@bongos/core 1.19.850 → 1.19.851

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.850",
-  "core_contract": "1.19.850",
-  "source_commit": "232e375d3248cfc923d287f61d29cb6c5f59c5d9",
+  "core_version": "1.19.851",
+  "core_contract": "1.19.851",
+  "source_commit": "da155ea160e5cc9856e3f5cf748f295b8249fda3",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T20:32:54.381Z",
+  "built_at": "2026-09-17T20:50:42.971Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 496,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2276,
+    "functional_verbatim": 2277,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2798,
-  "tree_sha256": "12391d158894c3d0cb4e4073c3939f9c3e83705fa0406663fe5a30859fba4af4",
+  "file_count": 2799,
+  "tree_sha256": "7da0b3dfc799f5f86bd7a462eab350162e41438285181ab7698d19e15c38cc7a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -302,7 +302,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "2d993829478b5f8931e5a8248818b70279055d1af643e51f07de6161eab593aa"
+      "sha256": "dace360d1e995ce2a7401a275a7ed68f6ebb877da948f7cf5ff710a9ce8c8bfc"
     },
     {
       "path": "CLAUDE.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6c3496a323791d9b6bfc8e86faba4e433a51091e5a9d12b85ede0b207d8057a5"
+      "sha256": "9c1f78d5dc54fdd2b6d62922778e01dbb465005ac689526f7fc327cb977f416b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2847,7 +2847,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "85823a0b17b646da4b17596c78819da8e7342f24395dcc2e3ea82b5e07c25cba"
+      "sha256": "dba962c19bf22e5773fd05eb6667581d15f62ecda7292a37f83b12227ad14049"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -7907,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1e217b4d7975b9c295c2806a83a5817f93fc38a0786a1976fe8ec19aac141b50"
+      "sha256": "36122cd40b437ccc5c77b91e5644e520abc238661e70b3232c8741ded1cdda0a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6943316e63bef1a867ea04e705e42a9aa28a50e2cded10e16874899c61f69f03"
+      "sha256": "aa3305048a8974caa7fbb34d88c86c5aa326e7d1f21ed80dc82d0e66a523b04a"
     },
     {
       "path": "public-docs/index.html",
@@ -9852,7 +9852,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d2a5ba427ce014f7940e2757f06541e25275e0c4f59c0b9c5026396c795e41f2"
+      "sha256": "81e4082b5cc1067347973cfe7d4c994a6eb43f3b9e64cb3c3f55fd3eec8fd69c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12154,6 +12154,11 @@
       "mode": "0000644",
       "sha256": "68a429b47a1ca36a41433c0d8c3298a0f54745a19b050675aedba658a2cea0ef"
     },
+    {
+      "path": "tests/markdown_line_endings.mjs",
+      "mode": "0000644",
+      "sha256": "629ee8bb78098296039d174b9ddd460fe86acade39f60c1d9bb5f6be9d13762f"
+    },
     {
       "path": "tests/me_ship_days_bound.mjs",
       "mode": "0000644",

