@bongos/core 1.21.111 → 1.21.112

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.111",
-  "core_contract": "1.21.111",
-  "source_commit": "a3e0196872aa25b75c2e6477c588bf9a3cc19b06",
+  "core_version": "1.21.112",
+  "core_contract": "1.21.112",
+  "source_commit": "20d2e0bfe68101dc84b13e8322b6c1dd35abcfe3",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T17:16:36.431Z",
+  "built_at": "2026-10-09T17:32:18.946Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 592,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3657,
-  "tree_sha256": "c31261294242b2cd66c134daea2ffb60526f5cfa809bbed76fee9c229436b1a9",
+  "tree_sha256": "8fb96168c1321372e872219e26f508d99b040b9ebce4ce6ca17e482c0216c0a0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -612,7 +612,7 @@
     {
       "path": "docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md",
       "mode": "0000644",
-      "sha256": "250ee61fac1aff3aa602a769a0b6fb2dcdac9f9abe9c61381d755a1b53a0eea2"
+      "sha256": "9127ee3f769616ad16e7151cb7f5f5a461690303804ce0ee7ddf6410f101dbd0"
     },
     {
       "path": "docs/adr/0044-mediterranean-palette-replacement.md",
@@ -2352,7 +2352,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "58b05e37108c25afa2d1d61a22c6fa0419ec2e242dacc3c1f8b7f7c70bd46ae2"
+      "sha256": "453a9449ea0dc1a5f50b1d786a4d5b14086423bfd02904c9a0df5c541347d144"
     },
     {
       "path": "docs/copy-inventory.md",
@@ -2872,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1665ae4a1fae5235c36e3a4d4d588de6d93817774de58ce40cd62e623e115a53"
+      "sha256": "c7506ded99bfae21631034eaeda8c97b705dc16fe06bbf4e2419a257f578f755"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10172,12 +10172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4ba883875bbc96c1d74b3e0ad996ea707dea726f16d20989a885b07bde0a8a5b"
+      "sha256": "c0b56b64fd6deff145189d27a3aec0713132b1112d2545617719ee5d29f5e714"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "69b4ae038049ccf22290a8ab298d08d04d4e8800619f11c24a9aea97614ad535"
+      "sha256": "3093047c8006d903bd5348bba1b43d9cd99f8dfd9ed19bb1575c8c92035a16b0"
     },
     {
       "path": "public-docs/index.html",
@@ -10197,7 +10197,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "aaa8e0550bc3b6b84184791498534dfe89d5accebc4c5e51220a95689c6a053e"
+      "sha256": "15e75913ea8e573944116d52fe5e44135ca7be4bc7a338cb6ee7d36f4b2a44d3"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12482,7 +12482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f10cbc790057ddb654dea27953fb735caba80cbc333d28a5b9253b44a852fd6b"
+      "sha256": "a59fd4faf5376d371522507f8d01e336f655e2871ca2b4409f59606cccdfa28f"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md

@@ -19,7 +19,7 @@ The SSH deploy failed (their box had no droplet key), but it didn't matter: the
 
 [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) put authority in `builders.rank` and enforced it **server-side per request** — but **only for `/api/gds/*` HTTP routes**. It explicitly does not cover two surfaces:
 
-1. **GitHub `main` is writable by every collaborator.** The repo is a **free-plan private repo**, so GitHub branch protection is *not available* ("Upgrade to GitHub Pro…"). All collaborators (`example-owner`, `LarsCode`, `willExample`, `IAMMASTERQUA`) have full push to `main`. The grader / confirm / rank gates live inside `ship.js` and the server — a raw `git push origin main` touches neither.
+1. **GitHub `main` is writable by every collaborator.** The repo is a **free-plan private repo**, so GitHub branch protection is *not available* ("Upgrade to GitHub Pro…"). All collaborators (`example-owner`, `LarsCode`, `willExample`, `IAMMASTERQUA`) have full push to `main`. The grader / confirm / rank gates live inside `ship.js` and the server — a raw `git push origin main` touches neither. *(As written at the time. Since 2026-08-08 `main` is protected — a pull request plus the `unit` check for every non-admin; see §"Branch-protection status" for the current probes.)*
 2. **The legit pipeline itself distributes the dangerous credentials.** `ship.js` does the merge-to-`main` and `ssh …deploy.sh` **client-side, from the builder's machine** — so the design hands every shipping builder the exact credentials needed to bypass it.
 
 A second, softer problem Lars raised: a sub-Metic builder had free rein to **read into and reason about the tiering/permission code** in the first place. Newcomers (`xenos`/`thetes`) should stay in their lane.
@@ -30,13 +30,13 @@ Two threads.
 
