@bongos/core 1.19.840 → 1.19.842

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.840",
-  "core_contract": "1.19.840",
-  "source_commit": "47fbba53d86033101f57cf1e1a85aef7367fe320",
+  "core_version": "1.19.842",
+  "core_contract": "1.19.842",
+  "source_commit": "ffa8d1ce17675d5981142ca6588ef641d0893058",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T17:45:41.665Z",
+  "built_at": "2026-09-17T18:21:47.399Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 495,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2262,
+    "functional_verbatim": 2266,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2783,
-  "tree_sha256": "5ddd99652c37c0ad56f34d618732a671733aed9b055c1c4ee161135581d0c80a",
+  "file_count": 2787,
+  "tree_sha256": "204ee5631e422b90ff1d79a7fde81706ca492bea501801a162421ebd04f6bfdb",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -404,6 +404,11 @@
       "mode": "0000644",
       "sha256": "9bdd8eb1fbfb9053ed0fb921c0f669dcdaad2fe8b2629ce4cc9457dca995afbe"
     },
+    {
+      "path": "config/scheduled-routines.json",
+      "mode": "0000644",
+      "sha256": "9086dbccb8319aaca6b88757249bc3a5001612f4b5e2afb47ac41e9dfe4fd28f"
+    },
     {
       "path": "docker-compose.yml",
       "mode": "0000644",
@@ -2572,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f8fa8c024b4d6741ea672a7be33957d6cc58c6b85867ef2b5499bcc31fdf4b50"
+      "sha256": "033de93b8ea7781edf94b6b1146741c2bde76443ecf7b6c8b1bf47d8919d6bab"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4517,7 +4522,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "ec125c2bfba680c7645dda0b65dd6ece183dd57ceecdb5616ea2b8b34b776e56"
+      "sha256": "aba8a8b1ce22708f5a7c05a64cbb4d1a08db295339a09df3c50a91f2735c1d47"
     },
     {
       "path": "modules/government/ranks.js",
@@ -6514,15 +6519,20 @@
       "mode": "0000644",
       "sha256": "bf4a392ce4c545feb246b818ad2b37dd5e92050538d5202fb8980941d0ec52c9"
     },
+    {
+      "path": "modules/provisioning/pollers/liveness-notify.js",
+      "mode": "0000644",
+      "sha256": "b359eb2c731563e3570f8fbea7128f78070e7bd5737110f739a2b2fcb2cf382b"
+    },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
       "mode": "0000644",
-      "sha256": "f47e30b7d4bc1275f65e29a1d9f987c7f20e6baa0a6c441fb4ddbb56f11fe58f"
+      "sha256": "90db999a2e1d3dec2e3910281e2e5dccd55cf294d7c5c38233456c29d71bacd3"
     },
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "b70d138fb6ed6f0fe4f04d2a37a7a195364250ca10b46a933c5aad0057061c10"
+      "sha256": "c2e7574b84038bd2f4da93d5ec54f8e577353d9c37e5585bff1dd9b8f855cccf"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6569,10 +6579,15 @@
       "mode": "0000644",
       "sha256": "cb2ca3bdf6cd99ee66d5242709fed3c167840a90cff9efe83ddb193c00c9719e"
     },
+    {
+      "path": "modules/provisioning/tests/liveness-notify.mjs",
+      "mode": "0000644",
+      "sha256": "27c83fd37966796a6dd0dd55c69b434e77f7782bebe7452706ff00cc99308db8"
+    },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
       "mode": "0000644",
-      "sha256": "ead476fd677f78a3daed878fe8916acecbdac25e1ae6e29f340a8d08428c8fbf"
+      "sha256": "c5f7c2d8880f9bfd45346ac8a7b24e3391daa9d96aeffad806d074ac4fffabf4"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -7877,12 +7892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d54803c0123c3ee0b857092be850581f787ed85dc36cae70e737977f14f0356b"
+      "sha256": "21b80f9aba47da61edcb4a374ad4aad35f2e5c563cccb1daae278b6d892d0255"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0a21605b0152921f84f2e67716df7e251b09a23b24c3b9569d3332d8d98e754c"
+      "sha256": "61f48c57b02632310e7ba92115fdc6939efe7967f2ee7542fa7b12834f8af6c2"
     },
     {
       "path": "public-docs/index.html",
@@ -8827,7 +8842,7 @@
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "3663bea0a86f5f0a32d4bd48d98a78405fcc7a2840b4db081cade8601e9efa5b"
+      "sha256": "da74b7bf9aa1453eb56f922f3733aa06ac2d00216f668a06dc134934f1d4fde7"
     },
     {
       "path": "scripts/gds/publish-watch.js",
@@ -9812,7 +9827,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8bfa67a85b56ce33dbb502537edced8bf39de30551c7949bf3aa9460a1deffa3"
+      "sha256": "84e310a550189d0d3d86f825cc04d61d81e0c0dc78428056661357a1a5076e74"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9954,6 +9969,11 @@
       "mode": "0000644",
       "sha256": "919ca0ea3fe5f78a194781f6b634b9da23212073cf0c7cbe8ae36a65cc3fecdb"
     },
+    {
+      "path": "tests/agents_roster.mjs",
+      "mode": "0000644",
+      "sha256": "acc25f4d72cb22719d6977f939b41f9f17e0d102880976699b6ebcda1c64c523"
+    },
     {
       "path": "tests/agents_routes.mjs",
       "mode": "0000644",
@@ -11432,7 +11452,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "1d8502e8d25eedb54ed0fcbe3ce1a0fe87495d03bd8bda7322e55d6004669a63"
+      "sha256": "c3c72c3a2cf970222c80051787df7fd7d155b5abd2f80b797a6a58bf5e95e0eb"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/config/scheduled-routines.json

