@bongos/core 1.19.917 → 1.19.918

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.917",
-  "core_contract": "1.19.917",
-  "source_commit": "5e828ad0df8cbaa5a638c0365e6a9f993756b6f9",
+  "core_version": "1.19.918",
+  "core_contract": "1.19.918",
+  "source_commit": "d9c3f86944e01f8135ce13bc9476f2ef3c86c00a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T17:33:13.906Z",
+  "built_at": "2026-09-20T18:32:13.181Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 506,
+    "docs_redacted": 507,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2298,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2830,
-  "tree_sha256": "5d48e907f305164b84433d1bad09d324336c2fb2924f148081143ff761c39f58",
+  "file_count": 2831,
+  "tree_sha256": "7ecf5ebe792ee91db6d6d40ef4e6b49ea2d375af7a1c100885d66c7e266e5171",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2062,7 +2062,7 @@
     {
       "path": "docs/adr/0314-module-protection-is-per-path-not-per-module.md",
       "mode": "0000644",
-      "sha256": "accaba461051e427c251e9c4ec4ff74304447fd6cd68f940311f4b978ff234c2"
+      "sha256": "d408c3f7bee29bbdf5f537ec7ed4559b88fae5d8074a8d58e556dc9e65bff46d"
     },
     {
       "path": "docs/adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md",
@@ -2079,10 +2079,15 @@
       "mode": "0000644",
       "sha256": "4dd5bbb9c14e4ba19568646ceea2d29b66c46b99555d6c236a25b7b40097756c"
     },
+    {
+      "path": "docs/adr/0318-listing-a-file-for-task-affinity-is-not-owning-it.md",
+      "mode": "0000644",
+      "sha256": "d5364169236db8c8d1a7968051fba352bb368aca53b19e554f172e0c3dc90d5d"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "05a90e437ed0c53a9bcc4f310f9cb056c4f8aa333ab8953f2f56a20d4381f7f9"
+      "sha256": "9cebfdfef7de4b2c0ede697b30f387121f2a4a0df695b21b205f16acea84bad9"
     },
     {
       "path": "docs/api-reference.md",
@@ -2652,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7459f942b736ed35b74c50c3f95279e64f3c80dc7e06d686aef147bf6c3bb62c"
+      "sha256": "824b753887223eeba6c21424a6a1f0984235e33165799114ac4a40993bb9b080"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7847,12 +7852,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fd2d387fbc65cce2c412625937abd7fd2c7760083fd0768aa8ae45c2e8bd4992"
+      "sha256": "9842c68958d709653d9006a15332aa271621aaa6e4fac8de8411896a6c103042"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bfee39b9a538046973186020153d4058238ccd25e55c8874316fd5ebab0c42c2"
+      "sha256": "31b797c1d71820a20e2744debb104990294e44cf943d24aeed1b77b35e2f1b2a"
     },
     {
       "path": "public-docs/index.html",
@@ -9662,7 +9667,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "cfcc13ad9d554c4f6f0d8bb4df822a1e2a7f589c2bc3c2829b95b64d00f82cd0"
+      "sha256": "40f2196830c746ed440ba91b938bece8ba48fdf225285c6a6d5dccd109d47d3d"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9852,7 +9857,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d0494683c02dfc17a402568d4ed72ccc574b73b4813d06de8eda9ccfcafe09d9"
+      "sha256": "250d1791c44836efe9407a5a524a0171bf7ad0c9b337c0cfaa6dd4c491b76d7c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12357,7 +12362,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "4d65821ed847d364a80920b29c82cf1ee8ac06b3a8349845902e58e75cf96c7b"
+      "sha256": "0a6878a91c21b5e8c31f0c06518177969f907cb0a980733c2ec1a89f8621bcb8"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/adr/0314-module-protection-is-per-path-not-per-module.md

@@ -111,11 +111,16 @@ new derivation mechanism. Filed separately:
   structural path test — directories under `scripts/` are territory and still
   protect), narrowing the derived set from twelve to the nine predicted below.
   Nothing was unprotected to achieve it and the path wall did not move.
