@bongos/core 1.19.862 → 1.19.864

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.862",
-  "core_contract": "1.19.862",
-  "source_commit": "ce0983547b33999b6262c9c586d0b7f9fe970689",
+  "core_version": "1.19.864",
+  "core_contract": "1.19.864",
+  "source_commit": "c073f3cd57b680341105e1e2f06e3a5c0ebb3358",
   "source_ref": "HEAD",
-  "built_at": "2026-09-18T00:41:20.268Z",
+  "built_at": "2026-09-18T01:11:02.555Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2280,
+    "functional_verbatim": 2281,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2806,
-  "tree_sha256": "3c3f933893a61cda70824e5d11211bd2d7483c501eb5a5a2e17bfea72de33382",
+  "file_count": 2807,
+  "tree_sha256": "605295e9a15f1948dd81353eab191ae7c28bbf4c6859146311c02ffc16a3e235",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -467,7 +467,7 @@
     {
       "path": "docs/adr/0010-pms-architecture.md",
       "mode": "0000644",
-      "sha256": "ccb80802371df9fc3794b08e43f7372e786531804d1501ec9e683e1992899f09"
+      "sha256": "30193a4833d15edc09bf75b41451e1ac25d48543dcbdae5c3c210e2cb9493f40"
     },
     {
       "path": "docs/adr/0011-terrain-id-rendering-model.md",
@@ -517,7 +517,7 @@
     {
       "path": "docs/adr/0020-security-model-public-stub.md",
       "mode": "0000644",
-      "sha256": "22730680f71c68b508d476bb2a1802586cfd56bffd391cb5d98cac9a928e89f1"
+      "sha256": "6b90acde1797bec054e17dd343883fc4dd2a6d8d1a9902f53da0d7fb21f94b2a"
     },
     {
       "path": "docs/adr/0021-per-builder-skill-model-preferences.md",
@@ -527,7 +527,7 @@
     {
       "path": "docs/adr/0022-secrets-policy.md",
       "mode": "0000644",
-      "sha256": "7608302b6cefddef9efabfd0a5c63dfd8f9a5480dbbb25552af092c25551420b"
+      "sha256": "3d63f192c4c596f1840f057ddd1686f2ed4504eb7712965d57ee2173580d3c58"
     },
     {
       "path": "docs/adr/0023-kind-multipliers-and-idea-bonus.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "eaa7dca723187a394a3b6ee252bbb81b13b76cc384a4651b6ee74a859af9d611"
+      "sha256": "38c851145d7b4066a378b1af75747b6cc28529b7f824bd6b7e30e0502bc6346c"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "191ec7b680ce527f312660fc8cc1505803adb992febf7deac050d43abdc987dd"
+      "sha256": "efb0a55093a321e95fbbbe4d5a0d074ef2cd3bd0148dc820fe338027465d2aed"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7927,12 +7927,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "669729fd3145c8a17880f92490b18fa7e76d6416c780e1420808be4f8c583bab"
+      "sha256": "ea96e5b57ed6cd9e4a043090b7ab48ac78b8f058b2c9767d77633a20e528ff6b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0a41309fd1fc04ef03267da5ba55d9580489ab6f598b34ef4a14d9dd79906404"
+      "sha256": "feed56a36e8348a1790db370c1ea4a6896a6e120a490116212625d8317ff4cf6"
     },
     {
       "path": "public-docs/index.html",
@@ -9877,7 +9877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b16a023fc2c2dcf233402a8e3b72214d9c8217f5df7d6f5b0925f064a6c172e5"
+      "sha256": "3ee60c835967094a7b5c983e651e0ada54b2127b2b38a329ecf8d6a9237cb0d2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11034,6 +11034,11 @@
       "mode": "0000644",
       "sha256": "acc6c86bfb9edaee192e9c363f4b578a01e1bba69422d618987d8ff75e883a63"
     },
+    {
+      "path": "tests/docs_scrubber_damage.mjs",
+      "mode": "0000644",
+      "sha256": "2d815aa719c9b83af094405b02dcb50c031267fd38cdd9306c81d592597966dd"
+    },
     {
       "path": "tests/doctor_hooks.mjs",
       "mode": "0000644",