@@ -0,0 +1,29 @@
+{
+  "_note": "Scheduled-routines portability manifest (task 2014 / BONGOS-V1, ADR 0115). Declares, per autonomous routine under `.claude/scheduled-tasks/<key>/`, how it ports to a self-hosted, multi-builder instance: its SCOPE, whether it's ON by default, its cadence, and whether it needs the autonomy flag armed. THE CONTRACT: every routine is INSTANCE-WIDE — one scheduled run per instance (a designated scheduler / control plane), NOT one cron per builder. A routine's per-builder EFFECT (bfg scores each builder; newcomer-floor restocks per discipline) comes from iterating the builder set inside the routine body — there is no per-builder schedule in v1. A fresh instance inherits this whole set from the core template; the operator opts in/out + sets cadence HERE, without editing the routine. Builders do not schedule their own routines; their involvement is governed by their per-builder settings (autonomy opt-in, wandering), not this file. Cadence values are hints for the scheduler; the actual cron lives in the operator's scheduler config. `requiresAutonomy: true` means the routine is a no-op until the instance arms the autonomy flag (<PREFIX>_AUTONOMY_ENABLED) — those default OFF.",
+  "defaults": { "scope": "instance-wide", "enabled": true, "requiresAutonomy": false },
+  "routines": {
+    "artifact-audit":        { "scope": "instance-wide", "enabled": true,  "cadence": "weekly",  "requiresAutonomy": false, "note": "deterministic; task 1003200. Reads main's own history + tree, so it runs in CI (a vendored core is not a git repo) — .github/workflows/artifact-audit.yml." },
+    "artifact-staleness":    { "scope": "instance-wide", "enabled": true,  "cadence": "daily",   "requiresAutonomy": false, "note": "deterministic; task 1001930 / ADR 0110 pt.5. INSTANCE-SIDE ONLY, and the opposite of artifact-audit above: it reads the gitignored deploy-generated files on the serving machine's disk, which a CI checkout legitimately does not have — so it declares no cadence in its SKILL.md and no workflow fires it. This cadence is the hint the operator's own scheduler reads." },
+    "bfg":                    { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "Parts A+B read-only + always-on; Part C (cross-builder write) is separately gated by BFG_WRITE_ENABLED + a provisioned principal token." },
+    "bfg-session-eval":       { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
+    "box-dormant-reclaim":    { "scope": "instance-wide", "enabled": false, "cadence": "daily",  "requiresAutonomy": false, "note": "RETIRED with the dev-box module (goal 1000091, task 1003886). Held OFF so the fleet is inert while the removal lands; the routine body is deleted by the dev-box teardown tasks." },
+    "box-idle-suspend":       { "scope": "instance-wide", "enabled": false, "cadence": "hourly", "requiresAutonomy": false, "note": "RETIRED with the dev-box module (goal 1000091, task 1003886). Held OFF so the fleet is inert while the removal lands; the routine body is deleted by the dev-box teardown tasks." },
+    "core-update-subscription": { "scope": "instance-wide", "enabled": true, "cadence": "15min", "requiresAutonomy": true, "note": "Patch-only auto-upgrade of subscribed consumer instances (ADR 0136 / task 2150). Default OFF + opt-in: the roster (config/update-subscriptions.json) ships empty, so this is a no-op until an operator arms autonomy AND lists an instance. Every upgrade is health-gated with auto-rollback (task 2149). CADENCE (task 1003674): this is the knob that decides how long a published release waits before a subscribed instance takes it — at 'daily' a builder's ship reached the live site up to 24h late, because everything upstream is already fast (CI publishes to npm within ~2 min of merge) and this sweep was the only slow step. 15min is the worst-case lag, not a re-check cost: the sweep exits immediately when the registry has nothing newer. FLOOR ~5min: an upgrading run takes ~2 min, and runs must not overlap. Installing the period is the operator's half — see docs/recipes/upgrading-the-core.md." },
+    "dep-audit-nightly":      { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
+    "diagram-drift":          { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "idea-triage-nightly":    { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
+    "main-audit":             { "scope": "instance-wide", "enabled": true,  "cadence": "on-merge", "requiresAutonomy": false, "note": "Trust-boundary backstop — audits commits landed on main." },
+    "newcomer-floor":         { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "newcomer-generator":     { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "overnight-builder":      { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true, "note": "Autonomous claim+ship; OFF until the instance arms autonomy." },
+    "overnight-code-review":  { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
+    "peer-vote-tally":        { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "rank-roles-audit":       { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "deterministic; read-only; never fatal at boot (idea 1000622) — task 1002873" },
+    "redteam-weekly":         { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false, "note": "deterministic; task 1003128" },
+    "repo-simplify-sweep":    { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
+    "security-review-weekly": { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
+    "skill-usage-review":     { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
+    "stale-claim-release":    { "scope": "instance-wide", "enabled": true,  "cadence": "hourly", "requiresAutonomy": false },
+    "stranded-rows":          { "scope": "instance-wide", "enabled": true,  "requiresAutonomy": false, "note": "no cadence: nothing schedules it yet, so it is run by hand — declaring one with no cron firing it fails fitness Check 25 (task 1003775)" }
+  }
+}

package/docs/module-api-changelog.md

@@ -2154,5 +2154,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.838 with no explicit bump. run 35252591179. (task 1002620)
   1.19.840 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.839 with no explicit bump. run 35254616836. (task 1002620)
+  1.19.841 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.840 with no explicit bump. run 35257419225. (task 1002620)
+  1.19.842 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.841 with no explicit bump. run 35258288930. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -89,6 +89,7 @@
     { "glob": "docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md", "group": "docs", "why": "this gate's own ADR" },
     { "glob": "CLAUDE.md", "group": "docs", "why": "the methodology core" },
     { "glob": ".claude/hooks/", "group": "automation", "why": "local automation that could weaken a gate" },
-    { "glob": ".claude/settings.json", "group": "automation", "why": "local automation that could weaken a gate" }
+    { "glob": ".claude/settings.json", "group": "automation", "why": "local automation that could weaken a gate" },
+    { "glob": "config/scheduled-routines.json", "group": "automation", "why": "task 1002500. The ROUTINE SWITCHBOARD: per routine it decides enabled, cadence and requiresAutonomy — so an edit here can arm overnight-builder (autonomous claim+ship) or silence main-audit, the post-merge trust-boundary backstop ADR 0043 relies on. Sibling of .claude/hooks/ and .claude/settings.json above: the routine BODIES under .claude/scheduled-tasks/ are the autonomy module's source surface and stay unprotected, because protectedness derives per module and walling them is a separate policy decision (the .claude/agents/ precedent recorded in tests/government_protected_surfaces.mjs). This file is kernel-owned territory (module-scope-map's kernel key carries 'config/'), which is already protected, so registering it widens no module wall. The set is computed, not listed: the routine-switch tripwire in tests/government_protected_surfaces.mjs re-detects every config/*.json declaring routine switches and reds if one is unregistered." }
   ]
 }

