@bongos/core 1.19.887 → 1.19.888

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.887",
-  "core_contract": "1.19.887",
-  "source_commit": "b874dffd8907b22a633526eddcb279c009c89b40",
+  "core_version": "1.19.888",
+  "core_contract": "1.19.888",
+  "source_commit": "7ccf0b2f4cc7f7bafb93762cbd5cfb9ed37cf546",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T20:48:51.300Z",
+  "built_at": "2026-09-19T20:57:53.725Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2264,
+    "functional_verbatim": 2266,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2787,
-  "tree_sha256": "920b5751e940860113c8a2a84ede022e547e1901077f62330213144c8612091b",
+  "file_count": 2789,
+  "tree_sha256": "42c331016e53b14ca5416a325790e2846ea0ee2c6a24177222b823a1d2977b9c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "31fdd25f81e095205720c92ce31100187f7d1c1c89eecc8b9c84f00936350352"
+      "sha256": "7f60dfa2c479fecbd5a81de040689b9ff6f9d2aa5a907f9a7fcf86b77b476fea"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3732,7 +3732,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "3ff56e388e9ae4cccb09fb072793b5544f771aeae51e8477f8a221f0c78b9515"
+      "sha256": "e9b3c905539a323d74a55f98455204bd46daca2daf49c476324e85684ba7971f"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -3754,6 +3754,11 @@
       "mode": "0000644",
       "sha256": "31a5ac35536cecd264bc989907f4cf094e050db0b8de85e7e3e7831cf7c25a9d"
     },
+    {
+      "path": "modules/agents/migrations/agents_005_cron_trigger.sql",
+      "mode": "0000644",
+      "sha256": "5d422998b1d53ee015f4a494ccede1adcb1eb90bd501bd28c1d88f9840b87367"
+    },
     {
       "path": "modules/agents/module.json",
       "mode": "0000644",
@@ -7692,12 +7697,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "356149fe3c3c69d00f16886662e5fee0ab51c4be066af64156a2b3bb7e14c69c"
+      "sha256": "d3b1b9f84e1713ff7815c19a9bd02b6c4de4dd3b44a5ede68ff56fbd5ad0cfcd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9e2d057866feafc0e9606c36335013a47ad55190c03e7beed63d1e592f2fd23a"
+      "sha256": "4cd9682e13a9a2e1e358c7bd500286378e7b5b8ceb1bb284a925b91ab8de2a08"
     },
     {
       "path": "public-docs/index.html",
@@ -9702,7 +9707,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "309fd0ddeb0185da023052aaab8967162dbdb833ade7226f49e1636440146e83"
+      "sha256": "ae3867dc81f944026ce67bae25ca927232b84accc4ed03d4ef45798526c72c46"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9844,6 +9849,11 @@
       "mode": "0000644",
       "sha256": "eea8f9e0bdf2c84fabc81e16c30e4026a7a336c1e705d614e68b805957b9b74a"
     },
+    {
+      "path": "tests/agents_cron_trigger.mjs",
+      "mode": "0000644",
+      "sha256": "be78fa37657214c39a4880d2e1b44a1647c8b509d63262ca9a4a334431d7bdde"
+    },
     {
       "path": "tests/agents_event_router.mjs",
       "mode": "0000644",
@@ -9877,7 +9887,7 @@
     {
       "path": "tests/agents_validate.mjs",
       "mode": "0000644",
-      "sha256": "9376185bc6e11571b050dcf61a993faf780cea66aa4c0844d114b1cb738043e2"
+      "sha256": "164059d69fabbd5dd70a29b29c524b5359f0346b71091e73a5e4fafa5dbc0804"
     },
     {
       "path": "tests/agents_write_routes.mjs",

package/docs/module-api-changelog.md

@@ -2248,5 +2248,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.885 with no explicit bump. run 35467975408. (task 1002620)
   1.19.887 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.886 with no explicit bump. run 35468511941. (task 1002620)
+  1.19.888 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.887 with no explicit bump. run 35468948342. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -48,8 +48,31 @@
 const EVENT_CATALOG = Object.freeze(['task.shipped', 'idea.graded.full']);
 
