@bongos/core 1.19.949 → 1.19.950

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.949",
-  "core_contract": "1.19.949",
-  "source_commit": "b167833627e1c0360613322d616a6e288ea083a0",
+  "core_version": "1.19.950",
+  "core_contract": "1.19.950",
+  "source_commit": "b332b91c550367626b416cf9edd7e689d7e5f061",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T01:20:15.264Z",
+  "built_at": "2026-09-22T03:31:42.605Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 513,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2886,
-  "tree_sha256": "76d08b0cd0d4045e4ecadf3d9571fbcbc63cf5aebc7d33edf787c30a0c7978de",
+  "tree_sha256": "0faab48c30a2ae5ab6fce64aec38fc54571056bfe7f3fa566f4336818100fd1c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "29e0651fa0f5cb469d61cc13ff096ef772a07006f2e8d53e2d6119b3b3f194fb"
+      "sha256": "1b1d7162b5d86bf679ed7a8bbf6d0a354eb382f88ef896651211856ab7fda2dc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8042,12 +8042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c2e5171010f3ceab561e381ba14d2d76649b8bca170450a8db18edde40bf6228"
+      "sha256": "ef28356c6251d661ff78b1446e9ddc3e13770144c862634da5a8d91ef7ba6e51"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7988eef8fb6aceffb3357949ab178209d7e340281f00f926334fd3456ef57c1"
+      "sha256": "fe67ef68895ddb7bc5c2a507a7f57fa4d3b683611e557cba82be40f3641013e3"
     },
     {
       "path": "public-docs/index.html",
@@ -9852,7 +9852,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "36da288c8087ebd653c0b208a02414ea55d09da53df22cb4fc3d281941756ec7"
+      "sha256": "8cb783238eaf296a3d057537b829ec14c7d3d65f380874af18861d6262cffb10"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10047,7 +10047,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3fbfb8061f3fdf5fbc1d7426db7eb5dd6b8ec4acaab02eab9489c0d443792b09"
+      "sha256": "107e4e25c1f869c19259c01752fecc19c138790c60981256651663823345c049"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -2372,5 +2372,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.947 with no explicit bump. run 35671807404. (task 1002620)
   1.19.949 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.948 with no explicit bump. run 35675336642. (task 1002620)
+  1.19.950 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.949 with no explicit bump. run 35683452297. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.949",
+  "version": "1.19.950",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.949",
+      "version": "1.19.950",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.949",
+  "version": "1.19.950",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -261,6 +261,13 @@ const MODULE_GLOBS = {
   //     the front door is this module's first customer, not its owner. ---
   'ui-design': [
     'modules/ui-design/',
+    // The `impeccable` design method's working tree — mocks/, review/, surfaces/.
+    // DESIGN.md:226 names .impeccable/mocks/world-assets/ as the SOURCE of cutouts
+    // that shipped to modules/public-landing/public/assets/world/, so this is
+    // ui-design's own output (task 1004146). Deliberately here and not in a
+    // protected module: ui-design is unprotected, so a ui builder keeps reach over
+    // their own working directory.
+    '.impeccable/',
     'scripts/gds/design-sync.js', 'scripts/gds/figma-design-sync.js', 'scripts/gds/validate-design.js',
     'scripts/gds/ui-kit-transform.js', // the kit's stub reaches the real serving transforms through this command (task 1003320)
     '.claude/skills/design/', '.claude/skills/design-sync/', '.claude/skills/figma-design-sync/',
@@ -377,6 +384,19 @@ const MODULE_GLOBS = {
     '.claude/settings.json', '.claude/hooks/',
     '.husky/',
     '.npmrc', '.gitleaks.toml',
+    // The SELF-HOST IMAGE (V4.R63, task 1202, ADR 0062): `docker compose up` brings
+    // up Postgres + a vanilla, neutral-branded instance with every feature module
+    // off. Assigned here by task 1004146 — same class as the .github/ and .husky/
+    // entries above and the .devcontainer/ one below: repo-root build config that
+    // defines WHAT RUNS. Not
+    // `provisioning`, which owns the control plane that stands up instances, not an
+    // image a stranger runs. They are not dev-box artifacts either, despite most
+    // inbound references coming from .devcontainer/ and the devcontainer workflow.
+    'Dockerfile', 'docker-compose.yml', 'docker-entrypoint.sh', '.dockerignore',
+    // Repo-level dotfiles, the class .gitattributes and .npmrc already sit in.
+    // .env.local.example is the local-secrets template, next to the .gitleaks.toml
+    // scanner config above (task 1004146).
+    '.gitignore', '.env.local.example',
     // .devcontainer/ is the same class as the entries above it — repo-level
     // developer-environment config, not a feature's territory (task 1004029).
     // It belonged to NO module and was not in SHARED_GLOBS, so isCovered() said
@@ -557,17 +577,6 @@ const UNOWNED_ROOTS = Object.freeze({
   // Generated packaging manifests — written by package-core.js, never hand-edited.
   '.bongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
   '.cloudbongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
-  // Container build + repo-level dotfiles. review: devsecops already owns the
-  // neighbouring .npmrc / .gitattributes / package.json, so these plausibly belong
-  // to it — but that is a scope-wall change and wants its own decision.
-  '.dockerignore': 'review: container build, plausibly devsecops',
-  'Dockerfile': 'review: container build, plausibly devsecops',
-  'docker-compose.yml': 'review: container build, plausibly devsecops',
-  'docker-entrypoint.sh': 'review: container build, plausibly devsecops',
-  '.gitignore': 'review: repo-level dotfile, plausibly devsecops',
-  '.env.local.example': 'review: repo-level dotfile, plausibly devsecops',
-  // Design tooling checked into the tree. review: plausibly ui-design.
-  '.impeccable/': 'review: design tooling, plausibly ui-design',
   // Governance + legal. Deliberately not methodology: methodology owns docs/, and
   // these are the project's constitutional documents rather than its handbook.
   'LICENSE': 'project legal text',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.949'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.950'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');