@bongos/core 1.19.958 → 1.19.959

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.958",
-  "core_contract": "1.19.958",
-  "source_commit": "8b7c56c98aae1497c594219c7ae761ce54c60f8b",
+  "core_version": "1.19.959",
+  "core_contract": "1.19.959",
+  "source_commit": "762c63db2672a1dac87eb25a78bd3a93717b6d1a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T13:42:54.493Z",
+  "built_at": "2026-09-22T14:26:09.898Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2898,
-  "tree_sha256": "1dd23da0216fa29e9f848ba037a788cf0cfa9d0a55fea04ffb7eba833b142541",
+  "tree_sha256": "f587a606503aa60197f7ffbed71f7a3df76cfafda2da9b932090732dfc2cc512",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "25f1d655a540764066d47dcd30fc53451e253377c57ac1647d3dc3128928a385"
+      "sha256": "164da9dadc56356e91897f78786de7c42b32e37534971b6743985abeba81d718"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4497,7 +4497,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "3c70a4abe22d8720a57da14e1f6dbc659cc57b066c1c811c8130f20d6d586e20"
+      "sha256": "ad15115c455dc9eb8b7786ce704beb94b5c40fabe17806e88b5edffb20b164cf"
     },
     {
       "path": "modules/government/ranks.js",
@@ -8082,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "83b00099cd3853c2bf7ca568043852caec477bace90cb26921122a525ed0bfc8"
+      "sha256": "e0d9870134171629f6021c929775456f72729ad7131249f17c5e99cd64d2405f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8f3e2b77a4b6f11f1eb2ffe270ea5fe212d959a1dd0db7eab501808423df8ef4"
+      "sha256": "830c6340ff774389b6a391c8045116ccabc871a23ba09688e03380892f340a2a"
     },
     {
       "path": "public-docs/index.html",
@@ -9897,7 +9897,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "8cb783238eaf296a3d057537b829ec14c7d3d65f380874af18861d6262cffb10"
+      "sha256": "70b35812cbf26b9ce8c25663bbc4fcce40272b4877b89baf70cd64a5fe90b3b3"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10092,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "afe264ed7d639f350d12b51e28f13d9a5a604bac89b110dcad7b38a415334df3"
+      "sha256": "73781b940ba631e4642209a973a119375f7ff12f23027033030b1c95f0cc45f7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11777,7 +11777,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "fd0cca1a62b8c2ab3bd556aabf4f6949bb6affb66c2fb1fd6258bccfffebc744"
+      "sha256": "4299e738542cd8951ec9846c4add158e902cb2ad29deba6c4afbfdb2b94877bf"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -2390,5 +2390,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
   1.19.958 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
+  1.19.959 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.958 with no explicit bump. run 35740227000. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -26,7 +26,13 @@
   "permission": "path.protected.modify",
   "surfaces": [
     { "glob": "src/bongos/auth.js", "group": "authz", "why": "requireBuilder / requireRank definitions" },
+    { "glob": "src/bongos/auth-admission.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-config.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-discord.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-github.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-idp.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/db.js", "group": "authz", "why": "rank tiers, REQUIRES_RANK_TIER — the CASE edited in the SEC #863 incident" },
+    { "glob": "src/bongos/db-kernel.js", "group": "authz", "why": "task 1004024. The kernel db slice carved out of db.js (BV1.R69 / ADR 0091): builder identity and the rank reads the SEC #863 entry above exists for." },
     { "glob": "src/bongos/route-rank-check.js", "group": "authz", "why": "the route-gate auditor" },
     { "glob": "src/bongos/permission-path-check.js", "group": "authz", "why": "the matcher that reads this registry (self-protect)" },
     { "glob": "src/bongos/middleware/", "group": "authz", "why": "audit + any auth middleware" },
@@ -43,11 +49,40 @@
     { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
     { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
     { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
+    { "glob": "scripts/gds/box-auth-check.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
+    { "glob": "scripts/gds/box-sync.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
     { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
+    { "glob": "modules/grading/grader-config.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-model.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-no-artifact.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-prompt.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },
+    { "glob": "scripts/gds/ship-check.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-deploy-target.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-escalation.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-finish.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-flow.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-git.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-honesty.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-io.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-land.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-memory-sync.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge-gate.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-preflight-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-regen.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-resume.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-session-upload.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-state.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-surprise.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
     { "glob": "scripts/gds/confirm.js", "group": "pipeline", "why": "the confirm step" },
     { "glob": "scripts/gds/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
     { "glob": "scripts/gds/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.958",
+  "version": "1.19.959",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.958",
+      "version": "1.19.959",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.958",
+  "version": "1.19.959",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -48,6 +48,9 @@ const MODULE_GLOBS = {
     'src/bongos/auth.js', 'src/bongos/db.js', 'src/bongos/db-kernel.js', 'src/bongos/pool.js',
     'src/bongos/routes.js', 'src/bongos/route-rank-check.js',
     'src/bongos/permission-path-check.js', 'src/bongos/sensitive-surfaces.js',
+    // task 1004024: the auth.js carve (db-kernel.js, above, is db.js's), now protected.
