always wins — it is never exempted below.
+    if (ENV_SECRET_KEY_RE.test(k)) { out.push(v); continue; }
+    if (ENV_SECRET_PREFIX_RE.test(k) && !ENV_CONFIG_NAME_RE.test(k)) out.push(v);
   }
   return out;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.784",
+  "version": "1.19.786",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.784",
+      "version": "1.19.786",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.784",
+  "version": "1.19.786",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.784'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.786'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scrubber_corpus.mjs

@@ -327,6 +327,65 @@ test('collectEnvSecrets: benign shell PWD/OLDPWD are skipped, real *_PWD passwor
   assert.ok(got.includes(env.MYSQL_PWD), 'MYSQL_PWD (a real password var) must still be collected');
 });
 
+test('collectEnvSecrets: Claude Code harness config vars are skipped, real anthropic credentials still collected (task 1003512)', () => {
+  // Regression: ENV_SECRET_PREFIX_RE matches ^anthropic, so the harness's own
+  // ANTHROPIC_DEFAULT_OPUS_MODEL — value = a MODEL ID, not a credential — was collected
+  // as a live secret. package-core's fail-closed leak gate then flagged every functional
+  // file containing that string verbatim (the grader, llm-pricing and their tests) and
+  // refused to build on ANY machine where Claude Code had set its model vars. Hit live
+  // packaging 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_DEFAULT_SONNET_MODEL: 'claude-sonnet-5',
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_MODEL: 'claude-opus-5-20260101',
+    ANTHROPIC_SMALL_FAST_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_BASE_URL: 'https://api.anthropic.com',
+    // ...and the ones that really are credentials, under the SAME provider prefix.
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(31, 30, B64URL),
+    ANTHROPIC_AUTH_TOKEN: randStr(32, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+
+  for (const k of ['ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL', 'ANTHROPIC_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL',
+    'ANTHROPIC_BASE_URL']) {
+    assert.ok(!got.includes(env[k]), `${k} is a config identifier and must not be collected`);
+  }
+  // The exemption is on the NAME and must never reach a name carrying a secret word.
+  assert.ok(got.includes(env.ANTHROPIC_API_KEY), 'ANTHROPIC_API_KEY must still be collected');
+  assert.ok(got.includes(env.ANTHROPIC_AUTH_TOKEN), 'ANTHROPIC_AUTH_TOKEN must still be collected');
+  assert.equal(got.length, 2, 'exactly the two real credentials, nothing else');
+});
+
+test('the *_MODEL exemption cannot be used to smuggle a credential (task 1003512)', () => {
+  // A name that carries a secret WORD is collected whatever it ends with — the
+  // exemption applies only to names matched by the provider PREFIX alone. Without this,
+  // the fix would be a hole: these literals feed the PUBLIC mirror and session uploads.
+  const env = {
+    ANTHROPIC_SECRET_MODEL: randStr(33, 40, B64URL),
+    ANTHROPIC_API_KEY_MODEL: randStr(34, 40, B64URL),
+    OPENAI_TOKEN_BASE_URL: randStr(35, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+  for (const k of Object.keys(env)) {
+    assert.ok(got.includes(env[k]), `${k} carries a secret word and must still be collected`);
+  }
+});
+
+test('a model id survives a transcript scrub while a real key does not (task 1003512)', () => {
+  // The end-to-end shape of the bug: the model id is what package-core found verbatim
+  // in modules/grading and failed the build on. RECALL IS UNCHANGED for the credential.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(36, 30, B64URL),
+  };
+  const text = `the grader ran on ${env.ANTHROPIC_DEFAULT_OPUS_MODEL} using ${env.ANTHROPIC_API_KEY}`;
+  const out = scrubSecrets(text, collectEnvSecrets(env));
+  assert.ok(out.includes('claude-opus-5'), 'a model id is not a secret and must survive');
+  assert.ok(!out.includes(env.ANTHROPIC_API_KEY), 'the key must still be scrubbed');
+});
+
 test('self-reference `key = key` (SQL SET col = col) survives — zero recall loss', () => {
   // task 1688: the core packager redacts live SQL, so a `_token` COLUMN self-increment
   // must NOT be corrupted — while a real `key = <secret>` assignment is STILL redacted.