@bongos/core 1.19.931 → 1.19.932

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.931",
-  "core_contract": "1.19.931",
-  "source_commit": "b6d78155b15d9c6063a4ea7477c43f75e2bbab6c",
+  "core_version": "1.19.932",
+  "core_contract": "1.19.932",
+  "source_commit": "d2abbbb5631c1442fe5699f12039542a2044b84b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T01:31:35.320Z",
+  "built_at": "2026-09-21T02:43:33.416Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 511,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2862,
-  "tree_sha256": "ded0626099adb90597501b45fcca7742db0c45a765194e726a9befad8aa63c47",
+  "tree_sha256": "639ee94b251255963e185eb8bc26d41ced7c87d5f0e72931acdf76dfb644891a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1ceef6efa3c35c5d63b9873f2cc0a981a5646727fdd62216616f48f4d2cfeae2"
+      "sha256": "7b02e10e565ac40dfc301149ac22736254d6fa96db7ea43872660dd2ab4020da"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7967,12 +7967,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "010ad7a7b802e8d4d32190e622f0adc1311aa59728a9e94663c9daa6871b99e1"
+      "sha256": "bf02d212a688052c5330c5169c16cd5f8cc895f84e56931df8ee629503a2fe20"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "937a9b3f81ddbcea577192fa28a4c90562cd5f17ecbe55115ee6b63dcae3f07f"
+      "sha256": "6ea8cd02b01a88bbfe602657ca27a4dad0505cad4ee712f097e17b7794514214"
     },
     {
       "path": "public-docs/index.html",
@@ -9782,7 +9782,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "40f2196830c746ed440ba91b938bece8ba48fdf225285c6a6d5dccd109d47d3d"
+      "sha256": "b5ee44e89d9686d1fc297dfd9952d3614edfe7f4a4cd18c264d9b4d68adb2629"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9972,7 +9972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6d65e90e4121fcaa45780d9aa68eb2abab94d20cd512cdf9f165ea6797fed953"
+      "sha256": "04b4e543718c564aa70a79b83a60202eaac5f0c30b5fcaae897bdf29f9e9653a"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -2336,5 +2336,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.929 with no explicit bump. run 35549362371. (task 1002620)
   1.19.931 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.930 with no explicit bump. run 35551146764. (task 1002620)
+  1.19.932 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.931 with no explicit bump. run 35555080510. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.931",
+  "version": "1.19.932",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.931",
+      "version": "1.19.932",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.931",
+  "version": "1.19.932",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -367,6 +367,17 @@ const MODULE_GLOBS = {
     '.claude/settings.json', '.claude/hooks/',
     '.husky/',
     '.npmrc', '.gitleaks.toml',
+    // .devcontainer/ is the same class as the entries above it — repo-level
+    // developer-environment config, not a feature's territory (task 1004029).
+    // It belonged to NO module and was not in SHARED_GLOBS, so isCovered() said
+    // false for it under EVERY possible scope_modules value: no goal could
+    // authorize a task that touched it, which is what stalled task 1003896
+    // (delete .devcontainer/). Given to devsecops rather than added to
+    // SHARED_GLOBS because it has a real owner — SHARED_GLOBS is for roots owned
+    // by nobody, and every addition there widens the wall for every goal at once.
+    // devsecops is PROTECTED, so this path is now Archon-only to scope; that is
+    // the correct floor for a file that defines what a builder's environment runs.
+    '.devcontainer/',
     'package.json', 'package-lock.json',
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.931'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.932'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');