@bongos/core 1.19.785 → 1.19.787

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.785",
-  "core_contract": "1.19.785",
-  "source_commit": "022d941502640ca75c63a0fb7d13ae42233b583f",
+  "core_version": "1.19.787",
+  "core_contract": "1.19.787",
+  "source_commit": "b32b78533de72aa607032c7eeea369d98103ef3b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T22:11:28.177Z",
+  "built_at": "2026-09-16T22:32:51.862Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2668,
-  "tree_sha256": "e71aafdc39bbf2b01c233a16c86515be287220faecbb7afaa6f874ffb6dbd9fa",
+  "tree_sha256": "6633332cd057cd360e74849250fa2f7ab2458f7f683c8c6315c4820d19d06ac7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -207,7 +207,7 @@
     {
       "path": ".claude/skills/planning-session/SKILL.md",
       "mode": "0000644",
-      "sha256": "8ed3e62213268015e49ad180d9f9c0c3c875867b392e93430a9850962a70455b"
+      "sha256": "ede2aa15718bff19d38ffa7f42d64bae7490a9025f7e85d43c43306da3f611b6"
     },
     {
       "path": ".claude/skills/priority-session/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "37d573a87561b4c12d3b3d1d416ad720fa4286a57fd2e30f906f0262cb70ad4d"
+      "sha256": "3c0fb2e250b9dca8299cae204683c9fb815421e52206b44472b94952d7e61ede"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5447,7 +5447,7 @@
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
       "mode": "0000644",
-      "sha256": "04406d383068e42eafed42fa51cf9108df2907f0807b1ed7bcd0abc9eaf7bfb7"
+      "sha256": "2fefa2efa05b2a63ee510345180c04d211d5068c8bc82c050392dac3d02cfac2"
     },
     {
       "path": "modules/lifecycle/db-goals.js",
@@ -5737,12 +5737,12 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "b821b384c67c5182f52653a283674da62756885c4fa5cf6790cea5eccd688f49"
+      "sha256": "9cff3bcd27467dc413aa975cd20262b47e8595a50a845d93b557a24828719bbf"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "3c4bbd0b62fbef12e8511bfcbaae22fa677fc956b83423a8f213207fc1062c90"
+      "sha256": "0497ab99a5c13399617b43f70d775e77773f1eed259548433f19c20c708ebab9"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7062,7 +7062,7 @@
     {
       "path": "modules/security/secret-scrub.js",
       "mode": "0000644",
-      "sha256": "26e920133f0ad40de27a0b20e97492d8d42e656561e2e331e8b6ecce3de2ccf3"
+      "sha256": "c28b9a47e3d01d206cb2a13e71844865a95cc2a9dc5e0237e1153ccf8f292286"
     },
     {
       "path": "modules/security/security.js",
@@ -7622,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "39247eaf1ee78994bb9f1be1d50c320bbf7a1184efe408bec6458a8450638036"
+      "sha256": "c99209b9bfd8f2191eb0e622e45d4875760a65c7ae4f8653758667e11bd0bb66"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6ce05e6b15c23da646d860f0c9d2c5a84cbee1fac61af6c807cefe7e2b743eae"
+      "sha256": "fae2586d07f9b98f2631be427db59eb76c7149b49a01c404af51a40edde911a3"
     },
     {
       "path": "public-docs/index.html",
@@ -8702,7 +8702,7 @@
     {
       "path": "scripts/gds/seed-bongos-v1-idea-routing-tasks.js",
       "mode": "0000644",
-      "sha256": "d028e80a7c1cd85805954187e43ec32d624244bf9b3374b4f27c5d47ced79f95"
+      "sha256": "fc30acb5a295289c446b5fd7dd79bcd4e2ba8a3b90bbe1c426fecc087bbefadd"
     },
     {
       "path": "scripts/gds/seed-bongos-v1-seo-tasks.js",
@@ -8727,7 +8727,7 @@
     {
       "path": "scripts/gds/seed-bv1-profiles-tasks.js",
       "mode": "0000644",
-      "sha256": "a1101fcbb8988a19bd34f5c80789b8d69e421907be4c6143f6052e594c0b6944"
+      "sha256": "53353029323de1e200b11bceccf822f524a19ff857cf17f6fa4b1ada73408c40"
     },
     {
       "path": "scripts/gds/seed-bv1-r01-delta-tasks.js",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0f2dbf8705fbe60f6a38db6c2e40c5b671576645a092902706e5251d78758784"
+      "sha256": "37250a4442445fd5b73d199d17c2646944e633f7816a366ef7f6477168c6c2bd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10342,7 +10342,7 @@
     {
       "path": "tests/criterion_ref_parse.mjs",
       "mode": "0000644",
-      "sha256": "8eca863d641ce68a3edad2b902ecc15e9ec64c14fb420418a463461f29e44ff1"
+      "sha256": "80ce711abf62a78dc4f36b513b852a5396173a2ff50e5deab2460531d17911e4"
     },
     {
       "path": "tests/criterion_suggest.mjs",
@@ -12557,7 +12557,7 @@
     {
       "path": "tests/scrubber_corpus.mjs",
       "mode": "0000644",
-      "sha256": "cb05f1824487124163f7b8dac0a8c589a1a02cbb1130f06ac716701fea6bf59c"
+      "sha256": "d1f80894bd96f866359d3d1997e36e8843fe3dba141ac621874cdc1d530b9282"
     },
     {
       "path": "tests/seam_wiring_guard.mjs",

