@bongos/core 1.19.913 → 1.19.914

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.913",
-  "core_contract": "1.19.913",
-  "source_commit": "e5423d044bfab389c03a2bf60d244f83c015154c",
+  "core_version": "1.19.914",
+  "core_contract": "1.19.914",
+  "source_commit": "81b80cbc81505afaf295f223d65f33b098524874",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T16:36:18.057Z",
+  "built_at": "2026-09-20T16:45:54.496Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 504,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2817,
-  "tree_sha256": "f335bd0e9dfe731d6a3b535d10eab167f47b4517a03e5ed410bf48e8d607cc4d",
+  "tree_sha256": "1f2169776959966454ca4ed89eb86b91320d410e2212011cb5abd19639550c6a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2642,7 +2642,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "16f8d72724c91138e8fb17da0723f2901c66dee89a53e44dbc41dd65eb71b161"
+      "sha256": "b47e1d07dc8f26cc6a93d8c0af9ced52c80949e0d118c68acb6f6408024b40f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7797,12 +7797,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "599eeee82f59bc74d6e6e19ebc61bba89421c050ca7444478e13860d6e0276cf"
+      "sha256": "7a0bf95c593548a4af11e8cacd4e79ab9b72edc7fff191c5922e0b0e04959393"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "899fa307dabbae44dd14efe9d121af734c3cdbb9d0027668ff21ba5e2b8e49dd"
+      "sha256": "f0ee3eff2afb0f48e77843723d28397dfd39e06149216d8e41e05cf3d73fd698"
     },
     {
       "path": "public-docs/index.html",
@@ -9612,7 +9612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "b82d3257c27689e53b3d491251cc46d474c8f4da944e2e8f73242525df878484"
+      "sha256": "cfcc13ad9d554c4f6f0d8bb4df822a1e2a7f589c2bc3c2829b95b64d00f82cd0"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9802,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5f5e11f8e4ade6fc0642e3051c89a1f3495628cb567c0fa30037b2fd55640170"
+      "sha256": "6002aa90924229eb6418bed7f42c380a0c3de8f15f77a0381b44270f37b7dad0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12302,7 +12302,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "fae747eaeea8e9d657de097a72e5f8d244bd2ece6c7e890ff4c9756787721bc5"
+      "sha256": "4d65821ed847d364a80920b29c82cf1ee8ac06b3a8349845902e58e75cf96c7b"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/module-api-changelog.md

@@ -2300,5 +2300,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.911 with no explicit bump. run 35522352719. (task 1002620)
   1.19.913 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.912 with no explicit bump. run 35523207325. (task 1002620)
+  1.19.914 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.913 with no explicit bump. run 35523700531. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.913",
+  "version": "1.19.914",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.913",
+      "version": "1.19.914",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.913",
+  "version": "1.19.914",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -63,6 +63,12 @@ const MODULE_GLOBS = {
     // red-team FEATURE carved to modules/security/ (BV1.R79 / 02-module-map §5).
     'src/bongos/routes/security.js',
     'server.js', 'config/',
+  
+    // ADOPTED (task 1004111): a protected path owned by no module is authorable
+    // by NO goal, because MODULE_GLOBS is the authoring territory and the shared
+    // floor is only tests/. cli-lib.js is the CLI's own argv/session plumbing —
+    // core library surface, so it sits with the rest of the kernel.
+    'scripts/gds/cli-lib.js',
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
@@ -81,6 +87,12 @@ const MODULE_GLOBS = {
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
     'migrations/',
+  
+    // ADOPTED (task 1004111): the deploy half of the ship pipeline lifecycle
+    // already owns end to end — migrate.sh runs the migrations it owns, and
+    // scripts/deploy/ is what a merge to main triggers.
+    'scripts/migrate.sh',
+    'scripts/deploy/',
   ],
   // --- credit-allocation model + ledger + pricing + gamification ---
   economy: [
@@ -316,6 +328,17 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+  
+    // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
+    // orchestrates these five provisioning CLIs, and infra/ is the shell-script
+    // tree it resolves from the instance root — the comment above has described
+    // infra/ as dev-box's since task 1002386 without the glob saying so.