package/.gitattributes

@@ -37,6 +37,26 @@
 # read as environmental noise.
 *.sql          text eol=lf
 
+# Markdown: pinned for the same reason *.sql above is (task 1003981). Unpinned, every
+# .md fell through `* text=auto`, so a Windows clone with the common core.autocrlf=true
+# got CRLF in the worktree for 834 of the 835 tracked .md files while the index stayed
+# LF. That is not cosmetic: this repo has several tools that read .md AS TEXT and make a
+# decision from what they parse — skill-preflight.js (SKILL.md frontmatter), fitness.js
+# G03, linkify-refs.js, docs-entropy.js, the role-pack guard and the doc-CLI guard. A
+# CRLF-blind reader does not fail loudly; it parses nothing and so reports nothing to
+# check. Measured on task 1003754: skill-preflight's /^---\n/ frontmatter regex matched
+# ZERO of 53 skills, so G03 compared an empty set against an empty set and could not
+# fail. Per-site normalisation (tasks 1003754, 1003935) fixes the reader that was
+# noticed; this rule fixes the class, for the reader nobody has written yet.
+#
+# Renormalisation cost: NONE. Measured before landing — no tracked .md carries CRLF in
+# the INDEX, so `git add --renormalize` stages zero files and no committed byte changes.
+# The rule only changes what checkout WRITES. An existing Windows worktree keeps its
+# CRLF copies (the clean filter already normalises them to LF on add, so `git status`
+# stays quiet); a fresh clone, and any file git rewrites, get LF. To convert an existing
+# checkout in place: `git rm --cached -r . && git reset --hard`.
+*.md           text eol=lf
+
 # Future Windows-only wrappers (none today) must be CRLF — cmd.exe/PowerShell
 # expect it. Declared up front so a later setup-builder.cmd lands correct.
 *.bat          text eol=crlf
@@ -115,9 +135,13 @@ src/bongos/routes/CLAUDE.md   merge=otb-regen
 # `* text=auto` above (index LF, worktree CRLF) the check reported STALE forever on
 # every Windows checkout while the committed content was already correct. The .json
 # never had the bug because `*.json text eol=lf` above already pins it; the .md fell
-# through to text=auto because no `*.md` rule exists (and none should — pinning all
-# 685 tracked .md files would renormalize the whole docs tree for one generated file).
-# `*.md` deliberately stays unpinned; only the GENERATED artifact is pinned here.
+# through to text=auto because, at the time, no `*.md` rule existed. This entry's
+# `text eol=lf` is now REDUNDANT with the blanket `*.md text eol=lf` above (task
+# 1003981) — kept because it is load-bearing documentation of WHY the generated pair
+# needs LF, and because tests/git_merge_regen.mjs pins this line's multi-attribute
+# shape. The earlier note here argued *.md should stay unpinned, on the belief that
+# pinning it would renormalize the whole docs tree; that was measured and is false —
+# the index was already uniformly LF, so the blanket rule renormalized nothing.
 docs/copy-registry.json    merge=otb-regen
 docs/copy-inventory.md     merge=otb-regen text eol=lf
 

package/docs/module-api-changelog.md

@@ -2174,5 +2174,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.848 with no explicit bump. run 35269098215. (task 1002620)
   1.19.850 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.849 with no explicit bump. run 35271402682. (task 1002620)
+  1.19.851 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.850 with no explicit bump. run 35273175013. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -214,7 +214,7 @@ caught a real bug during task 1003548, so read its assertion before blaming the
 
 - Several hall files (`people.css`, `people.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
 - A `git diff --stat` that touches every line of a file you barely edited is an EOL flip — check with `git diff --stat --ignore-cr-at-eol`, and restore the original EOL before committing.
-- **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Note `*.md` is deliberately NOT pinned repo-wide; only that one generated artifact is.
+- **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Since task 1003981 `*.md` IS pinned repo-wide (`*.md text eol=lf`), so a fresh clone gets LF markdown everywhere and a markdown reader no longer has to be CRLF-aware to be correct. An EXISTING Windows checkout keeps its CRLF copies until git rewrites them — the clean filter still normalises to LF on add, so `git status` stays quiet and nothing is broken; to convert in place, `git rm --cached -r . && git reset --hard`.
 - **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/gds/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).
 
