@bongos/core 1.19.862 → 1.19.863

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.862",
-  "core_contract": "1.19.862",
-  "source_commit": "ce0983547b33999b6262c9c586d0b7f9fe970689",
+  "core_version": "1.19.863",
+  "core_contract": "1.19.863",
+  "source_commit": "f7ba964fecdad465711447780224d81c6d161651",
   "source_ref": "HEAD",
-  "built_at": "2026-09-18T00:41:20.268Z",
+  "built_at": "2026-09-18T00:51:13.074Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2806,
-  "tree_sha256": "3c3f933893a61cda70824e5d11211bd2d7483c501eb5a5a2e17bfea72de33382",
+  "tree_sha256": "a6156c439f3369569a8f4a35b905f401d800592b85c16f01f948bb1eac6126b9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -467,7 +467,7 @@
     {
       "path": "docs/adr/0010-pms-architecture.md",
       "mode": "0000644",
-      "sha256": "ccb80802371df9fc3794b08e43f7372e786531804d1501ec9e683e1992899f09"
+      "sha256": "30193a4833d15edc09bf75b41451e1ac25d48543dcbdae5c3c210e2cb9493f40"
     },
     {
       "path": "docs/adr/0011-terrain-id-rendering-model.md",
@@ -517,7 +517,7 @@
     {
       "path": "docs/adr/0020-security-model-public-stub.md",
       "mode": "0000644",
-      "sha256": "22730680f71c68b508d476bb2a1802586cfd56bffd391cb5d98cac9a928e89f1"
+      "sha256": "6b90acde1797bec054e17dd343883fc4dd2a6d8d1a9902f53da0d7fb21f94b2a"
     },
     {
       "path": "docs/adr/0021-per-builder-skill-model-preferences.md",
@@ -527,7 +527,7 @@
     {
       "path": "docs/adr/0022-secrets-policy.md",
       "mode": "0000644",
-      "sha256": "7608302b6cefddef9efabfd0a5c63dfd8f9a5480dbbb25552af092c25551420b"
+      "sha256": "3d63f192c4c596f1840f057ddd1686f2ed4504eb7712965d57ee2173580d3c58"
     },
     {
       "path": "docs/adr/0023-kind-multipliers-and-idea-bonus.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "191ec7b680ce527f312660fc8cc1505803adb992febf7deac050d43abdc987dd"
+      "sha256": "b67a7da05a53b1e15567815a30dae32036c4dc4a6fa094c63e28b7cdc349e129"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7927,12 +7927,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "669729fd3145c8a17880f92490b18fa7e76d6416c780e1420808be4f8c583bab"
+      "sha256": "d8d576d927a64fc4345b815d0f09cd76c4a0f81291fe6c9566627d040aeb4209"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0a41309fd1fc04ef03267da5ba55d9580489ab6f598b34ef4a14d9dd79906404"
+      "sha256": "8fe2a5bdbd9f52067911cfab21a28e6246d474022499d731d176e5624e25d2bb"
     },
     {
       "path": "public-docs/index.html",
@@ -9877,7 +9877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b16a023fc2c2dcf233402a8e3b72214d9c8217f5df7d6f5b0925f064a6c172e5"
+      "sha256": "c550b9efb0a77a548f269c52952abe1e92a9d4d9f9c85cceb697e32d08a8f96b"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0010-pms-architecture.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-05-09
 - **Deciders:** Lars
-- **Addendum (V3.R01, 2026-05-13):** "PMS" was renamed to "GDS" (Game Development System) when V3 opened the system to multiple builders. Folder/route/env-var renames: `src/pms/` → `src/bongos/`, `scripts/pms/` → `scripts/gds/`, `/api/pms/*` → `/api/gds/*`, `PMS_GITHUB_*` → `GDS_GITHUB_*`, `PMS_API_BASE` → `GDS_API_BASE`, `pms_session` cookie → `gds_session`, `~/.config/otb/pms-session.json` → `~/.config/otb/gds-session.json`. The version ID `PMS-V3` was also renamed to `GDS-V3` (migration `<redacted>.sql` rewrites `versions`, `tasks`, `done_when_criteria`, `idea_inbox`, plus the `pms-shipper` achievement → `gds-shipper`). Future internal-track versions ship as `GDS-V4`, `GDS-V5`, etc. The version IDs `PMS-V1` and `PMS-V2` are NOT renamed — those versions shipped under those names and their archives in `limitations/pms-v*-shipped.md` are immutable historical records.
+- **Addendum (V3.R01, 2026-05-13):** "PMS" was renamed to "GDS" (Game Development System) when V3 opened the system to multiple builders. Folder/route/env-var renames: `src/pms/` → `src/bongos/`, `scripts/pms/` → `scripts/gds/`, `/api/pms/*` → `/api/gds/*`, `PMS_GITHUB_*` → `GDS_GITHUB_*`, `PMS_API_BASE` → `GDS_API_BASE`, `pms_session` cookie → `gds_session`, `~/.config/otb/pms-session.json` → `~/.config/otb/gds-session.json`. The version ID `PMS-V3` was also renamed to `GDS-V3` (migration `019_rename_pms_v3_to_gds_v3.sql` rewrites `versions`, `tasks`, `done_when_criteria`, `idea_inbox`, plus the `pms-shipper` achievement → `gds-shipper`). Future internal-track versions ship as `GDS-V4`, `GDS-V5`, etc. The version IDs `PMS-V1` and `PMS-V2` are NOT renamed — those versions shipped under those names and their archives in `limitations/pms-v*-shipped.md` are immutable historical records.
 
