@bongos/core 1.19.912 → 1.19.913

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.912",
-  "core_contract": "1.19.912",
-  "source_commit": "d9093cd602f014a948cee8ac7ea27f36d4be922b",
+  "core_version": "1.19.913",
+  "core_contract": "1.19.913",
+  "source_commit": "e5423d044bfab389c03a2bf60d244f83c015154c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T16:20:10.208Z",
+  "built_at": "2026-09-20T16:36:18.057Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 504,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2817,
-  "tree_sha256": "e4f492bda78fcddcc35a433c3f5c7ca4b3e193298e923da342a7326e182fb695",
+  "tree_sha256": "f335bd0e9dfe731d6a3b535d10eab167f47b4517a03e5ed410bf48e8d607cc4d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1742,7 +1742,7 @@
     {
       "path": "docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md",
       "mode": "0000644",
-      "sha256": "b79190a5eab7109287b60afd56dd4f935c8b2f87c75a6ab9e8b52f5e76f09257"
+      "sha256": "dc2f3cbb649c974f8c13ae057a8fe662c44548a1d75ff4585b094673d5cbe22d"
     },
     {
       "path": "docs/adr/0251-a-suggestion-of-who-to-invite-is-a-recruiting-surface-and-owes-the-opt-out.md",
@@ -2642,7 +2642,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1dfb3933a3ce48499941b71978e9f462fe97c49e7d472b71022b654850093e3b"
+      "sha256": "16f8d72724c91138e8fb17da0723f2901c66dee89a53e44dbc41dd65eb71b161"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4277,7 +4277,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "c705435848db169f6a37832b88ae7280193232a3f0f918388a11b05072836af3"
+      "sha256": "65ff329fd00c94ed4571d852079515e173339ee070d5489ce10d5cabe219b20b"
     },
     {
       "path": "modules/government/config.js",
@@ -7797,12 +7797,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d424dadd5439bf9883d9e0e44a938ed30a2e5c63f4dd1ed336e6130dbef959e6"
+      "sha256": "599eeee82f59bc74d6e6e19ebc61bba89421c050ca7444478e13860d6e0276cf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ffdc1c047d136b67d5443336e8c8874b9cf7c13868a908a486470ffdcc780f3c"
+      "sha256": "899fa307dabbae44dd14efe9d121af734c3cdbb9d0027668ff21ba5e2b8e49dd"
     },
     {
       "path": "public-docs/index.html",
@@ -9802,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b0f164fe792662f67fe4184880ea2197ae4b22bec2696fdcb1693778caf44999"
+      "sha256": "5f5e11f8e4ade6fc0642e3051c89a1f3495628cb567c0fa30037b2fd55640170"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11402,7 +11402,7 @@
     {
       "path": "tests/government_catalog.mjs",
       "mode": "0000644",
-      "sha256": "1058c2c691a05b4db0365fed68794de8cffa2c4af2c97f4e8c91ba197f67cb6d"
+      "sha256": "ba1c95ca55d8d8e256ba03f2543e44cee4272b9652742343617e35cebefe3ab9"
     },
     {
       "path": "tests/government_charter_library.mjs",

package/docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md

@@ -125,6 +125,33 @@ now a disposition over scope, not a piece of authoring.
 
 The rest of ADR 0157 stands; this touches exactly one key.
 
+### 6a. The `system` flag on that key: asked, and answered NOT NOW (2026-09-17)
+
+Raising the floor left a gap that §6 did not close and did not hide. `version.create`
+is `system: false`, and the `system` flag is what permanently bars granting a key to a
+**custom** rank. So the government may still grant `version.create` to a custom
+sub-Archon rank, and for a builder holding that rank D1 is decorative again: refused a
+goal on a building version, they cut a fresh version and put it there — exactly the
+escape hatch D1 exists to close.
+
+The question "should `version.create` become `system: true`, joining `version.close`?"
+was raised as task 1003853 and **decided by the owner on 2026-09-17: not now.**
+
+The case *for* was real and was heard: create is now a disposition over scope in this
+ADR's own words, its pair `version.close` is already `system: true`, and a gate a custom
+rank can be granted is not a gate. It lost to the cost of the remedy. `system: true` is
+**permanent and instance-wide** — it would remove for good the ability to delegate
+version authoring to any custom rank, which is a real capability an instance might want,
+and no instance has asked for the loophole to be closed. The gap is theoretical until
+someone defines a custom sub-Archon rank *and* grants it this key; at that moment it
+stops being theoretical and this is worth reopening.
+
+This subsection records that the question is **answered, not pending**. A future reader
+should not implement the one-word catalog change on the strength of the For argument
+alone — it was already weighed. `tests/government_catalog.mjs` pins `version.create` at
+`system: false` with the archon floor so the flag cannot move without someone meeting
+this decision head-on.
+
 ## 7. Consequences
 
