@bongos/core 1.19.857 → 1.19.858

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.857",
-  "core_contract": "1.19.857",
-  "source_commit": "b591a81b627f40ec9e0d235d201b1f54f21ea1bf",
+  "core_version": "1.19.858",
+  "core_contract": "1.19.858",
+  "source_commit": "afc4e781c80a292d23180b498c8a15f9483bcedb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T21:51:29.538Z",
+  "built_at": "2026-09-17T22:01:14.430Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2804,
-  "tree_sha256": "6d87cce28c4d7d99fab00dce29c6654aa1e59ebbff7c20ece7de301410c34332",
+  "tree_sha256": "34a2816607bed641f30b7a13611a257ff4330ca477e9b6fb6e03ed7137e20ad5",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -517,7 +517,7 @@
     {
       "path": "docs/adr/0020-security-model-public-stub.md",
       "mode": "0000644",
-      "sha256": "b95bade85ead2f18f4ad8da7a96c178ff6ccc141d805247838233e15154ed79b"
+      "sha256": "22730680f71c68b508d476bb2a1802586cfd56bffd391cb5d98cac9a928e89f1"
     },
     {
       "path": "docs/adr/0021-per-builder-skill-model-preferences.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6039f82c978097f35c3be7357b99c225fd678ca31692b09a130a5389112735dd"
+      "sha256": "56c034df0c7eb96ada2eed6aa17ce5e3485716901c6215c72eb247276a091ca9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2867,7 +2867,7 @@
     {
       "path": "docs/research/cursor-competitive-analysis.md",
       "mode": "0000644",
-      "sha256": "3659fa514a0f2c392ea1779e1c1af70085760b174028f11065a6b72e06dab253"
+      "sha256": "bc2e01b959b5cf36f848dd57a1635d1a9e0a4ae3439610e936bc709ebfc01f96"
     },
     {
       "path": "docs/research/llm-model-agnostic-and-cheaper-grader.md",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "73c27e08b25249cef8ec8eb6a17f45c8f73c6eb75459aa852129456893485446"
+      "sha256": "66f32ef74e691565c2cb563b55bf7276e51a0fb60ac2e993a92ed490e4124191"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6a45a64683e79505a88ad297424ff463068def3a2b92ba9a417b7d119941640a"
+      "sha256": "52c154531637a295f97e1352c9506ab2096351f701953d257097a94bef201ccf"
     },
     {
       "path": "public-docs/index.html",
@@ -8232,7 +8232,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "de8dcb51a250334621b104e99f7bc5f857f4422718c3c3ed8519cd5d0ebc8739"
+      "sha256": "488a2a6c55c794625c47480def16c3b3fee81be4bd73d36a21f11a7feab741fc"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -9867,7 +9867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f3e4186d676d49a57c8b8cbe857c25c0632ebf7e6f0991380ee746d995b75e45"
+      "sha256": "afc74def8759f073e583a0ec5677587d849e1d8534f704bd1560cb018a16dc10"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10592,7 +10592,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "42df08d261aaeb7cf94db3eef0e95b06af138d8d317b57f12dc4cb2c23d9f81a"
+      "sha256": "ac4c44006a151190a5ead99c7a32241cf95e21b3eca397ea7c0d4bf26b0b7de9"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",

package/docs/adr/0020-security-model-public-stub.md

@@ -20,7 +20,7 @@ The **full security ADR is server-side**, served by a Metic+-gated endpoint and
 
 | Surface | Where | Who reads it |
 |---|---|---|
-| Public stub (this file) | `docs/adr/<redacted>.md`, in the repo | anyone with the repo |
+| Public stub (this file) | `docs/adr/0020-security-model-public-stub.md`, in the repo | anyone with the repo |
 | Full security ADR | A markdown file on the droplet at the path named by `GDS_SECURITY_ADR_PATH` (recommended: `/etc/example/security-adr.md`, owned by the deploy user, `chmod 600`) | the server process, on read; Metic+ via API |
 | Public read endpoint | none | — |
 | Authenticated read endpoint | `GET /api/gds/security/adr` — `requireBuilder` + `requireRank('metic','archon')` — returns the markdown body verbatim under `{ adr_md, source: <path>, fetched_at }` | Metic, Archon |

package/docs/module-api-changelog.md

@@ -2188,5 +2188,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.855 with no explicit bump. run 35277927951. (task 1002620)
   1.19.857 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.856 with no explicit bump. run 35278916322. (task 1002620)
+  1.19.858 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.857 with no explicit bump. run 35279781206. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/research/cursor-competitive-analysis.md

