@bongos/core 1.19.912 → 1.19.914

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.912",
-  "core_contract": "1.19.912",
-  "source_commit": "d9093cd602f014a948cee8ac7ea27f36d4be922b",
+  "core_version": "1.19.914",
+  "core_contract": "1.19.914",
+  "source_commit": "81b80cbc81505afaf295f223d65f33b098524874",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T16:20:10.208Z",
+  "built_at": "2026-09-20T16:45:54.496Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 504,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2817,
-  "tree_sha256": "e4f492bda78fcddcc35a433c3f5c7ca4b3e193298e923da342a7326e182fb695",
+  "tree_sha256": "1f2169776959966454ca4ed89eb86b91320d410e2212011cb5abd19639550c6a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1742,7 +1742,7 @@
     {
       "path": "docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md",
       "mode": "0000644",
-      "sha256": "b79190a5eab7109287b60afd56dd4f935c8b2f87c75a6ab9e8b52f5e76f09257"
+      "sha256": "dc2f3cbb649c974f8c13ae057a8fe662c44548a1d75ff4585b094673d5cbe22d"
     },
     {
       "path": "docs/adr/0251-a-suggestion-of-who-to-invite-is-a-recruiting-surface-and-owes-the-opt-out.md",
@@ -2642,7 +2642,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1dfb3933a3ce48499941b71978e9f462fe97c49e7d472b71022b654850093e3b"
+      "sha256": "b47e1d07dc8f26cc6a93d8c0af9ced52c80949e0d118c68acb6f6408024b40f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4277,7 +4277,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "c705435848db169f6a37832b88ae7280193232a3f0f918388a11b05072836af3"
+      "sha256": "65ff329fd00c94ed4571d852079515e173339ee070d5489ce10d5cabe219b20b"
     },
     {
       "path": "modules/government/config.js",
@@ -7797,12 +7797,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d424dadd5439bf9883d9e0e44a938ed30a2e5c63f4dd1ed336e6130dbef959e6"
+      "sha256": "7a0bf95c593548a4af11e8cacd4e79ab9b72edc7fff191c5922e0b0e04959393"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ffdc1c047d136b67d5443336e8c8874b9cf7c13868a908a486470ffdcc780f3c"
+      "sha256": "f0ee3eff2afb0f48e77843723d28397dfd39e06149216d8e41e05cf3d73fd698"
     },
     {
       "path": "public-docs/index.html",
@@ -9612,7 +9612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "b82d3257c27689e53b3d491251cc46d474c8f4da944e2e8f73242525df878484"
+      "sha256": "cfcc13ad9d554c4f6f0d8bb4df822a1e2a7f589c2bc3c2829b95b64d00f82cd0"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9802,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b0f164fe792662f67fe4184880ea2197ae4b22bec2696fdcb1693778caf44999"
+      "sha256": "6002aa90924229eb6418bed7f42c380a0c3de8f15f77a0381b44270f37b7dad0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11402,7 +11402,7 @@
     {
       "path": "tests/government_catalog.mjs",
       "mode": "0000644",
-      "sha256": "1058c2c691a05b4db0365fed68794de8cffa2c4af2c97f4e8c91ba197f67cb6d"
+      "sha256": "ba1c95ca55d8d8e256ba03f2543e44cee4272b9652742343617e35cebefe3ab9"
     },
     {
       "path": "tests/government_charter_library.mjs",
@@ -12302,7 +12302,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "fae747eaeea8e9d657de097a72e5f8d244bd2ece6c7e890ff4c9756787721bc5"
+      "sha256": "4d65821ed847d364a80920b29c82cf1ee8ac06b3a8349845902e58e75cf96c7b"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md

@@ -125,6 +125,33 @@ now a disposition over scope, not a piece of authoring.
 
 The rest of ADR 0157 stands; this touches exactly one key.
 
+### 6a. The `system` flag on that key: asked, and answered NOT NOW (2026-09-17)
+
+Raising the floor left a gap that §6 did not close and did not hide. `version.create`
+is `system: false`, and the `system` flag is what permanently bars granting a key to a
+**custom** rank. So the government may still grant `version.create` to a custom
+sub-Archon rank, and for a builder holding that rank D1 is decorative again: refused a
+goal on a building version, they cut a fresh version and put it there — exactly the
+escape hatch D1 exists to close.
+
+The question "should `version.create` become `system: true`, joining `version.close`?"
+was raised as task 1003853 and **decided by the owner on 2026-09-17: not now.**
+
+The case *for* was real and was heard: create is now a disposition over scope in this
+ADR's own words, its pair `version.close` is already `system: true`, and a gate a custom
+rank can be granted is not a gate. It lost to the cost of the remedy. `system: true` is
+**permanent and instance-wide** — it would remove for good the ability to delegate
+version authoring to any custom rank, which is a real capability an instance might want,
+and no instance has asked for the loophole to be closed. The gap is theoretical until
+someone defines a custom sub-Archon rank *and* grants it this key; at that moment it
+stops being theoretical and this is worth reopening.
+
+This subsection records that the question is **answered, not pending**. A future reader
+should not implement the one-word catalog change on the strength of the For argument
+alone — it was already weighed. `tests/government_catalog.mjs` pins `version.create` at
+`system: false` with the archon floor so the flag cannot move without someone meeting
+this decision head-on.
+
 ## 7. Consequences
 