-- **`builder-settings`, deliberately out of scope.** Its overlap is
-  `src/bongos/routes/me.js` caught by the blanket `src/bongos/routes/` prefix, so
-  narrowing it means either finishing the strangler move of `me.js` into
-  `modules/builder-settings/` or narrowing a blanket protected glob — a security
-  change with its own blast radius.
+- ~~**`builder-settings`, deliberately out of scope.**~~ **Resolved** by
+  [ADR 0318](0318-listing-a-file-for-task-affinity-is-not-owning-it.md)
+  ([task 1004110](https://cloudbongos.com/builders#/task/1004110)), and by neither
+  of the two routes predicted here. Its overlap was `src/bongos/routes/me.js`
+  caught by the blanket `src/bongos/routes/` prefix — but that glob was a task
+  AFFINITY listing, not an ownership claim, on a file `MODULE_GLOBS` itself
+  called a core facade. Ownership moved to `kernel`, where the aggregator
+  belongs; the blanket glob was left alone (all eighteen route files are
+  protected by it and nothing else) and no strangler move was needed (the
+  aggregator resolves ten module ports). The derived set narrows nine to eight.
 - **Nine protected paths are owned by no module at all** — `gen-repo-map.js`,
   `gen-file-map.js`, `gen-session-index.js`, `install-git-hooks.js`, `cli-lib.js`,
   `run-unit-tests.js`, `git-merge-regen.js`, `scripts/gds/hooks/` and

package/docs/adr/0318-listing-a-file-for-task-affinity-is-not-owning-it.md

@@ -0,0 +1,101 @@
+# ADR 0318 — Listing a file for task affinity is not claiming to own it
+
+- **Status:** accepted — **implemented** by [task 1004110](https://cloudbongos.com/builders#/task/1004110) (2026-09-20)
+- **Date:** 2026-09-20
+- **Task:** [task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2
+- **Extends** [ADR 0314](0314-module-protection-is-per-path-not-per-module.md), which left this case open by name.
+- **Supersedes nothing.**
+
+## The question
+
+After [ADR 0314](0314-module-protection-is-per-path-not-per-module.md), nine
+modules derive `protected` — making a goal scoped to them Archon-only to create.
+`builder-settings` was one of them, and it earned that on exactly one glob:
+`src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix in
+`PROTECTED_GLOBS`.
+
+ADR 0314 named this and left it, because clearing it looked like it needed one of
+two expensive things: finishing the strangler move of `me.js` into
+`modules/builder-settings/`, or narrowing a blanket protected glob. Both were
+scoped out. The task that picked this up was written the same way — those two
+options, and *"the choice is the deliverable"*.
+
+Both are wrong, and measuring them is what shows a third thing was actually broken.
+
+## What the measurements said
+
+**Narrowing the blanket prefix removes the only wall that exists.** All eighteen
+files under `src/bongos/routes/` are protected by that prefix *and nothing else* —
+no route file has a second protecting glob. Narrowing it unwalls `auth.js`,
+`builders.js`, `backup.js` and `core-update.js` in the same stroke. This is now
+pinned as a test rather than left as a caution, so the next reader does not have
+to re-derive it.
+
+**Moving `me.js` into `modules/builder-settings/` inverts the port architecture.**
+`GET /me` is a deliberate aggregator: it resolves **ten** module ports —
+`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`,
+`box.hasEverConnected`, `art.sharedKeyConfigured`, `art.getBuilderGeminiKeyRow`,
+`discord.isLinked` — and `builder-settings` is one of the ten. Hosting it inside
+one module would mean that module resolving nine foreign ports from the inside,
+which is the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md)
+rule 1 exists to forbid. A core facade is precisely what prevents that.
+
+Three places already said so, in the code, before this task was written: the file
+header (*"This file kept only the read aggregation"*), `module.json` (*"the
+`GET /me` aggregator stays a thin core facade"*), and `MODULE_GLOBS` itself.