+    'src/bongos/auth-admission.js', 'src/bongos/auth-config.js', 'src/bongos/auth-discord.js',
+    'src/bongos/auth-github.js', 'src/bongos/auth-idp.js',
     'src/bongos/middleware/', 'src/bongos/live-channel.js', 'src/bongos/secret-box.js',
     'src/bongos/repo-info.js', 'src/bongos/api-path-404.js', 'src/bongos/serve-internal.js',
     'src/bongos/module-scope-map.js', 'src/bongos/hierarchy-config.js',
@@ -91,6 +94,14 @@ const MODULE_GLOBS = {
   lifecycle: [
     'modules/lifecycle/',
     'scripts/gds/ship.js', 'scripts/gds/claim.js', 'scripts/gds/release.js',
+    // task 1004024: the 2026-08-23 ship.js carve, now protected (by name: no '*' here).
+    'scripts/gds/ship-check.js', 'scripts/gds/ship-deploy-target.js', 'scripts/gds/ship-escalation.js',
+    'scripts/gds/ship-finish.js', 'scripts/gds/ship-flow.js', 'scripts/gds/ship-git.js',
+    'scripts/gds/ship-grade-steps.js', 'scripts/gds/ship-grade.js', 'scripts/gds/ship-honesty.js',
+    'scripts/gds/ship-io.js', 'scripts/gds/ship-land.js', 'scripts/gds/ship-memory-sync.js',
+    'scripts/gds/ship-merge-gate.js', 'scripts/gds/ship-merge.js', 'scripts/gds/ship-preflight-steps.js',
+    'scripts/gds/ship-regen.js', 'scripts/gds/ship-resume.js', 'scripts/gds/ship-session-upload.js',
+    'scripts/gds/ship-state.js', 'scripts/gds/ship-surprise.js', 'scripts/gds/ship-visual.js',
     'scripts/gds/merge-mode.js', 'scripts/gds/confirm.js', 'scripts/gds/main-audit.js',
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
@@ -355,6 +366,7 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+    'scripts/gds/box-sync.js', // task 1004024: split out of box.js, now protected
   
     // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
     // orchestrates these five provisioning CLIs, and infra/ is the shell-script

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.958'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.959'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -116,6 +116,14 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // If the owner does want the agents module rank-walled, it needs the entry here,
 // a publish-manifest carve-out, and the module-scope-map roster test updated —
 // three deliberate edits, not a side effect of a scope fix.
+// One ADDED_SINCE_R101 entry per file carved out of `parent`, chained so each sits directly
+// below the previous one — the order the registry lists them in.
+function carve(parent, names, why) {
+  const dir = path.posix.dirname(parent);
+  const globs = names.map((n) => `${dir}/${n}.js`);
+  return globs.map((glob, i) => ({ after: i ? globs[i - 1] : parent, glob, why }));
+}
+
 const ADDED_SINCE_R101 = [
   // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
   // execution roots the merge resolver runs out of a cloned branch. The audit named four
@@ -263,6 +271,30 @@ const ADDED_SINCE_R101 = [
        + 'sub-Metic builders out of in spirit, so the real cost of this entry is three '
        + 'tasks that arguably should not have been open.',
   },
+  // task 1004024, owner decision 2026-09-22 (all five families). Each protected FILE below
+  // had been carved into `<name>-*.js` siblings and only the facade stayed registered. The
+  // carve tripwire further down is what found the four beyond the one the task named.
+  // Listed BY NAME, not as `<name>-*.js`: path-match (the goal scope wall) reads no '*'.
