@bongos/core 1.19.958 → 1.19.960

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.958",
-  "core_contract": "1.19.958",
-  "source_commit": "8b7c56c98aae1497c594219c7ae761ce54c60f8b",
+  "core_version": "1.19.960",
+  "core_contract": "1.19.960",
+  "source_commit": "07224a002beb8673193550edb973a83f63733ac9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T13:42:54.493Z",
+  "built_at": "2026-09-22T16:38:38.841Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2898,
-  "tree_sha256": "1dd23da0216fa29e9f848ba037a788cf0cfa9d0a55fea04ffb7eba833b142541",
+  "tree_sha256": "de8dc0908595fb0f613026497e94dc03c3a50bb631a2adc952bdaefedcb96199",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "25f1d655a540764066d47dcd30fc53451e253377c57ac1647d3dc3128928a385"
+      "sha256": "4cc28a5f552998a430d1d1ecb6ec1882607ccd555f5d2e01c7a2197b6414b67a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4497,7 +4497,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "3c70a4abe22d8720a57da14e1f6dbc659cc57b066c1c811c8130f20d6d586e20"
+      "sha256": "ad15115c455dc9eb8b7786ce704beb94b5c40fabe17806e88b5edffb20b164cf"
     },
     {
       "path": "modules/government/ranks.js",
@@ -8082,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "83b00099cd3853c2bf7ca568043852caec477bace90cb26921122a525ed0bfc8"
+      "sha256": "f1832d9a38929a6d0cd0a93720088edcba0cc7952bbe2df7d57ec0986c1dea49"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8f3e2b77a4b6f11f1eb2ffe270ea5fe212d959a1dd0db7eab501808423df8ef4"
+      "sha256": "98d101c939c100960c78ea1887fd429720d643c3931840ac847df15544312e72"
     },
     {
       "path": "public-docs/index.html",
@@ -8432,7 +8432,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "2209cc2ca1476efc0af464e6e58ae87c5a5dc8d5a70b2ad067867adbfe0aab06"
+      "sha256": "717de4da1c2e966aff2cb8dff997a4cedcf5d92eea85a9ceeb75118bef1f6859"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -9897,7 +9897,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "8cb783238eaf296a3d057537b829ec14c7d3d65f380874af18861d6262cffb10"
+      "sha256": "70b35812cbf26b9ce8c25663bbc4fcce40272b4877b89baf70cd64a5fe90b3b3"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10092,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "afe264ed7d639f350d12b51e28f13d9a5a604bac89b110dcad7b38a415334df3"
+      "sha256": "23025d957268d4f44b0a2a8a552f1371a9c50af1220239de8ca3fd9b0bd605f3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10872,7 +10872,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "60eb54f19f26f3557afd6b12f0f2867208638a2b6547f58abd192b6f07e805c3"
+      "sha256": "0f0d53e5c63f9b776aa5ea9c2e0408e350e54230ee0c214af26faf34eaa7bb5f"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -11777,7 +11777,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "fd0cca1a62b8c2ab3bd556aabf4f6949bb6affb66c2fb1fd6258bccfffebc744"
+      "sha256": "4299e738542cd8951ec9846c4add158e902cb2ad29deba6c4afbfdb2b94877bf"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -2390,5 +2390,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
   1.19.958 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
+  1.19.959 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.958 with no explicit bump. run 35740227000. (task 1002620)
+  1.19.960 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.959 with no explicit bump. run 35755397900. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -26,7 +26,13 @@
   "permission": "path.protected.modify",
   "surfaces": [
     { "glob": "src/bongos/auth.js", "group": "authz", "why": "requireBuilder / requireRank definitions" },
+    { "glob": "src/bongos/auth-admission.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-config.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-discord.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-github.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-idp.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/db.js", "group": "authz", "why": "rank tiers, REQUIRES_RANK_TIER — the CASE edited in the SEC #863 incident" },
+    { "glob": "src/bongos/db-kernel.js", "group": "authz", "why": "task 1004024. The kernel db slice carved out of db.js (BV1.R69 / ADR 0091): builder identity and the rank reads the SEC #863 entry above exists for." },
     { "glob": "src/bongos/route-rank-check.js", "group": "authz", "why": "the route-gate auditor" },
     { "glob": "src/bongos/permission-path-check.js", "group": "authz", "why": "the matcher that reads this registry (self-protect)" },
     { "glob": "src/bongos/middleware/", "group": "authz", "why": "audit + any auth middleware" },
@@ -43,11 +49,40 @@
     { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
     { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
     { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
