@bongos/core 1.19.796 → 1.19.797

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.796",
-  "core_contract": "1.19.796",
-  "source_commit": "eb84110e187e21a515d265977ce83f905d8ca85a",
+  "core_version": "1.19.797",
+  "core_contract": "1.19.797",
+  "source_commit": "8f5cae915f47995fbf47d3adaeeb356c02f4a9f7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T01:04:56.932Z",
+  "built_at": "2026-09-17T01:13:47.184Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2182,
+    "functional_verbatim": 2183,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2693,
-  "tree_sha256": "19d44026eb8aaa1ed4e9b87d3ff059e80fe495cbb5ba3e19bf74a36fe69632d0",
+  "file_count": 2694,
+  "tree_sha256": "c15e5cbc3148cc9a221215b7607ed8cdc79df894902b2e7390bc9baa08d49bc6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -207,7 +207,7 @@
     {
       "path": ".claude/skills/planning-session/SKILL.md",
       "mode": "0000644",
-      "sha256": "ede2aa15718bff19d38ffa7f42d64bae7490a9025f7e85d43c43306da3f611b6"
+      "sha256": "9320b9a04d36d3169e5a01e4fb5dc595fe84ef292541307fd17974a283b4c509"
     },
     {
       "path": ".claude/skills/priority-session/SKILL.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "393caf0055b05621fc26bb45600687b9f02f66d3efcb6774661001d93a6a1847"
+      "sha256": "e0e6a2d6f7b83b899430db2acfa43e9385fd35237cf0245cf54c415be7fe9424"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7702,12 +7702,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f93bb0db7f1d64f92d574b1c67095cb6e23f4101da20886678ac869477005630"
+      "sha256": "21954c7eccc561a9ad23abf43f4511040f8b67231aeb91fa88e47d324c3ff18d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ddba830385dd1e004134ca3b317969fb69aa5772b607e2d650fae222915ec51e"
+      "sha256": "4a4cd623c012c80ec9a7d18065e78a47209ed2ded81d282e796e9bca6ce7ce6b"
     },
     {
       "path": "public-docs/index.html",
@@ -9587,7 +9587,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a7ef0a9cd6da08076cf17a8de8eae34b588fe51f05f0be618e9fd4e37951e214"
+      "sha256": "12ad8d673d39e15d3ccf283f17927e66dbcf499f1b5243f15bd6cb46545bb1e2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10979,6 +10979,11 @@
       "mode": "0000644",
       "sha256": "3c420d28341a6e5aaeb5d4af978e72acefec3c9bd7d97f66fd11a72517118606"
     },
+    {
+      "path": "tests/goal_unknown_module_hint.mjs",
+      "mode": "0000644",
+      "sha256": "7e7863c75b1282150fb090da90da8628f68a97873c27527978d806fa9d2c4835"
+    },
     {
       "path": "tests/goal_wall_proof.mjs",
       "mode": "0000644",