 // Mirrors agents_definitions_trigger_type_chk. 'event' consumes the catalog above;
-// 'on-demand' is the historian shape (a builder asks, the agent answers).
-const TRIGGER_TYPES = Object.freeze(['event', 'on-demand']);
+// 'on-demand' is the historian shape (a builder asks, the agent answers); 'cron'
+// fires on a cadence and consumes CADENCES below (task 1004008, agents_005).
+const TRIGGER_TYPES = Object.freeze(['event', 'on-demand', 'cron']);
+
+// The cadence vocabulary a 'cron' trigger may declare, in trigger_spec.cadence.
+//
+// DUPLICATED FROM scripts/gds/routine-schedule.js ON PURPOSE, for the reason
+// RANK_ORDER below is duplicated: a module may require only src/module-api.js
+// (ADR 0083), so it cannot reach into scripts/. The two copies are kept honest by
+// tests/agents_cron_trigger.mjs, which reads routine-schedule.js's own CADENCES +
+// isUniformDivisor and asserts this file agrees — a drifting copy fails there
+// rather than at some future tick.
+//
+// N MUST DIVIDE 60 for the sub-hourly form. A cron step restarts each hour, so
+// only a divisor yields a uniform period: `*/15` fires :00 :15 :30 :45 always,
+// but `*/7` fires :00…:56 then waits 4 — a "7min" cadence that is not one.
+const CADENCES = Object.freeze(['hourly', 'daily', 'weekly', 'monthly']);
+const SUBHOURLY_RE = /^([1-9]\d*)min$/;
+function isCadence(name) {
+  if (CADENCES.includes(name)) return true;
+  const m = SUBHOURLY_RE.exec(String(name == null ? '' : name));
+  if (!m) return false;
+  const n = Number(m[1]);
+  return Number.isInteger(n) && n > 0 && n < 60 && 60 % n === 0;
+}
 
 // Mirrors agents_definitions_model_tier_chk. No 'main' tier by design — an agent
 // is a subagent, never the main session.
@@ -222,6 +245,29 @@ function validateAgentDefinition(obj, opts = {}) {
     }
   }
 
+  // --- the cadence, fail-closed, the same shape as the event catalog above ----
+  // agents_005's CHECK pins that a cron definition HAS a non-empty cadence; the
+  // vocabulary is pinned here, because the sub-hourly rule is a predicate and a
+  // CHECK spelling it out would be a second copy free to drift.
+  //
+  // The reach is deliberately the EVENT BLOCK'S reach, no more: an UNWIRED
+  // cadence is refused wherever it appears, including on a non-cron definition
+  // where it is dead config. A VALID cadence on a non-cron definition is ACCEPTED,
+  // exactly as a wired `event:` on an on-demand definition is — harmless, unread,
+  // and not this validator's call to police. Saying otherwise in a comment would
+  // describe a guard that is not here.
+  if (spec) {
+    const cadence = safeGet(spec, 'cadence');
+    const hasCadenceKey = cadence !== undefined && cadence !== null;
+    if (triggerType === 'cron' && !isNonEmptyString(cadence)) {
+      E('trigger_cadence_missing', 'trigger_spec.cadence',
+        `trigger_spec.cadence: required for a 'cron' trigger — a definition with no cadence can never fire. Named cadences: ${CADENCES.join(', ')}; or a sub-hourly '<N>min' where N divides 60.`);
+    } else if (hasCadenceKey && !isCadence(cadence)) {
+      E('trigger_cadence_unwired', 'trigger_spec.cadence',
+        `trigger_spec.cadence: ${JSON.stringify(cadence)} is not a cadence. Named cadences: ${CADENCES.join(', ')}; or a sub-hourly '<N>min' where N divides 60 (so the declared period and the realized one are the same claim).`);
+    }
+  }
+
   // --- model tier -----------------------------------------------------------
   const rawTier = safeGet(obj, 'model_tier');
   const modelTier = rawTier === undefined || rawTier === null ? 'default' : rawTier;
@@ -355,6 +401,7 @@ function validateAgentDefinition(obj, opts = {}) {
 module.exports = {
   validateAgentDefinition,
   EVENT_CATALOG,
+  CADENCES, isCadence,
   TRIGGER_TYPES,
   MODEL_TIERS,
   RANK_ORDER,