package/modules/provisioning/pollers/liveness-notify.js

@@ -0,0 +1,110 @@
+'use strict';
+
+// modules/provisioning/pollers/liveness-notify.js — the owner-facing half of the
+// liveness sweep: when does an outage become something worth saying out loud, and
+// in what words (task 1002894, from idea 1000703; the owner's YES of 2026-08-12,
+// scoped out of task 1002696).
+//
+// WHY. The sweep has knocked on every active project's /healthz every five minutes
+// since task 1002696 and told nobody — an owner learned their project had stopped
+// answering by opening the projects page. This turns that record into one message
+// on the DOWN edge, and one when it comes back.
+//
+// THE THREE RULES that keep a heartbeat from becoming a siren:
+//   * EDGE, not state. The fall is only visible in the row's PRIOR last_verified_up,
+//     which recordLivenessProbe now returns. A row that was already down when this
+//     process started has no edge to see, so a restarted control plane re-posts
+//     nothing — the notice state is deliberately in memory, seeded only by an edge
+//     this process observed.
+//   * CONFIRM before speaking. One failed probe is a blip; the notice waits for the
+//     outage to survive a second consecutive sweep, and a project that recovers in
+//     between was never announced, so nothing needs unsaying.
+//   * COLLAPSE a fan-out. When several projects fall in the same sweep, the cause is
+//     almost always on this side — a control-plane restart, a prober-side network
+//     blip — so they become ONE message that says so, never one per project.
+//
+// The copy is owner-audience and names a project only when the project is public on
+// the platform's map; a private one is described, never identified.
+
+const { execFile } = require('node:child_process');
+const path = require('node:path');
+
+// Consecutive down probes before an outage is announced. Two ≈ one sweep interval
+// of patience, which is what makes a single refused connection cost nothing.
+const DOWN_CONFIRM = Number(process.env.PROVISIONING_LIVENESS_DOWN_CONFIRM) || 2;
+// Simultaneous falls that mean "look at the platform, not the projects".
+const FLEET_GUARD = Number(process.env.PROVISIONING_LIVENESS_FLEET_GUARD) || 3;
+// scripts/discord/post.js is invoked from the repo root regardless of cwd.
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
+
+// What the owner reads. `name` is null for a project that is not public — it is
+// described rather than identified, so a private project's slug never rides a
+// Discord channel. A `count` with no name is the collapsed fleet message. PURE.
+function noticeText({ kind, name = null, count = 0 } = {}) {
+  if (!name && count > 1) {
+    return kind === 'up'
+      ? `✅ All ${count} projects that went quiet are answering again.`
+      : `⚠️ ${count} projects stopped answering at the same moment. When that many go quiet together it is usually the platform's own check that is having trouble, not the projects themselves — worth a look here first.`;
+  }
+  const who = name ? `**${name}**` : 'A private project';
+  if (kind === 'up') return `✅ ${who} is answering again.`;
+  return `⚠️ ${who} has stopped answering. The platform knocked twice in a row and heard nothing back. It will say so here when the project answers again.`;
+}
+
+// One collapsed message, or one per project — never both. PURE.
+function collapse(rows, kind, fleetGuard) {
+  if (!rows.length) return [];
+  if (rows.length >= fleetGuard) return [{ kind, ids: rows.map((r) => r.id), text: noticeText({ kind, count: rows.length }) }];
+  return rows.map((r) => ({ kind, ids: [r.id], text: noticeText({ kind, name: r.isPublic ? r.slug : null }) }));
+}
+
+// The decision, given this sweep's observations ({ id, slug, isPublic, up, prevUp })
+// and the notice state carried between sweeps. MUTATES `state` (a Map, id → { streak,
+// notified }) and returns what to post; everything else about it is pure, so the
+// rules above are unit-tested without a sweep, a database or a network.
+function planNotices(observations, state, { confirm = DOWN_CONFIRM, fleetGuard = FLEET_GUARD } = {}) {
+  const downs = [], ups = [];
+  for (const o of observations || []) {
+    const prev = state.get(o.id);
+    if (o.up) {
+      // Only a project we actually announced gets an all-clear; a blip that never
+      // reached a notice just drops its streak.
+      if (prev && prev.notified) ups.push(o);
+      state.delete(o.id);
+      continue;
+    }
+    let streak;
+    if (prev) streak = prev.streak + 1;
+    else if (o.prevUp === true) streak = 1;   // the fall, observed in this process
+    else continue;                            // already down before we were watching
+    const notified = !!(prev && prev.notified);
+    if (!notified && streak >= confirm) downs.push(o);
+    state.set(o.id, { streak, notified: notified || streak >= confirm });
+  }
+  const notices = [...collapse(downs, 'down', fleetGuard), ...collapse(ups, 'up', fleetGuard)];
+  const collapsedCount = (list) => (list.length >= fleetGuard ? list.length : 0);
+  return { notices, suppressed: collapsedCount(downs) + collapsedCount(ups) };
+}
+
+// Fire-and-forget to Discord #ship-news — the owner-facing feed the build broadcast
+// already uses (owner's call, 2026-09-17: no new channel, no new webhook to place).
+// Mirrors fireDiscordBroadcast in src/bongos/routes/builders.js: non-blocking,
+// CHAT_DRY_RUN=1 short-circuits for the smoke path, and a Discord hiccup can never
+// stall a sweep tick.
+function postNotice(notice, { log = console.log } = {}) {
+  const text = notice && notice.text;
+  if (!text) return;
+  if (process.env.CHAT_DRY_RUN === '1') {
+    log(`[liveness] [broadcast dry-run] would post: ${text}`);
+    return;
+  }
+  try {
+    execFile('node', ['scripts/discord/post.js', text], { cwd: REPO_ROOT, timeout: 10_000 }, (err) => {
+      if (err) log(`[liveness] notice broadcast failed (non-blocking): ${err.message}`);
+    });
+  } catch (e) {
+    log(`[liveness] notice broadcast failed (non-blocking): ${e && e.message ? e.message : e}`);
+  }
+}
+
+module.exports = { planNotices, noticeText, postNotice, DOWN_CONFIRM, FLEET_GUARD };

package/modules/provisioning/pollers/liveness-sweep.js

@@ -27,6 +27,19 @@ const dns = require('node:dns').promises;
 const { Agent: UndiciAgent } = require('undici');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
+const { planNotices, postNotice } = require('./liveness-notify');
+
+// Notice state between sweeps (task 1002894): id → { streak, notified }. In memory
+// on purpose — it is seeded only by a fall this process observed, which is exactly
+// what stops a restarted control plane re-announcing an outage it arrived to find.
+const noticeState = new Map();
+function resetNoticeState() { noticeState.clear(); }
+
+// Name a project in an owner-facing message only when it is public on the platform's
+// map; a private or stealth one is described, never identified.
+function isPublicProject(row) {
+  try { return provisioning.effectiveSettings(row).visibility === 'public'; } catch (_) { return false; }
+}
 