+    { "glob": "scripts/gds/box-auth-check.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
+    { "glob": "scripts/gds/box-sync.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
     { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
+    { "glob": "modules/grading/grader-config.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-model.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-no-artifact.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-prompt.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },
+    { "glob": "scripts/gds/ship-check.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-deploy-target.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-escalation.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-finish.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-flow.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-git.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-honesty.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-io.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-land.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-memory-sync.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge-gate.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-preflight-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-regen.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-resume.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-session-upload.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-state.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-surprise.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
     { "glob": "scripts/gds/confirm.js", "group": "pipeline", "why": "the confirm step" },
     { "glob": "scripts/gds/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
     { "glob": "scripts/gds/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.958",
+  "version": "1.19.960",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.958",
+      "version": "1.19.960",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.958",
+  "version": "1.19.960",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -385,12 +385,35 @@ const STARTER_COMMANDS = [
 const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
 const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 
+// The deny half (task 1003966): what the local agent may not READ. Keys are the
+// same exposure on every instance, so those rules ship verbatim.
+const STARTER_DENY_SECRETS = [
+  'Read(.env)', 'Read(**/.env)', 'Read(.env.local)', 'Read(**/.env.local)',
+  'Read(.env.*.local)', 'Read(**/.env.*.local)',
+  'Read(**/*.pem)', 'Read(**/id_rsa*)', 'Read(**/id_ed25519*)',
+];
+
+// Credential files are derived from where the CLI actually reads them, not rebranded from the
+// core's literals: the rebrand would also move the host-keyed store, which sits at a fixed anchor
+// whatever the brand (cli-lib sessionStoreDir, task 1003741). The shelf rule is the only layer an
+// instance gets against the repo-global stash stack, since the git-guard hook does not ship.
+function starterDeny(branding = {}) {
+  const dirs = [...new Set([effConfigDir(branding), ...ic.LEGACY_DIRS])];
+  const credentialFiles = ['env', ...ic.SESSION_FILENAMES];
+  return [
+    ...STARTER_DENY_SECRETS,
+    ...dirs.flatMap((dir) => credentialFiles.map((file) => `Read(~/.config/${dir}/${file})`)),
+    `Read(~/.config/${ic.FALLBACK_DIR}/instances/**)`,
+    ...STARTER_SHELL_TOOLS.map((tool) => `${tool}(git stash:*)`),
+  ];
+}
+
 // The starter an instance gets when the core root carries no settings.json — a
 // package-only install. Permissions ONLY: no hooks (they are topology), no env.
-function renderStarterSettings() {
+function renderStarterSettings(branding = {}) {
   return `${JSON.stringify({
-    _doc: 'Starter written by scripts/gds/claude-materialize.js (task 1003962). Permissions only — the blessed Bongos commands, mirroring the core repo\'s own allow-list (ADR 0104). An allow-rule lets the local agent RUN a command; it grants no authority, which the server decides per request from your live rank (ADR 0016). Yours to edit: a later materialize never clobbers this file.',
-    permissions: { allow: STARTER_ALLOW },
+    _doc: 'Starter written by scripts/gds/claude-materialize.js (tasks 1003962, 1003966). Permissions only — the blessed Bongos commands, mirroring the core repo\'s own allow-list (ADR 0104), and the deny rules that keep the local agent from reading keys and session tokens. An allow-rule lets the local agent RUN a command; it grants no authority, which the server decides per request from your live rank (ADR 0016). Yours to edit: a later materialize never clobbers this file.',
+    permissions: { allow: STARTER_ALLOW, deny: starterDeny(branding) },
   }, null, 2)}\n`;
 }
 
