@bongos/core 1.19.951 → 1.19.952

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.951",
-  "core_contract": "1.19.951",
-  "source_commit": "52686c08170a959adbd2fff6681162b3b3e248ae",
+  "core_version": "1.19.952",
+  "core_contract": "1.19.952",
+  "source_commit": "76560f7026937d8fcb87e98f1cbb582781a7852a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T04:02:59.605Z",
+  "built_at": "2026-09-22T04:20:21.435Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 513,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2889,
-  "tree_sha256": "4c573e93b9c8147a0c7657ef1f9c43b7e3a0e37d6254e65502e205f91a77fdb0",
+  "tree_sha256": "b5e1b32c4cf3b07a161044a90c080241342270c91f71fcc551b02670ad0dd720",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "707238093af0e4b56e36139173b6d46d7ffd33a86c348181a40dc74083821738"
+      "sha256": "961a09f17879832bc7fa1e4607a41bddcc1a2d08e0c9ce55c1e5de6ba5af822e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8047,12 +8047,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "14465332b60fa42b702654bd0dd552e8b332b3c17cc969bfe08c3cd8a720320a"
+      "sha256": "09603574afd51f32c16292e9b19bd8bd8c8c57927721d5187229f414aeae1144"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7f40ce54ba7eddac00919f6407ee95888c15a87e3fc526450b64a00365cd913"
+      "sha256": "7a932995f95a2d638f25c48b9b1312f29682ac863cf8b35b4ebe58e515cd42f1"
     },
     {
       "path": "public-docs/index.html",
@@ -8127,7 +8127,7 @@
     {
       "path": "scripts/gds/adopt-preflight.js",
       "mode": "0000644",
-      "sha256": "1e2c8a70aec49eaa0d95a9cbf37145fa1c851b46e2ec27f72f773d4198356ab9"
+      "sha256": "9b16bbd8ceb60b801f042ad955b22b67c5703ce6dc8505bf333cefffbd3f37ae"
     },
     {
       "path": "scripts/gds/adr-namespace.js",
@@ -8507,7 +8507,7 @@
     {
       "path": "scripts/gds/device-flow-help.js",
       "mode": "0000644",
-      "sha256": "802b8875e2aa7e51b1b95800aae461c5d289d7684ef57e6da95bebc458aa0f5e"
+      "sha256": "843c7ec13103f121b5ff0056ba8d547dd20da837b5a04ef37c74bf4069411c38"
     },
     {
       "path": "scripts/gds/diagnose-achievements.js",
@@ -8772,7 +8772,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "d18b93dc0ac9136cfae79d98cd3506cb12d94fce30829a39dfb15f880770b93e"
+      "sha256": "529a6af81068f10cd8eeb4738f4d2fd17aec41f40c4dd3195909828e4656fe28"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8847,7 +8847,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "fcb70ddb8175d4cbbfd3217dcb9352e6280d5597c8caffe88a6399b54041e93b"
+      "sha256": "a5502a11527ac903446e13536e78900c3af82b3382757a547e2561761ef7e396"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -9362,7 +9362,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "79027b353a20b02c363d691ba30eda7d3456b8a081199ddc2c2559162523d66c"
+      "sha256": "edbebc4a0f4557cc8fc9dd0eb7115379a2fd0e34247725180cfb8eccb1cb0a18"
     },
     {
       "path": "scripts/gds/ship-check.js",
@@ -10057,7 +10057,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "156e1f0be121fb3fa396c32374f1ab8d0540f1d6c42a8aee28d05b5429a14115"
+      "sha256": "e780332ee4be93e25030115f0a32c91e121aa0f9080e8f2abb0df1c0f3064eb0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10177,7 +10177,7 @@
     {
       "path": "tests/adopt_preflight.mjs",
       "mode": "0000644",
-      "sha256": "2489a19e7c36f53c4046a4a6fab54a55dbdfe8da6daa3452316f9e0abea01742"
+      "sha256": "c31b72a08ca2007497e6c44108f0de35aaea6d3cd1fd1a54e65162a8bf555012"
     },
     {
       "path": "tests/adr_renumber_integrity.mjs",
@@ -10612,7 +10612,7 @@
     {
       "path": "tests/bongos_login.mjs",
       "mode": "0000644",
-      "sha256": "149d3b80bb3fce785ffb33bda72ebb30a66c31b374de5977f2283bc713c98441"
+      "sha256": "1e95957f3c780b4054128000e0deefc76e4df41c3076da76d2fbd187b47c95d2"
     },
     {
       "path": "tests/box_access.mjs",
@@ -11147,7 +11147,7 @@
     {
       "path": "tests/discord_approvals.mjs",
       "mode": "0000644",
-      "sha256": "748ec9bb00437eea0cb6692a8ca042f3d19c2ff7704cb2f2f79e195d459f1559"
+      "sha256": "6f5e924b108a8738f3c7d4a97057049167a7a88a6f4af997321cd8585df3038b"
     },
     {
       "path": "tests/discord_autojoin.mjs",
@@ -12627,7 +12627,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "53aa3732865dfce17a3216390b057dae825a6a7a8056309f3f31654c06636bee"
+      "sha256": "868942895e19730936594efb9f0fb69e4e511397ed738c05e0b27073c01846f7"
     },
     {
       "path": "tests/module_api_lazy.mjs",

package/docs/module-api-changelog.md

@@ -2376,5 +2376,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.949 with no explicit bump. run 35683452297. (task 1002620)
   1.19.951 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.950 with no explicit bump. run 35685346231. (task 1002620)
+  1.19.952 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.951 with no explicit bump. run 35686469735. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.951",
+  "version": "1.19.952",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.951",
+      "version": "1.19.952",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.951",
+  "version": "1.19.952",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/adopt-preflight.js