+
+## The decision
+
+**`MODULE_GLOBS` listed `src/bongos/routes/me.js` under `builder-settings` for
+task affinity — and said so in the same comment — while `isProtected()` read it
+as an ownership claim.** Affinity is a convenience for authoring; ownership is a
+statement about territory. One listing, read as the other, made a whole module
+Archon-only on the strength of a file its own comment called core.
+
+So: **ownership follows what the file is.** `src/bongos/routes/me.js` moves to
+`kernel`, which already owns `src/bongos/routes/security.js` and is the home of
+the core route surface. `builder-settings` keeps its own directory and its
+pref-mirroring CLI, and stops being protected.
+
+This is [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) one step
+on. That decision said *owning the command is not owning the authority*, for a CLI
+entrypoint that merely lives near a module. The same error wearing different
+clothes: **being listed next to a module is not owning it either.** 0314 solved
+its case structurally, with a path test (`isCommandPath`). This one is solved by
+correcting the data, because there is exactly one such listing — see below.
+
+## Why not a general affinity tier
+
+The obvious generalisation is to mark affinity entries in `MODULE_GLOBS` so
+`isProtected()` skips them, mirroring `isCommandPath`. Rejected, because the
+audit does not support it. Of the nine protected modules, three others
+(`kernel`, `devsecops`, `methodology`) are protected only by paths outside their
+own directory — but in every one of those the foreign path genuinely *is* the
+domain: `kernel` **is** `src/bongos/auth.js`, `devsecops` **is** `.github/`,
+`methodology` **is** `CLAUDE.md` and `docs/`.
+
+`builder-settings` was the only module protected by a path its own source
+described as belonging elsewhere. A new tier in `MODULE_GLOBS` would be a new
+concept, and a new place for a hole to hide, built for a population of one.
+
+## Consequences
+
+- `protectedModules()` goes **9 -> 8**. `builder-settings` leaves the set.
+- **The wall that matters does not move.** This decides who may CREATE a goal
+  whose territory includes `/me`. It does not decide who may WRITE it: a
+  sub-Metic builder touching `src/bongos/routes/me.js` is still refused by
+  `checkPermissionPaths`, which the tests assert directly rather than assume.
+- A `builder-settings`-scoped goal can no longer author a task touching `/me`;
+  that needs `kernel` scope. Correct, rather than a loss — the aggregator spans
+  ten modules and belongs to none of them.
+- `src/bongos/routes/` now has **two** of eighteen files owned, up from two with
+  one of them wrong. The other sixteen remain authorable by no goal;
+  [task 1004116](https://cloudbongos.com/builders#/task/1004116) holds that
+  decision, and this change removes the builder-settings overlap that made its
+  option (a) awkward.
+
+## Not built here
+
+- **The other sixteen route files.** Still unowned, still
+  [task 1004116](https://cloudbongos.com/builders#/task/1004116). The blanket-prefix
+  tripwire added here is the measurement that task needs, landed early.

package/docs/adr/README.md

@@ -409,3 +409,4 @@ This keeps the decision history honest and traceable.
