@bongos/core 1.19.859 → 1.19.861

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.859",
-  "core_contract": "1.19.859",
-  "source_commit": "88f0482054c54e919261f2a12807d600816ed82a",
+  "core_version": "1.19.861",
+  "core_contract": "1.19.861",
+  "source_commit": "4e1d31227bc0a2db3534bfbaa9fedd102870074e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T22:12:12.572Z",
+  "built_at": "2026-09-17T22:42:20.133Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2804,
-  "tree_sha256": "b78ad9f6f954e75b5baea41887323131be92e116c1966a2199cca319f8b0b875",
+  "tree_sha256": "49fc880b51d9733acfbdbedf53c6d696191648b163cb0e702bc44b1722384f41",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1e68c4750a4f88d910f87d06d8f99acaabe7c8c0c393a3da8b94ecd9b3b32ca8"
+      "sha256": "5ad4d4175cf1bdfd1fc4d58946722c87309a07ff9d6146658ae7bbe32a93af51"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2d544ea0fed5368d5c140a2e44b18b8265be912369bd47dcf78b5fcfaef6d739"
+      "sha256": "a3caf19c193288a64f26ef67883b6924563861d286aaa8dc102826081692f66c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3aa07b12e96b6217ec805ae73ff8d535d1ac92c4c5d00d6074d8e92afd2672cb"
+      "sha256": "321bdc4e8a5d0a857eb37f0bcb3410dc16bc50f32f3f9b9fec7e28e90991c10b"
     },
     {
       "path": "public-docs/index.html",
@@ -8387,7 +8387,7 @@
     {
       "path": "scripts/gds/doctor.js",
       "mode": "0000644",
-      "sha256": "eaae00a0124635c26f45b4f6620ed95e913a5c2140178fb85bd3f5020dab5d44"
+      "sha256": "f690a26bac623e67d4d4a8d889c5f69b05a8afb98eda13309e73b45c9f5fbbaa"
     },
     {
       "path": "scripts/gds/enroll-control-plane.js",
@@ -9867,7 +9867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6c6509130bcd722c09a1aca7f9b4f9bcd82200c2e47b9b68659d0b831ac606e5"
+      "sha256": "e9b79cddc8f92f9cd1f7b1aa22ffd661af52a68f08f469f43879d1f9cf6df545"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11027,7 +11027,7 @@
     {
       "path": "tests/doctor_hooks.mjs",
       "mode": "0000644",
-      "sha256": "89e05751271dd18b96a2319d624403353bdc710b2e8b5c0cf6181b125cd17b76"
+      "sha256": "e07d380e22f833d9ecf48cafb546dbe75830b6b45f6a73625eca20ca385d0909"
     },
     {
       "path": "tests/edit_hints.mjs",

package/docs/module-api-changelog.md

@@ -2192,5 +2192,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.857 with no explicit bump. run 35279781206. (task 1002620)
   1.19.859 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.858 with no explicit bump. run 35280770718. (task 1002620)
+  1.19.860 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.859 with no explicit bump. run 35281454119. (task 1002620)
+  1.19.861 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.860 with no explicit bump. run 35283293619. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.859",
+  "version": "1.19.861",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.859",
+      "version": "1.19.861",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.859",
+  "version": "1.19.861",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/doctor.js

@@ -216,6 +216,41 @@ function classifyHooksState({ hooksPath, worktreeRoot, exists = fs.existsSync })
   return { status: 'ok', code: 'active', resolved, message: `core.hooksPath="${hooksPath}" → ${resolved} (exists)` };
 }
 