package/.claude/skills/planning-session/SKILL.md

@@ -172,7 +172,7 @@ Don't tunnel-vision. Surface lateral options the user might not have thought of:
 - **Criteria (done-when)** — the goal's criteria verbatim by slug (C1, C2, …); every task links to one.
 - **Design decisions & assumptions** — what we're committing to and why; note grounding from the codebase (existing modules/tables/routes to reuse). Starts from your best defaults; the Phase-4 interview fills and revises this.
 - **Open questions (for the interview)** — the non-obvious decisions still unresolved, each with why-it-matters + the options you see. This is the raw material for Phase 4; empty it as answers land.
-- **Task outline** — grouped by criterion (and phase, if phased), one row per task: `R## · kind · title · one-line done-when · deps:[R##] · criterion_ids:[Cn]`, tagged `[E]`/`[I]`/`[N]`. Mark **spikes** (needs-exploration) and **proofs** (the live demo per criterion).
+- **Task outline** — grouped by criterion (and phase, if phased), one row per task: `R## · kind · title · one-line done-when · deps:[R##] · criterion_ids:[<criterion-slug>]`, tagged `[E]`/`[I]`/`[N]`. Mark **spikes** (needs-exploration) and **proofs** (the live demo per criterion).
 - **Dependency graph & ranking** — filled in Phase 4 (topo order + priority tiers).
 - **Out of scope** — what this goal explicitly does NOT do, so the interview and tasks stay bounded.
 
@@ -269,10 +269,10 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
    - **Migration** at `migrations/<NN>_<ver_slug>_planning_seed.sql` (CORE — platform-universal, non-scope-truth changes only): `UPDATE versions SET done_when = ...` and `UPDATE tasks` for existing-task priority + V##.R## title prefix (guarded by `WHERE title NOT LIKE 'V<ver>.R%'`). **Do NOT put versions/goals/`done_when_criteria` INSERTs here** — that's scope-truth and fails the `selfhost-boot` gate (ADR 0105).
 
