@bongos/core 1.24.66 → 1.24.67

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.66",
-  "core_contract": "1.24.66",
-  "source_commit": "c8dd200682525465ab4c31d562c49ede1a515404",
+  "core_version": "1.24.67",
+  "core_contract": "1.24.67",
+  "source_commit": "cb3a73a80b0216905417a6379f4caf4f66a159c2",
   "source_ref": "HEAD",
-  "built_at": "2026-11-09T19:50:40.752Z",
+  "built_at": "2026-11-09T20:07:37.283Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4575,
-  "tree_sha256": "8863cadeb49c7cd719e61a10cdc6f7fb0e2452e1e6e52089b74b997125377f11",
+  "tree_sha256": "ab4503425d89d4eec00873f68e4ed95088cb713b9816a7a0f3cc218da4f734d1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d9de836d931d1f89f45b5500fc6b7eceed36543deb0dc521decb3b1722074a69"
+      "sha256": "b2ea544c7a4c86e2c83d079531d105a0f8ade34933bfe96929c5bd8256dcea5c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5757,7 +5757,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "12308c4d0a2f58fe874ef8b3ed4698709869a42c24c08d2b72011bd81c0ff160"
+      "sha256": "0b54c64b1515a2208a8094e80a891e99e374a99bc26e99f70c81d592ef125cbc"
     },
     {
       "path": "modules/government/ranks.js",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6404eb74f3c63e5cbd0cc64d9a18d2a860b758a8077199241d508938f556ddb5"
+      "sha256": "02030268a28d3b76dc99198d41bf1de043460b72e8dedde3caa400b65c5ea4bf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e6fa2b150dfc6c0ebdd2fb524ba028608c04ff5d698ab8ab4be2cbc62a7c2501"
+      "sha256": "f18b77185a5d2b924bf459cc5415880fea61d1118f9a358f0691b8d703565120"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f21fea4a4cb0dd1eceb683e196ac37110931e63de4290b1d99614d747f30fb78"
+      "sha256": "576be7645a892c65c51e1ae3c8a17d7a5ecb2a2505cf9467dfff7a26b7aa5679"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "66cdc6ea2874f48cf67645553922f875fb60cfc951e7f075ac58ce2ab9adb660"
+      "sha256": "ab5adbd2f126b45470953b8c28545124554f69e04a1ba70494471d888288d509"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -18437,7 +18437,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "edbc428d065ead0a9fd9ba02218fa25f72f1646e594d01386f13256b0621490f"
+      "sha256": "de07f6405cc18311d0e048efcbc450bb15b270387a9579b53811ae4ac506c7e0"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -3386,5 +3386,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.64 with no explicit bump. run 42516347052. (task 1002620)
   1.24.66 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.65 with no explicit bump. run 42686885661. (task 1002620)
+  1.24.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.66 with no explicit bump. run 42689728958. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -104,6 +104,16 @@
     { "glob": "scripts/bongos/main-audit.js", "group": "pipeline", "why": "the post-push audit — the authoritative substrate layer (self-protect)" },
     { "glob": "scripts/bongos/push-main.js", "group": "pipeline", "why": "the sanctioned main-push (carries the override)" },
     { "glob": "scripts/bongos/run-unit-tests.js", "group": "pipeline", "why": "the unit-gate test SELECTOR — muting tests here blunts the CI gate (ADR 0058)" },
+    { "glob": "scripts/bongos/fitness.js", "group": "pipeline", "why": "task 1004383. The architecture fitness gate CI runs on every merge, including the module-migration DDL check task 1003373 extends. scripts/gds/fitness.js is only a forwarder to it (already under scripts/gds/); the real gate sat unprotected." },
+    { "glob": "scripts/bongos/fitness-checks-error-envelope.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-checks-identity.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-checks-packaging.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-checks-route-pins.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-checks-vocabulary.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-checks-write-validation.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-lib.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-migration-contraction.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
+    { "glob": "scripts/bongos/fitness-ratchets.js", "group": "pipeline", "why": "task 1004383. A check file of the fitness CI gate, split out beside fitness.js; protected with it under the 1004024 carve rule, since muting a check here blunts the gate." },