 // ~5-minute cadence — matches the display contract's "fresh ≤ 2 cadences" window
 // and is cheap: one HTTP GET per active instance. Override for tests/ops.
@@ -198,8 +211,8 @@ async function sweepOnce(deps = {}) {
       pin = gate.pin || null;
     }
     const probe = await probeHealthz(url, { timeoutMs: deps.timeoutMs, fetchImpl: deps.fetchImpl, pin });
-    await provisioning.recordLivenessProbe(db, row.id, probe.up);
-    return { row, probed: true, ...probe };
+    const rec = await provisioning.recordLivenessProbe(db, row.id, probe.up);
+    return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 
   const probed = results.filter((r) => r.probed);
@@ -217,6 +230,17 @@ async function sweepOnce(deps = {}) {
   // Nothing active ⇒ nothing to say. A vanilla control plane would otherwise emit
   // an empty account every five minutes forever.
   if (rows.length) log(formatSweepLine(out));
+
+  // Tell the owner what changed (task 1002894). Best-effort like everything else
+  // here: a broadcast that throws is logged and the tick still returns its account.
+  const notify = deps.notify || ((n) => postNotice(n, { log }));
+  const plan = planNotices(
+    probed.map((r) => ({ id: r.row.id, slug: r.row.slug, isPublic: isPublicProject(r.row), up: !!r.up, prevUp: r.prevUp })),
+    noticeState
+  );
+  for (const notice of plan.notices) {
+    try { notify(notice); } catch (e) { log(`[liveness] notice failed (non-blocking): ${e && e.message ? e.message : e}`); }
+  }
   return out;
 }
 
@@ -255,6 +279,7 @@ module.exports = {
   stop,
   // exported for tests
   sweepOnce,
+  resetNoticeState,
   probeHealthz,
   healthzUrl,
   formatSweepLine,

package/modules/provisioning/provisioning.js

@@ -979,7 +979,7 @@ async function clearReleasedDomains(db, id) {
 // against it would only ever record a false "down". `limit` is a runaway guard.
 async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   const { rows } = await db.query(
-    `SELECT id, slug, domain, port FROM provisioning_instances
+    `SELECT id, slug, domain, port, settings FROM provisioning_instances
       WHERE status = 'active'
       ORDER BY id
       LIMIT $1`,
@@ -988,16 +988,16 @@ async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   return rows;
 }
 
-// Record ONE probe observation. Deliberately narrow: it writes the two overlay
-// columns and nothing else — not `status`, and not `updated_at` either, so a
-// 5-minute heartbeat can never reshuffle the owner's updated_at-ordered card list
-// or fake activity on an instance nobody touched.
+// Record ONE probe observation. Deliberately narrow: it writes the two overlay columns
+// and nothing else — not `status`, and not `updated_at` either, so a 5-minute heartbeat
+// can never reshuffle the owner's updated_at-ordered card list or fake activity on an
+// instance nobody touched. `prev_up` rides the RETURNING (task 1002894): the FALL is visible
+// only in the value this write replaces — one statement, so no separate SELECT races a sweep.
 async function recordLivenessProbe(db, id, up) {
   const { rows } = await db.query(
-    `UPDATE provisioning_instances
-        SET last_verified_at = now(), last_verified_up = $2
-      WHERE id = $1
-      RETURNING id, last_verified_at, last_verified_up`,
+    `UPDATE provisioning_instances p SET last_verified_at = now(), last_verified_up = $2
+       FROM (SELECT id, last_verified_up FROM provisioning_instances WHERE id = $1) prev WHERE p.id = prev.id
+      RETURNING p.id, p.last_verified_at, p.last_verified_up, prev.last_verified_up AS prev_up`,
     [id, !!up]
   );
   return rows[0] || null;