 3. **Write a seed script** at `scripts/gds/seed-<ver_slug>-tasks.js` modeled on `scripts/gds/seed-v3-tasks.js` containing:
-   - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. Use the positional `"Cn"` token (C1 = the version's first criterion); the server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
+   - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
    - **`touches` is now OPTIONAL (task 882 / [ADR 0049](../../../docs/adr/0049-split-parallel-safety-contract.md)).** Omit it (or leave it blank) unless you already know a tight file set and want the advisory overlap signal during the brainstorm. At first `/builder-ship` the server backfills `touches[]` from the real committed diff — the declared set becomes what git actually reported. Don't burn planning effort predicting file lists; a rough or absent prediction is fine and no longer ship-blocking.
    - **`requires_rank` AUTO-DERIVES — you don't hand-set it per task (task [#1498](https://example.com/builders#/task/1498) / [ADR 0084](../../../docs/adr/0084-auto-derived-per-task-rank-floor.md)).** On create the server floors a task at `metic` when it is `security_sensitive` or its `touches` reach the permission / authz / ship-grade / deploy / migration core (the same protected paths a sub-Metic builder can't push to); everything else stays the open `xenos` default. To deliberately gate a task **higher** than the auto-floor (e.g. owner-only work), pass `requires_rank: 'metic' | 'archon'` on the task — it can only RAISE the floor, never drop below it.
-   - **Pass `goal_id: <gid>` on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a `"Cn"` position, or a numeric id — the slug is position-independent and cleanest.
+   - **Pass `goal_id: <gid>` on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a numeric id, or a `"Cn"` position — **but `Cn` is rejected outright once the version holds a second goal**, and a version almost always gains one. Treat the slug as the only form you write.
    - A main() that POSTs each task **with its `criterion_ids`** (idempotent on `source_ref`; the criterion links are inserted at create, idempotent on `(task_id, criterion_id)`), PATCHes `idea_inbox` for promotions, and after all tasks exist, POSTs `task_dependencies` via `POST /tasks/:id/dependencies` (resolving each R## to the just-created task ID). Idempotent on `(task_id, depends_on_task_id)`. (Need to re-attribute an already-seeded task? `POST /tasks/:id/criteria` with `{criterion_ids:['Cn',...]}`; `DELETE /tasks/:id/criteria/:criterionId` to detach — both Metic+ ([ADR 0090](../../../docs/adr/0090-metic-task-authoring.md)), mirroring the dependency endpoints.)
 
 > **Seeding contract — validated on goal 1000045 (2026-07-16):** proof-tasks use `kind='verify'` (a deliverable that IS a verification; can't be prematurely confirmed), spikes `kind='spike'`; `POST /tasks` accepts `criterion_ids` + `goal_id` inline and disciplines include `ui`; there is **no `promoted_idea_id`** field on `POST /tasks` — mark a promoted idea via `PATCH /inbox/:id`; **descoping a criterion has no API** (done-when is create/satisfy/unsatisfy only) — remove the row via a direct DB delete (`ssh … "sudo -u postgres psql -d <db> -c \"DELETE FROM done_when_criteria WHERE id=…\""`) under the meta-task claim, capturing the SQL in its notes; and a seed script **must throttle + honor `429` `retry_after`** (per-IP rate limit) — add a base delay between calls and back off on 429, or a large seed dies halfway. A completed reference seed: `scripts/gds/<redacted>.js`.

package/docs/module-api-changelog.md

@@ -2044,5 +2044,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.783 with no explicit bump. run 35155326585. (task 1002620)
   1.19.785 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.784 with no explicit bump. run 35156349018. (task 1002620)
+  1.19.786 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.785 with no explicit bump. run 35157132070. (task 1002620)
+  1.19.787 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.786 with no explicit bump. run 35158163962. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-deps-criteria.js