@@ -16,7 +16,7 @@ This was produced by the project's deep-research harness (fan-out web search →
 
 > **Operational note for the owner:** this is the **second** harness run in a row truncated by the org's monthly Claude spend limit (the module-system doc was the first). The *subagents* die on it; the *main loop* still works, which is how the verification round below got done. To get full unattended verification + auto-synthesis on the next deep dive, raise the limit at `claude.ai/admin-settings/usage`.
 
-Full bibliography in [§10](#10-bibliography). Our positioning is from a direct read of [`docs/adr/<redacted>.md`](../adr/<redacted>.md), [`docs/adr/<redacted>.md`](../adr/<redacted>.md), and [`GOVERNANCE.md`](../../GOVERNANCE.md).
+Full bibliography in [§10](#10-bibliography). Our positioning is from a direct read of [`docs/adr/0065-agpl-nonprofit-ai-first-governance.md`](../adr/0065-agpl-nonprofit-ai-first-governance.md), [`docs/adr/0062-medusa-instance-model-decoupling.md`](../adr/0062-medusa-instance-model-decoupling.md), and [`GOVERNANCE.md`](../../GOVERNANCE.md).
 
 ---
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.857",
+  "version": "1.19.858",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.857",
+      "version": "1.19.858",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.857",
+  "version": "1.19.858",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -403,6 +403,19 @@ function transformSettings(srcPath) {
       }
     }
   }
+  // Permission rules name the SAME commands the hooks and skills do, so they take the same
+  // rewrite — a rule left as `node scripts/gds/ship.js` matches nothing once the instance's
+  // skills run `bongos ship` (task 1004012). `allow` gets the one spelling the skills use; a
+  // restrictive list gets BOTH ways an instance can reach the script, or it guards only one.
+  const perms = json && json.permissions;
+  if (perms && typeof perms === 'object') {
+    for (const [key, rules] of Object.entries(perms)) {
+      if (!Array.isArray(rules)) continue;
+      // an empty verb table makes bongosify emit the `bongos exec scripts/gds/<x>.js` spelling
+      const spellings =(r) => (key === 'allow' ? [bongosify(r)] : [bongosify(r), bongosify(r, {})]);
+      perms[key] = [...new Set(rules.flatMap((r) => (typeof r === 'string' ? spellings(r) : [r])))];
+    }
+  }
   return JSON.stringify(json, null, 2) + '\n';
 }
 
@@ -600,7 +613,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       }
       addWritten('.claude/settings.json');
       summary.settings = true;
-      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json (hook commands→bongos, identity rebranded)`);
+      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json (hook commands + permission rules→bongos, identity rebranded)`);
     }
   } else {
     // Package-only install: the core root carries no settings.json to copy, so

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.857'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.858'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -6,7 +6,7 @@
 //      $CLAUDE_PROJECT_DIR/quotes stripped; args preserved; .claude/hooks/ refs left instance-local;
 //      idempotent.
 //   2. scriptToVerb — excludes prefixArgs verbs so api.js never mis-maps to `bongos box`.
-//   3. transformSettings — rewrites only the scripts/gds hook commands, keeps .claude/hooks/ ones.
+//   3. transformSettings — rewrites the scripts/gds hook commands AND permission rules, keeps .claude/hooks/ ones.
 //   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/gds),
 //      writes settings.json, copies hooks; and NO-OPS when the target IS the core root (self-copy guard).
 //   5. task 1003486 — a UI task brings its own tools: the `materializeModuleSkills` opt-in on a
@@ -104,6 +104,44 @@ t('transformSettings: rewrites scripts/gds hook commands, keeps .claude/hooks/ o
   rmSync(dir, { recursive: true, force: true });
 });
 