package/docs/adr/0010-pms-architecture.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-05-09
 - **Deciders:** Lars
-- **Addendum (V3.R01, 2026-05-13):** "PMS" was renamed to "GDS" (Game Development System) when V3 opened the system to multiple builders. Folder/route/env-var renames: `src/pms/` → `src/bongos/`, `scripts/pms/` → `scripts/gds/`, `/api/pms/*` → `/api/gds/*`, `PMS_GITHUB_*` → `GDS_GITHUB_*`, `PMS_API_BASE` → `GDS_API_BASE`, `pms_session` cookie → `gds_session`, `~/.config/otb/pms-session.json` → `~/.config/otb/gds-session.json`. The version ID `PMS-V3` was also renamed to `GDS-V3` (migration `<redacted>.sql` rewrites `versions`, `tasks`, `done_when_criteria`, `idea_inbox`, plus the `pms-shipper` achievement → `gds-shipper`). Future internal-track versions ship as `GDS-V4`, `GDS-V5`, etc. The version IDs `PMS-V1` and `PMS-V2` are NOT renamed — those versions shipped under those names and their archives in `limitations/pms-v*-shipped.md` are immutable historical records.
+- **Addendum (V3.R01, 2026-05-13):** "PMS" was renamed to "GDS" (Game Development System) when V3 opened the system to multiple builders. Folder/route/env-var renames: `src/pms/` → `src/bongos/`, `scripts/pms/` → `scripts/gds/`, `/api/pms/*` → `/api/gds/*`, `PMS_GITHUB_*` → `GDS_GITHUB_*`, `PMS_API_BASE` → `GDS_API_BASE`, `pms_session` cookie → `gds_session`, `~/.config/otb/pms-session.json` → `~/.config/otb/gds-session.json`. The version ID `PMS-V3` was also renamed to `GDS-V3` (migration `019_rename_pms_v3_to_gds_v3.sql` rewrites `versions`, `tasks`, `done_when_criteria`, `idea_inbox`, plus the `pms-shipper` achievement → `gds-shipper`). Future internal-track versions ship as `GDS-V4`, `GDS-V5`, etc. The version IDs `PMS-V1` and `PMS-V2` are NOT renamed — those versions shipped under those names and their archives in `limitations/pms-v*-shipped.md` are immutable historical records.
 
   V3.R01 also introduced a transitional `/api/pms/* → /api/gds/*` redirect surface (301 for GET/HEAD, 308 for POST/PATCH/DELETE) so old skill files and cached browser clients would keep working through the rollout. **V3.R01-followup ([#308](https://example.com/builders#/task/308), 2026-05-13) removed that redirect surface** after a repo audit confirmed no caller still hits the legacy path; `/api/pms/*` is now a 404. The read-side back-compat for the `pms_session` cookie, `PMS_GITHUB_*` env vars, and the `~/.config/otb/pms-session.json` file path **continues** (in `src/bongos/auth.js` and `scripts/gds/cli-lib.js`) — those are independent of the URL surface and protect existing local sessions.
 

package/docs/adr/0020-security-model-public-stub.md

@@ -66,5 +66,5 @@ The defense doesn't depend on the ADR's secrecy. Every protection mentioned in t
 - [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) — the server-enforced trust boundary the security model rests on.
 - [ADR 0018](0018-three-rank-model-goes-live.md) — the three-rank model whose gates the security ADR documents.
 - [ADR 0019](0019-red-team-bounty-payout-table.md) — the payout table a confirmed vulnerability_report maps onto.
-- Migration [<redacted>.sql](../../migrations/<redacted>.sql) — the report intake table (R63).
+- Migration [030_vulnerability_reports.sql](../../migrations/030_vulnerability_reports.sql) — the report intake table (R63).
 - Migration [033_audit_log.sql](../../migrations/033_audit_log.sql) — the audit ledger every privileged write lands in (R35).

package/docs/adr/0022-secrets-policy.md

@@ -86,7 +86,7 @@ When a credential is rotated — either because we found a leak or because the c
 4. **Revoke the old credential** at the issuing service. Do this AFTER step 2; the brief overlap is intentional so a slow-rolling service catches both keys.
 5. **Log the rotation** — a one-line entry to [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) (date + which credential + why), so the next builder spinning up knows what changed when.
 
-GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use, revocable per session or per builder (migration `<redacted>.sql`, ADR-aligned with [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). No manual rotation needed for those except in a leak scenario, which falls under "What to do on a hit" below.
+GDS session tokens rotate automatically — they're 30-day-TTL, refresh-on-use, revocable per session or per builder (migration `035_auth_token_hygiene.sql`, ADR-aligned with [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). No manual rotation needed for those except in a leak scenario, which falls under "What to do on a hit" below.
 