@@ -286,13 +286,26 @@ function parseCriterionRef(raw) {
 }
 
 // Resolve an array of refs to done_when_criteria.id values within a version.
-// Returns { ids: [unique numeric ids, first-appearance order], unresolved: [refs] }.
-
-async function resolveCriterionIds(versionId, refs) {
+// Returns { ids: [unique numeric ids, first-appearance order], unresolved: [refs],
+// ambiguous: [positional refs refused because the version holds >1 goal] }.
+//
+// WHY ambiguous exists (task 1003108). A positional "Cn" ranks over the WHOLE
+// version's criteria. That is unambiguous only while the version holds ONE goal:
+// add a second and the "C1" a planner reads off a per-goal spec silently resolves
+// to some other goal's criterion — a wrong link, not an error. It mislinked all 15
+// tasks of goal 1000071 (2026-08-17, learning 1000188) and the seed still printed
+// success. Task 1003076 added the after-the-fact tally that catches the symptom;
+// this refuses the ref at the write, so the mislink cannot be created. Slugs are
+// position-independent and stay legal on every version, which is why the skill now
+// requires them. `executor` is the same testability seam countTasksWithoutCriterionLink
+// uses — a fake SQL-recording client needs no live Postgres.
+
+async function resolveCriterionIds(versionId, refs, executor = pool) {
   const ids = [];
   const unresolved = [];
-  if (!Array.isArray(refs) || refs.length === 0) return { ids, unresolved };
-  const { rows } = await pool.query(
+  const ambiguous = [];
+  if (!Array.isArray(refs) || refs.length === 0) return { ids, unresolved, ambiguous };
+  const { rows } = await executor.query(
     `SELECT id, criterion_id,
             ROW_NUMBER() OVER (ORDER BY sort_order, criterion_id) AS cnum
        FROM done_when_criteria
@@ -302,17 +315,31 @@ async function resolveCriterionIds(versionId, refs) {
   const byId = new Set(rows.map((r) => Number(r.id)));
   const byCnum = new Map(rows.map((r) => [Number(r.cnum), Number(r.id)]));
   const bySlug = new Map(rows.map((r) => [String(r.criterion_id), Number(r.id)]));
+  // Only pay for the goal count when a positional ref is actually present — the
+  // slug path (the one the skill now requires) costs no extra query.
+  let multiGoal = false;
+  if (refs.some((r) => parseCriterionRef(r).kind === 'cnum')) {
+    const { rows: g } = await executor.query(
+      'SELECT COUNT(*)::int AS n FROM goals WHERE version_id = $1',
+      [versionId]
+    );
+    multiGoal = Number(g[0] ? g[0].n : 0) > 1;
+  }
   const seen = new Set();
   for (const raw of refs) {
     const p = parseCriterionRef(raw);
     let id = null;
-    if (p.kind === 'cnum') id = byCnum.get(p.n) ?? null;
-    else if (p.kind === 'id') id = byId.has(p.id) ? p.id : null;
+    if (p.kind === 'cnum') {
+      // Refuse rather than guess: resolving it would produce a plausible-looking
+      // wrong link that no later check attributes to the ref.
+      if (multiGoal) { ambiguous.push(String(raw).trim()); continue; }
+      id = byCnum.get(p.n) ?? null;
+    } else if (p.kind === 'id') id = byId.has(p.id) ? p.id : null;
     else id = bySlug.get(p.slug) ?? null;
     if (id == null) { unresolved.push(String(raw).trim()); continue; }
     if (!seen.has(id)) { seen.add(id); ids.push(id); }
   }
-  return { ids, unresolved };
+  return { ids, unresolved, ambiguous };
 }
 
 // countTasksWithoutCriterionLink — task 1003157's DONE WHEN item 2: the count of