 ## Four Windows traps that make a test lie — all four found in one pass (task 1003529)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.850",
+  "version": "1.19.851",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.850",
+      "version": "1.19.851",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.850",
+  "version": "1.19.851",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.850'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.851'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/markdown_line_endings.mjs

@@ -0,0 +1,78 @@
+// tests/markdown_line_endings.mjs — *.md is pinned to LF in .gitattributes (task 1003981).
+//
+// WHAT THIS GUARDS. At least six tools in this repo read a .md file AS TEXT and make a
+// decision from what they parse: skill-preflight.js (SKILL.md frontmatter), fitness.js
+// G03, linkify-refs.js, docs-entropy.js, the role-pack guard and the doc-CLI guard.
+// Before this pin, *.md fell through `* text=auto`, so a Windows clone with the common
+// core.autocrlf=true got CRLF in the worktree for 834 of 835 tracked .md files while the
+// index stayed LF. A CRLF-blind reader does not fail loudly — it parses nothing, and a
+// guard with nothing to compare cannot fail. Measured on task 1003754: skill-preflight's
+// /^---\n/ frontmatter regex matched ZERO of 53 skills, and G03 duly reported
+// "53 skill(s) scanned; 0 declare a machine contract" while staying green.
+//
+// Asserted through GIT ITSELF (`git check-attr`), not by pattern-matching .gitattributes:
+// the pattern semantics are git's, and the failure mode this replaces was precisely a
+// rule that read correctly but did not match what it was believed to match (the
+// root-anchored /CLAUDE.md lesson in tests/git_merge_regen.mjs). Reading the file back
+// would re-assert our own spelling rather than git's resolution of it.
+//
+// Run:  node --test tests/markdown_line_endings.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repo = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const git = (args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+
+const eolOf = (p) => {
+  const r = git(['check-attr', 'eol', '--', p]);
+  return (r.stdout || '').trim().split(': ').pop();
+};
+
+// Representative paths, chosen for DEPTH rather than count: a gitattributes pattern
+// with no leading slash matches at any depth, and the bug being pinned bit a .md
+// four directories down, not one at the root.
+test('every tracked .md resolves to eol=lf, at any depth', () => {
+  for (const p of [
+    'README.md',
+    'CLAUDE.md',
+    'docs/architecture.md',
+    'docs/packs/engineer.md',
+    'docs/adr/README.md',
+    '.claude/skills/merge-mode/SKILL.md',
+    'modules/hall-ui/CLAUDE.md',
+  ]) {
+    assert.equal(eolOf(p), 'lf', `${p} must be pinned to LF — a CRLF copy silently voids every reader that parses it`);
+  }
+});
+
+// The invariant that actually matters, over the REAL tracked set rather than a sample.
+// `git ls-files --eol` reports the index ("i/") and worktree ("w/") encodings side by
+// side; the index is what every clone receives, so an index CRLF is the state that
+// would ship the bug to someone else's checkout.
+test('no tracked .md carries CRLF in the index', () => {
+  const r = git(['ls-files', '--eol', '-z', '*.md']);
+  assert.equal(r.status, 0, 'git ls-files --eol must succeed');
+  const rows = (r.stdout || '').split('\0').filter(Boolean);
+  assert.ok(rows.length > 500, `expected the full markdown set, got ${rows.length} rows`);
+
+  const crlf = rows.filter((row) => /^i\/crlf/.test(row.trim())).map((row) => row.trim());
+  assert.deepEqual(crlf, [], `these .md files are CRLF in the index: ${crlf.join(', ')}`);
+});
+
+// The complementary half, and the reason this is not just `*` pinned to LF: the repo
+// deliberately ships CRLF for the Windows-shell wrappers, where cmd.exe and PowerShell
+// expect it. A future over-broad edit that pinned everything to LF would silently break
+// those, and the markdown assertions above would keep passing while it did.
+test('the Windows-shell classes stay pinned to CRLF', () => {
+  // scripts/gds/api.ps1 is the one such file that exists today; the .cmd/.bat spellings
+  // are the declared-up-front rules for the wrappers .gitattributes says do not exist yet.
+  // check-attr resolves a PATTERN, so it answers for those too — which is the point here.
+  for (const p of ['scripts/gds/api.ps1', 'scripts/setup-builder.cmd', 'scripts/setup-builder.bat']) {
+    assert.equal(eolOf(p), 'crlf', `${p} must stay CRLF — cmd.exe/PowerShell expect it`);
+  }
+});