package/modules/agents/migrations/agents_005_cron_trigger.sql

@@ -0,0 +1,78 @@
+-- agents_005_cron_trigger.sql — make 'cron' a trigger type that can exist (task 1004008).
+--
+-- Tasks 1002498 (the cron-router poller) and 1002501 (the cron roster) both ask
+-- for a timer whose each tick SELECTS DUE CRON AGENTS. There are none and there
+-- can be none: agents_001 pinned trigger_type to ('event','on-demand') on BOTH
+-- agents_definitions and agents_runs, and lib/validate.js mirrors it. Build the
+-- poller against that and you get a timer that is correct, tested, and selects
+-- from an empty set by construction — green tests over an unreachable branch,
+-- which is a false claim of coverage rather than coverage. This migration is the
+-- enabling half; the poller is 1002498's and is deliberately NOT built here.
+--
+-- WIDENING A FAIL-CLOSED ENUM IS THE POINT, NOT A WORKAROUND. agents_001's header
+-- calls these enums fail-closed on purpose: "an unwired trigger name is refused,
+-- never silently stored". That rule is kept — 'cron' stops being unwired in the
+-- same change that makes it storable, because lib/validate.js is widened and
+-- constrained alongside. What is still true after this: a trigger name outside
+-- the three is refused at both the validator and the constraint.
+--
+-- BOTH TABLES, AND WHY THE LEDGER MATTERS AS MUCH AS THE DEFINITION. agents_001
+-- constrains trigger_type on agents_runs too. Widen only the definition and a
+-- cron agent could be stored and enabled, and then fail at the moment it fires,
+-- when the ledger insert violates its own CHECK — the worst shape available: a
+-- definition that looks armed and cannot record a single run.
+--
+-- A CRON DEFINITION MUST SAY WHEN. agents_001 already refuses an event definition
+-- with no event name ("a definition that can never fire"). A cron definition with
+-- no cadence is the same defect wearing a different key, so it gets the same
+-- treatment rather than being left for the poller to interpret at tick time.
+-- The cadence VOCABULARY is validated in lib/validate.js, not here: the named set
+-- ('hourly','daily','weekly','monthly') plus the open-ended sub-hourly form
+-- ('15min') is a predicate, and a CHECK that tried to spell the sub-hourly rule —
+-- N must divide 60 — would be a second, drifting copy of it. The constraint
+-- pins the SHAPE (a non-empty cadence key is present); the validator pins the
+-- VALUE. That is the same division agents_001 draws for `event`.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is agents_-prefixed, there is no down-migration, and the filename is
+-- agents_-prefixed (ADR 0108 §5). Idempotent: safe to re-run. No existing row
+-- changes — widening a CHECK can only make rows MORE legal, so nothing that
+-- validates today stops validating.
+
+BEGIN;
+
+DO $$
+BEGIN
+  -- agents_definitions: the three WIRED trigger types.
+  IF EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_definitions_trigger_type_chk') THEN
+    ALTER TABLE agents_definitions DROP CONSTRAINT agents_definitions_trigger_type_chk;
+  END IF;
+  ALTER TABLE agents_definitions ADD CONSTRAINT agents_definitions_trigger_type_chk
+    CHECK (trigger_type IN ('event', 'on-demand', 'cron'));
+
+  -- agents_runs: the same three, so a cron fire can be RECORDED and not only run.
+  IF EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_runs_trigger_type_chk') THEN
+    ALTER TABLE agents_runs DROP CONSTRAINT agents_runs_trigger_type_chk;
+  END IF;
+  ALTER TABLE agents_runs ADD CONSTRAINT agents_runs_trigger_type_chk
+    CHECK (trigger_type IN ('event', 'on-demand', 'cron'));
+
+  -- The twin of agents_definitions_trigger_spec_event_chk: a cron definition
+  -- carries a non-empty cadence, or it is a definition that can never fire.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_definitions_trigger_spec_cadence_chk') THEN
+    ALTER TABLE agents_definitions ADD CONSTRAINT agents_definitions_trigger_spec_cadence_chk
+      CHECK (trigger_type <> 'cron'
+             OR (trigger_spec ? 'cadence' AND length(trigger_spec ->> 'cadence') > 0));
+  END IF;
+END $$;
+
+-- agents_001 indexes (trigger_type, trigger_spec->>'event') for the event
+-- router's "who wants this event" read. The cron router's read is a different
+-- question — "which cron agents are due" — and it is answered by scanning the
+-- cron rows, which are few. Adding a cadence index now would be indexing for a
+-- query no committed code makes; 1002498 adds one if its poller needs it.
+
+COMMENT ON CONSTRAINT agents_definitions_trigger_type_chk ON agents_definitions IS
+  'The WIRED trigger vocabulary (task 1004008 added cron). Mirrored by TRIGGER_TYPES in modules/agents/lib/validate.js — widen both together or the two disagree about what can exist.';
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.887",
+  "version": "1.19.888",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.887",
+      "version": "1.19.888",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.887",
+  "version": "1.19.888",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.887'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.888'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_cron_trigger.mjs