   V3.R01 also introduced a transitional `/api/pms/* → /api/gds/*` redirect surface (301 for GET/HEAD, 308 for POST/PATCH/DELETE) so old skill files and cached browser clients would keep working through the rollout. **V3.R01-followup ([#308](https://example.com/builders#/task/308), 2026-05-13) removed that redirect surface** after a repo audit confirmed no caller still hits the legacy path; `/api/pms/*` is now a 404. The read-side back-compat for the `pms_session` cookie, `PMS_GITHUB_*` env vars, and the `~/.config/otb/pms-session.json` file path **continues** (in `src/bongos/auth.js` and `scripts/gds/cli-lib.js`) — those are independent of the URL surface and protect existing local sessions.
 

package/docs/adr/0020-security-model-public-stub.md

@@ -66,5 +66,5 @@ The defense doesn't depend on the ADR's secrecy. Every protection mentioned in t
 - [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) — the server-enforced trust boundary the security model rests on.
 - [ADR 0018](0018-three-rank-model-goes-live.md) — the three-rank model whose gates the security ADR documents.
 - [ADR 0019](0019-red-team-bounty-payout-table.md) — the payout table a confirmed vulnerability_report maps onto.
-- Migration [<redacted>.sql](../../migrations/<redacted>.sql) — the report intake table (R63).
+- Migration [030_vulnerability_reports.sql](../../migrations/030_vulnerability_reports.sql) — the report intake table (R63).
 - Migration [033_audit_log.sql](../../migrations/033_audit_log.sql) — the audit ledger every privileged write lands in (R35).

package/docs/adr/0022-secrets-policy.md

@@ -86,7 +86,7 @@ When a credential is rotated — either because we found a leak or because the c
 4. **Revoke the old credential** at the issuing service. Do this AFTER step 2; the brief overlap is intentional so a slow-rolling service catches both keys.
 5. **Log the rotation** — a one-line entry to [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) (date + which credential + why), so the next builder spinning up knows what changed when.
 
-GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use, revocable per session or per builder (migration `<redacted>.sql`, ADR-aligned with [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). No manual rotation needed for those except in a leak scenario, which falls under "What to do on a hit" below.
+GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use, revocable per session or per builder (migration `035_auth_token_hygiene.sql`, ADR-aligned with [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). No manual rotation needed for those except in a leak scenario, which falls under "What to do on a hit" below.
 
 ## What to do when the scan finds a hit
 

package/docs/module-api-changelog.md

@@ -2198,5 +2198,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.860 with no explicit bump. run 35290990147. (task 1002620)
   1.19.862 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.861 with no explicit bump. run 35292190396. (task 1002620)
+  1.19.863 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.862 with no explicit bump. run 35292877780. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.862",
+  "version": "1.19.863",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.862",
+      "version": "1.19.863",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.862",
+  "version": "1.19.863",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.862'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.863'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');