@bongos/core 1.19.809 → 1.19.810

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.809",
-  "core_contract": "1.19.809",
-  "source_commit": "8a0d6205ab8651338ec9f196b0d2a76457ecd7de",
+  "core_version": "1.19.810",
+  "core_contract": "1.19.810",
+  "source_commit": "a3d5dcdde5918a6ce46742502351896701a5a312",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T05:51:03.923Z",
+  "built_at": "2026-09-17T06:04:48.341Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2710,
-  "tree_sha256": "8ffacf4d6b6f9d1185a0367eef97d3f885c3219caa5f7b483c03e568f6e244cf",
+  "tree_sha256": "43e8bede11fa1d3c211405b457b91c73433af719f13cf34869cd9894607688b7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0fc3cc0ea86f2325096412d389457b095d7e12b175415e0f9bc41d5cd40946a1"
+      "sha256": "559a5a32d7f2bbdfc6059b033898244d10bba1abc6881cc9d42388d135c1a164"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7727,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bce83e06aea9721525e159bbe1446154fcda006c89fdcde14fd6ab46f624366a"
+      "sha256": "85db67c033657807d558c218faa46b3a94719479ca312e38fee928ea8e845d2a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "714b48f38c2da73d5a2353c66228b8f4aa8cd375f7c712a1421f59bb0cf22e09"
+      "sha256": "1ea12b0f66807661d162a59b47b20a2e166b5d356f88a766240c8a573cf95859"
     },
     {
       "path": "public-docs/index.html",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "de8f1f66bf964bfcb8e4fa570f1f873782dfee8d633ff6e599fb894096aecd14"
+      "sha256": "bb39ac6572410567ce0a2881f26b0512df817fd04cec9130792ca24c48e8d02a"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9432,7 +9432,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "f9d3e4e892d11bbe83b0f76c588fc4c76204f6a424257eb0249acf680f85967a"
+      "sha256": "8d7b749edca694b4c9d8a563a4334c7fe3fc7be64c520c3d14c3b63febff132a"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9622,7 +9622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "03b5ce71d6aeab750b5bd2dad14f89d459472a4b42a701b4923bb430cafa384e"
+      "sha256": "a73a30f63258ab08abe959da6d8f31f8428c30c5d49772350beecb72e9131b2f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11942,7 +11942,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "d985570340fb9706224c72ed27a2b9a9a84b985f56d2a45fcac564dc463175d4"
+      "sha256": "e277e0579dd6c8fea459cc5a3b4adf04dda12c95e69a415eeea5cfd2de52d760"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/module-api-changelog.md

@@ -2092,5 +2092,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.807 with no explicit bump. run 35185130913. (task 1002620)
   1.19.809 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.808 with no explicit bump. run 35187322516. (task 1002620)
+  1.19.810 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.809 with no explicit bump. run 35188253911. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.809",
+  "version": "1.19.810",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.809",
+      "version": "1.19.810",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.809",
+  "version": "1.19.810",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-flow.js