@@ -12,7 +12,7 @@
 //   • CI collisions — the repo's workflows vs core's expected unit/secret-scan/
 //     gate-review checks.
 //   • IGNORED incoming files — a pre-existing .gitignore rule that would swallow what
-//     adopt is about to commit (task 1003400). This is the check that was missing when
+//     adopt is about to commit (task 1003881). This is the check that was missing when
 //     Cloud Bongos was adopted onto a repo whose .gitignore already carried `.claude/`:
 //     the skills, hooks and settings.json were materialized onto disk and then dropped
 //     by `git add`, so the adopt commit landed 8 files with no methodology surface at

package/scripts/gds/device-flow-help.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // scripts/gds/device-flow-help.js — the one explanation of a Device-Flow refusal, shared
-// by `bongos setup` and `bongos login` (task 1003400).
+// by `bongos setup` and `bongos login` (task 1003881).
 //
 // WHY IT EXISTS AT ALL. GitHub creates an App from a manifest with Device Flow OFF and
 // exposes no API to switch it on — only a checkbox in the App's settings. So on every

package/scripts/gds/init.js

@@ -497,7 +497,8 @@ async function interview({ adopt = false } = {}) {
 // ---------------------------------------------------------------------------
 
 // PURE (exported for tests) — the root START-HERE guide (task 1002404, goal
-// 1000052). A freshly-CLONED instance must tell a human what to run FIRST: the
+// 1000052; task 1003881 made it LAYER onto an existing README instead of
+// skipping one — see layerReadme below). A freshly-CLONED instance must tell a human what to run FIRST: the
 // `bongos` CLI ships INSIDE the not-yet-installed @bongos/core package, so
 // `npm install` has to come before any `bongos` command (including `bongos dev`).
 // `bongos init` runs npm install during scaffolding, but a later `git clone` of
@@ -637,8 +638,9 @@ function writeConfigs(spec, { dir, force, dryRun, coreDep, log = console.log })
   log(`  ✓ wrote ${path.relative(dir, modulesPath)}`);
   log(`  ✓ wrote ${path.relative(dir, hierarchyPath)}`);
   log(`  ✓ wrote ${path.relative(dir, pkgPath)} (pins ${CORE_PKG} → ${pinNote})`);
-  // README START-HERE (task 1002404): mint it when absent, else APPEND the marked
-  // section. Never a blind overwrite — an owner's own README content always survives.
+  // README START-HERE (task 1002404, layering added by task 1003881): mint it when
+  // absent, else APPEND the marked section. Never a blind overwrite — an owner's own
+  // README content always survives, which is why the guide stopped being skipped.
   layerReadme(branding, { dir, dryRun: false, log });
   return { brandingPath, modulesPath, hierarchyPath, pkgPath, readmePath, wrote: true };
 }

package/scripts/gds/login.js

@@ -23,7 +23,7 @@
 const readline = require('node:readline');
 const { spawnSync } = require('node:child_process');
 const { saveSession, loadStoredSession, listStoredSessions } = require('./cli-lib');
-// The device-flow refusal detector + its plain-language cure (task 1003400). A leaf
+// The device-flow refusal detector + its plain-language cure (task 1003881). A leaf
 // module, NOT setup.js: setup requires this file for runDeviceFlow, so requiring it
 // back would close a require cycle. Both callers depend on the leaf instead.
 const { isDeviceFlowDisabled, deviceFlowFallbackLines } = require('./device-flow-help');

package/scripts/gds/setup.js

@@ -274,7 +274,7 @@ async function promptOnboardingConsent() {
 }
 
 // ── W1: the manifest-born App has Device Flow OFF (task 1003051) ─────────────
-// The detector + the guidance moved to ./device-flow-help (task 1003400) so
+// The detector + the guidance moved to ./device-flow-help (task 1003881) so
 // `bongos login` can use the same words without closing a require cycle back
 // through this file (setup requires login for runDeviceFlow). Re-exported here
 // because both are part of setup.js's tested public surface.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.951'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.952'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/adopt_preflight.mjs

@@ -101,7 +101,7 @@ t('preflightAdopt: a clean repo → no blocking; every category reports', () =>
   } finally { rmSync(dir, { recursive: true, force: true }); }
 });
 
-// ---- ignored-incoming: the check that was missing (task 1003400) ----------
+// ---- ignored-incoming: the check that was missing (task 1003881) ----------
 //
 // The failure it exists to stop: adopt onto a repo whose .gitignore already carries
 // `.claude/`. The skills/hooks/settings are written to disk, `git add` drops them, the

package/tests/bongos_login.mjs

@@ -45,7 +45,7 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({}), 'wait');
 });
 
-// ---- the Device-Flow dead end (task 1003400) -------------------------------
+// ---- the Device-Flow dead end (task 1003881) -------------------------------
 //
 // Device Flow is OFF on every GitHub App created from a manifest and GitHub offers no
 // API to switch it on, so terminal sign-in is broken from birth on a fresh instance —

package/tests/discord_approvals.mjs

@@ -170,7 +170,7 @@ await t('a DB error returns {error}, never throws', async () => {
   assert.equal(r.outcome, 'error');
 });
 
-// ---- the outbound half must not outlive the inbound half (task 1003400) ----
+// ---- the outbound half must not outlive the inbound half (task 1003881) ----
 //
 // The 👍 this line invites is applied ONLY by discord-approvals.js, which lives in the
 // `discord` module. onboarding (which posts) is default-ON; discord is default-OFF; and

package/tests/module_api.mjs

@@ -48,7 +48,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
-  'isModuleEnabled', // task 1003400: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
+  'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',
   'contribute', 'contributions', 'collectContributions', 'listContributionPoints',