@@ -685,7 +708,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
     } else {
       if (!dryRun) {
         fs.mkdirSync(destClaude, { recursive: true });
-        fs.writeFileSync(settingsDest, renderStarterSettings());
+        fs.writeFileSync(settingsDest, renderStarterSettings(toBranding));
       }
       addWritten('.claude/settings.json');
       summary.settings = true;

package/src/bongos/module-scope-map.js

@@ -48,6 +48,9 @@ const MODULE_GLOBS = {
     'src/bongos/auth.js', 'src/bongos/db.js', 'src/bongos/db-kernel.js', 'src/bongos/pool.js',
     'src/bongos/routes.js', 'src/bongos/route-rank-check.js',
     'src/bongos/permission-path-check.js', 'src/bongos/sensitive-surfaces.js',
+    // task 1004024: the auth.js carve (db-kernel.js, above, is db.js's), now protected.
+    'src/bongos/auth-admission.js', 'src/bongos/auth-config.js', 'src/bongos/auth-discord.js',
+    'src/bongos/auth-github.js', 'src/bongos/auth-idp.js',
     'src/bongos/middleware/', 'src/bongos/live-channel.js', 'src/bongos/secret-box.js',
     'src/bongos/repo-info.js', 'src/bongos/api-path-404.js', 'src/bongos/serve-internal.js',
     'src/bongos/module-scope-map.js', 'src/bongos/hierarchy-config.js',
@@ -91,6 +94,14 @@ const MODULE_GLOBS = {
   lifecycle: [
     'modules/lifecycle/',
     'scripts/gds/ship.js', 'scripts/gds/claim.js', 'scripts/gds/release.js',
+    // task 1004024: the 2026-08-23 ship.js carve, now protected (by name: no '*' here).
+    'scripts/gds/ship-check.js', 'scripts/gds/ship-deploy-target.js', 'scripts/gds/ship-escalation.js',
+    'scripts/gds/ship-finish.js', 'scripts/gds/ship-flow.js', 'scripts/gds/ship-git.js',
+    'scripts/gds/ship-grade-steps.js', 'scripts/gds/ship-grade.js', 'scripts/gds/ship-honesty.js',
+    'scripts/gds/ship-io.js', 'scripts/gds/ship-land.js', 'scripts/gds/ship-memory-sync.js',
+    'scripts/gds/ship-merge-gate.js', 'scripts/gds/ship-merge.js', 'scripts/gds/ship-preflight-steps.js',
+    'scripts/gds/ship-regen.js', 'scripts/gds/ship-resume.js', 'scripts/gds/ship-session-upload.js',
+    'scripts/gds/ship-state.js', 'scripts/gds/ship-surprise.js', 'scripts/gds/ship-visual.js',
     'scripts/gds/merge-mode.js', 'scripts/gds/confirm.js', 'scripts/gds/main-audit.js',
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
@@ -355,6 +366,7 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+    'scripts/gds/box-sync.js', // task 1004024: split out of box.js, now protected
   
     // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
     // orchestrates these five provisioning CLIs, and infra/ is the shell-script

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.958'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.960'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -18,14 +18,16 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
+import { tmpdir, homedir } from 'node:os';
+import { join, dirname, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const m = require('../scripts/gds/claude-materialize.js');
 const claim = require('../scripts/gds/claim.js');
+const cliLib = require('../scripts/gds/cli-lib.js');
+const ic = require('../src/instance-config.js');
 // The live verb table, so a starter allow-rule naming a verb that does not exist
 // fails here rather than shipping as an inert permission (task 1003962).
 const { VERBS: cliVerbs } = require('../bin/bongos.js');
@@ -804,6 +806,55 @@ t('a package-only install (no settings.json at the core root) GETS the starter',
   rmSync(inst, { recursive: true, force: true });
 });
 
