@bongos/core 1.24.13 → 1.24.14

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.13",
-  "core_contract": "1.24.13",
-  "source_commit": "e466a714a21c96f64444afac06eaa4ac12158f89",
+  "core_version": "1.24.14",
+  "core_contract": "1.24.14",
+  "source_commit": "a8bce3546e79beaf3e48e96f57eee0a0c90d685d",
   "source_ref": "HEAD",
-  "built_at": "2026-10-30T15:58:31.506Z",
+  "built_at": "2026-10-30T16:11:41.715Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 630,
+    "docs_redacted": 631,
     "agent_docs_stubbed": 32,
     "functional_verbatim": 3765,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4428,
-  "tree_sha256": "1a908ac2230477c2b66c5f96d93a4444e66b8e2cc00942e901ebd0b414234a11",
+  "file_count": 4429,
+  "tree_sha256": "62e0df8d7d500331af5d9a5eb42591652f14ea807bb121ba205a69402ee6155c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2439,10 +2439,15 @@
       "mode": "0000644",
       "sha256": "7c13a3f082ab91435a181f8b197f1e46708cc1b24a9ad80463c74f3726280d70"
     },
+    {
+      "path": "docs/adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md",
+      "mode": "0000644",
+      "sha256": "286df23c58b4d03f62b0ce1bca17bd15b1fc41a145d6493fb26a74d099a16ea3"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "9eb0ee56f15eeac199fb9a4d16f4d74de34fde7fabb84ddc788de868c8198022"
+      "sha256": "bd34b72731c3b8bacb6c59813757a4d01316c7de452a0d2fe9e1e54eac2fc5d5"
     },
     {
       "path": "docs/api-reference.md",
@@ -2992,7 +2997,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6ba9fd4505685a5d6113d30257f4fddd39afee64203a035aea8c58258354b804"
+      "sha256": "375dbdae603dcfec7e46a3ee36c32d8e5308e7baca8a11a1252d794f86d595f1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -11597,12 +11602,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c058a256cb032ce496f27ec8a1ce577657e640fdcf773b3e177c989ff0d8850"
+      "sha256": "30edca16780978e941b3a104b175009f2a04ef7df84c6060946fb475076ec25d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f66bb55ee722f9f62c1af0c355b53f5da8334f585fe9c17187d2bcff767a6f50"
+      "sha256": "526a29506900ffaa89a8e0a57070c76657a995ec03b8d04c6903204264f7a39b"
     },
     {
       "path": "public-docs/index.html",
@@ -11622,7 +11627,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "402c1fbac055b75ef9c84089a435cf778d8d78d4ad555e4181020fbf7668a170"
+      "sha256": "10c04fa37c4a9eaa73363ca2ad7781722749e629979498fb9173405889296fb3"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -15467,7 +15472,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "150119c81c0b5d726a6ea88fc864f12b9566e789a40b7086c6664c5ddb8a129a"
+      "sha256": "12bee6c6e19dfd587725e1d269faa5c35d77d978cad13086771f14e9503d3bcb"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md

