GAM 7.49.00 (automated bump)

CLAUDE.md

@@ -22,8 +22,8 @@ Each of these exists because something went wrong. Several have tests guarding t
    ran on a bare POST — against what the preview showed: a confirm step that posts the live form
    runs the changes its preview held (single-use `web/previews.py` token), never a rebuild of that
    form. `tests/test_write_routes_guarded.py` holds every POST route to this or a stated exemption.
-3. **Only read-only commands may become runnable automatically.** Of 1077 catalog entries, 540 run:
-   26 hand-curated (the only ones that can *change* anything) plus 514 grammar-derived commands
+3. **Only read-only commands may become runnable automatically.** Of 1078 catalog entries, 541 run:
+   26 hand-curated (the only ones that can *change* anything) plus 515 grammar-derived commands
    auto-promoted by `core/catalog/readbuilder.py` **because they are confidently `READ_ONLY` and not
    flagged uncertain**. Everything else is inert, syntax display only. Adding write coverage is a
    deliberate act of curation. (Two agent-facing docs once claimed only the 26 curated commands run —
@@ -119,7 +119,7 @@ make gam TAG=vX.Y.Z                 # re-vendor GAM (fails closed on an unpinned
 make app                            # build dist/GamGUI.app
 ```
 
-GAM is pinned at `EXPECTED_GAM_VERSION` in `core/gam/commands.py` (currently 7.48.30); three drift
+GAM is pinned at `EXPECTED_GAM_VERSION` in `core/gam/commands.py` (currently 7.49.00); three drift
 guards (`test_required_command_tokens_present`, `test_catalog_matches_grammar`,
 `test_pinned_version_consistent`) fail if a bump breaks a command we use. Bump with
 `scripts/bump_gam.py vX.Y.Z` — runbook in [build-packaging](docs/domains/build-packaging.md); the

README.md

@@ -110,8 +110,8 @@ new features go to [SwiftGamGui](https://github.com/goetchstone/SwiftGamGui). Wo
   password goes on a copyable, printable sheet, or Google emails it via GAM's `notify`), the role's
   OU and signature, its groups and shared calendars, a Google Tasks checklist for whoever does the
   setup, and a templated welcome email — for one person, or a CSV of hires as a background job.
-- **Command Builder** — browse/search the full categorized GAM catalog (1,077 commands, 540 of them
-  runnable: 26 hand-curated, the only ones that can change anything, plus 514 read-only commands
+- **Command Builder** — browse/search the full categorized GAM catalog (1,078 commands, 541 of them
+  runnable: 26 hand-curated, the only ones that can change anything, plus 515 read-only commands
   derived from GAM's grammar); curated commands get typed slots, drag-a-user targeting, a guarded
   preview → run, linear sequencing, and results export (CSV download or straight to a Google
   Sheet). Result tables slice like grep — a live row filter plus an **External only** toggle that

ROADMAP.md

@@ -47,8 +47,8 @@ around that is not on this list. See [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Later
 
-- **Grow the buildable command set — specifically the writes.** Of 1,077 catalog entries, 540 can
-  run today: 26 hand-curated commands (the only ones that can *change* anything) plus 514
+- **Grow the buildable command set — specifically the writes.** Of 1,078 catalog entries, 541 can
+  run today: 26 hand-curated commands (the only ones that can *change* anything) plus 515
   grammar-derived commands auto-promoted because they are confidently read-only. The other 537 —
   every write, and anything whose risk could not be inferred with confidence — are inert, syntax
   display only. That asymmetry is the safety boundary: a command can become runnable automatically
@@ -78,7 +78,7 @@ discover later.
   asked for it, so the effort goes elsewhere. The connector/core split is where you would start if
   that changed.
 - **A free-text `gam …` box.** The tempting escape hatch, and the trade-off is narrower than it
-  sounds. *Reads are already open*: 514 grammar-derived read commands run today with no curation at
+  sounds. *Reads are already open*: 515 grammar-derived read commands run today with no curation at
   all (the handful whose output is a secret or a file — backup codes, browser tokens, and every
   `get` download: Drive files and Docs, Keep attachments, ChromeOS device files, photos — are
   audited when run; SECURITY.md lists them). The line is drawn at **writes** — every command that can change something is hand-modeled, so

gamgui/core/gam/commands.py

@@ -21,7 +21,7 @@
 # `scripts/fetch_gam.sh` (TAG), the mock, and the version tests must all match this; that's enforced by
 # tests/test_command_contract.py so they can't drift. Bump deliberately via the "Updating GAM" runbook.
 # Compared (as a substring) against the running `gam version` for the fail-soft runtime self-check.
-EXPECTED_GAM_VERSION = "7.48.30"
+EXPECTED_GAM_VERSION = "7.49.00"
 
 # Roles accepted by Google Directory for group membership.
 GROUP_ROLES = ("member", "manager", "owner")

gamgui/resources/gam7/VERSION

@@ -1 +1 @@
-v7.48.30
+v7.49.00

scripts/fetch_gam.sh

@@ -13,7 +13,7 @@ REPO="GAM-team/GAM"
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DEST="$ROOT/gamgui/resources/gam7"
 # Pinned for reproducible builds. Override with `--tag latest` to grab the newest release.
-TAG="v7.48.30"
+TAG="v7.49.00"
 # Installing an asset we have no pinned hash for is opt-in: see the checksum gate below.
 ALLOW_UNPINNED=0
 

scripts/gam_checksums.txt

@@ -3,4 +3,4 @@
 # install on mismatch (catches a tampered / MITM'd / unexpected binary). Tracked in git so the pin
 # is reviewable. Update DELIBERATELY when bumping EXPECTED_GAM_VERSION (record the new asset's hash).
 # Format: <sha256>  <asset-filename>
-67fbad3d2343cddb5da7a8084c3f03b2c8d6786e8319ffdb6d692dbdefbd94cf  gam-7.48.30-macos26.6-arm64.tar.xz
+53a3a7d7f17b6ee3252b2e5bc0e247792892f90939a2e8ca323b1078d4d3934a  gam-7.49.00-macos26.6-arm64.tar.xz

tests/fixtures/mock_gam.sh

@@ -144,7 +144,7 @@ acl_notify_tail() {
 
 case "${1:-}" in
   version)
-    echo "GAM 7.48.30 - mock"
+    echo "GAM 7.49.00 - mock"
     exit 0
     ;;
 esac