package/.claude/skills/planning-session/SKILL.md

@@ -134,6 +134,9 @@ For the version being planned, **group the agreed criteria into goals**. For eac
 - **`scope_modules`** — the module **keys** (NOT file paths) whose files this goal's members may touch. **This is the wall, and it is set here and only here — never self-granted.** Keep it tight: the modules the goal's work actually needs. Widening later goes through an explicit request a trusted rank approves (`POST /goals/:id/scope`; Archon for a `protected` module) — BV1.R64.
   > **The valid key list is the source of truth in [`src/bongos/module-scope-map.js`](../../../src/bongos/module-scope-map.js) — read it, don't trust this list.** It exports `moduleKeys()` (all keys), `protectedModules()` / `isProtectedModule(key)` (which are PROTECTED), and `scopeForModule(key)` (a key's globs + `protected` flag). Each key maps to path-globs; `protected` is **derived** (the key's globs overlap the trust/ship-pipeline/migration/authz core), and a goal scoped to any protected key is **Archon-only** to create. The current roster (run `node -e "const m=require('./src/bongos/module-scope-map');console.log(m.moduleKeys().map(k=>k+(m.isProtectedModule(k)?' 🔒':'')).join('\n'))"` to print it live):
   >   - **No roster is written down here on purpose.** The previous snapshot went stale within a release (it still omitted a key that had been added), which is exactly the failure a "read it live" rule prevents. Run the one-liner above; `protected` is derived from glob overlap, so it changes when the globs change.
+  >   - **That file is the SOURCE. The RUNNING SERVER is the GATE.** `POST /goals` validates `scope_modules` against the roster the LIVE server loaded — not the one in your checkout — so a key added since the last deploy is valid here and refused on the wire. Merging to main deploys nothing (gate 3 of [the release pipeline](../../../docs/recipes/core-release-pipeline.md)), and this is not a rare race: the module roster grows precisely during the versions when planning sessions run. On 2026-08-16 goal 1000069 was created with `government` in scope and came back `unknown: ["government"]` — the key was on main; the site was a release behind. **The SessionStart deploy-state line already tells you whether you are exposed.** If it says the site is behind main, treat any recently-added key as suspect before you compose the goal, not after.
+  >   - **The refusal is not a dead end — it hands you the answer.** `unknown_module` comes back with `valid: [...]`: the LIVE roster, from the server that just refused you. One rejected call tells you exactly what will be accepted, so read it and re-point rather than trying keys one at a time. (`tests/goal_unknown_module_hint.mjs` pins that the refusal keeps carrying it, because this instruction is only true while it does.)
+  >   - **Prefer a deployed alias where one exists, and write the re-point down.** Goal 1000069 was walled to the deprecated `governance` alias, which ADR 0174 deliberately kept carrying BOTH sets of globs through the transition — so the wall was identical, not weaker — and the goal description recorded that `scope_modules` should be re-pointed once the newer release went live. A goal walled to an alias with no note is a goal nobody re-points.
 - **No covering key? → file a module-map prep task FIRST.** Every `scope_modules` entry must be a real key from `moduleKeys()`. If a goal's planned work touches file paths that **no existing key covers** (e.g. a brand-new module dir, or code still fused under `src/bongos/` that isn't yet broken out as its own key), the scope wall cannot place that work. Do **not** invent a key. Instead, **add a prep task to this version** — `kind='refactor'`, scoped to `kernel` (the module that owns `module-scope-map.js`) — to extend `MODULE_GLOBS` so a key covers those paths, and make the dependent goal's tasks depend on it. Adding/editing a key is itself a `kernel`-scoped (Archon-gated) change, so flag it for Archon sign-off in this session.
 - **Join policy** — a normal-scope goal is **open-join** (any builder); a goal whose scope includes a **`protected`** module is **Archon-mediated** (a non-Archon can't self-join; an Archon admits Metic+ members). Creating a protected-scope goal is itself **Archon-only** — so flag those for Archon sign-off in this session.
 - **Optional seed tasks / lead** — any obvious first tasks, and who leads.

package/docs/module-api-changelog.md

@@ -2066,5 +2066,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.794 with no explicit bump. run 35168408728. (task 1002620)
   1.19.796 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.795 with no explicit bump. run 35169093667. (task 1002620)
+  1.19.797 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.796 with no explicit bump. run 35169694391. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.796",
+  "version": "1.19.797",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.796",
+      "version": "1.19.797",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.796",
+  "version": "1.19.797",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.796'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.797'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_unknown_module_hint.mjs