     { "glob": "scripts/bongos/hard-floor.js", "group": "pipeline", "why": "task 1004859. The trust-boundary hard-floor list (self-protect). It moved here from scripts/bongos/gate-review.js when that never-run CI classifier was removed; publish-manifest.js and adopt-preflight.js read it." },
     { "glob": "scripts/bongos/setup.js", "group": "pipeline", "why": "/builder-setup — installs the pre-push hook" },
     { "glob": "scripts/bongos/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.66",
+  "version": "1.24.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.66",
+      "version": "1.24.67",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.66",
+  "version": "1.24.67",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11399,5 +11399,11 @@
       "id": "1004384",
       "text": "Sessions that start on a claimed task no longer receive raw idea titles from Discord: hint titles are now cleaned and boxed off as data, and outside ideas are left out, so a planted instruction can't steer the agent. The hints"
     }
+  ],
+  "1.24.67": [
+    {
+      "id": "1004383",
+      "text": "The CI check that guards every merge is now protected, so a builder below Metic can no longer quietly switch its checks off. Protecting the credit-minting file was held back for the owner to decide, because it would lock the w"
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.66'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.67'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -350,6 +350,19 @@ const ADDED_SINCE_R101 = [
     glob: 'modules/lifecycle/claim-eligibility.js',
     why: "the queue axis of the claim gate: which tasks a builder's permissions let them claim at all.",
   },
+  // task 1004383 (2026-09-29 security-goal audit). The fitness CI gate: the filing task
+  // named scripts/gds/fitness.js, which by the claim was a forwarder already protected
+  // under scripts/gds/ — the real gate and its check files sat unprotected.
+  {
+    after: 'scripts/bongos/run-unit-tests.js',
+    glob: 'scripts/bongos/fitness.js',
+    why: 'the architecture fitness gate CI runs on every merge, including the module-'
+       + 'migration DDL check; muting a check here blunts the gate.',
+  },
+  ...carve('scripts/bongos/fitness.js', ['fitness-checks-error-envelope', 'fitness-checks-identity',
+    'fitness-checks-packaging', 'fitness-checks-route-pins', 'fitness-checks-vocabulary',
+    'fitness-checks-write-validation', 'fitness-lib', 'fitness-migration-contraction', 'fitness-ratchets'],
+    'a check file of the fitness CI gate, split out beside fitness.js.'),
   // task 1004546: the Autobongos self-edit wall. The grade of task 1004540 refused a
   // version whose guard lived in unprotected shared files, so it moved into these two
   // small ones and they sit beside the rest of the publish pipeline.
@@ -602,6 +615,23 @@ const AUTHZ_INVENTORY = [
   'permissionAllowsClaim', 'claimEligibilityAllows', // modules/lifecycle/claim-eligibility.js
 ];
 
+// task 1004383. The files that ACT on a grade or gate a merge — not just the grader itself.
+// db-grade.js writes the grade and attributes its credit (registered with the lifecycle/db.js
+// family, task 1004382); scripts/bongos/fitness.js is the CI gate, and the carve tripwire
+// above makes its fitness-*.js check files follow it. scripts/gds/fitness.js is only a
+// forwarder to it, already under scripts/gds/. modules/economy/credits.js is deliberately
+// NOT here: registering it walls the whole economy module, an owner decision (task 1005184).
+const GATE_ACTORS = ['modules/lifecycle/db-grade.js', 'scripts/bongos/fitness.js'];
+
+test('the grade write and the fitness CI gate are protected at Metic (1004383)', () => {
+  for (const rel of GATE_ACTORS) {
+    assert.ok(fs.existsSync(path.join(ROOT, rel)), `${rel} is gone — update GATE_ACTORS to where it moved`);
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface, `${rel} acts on a grade or gates a merge but no protected surface covers it.`);
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic, `${rel} is floored below Metic.`);
+  }
+});
+
 // Files (repo-relative) that DEFINE `name` as a function, out of the tracked non-test .js.
 function definitionSites(name, tracked, read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8')) {
   const re = new RegExp(`(?:^|[^\\w$.])(?:async\\s+)?function\\s*\\*?\\s*${name}\\s*\\(`