package/modules/provisioning/tests/liveness-notify.mjs

@@ -0,0 +1,199 @@
+// modules/provisioning/tests/liveness-notify.mjs
+//
+// The owner-facing outage notice the liveness sweep posts (task 1002894, from
+// idea 1000703). The sweep has probed every active instance since task 1002696 and
+// told nobody. Covered here:
+//   • planNotices — the edge rules: one notice per outage, silence afterwards, a
+//     single-sweep blip never posts, a restarted poller never re-posts a fall it
+//     did not see, recovery only after a down notice actually went out
+//   • the fleet guard — many falls at once collapse into ONE message, because that
+//     shape is the platform's own checker, not N projects
+//   • noticeText — owner-audience copy that never names a non-public project
+//   • sweepOnce — the notices ride the sweep, and a broadcast that throws cannot
+//     stall a tick
+//
+// DB-free, network-free: `db` is a recording fake and `notify` is injected.
+//
+// Run standalone: node modules/provisioning/tests/liveness-notify.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+// ESM named imports, not createRequire: knip cannot trace a require()'d export from a
+// test, so a test-only export would read as dead code in the CI ratchet.
+import { planNotices, noticeText, DOWN_CONFIRM, FLEET_GUARD } from '../pollers/liveness-notify.js';
+
+const require = createRequire(import.meta.url);
+const liveness = require('../pollers/liveness-sweep.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// One observation of one instance in one sweep. prevUp is what the row said
+// BEFORE this probe was recorded — the transition is only visible there.
+const obs = (over = {}) => ({ id: 1, slug: 'mercury', isPublic: true, up: false, prevUp: true, ...over });
+// Drive N sweeps through one state Map and collect what each would post.
+function sweeps(observations, { state = new Map(), opts = {} } = {}) {
+  return observations.map((row) => planNotices([].concat(row), state, opts).notices);
+}
+
+console.log('planNotices (the edge rules):');
+
+t('a fall posts exactly ONE notice, after the outage is confirmed, then stays quiet', () => {
+  assert.equal(DOWN_CONFIRM >= 2, true, 'one probe is a blip, not an outage');
+  const rounds = sweeps([
+    obs(),                                   // the fall: prior up, now down
+    obs({ prevUp: false }),                  // still down — confirms it
+    obs({ prevUp: false }),                  // and again
+    obs({ prevUp: false }),
+  ]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 0, 0]);
+  assert.equal(rounds[1][0].kind, 'down');
+  assert.match(rounds[1][0].text, /mercury/);
+});
+
+t('a one-sweep blip never posts — it recovers before the outage is confirmed', () => {
+  const rounds = sweeps([obs(), obs({ up: true, prevUp: false })]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 0], 'nothing was said, so nothing needs unsaying');
+});
+
+t('a restarted poller never re-posts an outage that fell before it started', () => {
+  // Fresh state (the restart) and a row that is ALREADY down: no edge to see.
+  const rounds = sweeps([obs({ prevUp: false }), obs({ prevUp: false }), obs({ prevUp: false })]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 0, 0]);
+});
+
+t('recovery posts once, and only when a down notice actually went out', () => {
+  const state = new Map();
+  const rounds = sweeps([obs(), obs({ prevUp: false }), obs({ up: true, prevUp: false }), obs({ up: true, prevUp: true })], { state });
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 1, 0]);
+  assert.equal(rounds[2][0].kind, 'up');
+  assert.equal(state.size, 0, 'a healed instance leaves no state behind');
+});
+
+t('a second outage on the same instance posts again — the notice is per outage, not per lifetime', () => {
+  const state = new Map();
+  const rounds = sweeps([obs(), obs({ prevUp: false }), obs({ up: true, prevUp: false }), obs(), obs({ prevUp: false })], { state });
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 1, 0, 1]);
+  assert.equal(rounds[4][0].kind, 'down');
+});
+
+t('the fleet guard collapses a mass fall into ONE message and never fans out', () => {
+  const state = new Map();
+  const fleet = Array.from({ length: FLEET_GUARD }, (_, i) => ({ id: i + 1, slug: `p${i + 1}`, isPublic: true, up: false, prevUp: true }));
+  assert.equal(planNotices(fleet, state).notices.length, 0, 'still unconfirmed on the first sweep');
+  const second = planNotices(fleet.map((r) => ({ ...r, prevUp: false })), state);
+  assert.equal(second.notices.length, 1);
+  assert.equal(second.suppressed, FLEET_GUARD);
+  assert.match(second.notices[0].text, new RegExp(`${FLEET_GUARD} projects`));
+  assert.doesNotMatch(second.notices[0].text, /p1|p2/, 'a fleet-wide message names no project');
+  // …and the recovery collapses the same way, rather than posting one per project.
+  const back = planNotices(fleet.map((r) => ({ ...r, up: true, prevUp: false })), state);
+  assert.equal(back.notices.length, 1);
+  assert.equal(back.notices[0].kind, 'up');
+  assert.equal(state.size, 0);
+});
+
+t('below the guard, each project still gets its own named notice', () => {
+  const state = new Map();
+  const few = Array.from({ length: FLEET_GUARD - 1 }, (_, i) => ({ id: i + 1, slug: `p${i + 1}`, isPublic: true, up: false, prevUp: true }));
+  planNotices(few, state);
+  const out = planNotices(few.map((r) => ({ ...r, prevUp: false })), state);
+  assert.equal(out.notices.length, few.length);
+  assert.equal(out.suppressed, 0);
+  assert.match(out.notices[0].text, /p1/);
+});
+
+console.log('\nnoticeText (owner-audience copy):');
+
+t('a public project is named; a non-public one never is', () => {
+  const named = noticeText({ kind: 'down', name: 'mercury' });
+  assert.match(named, /mercury/);
+  const hidden = noticeText({ kind: 'down', name: null });
+  assert.doesNotMatch(hidden, /mercury|null|undefined/);
+  assert.match(hidden, /project/i);
+});
+
+t('the copy carries no jargon and no internals', () => {
+  for (const kind of ['down', 'up']) {
+    for (const name of ['mercury', null]) {
+      const text = noticeText({ kind, name, count: 4 });
+      assert.doesNotMatch(text, /healthz|probe|ECONNREFUSED|http \d|instance|sweep|poller|null|undefined/i, `${kind}/${name}: ${text}`);
+      assert.ok(text.length > 20 && text.length < 320, 'one short paragraph');
+    }
+  }
+});
+
+t('a non-public project is not named in the sweep observation either', () => {
+  const state = new Map();
+  const row = { id: 9, slug: 'secret-co', isPublic: false, up: false, prevUp: true };
+  planNotices([row], state);
+  const out = planNotices([{ ...row, prevUp: false }], state);
+  assert.equal(out.notices.length, 1);
+  assert.doesNotMatch(out.notices[0].text, /secret-co/);
+});
+
+console.log('\nsweepOnce (the notices ride the sweep):');
+
+// A fake db that answers the sweep's two statements, with the prior value the
+// edge rules read. `up` decides what the probe will find.
+function fakeDb(rows, priorUp = new Map()) {
+  return {
+    query: async (sql, params) => {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) return { rows };
+      if (/UPDATE provisioning_instances/.test(sql)) {
+        const prev = priorUp.has(params[0]) ? priorUp.get(params[0]) : true;
+        priorUp.set(params[0], params[1]);
+        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1], prev_up: prev }] };
+      }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+
+await ta('a down instance posts one notice on the confirming sweep, through the injected broadcaster', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 1, slug: 'mercury', domain: null, port: 1, settings: {} }];
+  const db = fakeDb(rows);
+  const posted = [];
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: (n) => posted.push(n), fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 0, 'the first down is not yet an outage');
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1);
+  assert.equal(posted[0].kind, 'down');
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1, 'and it stays quiet');
+});
+
+await ta('a broadcaster that throws cannot stall a sweep tick', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 1, slug: 'mercury', domain: null, port: 1, settings: {} }];
+  const db = fakeDb(rows);
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: () => { throw new Error('discord is down'); }, fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  const out = await liveness.sweepOnce(deps);
+  assert.equal(out.down, 1, 'the sweep still reports what it saw');
+});
+
+await ta('a gated project is never named in what the sweep posts', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 7, slug: 'secret-co', domain: null, port: 1, settings: { visibility: 'private' } }];
+  const db = fakeDb(rows);
+  const posted = [];
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: (n) => posted.push(n), fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1);
+  assert.doesNotMatch(posted[0].text, /secret-co/);
+});
+
+console.log(`\nprovisioning liveness notice: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/modules/provisioning/tests/liveness.mjs