package/modules/lifecycle/routes/task-write-routes.js

@@ -62,8 +62,9 @@ module.exports = function registerTaskWriteRoutes(router) {
       requires_rank: { type: 'string', maxLength: 16 },  // task 1498 / ADR 0084 — per-task rank floor (auto-derived; explicit value can only raise it)
       auto_detect_touches: { type: 'boolean' },
       // task 438: link the new task to done-when criteria at creation time. Each
-      // element is a numeric done_when_criteria.id, a positional "Cn" token, or a
-      // criterion_id slug — resolved against this task's version below (ADR 0025).
+      // element is a criterion_id slug (required on a multi-goal version — task
+      // 1003108), a numeric done_when_criteria.id, or a positional "Cn" token —
+      // resolved against this task's version below (ADR 0025).
       criterion_ids: { type: 'array', maxItems: 100 },
       // BV1.R53 (task 1422): module affinity label. Drives module-disjointness at
       // claim time and diff⊆module drift detection at ship time.
@@ -119,7 +120,10 @@ module.exports = function registerTaskWriteRoutes(router) {
     // is unambiguous and a numeric id from another version doesn't resolve.
     let criterionIdsResolved = [];
     if (Array.isArray(body.criterion_ids) && body.criterion_ids.length > 0) {
-      const { ids, unresolved } = await db.resolveCriterionIds(body.version_id, body.criterion_ids);
+      const { ids, unresolved, ambiguous } = await db.resolveCriterionIds(body.version_id, body.criterion_ids);
+      if (ambiguous.length > 0) {
+        return res.fail('ambiguous_criterion_ref', { status: 400, message: `Version '${body.version_id}' holds more than one goal, so a positional "Cn" ref ranks over the WHOLE version's criteria — not this goal's — and would link to the wrong criterion silently (task 1003108). Re-send these as criterion_id slugs: ${ambiguous.join(', ')}.`, details: { ambiguous } });
+      }
       if (unresolved.length > 0) {
         return res.fail('bad_criterion_ref', { status: 400, message: `These criterion refs don't match any criterion of version '${body.version_id}': ` +
             `${unresolved.join(', ')}. Use a numeric done_when_criteria.id, a "Cn" position, or a criterion_id slug.`, details: { unresolved } });

package/modules/lifecycle/routes/tasks.js

@@ -452,7 +452,10 @@ module.exports = function buildTasksRouter() {
 
     const task = await db.getTask(id);
     if (!task) return res.fail('task_not_found', 404);
-    const { ids, unresolved } = await db.resolveCriterionIds(task.version_id, refs);
+    const { ids, unresolved, ambiguous } = await db.resolveCriterionIds(task.version_id, refs);
+    if (ambiguous.length > 0) {
+      return res.fail('ambiguous_criterion_ref', { status: 400, message: `Version '${task.version_id}' holds more than one goal, so a positional "Cn" ref ranks over the WHOLE version's criteria — not this goal's — and would link to the wrong criterion silently (task 1003108). Re-send these as criterion_id slugs: ${ambiguous.join(', ')}.`, details: { ambiguous } });
+    }
     if (unresolved.length > 0) {
       return res.fail('bad_criterion_ref', { status: 400, message: `These criterion refs don't match any criterion of version '${task.version_id}': ${unresolved.join(', ')}.`, details: { unresolved } });
     }

