@bongos/core 1.19.841 → 1.19.842

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.841",
-  "core_contract": "1.19.841",
-  "source_commit": "fd701dc457a5344486573c53ca1f4efcc1948007",
+  "core_version": "1.19.842",
+  "core_contract": "1.19.842",
+  "source_commit": "ffa8d1ce17675d5981142ca6588ef641d0893058",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T18:13:18.546Z",
+  "built_at": "2026-09-17T18:21:47.399Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 495,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2265,
+    "functional_verbatim": 2266,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2786,
-  "tree_sha256": "a54472eaf1c55f1c7f905fb6fd2712a9ab44e8e9f3a731ffba11037c3d9f5b69",
+  "file_count": 2787,
+  "tree_sha256": "204ee5631e422b90ff1d79a7fde81706ca492bea501801a162421ebd04f6bfdb",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "79b20e6155f002dd63671b994cbbb8e2f269c3634cd213b5695c0de8bb031cc7"
+      "sha256": "033de93b8ea7781edf94b6b1146741c2bde76443ecf7b6c8b1bf47d8919d6bab"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7892,12 +7892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d507a842a2ad14e85f0e5564998ab1288afad232febc358f932736b51fd12bd7"
+      "sha256": "21b80f9aba47da61edcb4a374ad4aad35f2e5c563cccb1daae278b6d892d0255"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "81e581275d29c80dc0c2496d83b2a5317da29e43d65aabf7a49309aed72b1003"
+      "sha256": "61f48c57b02632310e7ba92115fdc6939efe7967f2ee7542fa7b12834f8af6c2"
     },
     {
       "path": "public-docs/index.html",
@@ -9827,7 +9827,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d01a900eabeae11f0d03aa7aff1ea89af23f58a3e01c07fc79a4e4ea8b68f4a4"
+      "sha256": "84e310a550189d0d3d86f825cc04d61d81e0c0dc78428056661357a1a5076e74"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9969,6 +9969,11 @@
       "mode": "0000644",
       "sha256": "919ca0ea3fe5f78a194781f6b634b9da23212073cf0c7cbe8ae36a65cc3fecdb"
     },
+    {
+      "path": "tests/agents_roster.mjs",
+      "mode": "0000644",
+      "sha256": "acc25f4d72cb22719d6977f939b41f9f17e0d102880976699b6ebcda1c64c523"
+    },
     {
       "path": "tests/agents_routes.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2156,5 +2156,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.839 with no explicit bump. run 35254616836. (task 1002620)
   1.19.841 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.840 with no explicit bump. run 35257419225. (task 1002620)
+  1.19.842 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.841 with no explicit bump. run 35258288930. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.841",
+  "version": "1.19.842",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.841",
+      "version": "1.19.842",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.841",
+  "version": "1.19.842",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.841'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.842'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_roster.mjs

@@ -0,0 +1,132 @@
+// tests/agents_roster.mjs — the SHIPPED roster in `.claude/agents/` (task
+// 1002496, goal 1000095).
+//
+// The definitions are prose files, so nothing about them is checked by the type
+// system, and the sync that imports them is fail-open at deploy (a bad file makes
+// the registry smaller, never aborts the deploy — tests/agents_sync.mjs pins
+// that). The consequence is that a malformed definition is INVISIBLE until
+// someone goes looking in the registry for an agent that quietly never imported.
+// This file is the guard: every roster file must survive the REAL parser and the
+// REAL validator, not a hand-built object that resembles one.
+//
+// Tested at the round-trip altitude on purpose. A test over parseAgentFile alone
+// passes on a key the validator later drops, which is exactly the defect task
+// 1004007 records: a top-level `touches:` validates ok and is silently normalized
+// away. Parse and validate together, or the test agrees with the bug.
+//
+// In tests/ rather than modules/agents/tests/ for the same reason as
+// tests/agents_sync.mjs: the module is default:false and module-local tests are
+// discovered only when the module is ENABLED, so they would never run here.