 ## What to do when the scan finds a hit
 

package/docs/file-map.md

@@ -366,6 +366,7 @@ tests/
 ├── session_506_regression.mjs    ← (6D.5): the #506 regression gate — runs the engine over tests/fixtures/session-506-digest.json, asserts the hand-labelled findings (→#513/#514/#468) reproduce.
 ├── grade_attempts.mjs            ← (6D.6): logGradeAttempt swallow-safety + param coercion via an injected queryFn (no DB).
 ├── linkify_refs.mjs              ← (#604): the doc-linkifier classifier — pins which `#NNN` rewrite (tasks) vs stay bare (heading anchors, link targets, idea/blocker/session/PR ids, code spans), incl. comma-list entity inheritance + idempotency.
+├── docs_scrubber_damage.mjs      ← (task 1004027, part 4 of the scrubber-damage family after 1004021/1004022): docs/recipes/managed-settings-remote-control.md had TWO pieces of real prose replaced by the literal `<redacted>` — an in-page anchor target and an `infra/*.sh` script name — while FOUR other `<redacted>` in the same file are deliberate stand-ins for real secrets. Pins both halves: every in-page anchor resolves through docs-entropy's own parseFile (so the slug asserted is the slug the lint computes), the key-sync cron names the script `scripts/gds/box-infra.js` actually bakes into the cloud-init, and the placeholder count stays at EXACTLY four, matched by context rather than line number. The last assertion is the point — the anchor lint only reads link targets, so a global sweep of the literal would leave doc_broken_anchors at 0 while destroying four correct lines.
 ├── sandbox_stage.mjs             ← (#927, ADR 0046): sandbox-first review gate — box detection, BOX_PREVIEW_HOSTNAME parsing, previewable-surface matching, decideShipGate table, tree-stamp freshness (temp git repo), runShipGate composition with injected fs/exec/prompt.
 ├── session_start_freshness.mjs   ← (#1277, ADR 0067): the SessionStart freshness decision (decideFreshness) — pull ONLY on a clean `main` full clone strictly behind origin/main; warn in every other behind case; skip when up to date.
 ├── own_scope_guard.mjs           ← (task 1003343, goal 1000045 criterion own-scope-held-by-a-test): the OWN-SCOPE structural guard, generalised out of memory_isolation.mjs. An explicit inventory of own-scoped route files; inside them the route's declared PATH decides — a path naming no builder must never read a subject from the request (direct, optional-chained, destructured, aliased, computed-key or header), a path that DOES name one needs a per-route exemption whose gate the guard verifies is present. Repo-wide backstop: any file mounting a `/me` route must be in the inventory. Source-grepping, so it runs in the DB-free `unit` lane.

package/docs/module-api-changelog.md

@@ -2198,5 +2198,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.860 with no explicit bump. run 35290990147. (task 1002620)
   1.19.862 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.861 with no explicit bump. run 35292190396. (task 1002620)
+  1.19.863 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.862 with no explicit bump. run 35292877780. (task 1002620)
+  1.19.864 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.863 with no explicit bump. run 35294233113. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.862",
+  "version": "1.19.864",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.862",
+      "version": "1.19.864",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.862",
+  "version": "1.19.864",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.862'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.864'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/docs_scrubber_damage.mjs