@@ -59,10 +59,11 @@ function fakeDb(rows) {
   return {
     updates,
     query: async (sql, params) => {
-      if (/SELECT id, slug, domain, port FROM provisioning_instances/.test(sql)) return { rows };
-      if (/UPDATE provisioning_instances/.test(sql)) {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) return { rows };
+      if (/^UPDATE provisioning_instances/.test(sql)) {
         updates.push({ sql, id: params[0], up: params[1] });
-        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1] }] };
+        // prev_up rides the write (task 1002894) — the notice reads the value replaced.
+        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1], prev_up: true }] };
       }
       throw new Error(`unexpected SQL: ${sql}`);
     },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.840",
+  "version": "1.19.842",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.840",
+      "version": "1.19.842",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.840",
+  "version": "1.19.842",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-manifest.js

@@ -80,6 +80,7 @@ const PUBLISH_ALLOWLIST = [
   'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
   'config/hierarchy.neutral.json',
   'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
+  'config/scheduled-routines.json',     // the routine SWITCHBOARD (ADR 0115) — per routine: enabled, cadence, requiresAutonomy. It carries no *.neutral.json twin because it IS the neutral starter: ADR 0115's contract is that "a fresh instance inherits this whole set from the core template", and the operator then opts in/out HERE. PUBLISHES rather than topology-excludes for that reason — a released core without it would hand a new instance an empty scheduler and no record of what the routines under .claude/scheduled-tasks/ are for. It reached this list when task 1002500 registered it as a protected surface, which forces the choice; before that it was default-denied by silence, which is the accident that rule exists to catch.
   // --- the portable methodology core, governance, and sanitized docs ---
   'CLAUDE.md',
   'README.md',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.840'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.842'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_roster.mjs

@@ -0,0 +1,132 @@
+// tests/agents_roster.mjs — the SHIPPED roster in `.claude/agents/` (task
+// 1002496, goal 1000095).
+//
+// The definitions are prose files, so nothing about them is checked by the type
+// system, and the sync that imports them is fail-open at deploy (a bad file makes
+// the registry smaller, never aborts the deploy — tests/agents_sync.mjs pins
+// that). The consequence is that a malformed definition is INVISIBLE until
+// someone goes looking in the registry for an agent that quietly never imported.
+// This file is the guard: every roster file must survive the REAL parser and the
+// REAL validator, not a hand-built object that resembles one.
+//
+// Tested at the round-trip altitude on purpose. A test over parseAgentFile alone
+// passes on a key the validator later drops, which is exactly the defect task
+// 1004007 records: a top-level `touches:` validates ok and is silently normalized
+// away. Parse and validate together, or the test agrees with the bug.
+//
+// In tests/ rather than modules/agents/tests/ for the same reason as
+// tests/agents_sync.mjs: the module is default:false and module-local tests are
+// discovered only when the module is ENABLED, so they would never run here.
+//
+// Run:  node tests/agents_roster.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const sync = require('../scripts/gds/agents-sync.js');
+const validate = require('../modules/agents/lib/validate.js');
+
+const validateDefinition = validate.validateAgentDefinition || validate;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); console.log(`  PASS  ${name}`); passed += 1; }
+  catch (err) { console.log(`  FAIL  ${name}\n        ${err.message}`); failed += 1; }
+}
+
+const ROSTER_DIR = new URL('../.claude/agents/', import.meta.url);
+const files = fs.readdirSync(ROSTER_DIR)
+  .filter((f) => f.endsWith('.md'))
+  .sort();
+
+// Parse once, reuse across the cases below. The name comes from the FILENAME,
+// which is how agents-sync identifies a file-sourced definition.
+const roster = files.map((f) => {
+  const name = f.replace(/\.md$/, '');
+  const text = fs.readFileSync(new URL(f, ROSTER_DIR), 'utf8');
+  return { name, file: f, candidate: sync.parseAgentFile(text, { name }) };
+});
+
+console.log('every shipped definition survives parse + validate:');
+
+// An empty roster would pass every per-file assertion below by vacuity — the
+// failure mode where a green suite means "nothing ran". Pin the floor.
+t('the roster is not empty', () => {
+  assert.ok(roster.length > 0, '.claude/agents/ holds no definitions — a vacuous pass');
+});
+
+for (const { name, file, candidate } of roster) {
+  t(`${file} validates against the real validator`, () => {
+    // authorRank archon so a scoped definition is judged on its shape rather
+    // than refused for rank; allowedModules mirrors what the sync passes.
+    const verdict = validateDefinition(candidate, {
+      authorRank: 'archon',
+      allowedModules: ['agents'],
+      protectedModules: [],
+    });
+    assert.ok(
+      verdict.ok,
+      `${file} would not import: ${JSON.stringify(verdict.errors)}`,
+    );
+  });
+
+  t(`${file} carries a persona worth sending`, () => {
+    // The BODY is the persona, and it is sent to a paid model on every fire. A
+    // file whose frontmatter parsed but whose body did not is the quiet failure
+    // this catches — it validates as a string and says nothing.
+    const persona = String(candidate.persona || '');
+    assert.ok(persona.length > 200, `${file}: persona is ${persona.length} chars — too thin to be a role prompt`);
+    assert.match(persona, new RegExp(name.replace(/-/g, '[- ]')), `${file}: the persona never names the agent it defines`);
+  });
+}
+
+console.log('\nthe on-demand roster this task shipped:');
+
+t('historian, planner and onboarding-buddy are all present', () => {
+  const names = roster.map((r) => r.name);
+  for (const want of ['historian', 'planner', 'onboarding-buddy']) {
+    assert.ok(names.includes(want), `${want} is missing from the roster`);
+  }
+});
+
+t('each of the three is on-demand', () => {
+  for (const want of ['historian', 'planner', 'onboarding-buddy']) {
+    const entry = roster.find((r) => r.name === want);
+    assert.equal(entry.candidate.trigger_type, 'on-demand',
+      `${want} must be on-demand — an event trigger here would fire on ships nobody asked it about`);
+  }
+});
+
+console.log('\nthe trap an event definition would walk into:');
+
+// TRIPWIRE for task 1004007, and the reason it is HERE rather than in that task:
+// this directory is where the mistake gets made. A file cannot express
+// `trigger_spec.touches` today (agents-sync.js parses a flat frontmatter and
+// folds only `event:` into the spec), and event-router.js:168 reads an absent
+// filter as FIRES ON EVERY SHIP at roughly $0.90 a fire. So the first
+// file-authored event agent is a standing bill, silently.
+//
+// This reds the moment someone adds one, which is the moment the warning is
+// worth something. Once 1004007 lands, tighten it to assert the filter SURVIVED
+// into trigger_spec rather than refusing event definitions outright.
+t('no file-authored event agent until a file can declare its filter', () => {
+  const eventBacked = roster.filter((r) => r.candidate.trigger_type === 'event');
+  for (const entry of eventBacked) {
+    const spec = entry.candidate.trigger_spec;
+    const globs = spec && Array.isArray(spec.touches) ? spec.touches
+      : spec && Array.isArray(spec.touches_globs) ? spec.touches_globs
+        : [];
+    assert.ok(
+      globs.length > 0,
+      `${entry.file} is an event definition with no touches filter, so it would fire on EVERY ship (~$0.90 each). `
+      + 'A file cannot declare one until task 1004007 lands — see tests/agents_roster.mjs.',
+    );
+  }
+});
+
+console.log(`\nagents_roster: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/government_protected_surfaces.mjs