 - The live instance is **not** in the state these rules describe, and the rules cannot be enforced on data that violates them. Bringing it over is explicit work under criterion `sv-cutover-proven-live`: fold `CB-V1` into `BONGOS-V1`, disposition the closed goals holding open tasks, rehome the catch-all tasks, and scope `BONGOS-V2` in `planning`. Each invariant lands with a query proving it.

package/docs/module-api-changelog.md

@@ -2298,5 +2298,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.910 with no explicit bump. run 35520751450. (task 1002620)
   1.19.912 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.911 with no explicit bump. run 35522352719. (task 1002620)
+  1.19.913 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.912 with no explicit bump. run 35523207325. (task 1002620)
+  1.19.914 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.913 with no explicit bump. run 35523700531. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -139,6 +139,19 @@ const PERMISSIONS = [
   // is a second-order change to what custom ranks may hold — the same reasoning that
   // keeps `dependency.cross_tier.manage` where it is — and neither ADR 0250 nor this
   // task decided it. Filed for the owner rather than taken here.
+  //
+  // ANSWERED 2026-09-17 — NOT NOW. The owner decided in an Archon session that
+  // `version.create` STAYS system:false (task 1003853, ADR 0250 §6a). The gap above is
+  // real and stands as written; it is simply not worth what closing it costs today.
+  // `system:true` is PERMANENT — it would remove, for every instance and for good, the
+  // ability to delegate version authoring to a custom rank, and no instance has asked
+  // for the loophole to be closed. The gap stays theoretical until someone actually
+  // defines a custom sub-Archon rank AND grants it this key.
+  //
+  // So: do NOT flip this to `true` on the strength of the "a gate a custom rank can be
+  // granted is not a gate" argument. That argument was heard and was not the deciding
+  // one. The revisit trigger is a concrete one — the first time such a rank exists —
+  // and tests/government_catalog.mjs pins the flag so the change cannot land silently.
   { key: 'version.create', system: false, floor: 'archon', guards: 'POST /versions — create a version + its done-when criteria (ADR 0250 §6 returns it to archon; ADR 0157 had lowered it to metic)' },
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.912",
+  "version": "1.19.914",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.912",
+      "version": "1.19.914",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.912",
+  "version": "1.19.914",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -63,6 +63,12 @@ const MODULE_GLOBS = {
     // red-team FEATURE carved to modules/security/ (BV1.R79 / 02-module-map §5).
     'src/bongos/routes/security.js',
     'server.js', 'config/',
+  
+    // ADOPTED (task 1004111): a protected path owned by no module is authorable
+    // by NO goal, because MODULE_GLOBS is the authoring territory and the shared
+    // floor is only tests/. cli-lib.js is the CLI's own argv/session plumbing —
+    // core library surface, so it sits with the rest of the kernel.
+    'scripts/gds/cli-lib.js',
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
@@ -81,6 +87,12 @@ const MODULE_GLOBS = {
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
     'migrations/',
+  
+    // ADOPTED (task 1004111): the deploy half of the ship pipeline lifecycle
+    // already owns end to end — migrate.sh runs the migrations it owns, and
+    // scripts/deploy/ is what a merge to main triggers.
+    'scripts/migrate.sh',
+    'scripts/deploy/',
   ],
   // --- credit-allocation model + ledger + pricing + gamification ---
   economy: [
@@ -316,6 +328,17 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+  
+    // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
+    // orchestrates these five provisioning CLIs, and infra/ is the shell-script
+    // tree it resolves from the instance root — the comment above has described
+    // infra/ as dev-box's since task 1002386 without the glob saying so.
+    'scripts/gds/provision-config.js',
+    'scripts/gds/provision-net.js',
+    'scripts/gds/box-infra.js',
+    'scripts/gds/cf-tunnel.js',
+    'scripts/gds/do-api.js',
+    'infra/',
   ],
   // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
   //     hook files, git hooks, root manifests, and the fitness/entropy tooling
@@ -368,6 +391,20 @@ const MODULE_GLOBS = {
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
     'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
+  
+    // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
+    // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the
+    // .husky/ it owns; git-merge-regen.js + .gitattributes are the merge-driver
+    // PAIR and must not straddle a module boundary; run-unit-tests.js is the CI
+    // runner; gen-api-client.js is the sibling of the gen-api-docs.js above.
+    // CODEOWNERS is review routing, which is this module's job.
+    'scripts/gds/install-git-hooks.js',
+    'scripts/gds/hooks/',
+    'scripts/gds/git-merge-regen.js',
+    '.gitattributes',
+    'scripts/gds/run-unit-tests.js',
+    'scripts/gds/gen-api-client.js',
+    'CODEOWNERS',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
@@ -415,6 +452,13 @@ const MODULE_GLOBS = {
     'docs/',
     '.claude/skills/', '.claude/rules/',
     'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+  
+    // ADOPTED (task 1004111): the three freshness generators that write the docs
+    // this module owns — repo-map, file-map and the session index all emit into
+    // docs/ (and CLAUDE.md), so the generator belongs with its output.
+    'scripts/gds/gen-repo-map.js',
+    'scripts/gds/gen-file-map.js',
+    'scripts/gds/gen-session-index.js',
   ],
 };
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.912'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.914'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_catalog.mjs