+// task 1003966 — the starter shipped the allow half alone: the convenience with none of the
+// hardening. The deny half is what stops the agent reading a key or a session token.
+const starterDenyFor = (branding) => JSON.parse(m.renderStarterSettings(branding)).permissions.deny;
+const homeRel = (abs) => `~/${relative(homedir(), abs).split(sep).join('/')}`;
+
+t("a package-only install gets the deny rules, pointed at THAT instance's config dir", () => {
+  const core = mkdtempSync(join(tmpdir(), 'w3-deny-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'w3-deny-inst-'));
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'branding.json'), JSON.stringify({ configDir: 'acme', envPrefix: 'ACME' }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  const deny = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  assert.ok(Array.isArray(deny), 'the starter must carry permissions.deny');
+  for (const secret of ['Read(**/.env)', 'Read(**/.env.*.local)', 'Read(**/*.pem)', 'Read(**/id_rsa*)']) {
+    assert.ok(deny.includes(secret), `missing ${secret}`);
+  }
+  assert.ok(deny.includes('Read(~/.config/acme/bongos-session.json)'), "the instance's OWN session file");
+  assert.deepEqual(deny.filter((r) => /\.config\/(?!acme\/)/.test(r) && !r.startsWith(`Read(${homeRel(cliLib.sessionStoreDir())}`)
+    && !ic.LEGACY_DIRS.some((d) => r.includes(`.config/${d}/`))), [],
+    "a session rule naming another brand's dir guards the wrong path and leaves this one open");
+  for (const tool of ['Bash', 'PowerShell']) assert.ok(deny.includes(`${tool}(git stash:*)`), `${tool}(git stash:*)`);
+  rmSync(core, { recursive: true, force: true });
+  rmSync(inst, { recursive: true, force: true });
+});
+
+t('every file the CLI reads a session from is denied, the host-keyed store included', () => {
+  // Pinned to cli-lib's own read list, so a new session filename or dir fails HERE.
+  let brand = {};
+  try { brand = require('../src/branding').branding(); } catch { /* unbranded checkout */ }
+  const deny = starterDenyFor(brand);
+  for (const p of cliLib.SESSION_READ_PATHS) assert.ok(deny.includes(`Read(${homeRel(p)})`), `Read(${homeRel(p)})`);
+  assert.ok(deny.includes(`Read(${homeRel(cliLib.sessionStoreDir())}/**)`),
+    'the store sits at a fixed anchor whatever the brand (task 1003741), so it is never rebranded');
+});
+
+t("every deny rule in the core's own settings.json reaches the starter", () => {
+  // The two lists drift the way the allow halves could: a rule added to the core
+  // protects the core and silently no instance. A config-dir file is compared by
+  // name, in the instance's dir; everything else must match verbatim.
+  const core = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  const deny = starterDenyFor({ configDir: 'acme' });
+  for (const rule of core) {
+    const cfg = rule.match(/^Read\(~\/\.config\/[^/]+\/(.+)\)$/);
+    const want = cfg ? `Read(~/.config/acme/${cfg[1]})` : rule;
+    assert.ok(deny.includes(want), `core deny ${rule} → starter must carry ${want}`);
+  }
+});
+
 // task 1004012 — the other source: a CHECKOUT core root does carry a settings.json, and the
 // instance used to receive its allow-list verbatim, naming scripts its skills no longer run.
 t('a checkout-materialized instance gets allow-rules in the bongos form, end to end', () => {

package/tests/government_protected_surfaces.mjs

@@ -116,6 +116,14 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // If the owner does want the agents module rank-walled, it needs the entry here,
 // a publish-manifest carve-out, and the module-scope-map roster test updated —
 // three deliberate edits, not a side effect of a scope fix.
+// One ADDED_SINCE_R101 entry per file carved out of `parent`, chained so each sits directly
+// below the previous one — the order the registry lists them in.
+function carve(parent, names, why) {
+  const dir = path.posix.dirname(parent);
+  const globs = names.map((n) => `${dir}/${n}.js`);
+  return globs.map((glob, i) => ({ after: i ? globs[i - 1] : parent, glob, why }));
+}
+
 const ADDED_SINCE_R101 = [
   // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
   // execution roots the merge resolver runs out of a cloned branch. The audit named four
@@ -263,6 +271,30 @@ const ADDED_SINCE_R101 = [
        + 'sub-Metic builders out of in spirit, so the real cost of this entry is three '
        + 'tasks that arguably should not have been open.',
   },
+  // task 1004024, owner decision 2026-09-22 (all five families). Each protected FILE below
+  // had been carved into `<name>-*.js` siblings and only the facade stayed registered. The
+  // carve tripwire further down is what found the four beyond the one the task named.
+  // Listed BY NAME, not as `<name>-*.js`: path-match (the goal scope wall) reads no '*'.
+  ...carve('src/bongos/auth.js', ['auth-admission', 'auth-config', 'auth-discord', 'auth-github', 'auth-idp'],
+    'the auth.js carve: session-token minting and the OAuth exchange, admission and '
+    + 'first-admin seating, IdP assertion checks.'),
+  ...carve('src/bongos/db.js', ['db-kernel'],
+    'the kernel slice carved out of db.js: builder identity and the rank reads the '
+    + 'SEC #863 entry exists for.'),
+  ...carve('scripts/gds/box.js', ['box-auth-check', 'box-sync'],
+    'the box.js family: the dev-box session-start auth gate and the box sync; box-infra.js '
+    + 'was already listed by name.'),
+  ...carve('modules/grading/grader.js', ['grader-config', 'grader-model', 'grader-no-artifact',
+    'grader-prompt', 'grader-score', 'grader-subagent'],
+    'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
+    + 'score guards a model cannot talk past.'),
+  ...carve('scripts/gds/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
+    'ship-finish', 'ship-flow', 'ship-git', 'ship-grade-steps', 'ship-grade', 'ship-honesty',
+    'ship-io', 'ship-land', 'ship-memory-sync', 'ship-merge-gate', 'ship-merge',
+    'ship-preflight-steps', 'ship-regen', 'ship-resume', 'ship-session-upload', 'ship-state',
+    'ship-surprise', 'ship-visual'],
+    'the 2026-08-23 ship.js carve: the land path, the ship state machine, the grade gate '
+    + 'steps and pushVia, ~6,200 lines behind a 373-line protected entry point.'),
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -392,6 +424,55 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
   }
 });
 
