@bongos/core 1.21.133 → 1.21.134

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.133",
-  "core_contract": "1.21.133",
-  "source_commit": "e3e005eed0218082a8724a9aa638657aced70c56",
+  "core_version": "1.21.134",
+  "core_contract": "1.21.134",
+  "source_commit": "7f0bb837924e95ccff5e553a687b228eef70ce30",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T20:42:02.660Z",
+  "built_at": "2026-10-15T21:28:31.615Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 607,
+    "docs_redacted": 608,
     "agent_docs_stubbed": 28,
     "functional_verbatim": 3149,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3785,
-  "tree_sha256": "cf35d4f10854a481a256f0d2cec544ac8af781a48de1b57c1c1d796da2247311",
+  "file_count": 3786,
+  "tree_sha256": "f5dfa49c3f439d7d10d733cc5f9c0940cf30172fa438d8757a49b7a6cd636fc8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2369,10 +2369,15 @@
       "mode": "0000644",
       "sha256": "12602b29d3a701e7ad1e6c411f7cbf6de3c3148b9c08624b6197968de8079c5f"
     },
+    {
+      "path": "docs/adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md",
+      "mode": "0000644",
+      "sha256": "ae20b78283a004ba64d66cd0eec7db2c0d1a6ba211560e37f99d188a94f11668"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6d2a97e2c7ce557aad5e82dd02c529dc05f0bdf6c014df9a812d3e65c7216763"
+      "sha256": "c5e8e4a27cf07799da677172e50a0c06d9be9bdf31f511416b40e392d268ffc0"
     },
     {
       "path": "docs/api-reference.md",
@@ -2922,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aea7064cd17fd4d1fc01c0200f2308dd2a86d619c5597a08ec6e48ed0fea84c1"
+      "sha256": "e77d3f864bca9f90cc1dbf2cfedd61dc315a27bb37084bbc8873ed144e7afa64"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10517,12 +10522,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1cd22cb8399eb1ee3a2d88e4daa62bf7e297bd5fe8c4b2dff3d479d22424397a"
+      "sha256": "16a65f4d7586e27be39c10448d7a39a0782725e1c050655e08ed930e3dc50ed5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fab9569c9c6d74288d0600330226824092a5f614cad6dc56fa2aeadc66390562"
+      "sha256": "f6a3dfa7fb0820113d9448f1b011a6e2edaeb3f06656d9530e2dbea160e112f0"
     },
     {
       "path": "public-docs/index.html",
@@ -10542,7 +10547,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f1ff443de9dc0455809075798cb9d83b321c92432a551e23531cd53487d9aad7"
+      "sha256": "0a7de5fe356b571a5dcaf748c830d457a365165d17b0d733594b6bfc89ef6267"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12897,7 +12902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e23647f9c7de84f53386722f8666995b6e49ee459ff78e037cef956c9d4874eb"
+      "sha256": "d253382a583b4d8ad6289d41cf1e5db7ebe264ed7bf54ab93b5b0b44f46b5135"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md