package/modules/security/secret-scrub.js

@@ -190,12 +190,34 @@ const ENV_SECRET_PREFIX_RE = /^(?:gds_|pms_|mac_|apple|anthropic|stripe|cf_|clou
 // last `cd` (task 2130). Exact-match only, so real password vars (MYSQL_PWD, DB_PWD, …)
 // still match below.
 const ENV_BENIGN_KEY_RE = /^(?:PWD|OLDPWD)$/;
+// CONFIG-IDENTIFIER NAMES under a provider prefix (task 1003512). ENV_SECRET_PREFIX_RE
+// matches ^anthropic, so the Claude Code harness's own ANTHROPIC_DEFAULT_OPUS_MODEL —
+// whose value is a MODEL ID like claude-opus-5, not a credential — was collected as a
+// live secret. package-core's fail-closed leak gate then flagged every functional file
+// containing that string verbatim and refused to build, on ANY machine where Claude
+// Code had set its model vars, i.e. every builder machine. Hit live packaging
+// 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+//
+// AN ALLOWLIST ON THE NAME, NOT A SHAPE TEST ON THE VALUE. The entropy/prefix check on
+// the VALUE is the other obvious fix and this file already records why that direction
+// loses: see the doc-path exemption above, where three shape rules were tried and each
+// one leaked, because a predicate built on what a secret LOOKS like also admits a
+// secret dressed the other way. These literals feed the PUBLIC mirror and session
+// uploads, so a shape hole here is a smuggling channel. That a _MODEL or _BASE_URL var
+// holds a configuration identifier is a fact about the NAME, which cannot be dressed.
+//
+// NARROW BY CONSTRUCTION: this exempts only names matched by the provider PREFIX. A
+// name carrying an actual secret word (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN) matches
+// ENV_SECRET_KEY_RE first and is still collected, whatever it ends with.
+const ENV_CONFIG_NAME_RE = /(?:_MODEL|_BASE_URL)$/i;
 function collectEnvSecrets(env = process.env) {
   const out = [];
   for (const [k, v] of Object.entries(env || {})) {
     if (typeof v !== 'string' || v.length < 8) continue;
     if (ENV_BENIGN_KEY_RE.test(k)) continue;
-    if (ENV_SECRET_KEY_RE.test(k) || ENV_SECRET_PREFIX_RE.test(k)) out.push(v);
+    // A secret WORD in the name always wins — it is never exempted below.
+    if (ENV_SECRET_KEY_RE.test(k)) { out.push(v); continue; }
+    if (ENV_SECRET_PREFIX_RE.test(k) && !ENV_CONFIG_NAME_RE.test(k)) out.push(v);
   }
   return out;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.785",
+  "version": "1.19.787",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.785",
+      "version": "1.19.787",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.785",
+  "version": "1.19.787",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bongos-v1-idea-routing-tasks.js

@@ -1,3 +1,10 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108) — copy its
+// verifySeedCriteriaLinks tail instead, which is what this script is cited for.
+// Its positional "Cn" refs rank over the whole VERSION's criteria, so on a
+// multi-goal version they resolve to another goal's criterion silently (learning
+// 1000188). POST /tasks now refuses a positional ref there (400
+// ambiguous_criterion_ref). A new seed uses criterion_id SLUGS.
+//
 // Seed the tasks for goal 1000071 "Idea routing — work that has a home lands in it" (BONGOS-V1).
 // Source of truth: docs/specs/bongos-v1-idea-routing.md (status: final).
 // Idempotent on (source, source_ref). Re-running resolves to the existing rows.

package/scripts/gds/seed-bv1-profiles-tasks.js

@@ -1,3 +1,12 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108). Its positional
+// "Cn" refs were written when BONGOS-V1 held one goal, where they were unambiguous.
+// Cn ranks over the whole VERSION's criteria, so on a multi-goal version it resolves
+// to another goal's criterion silently — that is how all 15 tasks of goal 1000071 were
+// mislinked (learning 1000188). POST /tasks now refuses a positional ref on a
+// multi-goal version (400 ambiguous_criterion_ref). A new seed uses criterion_id
+// SLUGS. This file is kept as-is because it has already run and is idempotent on
+// source_ref — a re-run returns the existing rows before criterion resolution.
+//
 // Seed the tasks for goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
 // Source of truth: docs/specs/bongos-v1-public-builder-profiles.md (status: final).
 // Idempotent on (source, source_ref). Re-running resolves to the existing rows.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.785'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.787'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_ref_parse.mjs

@@ -6,8 +6,10 @@
 //   - a numeric done_when id     → { kind: 'id', id }
 //   - a criterion_id slug        → { kind: 'slug', slug }
 // resolveCriterionIds itself is DB-backed (it ranks a version's criteria), so the
-// parsing rule — the part that decides what a token MEANS — is what's unit-tested
-// here without a database. Run: node tests/criterion_ref_parse.mjs
+// parsing rule — the part that decides what a token MEANS — is unit-tested here
+// without a database. Task 1003108 added a second block covering resolveCriterionIds
+// itself through its executor seam: a positional "Cn" must be REFUSED once the
+// version holds more than one goal. Run: node tests/criterion_ref_parse.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -49,5 +51,82 @@ test('a "Cn" embedded in a longer string does NOT match (anchored)', () => {
   assert.equal(db.parseCriterionRef('see C8 above').kind, 'slug');
 });
 