@@ -0,0 +1,133 @@
+// tests/agents_cron_trigger.mjs — 'cron' is a trigger type that can EXIST
+// (task 1004008, goal 1000095).
+//
+// Tasks 1002498 (cron-router poller) and 1002501 (cron roster) both select "due
+// cron agents" from a set that was empty by construction: agents_001 pinned
+// trigger_type to ('event','on-demand') on BOTH agents_definitions and
+// agents_runs, and lib/validate.js mirrored it. A poller built against that is
+// correct, tested, and unreachable — green tests over a branch nothing can enter.
+//
+// What this locks:
+//   * the THREE places that must agree (validator, definitions CHECK, runs CHECK)
+//     — the ledger constraint is the one that is easy to forget, and forgetting it
+//     yields the worst shape available: an agent that looks armed, fires, and
+//     then violates a CHECK when it tries to record the run.
+//   * the cadence VOCABULARY, including the sub-hourly divisor rule.
+//   * that validate.js's duplicated CADENCES really match scripts/gds/
+//     routine-schedule.js's, which is the copy this one was made from.
+//   * that widening the enum did not loosen it — an unwired name is still refused.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const v = require('../modules/agents/lib/validate.js');
+const schedule = require('../scripts/gds/routine-schedule.js');
+
+const sql = (f) => fs.readFileSync(path.join(ROOT, 'modules', 'agents', 'migrations', f), 'utf8');
+const mig001 = sql('agents_001_definitions.sql');
+const mig005 = sql('agents_005_cron_trigger.sql');
+
+const def = (over = {}) => ({ name: 'ship-digest', persona: 'x'.repeat(40), ...over });
+const cron = (cadence) => def({ trigger_type: 'cron', trigger_spec: { cadence } });
+
+// ---- 1. the validator ------------------------------------------------------
+
+test("'cron' is a wired trigger type", () => {
+  assert.ok(v.TRIGGER_TYPES.includes('cron'));
+  // Widening is not loosening: the enum is still closed.
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'webhook', trigger_spec: {} })).ok, false);
+  assert.deepEqual([...v.TRIGGER_TYPES].sort(), ['cron', 'event', 'on-demand']);
+});
+
+test('a cron definition must say WHEN, or it can never fire', () => {
+  const r = v.validateAgentDefinition(def({ trigger_type: 'cron', trigger_spec: {} }));
+  assert.equal(r.ok, false);
+  assert.ok(r.errors.some((e) => e.code === 'trigger_cadence_missing'),
+    'the missing cadence is named as its own error, not folded into a generic spec failure');
+});
+
+test('the cadence vocabulary: named, and sub-hourly where N divides 60', () => {
+  for (const good of ['hourly', 'daily', 'weekly', 'monthly', '15min', '5min', '30min', '1min']) {
+    assert.equal(v.validateAgentDefinition(cron(good)).ok, true, `${good} is a cadence`);
+  }
+  // 7 and 45 do not divide 60: `*/7` fires :00…:56 then waits 4, so the declared
+  // period and the realized period would be different claims.
+  for (const bad of ['7min', '45min', '0min', '60min', 'fortnightly', 'often', '']) {
+    assert.equal(v.validateAgentDefinition(cron(bad)).ok, false, `${bad} is not a cadence`);
+  }
+});
+
+test('an accepted cron definition keeps its cadence through normalization', () => {
+  // The bug class task 1004007 documents one axis over: validate accepted a field
+  // and then DROPPED it, so a definition looked configured and was not.
+  const r = v.validateAgentDefinition(cron('daily'));
+  assert.equal(r.ok, true);
+  assert.equal(r.value.trigger_spec.cadence, 'daily', 'the cadence survives into the normalized value');