@@ -17,6 +17,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -226,6 +227,19 @@ const ADDED_SINCE_R101 = [
        + 'that computed set is expected. Registered because it is the code that puts the '
        + 'credential on the wire.',
   },
+  // task 1002500. The routine SWITCHBOARD — the counterpart to the hooks/settings entries
+  // in group 'automation', which protect how a session behaves but said nothing about what
+  // fires with no session at all. The routine-switch tripwire below recomputes this set
+  // from config/ by SHAPE, so a second switchboard cannot land unregistered.
+  {
+    after: '.claude/settings.json',
+    glob: 'config/scheduled-routines.json',
+    why: 'decides, per routine, enabled / cadence / requiresAutonomy. Arming '
+       + 'overnight-builder there starts an autonomous claim-and-ship loop; clearing '
+       + "main-audit's entry silences the post-merge backstop that catches a sub-Metic "
+       + 'edit which slipped past the pre-push hook and the grader — the one ADR 0043 '
+       + 'layer that does not depend on the builder cooperating.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -561,6 +575,173 @@ test('registering the credential readers widened no module wall', () => {
     + 'is not, the premise of the box.js entry has changed.');
 });
 
+// ---------- the routine-switch tripwire: every SWITCHBOARD is a protected surface ----------
+//
+// task 1002500. Group 'automation' protected how a SESSION behaves — .claude/hooks/ and
+// .claude/settings.json — and said nothing about what fires when no session exists at all.
+// config/scheduled-routines.json is that file: per routine it carries enabled, cadence and
+// requiresAutonomy, so one edit there arms overnight-builder (an autonomous claim-and-ship
+// loop) or silences main-audit, which is the only ADR 0043 layer that does not depend on
+// the builder cooperating.
+//
+// DETECTED BY SHAPE, NOT BY NAME. Naming the one file we know about today is the failure
+// this project keeps re-learning (the audit's stale "gen-* trio" above, the filing task's
+// wrong path for the Cloudflare reader): the registry would record the gap as closed while
+// a second switchboard lands beside it unprotected. So the set is recomputed from config/
+// on every run, and an entry whose values decide whether-and-how-often a routine runs must
+// be registered or this reds.
+//
+// WHY ONLY THE SWITCHBOARD, NOT THE ROUTINE BODIES. .claude/scheduled-tasks/ is the
+// autonomy module's source surface, and `protected` DERIVES per module from overlap with
+// this registry — so registering the bodies would rank-wall the whole autonomy module and
+// every goal scoped to it. That is a policy decision with three deliberate edits attached
+// (registry, publish-manifest carve-out, the module-scope-map roster), exactly as recorded
+// for .claude/agents/ at the head of this file. Protecting the switchboard gates who may
+// ARM a routine; it deliberately says nothing about who may edit what one does.
+const CONFIG_DIR = path.join(ROOT, 'config');
+
+// Does this JSON declare routine SWITCHES — entries deciding whether a routine runs and
+// how often? True for an object carrying `requiresAutonomy`, or `enabled` alongside a
+// `cadence`. Recursive so a flat manifest is caught as readily as the nested `routines`
+// map today; `enabled` ALONE is deliberately not enough, or every feature-flag file in
+// config/ would match and the tripwire would mean nothing.
+//
+// MAX_SWITCH_DEPTH is the deepest nesting a switchboard is searched at. The shapes that
+// exist are depth 0 (a flat `{ "<routine>": {...} }` map, where the entry sits one level
+// in) and depth 1 (today's `{ "routines": { "<routine>": {...} } }`). Three is that plus a
+// level of headroom, and it is a bound rather than a guess: the cost of it being too low
+// is a switchboard buried deeper than any we write going unnoticed, and the cost of
+// removing it is walking arbitrarily deep into unrelated config for a key that only ever
+// appears near the top. Raise it and the tripwire still holds; the negative test below is
+// what would catch a raise that starts matching ordinary config.
+const MAX_SWITCH_DEPTH = 3;
+
+function declaresRoutineSwitches(node, depth = 0) {
+  if (!node || typeof node !== 'object' || Array.isArray(node) || depth > MAX_SWITCH_DEPTH) return false;
+  if (typeof node.requiresAutonomy === 'boolean') return true;
+  if (typeof node.enabled === 'boolean' && typeof node.cadence === 'string') return true;
+  return Object.values(node).some((v) => declaresRoutineSwitches(v, depth + 1));
+}
+
+// Every config/*.json that declares routine switches, as repo-relative paths.
+function routineSwitchManifests(dir = CONFIG_DIR) {
+  const out = [];
+  for (const name of fs.readdirSync(dir).sort()) {
+    if (!name.endsWith('.json')) continue;
+    let doc;
+    try { doc = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8')); } catch (_) { continue; }
+    if (declaresRoutineSwitches(doc)) out.push(`config/${name}`);
+  }
+  return out;
+}
+
+test('declaresRoutineSwitches detects a switchboard in both shapes', () => {
+  assert.equal(declaresRoutineSwitches({ routines: { a: { enabled: true, cadence: 'daily' } } }), true,
+    'the nested shape config/scheduled-routines.json uses today');
+  assert.equal(declaresRoutineSwitches({ 'overnight-builder': { requiresAutonomy: true } }), true,
+    'a FLAT manifest — the shape a second switchboard is most likely to arrive in');
+  assert.equal(declaresRoutineSwitches({ a: { b: { c: { requiresAutonomy: false } } } }), true,
+    'requiresAutonomy:false still declares the switch — the value is policy, the key is the shape');
+});
+
+test('declaresRoutineSwitches does not fire on a near-miss', () => {
+  assert.equal(declaresRoutineSwitches({ game: false, discord: true }), false,
+    'a feature-flag map is not a routine switchboard');
+  assert.equal(declaresRoutineSwitches({ mod: { enabled: true } }), false,