+    'scripts/gds/provision-config.js',
+    'scripts/gds/provision-net.js',
+    'scripts/gds/box-infra.js',
+    'scripts/gds/cf-tunnel.js',
+    'scripts/gds/do-api.js',
+    'infra/',
   ],
   // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
   //     hook files, git hooks, root manifests, and the fitness/entropy tooling
@@ -368,6 +391,20 @@ const MODULE_GLOBS = {
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
     'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
+  
+    // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
+    // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the
+    // .husky/ it owns; git-merge-regen.js + .gitattributes are the merge-driver
+    // PAIR and must not straddle a module boundary; run-unit-tests.js is the CI
+    // runner; gen-api-client.js is the sibling of the gen-api-docs.js above.
+    // CODEOWNERS is review routing, which is this module's job.
+    'scripts/gds/install-git-hooks.js',
+    'scripts/gds/hooks/',
+    'scripts/gds/git-merge-regen.js',
+    '.gitattributes',
+    'scripts/gds/run-unit-tests.js',
+    'scripts/gds/gen-api-client.js',
+    'CODEOWNERS',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
@@ -415,6 +452,13 @@ const MODULE_GLOBS = {
     'docs/',
     '.claude/skills/', '.claude/rules/',
     'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+  
+    // ADOPTED (task 1004111): the three freshness generators that write the docs
+    // this module owns — repo-map, file-map and the session index all emit into
+    // docs/ (and CLAUDE.md), so the generator belongs with its output.
+    'scripts/gds/gen-repo-map.js',
+    'scripts/gds/gen-file-map.js',
+    'scripts/gds/gen-session-index.js',
   ],
 };
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.913'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.914'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -14,7 +14,7 @@ const { PROTECTED_GLOBS } = require(path.join(ROOT, 'src', 'bongos', 'permission
 const gsc = require(path.join(ROOT, 'src', 'bongos', 'goal-scope-check.js'));
 // the OLD protection rule, recomputed in-test so the shrink-only property below
 // is proved against real globs rather than a copied literal (ADR 0314).
-const { touchesOverlap } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
+const { touchesOverlap, matchOne } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
 
 test('roster covers the decided ~16 modules + kernel, each with non-empty globs', () => {
   const keys = scope.moduleKeys();
@@ -550,3 +550,104 @@ test('moduleDriftFiles degrades safely on junk input', () => {
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
   assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
 });
+
+// EVERY PROTECTED PATH HAS AN OWNING MODULE (task 1004111).
+//
+// MODULE_GLOBS is the territory deciding who may AUTHOR a task touching a path,
+// and the shared floor is only tests/. So a protected path owned by no module is
+// authorable by NO goal at all — scopeSubset returns out_of_scope whatever the
+// goal is scoped to. Nineteen paths were in that state, including infra/,
+// scripts/deploy/, scripts/migrate.sh, CODEOWNERS and the merge-driver pair.
+//
+// This is a TRIPWIRE, not a snapshot: it is computed over PROTECTED_GLOBS, so a
+// path added to the protected roster without an owner reds the build on the spot.
+//
+// THE PROBE TRAP (ADR 0314's own measurement nearly got this wrong in both
+// directions): matchOne(file, touches) takes an ARRAY as its second argument.
+// Passing a joined string iterates its characters and reports everything
+// unowned. The guard test below pins that, so this one cannot rot into a
+// vacuous pass.
+// Ownership is DIRECTIONAL, deliberately. touchesOverlap is symmetric, so a
+// module owning ONE file inside a protected directory would "own" the whole
+// directory and this tripwire would pass on a path no goal can actually author —
+// which is exactly what it caught: kernel owns src/bongos/routes/security.js,
+// and under symmetric overlap that looked like ownership of src/bongos/routes/.