+  assert.equal(r.value.trigger_type, 'cron');
+});
+
+test('the event path is untouched', () => {
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: { event: 'task.shipped' } })).ok, true);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: {} })).ok, false);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: { event: 'nope' } })).ok, false);
+});
+
+test('a VALID cadence on a non-cron definition is accepted, as a wired event is', () => {
+  // Pinned because the reach is a judgement call and the comment beside the code
+  // claims exactly this. An UNWIRED cadence is still refused wherever it appears.
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'on-demand', trigger_spec: { cadence: 'daily' } })).ok, true);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'on-demand', trigger_spec: { cadence: '7min' } })).ok, false);
+});
+
+// ---- 2. the copy that is free to drift -------------------------------------
+
+test('validate.js CADENCES agrees with routine-schedule.js, the copy it came from', () => {
+  // A module may require only src/module-api.js (ADR 0083), so validate.js cannot
+  // import this list — it holds a duplicate. This test is the thing that keeps the
+  // duplicate honest; without it the two are one edit away from disagreeing about
+  // what a cadence is, and nothing would say so until a tick.
+  assert.deepEqual([...v.CADENCES].sort(), [...schedule.CADENCES].sort());
+  for (const n of [1, 5, 7, 15, 30, 45, 60, 0]) {
+    assert.equal(v.isCadence(`${n}min`), schedule.isCadence(`${n}min`),
+      `the two copies agree on ${n}min`);
+  }
+});
+
+// ---- 3. both CHECK constraints ---------------------------------------------
+
+test('BOTH tables widen — the ledger as well as the definition', () => {
+  // agents_001 constrains trigger_type on agents_runs too. Widen only the
+  // definition and a cron agent stores, enables, fires, and THEN fails when the
+  // run insert violates its own CHECK.
+  for (const c of ['agents_definitions_trigger_type_chk', 'agents_runs_trigger_type_chk']) {
+    assert.ok(mig001.includes(c), `${c} exists in agents_001 — this test is about widening it`);
+    assert.match(mig005, new RegExp(`ADD CONSTRAINT ${c}[\\s\\S]{0,200}?'cron'`),
+      `${c} is re-added including 'cron'`);
+    assert.match(mig005, new RegExp(`DROP CONSTRAINT ${c}`),
+      `${c} is dropped before being re-added — ALTER cannot widen a CHECK in place`);
+  }
+});
+
+test('the migration pins the SHAPE of a cron spec, leaving the vocabulary to the validator', () => {
+  assert.match(mig005, /agents_definitions_trigger_spec_cadence_chk/);
+  assert.match(mig005, /trigger_type <> 'cron'/, 'the guard only binds cron rows');
+  assert.match(mig005, /trigger_spec \? 'cadence'/, 'and requires the key');
+  // The sub-hourly divisor rule must NOT be spelled in SQL — that would be a
+  // second copy of isCadence(), free to drift from the one the validator uses.
+  assert.ok(!/% *60|divid/i.test(mig005.replace(/^--.*$/gm, '')),
+    'no arithmetic cadence rule in the executable SQL — the predicate lives in one place');
+});
+
+test('the migration is additive, namespaced and idempotent (ADR 0083 §5)', () => {
+  assert.match(mig005, /IF (NOT )?EXISTS/, 'guarded so a re-run is safe');
+  assert.ok(!/\bDROP TABLE\b|\bDROP COLUMN\b/i.test(mig005), 'nothing is destroyed');
+  for (const stmt of mig005.match(/(CREATE|ALTER)\s+TABLE\s+(\w+)/gi) || []) {
+    assert.match(stmt, /\s(agents_\w+)$/, `${stmt} touches only agents_-namespaced tables`);
+  }
+});