@@ -11,8 +11,7 @@
 const { cliClient, requireSession, arg, detectWorktreeName, cardFlagsFromMe } = require('./cli-lib');
 const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal, staleSummaryNotice } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
-const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
-const { matchOne } = require('../../src/bongos/path-match');
+const { isModuleKey, scopeForModule, moduleDriftFiles: computeModuleDrift } = require('../../src/bongos/module-scope-map');
 const { runShipGate } = require('./sandbox-stage');
 const { captureSurpriseLearning, promptSurprise } = require('./ship-surprise.js');
 // task 1003109: the optional `--visual` leg of a ship (goal 1000072).
@@ -270,9 +269,18 @@ async function shipMain() {
   // ---- Module drift check (BV1.R53, task 1422) ----
   // If the task carries a module_key, verify the committed diff doesn't stray
   // into a DIFFERENT module's territory. "You said game, you touched dev-box" is
-  // the semantic violation this catches. Files outside all module scopes (docs,
-  // session logs, general scripts) are allowed — they're cross-cutting. Only
-  // contact with a DIFFERENT module's glob set is refused.
+  // the semantic violation this catches. Files no module owns are allowed —
+  // they're cross-cutting — as is the territory of a CROSS-CUTTING module, which
+  // every craft legitimately writes into. Only contact with a different OWNING
+  // module's glob set is flagged.
+  //
+  // The rule itself lives in module-scope-map.js (moduleDriftFiles) next to the
+  // map it reads, so it can be tested without running a ship (task 1003770). It
+  // used to be inline here, and read "files outside all module scopes (docs,
+  // session logs, general scripts) are allowed" — a premise task 1002989 ended by
+  // giving `methodology` the whole docs/ subtree. Since every ship writes a
+  // session log, the advisory then fired for 25 of the 26 module keys on that log
+  // alone. See CROSS_CUTTING_KEYS for why the glob was not shrunk instead.
   //
   // The check is ADVISORY (warns but does not refuse) on the first cut because
   // the module_key column is new and existing tasks may carry a broader diff scope
@@ -280,24 +288,26 @@ async function shipMain() {
   // ac.module_key comes from getActiveClaimsForBuilder (t.module_key in the join).
   const enforceModule = args.includes('--enforce-module');
   if (ac.module_key && isModuleKey(ac.module_key) && committedFiles.length > 0) {
-    const declaredScope = scopeForModule(ac.module_key);
-    const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map');
-    const moduleDriftFiles = committedFiles.filter((f) => {
-      if (declaredScope && matchOne(f, declaredScope.globs)) return false;
-      for (const [key, entry] of Object.entries(MODULE_SCOPE_MAP)) {
-        if (key === ac.module_key) continue;
-        if (matchOne(f, entry.globs)) return true;
-      }
-      return false;
-    });
+    const moduleDriftFiles = computeModuleDrift(ac.module_key, committedFiles);
     if (moduleDriftFiles.length > 0) {
+      // Name the module's REAL territory rather than guessing 'modules/<key>/'.
+      // That guess is wrong for every module whose code has not been carved out
+      // yet (ADR 0083) — kernel lives in src/bongos/, methodology in docs/ — so
+      // the advisory used to tell those builders to move their work somewhere
+      // their module does not own. scopeForModule is the roster's own answer.
+      const declared = scopeForModule(ac.module_key);
+      const territory = declared && declared.globs.length
+        ? declared.globs.slice(0, 4).join(', ') + (declared.globs.length > 4 ? `, +${declared.globs.length - 4} more` : '')
+        : `modules/${ac.module_key}/`;
       const msg = [
         `\n⚠ Module drift detected: task is scoped to '${ac.module_key}' but ${moduleDriftFiles.length} file(s) touch a different module:`,
         ...moduleDriftFiles.map((f) => `  - ${f}`),
         '',
+        `  '${ac.module_key}' owns: ${territory}`,
+        '',
         enforceModule
-          ? 'Refused (--enforce-module). Confine your changes to modules/' + ac.module_key + '/ or clear the module_key label.'
-          : 'Advisory — ship proceeds, but consider confining your changes to modules/' + ac.module_key + '/.',
+          ? `Refused (--enforce-module). Confine your changes to that territory, or clear the module_key label.`
+          : 'Advisory — ship proceeds, but consider confining your changes to that territory.',
       ].join('\n');
       console.log(msg);
       if (enforceModule) process.exit(1);

package/src/bongos/module-scope-map.js

@@ -37,7 +37,7 @@
 'use strict';
 
 const { PROTECTED_GLOBS } = require('./permission-path-check');
-const { touchesOverlap } = require('./path-match');
+const { touchesOverlap, matchOne } = require('./path-match');
 
 // key → the path globs that constitute the module's code (exact paths or
 // trailing-'/' subtree prefixes). See the header for the auto-tighten contract.
@@ -486,6 +486,62 @@ function scopeIncludesProtected(keys) {
   return (keys || []).some((k) => isProtectedModule(k) === true);
 }
 