-console.log(`\ncriterion ref parse (task 438) tests: ${passed} passed, ${failed} failed`);
-process.exit(failed > 0 ? 1 : 0);
+// --- resolveCriterionIds: the multi-goal refusal (task 1003108) -------------
+// resolveCriterionIds is DB-backed, but it takes an `executor` seam (the one
+// countTasksWithoutCriterionLink uses), so a fake SQL-recording client covers the
+// rule without Postgres. The rule: a positional "Cn" ranks over the WHOLE
+// version's criteria, so once a version holds a second goal it silently resolves
+// to another goal's criterion — the shape that mislinked all 15 tasks of goal
+// 1000071. It must come back as `ambiguous`, never as an id.
+
+function fakeExecutor(goalCount) {
+  const seen = [];
+  return {
+    seen,
+    async query(sql, params) {
+      seen.push(sql);
+      if (/FROM goals/.test(sql)) return { rows: [{ n: goalCount }] };
+      return { rows: [
+        { id: 501, criterion_id: 'first-slug', cnum: 1 },
+        { id: 502, criterion_id: 'second-slug', cnum: 2 },
+      ] };
+    },
+  };
+}
+
+async function atest(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+async function main() {
+  await atest('a positional "Cn" resolves on a SINGLE-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['C2'], fakeExecutor(1));
+    assert.deepEqual(r.ids, [502]);
+    assert.deepEqual(r.ambiguous, []);
+    assert.deepEqual(r.unresolved, []);
+  });
+
+  await atest('a positional "Cn" is REFUSED on a multi-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['C2'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [], 'must not resolve to an id — refusing is the whole point');
+    assert.deepEqual(r.ambiguous, ['C2']);
+    assert.deepEqual(r.unresolved, [], 'ambiguous is not the same failure as unknown');
+  });
+
+  await atest('slugs still resolve on a multi-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['second-slug'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [502]);
+    assert.deepEqual(r.ambiguous, []);
+  });
+
+  await atest('a mixed list refuses only the positional ref', async () => {
+    const r = await db.resolveCriterionIds('V9', ['first-slug', 'C2', '502'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [501, 502], 'the slug and the numeric id survive');
+    assert.deepEqual(r.ambiguous, ['C2']);
+  });
+
+  await atest('an unknown slug is unresolved, not ambiguous', async () => {
+    const r = await db.resolveCriterionIds('V9', ['no-such-slug'], fakeExecutor(2));
+    assert.deepEqual(r.unresolved, ['no-such-slug']);
+    assert.deepEqual(r.ambiguous, []);
+  });
+
+  await atest('the goal count is NOT queried when no positional ref is present', async () => {
+    // The slug path is the one the skill now requires — it must not pay for an
+    // extra round trip. A green test here is what keeps the fast path fast.
+    const ex = fakeExecutor(2);
+    await db.resolveCriterionIds('V9', ['first-slug'], ex);
+    assert.equal(ex.seen.filter((s) => /FROM goals/.test(s)).length, 0);
+  });
+
+  await atest('an empty ref list returns all three arrays', async () => {
+    const r = await db.resolveCriterionIds('V9', [], fakeExecutor(2));
+    assert.deepEqual(r, { ids: [], unresolved: [], ambiguous: [] });
+  });
+
+  console.log(`\ncriterion ref parse (task 438) + multi-goal refusal (task 1003108) tests: ${passed} passed, ${failed} failed`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main();

package/tests/scrubber_corpus.mjs

@@ -327,6 +327,65 @@ test('collectEnvSecrets: benign shell PWD/OLDPWD are skipped, real *_PWD passwor
   assert.ok(got.includes(env.MYSQL_PWD), 'MYSQL_PWD (a real password var) must still be collected');
 });
 