 | 0316 | [**The ignite floor is a scheduling dial, not the trusted tier** ([task 1004084](https://cloudbongos.com/builders#/task/1004084), goal 1000095 — BONGOS-V2). BV2 decision 3 makes the ignite floor — who may turn a quick idea straight into claimable work — a per-instance setting, and decision 16 adds the descent decay rate beside it, the two to share one home. Both the spec and the seeded task described the mechanism the same way: the floor IS the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this is "a setting, not a refactor". Tracing the code before building refuted that: `METIC_PLUS` is spelled once but READ for four semantically different gates — the two `decideLanding` bug branches (land at `ready` or at `backlog`), `mayProposeCriterion` (who may file a `kind='criterion-proposal'`, a planning-scope write), and the protected-scope wall in `authorizeRoutedLanding` (who may route work into the permission / ship-grade / deploy / migration core). Only the first two are the ignite floor, so making the CONSTANT configurable would mean an instance setting its floor to `xenos` — exactly the "project of one wants every thought claimable" case the owner asked for — ALSO gaining the right to file criterion-proposals and to breach the protected core. The codebase already said so in three places nobody had read into the spec: the constant's own header ("It grants nothing — the server-side rank floor and the goal's scope wall are separate, load-bearing gates"), the protected-scope branch ("the two are layers, not alternatives"), and `tests/filing_abuse_matrix.mjs`, which models the widening as an ATTACK and pins the literal. Decision: a separate dial. `modules/ideas/config.js` + `config/ideas.neutral.json` carry both knobs on the `modules/government/config.js` precedence (env -> instance root `config/ideas.json` -> core root neutral; the ADR 0268 dual-root split matters, since one root reads the host pack out of `node_modules` where `npm ci` erases it). `igniteFloor` defaults to `metic`, resolving to exactly the `METIC_PLUS` set, and is threaded into `decideLanding` as a ready-made `trustedRanks` **Set** by the callers — `routing.js` is TOLD the floor and never reads config, staying pure and DB-free — while `METIC_PLUS` stays a FIXED constant for the other two gates, neither of which takes a floor argument (pinned structurally). `descentDecayRate` defaults to 0.5 and ships with no production caller, because R11 is its intended reader and depends on the unbuilt R08 — the same deliberate slice boundary `modules/government/config.js` documents for itself, and what decision 16 asked for. Everything fails to VANILLA rather than dead: a malformed pack, an unknown rank or an out-of-band rate falls back, and an unrecognised floor yields the DEFAULT set, never an empty one (failing closed would stop every ignition on a typo). Rejected: configuring `METIC_PLUS` as written (a security widening in a config file's clothes); splitting it into four named constants (the other three want the same fixed tier, and naming them invites configuring them); having `routing.js` read the config itself (makes the landing matrix impure and untestable at a different floor). Spec decision 3's "spelled in one place" describes the intent, not the mechanism; the spec was not edited and the task description was amended in flight.](0316-the-ignite-floor-is-not-the-trusted-tier.md) | ideas / permissions |
 | 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |
 | 0317 | [**A plane that cannot give an instance its own account is refused, not given a shared uid** ([task 1004018](https://cloudbongos.com/builders#/task/1004018), goal 1000106 — BONGOS-V2). The last of the three container gaps [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) deferred, and the sibling of [ADR 0315](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md). [ADR 0281](0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) makes an instance's identity its own unix account, and the unit's `User=`/`Group=` is what stops one co-tenant reading a sibling's `/proc/<pid>/environ` — where every instance's `EnvironmentFile` carries its GitHub App private key and OAuth client secret (audit B3). `useradd` needs uid 0; the self-host image is `node:22-bookworm-slim` running `USER node` with **no sudo**, so there the account cannot be created at all. **Two failure shapes, neither honest**: today step 1c's `boxExec(ensureInstanceUserCmd(...))` is not `allowFail`, so it throws AFTER every preflight passed, AFTER the status flip to `provisioning`, and — for a standalone — after a repo pull and an `npm ci`, recording a crash with the box half-changed; and tomorrow it goes quiet, because a compose self-host only stops short of step 1c by ADR 0315's coincidence, and 0315 says in its own consequences that a future front door **replaces** that refusal. Decision: `accountPlaneGap(exec, { privileged })` in `provision-repo.js` probes with `${sudo}sh -c 'test "$(id -u)" = 0'` and `provisionInstance` refuses with `Account preflight failed: …` before any mutation. **The probe runs the SAME escalation the mutation will** (`PROVISION_SUDO=1` renders the same `sudo ` prefix `ensureInstanceUserCmd` uses), so a pass is evidence rather than inference. **`sh -c`, not a bare `test`, is load-bearing**: under