+// The pre-commit verdict, extracted pure so it can be tested (the classifyHooksState
+// precedent above, task 1002524).
+//
+// ABSENT IS NOT A FAULT (task 1003773). The core ships `.husky/pre-push` and
+// `.husky/post-merge` and nothing else — `.husky/pre-commit` has never existed in git
+// history, and install-git-hooks.js says outright that an instance MAY add one. Doctor
+// used to warn unconditionally that the "secrets-guard hook will not fire", which asserts
+// a live hole in the walls on every clean clone. That trains builders to skim this very
+// section — the one carrying the REAL fault, an unset core.hooksPath that genuinely does
+// disable pre-push. A false positive beside a true positive degrades the true one.
+//
+// Secrets are enforced by .claude/hooks/secret-gate.js and the CI secrets-scan in
+// .github/workflows/main-audit.yml, neither of which the old warning mentioned.
+//
+// A pre-commit file that EXISTS but is not executable is still a real fault: someone
+// installed a gate that silently does not run.
+function classifyPreCommitState({ preCommitPath, present, executable }) {
+  if (!present) {
+    return {
+      status: 'ok',
+      code: 'absent-by-design',
+      message: 'no pre-commit hook — the core ships pre-push only, by design. '
+        + 'Secrets are enforced by .claude/hooks/secret-gate.js and the CI secrets-scan.',
+    };
+  }
+  if (!executable) {
+    return {
+      status: 'warn',
+      code: 'not-executable',
+      message: `pre-commit exists but is not executable: ${preCommitPath}`,
+    };
+  }
+  return { status: 'ok', code: 'active', message: 'pre-commit hook is executable.' };
+}
+
 function checkGitPlumbing() {
   section('Git plumbing');
   const verdict = classifyHooksState({
@@ -226,16 +261,13 @@ function checkGitPlumbing() {
   report('git', verdict.message);
   if (verdict.status !== 'ok') return;
   const preCommit = path.join(verdict.resolved, 'pre-commit');
-  if (!fs.existsSync(preCommit)) {
-    warn('git', `No pre-commit file at ${preCommit} — secrets-guard hook will not fire.`);
-  } else {
-    try {
-      fs.accessSync(preCommit, fs.constants.X_OK);
-      ok('git', `pre-commit hook is executable.`);
-    } catch (_) {
-      warn('git', `pre-commit exists but is not executable: ${preCommit}`);
-    }
+  const present = fs.existsSync(preCommit);
+  let executable = false;
+  if (present) {
+    try { fs.accessSync(preCommit, fs.constants.X_OK); executable = true; } catch (_) { executable = false; }
   }
+  const pre = classifyPreCommitState({ preCommitPath: preCommit, present, executable });
+  ({ ok, warn, fail }[pre.status])('git', pre.message);
 }
 
 // --------------------------------------------------------------------------
@@ -406,7 +438,7 @@ function checkRunnerDrift() {
 // --------------------------------------------------------------------------
 // Guarded so requiring this file for its pure helpers (tests/doctor_hooks.mjs)
 // does not run the checks, which shell out to git and hit the network.
-module.exports = { classifyHooksState, runnerDriftRows };
+module.exports = { classifyHooksState, classifyPreCommitState, runnerDriftRows };
 
 if (require.main === module) (async () => {
   console.log(`${C.bold}GDS Doctor${C.reset} — local-machine health check`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.859'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.861'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/doctor_hooks.mjs

@@ -25,7 +25,7 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { classifyHooksState } = require('../scripts/gds/doctor.js');
+const { classifyHooksState, classifyPreCommitState } = require('../scripts/gds/doctor.js');
 
 let passed = 0;
 let failed = 0;
@@ -137,5 +137,36 @@ test('every verdict carries a non-empty message', () => {
 });
 
 console.log('');
+// ---- pre-commit verdict (task 1003773) -------------------------------------
+//
+// The core ships .husky/pre-push and .husky/post-merge only; .husky/pre-commit has
+// never existed in git history. Doctor warned "secrets-guard hook will not fire" on
+// every clean clone — asserting a live hole in the walls where there is none, in the
+// same section that carries the real fault (an unset core.hooksPath). Absent is OK;
+// present-but-not-executable is the case that IS a fault.
+
+test('an ABSENT pre-commit is ok, not a warning — the core ships pre-push by design', () => {
+  const v = classifyPreCommitState({ preCommitPath: '/repo/.husky/pre-commit', present: false, executable: false });
+  assert.equal(v.status, 'ok', 'a clean clone must not be warned at');
+  assert.equal(v.code, 'absent-by-design');
+  assert.doesNotMatch(v.message, /will not fire/, 'must not assert a dead security gate');
+  // It must NAME what does enforce, or it is just a silenced warning.
+  assert.match(v.message, /secret-gate\.js/);
+  assert.match(v.message, /secrets-scan/);
+});
+
+test('a pre-commit that exists but is not executable is still a WARN', () => {
+  const v = classifyPreCommitState({ preCommitPath: '/repo/.husky/pre-commit', present: true, executable: false });
+  assert.equal(v.status, 'warn', 'an installed gate that cannot run is a real fault');
+  assert.equal(v.code, 'not-executable');
+  assert.match(v.message, /not executable/);
+});
+
+test('an executable pre-commit is ok', () => {
+  const v = classifyPreCommitState({ preCommitPath: '/repo/.husky/pre-commit', present: true, executable: true });
+  assert.equal(v.status, 'ok');
+  assert.equal(v.code, 'active');
+});
+
 console.log(`${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);