+//
+// Run:  node tests/agents_roster.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const sync = require('../scripts/gds/agents-sync.js');
+const validate = require('../modules/agents/lib/validate.js');
+
+const validateDefinition = validate.validateAgentDefinition || validate;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); console.log(`  PASS  ${name}`); passed += 1; }
+  catch (err) { console.log(`  FAIL  ${name}\n        ${err.message}`); failed += 1; }
+}
+
+const ROSTER_DIR = new URL('../.claude/agents/', import.meta.url);
+const files = fs.readdirSync(ROSTER_DIR)
+  .filter((f) => f.endsWith('.md'))
+  .sort();
+
+// Parse once, reuse across the cases below. The name comes from the FILENAME,
+// which is how agents-sync identifies a file-sourced definition.
+const roster = files.map((f) => {
+  const name = f.replace(/\.md$/, '');
+  const text = fs.readFileSync(new URL(f, ROSTER_DIR), 'utf8');
+  return { name, file: f, candidate: sync.parseAgentFile(text, { name }) };
+});
+
+console.log('every shipped definition survives parse + validate:');
+
+// An empty roster would pass every per-file assertion below by vacuity — the
+// failure mode where a green suite means "nothing ran". Pin the floor.
+t('the roster is not empty', () => {
+  assert.ok(roster.length > 0, '.claude/agents/ holds no definitions — a vacuous pass');
+});
+
+for (const { name, file, candidate } of roster) {
+  t(`${file} validates against the real validator`, () => {
+    // authorRank archon so a scoped definition is judged on its shape rather
+    // than refused for rank; allowedModules mirrors what the sync passes.
+    const verdict = validateDefinition(candidate, {
+      authorRank: 'archon',
+      allowedModules: ['agents'],
+      protectedModules: [],
+    });
+    assert.ok(
+      verdict.ok,
+      `${file} would not import: ${JSON.stringify(verdict.errors)}`,
+    );
+  });
+
+  t(`${file} carries a persona worth sending`, () => {
+    // The BODY is the persona, and it is sent to a paid model on every fire. A
+    // file whose frontmatter parsed but whose body did not is the quiet failure
+    // this catches — it validates as a string and says nothing.
+    const persona = String(candidate.persona || '');
+    assert.ok(persona.length > 200, `${file}: persona is ${persona.length} chars — too thin to be a role prompt`);
+    assert.match(persona, new RegExp(name.replace(/-/g, '[- ]')), `${file}: the persona never names the agent it defines`);
+  });
+}
+
+console.log('\nthe on-demand roster this task shipped:');
+
+t('historian, planner and onboarding-buddy are all present', () => {
+  const names = roster.map((r) => r.name);
+  for (const want of ['historian', 'planner', 'onboarding-buddy']) {
+    assert.ok(names.includes(want), `${want} is missing from the roster`);
+  }
+});
+
+t('each of the three is on-demand', () => {
+  for (const want of ['historian', 'planner', 'onboarding-buddy']) {
+    const entry = roster.find((r) => r.name === want);
+    assert.equal(entry.candidate.trigger_type, 'on-demand',
+      `${want} must be on-demand — an event trigger here would fire on ships nobody asked it about`);
+  }
+});
+
+console.log('\nthe trap an event definition would walk into:');
+
+// TRIPWIRE for task 1004007, and the reason it is HERE rather than in that task:
+// this directory is where the mistake gets made. A file cannot express
+// `trigger_spec.touches` today (agents-sync.js parses a flat frontmatter and
+// folds only `event:` into the spec), and event-router.js:168 reads an absent
+// filter as FIRES ON EVERY SHIP at roughly $0.90 a fire. So the first
+// file-authored event agent is a standing bill, silently.
+//
+// This reds the moment someone adds one, which is the moment the warning is
+// worth something. Once 1004007 lands, tighten it to assert the filter SURVIVED
+// into trigger_spec rather than refusing event definitions outright.
+t('no file-authored event agent until a file can declare its filter', () => {
+  const eventBacked = roster.filter((r) => r.candidate.trigger_type === 'event');
+  for (const entry of eventBacked) {
+    const spec = entry.candidate.trigger_spec;
+    const globs = spec && Array.isArray(spec.touches) ? spec.touches
+      : spec && Array.isArray(spec.touches_globs) ? spec.touches_globs
+        : [];
+    assert.ok(
+      globs.length > 0,
+      `${entry.file} is an event definition with no touches filter, so it would fire on EVERY ship (~$0.90 each). `
+      + 'A file cannot declare one until task 1004007 lands — see tests/agents_roster.mjs.',
+    );
+  }
+});
+
+console.log(`\nagents_roster: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);