sudo the outer unprivileged shell would expand `$(id -u)` first and answer about the wrong user, passing on exactly the plane this refuses — and for the same reason there is no pipeline, whose exit status is its last stage's. **Only a shell that ran and answered proves it**: `boxExec` is `ssh <host> bash -s` under remote exec, so exit 1 (`test` said no) and 127 (no sudo binary) are read as proof while ssh's own 255 answers "could not confirm" with the real cause leading — ADR 0315's rule applied to a different question. Ordered **third**, after capacity and ingress and before 0303's wiring check: the first three ask about the PLANE, 0303 asks about this instance's DOMAIN, and 0315's order is extended rather than rearranged. **Rejected: accepting it** — documenting a self-host container as single-tenant with a shared uid is a silent downgrade of the vector 0281 closed, observable nowhere on the running box, and "single-tenant" is not what a container hosting several child projects is; **an identity seam with a container implementation**, because nothing exists to put behind it and a seam whose second backend does nothing is 0315's no-op wearing a seam's clothes; **probing `useradd --help` / `command -v useradd`**, which succeed unprivileged on the very image this refuses; **`${sudo}id -u` compared against `0`**, which decides on captured stdout where every sibling preflight and every test fake treats exit status as the contract; and **refusing inside step 1c**, which keeps the refusal after the status flip. Not covered, deliberately: root-but-no-`useradd` (an Alpine-style plane fails loudly at step 1c as today), and teardown (0315's reason — a refusal there strands a row instead of cleaning it). No `PROVISION_ALLOW_SHARED_UID`: a runner either reaches root on this plane or it does not.](0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md) | provisioning / identity |
+| 0318 | [**Listing a file for task affinity is not claiming to own it** ([task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2). The case [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) named and left open, closed by neither of the two routes it predicted. `builder-settings` derived `protected` — Archon-only to scope a goal to — on exactly one glob, `src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix. **That glob was never an ownership claim:** `MODULE_GLOBS` listed it for task AFFINITY and said in the same comment that the `GET /me` aggregator stays a thin core facade, and `isProtected()` cannot tell the two apart. **Both predicted routes were measured and rejected.** Narrowing the blanket prefix: all eighteen files under `src/bongos/routes/` are protected by that prefix AND NOTHING ELSE, so narrowing unwalls `auth.js`, `builders.js`, `backup.js` and `core-update.js` together — now pinned as a tripwire test rather than left as a caution. Moving `me.js` into `modules/builder-settings/`: the aggregator resolves TEN module ports (`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`, `box`, `art` ×2, `discord`) and `builder-settings` is one of them, so hosting it inside one module means resolving nine foreign ports from the inside — the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 forbids. Decision: **ownership follows what the file is** — `me.js` moves to `kernel`, which already owns `src/bongos/routes/security.js`. This is 0314 one step on: owning the command is not owning the authority, and **being listed next to a module is not owning it either**. **Rejected: a general affinity tier** in `MODULE_GLOBS` mirroring `isCommandPath` — the audit does not support it. Three other modules (`kernel`, `devsecops`, `methodology`) are also protected only by paths outside their own directory, but in each the foreign path genuinely IS the domain; `builder-settings` was the only module protected by a path its own source called core, so a new tier would be a new place for a hole to hide, built for a population of one. `protectedModules()` goes 9 -> 8. **The wall that matters does not move:** a sub-Metic builder touching `/me` is still refused by `checkPermissionPaths`, asserted directly rather than assumed. The sixteen still-unowned route files remain [task 1004116](https://cloudbongos.com/builders#/task/1004116), whose option (a) this de-risks.](0318-listing-a-file-for-task-affinity-is-not-owning-it.md) | permissions / module scope |

package/docs/module-api-changelog.md

@@ -2308,5 +2308,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.915 with no explicit bump. run 35525694524. (task 1002620)
   1.19.917 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.916 with no explicit bump. run 35526196428. (task 1002620)
+  1.19.918 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.917 with no explicit bump. run 35529342372. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.917",
+  "version": "1.19.918",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.917",
+      "version": "1.19.918",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.917",
+  "version": "1.19.918",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -62,6 +62,14 @@ const MODULE_GLOBS = {
     // exploit-detail engagement-doc store (/security/docs). Stays kernel when the
     // red-team FEATURE carved to modules/security/ (BV1.R79 / 02-module-map §5).