+// matchOne(p, globs) asks the question the wall asks: does some module's
+// territory COVER this path?
+function ownersOf(p) {
+  return scope.moduleKeys().filter((k) => matchOne(p, scope.scopeForModule(k).globs) !== null);
+}
+
+// The one PROTECTED_GLOBS entry still owned by nobody, exempted BY NAME so the
+// tripwire stays true rather than being weakened to accommodate it.
+// src/bongos/routes/ is a blanket directory: protection covers all 18 files under
+// it, authoring covers 2 (me.js -> builder-settings, security.js -> kernel).
+// Closing it means deciding who owns the other sixteen live route files, which is
+// an ownership call and not a missing glob — filed as task 1004116. Removing this
+// entry is that task's first step.
+const UNOWNED_EXEMPT = ['src/bongos/routes/'];
+
+test('every PROTECTED_GLOBS entry is owned by at least one module', () => {
+  const unowned = PROTECTED_GLOBS
+    .filter((p) => !UNOWNED_EXEMPT.includes(p))
+    .filter((p) => ownersOf(p).length === 0);
+  assert.deepEqual(
+    unowned, [],
+    'these protected paths are authorable by NO goal — give each an owning module in MODULE_GLOBS (task 1004111)',
+  );
+});
+
+test('the exemption list is not a place to hide a new hole', () => {
+  // An exemption that silently stops applying is worse than none: it would sit
+  // in the file implying a known gap that no longer exists, and the next unowned
+  // path could be parked beside it. So assert the exemption is still REQUIRED.
+  for (const p of UNOWNED_EXEMPT) {
+    assert.ok(PROTECTED_GLOBS.includes(p), `${p} is exempted but is no longer a protected glob — drop it`);
+    assert.equal(
+      ownersOf(p).length, 0,
+      `${p} now HAS an owning module — delete it from UNOWNED_EXEMPT (task 1004116 is done)`,
+    );
+  }
+});
+
+test('...and the owner is a real module whose goal can actually author the path', () => {
+  // Ownership on paper is not ownership: assert through the REAL wall, so a glob
+  // that resolves but does not cover cannot pass. Metic is used deliberately —
+  // these are protected paths, so a sub-Metic is refused by the path wall and
+  // would prove nothing about scope.
+  for (const p of PROTECTED_GLOBS.filter((x) => !UNOWNED_EXEMPT.includes(x))) {
+    const [owner] = ownersOf(p);
+    assert.ok(owner, `${p} has no owning module`);
+    assert.equal(
+      gsc.scopeSubset([owner], [p]).ok, true,
+      `${p} resolves to owner "${owner}" but that goal's territory does not cover it`,
+    );
+  }
+});
+
+test('adopting the unowned paths did NOT change which modules are protected', () => {
+  // The property that made assignment safe rather than a re-coupling: every
+  // receiving module was ALREADY protected, so no goal became Archon-only that
+  // was not before. If this fails, an adoption widened the trust boundary.
+  for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
+    assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
+  }
+  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
+  // is the by-name pin; this states the intent of THIS task against it.
+  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+});
+
+test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
+  // Pinned because it is how this hole was nearly mis-measured twice. If a future
+  // edit passes a joined string, the tripwire above would silently "find" the
+  // whole roster unowned — or, inverted, find nothing. Prove the array form is
+  // the one with the real answer.
+  const p = '.gitattributes';
+  assert.ok(PROTECTED_GLOBS.includes(p), 'fixture assumption: .gitattributes is protected');
+  assert.ok(ownersOf(p).length > 0, 'the ARRAY form finds the real owner');
+  assert.ok(touchesOverlap([p], scope.scopeForModule('devsecops').globs), 'and the symmetric form agrees for an exactly-owned path');
+  assert.equal(
+    matchOne(p, scope.scopeForModule('devsecops').globs.join(',')), null,
+    'a STRING second argument must not be mistaken for a working query',
+  );
+});