@bongos/core 1.20.4 → 1.20.5

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.4",
-  "core_contract": "1.20.4",
-  "source_commit": "cb1154ab6f5663fcf5ec4b1b2de9d59f4d53c0cf",
+  "core_version": "1.20.5",
+  "core_contract": "1.20.5",
+  "source_commit": "f8c753cef2672efe171e4fe602085b792e6386d1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T03:24:03.992Z",
+  "built_at": "2026-09-30T03:35:13.655Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 554,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3191,
-  "tree_sha256": "979ab93ed2588479c67154f837a646ebb982d48e470267a63835464662744650",
+  "tree_sha256": "1073eeb8e65fd705725fd70e257cdc88e19f13f523952cac80cd758b9c685d84",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -467,7 +467,7 @@
     {
       "path": "docs/adr/0015-task-dependencies-and-auto-promotion.md",
       "mode": "0000644",
-      "sha256": "c95897746c3198dc83165b12a72ecc42e7f9517875d2b388b5a240ae1baa4e57"
+      "sha256": "cd62924891d2e22400927574319b846a589733ff29a2de59ff1496aaafda66f6"
     },
     {
       "path": "docs/adr/0016-trust-boundary-server-enforced-permissions.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fc86b2b7f4ff0f0825ddbef82d3d33286d642a86e5f4dcf6fb62d6ad2efe3558"
+      "sha256": "15217249e22ff2fcfff4699248db09ff0df84d3a43ddace4d47349b7fdf8a203"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8822,12 +8822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a2051b26efcb3819d5b8190bff59b4695bbd0cd69efed2f95a4af8717e6a1c38"
+      "sha256": "d98f4919cb3c6dea66d2cc9fa26bdadd331a0477d218675a1f9044cef97bea31"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "895cf915952f0155ee5d26315afd456d0630e5ab39ce65c22fa10bc0fa5aa7ae"
+      "sha256": "496d627f9b1d7654c79d602684aa0c926f2d8826def762f62c74ea0a28a0fec0"
     },
     {
       "path": "public-docs/index.html",
@@ -8847,7 +8847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "b0f0a951c309fec69d3e8c0a4b30516bf56b1fcb4ce24490d84a89bd14ed01a0"
+      "sha256": "e1e71eaf5a604fcf92bd03ff51fd906531452bc989fe263b75a57a1588e9f7dc"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10947,7 +10947,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e3e6394ab165f0c08e998c0c43fe18d1ec92872a84490deb7a9a01712656c024"
+      "sha256": "9041c5f070b7321ff0d7f10452dcbcbe961edd273c0b26d94c496f0a238c1837"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0015-task-dependencies-and-auto-promotion.md

@@ -58,6 +58,8 @@ The function fires when `NEW.status='shipped' AND OLD.status<>'shipped'`. It sca
 
 `claimTasksBatch` does the same check per-task but treats batch-internal deps as "OK" (the batch is worked serially).
 
+**The batch caller owns the ordering (task 1004391).** "Worked serially" is a promise the caller makes, not one the system keeps. `claimTasksBatch` (now in [modules/lifecycle/db-claims.js](../../modules/lifecycle/db-claims.js), with its dry-run twin in the same file) only waives the claim-time check for a dependency that is claimed in the same batch; **nothing at ship time checks that the dependency shipped first**. Once both are claimed, a dependent can pass `completed`, `confirmed` and land on `main` before the task it depends on. Whoever claims a batch — a builder, `/builder-sequence`, the autonomous runner — must ship each in-batch dependency before its dependent. The owner chose to write this rule down rather than add a ship-time gate (which would change the protected ship pipeline); if dependents landing out of order ever causes real damage, the gate is the follow-up.
+
 ### API surface
 
 | Verb     | Path                                          | Body / returns                                           |

package/docs/module-api-changelog.md

@@ -2665,5 +2665,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.2 with no explicit bump. run 36662547009. (task 1002620)
   1.20.4 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.3 with no explicit bump. run 36664167210. (task 1002620)
+  1.20.5 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.4 with no explicit bump. run 36665024938. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.4",
+  "version": "1.20.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.4",
+      "version": "1.20.5",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.4",
+  "version": "1.20.5",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8064,5 +8064,11 @@
       "id": "1003418",
       "text": "The project's automatic checks now catch any document that describes a safety check which no longer exists. On its first run it found the README still telling people their code was scanned for leaked passwords by a tool that w"
     }
+  ],
+  "1.20.5": [
+    {
+      "id": "1004391",
+      "text": "Wrote down a rule: when several linked tasks are claimed together, whoever claims them must finish them in order. Nothing enforces it yet, by the owner's choice."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');