+// ---------- the carve tripwire: a protected FILE's `<name>-*.js` siblings are protected ----------
+//
+// task 1004024. Splitting a protected file into `<name>-<phase>.js` siblings is this repo's
+// carve convention, and every carve so far left only the facade registered: ship.js (21
+// files), grader.js (6), auth.js (5), db.js, box.js. A require()-graph rule was measured and
+// rejected — from the protected scripts it reaches 52 unprotected files (upgrade.js, login.js,
+// package-core.js…), floor-gating ordinary work. The name rule is the shape a carve leaves.
+function stemSiblings(entry, tracked) {
+  const dir = path.posix.dirname(entry);
+  const prefix = `${path.posix.basename(entry, '.js')}-`;
+  return tracked.filter((f) => path.posix.dirname(f) === dir
+    && path.posix.basename(f).startsWith(prefix) && f.endsWith('.js'));
+}
+
+test('no protected glob uses a wildcard — the goal scope wall could not read it', () => {
+  // permission-path-check reads '*', but module-scope-map derives ownership and the
+  // protected module set through path-match, which knows only an exact path or a '/'
+  // prefix. A wildcard here would protect files no module can own (task 1004024).
+  assert.deepEqual(ppc.PROTECTED_GLOBS.filter((g) => g.includes('*')), []);
+});
+
+test('stemSiblings finds a split-out file and nothing that merely resembles one', () => {
+  const tree = ['scripts/gds/ship.js', 'scripts/gds/ship-land.js', 'scripts/gds/shipper.js',
+    'scripts/gds/ship_x.js', 'scripts/gds/sub/ship-x.js', 'scripts/gds/ship-notes.md', 'src/ship-y.js'];
+  assert.deepEqual(stemSiblings('scripts/gds/ship.js', tree), ['scripts/gds/ship-land.js']);
+});
+
+test('every file split out of a protected file is itself protected (1004024 carve tripwire)', () => {
+  const tracked = execFileSync('git', ['ls-files', '*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+  const entries = ppc.PROTECTED_GLOBS.filter((g) => g.endsWith('.js') && !g.includes('*'));
+  let checked = 0;
+  for (const entry of entries) {
+    const floor = ppc.RANK_TIER[ppc.surfaceFor(entry).floor];
+    for (const rel of stemSiblings(entry, tracked)) {
+      checked += 1;
+      const surface = ppc.surfaceFor(rel);
+      assert.ok(surface,
+        `${rel} sits beside the protected ${entry} under its name — the shape a carve leaves — `
+        + 'but no protected surface covers it. Register it by name in '
+        + 'modules/government/protected-surfaces.json, declare it in ADDED_SINCE_R101, and '
+        + 'give it the parent\'s owning module in src/bongos/module-scope-map.js.');
+      assert.ok(ppc.RANK_TIER[surface.floor] >= floor,
+        `${rel} is floored at '${surface.floor}', below the ${entry} it was carved from.`);
+    }
+  }
+  assert.ok(checked >= 35, `fixture sanity: expected the five known carves (35 files), saw ${checked}`);
+});
+
 // ---------- the credential tripwire: every credential READER is a protected surface ----------
 //
 // task 1002891, from idea 1000692 (the grader's hacker worker, on the 1002690 re-grade).