+// ---- CROSS-CUTTING MODULES (task 1003770) ----
+//
+// A module whose territory EVERY craft legitimately writes into, whatever its own
+// task is scoped to. Distinct from SHARED_GLOBS above: a shared glob is owned by
+// nobody, while a cross-cutting module genuinely owns its paths — `methodology`
+// really is the owner of docs/ — it is just that owning them cannot mean other
+// modules are trespassing when they write there.
+//
+// WHAT THIS IS AND IS NOT FOR. This narrows ONE consumer: the ship-time module-
+// drift advisory (moduleDriftFiles below), whose question is "you said game, did
+// you touch dev-box?" — module-to-module confusion. It does NOT touch the goal
+// scope wall, claim collisions (touchesOverlap), or the protected-path wall.
+// Those keep counting methodology's territory as methodology's.
+//
+// WHY IT WAS NEEDED. Task 1002989 gave `methodology` the whole docs/ subtree.
+// Since every ship writes a session log under docs/session-logs/, that made the
+// advisory fire on 25 of the 26 module keys for the session log ALONE — it warned
+// on essentially every module-keyed ship, which is not a signal, it is weather.
+//
+// WHY NOT SHRINK THE GLOB INSTEAD. The glob format has no wildcards (see the
+// header), so "all of docs/ except session-logs" is inexpressible; enumerating
+// docs/ subtree-by-subtree would rot on the next doc.
+//
+// THE BAR, deliberately high — "every task legitimately writes here as a normal
+// part of shipping". `devsecops` is NOT on this list even though it owns
+// package.json: a task that edits .github/, .husky/ or fitness.js while scoped to
+// another module IS the confusion this advisory exists to surface, and lockfile
+// churn is occasional rather than universal.
+const CROSS_CUTTING_KEYS = Object.freeze(['methodology']);
+
+function isCrossCuttingModule(key) {
+  return CROSS_CUTTING_KEYS.includes(key);
+}
+
+// Pure: of `files`, the ones that stray into a DIFFERENT module's territory for a
+// task scoped to `moduleKey`. Extracted from scripts/gds/ship-flow.js (BV1.R53,
+// task 1422) so the rule is testable without running a ship.
+//
+// A file is drift only if it is (a) outside the declared module's own globs and
+// (b) inside some OTHER module's globs — a path no module owns is cross-cutting
+// and always fine. Cross-cutting modules are skipped in (b): their territory
+// never makes a file someone else's. An unknown moduleKey yields no drift, since
+// there is no declared scope to stray from.
+function moduleDriftFiles(moduleKey, files) {
+  const declaredScope = scopeForModule(moduleKey);
+  if (!declaredScope) return [];
+  return (files || []).filter((file) => {
+    if (matchOne(file, declaredScope.globs)) return false;
+    for (const [key, entry] of Object.entries(MODULE_SCOPE_MAP)) {
+      if (key === moduleKey || isCrossCuttingModule(key)) continue;
+      if (matchOne(file, entry.globs)) return true;
+    }
+    return false;
+  });
+}
+
 module.exports = {
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
@@ -498,5 +554,6 @@ module.exports = {
   isProtectedModule,
   protectedModules,
   globsForModules,
+  moduleDriftFiles,
   scopeIncludesProtected,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.809'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.810'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -291,3 +291,99 @@ test('the gap this closed: an honest task declaring its own test is now authoriz
   const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'thetes');
   assert.equal(r.ok, true, r.reason);
 });
+
+
+// ---- module drift advisory: cross-cutting territory (task 1003770) ----
+
+const SESSION_LOG = 'docs/session-logs/2026-09-16-task-1003770-example.md';
+
+test('THE BUG: a module-scoped task writing a session log is not drift (task 1003770)', () => {
+  // The row's own acceptance criterion. Task 1002989 gave `methodology` the whole
+  // docs/ subtree, and every ship writes a session log under it — so the advisory
+  // started firing on almost every module-keyed ship.
+  for (const key of scope.moduleKeys()) {
+    assert.deepEqual(
+      scope.moduleDriftFiles(key, [SESSION_LOG]), [],
+      `a '${key}' task writing a session log must not read as drift`,
+    );
+  }
+});
+
+test('the regression this replaces: the OLD rule flagged 25 of 26 keys on that one file', () => {
+  // Reproduce the pre-fix predicate — identical except that it does not skip