@@ -0,0 +1,71 @@
+# 0397 — The payment rail is Stripe Connect, one connected account per project; J.P. Morgan Payments is the written fallback
+
+- **Status:** Accepted for the choice of rail. Nothing is bought or opened by this record, and the counsel items below still gate every task that moves real money.
+- **Date:** 2026-10-30
+- **Deciders:** The owner chose Stripe on 2026-10-30, after the two options the legal framework names were set side by side. The fallback is the builder's recommendation, recorded because the task asks for one.
+- **Tasks:** [task 1004906](https://cloudbongos.com/builders#/task/1004906) (this decision). Unblocks the money tasks behind it in goal 1000092.
+- **Interacts with:** [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) (the per-flow map and the pay-type gates this fills in), [ADR 0388](0388-a-module-sale-is-split-by-the-project-the-buyer-pays-the-platform-fee.md) (the buyer-paid fee), [ADR 0392](0392-ai-generation-runs-on-a-processor-held-balance-and-the-builders-own-keys.md) (processor-held balance for AI generation).
+
+The owner's legal framework is a confidential draft. This record cites it by Article only. It is a product constraint for building, not legal advice, and it does not answer the counsel items listed at the end.
+
+## Context
+
+[ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) decided that a licensed processor, never Bongos, holds all user and project money, and left the processor itself to this task. The framework names two: Stripe Connect and J.P. Morgan Payments. The task asks for the cheapest option the framework permits, a fallback, and a comparison on cost, payout speed, failure handling and who files suspicious-activity reports. Nothing here is purchased without the owner's go-ahead.
+
+## Decision
+
+**1. The rail is Stripe Connect.** Both options keep funds with a licensed institution and so both satisfy Art. II. Stripe is chosen because it is the cheaper and faster one to start: no sales process or minimum volume to open, the marketplace pieces ADR 0385 needs already exist as products (below), and a builder can be built against it with the platform's own test mode before any account is opened.
+
+**2. Account structure: one connected account per project, and one per payee.** A project's money sits in that project's own connected account, held by Stripe, not in a balance owned by Cloud Bongos. A builder or contributor who is paid gets their own connected account, onboarded through the processor's hosted flow, which is also where identity, tax details, age and sanctions screening are collected (Art. VII, X, XI). Bongos stores the processor's account and transfer identifiers and its own append-only record of each movement and its cause, and never a balance it could spend. A balance on screen is a read of the processor's figure.
+
+**3. Each ADR 0385 flow maps to a Stripe Connect primitive.** The exact product for each row is confirmed against Stripe's current documentation when its build task starts; this table names the intended primitive so a flow with none is redesigned, not custom-built.
+
+| Flow | Stripe Connect primitive |
+| --- | --- |
+| Project funding | A charge to the funder, settled into the project's connected account |
+| Balance view | A read of the connected account's balance |
+| User-to-user payment | A transfer between connected accounts, on the payer's instruction |
+| Builder payout | A transfer from the project's connected account to the builder's, under the signed rule |
+| Contractor pay (our own) | The same transfer, with Cloud Bongos acting as a project through its own connected account |
+| Cash-out | A payout from the connected account to the user's bank |
+| Module sale | A charge to the buyer with an application fee, then transfers to the seller and contributors (ADR 0388) |
+
+**4. The cheapest permitted option is Stripe's standard published pricing at account opening.** The rates are not recorded here, because they change and because opening an account is the owner's act. The build tasks must read the rate from the account, never copy a number into code. J.P. Morgan Payments is priced by negotiation, so no cheaper figure can be shown for it without a sales conversation, and none was started.
+
+**5. Fallback: J.P. Morgan Payments.** It is the framework's other named rail and suits large volumes and bank-grade requirements. It is not the start because it normally comes with an onboarding process and volume expectations that the first payouts do not meet. The fallback applies if Stripe declines or restricts the platform, if payout reach or fees stop working for the volume, or if counsel's answer to item 3 needs a structure Stripe's account types do not offer. Every money-moving task keeps its processor calls behind one module boundary so a rail change replaces one adapter, not the product.
+
+**6. Who watches for suspicious activity.** The processor is the licensed party that monitors its accounts and files any required reports on money it holds. Bongos does not file on the processor's behalf and does not claim to. Bongos's own duties, such as holding a payout when a screen flags it and telling the person, stay as ADR 0385 decision 8 and the payout-gate tasks define them. Counsel confirms this split (item 3).
+
+**7. Failure handling.** A failed or returned transfer is a recorded movement with its reason, never a silent retry or a deletion. Bongos keeps its record and the processor's record side by side and checks them daily (a later task), with an alarm on drift. A payout the processor holds or rejects is shown to the person as held, with the reason the processor gives, and nothing is re-sent on its own.
+
+## Comparison
+
+| | Stripe Connect | J.P. Morgan Payments |
+| --- | --- | --- |
+| Cost to start | Standard published rates, no minimum to open | Negotiated; typically a sales process first |
+| Payout speed | Standard payouts in days by default; faster options exist | Strong bank rails; set by the agreement |
+| Marketplace pieces (connected accounts, hosted onboarding, application fees, transfers) | Built in | Possible, with more integration work |
+| Who monitors the held money | Stripe | JPMorgan |
+| Fit for first payouts | Yes | Later, at volume |
+
+Cost and speed rows describe how the two are generally offered. They were not quoted live for this record, and the first Stripe account's actual terms win over this table.
+
+## Consequences
+
+- [task 1003182](https://cloudbongos.com/builders#/task/1003182), [task 1003183](https://cloudbongos.com/builders#/task/1003183), [task 1004907](https://cloudbongos.com/builders#/task/1004907), [task 1004910](https://cloudbongos.com/builders#/task/1004910) and [task 1004911](https://cloudbongos.com/builders#/task/1004911) now name Stripe Connect as the primitive they map to.
+- No money-moving task ships before the owner opens the account and counsel clears items 1 to 4 of ADR 0385.
+- A processor adapter module is the only place that may name Stripe. Nothing else calls it directly.
+- Test mode first. No live key is created or stored by this task.
+
+## Held for counsel (unchanged by this record)
+
+1. Whether a standing signed payout rule satisfies the attributable-action requirement (Art. I).
+2. Whether a credit-weighted pool distribution creates stored value, a security or a wage-style fee problem.
+3. Agent-of-payee versus full pass-through, which account type that implies, and the exact split of monitoring duties in decision 6.
+4. Which entity collects the fee and which is the payee's agent.
+
+## Rejected
+
+- **J.P. Morgan Payments first.** Slower and dearer to start for volumes this small; kept as the fallback.
+- **One platform-owned Stripe balance for every project.** Makes Cloud Bongos the holder of project money (Art. II).
+- **Building our own ledger of user balances.** Same custody problem, and a second source of truth that can drift from the processor's.