@@ -0,0 +1,111 @@
+// tests/docs_scrubber_damage.mjs — the secret-scrubber ate real prose in
+// docs/recipes/managed-settings-remote-control.md (task 1004027, part 4 of the
+// damage family after 1004021 / 1004022).
+//
+// Two distinct repairs, and the SECOND is the trap. A scrubber pass replaced
+// two pieces of ordinary content with the literal `<redacted>`:
+//   - an in-page anchor target, so the link went nowhere;
+//   - an `infra/*.sh` script name, so the doc pointed at no script at all.
+// But four OTHER `<redacted>` occurrences in the same file are DELIBERATE — they
+// stand in for real secrets (a tunnel credential, two tokens, a trust seed).
+// A global sweep "fixes" the two and destroys the four, and nothing in the repo
+// would notice, because the anchor lint only ever looks at link targets.
+//
+// So this file pins BOTH halves: the anchor and the script path resolve, AND the
+// placeholder count stays at exactly four. The second assertion is the one that
+// makes a future sweep fail loudly instead of quietly.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { parseFile } = require(path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js'));
+
+const REL = 'docs/recipes/managed-settings-remote-control.md';
+const ABS = path.join(ROOT, REL);
+const raw = () => fs.readFileSync(ABS, 'utf8');
+
+// The doc is only worth asserting against while it exists at this path.
+test('the recipe under repair is still tracked at its documented path', () => {
+  assert.ok(fs.existsSync(ABS), `${REL} is missing — move this test with it`);
+});
+
+test('every in-page anchor in the recipe resolves to a heading it actually has', () => {
+  // The damaged link read `[named-tunnel automation](#<redacted>)`. Resolve
+  // through the SAME parser docs-entropy.js uses, so the slug this asserts is
+  // the slug the lint computes — a test with its own slug rule would let the
+  // doc pass here and still red the ratchet.
+  const { headings, links } = parseFile(ABS);
+  const slugs = new Set(headings.map((h) => h.slug));
+  const inPage = links.filter((l) => l.href.startsWith('#'));
+
+  assert.ok(inPage.length > 0, 'fixture sanity: the recipe does link to its own sections');
+  const broken = inPage.filter((l) => !slugs.has(l.href.slice(1)));
+  assert.deepEqual(
+    broken.map((l) => `${l.line}: ${l.href}`), [],
+    'an in-page anchor points at no heading in this file — this is what doc_broken_anchors counts',
+  );
+});
+
+test('the key-sync cron names a script the cloud-init renderer actually installs', () => {
+  // The damaged line read `infra/<redacted>.sh`. The authority for the real name
+  // is not prose anywhere: it is the renderer that bakes the script into the
+  // cloud-init, so assert the doc against THAT rather than against a literal.
+  const line = raw().split(/\r?\n/).find((l) => l.includes('GET /box/authorized-keys'))
+    ?? raw().split(/\r?\n/).find((l) => l.includes('keeps `authorized_keys` in sync'));
+  assert.ok(line, 'fixture sanity: the recipe still describes the authorized_keys sync cron');
+
+  const named = [...raw().matchAll(/`infra\/([a-z0-9-]+\.sh)`/g)].map((m) => m[1]);
+  assert.ok(
+    named.includes('box-authorized-keys-fetch.sh'),
+    `the recipe names no authorized-keys script; found ${JSON.stringify(named)}`,
+  );
+
+  // Scoped to the repaired name on purpose. Other `infra/*.sh` the recipe cites
+  // (box-connect.sh) are builder-side scripts absent from this checkout for an
+  // unrelated, pre-existing reason (idea 1000895) — asserting over all of them
+  // would red this test on a gap it is not about.
+  const renderer = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'box-infra.js'), 'utf8');
+  assert.ok(
+    renderer.includes('box-authorized-keys-fetch.sh'),
+    'box-infra.js no longer bakes box-authorized-keys-fetch.sh into the cloud-init — '
+    + 'the recipe now names a script nothing installs, so fix the doc to match the renderer',
+  );
+});
+
+test('the four deliberate <redacted> secret placeholders survive — a global sweep must fail here', () => {
+  // This is the anti-fix assertion. Each of these stands in for a real secret and
+  // is correct as written; "repairing" them is the damage, not the cure.
+  const lines = raw().split(/\r?\n/);
+  const placeholders = lines
+    .map((text, i) => ({ line: i + 1, text }))
+    .filter((l) => l.text.includes('<redacted>'));
+
+  assert.equal(
+    placeholders.length, 4,
+    'expected exactly the four secret placeholders, got:\n'
+    + placeholders.map((p) => `  ${p.line}: ${p.text.trim().slice(0, 110)}`).join('\n'),
+  );
+
+  // Named by CONTEXT, not by line number, so ordinary edits above them don't red this.
+  const contexts = ['"credential"', 'BOX_TUNNEL_TOKEN', 'BOX_SOURCE_FULL_TOKEN', '/root/.claude.json'];
+  for (const ctx of contexts) {
+    assert.ok(
+      placeholders.some((p) => p.text.includes(ctx)),
+      `the deliberate placeholder for ${ctx} is gone — a <redacted> sweep took a real secret stand-in with it`,
+    );
+  }
+
+  // And no placeholder may sit in a link target or a path again: those two shapes
+  // are exactly what the scrubber damaged.
+  for (const p of placeholders) {
+    assert.ok(
+      !/\(#<redacted>\)/.test(p.text) && !/infra\/<redacted>/.test(p.text),
+      `line ${p.line} carries scrubber damage, not a secret placeholder: ${p.text.trim().slice(0, 110)}`,
+    );
+  }
+});