+  // cross-cutting modules — and prove it fails where the new one passes. Without
+  // this, the test above could pass for the wrong reason (e.g. nobody owning
+  // docs/) and go quietly vacuous if the glob moved again.
+  const { matchOne } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
+  const oldRule = (moduleKey, files) => {
+    const declared = scope.scopeForModule(moduleKey);
+    return files.filter((file) => {
+      if (declared && matchOne(file, declared.globs)) return false;
+      return Object.entries(scope.MODULE_SCOPE_MAP)
+        .some(([k, e]) => k !== moduleKey && matchOne(file, e.globs));
+    });
+  };
+  const flaggedBefore = scope.moduleKeys().filter((k) => oldRule(k, [SESSION_LOG]).length);
+  assert.ok(
+    flaggedBefore.length >= 20,
+    `expected the old rule to flag most keys on a session log, it flagged ${flaggedBefore.length}`,
+  );
+  assert.ok(flaggedBefore.includes('lifecycle'), 'sanity: lifecycle was among them');
+});
+
+test('a cross-cutting module owns its paths everywhere EXCEPT the drift advisory', () => {
+  // The narrowness is the point: this must not become a hole in the scope wall.
+  // methodology still genuinely owns docs/ — only moduleDriftFiles looks away.
+  // Asserted through behaviour, not through the roster constant: the constant is
+  // internal (nothing outside the module reads it), and "docs/ stops counting as
+  // someone else's territory" is the property that actually matters.
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['docs/architecture.md']), []);
+  assert.ok(scope.scopeForModule('methodology').globs.includes('docs/'));
+  const owners = Object.entries(scope.MODULE_SCOPE_MAP)
+    .filter(([, e]) => e.globs.includes('docs/'))
+    .map(([k]) => k);
+  assert.deepEqual(owners, ['methodology'], 'docs/ is still owned, not orphaned');
+  // And the goal scope wall still places docs/ inside methodology, unchanged.
+  assert.equal(gsc.check(['methodology'], ['docs/architecture.md'], 'thetes').ok, true);
+});
+
+test('real cross-module contact is still flagged — the signal the advisory exists for', () => {
+  // "You said lifecycle, you touched dev-box."
+  assert.deepEqual(
+    scope.moduleDriftFiles('lifecycle', ['modules/dev-box/app/src/box-controller.js']),
+    ['modules/dev-box/app/src/box-controller.js'],
+  );
+  // Its own territory, and territory no module owns, both stay quiet.
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['modules/lifecycle/rot.js']), []);
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['some/unowned/path.txt']), []);
+  // A mixed diff reports only the straying file.
+  assert.deepEqual(
+    scope.moduleDriftFiles('lifecycle', ['modules/lifecycle/rot.js', SESSION_LOG, 'modules/discord/discord-bot.js']),
+    ['modules/discord/discord-bot.js'],
+  );
+});
+
+test('devsecops is deliberately NOT cross-cutting (task 1003770)', () => {
+  // The bar is "every task legitimately writes here as part of shipping". Editing
+  // .github/ or fitness.js while scoped elsewhere IS the confusion being surfaced,
+  // so this stays a signal. Widening the cross-cutting roster to devsecops would
+  // red these, which is the point: it should take a deliberate edit, not a shrug.
+  for (const f of ['.github/workflows/unit.yml', 'scripts/gds/fitness.js', 'package.json']) {
+    assert.deepEqual(scope.moduleDriftFiles('lifecycle', [f]), [f], `${f} must still read as drift`);
+  }
+  // And exactly one module is cross-cutting: every other key's territory still
+  // counts against a lifecycle-scoped task. Proven over the whole roster rather
+  // than by naming the constant, so adding a second cross-cutting module fails here.
+  const quiet = scope.moduleKeys().filter((k) => k !== 'lifecycle'
+    && scope.moduleDriftFiles('lifecycle', scope.scopeForModule(k).globs).length === 0);
+  assert.deepEqual(quiet, ['methodology']);
+});
+
+test('moduleDriftFiles degrades safely on junk input', () => {
+  // ship-flow calls this with whatever the claim carries; it must never throw.
+  assert.deepEqual(scope.moduleDriftFiles('not-a-module', ['modules/dev-box/app.js']), [],
+    'an unknown key has no declared scope to stray from');
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', []), []);
+  assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
+  assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
+});