+    'enabled ALONE is not enough — it must decide how often something fires');
+  assert.equal(declaresRoutineSwitches({ chart: { cadence: 'weekly' } }), false,
+    'a cadence with nothing enabling it is prose, not a switch');
+  assert.equal(declaresRoutineSwitches(null), false);
+  assert.equal(declaresRoutineSwitches([{ enabled: true, cadence: 'daily' }]), false,
+    'an array is not an entry map');
+});
+
+// The near-miss test above uses hand-built objects, which only proves the detector rejects
+// the shapes I thought to write. This proves the negative against the REAL directory: of
+// the config files actually in the tree, exactly one is a switchboard. Without it, a
+// detector that matched everything in config/ would still pass the tripwire (every other
+// file would simply have to be registered too, and the failure would read as a coverage
+// gap rather than as an over-broad detector).
+test('exactly one file in the real config/ is a switchboard — the rest do not match', () => {
+  const all = fs.readdirSync(CONFIG_DIR).filter((n) => n.endsWith('.json')).sort();
+  assert.ok(all.length >= 5,
+    `fixture sanity: config/ should hold several json files, found ${all.length}`);
+  const matched = routineSwitchManifests();
+  assert.deepEqual(matched, ['config/scheduled-routines.json'],
+    `the detector matched ${matched.length} of the ${all.length} files in config/. One is `
+    + 'correct. More means the shape test is too loose — a feature-flag or token file is '
+    + 'being read as a routine switchboard, which would turn this tripwire into a demand '
+    + 'to rank-wall ordinary config. Scanned: ' + all.join(', '));
+});
+
+test('every routine switchboard in config/ is a protected surface (1002500 tripwire)', () => {
+  const boards = routineSwitchManifests();
+  assert.ok(boards.includes('config/scheduled-routines.json'),
+    'fixture sanity: the known switchboard must be detected, or this tripwire is vacuous '
+    + '— the failure mode where a scan passes by quietly finding nothing');
+  for (const rel of boards) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} decides whether scheduled routines run and how often — arming one starts `
+      + 'unattended work, silencing one removes a gate — but no protected surface covers '
+      + 'it. Add it to modules/government/protected-surfaces.json (group "automation") and '
+      + 'declare it in ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} is a routine switchboard floored at '${surface.floor}' — below Metic it `
+      + 'stays writable by the ranks ADR 0043 keeps out of the pipeline.');
+  }
+});
+
+// The tripwire above passes today because the one switchboard IS registered — which is
+// also what it would look like if it were broken and finding nothing. This proves the RED
+// path without mutating the shipped registry: a switchboard that is not in it must be
+// detected AND must resolve to no protected surface, which is exactly the pair the loop
+// above turns into a failure.
+test('the tripwire fires on an UNREGISTERED switchboard', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-switchboard-probe-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'unrelated.json'), JSON.stringify({ game: false }));
+    fs.writeFileSync(path.join(dir, 'rogue-routines.json'),
+      JSON.stringify({ routines: { 'overnight-builder': { enabled: true, cadence: 'nightly', requiresAutonomy: true } } }));
+    const found = routineSwitchManifests(dir);
+    assert.deepEqual(found, ['config/rogue-routines.json'],
+      'the detector must find the rogue switchboard and ignore the feature-flag file');
+    assert.equal(ppc.surfaceFor('config/rogue-routines.json'), null,
+      'an unregistered config path must resolve to no surface — the falsy half the '
+      + 'tripwire asserts on. If this ever returns a surface, a config/ subtree glob was '
+      + 'added and the tripwire can no longer distinguish registered from unregistered.');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('registering the switchboard widened no module wall', () => {
+  // The same second-order effect asserted for the credential readers above. config/ is
+  // kernel territory (module-scope-map's kernel key), and kernel was already protected via
+  // src/bongos/auth.js and db.js — so this entry must change nothing.
+  //
+  // `agents` is the module to watch, and the ONLY one this test can honestly cite.
+  // `autonomy` — which owns .claude/scheduled-tasks/, the routine bodies — was ALREADY
+  // protected before this entry, through scripts/gds/conductor-dispatch.js in group
+  // 'pipeline' (verified glob by glob: none of its other five globs is protected). So its
+  // flag is not evidence either way here, and asserting it unprotected would have been a
+  // test that fails for a reason unrelated to what it claims to check.
+  const map = require(path.join(ROOT, 'src', 'bongos', 'module-scope-map.js'));
+  const protectedNow = map.protectedModules();
+  assert.ok(protectedNow.includes('kernel'),
+    'kernel owns config/ and was already protected before this entry; if it is not, the '
+    + 'premise that registering a config/ file widens nothing has changed.');
+  assert.ok(!protectedNow.includes('agents'),
+    'the agents module derived protected:true — a routine entry reached modules/agents/ '
+    + 'or .claude/agents/, which rank-walls every goal scoped to it. Protect the '
+    + 'SWITCHBOARD, not the agent or routine sources; walling that module is the separate '
+    + 'policy decision recorded for .claude/agents/ at the head of this file.');
+  assert.ok(ppc.surfaceFor('scripts/gds/conductor-dispatch.js'),
+    'the autonomy module was protected through conductor-dispatch.js before this entry. '
+    + 'If that glob is gone, re-derive which modules this registry walls before trusting '
+    + 'the assertion above.');
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a