package/tests/agents_validate.mjs

@@ -164,12 +164,20 @@ await test('an on-demand definition carrying a WIRED event is accepted', () => {
 
 // --- THE TRIGGER TYPE -------------------------------------------------------
 
-await test('TRIGGER_TYPES is the v1 pair the DB CHECK also pins', () => {
-  assert.deepEqual(TRIGGER_TYPES, ['event', 'on-demand']);
+await test('TRIGGER_TYPES is the wired set the DB CHECK also pins', () => {
+  // Was the v1 PAIR; task 1004008 added 'cron' so tasks 1002498/1002501 select
+  // from a set that can be non-empty. Kept as an exact list on purpose: widening
+  // this vocabulary must be a deliberate edit here AND in agents_005's CHECK on
+  // both agents_definitions and agents_runs (tests/agents_cron_trigger.mjs pins
+  // that the three agree).
+  assert.deepEqual(TRIGGER_TYPES, ['event', 'on-demand', 'cron']);
 });
 
 await test('an unknown trigger type is refused', () => {
-  for (const bad of ['cron', 'webhook', 'Event', 'on demand', '', null, undefined, 7, {}]) {
+  // 'cron' was this list's first entry until task 1004008 wired it. 'webhook' and
+  // 'schedule' are the plausible-but-unwired names now — the case exists to prove
+  // an unwired name is refused, so it needs names that are actually unwired.
+  for (const bad of ['webhook', 'schedule', 'Event', 'on demand', '', null, undefined, 7, {}]) {
     const r = validateAgentDefinition({ ...OK_DEF, trigger_type: bad }, OPTS);
     assert.equal(r.ok, false, `${JSON.stringify(bad)} must be refused`);
     assert.ok(hasCode(r, 'trigger_type_unknown'), `${JSON.stringify(bad)} → ${JSON.stringify(codes(r))}`);
@@ -471,7 +479,7 @@ await test('a hostile getter cannot escape the validator', () => {
 
 await test('EVERY error carries a code, a field and a human message', () => {
   const r = validateAgentDefinition(
-    { name: 'BAD NAME', trigger_type: 'cron', trigger_spec: 'nope', scope_modules: ['government'] },
+    { name: 'BAD NAME', trigger_type: 'webhook', trigger_spec: 'nope', scope_modules: ['government'] },
     { authorRank: 'xenos', allowedModules: ['agents'] },
   );
   assert.equal(r.ok, false);
@@ -485,7 +493,7 @@ await test('EVERY error carries a code, a field and a human message', () => {
 
 await test('validation reports ALL faults at once, not just the first', () => {
   // An author fixing a definition file should not have to re-run four times.
-  const r = validateAgentDefinition({ name: 'X', persona: '', trigger_type: 'cron' }, OPTS);
+  const r = validateAgentDefinition({ name: 'X', persona: '', trigger_type: 'webhook' }, OPTS);
   for (const code of ['name_invalid', 'persona_missing', 'trigger_type_unknown']) {
     assert.ok(hasCode(r, code), `${code} missing from ${JSON.stringify(codes(r))}`);
   }