@bongos/core 1.19.868 → 1.19.869

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.868",
-  "core_contract": "1.19.868",
-  "source_commit": "6e35e3093dab9de214c45a87c227247fdc311bab",
+  "core_version": "1.19.869",
+  "core_contract": "1.19.869",
+  "source_commit": "1c05e3dc3377bbcf20a40718645967ba72233f33",
   "source_ref": "HEAD",
-  "built_at": "2026-09-18T18:45:12.625Z",
+  "built_at": "2026-09-18T18:53:22.567Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2812,
-  "tree_sha256": "f61ec14f3d7f288cca2d20b1c27a0d0f4685e6e3474f344058c2bb7894cc3bef",
+  "tree_sha256": "95583ff799fe688c99189403a7dd43769bb9fcd6497b578ff5ddd7704fc3c15e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3a71551ddb488315c33aa0f3bd4850e96f91e79940e801eeaa9c5c9304cdc653"
+      "sha256": "76f1f5bc881e852c64c7b486e017ff4d1b12d28b341b1a5de39b652c1cf7f4d0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7927,12 +7927,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "89633564a9bfe53d895b487d7d0d06e8f23c3c1fcbabca119e7be607be5986b5"
+      "sha256": "fae81f32534c62d0ed9a54fdd6a2671f4bcc1b4d16fc3ecb3dbfbb98b23e9fef"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "266b5d6ca4a1c4342a451577885abc475091a30a1e9bceb3a1749e579e97121d"
+      "sha256": "4bb8ccfe89e010be6ddde0cb7a301dc02d876b953679f175e28d5ca87b3192c1"
     },
     {
       "path": "public-docs/index.html",
@@ -9882,7 +9882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a1045f7acc428f16a6ebdfbcdc8ecf0eb0829c16fde30829b3c8541150372c05"
+      "sha256": "c67aa62fe4d84efbcdfd2658102ee5d2d929f9bb479d6e33e1acee5ddb84055e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13087,7 +13087,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "f1cb5f34e9ecbd072b56840facdc57ca2b9d2fa6efc48427ce738cc65a72011f"
+      "sha256": "038940af4f863bb3efc096bf522351900fbcd393c0c117f3ac75fe3a0f05ffe7"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/module-api-changelog.md

@@ -2210,5 +2210,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.866 with no explicit bump. run 35380895321. (task 1002620)
   1.19.868 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.867 with no explicit bump. run 35381947323. (task 1002620)
+  1.19.869 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.868 with no explicit bump. run 35382740500. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.868",
+  "version": "1.19.869",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.868",
+      "version": "1.19.869",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.868",
+  "version": "1.19.869",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.868'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.869'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/reward_gate.mjs

@@ -261,8 +261,16 @@ t('createTask logs a [creation] audit line on auto-assign', () => {
   // rather than depending on a magic window size. A fixed 4800-char window
   // silently broke when task 1763 added the goal_id fallback before the INSERT,
   // sliding the [creation] audit line past its end.
+  // The `end > start ? end : <bytes>` ternary this used to carry defeated its own
+  // purpose: a renamed or reordered boundary symbol did not fail, it quietly
+  // reverted to exactly the magic window the anchor was introduced to remove,
+  // while the comment above still told the next reader the slice was anchored
+  // (task 1004016). Assert the boundary instead.
   const end = dbSrc.indexOf('async function findTaskBySourceRef', start);
-  const body = dbSrc.slice(start, end > start ? end : start + 6000);
+  assert.ok(start >= 0, 'createTask not found in the lifecycle data layer');
+  assert.ok(end > start,
+    'findTaskBySourceRef boundary not found — re-anchor this slice to whatever function now follows createTask');
+  const body = dbSrc.slice(start, end);
   assert.match(body, /suggestCreditsReward/, 'createTask must reuse the capped helper');
   assert.match(body, /\[reward-gate\] AUTO-ASSIGN.*\[creation\]/s, 'createTask must log a [creation] audit line');
 });
@@ -277,8 +285,12 @@ t('POST /tasks surfaces the assigned credits_reward in the 201 response', () =>
   // `credits_reward: task.credits_reward` response line to offset 11027, 27 chars
   // past the window — failing on main and reddening every PR's `unit` check
   // (task 2026; supersedes the never-pushed task 1967, same brittleness).
+  // Same defect as the createTask sibling above, same fix (task 1004016): the
+  // fallback window made a lost boundary invisible.
   const end = tasksRouteSrc.indexOf('router.', start + 'router.post'.length);
-  const body = tasksRouteSrc.slice(start, end > start ? end : start + 13000);
+  assert.ok(end > start,
+    'next router registration not found — re-anchor this slice to whatever follows the POST /tasks handler');
+  const body = tasksRouteSrc.slice(start, end);
   assert.match(body, /credits_reward: task\.credits_reward/, 'response must surface the born-with reward');
 });