@@ -38,6 +38,28 @@ test('system and operational partition the catalog exactly', () => {
   assert.deepEqual([...sys, ...op].sort(), permissionKeys().slice().sort());
 });
 
+// version.create is the one key in this catalog whose `system` flag is a RECORDED
+// DECISION rather than a derivation, so it gets a tripwire of its own (task 1003853).
+//
+// WHY. ADR 0250 §6 raised its floor to archon; §6a asked whether the flag should follow
+// to `system: true` and the owner answered NOT NOW on 2026-09-17 — `system: true` is
+// permanent and would remove for good the ability to delegate version authoring to a
+// custom rank. The For argument is a good one and is written down in the catalog beside
+// the key, which is exactly why a future reader may act on it without noticing it was
+// already weighed. A comment cannot stop that; a red test can.
+test('version.create stays system:false at the archon floor — an ANSWERED question, not an open one', () => {
+  const p = byKey('version.create');
+  assert.equal(p.floor, 'archon', 'ADR 0250 §6 returned version.create to the archon floor');
+  assert.equal(p.system, false,
+    'version.create must stay system:false. This is not an oversight: ADR 0250 §6a records '
+    + 'the owner deciding NOT NOW on 2026-09-17 (task 1003853). system:true is permanent and '
+    + 'instance-wide — it removes the ability to delegate version authoring to any custom rank. '
+    + 'Read §6a before changing this; the revisit trigger is a custom sub-Archon rank actually '
+    + 'existing AND being granted this key.');
+  // The pair it is often compared to HAS made that trip, which is the whole temptation.
+  assert.equal(isSystem('version.close'), true, 'version.close is system:true — create is deliberately not');
+});
+
 test('isGrantable: operational→true, system→false, unknown→false', () => {
   assert.equal(isGrantable('idea.triage'), true);
   assert.equal(isGrantable('builder.rank.set'), false); // system

package/tests/module-scope-map.mjs

@@ -14,7 +14,7 @@ const { PROTECTED_GLOBS } = require(path.join(ROOT, 'src', 'bongos', 'permission
 const gsc = require(path.join(ROOT, 'src', 'bongos', 'goal-scope-check.js'));
 // the OLD protection rule, recomputed in-test so the shrink-only property below
 // is proved against real globs rather than a copied literal (ADR 0314).
-const { touchesOverlap } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
+const { touchesOverlap, matchOne } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
 