 ### A. Close the code-landing path (chosen: Option A now, Option B later)
 
-The protection goal is "un-graded code cannot reach prod, and a raw push to `main` is caught." Three layers, defense-in-depth, where **layer 3 is the authoritative enforcement** (the only one that survives a raw push / `--no-verify`, given GitHub can't block the push on the free plan):
+The protection goal is "un-graded code cannot reach prod, and a raw push to `main` is caught." Three layers, defense-in-depth, where **layer 3 is the authoritative enforcement** (the only one that survives a raw push / `--no-verify`, given GitHub couldn't block the push on the free plan when this was written). **Since 2026-08-08 GitHub does block a non-admin's direct push** — see §"Branch-protection status"; layer 3 stays authoritative for what branch protection does not cover (the admin's direct push, a self-merged PR with zero reviews, and *who* authored a protected path — the `unit` check passes a sub-Metic author as readily as anyone):
 
 | Layer | Mechanism | Catches | Authoritative? |
 |---|---|---|---|
 | 1 — pre-push hook | `.husky/pre-push` → `scripts/gds/hooks/pre-push.js`. Blocks a direct push to `main` (override `OTB_ALLOW_MAIN_PUSH=1`, used only by the gated `scripts/gds/push-main.js`), and blocks a sub-Metic push that touches a permission-sensitive path. | the cooperative / careless case before the push leaves the box | no — bypassable with `--no-verify` |
 | 2 — grader pre-pass | `grader.permissionPathPrePass(changedFiles, builderRank)` hard-fails the grade if a sub-Metic diff touches a protected path (mirrors the route-rank pre-pass). | the honest GDS ship flow | no — skippable with `--skip-grade` / raw push |
-| 3 — post-push main audit | `scripts/gds/main-audit.js`: reads the **real** git history + **real** builder ranks (roster API, or Postgres via `--db` on the droplet). A resolved sub-Metic author on a protected path is a hard `[BLOCKER]`. Runs nightly (`.claude/scheduled-tasks/main-audit/`) **and** as the deploy gate (`--verify-head --db` from `~/deploy.sh`, `infra/deploy-main-audit-gate.sh`). | a raw `git push origin main`, a `--no-verify`, a `--skip-grade` — anything | **yes** — independent of the builder's cooperation |
+| 3 — post-push main audit | `scripts/gds/main-audit.js`: reads the **real** git history + **real** builder ranks (roster API, or Postgres via `--db` on the droplet). A resolved sub-Metic author on a protected path is a hard `[BLOCKER]`. Runs nightly (`.claude/scheduled-tasks/main-audit/`) **and** as the deploy gate (`--verify-head --db` from `~/deploy.sh`, `infra/deploy-main-audit-gate.sh`). | a raw `git push origin main` (since 2026-08-08 only the admin's; a non-admin's is refused by GitHub), a self-merged PR, a `--no-verify`, a `--skip-grade` — anything | **yes** — independent of the builder's cooperation, and the only layer that judges the author's RANK; branch protection proves a PR + green `unit`, not who may touch a protected path |
 
 "Option A" = the merge-to-`main` + deploy move **server-side** so builders never hold main-push/droplet-SSH at all. The protections above ship now; the *full* server-side move and the credential rotation are operator steps (blockers [#15](https://example.com/builders#/blocker/15), [#16](https://example.com/builders#/blocker/16)). Until then, the legit client-side push is allowed only through `scripts/gds/push-main.js`, and the deploy gate (layer 3) is what guarantees poison never reaches prod.
 
@@ -69,7 +69,40 @@ After shipping, the fix was adversarially red-teamed (a 4-dimension panel + per-
 
 **Not yet done (finding `#7`, follow-up):** the permission-path pre-pass (layer 2) runs only client-side in `ship.js`; the server `/grade` and `/confirm` routes don't re-run it. Layer 3 is the server-side backstop today; re-running the pre-pass server-side (the server holds the live rank in `req.builder.rank`) would harden the cooperative path.
 