+test('collectEnvSecrets: Claude Code harness config vars are skipped, real anthropic credentials still collected (task 1003512)', () => {
+  // Regression: ENV_SECRET_PREFIX_RE matches ^anthropic, so the harness's own
+  // ANTHROPIC_DEFAULT_OPUS_MODEL — value = a MODEL ID, not a credential — was collected
+  // as a live secret. package-core's fail-closed leak gate then flagged every functional
+  // file containing that string verbatim (the grader, llm-pricing and their tests) and
+  // refused to build on ANY machine where Claude Code had set its model vars. Hit live
+  // packaging 1.19.209; the workaround was `env -u ANTHROPIC_DEFAULT_OPUS_MODEL`.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_DEFAULT_SONNET_MODEL: 'claude-sonnet-5',
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_MODEL: 'claude-opus-5-20260101',
+    ANTHROPIC_SMALL_FAST_MODEL: 'claude-haiku-4-5-20251001',
+    ANTHROPIC_BASE_URL: 'https://api.anthropic.com',
+    // ...and the ones that really are credentials, under the SAME provider prefix.
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(31, 30, B64URL),
+    ANTHROPIC_AUTH_TOKEN: randStr(32, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+
+  for (const k of ['ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL', 'ANTHROPIC_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL',
+    'ANTHROPIC_BASE_URL']) {
+    assert.ok(!got.includes(env[k]), `${k} is a config identifier and must not be collected`);
+  }
+  // The exemption is on the NAME and must never reach a name carrying a secret word.
+  assert.ok(got.includes(env.ANTHROPIC_API_KEY), 'ANTHROPIC_API_KEY must still be collected');
+  assert.ok(got.includes(env.ANTHROPIC_AUTH_TOKEN), 'ANTHROPIC_AUTH_TOKEN must still be collected');
+  assert.equal(got.length, 2, 'exactly the two real credentials, nothing else');
+});
+
+test('the *_MODEL exemption cannot be used to smuggle a credential (task 1003512)', () => {
+  // A name that carries a secret WORD is collected whatever it ends with — the
+  // exemption applies only to names matched by the provider PREFIX alone. Without this,
+  // the fix would be a hole: these literals feed the PUBLIC mirror and session uploads.
+  const env = {
+    ANTHROPIC_SECRET_MODEL: randStr(33, 40, B64URL),
+    ANTHROPIC_API_KEY_MODEL: randStr(34, 40, B64URL),
+    OPENAI_TOKEN_BASE_URL: randStr(35, 40, B64URL),
+  };
+  const got = collectEnvSecrets(env);
+  for (const k of Object.keys(env)) {
+    assert.ok(got.includes(env[k]), `${k} carries a secret word and must still be collected`);
+  }
+});
+
+test('a model id survives a transcript scrub while a real key does not (task 1003512)', () => {
+  // The end-to-end shape of the bug: the model id is what package-core found verbatim
+  // in modules/grading and failed the build on. RECALL IS UNCHANGED for the credential.
+  const env = {
+    ANTHROPIC_DEFAULT_OPUS_MODEL: 'claude-opus-5',
+    ANTHROPIC_API_KEY: 'sk-' + 'ant-' + randStr(36, 30, B64URL),
+  };
+  const text = `the grader ran on ${env.ANTHROPIC_DEFAULT_OPUS_MODEL} using ${env.ANTHROPIC_API_KEY}`;
+  const out = scrubSecrets(text, collectEnvSecrets(env));
+  assert.ok(out.includes('claude-opus-5'), 'a model id is not a secret and must survive');
+  assert.ok(!out.includes(env.ANTHROPIC_API_KEY), 'the key must still be scrubbed');
+});
+
 test('self-reference `key = key` (SQL SET col = col) survives — zero recall loss', () => {
   // task 1688: the core packager redacts live SQL, so a `_token` COLUMN self-increment
   // must NOT be corrupted — while a real `key = <secret>` assignment is STILL redacted.