+// task 1004012: the skills an instance receives run `bongos ship`, so a rule that still says
+// `node scripts/gds/ship.js` matches nothing and every blessed command meets the prompt.
+t('transformSettings: permission rules are rewritten to the form the instance\'s skills actually run', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-perm-'));
+  const p = join(dir, 'settings.json');
+  writeFileSync(p, JSON.stringify({
+    permissions: {
+      // two spellings of one command, a script with no verb of its own, and a rule that names no script
+      allow: ['Bash(node scripts/gds/ship.js:*)', 'Bash(node ./scripts/gds/ship.js:*)', 'Bash(node scripts/gds/me.js:*)', 'Bash(git status:*)'],
+      deny: ['Bash(node scripts/gds/release.js:*)', 'Bash(node scripts/gds/me.js:*)', 'Read(./.env)'],
+      ask: ['Bash(node scripts/gds/claim.js:*)'],
+      defaultMode: 'acceptEdits',
+    },
+  }, null, 2));
+  const out = JSON.parse(m.transformSettings(p)).permissions;
+  assert.deepEqual(out.allow, ['Bash(bongos ship:*)', 'Bash(bongos exec scripts/gds/me.js:*)', 'Bash(git status:*)'],
+    'allow takes the ONE spelling the skills use, and two spellings of a command collapse to one rule');
+  // An instance can reach a script two ways — `bongos release` and `bongos exec scripts/gds/release.js` —
+  // so a restrictive rule that named only one would still LOOK like a guard while guarding half.
+  assert.deepEqual(out.deny, ['Bash(bongos release:*)', 'Bash(bongos exec scripts/gds/release.js:*)', 'Bash(bongos exec scripts/gds/me.js:*)', 'Read(./.env)']);
+  assert.deepEqual(out.ask, ['Bash(bongos claim:*)', 'Bash(bongos exec scripts/gds/claim.js:*)']);
+  assert.equal(out.defaultMode, 'acceptEdits', 'a non-list permission key passes through untouched');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('transformSettings: run on the core\'s OWN settings.json, no list keeps a rule in the path form', () => {
+  const perms = JSON.parse(m.transformSettings(join(ROOT, '.claude', 'settings.json'))).permissions;
+  for (const [key, rules] of Object.entries(perms)) {
+    if (!Array.isArray(rules)) continue;
+    // A rule bongosify cannot match (a glob in the script name, say) would land on an instance
+    // naming a path nothing runs. Adding one to the core must fail HERE, where someone can decide.
+    assert.deepEqual(rules.filter((r) => /\bnode\b[^)]*scripts\//.test(r)), [], `permissions.${key}`);
+  }
+  // compared as sets: the two lists are authored in different orders, and rule order means nothing
+  assert.deepEqual([...perms.allow].sort(), [...m.STARTER_ALLOW].sort(),
+    'a checkout-materialized instance and a package-only one must end up with the same blessed commands');
+});
+
 // ---- materializeClaude -----------------------------------------------------
 t('materializeClaude: copies + rewrites skills into a fresh instance dir (no leftover node scripts/gds)', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-inst-'));
@@ -762,6 +800,24 @@ t('a package-only install (no settings.json at the core root) GETS the starter',
   rmSync(inst, { recursive: true, force: true });
 });
 
+// task 1004012 — the other source: a CHECKOUT core root does carry a settings.json, and the
+// instance used to receive its allow-list verbatim, naming scripts its skills no longer run.
+t('a checkout-materialized instance gets allow-rules in the bongos form, end to end', () => {
+  const core = mkdtempSync(join(tmpdir(), 'w3-checkout-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'w3-checkout-inst-'));
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  writeFileSync(join(core, '.claude', 'settings.json'), JSON.stringify({
+    permissions: { allow: ['Bash(node scripts/gds/claim.js:*)', 'Bash(node scripts/gds/api.js:*)', 'Bash(gh pr list:*)'] },
+  }));
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.equal(res.settings, true);
+  const allow = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.allow;
+  assert.deepEqual(allow, ['Bash(bongos claim:*)', 'Bash(bongos exec scripts/gds/api.js:*)', 'Bash(gh pr list:*)']);
+  for (const rule of allow) assert.ok(m.STARTER_ALLOW.includes(rule), `${rule} is the starter's spelling too — one form, two sources`);
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
 t("an instance's OWN settings.json is never clobbered", () => {
   const core = mkdtempSync(join(tmpdir(), 'w3-keep-core-'));
   const inst = mkdtempSync(join(tmpdir(), 'w3-keep-inst-'));