-## Branch-protection status: re-verified 2026-07-24 (task [#1001840](https://cloudbongos.com/builders#/task/1001840))
+## Branch-protection status: re-verified 2026-09-25 (task [1004669](https://cloudbongos.com/builders#/task/1004669))
+
+**Current. `main` IS protected — a pull request plus the `unit` check, for everyone but the admin.**
+Probed 2026-09-25 with the owner's (admin) GitHub account while checking task
+[1001433](https://cloudbongos.com/builders#/task/1001433); the protection itself landed 2026-08-08
+(task [1002619](https://cloudbongos.com/builders#/task/1002619)):
+
+| Probe | Result |
+|---|---|
+| `GET /repos/:o/:r/branches/main` | `protected: true` |
+| `GET /repos/:o/:r/branches/main/protection` | `required_status_checks.contexts: ["unit"]` (`strict: false`) · `required_pull_request_reviews` present, `required_approving_review_count: 0` · `enforce_admins: false` · `allow_force_pushes: false` · `allow_deletions: false` |
+| `GET /repos/:o/:r/rulesets` | `[]` — classic branch protection, not a ruleset |
+| Collaborators with write | four, plus the admin owner; all four are Metic or Archon on the public leaderboard |
+
+What this means for the claims above:
+
+- **No longer true:** "a raw `git push origin main` by any collaborator is accepted". A non-admin's
+  direct push is refused; their work reaches `main` only through a PR whose `unit` check is green.
+  Force-pushing and deleting `main` are refused for everyone.
+- **Still true:** the **admin** can push directly (`enforce_admins: false`); a write collaborator can
+  merge **their own** PR with zero reviews (the review count is 0 — the deliberate checks-only posture
+  of ADR 0162); and a builder **below Metic** reaches `main` only through the server's own publish
+  path (ADR 0055), never with a credential of their own.
+- **So layer 3 (`main-audit.js`) stays the authoritative rank check.** Branch protection proves a
+  change came through a PR with a green `unit` run; it says nothing about whether its author may touch
+  a protected path. Option B (blocker [17](https://cloudbongos.com/builders#/blocker/17)) is half-delivered:
+  direct push is closed for non-admins, but nothing restricts `main` to the owner plus a deploy bot.
+
+Treat this as the freshness stamp: re-run the probes above before asserting the claim has changed,
+and update this section — not the history below — when it does.
+
+## Branch-protection status: 2026-07-24 (history — superseded by the section above)
+
+_Originally headed "re-verified 2026-07-24 (task [1001840](https://cloudbongos.com/builders#/task/1001840))"; kept as written._
 
 The 2026-07-03 authority sweep reported that `main` had since gained live branch protection (required
 checks + code-owner review, direct push blocked), which would have demoted `main-audit.js` from
@@ -90,8 +123,8 @@ private repo with no protection available, and **layer 3 (`main-audit.js`) remai
 enforcement**, not a redundant second net. Option B (blocker
 [#17](https://cloudbongos.com/builders#/blocker/17)) is still open and still the durable closure.
 
-Treat this as the freshness stamp: re-run the probes above before asserting the claim has changed —
-a plan upgrade or a new ruleset would flip it, and this section is what a future sweep should update.
+This was the freshness stamp until the 2026-08-08 protection flipped it; the current stamp is the
+2026-09-25 section above.
 
 ## G-2/G-17 resolution: Layer 1 delivered; the "path bug" refuted (2026-08-08, task 1002608)
 

package/docs/canonical-permissions.md

@@ -290,12 +290,15 @@ Reading the code is not rank-gated today; what a builder can LAND is (next secti
 ADR 0016's per-request rank check covers `/api/bongos/*` only. Two surfaces it does **not** cover —
 `git push` to `main` and `ssh` to the droplet — were used in the Builder 25 incident to land an
 un-graded tiering change straight on prod `main`. **Since 2026-08-08 (task 1002619), `main` HAS
-live branch protection: the required `unit` status check blocks every direct push, so all work
-lands via PR.** The protection is *checks-only* — a code-owner review requirement was briefly
+live branch protection: a pull request plus the required `unit` status check, so a non-admin's
+direct push is refused and their work lands via PR.** Re-probed 2026-09-25 (task
+[1004669](https://cloudbongos.com/builders#/task/1004669)): `enforce_admins` is off, so the **admin**
+can still push directly; the PR needs **zero** approvals, so a write collaborator can merge their own;
+force-push and deletion of `main` are refused for everyone. The protection is *checks-only* — a code-owner review requirement was briefly
 enforced and then deliberately retired by the owner (ADR 0162, task 1002635): gates are
 rank-consistent CI checks, never a named human's approval. (The 2026-07-24 state — no protection
 at all, PR #19 merged with zero checks — is preserved in ADR 0043 §"Branch-protection status" as
-history.) `main-audit.js` remains the authoritative *post-merge* layer — it catches what any
+history, below the current 2026-09-25 probes.) `main-audit.js` remains the authoritative *post-merge* layer — it catches what any
 pre-merge gate misses, independent of the builder's cooperation:
 
 - A builder **below Metic** (`xenos`, `thetes`) may **not modify permission-sensitive paths** — the

package/docs/module-api-changelog.md

@@ -3059,5 +3059,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.109 with no explicit bump. run 37963285770. (task 1002620)
   1.21.111 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.110 with no explicit bump. run 37965024171. (task 1002620)
+  1.21.112 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.111 with no explicit bump. run 37966893511. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.111",
+  "version": "1.21.112",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.111",
+      "version": "1.21.112",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.111",
+  "version": "1.21.112",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9524,5 +9524,11 @@
       "id": "1004667",
       "text": "Lost bug screenshots can now be brought back. We used to tell people a missing screenshot from the Discord bugs channel was gone for good. That was wrong: only the link expires, and the picture stays in Discord as long as the"
     }
+  ],
+  "1.21.112": [
+    {
+      "id": "1004669",
+      "text": "The security record for the main branch now says what is actually true. It used to say anyone with access could push straight to the main code line. That stopped being true in August: now every change from a regular collaborat"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.111'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.112'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');