@@ -0,0 +1,103 @@
+// tests/goal_unknown_module_hint.mjs
+//
+// The `unknown_module` refusal must keep handing back the LIVE module roster
+// (task 1003106, goal 1000095, from idea 1000760).
+//
+// WHY THIS EXISTS. `POST /goals` validates `scope_modules` against the roster
+// the RUNNING server loaded, while a planning session reads the roster from its
+// own checkout. Those are different lists whenever the deployed core pin sits
+// behind `main` — which is the normal state, by design, because merging to main
+// deploys nothing (gate 3 of the release pipeline). On 2026-08-16 a session
+// created a goal with `government` in scope and was refused: the key was on
+// main, the site was a release behind.
+//
+// The fix is guidance in `/planning-session` Phase 2.5, and the part of that
+// guidance with teeth is "the refusal is not a dead end — read `valid` off it
+// and re-point". **That instruction is only true while the refusal carries the
+// list.** If someone trims the payload to a bare code, the skill keeps telling
+// agents to read a field that is no longer there, and the failure is silent:
+// the planning session simply guesses again. So the two are pinned together
+// here — the route's payload, the roster it is built from, and the skill text
+// that depends on both.
+//
+// Deliberately NOT a re-test of the schema layer: `tests/goal_routes.mjs`
+// covers the request-validation branches and says in its own words that the
+// unknown-key check is in-handler, which is exactly the gap this fills.
+//
+// Pure: no DB, no network.
+//
+// Run:  node tests/goal_unknown_module_hint.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const scopeMap = require('../src/bongos/module-scope-map.js');
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOALS_ROUTE = path.join(ROOT, 'modules', 'lifecycle', 'routes', 'goals.js');
+const SKILL = path.join(ROOT, '.claude', 'skills', 'planning-session', 'SKILL.md');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// ---- the roster the refusal would hand back is real ------------------------
+
+test('moduleKeys() returns a real, non-empty roster', () => {
+  const keys = scopeMap.moduleKeys();
+  assert.ok(Array.isArray(keys), 'moduleKeys() returns an array');
+  assert.ok(keys.length >= 10, `expected a substantial roster, got ${keys.length}`);
+  assert.equal(new Set(keys).size, keys.length, 'keys are unique');
+  for (const k of keys) {
+    assert.ok(typeof k === 'string' && k.trim(), `key ${JSON.stringify(k)} is a non-empty string`);
+    assert.ok(scopeMap.isModuleKey(k), `isModuleKey agrees about ${k}`);
+  }
+  // A roster that answered "yes" to everything would make the refusal
+  // unreachable and this whole file vacuous.
+  assert.equal(scopeMap.isModuleKey('definitely-not-a-module'), false);
+});
+
+// ---- the refusal carries it ------------------------------------------------
+
+test('every unknown_module refusal hands back valid: moduleKeys()', () => {
+  const src = fs.readFileSync(GOALS_ROUTE, 'utf8');
+  const sites = [...src.matchAll(/res\.fail\(\s*'unknown_module'[\s\S]{0,200}?\)/g)].map((m) => m[0]);
+  // The count IS the vacuity guard: a regex that silently matched nothing would
+  // make the loop below pass without asserting anything at all.
+  assert.equal(sites.length, 2, `expected 2 unknown_module refusals in goals.js, found ${sites.length}`);
+  for (const site of sites) {
+    assert.match(
+      site, /valid:\s*moduleKeys\(\)/,
+      `an unknown_module refusal without valid: moduleKeys() — /planning-session Phase 2.5 tells agents to read that field:\n${site}`
+    );
+  }
+});
+
+// ---- and the skill still tells agents to read it ---------------------------
+
+test('Phase 2.5 tells the agent the server is the gate and the refusal carries the answer', () => {
+  const skill = fs.readFileSync(SKILL, 'utf8');
+  assert.ok(skill.includes('### Phase 2.5'), 'Phase 2.5 still exists');
+  assert.match(skill, /RUNNING SERVER is the GATE/,
+    'Phase 2.5 must still say the live server, not the checkout, decides a key');
+  assert.match(skill, /`unknown_module` comes back with `valid/,
+    'Phase 2.5 must still point at the field this test pins');
+});
+
+console.log('');
+console.log(`unknown_module carries the live roster (task 1003106): ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);