@@ -0,0 +1,64 @@
+# 0382 — A hardware security card is a passkey step-up check, switched on per builder by an Archon
+
+- **Status:** Proposed (research draft — nothing is built by this ADR)
+- **Date:** 2026-10-15
+- **Task:** task 1004676 (from idea 1001144)
+- **Decided by:** pending owner review
+- **Related:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary: the server enforces)
+
+## Context
+
+A builder should be able to tap an NFC card on a reader to prove who they are before reaching sensitive features. The owner has an NFC biometric card with FIDO on it and wants to test it.
+
+Findings from the code (2026-10-15):
+
+1. **No passkey / WebAuthn support exists.** `grep` over `src/` and `package.json` finds nothing. Sign-in is GitHub OAuth (`src/bongos/auth-github.js`) or, for hosted projects, the hub as identity provider (`auth-idp.js`). Both end in the same `builder_sessions` row (`auth.js`), and rank is read fresh from the DB on every request.
+2. **A step-up check fits the existing gates.** `requireBuilder` / `requireRank` / `requirePermission` in `auth.js` already run per request, so one more gate can ask "has this session proven a card recently?".
+3. **A plain RFID / PC-SC reader is not needed.** A FIDO2 card is a standard WebAuthn authenticator: the browser talks to it over NFC (or USB). No driver or PC/SC middleware is required for this path.
+
+## Decision
+
+**D1 — Use WebAuthn (FIDO2) via a vetted library** (`@simplewebauthn/server` + `@simplewebauthn/browser`). No hand-rolled CBOR/COSE parsing.
+
+**D2 — The card is a second factor, never the first.** GitHub (or hub) sign-in stays. The card adds a *step-up*: a session that has done a card check in the last **10 minutes** may reach the protected actions. The proof is a timestamp column on the server-side `builder_sessions` row, set only by the verify route; nothing the client sends counts as proof.
+
+**D3 — Register first.** A builder registers a card while signed in the normal way. The requirement can only be switched on for a builder who has at least one registered credential, so nobody is locked out by a switch. The Archon route refuses (409) when the builder has no credential.
+
+**D4 — An Archon switches the requirement on or off per builder.** Default is off for everyone. The switch is a server-side flag on the builder, set through an Archon-ranked route (rank checked fresh, per ADR 0016). Local file edits cannot flip it.
+
+**D5 — What the card guards (first cut, owner to confirm):** rank changes, deploy / go-live, session revocation, and any payout or treasury action. Chosen as the actions where a stolen session does the most damage.
+
+**D6 — Challenge and credential hygiene.** Random single-use challenges, server-stored, short-lived; verify origin and RP ID; `userVerification: 'required'` (the card's biometric is the second proof); credentials table with `credential_id`, `public_key`, `sign_count`, `transports`, `aaguid`, `nickname`, `created_at`, `last_used_at`; an opaque random user handle, never the email. A `sign_count` that goes backwards (when the card reports a counter) fails the check and is logged as a possible clone. Indexes on `credential_id` and `builder_id`. Challenges carry a TTL and are swept.
+
+**D7 — RP ID.** The RP ID is the registrable domain. Changing it later invalidates every credential, so it is set once, by the owner. Hosted projects on other subdomains need their own decision (one RP ID per host, or the hub as the sole place a card is checked).
+
+**D8 — Recovery is its own decision, not part of this ADR.** The owner will define the lost-card protocol. Until then the Archon off-switch (D4) is the recovery path, and a builder may register more than one card.
+
+## Alternatives considered
+
+- **PC/SC reader middleware** reading the card's UID: rejected. A UID is a copyable identifier, not a cryptographic proof, and it needs drivers on every machine.
+- **Card as the only login:** rejected. It removes the fallback and makes a lost card a lockout.
+
+## Testing and rollout
+
+- **Local:** passkeys work on `http://localhost`. Chrome DevTools' virtual authenticator tests without hardware; the real card is tested on the owner's machine.
+- **Rollout:** ship with the switch off for everyone (safe to land); the owner turns it on for their own account and tries the real card on the live site; then an Archon enables it builder by builder as cards are handed out.
+
+## Hardware and cost
+
+One FIDO2 NFC card (owner already has one), plus an NFC reader only if the computer has no NFC (a FIDO-compatible USB NFC reader is roughly $20–40). Phones with NFC need nothing extra.
+
+## Follow-up tasks
+
+Filed from this research: tasks 1004746 (registration page), 1004747 (step-up gate), 1004748 (Archon switch), 1004749 (lost-card recovery), and idea 1001246 (WebAuthn foundation). Sizing: one dependency, one table, roughly five small tasks, about a working week in total.
+
+1. WebAuthn foundation: library, credentials table, challenge store.
+2. Card registration page for a signed-in builder (+ list / rename / remove).
+3. The step-up gate and the protected actions of D5.
+4. The Archon per-builder switch (D4) and its audit-log entry.
+5. Lost-card recovery (waits on the owner's protocol).
+
+## Consequences
+
+- One new dependency and one new table; no change to how anyone signs in until the switch is turned on.
+- The protected-action list must be kept in step with new sensitive routes (a fitness check is a worthwhile follow-up).