     'src/bongos/routes/security.js',
+    // The GET /me AGGREGATOR (task 1004110, ADR 0318). A core facade, not a
+    // builder-settings file: it resolves TEN module ports (lifecycle, reward,
+    // onboarding, government, specialities, grade, box, art, discord) and
+    // builder-settings is merely one of them. It was listed under that module
+    // for task AFFINITY, and the affinity listing alone made the whole module
+    // protected - ADR 0314 in a second costume. Ownership follows what the
+    // file IS, and what it is is the core read facade over ten modules.
+    'src/bongos/routes/me.js',
     'server.js', 'config/',
   
     // ADOPTED (task 1004111): a protected path owned by no module is authorable
@@ -140,11 +148,13 @@ const MODULE_GLOBS = {
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
-  // `builder-settings` kernel PORT. The `GET /me` aggregator stays a thin core
-  // facade (routes/me.js) resolving that port — listed for task affinity. The
-  // pref-mirroring CLIs travel with the domain but stay under scripts/.
+  // `builder-settings` kernel PORT. The `GET /me` aggregator is NOT here: it
+  // stays a thin core facade resolving that port, and since task 1004110
+  // (ADR 0318) it is owned by KERNEL. Listing it here for task AFFINITY was
+  // the single glob that made this whole module protected, on a file the
+  // comment itself said was core. The pref-mirroring CLIs travel with the
+  // domain but stay under scripts/.
   'builder-settings': [
-    'src/bongos/routes/me.js',
     'scripts/gds/fetch-sound-prefs.js',
     'modules/builder-settings/',
   ],

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.917'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.918'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -2,6 +2,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -78,12 +79,24 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
 // three is still refused by the path wall (asserted below). What changed is who
 // may CREATE a goal whose territory happens to include them.
 //
-// `builder-settings` STAYS, deliberately: its overlap is src/bongos/routes/me.js
-// caught by the blanket src/bongos/routes/ prefix, not a command, so narrowing it
-// needs the me.js strangler move or a blanket-glob change — out of scope here.
+// NARROWED NINE -> EIGHT BY ADR 0318 (task 1004110). `builder-settings` left the
+// set. It derived protected on exactly one glob, src/bongos/routes/me.js, caught
+// by the blanket src/bongos/routes/ prefix. That glob was never an ownership
+// claim: MODULE_GLOBS listed it for task AFFINITY and said in the same comment
+// that the GET /me aggregator stays a thin CORE facade. It resolves ten module
+// ports and builder-settings is one of them, so the file is kernel territory and
+// is now owned there. Same shape as ADR 0314 one step on: owning the command is
+// not owning the authority, and neither is being listed next to it.
+//
+// Neither of the two routes the task proposed was taken, and the measurements are
+// why. Narrowing the blanket prefix was rejected because all 18 files under
+// src/bongos/routes/ are protected by that prefix AND NOTHING ELSE, so narrowing
+// removes the only wall from auth.js, builders.js, backup.js and core-update.js.
+// Moving me.js into modules/builder-settings/ was rejected because a ten-port
+// aggregator inside one module would have to resolve nine foreign ports from
+// inside a module, which is the core->module edge ADR 0083 rule 1 forbids.
 const PROTECTED_MODULES = [
   'agents',
-  'builder-settings',
   'dev-box',
   'devsecops',
   'government',
@@ -632,9 +645,16 @@ test('adopting the unowned paths did NOT change which modules are protected', ()
   for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
     assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
   }
-  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
-  // is the by-name pin; this states the intent of THIS task against it.
-  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+  // and the adoption changed no COUNT either. Pinned against PROTECTED_MODULES
+  // rather than a literal, so the by-name pin above stays the single place the
+  // set is spelled out: a deliberate departure (ADR 0318 removing
+  // builder-settings) edits one list, while an ACCIDENTAL widening still reds
+  // both this and the by-name test. A literal here duplicated the roster and
+  // made an intended change look like two unrelated failures.