+  ...carve('src/bongos/auth.js', ['auth-admission', 'auth-config', 'auth-discord', 'auth-github', 'auth-idp'],
+    'the auth.js carve: session-token minting and the OAuth exchange, admission and '
+    + 'first-admin seating, IdP assertion checks.'),
+  ...carve('src/bongos/db.js', ['db-kernel'],
+    'the kernel slice carved out of db.js: builder identity and the rank reads the '
+    + 'SEC #863 entry exists for.'),
+  ...carve('scripts/gds/box.js', ['box-auth-check', 'box-sync'],
+    'the box.js family: the dev-box session-start auth gate and the box sync; box-infra.js '
+    + 'was already listed by name.'),
+  ...carve('modules/grading/grader.js', ['grader-config', 'grader-model', 'grader-no-artifact',
+    'grader-prompt', 'grader-score', 'grader-subagent'],
+    'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
+    + 'score guards a model cannot talk past.'),
+  ...carve('scripts/gds/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
+    'ship-finish', 'ship-flow', 'ship-git', 'ship-grade-steps', 'ship-grade', 'ship-honesty',
+    'ship-io', 'ship-land', 'ship-memory-sync', 'ship-merge-gate', 'ship-merge',
+    'ship-preflight-steps', 'ship-regen', 'ship-resume', 'ship-session-upload', 'ship-state',
+    'ship-surprise', 'ship-visual'],
+    'the 2026-08-23 ship.js carve: the land path, the ship state machine, the grade gate '
+    + 'steps and pushVia, ~6,200 lines behind a 373-line protected entry point.'),
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -392,6 +424,55 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
   }
 });
 
+// ---------- the carve tripwire: a protected FILE's `<name>-*.js` siblings are protected ----------
+//
+// task 1004024. Splitting a protected file into `<name>-<phase>.js` siblings is this repo's
+// carve convention, and every carve so far left only the facade registered: ship.js (21
+// files), grader.js (6), auth.js (5), db.js, box.js. A require()-graph rule was measured and
+// rejected — from the protected scripts it reaches 52 unprotected files (upgrade.js, login.js,
+// package-core.js…), floor-gating ordinary work. The name rule is the shape a carve leaves.
+function stemSiblings(entry, tracked) {
+  const dir = path.posix.dirname(entry);
+  const prefix = `${path.posix.basename(entry, '.js')}-`;
+  return tracked.filter((f) => path.posix.dirname(f) === dir
+    && path.posix.basename(f).startsWith(prefix) && f.endsWith('.js'));
+}
+
+test('no protected glob uses a wildcard — the goal scope wall could not read it', () => {
+  // permission-path-check reads '*', but module-scope-map derives ownership and the
+  // protected module set through path-match, which knows only an exact path or a '/'
+  // prefix. A wildcard here would protect files no module can own (task 1004024).
+  assert.deepEqual(ppc.PROTECTED_GLOBS.filter((g) => g.includes('*')), []);
+});
+
+test('stemSiblings finds a split-out file and nothing that merely resembles one', () => {
+  const tree = ['scripts/gds/ship.js', 'scripts/gds/ship-land.js', 'scripts/gds/shipper.js',
+    'scripts/gds/ship_x.js', 'scripts/gds/sub/ship-x.js', 'scripts/gds/ship-notes.md', 'src/ship-y.js'];
+  assert.deepEqual(stemSiblings('scripts/gds/ship.js', tree), ['scripts/gds/ship-land.js']);
+});
+
+test('every file split out of a protected file is itself protected (1004024 carve tripwire)', () => {
+  const tracked = execFileSync('git', ['ls-files', '*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+  const entries = ppc.PROTECTED_GLOBS.filter((g) => g.endsWith('.js') && !g.includes('*'));
+  let checked = 0;
+  for (const entry of entries) {
+    const floor = ppc.RANK_TIER[ppc.surfaceFor(entry).floor];
+    for (const rel of stemSiblings(entry, tracked)) {
+      checked += 1;
+      const surface = ppc.surfaceFor(rel);
+      assert.ok(surface,
+        `${rel} sits beside the protected ${entry} under its name — the shape a carve leaves — `
+        + 'but no protected surface covers it. Register it by name in '
+        + 'modules/government/protected-surfaces.json, declare it in ADDED_SINCE_R101, and '
+        + 'give it the parent\'s owning module in src/bongos/module-scope-map.js.');
+      assert.ok(ppc.RANK_TIER[surface.floor] >= floor,
+        `${rel} is floored at '${surface.floor}', below the ${entry} it was carved from.`);
+    }
+  }
+  assert.ok(checked >= 35, `fixture sanity: expected the five known carves (35 files), saw ${checked}`);
+});
+
 // ---------- the credential tripwire: every credential READER is a protected surface ----------
 //
 // task 1002891, from idea 1000692 (the grader's hacker worker, on the 1002690 re-grade).