 test('roster covers the decided ~16 modules + kernel, each with non-empty globs', () => {
   const keys = scope.moduleKeys();
@@ -550,3 +550,104 @@ test('moduleDriftFiles degrades safely on junk input', () => {
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
   assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
 });
+
+// EVERY PROTECTED PATH HAS AN OWNING MODULE (task 1004111).
+//
+// MODULE_GLOBS is the territory deciding who may AUTHOR a task touching a path,
+// and the shared floor is only tests/. So a protected path owned by no module is
+// authorable by NO goal at all — scopeSubset returns out_of_scope whatever the
+// goal is scoped to. Nineteen paths were in that state, including infra/,
+// scripts/deploy/, scripts/migrate.sh, CODEOWNERS and the merge-driver pair.
+//
+// This is a TRIPWIRE, not a snapshot: it is computed over PROTECTED_GLOBS, so a
+// path added to the protected roster without an owner reds the build on the spot.
+//
+// THE PROBE TRAP (ADR 0314's own measurement nearly got this wrong in both
+// directions): matchOne(file, touches) takes an ARRAY as its second argument.
+// Passing a joined string iterates its characters and reports everything
+// unowned. The guard test below pins that, so this one cannot rot into a
+// vacuous pass.
+// Ownership is DIRECTIONAL, deliberately. touchesOverlap is symmetric, so a
+// module owning ONE file inside a protected directory would "own" the whole
+// directory and this tripwire would pass on a path no goal can actually author —
+// which is exactly what it caught: kernel owns src/bongos/routes/security.js,
+// and under symmetric overlap that looked like ownership of src/bongos/routes/.
+// matchOne(p, globs) asks the question the wall asks: does some module's
+// territory COVER this path?
+function ownersOf(p) {
+  return scope.moduleKeys().filter((k) => matchOne(p, scope.scopeForModule(k).globs) !== null);
+}
+
+// The one PROTECTED_GLOBS entry still owned by nobody, exempted BY NAME so the
+// tripwire stays true rather than being weakened to accommodate it.
+// src/bongos/routes/ is a blanket directory: protection covers all 18 files under
+// it, authoring covers 2 (me.js -> builder-settings, security.js -> kernel).
+// Closing it means deciding who owns the other sixteen live route files, which is
+// an ownership call and not a missing glob — filed as task 1004116. Removing this
+// entry is that task's first step.
+const UNOWNED_EXEMPT = ['src/bongos/routes/'];
+
+test('every PROTECTED_GLOBS entry is owned by at least one module', () => {
+  const unowned = PROTECTED_GLOBS
+    .filter((p) => !UNOWNED_EXEMPT.includes(p))
+    .filter((p) => ownersOf(p).length === 0);
+  assert.deepEqual(
+    unowned, [],
+    'these protected paths are authorable by NO goal — give each an owning module in MODULE_GLOBS (task 1004111)',
+  );
+});
+
+test('the exemption list is not a place to hide a new hole', () => {
+  // An exemption that silently stops applying is worse than none: it would sit
+  // in the file implying a known gap that no longer exists, and the next unowned
+  // path could be parked beside it. So assert the exemption is still REQUIRED.
+  for (const p of UNOWNED_EXEMPT) {
+    assert.ok(PROTECTED_GLOBS.includes(p), `${p} is exempted but is no longer a protected glob — drop it`);
+    assert.equal(
+      ownersOf(p).length, 0,
+      `${p} now HAS an owning module — delete it from UNOWNED_EXEMPT (task 1004116 is done)`,
+    );
+  }
+});
+
+test('...and the owner is a real module whose goal can actually author the path', () => {
+  // Ownership on paper is not ownership: assert through the REAL wall, so a glob
+  // that resolves but does not cover cannot pass. Metic is used deliberately —
+  // these are protected paths, so a sub-Metic is refused by the path wall and
+  // would prove nothing about scope.
+  for (const p of PROTECTED_GLOBS.filter((x) => !UNOWNED_EXEMPT.includes(x))) {
+    const [owner] = ownersOf(p);
+    assert.ok(owner, `${p} has no owning module`);
+    assert.equal(
+      gsc.scopeSubset([owner], [p]).ok, true,
+      `${p} resolves to owner "${owner}" but that goal's territory does not cover it`,
+    );
+  }
+});
+
+test('adopting the unowned paths did NOT change which modules are protected', () => {
+  // The property that made assignment safe rather than a re-coupling: every
+  // receiving module was ALREADY protected, so no goal became Archon-only that
+  // was not before. If this fails, an adoption widened the trust boundary.
+  for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
+    assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
+  }
+  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
+  // is the by-name pin; this states the intent of THIS task against it.
+  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+});
+
+test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
+  // Pinned because it is how this hole was nearly mis-measured twice. If a future
+  // edit passes a joined string, the tripwire above would silently "find" the
+  // whole roster unowned — or, inverted, find nothing. Prove the array form is
+  // the one with the real answer.
+  const p = '.gitattributes';
+  assert.ok(PROTECTED_GLOBS.includes(p), 'fixture assumption: .gitattributes is protected');
+  assert.ok(ownersOf(p).length > 0, 'the ARRAY form finds the real owner');
+  assert.ok(touchesOverlap([p], scope.scopeForModule('devsecops').globs), 'and the symmetric form agrees for an exactly-owned path');
+  assert.equal(
+    matchOne(p, scope.scopeForModule('devsecops').globs.join(',')), null,
+    'a STRING second argument must not be mistaken for a working query',
+  );
+});