+  assert.equal(
+    scope.protectedModules().length, PROTECTED_MODULES.length,
+    'adoption must not change the size of the protected set',
+  );
 });
 
 test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
@@ -651,3 +671,76 @@ test('the probe trap: matchOne takes an ARRAY, and a string reports everything u
     'a STRING second argument must not be mistaken for a working query',
   );
 });
+
+// --- ADR 0318: the GET /me aggregator is kernel territory (task 1004110) ---
+
+test('the GET /me aggregator is owned by kernel, not by builder-settings', () => {
+  // The affinity listing that made a whole module Archon-only. MODULE_GLOBS put
+  // src/bongos/routes/me.js under builder-settings and said in the same comment
+  // that the aggregator stays a thin CORE facade - so the glob was task affinity,
+  // never an ownership claim, and isProtected() could not tell the two apart.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    matchOne(ME, scope.scopeForModule('kernel').globs),
+    'kernel must own the /me aggregator - it is the core read facade over ten module ports',
+  );
+  assert.equal(
+    matchOne(ME, scope.scopeForModule('builder-settings').globs), null,
+    'builder-settings must NOT own /me: it is one of the ten ports the facade resolves, not its home',
+  );
+});
+
+test('builder-settings is not protected, and its own territory is what says so', () => {
+  assert.equal(
+    scope.scopeForModule('builder-settings').protected, false,
+    'builder-settings derived protected on the me.js affinity listing alone - removing it is the whole point of ADR 0318',
+  );
+  // Prove the module did not simply lose its territory on the way: it still owns
+  // its own directory, and that directory is genuinely not protected. Without
+  // this, blanking the globs entirely would pass the assertion above.
+  assert.ok(
+    matchOne('modules/builder-settings/interaction-prefs.js', scope.scopeForModule('builder-settings').globs),
+    'builder-settings must still own its own module directory',
+  );
+});
+
+test('unprotecting builder-settings did NOT open the path wall on /me', () => {
+  // The half that would make this a false success, mirroring the ADR 0314 test
+  // above. The module flag decides who may CREATE a goal over the territory; the
+  // per-file wall decides who may WRITE it. Only the first was meant to move.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    touchesOverlap([ME], PROTECTED_GLOBS),
+    'fixture assumption: /me is still a protected surface via the src/bongos/routes/ prefix',
+  );
+  assert.equal(gsc.scopeSubset(['kernel'], [ME]).ok, true, 'fixture assumption: kernel now owns /me');
+  const r = gsc.check(['kernel'], [ME], 'thetes');
+  assert.equal(r.ok, false, 'a sub-Metic builder must still be refused on /me');
+  assert.equal(r.code, 'protected_path', '/me must be refused BY THE PATH WALL, not by scope');
+  assert.equal(gsc.check(['kernel'], [ME], 'metic').ok, true, 'a Metic must still be able to author on /me');
+});
+
+test('every file under src/bongos/routes/ is protected by the blanket prefix AND NOTHING ELSE', () => {
+  // The measurement that killed the other option on task 1004110, pinned so the
+  // next reader does not have to re-derive it. Narrowing the blanket
+  // src/bongos/routes/ prefix looks like a small change and is not: it is the
+  // ONLY protection every route file has, auth.js and core-update.js included.
+  //
+  // If this reds because a route gained its own PROTECTED_GLOBS entry, that is
+  // fine and the exemption should be stated deliberately. If it reds because the
+  // blanket entry went away, read task 1004116 before touching anything.
+  const BLANKET = 'src/bongos/routes/';
+  assert.ok(PROTECTED_GLOBS.includes(BLANKET), 'the blanket route prefix must still be a protected glob');
+  const others = PROTECTED_GLOBS.filter((g) => g !== BLANKET);
+  const dir = path.join(ROOT, 'src', 'bongos', 'routes');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js') || f.endsWith('.md'));
+  assert.ok(files.length >= 18, 'expected the route directory to still be populated, saw ' + files.length);
+  for (const f of files) {
+    const rel = BLANKET + f;
+    assert.ok(touchesOverlap([rel], PROTECTED_GLOBS), rel + ' must be protected');
+    assert.deepEqual(
+      others.filter((g) => matchOne(rel, [g])), [],
+      rel + ' is protected by the blanket prefix alone - narrowing the prefix would leave it unwalled',
+    );
+  }
+});