 - The live instance is **not** in the state these rules describe, and the rules cannot be enforced on data that violates them. Bringing it over is explicit work under criterion `sv-cutover-proven-live`: fold `CB-V1` into `BONGOS-V1`, disposition the closed goals holding open tasks, rehome the catch-all tasks, and scope `BONGOS-V2` in `planning`. Each invariant lands with a query proving it.

package/docs/module-api-changelog.md

@@ -2298,5 +2298,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.910 with no explicit bump. run 35520751450. (task 1002620)
   1.19.912 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.911 with no explicit bump. run 35522352719. (task 1002620)
+  1.19.913 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.912 with no explicit bump. run 35523207325. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -139,6 +139,19 @@ const PERMISSIONS = [
   // is a second-order change to what custom ranks may hold — the same reasoning that
   // keeps `dependency.cross_tier.manage` where it is — and neither ADR 0250 nor this
   // task decided it. Filed for the owner rather than taken here.
+  //
+  // ANSWERED 2026-09-17 — NOT NOW. The owner decided in an Archon session that
+  // `version.create` STAYS system:false (task 1003853, ADR 0250 §6a). The gap above is
+  // real and stands as written; it is simply not worth what closing it costs today.
+  // `system:true` is PERMANENT — it would remove, for every instance and for good, the
+  // ability to delegate version authoring to a custom rank, and no instance has asked
+  // for the loophole to be closed. The gap stays theoretical until someone actually
+  // defines a custom sub-Archon rank AND grants it this key.
+  //
+  // So: do NOT flip this to `true` on the strength of the "a gate a custom rank can be
+  // granted is not a gate" argument. That argument was heard and was not the deciding
+  // one. The revisit trigger is a concrete one — the first time such a rank exists —
+  // and tests/government_catalog.mjs pins the flag so the change cannot land silently.
   { key: 'version.create', system: false, floor: 'archon', guards: 'POST /versions — create a version + its done-when criteria (ADR 0250 §6 returns it to archon; ADR 0157 had lowered it to metic)' },
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.912",
+  "version": "1.19.913",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.912",
+      "version": "1.19.913",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.912",
+  "version": "1.19.913",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.912'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.913'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_catalog.mjs

@@ -38,6 +38,28 @@ test('system and operational partition the catalog exactly', () => {
   assert.deepEqual([...sys, ...op].sort(), permissionKeys().slice().sort());
 });
 
+// version.create is the one key in this catalog whose `system` flag is a RECORDED
+// DECISION rather than a derivation, so it gets a tripwire of its own (task 1003853).
+//
+// WHY. ADR 0250 §6 raised its floor to archon; §6a asked whether the flag should follow
+// to `system: true` and the owner answered NOT NOW on 2026-09-17 — `system: true` is
+// permanent and would remove for good the ability to delegate version authoring to a
+// custom rank. The For argument is a good one and is written down in the catalog beside
+// the key, which is exactly why a future reader may act on it without noticing it was
+// already weighed. A comment cannot stop that; a red test can.
+test('version.create stays system:false at the archon floor — an ANSWERED question, not an open one', () => {
+  const p = byKey('version.create');
+  assert.equal(p.floor, 'archon', 'ADR 0250 §6 returned version.create to the archon floor');
+  assert.equal(p.system, false,
+    'version.create must stay system:false. This is not an oversight: ADR 0250 §6a records '
+    + 'the owner deciding NOT NOW on 2026-09-17 (task 1003853). system:true is permanent and '
+    + 'instance-wide — it removes the ability to delegate version authoring to any custom rank. '
+    + 'Read §6a before changing this; the revisit trigger is a custom sub-Archon rank actually '
+    + 'existing AND being granted this key.');
+  // The pair it is often compared to HAS made that trip, which is the whole temptation.
+  assert.equal(isSystem('version.close'), true, 'version.close is system:true — create is deliberately not');
+});
+
 test('isGrantable: operational→true, system→false, unknown→false', () => {
   assert.equal(isGrantable('idea.triage'), true);
   assert.equal(isGrantable('builder.rank.set'), false); // system