package/docs/adr/README.md

@@ -512,3 +512,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0396 | [**Google sign-in: a stand-in login, one chooser, and a CLI sign-in approved in the browser** ([task 1004993](https://cloudbongos.com/builders#/task/1004993)). A Google-only person gets `~<handle>` as the core builder login, a value no GitHub login can be, and never on the hub record; they are found by Google's own id through the hub, never an email. Every sign-in link shows Continue with GitHub / Continue with Google; the CLI sign-in is approved on this site's own page from the browser cookie. Projects cannot take a Google-only person until task 1004994.](0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md) | identity / sign-in |
 | 0394 | [**Market Watch searches the web through the Messages API on the project's own key, and runs from its own clock-anchored poller** ([task 1004934](https://cloudbongos.com/builders#/task/1004934) · goal 1000137). Not the grade port: the server image has no `claude` CLI, and a measured tool-enabled run costs the same ($0.106 per item). One Sonnet 5 call per item with bounded web search and fetch, on an owner-set key in Settings (the project pays the provider; Bongos holds no money); an hourly, ledger-due, resumable poller on the daily-checks pattern, not the abandoned cron-router; capped per item before it starts and fail closed; about $4–5 per weekly 40-item run.](0394-market-watch-searches-through-the-messages-api-on-the-projects-key-and-runs-from-its-own-poller.md) | modules / economy |
 | 0395 | [**A task says what it needs, and each person's lists show only what they can do** ([task 1004950](https://cloudbongos.com/builders#/task/1004950)). `tasks.needs` ⊆ {owner, server} is its own set, not an `automation_tag` value (that one says whether work runs unattended). Capabilities are read fresh like rank: `owner` from the owner seat (founding builder fallback, the UAT reading), `server` from `builders.capability_grants`, set only by the owner. The recommend lists (claimable feed, optimizer, autonomous runner) show only tasks whose needs the viewer holds; the runner never holds owner. The claim refuses only `server` (`NEEDS_SERVER_ACCESS`, all three surfaces). Visibility elsewhere is unchanged; the board filters by need.](0395-a-task-says-what-it-needs-and-lists-show-only-what-you-can-do.md) | lifecycle / work tracking |
+| 0397 | [**The payment rail is Stripe Connect, one connected account per project; J.P. Morgan Payments is the fallback** ([task 1004906](https://cloudbongos.com/builders#/task/1004906), goal 1000092). The owner chose Stripe on 2026-10-30. Each project holds its money in its own connected account and each payee has one, so Cloud Bongos holds nothing (ADR 0385). Every flow in the ADR 0385 map is named against a Stripe primitive; a processor adapter module is the only place that names Stripe, so the fallback replaces one adapter. The processor is the party that monitors the money it holds. Test mode first; no live key is created, and counsel items 1 to 4 still gate real money.](0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) | economy / payments |

package/docs/module-api-changelog.md

@@ -3284,5 +3284,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.11 with no explicit bump. run 41049460782. (task 1002620)
   1.24.13 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.12 with no explicit bump. run 41085201279. (task 1002620)
+  1.24.14 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.13 with no explicit bump. run 41087502858. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.13",
+  "version": "1.24.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.13",
+      "version": "1.24.14",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.13",
+  "version": "1.24.14",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10921,5 +10921,11 @@
       "id": "1005017",
       "text": "The weekly Market Watch run now also reads the links members added to a tracked item, treating them safely as outside text and staying within its page-reading limit."
     }
+  ],
+  "1.24.14": [
+    {
+      "id": "1004906",
+      "text": "The payment processor is chosen: Stripe Connect. Each project's money will sit in its own Stripe account, so we never hold anyone's money. J.P. Morgan Payments is recorded as the backup. Nothing is bought or opened yet, and th"
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');