package/docs/adr/README.md

@@ -500,3 +500,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0379 | [**The treasury is pots per goal, a reserve, and borrowing, over real spend** ([task 1004712](https://cloudbongos.com/builders#/task/1004712), goal 1000111). **D1:** spend is cost_log through each task's goal, this month, read every time. **D2:** a pot is a budget the Treasury's holder gives a goal (`government_pots`, government_031). **D3:** the reserve is last month's spend no pot was given, less loans; it may be overdrawn. **D4:** a dry pot files a borrow (poller), its ask stored on `treasury_spending:<id>` and routed to the Treasury. **D5:** answered once (lend, half, no) by its seat. **D6:** the spend cap is a project setting, off by default. **D7:** the docket source and the hall's pots, reserve, beacon and book are real.](0379-the-treasury-is-pots-per-goal-a-reserve-and-borrowing-over-real-spend.md) | government / treasury / city |
 | 0380 | [**A strictness preset is a bundle of laws, switched by one laws vote and read from the laws in force** ([task 1004715](https://cloudbongos.com/builders#/task/1004715), goal 1000111). **D1:** Open workshop, Guild, Factory are catalogues of laws in `presets.js`; every lock names a stored personal setting. **D2:** a switch is ONE laws amendment through `board.proposeLaws` (`POST /government/board/presets`); only its passing writes. **D3:** the preset in force is read from the laws in force, never stored; nothing is seeded. **D4:** `GET /government/presets` says what each would lock; My agents and the Charter are real.](0380-a-strictness-preset-is-a-bundle-of-laws-switched-by-one-laws-vote.md) | government / laws / my agents |
 | 0381 | [**The hub moves each hosted project's core on its own, by that project's update rule** ([task 1004729](https://cloudbongos.com/builders#/task/1004729), goal 1000090). Amends ADR 0293's "not automatic" for hosted projects. **D1:** after each snapshot the runner queues a preflight for `recommended`, then the move once that preflight passed. **D2:** through `enqueueIntent` as `runner:auto-upgrade`; never the control-plane row. **D3:** one automatic intent per tick. **D4:** a target that already failed or was refused is held (read from existing rows; task 1004730 is the richer hold). **D5:** `BONGOS_AUTO_CORE_UPGRADE=off` stops it platform-wide; default on; `pinned` is the per-project switch.](0381-the-hub-moves-each-hosted-project-by-its-update-rule.md) | provisioning / core upgrade / automation |
+| 0382 | [**A hardware card is a passkey step-up check, switched on per builder by an Archon** ([task 1004676](https://cloudbongos.com/builders#/task/1004676), proposed). No WebAuthn exists today; sign-in is GitHub OAuth or the hub IdP. **D1:** WebAuthn via a vetted library. **D2:** the card is a second factor, a server-recorded step-up, never the first. **D3:** register first; the requirement needs a registered card. **D4:** an Archon switches it on per builder, default off. **D5:** guards rank changes, deploy, session revoke, payouts. No PC/SC reader needed. Rejected: PC/SC middleware, card as sole login.](0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) | auth / security |

package/docs/module-api-changelog.md

@@ -3103,5 +3103,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.131 with no explicit bump. run 38783817499. (task 1002620)
   1.21.133 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.132 with no explicit bump. run 38803950047. (task 1002620)
+  1.21.134 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.133 with no explicit bump. run 38810062389. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.133",
+  "version": "1.21.134",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.133",
+      "version": "1.21.134",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.133",
+  "version": "1.21.134",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9800,5 +9800,11 @@
       "id": "1003463",
       "text": "The Goals page can now create a goal and add a done-when criterion to it."
     }
+  ],
+  "1.21.134": [
+    {
+      "id": "1004676",
+      "text": "Researched adding a tap-your-security-card check to Bongos. Plan written up and follow-up build work filed."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.133'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.134'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');